8typedef signed char int8_t;
11typedef long long int64_t;
12typedef unsigned char uint8_t;
13typedef unsigned short uint16_t;
14typedef unsigned int uint32_t;
15typedef unsigned long long uint64_t;
19#define UINT32_MAX ((uint32_t)0xFFFFFFFF)
32#define UBPF_STACK_SIZE 512
34#define IMMEDIATE(X) (int32_t)(X)
35#define OFFSET(X) (int16_t)(X)
36#define POINTER(X) (uint64_t)(X)
38#define READ_ONCE_64(destination, source, offset) \
39 destination = (uint64_t)ReadNoFence64((volatile const long long*)(source + offset))
40#define READ_ONCE_32(destination, source, offset) \
41 destination = (uint32_t)ReadNoFence((volatile const long*)(source + offset))
42#define READ_ONCE_16(destination, source, offset) \
43 destination = (uint16_t)ReadNoFence16((volatile const short*)(source + offset))
44#define READ_ONCE_8(destination, source, offset) \
45 destination = (uint8_t)ReadNoFence8((volatile const char*)(source + offset))
48#define READ_ONCE_S32(destination, source, offset) \
49 destination = (uint64_t)(int64_t)(int32_t)ReadNoFence((volatile const long*)(source + offset))
50#define READ_ONCE_S16(destination, source, offset) \
51 destination = (uint64_t)(int64_t)(int16_t)ReadNoFence16((volatile const short*)(source + offset))
52#define READ_ONCE_S8(destination, source, offset) \
53 destination = (uint64_t)(int64_t)(int8_t)ReadNoFence8((volatile const char*)(source + offset))
55#define WRITE_ONCE_64(destination, source, offset) \
56 WriteNoFence64((volatile long long*)(destination + offset), (long long)source)
57#define WRITE_ONCE_32(destination, source, offset) WriteNoFence((volatile long*)(destination + offset), (long)source)
58#define WRITE_ONCE_16(destination, source, offset) \
59 WriteNoFence16((volatile short*)(destination + offset), (short)source)
60#define WRITE_ONCE_8(destination, source, offset) WriteNoFence8((volatile char*)(destination + offset), (char)source)
63#define htobe16(X) swap16(X)
64#define htobe32(X) swap32(X)
65#define htobe64(X) swap64(X)
72#if !defined(UNREFERENCED_PARAMETER)
73#define UNREFERENCED_PARAMETER(P) (P)
76 typedef uint64_t (*
helper_function_t)(uint64_t, uint64_t, uint64_t, uint64_t, uint64_t,
void*);
226 _Out_
size_t* count);
229 _Out_
size_t* count);
231 _Outptr_result_buffer_maybenull_(*
size)
const uint8_t**
hash,
236 _Out_
size_t* count);
239 _Out_
size_t* count);
251 return value << 8 | value >> 8;
263 return swap16(value >> 16) | ((uint32_t)
swap16(value & ((1 << 16) - 1))) << 16;
275 return swap32(value >> 32) | ((uint64_t)
swap32(value & ((1ull << 32ull) - 1))) << 32;
278#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION 1
279#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(helper_function_entry_t, name)
280#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_TOTAL_SIZE sizeof(helper_function_entry_t)
281#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_HEADER \
282 {EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION, \
283 EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_SIZE, \
284 EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_TOTAL_SIZE}
286#define EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION 1
287#define EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_SIZE \
288 EBPF_SIZE_INCLUDING_FIELD(helper_function_data_t, tail_call)
289#define EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_TOTAL_SIZE sizeof(helper_function_data_t)
290#define EBPF_NATIVE_HELPER_FUNCTION_DATA_HEADER \
291 {EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION, \
292 EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_SIZE, \
293 EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_TOTAL_SIZE}
295#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_ENTRY_CURRENT_VERSION 1
296#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_ENTRY_CURRENT_VERSION_SIZE \
297 EBPF_SIZE_INCLUDING_FIELD(btf_resolved_function_entry_t, module_guid)
298#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_ENTRY_CURRENT_VERSION_TOTAL_SIZE sizeof(btf_resolved_function_entry_t)
299#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_ENTRY_HEADER \
300 {EBPF_NATIVE_BTF_RESOLVED_FUNCTION_ENTRY_CURRENT_VERSION, \
301 EBPF_NATIVE_BTF_RESOLVED_FUNCTION_ENTRY_CURRENT_VERSION_SIZE, \
302 EBPF_NATIVE_BTF_RESOLVED_FUNCTION_ENTRY_CURRENT_VERSION_TOTAL_SIZE}
304#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_DATA_CURRENT_VERSION 1
305#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_DATA_CURRENT_VERSION_SIZE \
306 EBPF_SIZE_INCLUDING_FIELD(btf_resolved_function_data_t, address)
307#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_DATA_CURRENT_VERSION_TOTAL_SIZE sizeof(btf_resolved_function_data_t)
308#define EBPF_NATIVE_BTF_RESOLVED_FUNCTION_DATA_HEADER \
309 {EBPF_NATIVE_BTF_RESOLVED_FUNCTION_DATA_CURRENT_VERSION, \
310 EBPF_NATIVE_BTF_RESOLVED_FUNCTION_DATA_CURRENT_VERSION_SIZE, \
311 EBPF_NATIVE_BTF_RESOLVED_FUNCTION_DATA_CURRENT_VERSION_TOTAL_SIZE}
313#define EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION 1
314#define EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(map_entry_t, name)
315#define EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_TOTAL_SIZE sizeof(map_entry_t)
316#define EBPF_NATIVE_MAP_ENTRY_HEADER \
317 {EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION, \
318 EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_SIZE, \
319 EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_TOTAL_SIZE}
321#define EBPF_NATIVE_MAP_DATA_CURRENT_VERSION 1
322#define EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(map_data_t, array_data)
