Libbpf eBPF macro bpf_core_field_offset
The bpf_core_field_offset macro is used to query the offset of a struct field on the kernel the program is being loaded on. The returned offset is in bytes.
Definition
#define bpf_core_field_offset(field...) \
__builtin_preserve_field_info(___bpf_field_ref(field), BPF_FIELD_BYTE_OFFSET)
Usage
The bpf_core_field_offset macro is used to query the offset of a struct field on the kernel the program is being loaded on. The returned size is in bytes.
Supports two forms:
- field reference through variable access:
bpf_core_field_offset(p->my_field) - field reference through type and field names:
bpf_core_field_offset(struct my_type, my_field)
This result is determined by the loader library such as libbpf, and set at load time and is considered as a constant value by the verifier.
Example
struct some_kernel_struct {
__u16 field1; // This field might be smaller or larger on the target kernel
__u32 field2;
}
SEC("kprobe")
int kprobe__example(struct pt_regs *ctx)
{
struct some_kernel_struct *a = PT_REGS_PARM1(ctx);
int field_offset = bpf_core_field_offset(a->field2)
// Do something with field_offset
// ...
return 0;
}