323#define EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_TOTAL_SIZE sizeof(map_data_t)
324#define EBPF_NATIVE_MAP_DATA_HEADER \
325 {EBPF_NATIVE_MAP_DATA_CURRENT_VERSION, \
326 EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_SIZE, \
327 EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_TOTAL_SIZE}
329#define EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION 1
330#define EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_SIZE \
331 EBPF_SIZE_INCLUDING_FIELD(program_entry_t, btf_resolved_function_count)
332#define EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_TOTAL_SIZE sizeof(program_entry_t)
333#define EBPF_NATIVE_PROGRAM_ENTRY_HEADER \
334 {EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION, \
335 EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_SIZE, \
336 EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_TOTAL_SIZE}
338#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION 1
339#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_SIZE \
340 EBPF_SIZE_INCLUDING_FIELD(program_runtime_context_t, btf_resolved_function_data)
341#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_TOTAL_SIZE sizeof(program_runtime_context_t)
342#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_HEADER \
343 {EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION, \
344 EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_SIZE, \
345 EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_TOTAL_SIZE}
347#define EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION 1
348#define EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(map_initial_values_t, values)
349#define EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_TOTAL_SIZE sizeof(map_initial_values_t)
350#define EBPF_NATIVE_MAP_INITIAL_VALUES_HEADER \
351 {EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION, \
352 EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_SIZE, \
353 EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_TOTAL_SIZE}
355#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION 1
356#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_SIZE \
357 EBPF_SIZE_INCLUDING_FIELD(global_variable_section_info_t, initial_data)
358#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_TOTAL_SIZE sizeof(global_variable_section_info_t)
359#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_HEADER \
360 {EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION, \
361 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_SIZE, \
362 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_TOTAL_SIZE}
364#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION 1
365#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_SIZE \
366 EBPF_SIZE_INCLUDING_FIELD(global_variable_section_data_t, address_of_map_value)
367#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_TOTAL_SIZE sizeof(global_variable_section_data_t)
368#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_HEADER \
369 {EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION, \
370 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_SIZE, \
371 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_TOTAL_SIZE}
373#define EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION 1
374#define EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(metadata_table_t, map_initial_values)
375#define EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_TOTAL_SIZE sizeof(metadata_table_t)
376#define EBPF_NATIVE_METADATA_TABLE_HEADER \
377 {EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION, \
378 EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_SIZE, \
379 EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_TOTAL_SIZE}
struct _program_runtime_context program_runtime_context_t
struct _global_variable_section_info global_variable_section_info_t
struct _helper_function_data helper_function_data_t
uint64_t swap64(uint64_t value)
Inline function used to implement the 64 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition bpf2c.h:273
uint64_t(* helper_function_t)(uint64_t, uint64_t, uint64_t, uint64_t, uint64_t, void *)
Definition bpf2c.h:76
struct _map_initial_values map_initial_values_t
Map initial values. This structure contains the initial values for a map. The values are used to init...
struct _map_entry map_entry_t
Map entry. This structure contains the address of the map and the map definition. The address is writ...
struct _helper_function_entry helper_function_entry_t
Helper function entry. This structure defines a helper function entry in the metadata table....
uint32_t swap32(uint32_t value)
Inline function used to implement the 32 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition bpf2c.h:261
struct _btf_resolved_function_data btf_resolved_function_data_t
struct _global_variable_section_data global_variable_section_data_t
uint16_t swap16(uint16_t value)
Inline function used to implement the 16 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition bpf2c.h:249
struct _program_entry program_entry_t
Program entry. This structure contains the address of the program and additional information about th...
struct _btf_resolved_function_entry btf_resolved_function_entry_t
struct _bpf2c_version bpf2c_version_t
Version information for the bpf2c compiler. This structure contains the version information for the b...
struct _metadata_table metadata_table_t
Metadata table for a module. This structure is returned by the module's metadata function,...
struct _map_data map_data_t
This file contains eBPF definitions common to eBPF programs, core execution engine as well as eBPF AP...
GUID ebpf_attach_type_t
Definition ebpf_windows.h:67
GUID ebpf_program_type_t
Definition ebpf_windows.h:66
uint8_t GUID[16]
Definition ebpf_windows.h:12
Version information for the bpf2c compiler. This structure contains the version information for the b...
Definition bpf2c.h:210
uint32_t major
Definition bpf2c.h:211
uint32_t revision
Definition bpf2c.h:213
uint32_t minor
Definition bpf2c.h:212
ebpf_native_module_header_t header
Definition bpf2c.h:107
helper_function_t address
Definition bpf2c.h:108
_Field_z_ const char * name
Definition bpf2c.h:101
GUID module_guid
Definition bpf2c.h:102
ebpf_native_module_header_t header
Definition bpf2c.h:100
eBPF Map Definition as it appears in the maps section of an ELF file.
Definition ebpf_structs.h:126
unsigned char * address_of_map_value
Definition bpf2c.h:160
ebpf_native_module_header_t header
Definition bpf2c.h:159
size_t size
Definition bpf2c.h:153
const void * initial_data
Definition bpf2c.h:154
const char * name
Definition bpf2c.h:152
ebpf_native_module_header_t header
Definition bpf2c.h:151
bool tail_call
Definition bpf2c.h:95
helper_function_t address
Definition bpf2c.h:94
ebpf_native_module_header_t header
Definition bpf2c.h:93
Helper function entry. This structure defines a helper function entry in the metadata table....
Definition bpf2c.h:85
const char * name
Definition bpf2c.h:88
uint32_t helper_id
Definition bpf2c.h:87
ebpf_native_module_header_t header
Definition bpf2c.h:86
uintptr_t address
Definition bpf2c.h:131
uint8_t * array_data
Direct pointer to array map data (NULL for non-array maps).
Definition bpf2c.h:132
ebpf_native_module_header_t header
Definition bpf2c.h:130
Map entry. This structure contains the address of the map and the map definition. The address is writ...
Definition bpf2c.h:117
ebpf_map_definition_in_file_t definition
Definition bpf2c.h:124
uint64_t zero_marker[2]
Definition bpf2c.h:121
ebpf_native_module_header_t header
Definition bpf2c.h:123
const char * name
Definition bpf2c.h:125
Map initial values. This structure contains the initial values for a map. The values are used to init...
Definition bpf2c.h:142
const char ** values
Definition bpf2c.h:146
size_t count
Definition bpf2c.h:145
ebpf_native_module_header_t header
Definition bpf2c.h:143
const char * name
Definition bpf2c.h:144
Program entry. This structure contains the address of the program and additional information about th...
Definition bpf2c.h:177
uint16_t helper_count
Number of helper functions used by the program.
Definition bpf2c.h:191
uint64_t zero
Definition bpf2c.h:181
const char * program_info_hash_type
Type of the program info hash.
Definition bpf2c.h:197
uint16_t referenced_map_count
Number of maps referenced by the program.
Definition bpf2c.h:189
const char * program_name
Name of the program.
Definition bpf2c.h:187
size_t bpf_instruction_count
Number of BPF instructions in the program.
Definition bpf2c.h:192
uint64_t(* function)(void *, const program_runtime_context_t *)
Address of the program.
Definition bpf2c.h:184
ebpf_native_module_header_t header
Definition bpf2c.h:183
size_t program_info_hash_length
Length of the program info hash.
Definition bpf2c.h:196
uint16_t * referenced_map_indices
List of map indices referenced by the program.
Definition bpf2c.h:188
uint16_t btf_resolved_function_count
Number of BTF-resolved functions used by the program.
Definition bpf2c.h:201
ebpf_attach_type_t * expected_attach_type
Expected attach type of the program.
Definition bpf2c.h:194
const char * pe_section_name
Name of the PE section containing the program.
Definition bpf2c.h:185
const uint8_t * program_info_hash
Hash of the program info.
Definition bpf2c.h:195
const char * section_name
Name of the section containing the program.
Definition bpf2c.h:186
_Field_size_(btf_resolved_function_count) btf_resolved_function_entry_t *btf_resolved_functions
ebpf_program_type_t * program_type
Type of the program.
Definition bpf2c.h:193
helper_function_entry_t * helpers
List of helper functions used by the program.
Definition bpf2c.h:190
map_data_t * map_data
Definition bpf2c.h:167
global_variable_section_data_t * global_variable_section_data
Definition bpf2c.h:168
helper_function_data_t * helper_data
Definition bpf2c.h:166
ebpf_native_module_header_t header
Definition bpf2c.h:165
btf_resolved_function_data_t * btf_resolved_function_data
Definition bpf2c.h:169