eBPF for Windows
bpf2c.h
Go to the documentation of this file.
1 // Copyright (c) Microsoft Corporation
2 // SPDX-License-Identifier: MIT
3 #pragma once
4 
5 #include "ebpf_structs.h"
6 
7 #if defined(NO_CRT)
8 typedef signed char int8_t;
9 typedef short int16_t;
10 typedef int int32_t;
11 typedef long long int64_t;
12 typedef unsigned char uint8_t;
13 typedef unsigned short uint16_t;
14 typedef unsigned int uint32_t;
15 typedef unsigned long long uint64_t;
16 #define bool _Bool
17 #define false 0
18 #define true 1
19 #define UINT32_MAX ((uint32_t)0xFFFFFFFF)
20 
21 #else
22 #include <stdbool.h>
23 #include <stddef.h>
24 #include <stdint.h>
25 #endif
26 
27 #ifdef __cplusplus
28 extern "C"
29 {
30 #endif
31 
32 #define UBPF_STACK_SIZE 512
33 
34 #define IMMEDIATE(X) (int32_t) X
35 #define OFFSET(X) (int16_t) X
36 #define POINTER(X) (uint64_t)(X)
37 
38 #if !defined(htobe16)
39 #define htobe16(X) swap16(X)
40 #define htobe32(X) swap32(X)
41 #define htobe64(X) swap64(X)
42 
43 #define htole16(X) (X)
44 #define htole32(X) (X)
45 #define htole64(X) (X)
46 #endif
47 
54  typedef struct _helper_function_entry
55  {
56  uint64_t (*address)(uint64_t r1, uint64_t r2, uint64_t r3, uint64_t r4, uint64_t r5);
57  uint32_t helper_id;
58  const char* name;
59  bool tail_call;
61 
67  typedef struct _map_entry
68  {
69  void* address;
71  const char* name;
73 
80  typedef struct _map_initial_values
81  {
82  const char* name; // Name of the map.
83  size_t count; // Number of values in the map.
84  const char** values; // Array of strings containing the initial values.
86 
91  typedef struct _program_entry
92  {
93  // DLLs put the strings into the same section, so add a marker
94  // at the start of a program entry to make it easy to find
95  // entries in the programs section.
96  uint64_t zero;
97 
98  uint64_t (*function)(void*);
99  const char* pe_section_name;
100  const char* section_name;
101  const char* program_name;
105  uint16_t helper_count;
109  const uint8_t* program_info_hash;
113 
119  typedef struct _bpf2c_version
120  {
121  uint32_t major;
122  uint32_t minor;
123  uint32_t revision;
125 
131  typedef struct _metadata_table
132  {
133  size_t size;
134  void (*programs)(
135  _Outptr_result_buffer_maybenull_(*count) program_entry_t** programs,
136  _Out_ size_t* count);
137  void (*maps)(
138  _Outptr_result_buffer_maybenull_(*count) map_entry_t** maps,
139  _Out_ size_t* count);
140  void (*hash)(
141  _Outptr_result_buffer_maybenull_(*size) const uint8_t** hash,
142  _Out_ size_t* size);
143  void (*version)(_Out_ bpf2c_version_t* version);
145  _Outptr_result_buffer_maybenull_(*count) map_initial_values_t** map_initial_values,
146  _Out_ size_t* count);
148 
155  inline uint16_t
156  swap16(uint16_t value)
157  {
158  return value << 8 | value >> 8;
159  }
160 
167  inline uint32_t
168  swap32(uint32_t value)
169  {
170  return swap16(value >> 16) | ((uint32_t)swap16(value & ((1 << 16) - 1))) << 16;
171  }
172 
179  inline uint64_t
180  swap64(uint64_t value)
181  {
182  return swap32(value >> 32) | ((uint64_t)swap32(value & ((1ull << 32ull) - 1))) << 32;
183  }
184 
185 #ifdef __cplusplus
186 }
187 #endif
uint64_t swap64(uint64_t value)
Inline function used to implement the 64 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition: bpf2c.h:180
struct _map_initial_values map_initial_values_t
Map initial values. This structure contains the initial values for a map. The values are used to init...
struct _map_entry map_entry_t
Map entry. This structure contains the address of the map and the map definition. The address is writ...
struct _helper_function_entry helper_function_entry_t
Helper function entry. This structure defines a helper function entry in the metadata table....
uint32_t swap32(uint32_t value)
Inline function used to implement the 32 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition: bpf2c.h:168
uint16_t swap16(uint16_t value)
Inline function used to implement the 16 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition: bpf2c.h:156
struct _program_entry program_entry_t
Program entry. This structure contains the address of the program and additional information about th...
struct _bpf2c_version bpf2c_version_t
Version information for the bpf2c compiler. This structure contains the version information for the b...
struct _metadata_table metadata_table_t
Metadata table for a module. This structure is returned by the module's metadata function,...
This file contains eBPF definitions common to eBPF programs, core execution engine as well as eBPF AP...
GUID ebpf_attach_type_t
Definition: ebpf_windows.h:44
GUID ebpf_program_type_t
Definition: ebpf_windows.h:43
Version information for the bpf2c compiler. This structure contains the version information for the b...
Definition: bpf2c.h:120
uint32_t major
Definition: bpf2c.h:121
uint32_t revision
Definition: bpf2c.h:123
uint32_t minor
Definition: bpf2c.h:122
eBPF Map Definition as it appears in the maps section of an ELF file.
Definition: ebpf_structs.h:125
Helper function entry. This structure defines a helper function entry in the metadata table....
Definition: bpf2c.h:55
bool tail_call
Definition: bpf2c.h:59
const char * name
Definition: bpf2c.h:58
uint64_t(* address)(uint64_t r1, uint64_t r2, uint64_t r3, uint64_t r4, uint64_t r5)
Definition: bpf2c.h:56
uint32_t helper_id
Definition: bpf2c.h:57
Map entry. This structure contains the address of the map and the map definition. The address is writ...
Definition: bpf2c.h:68
ebpf_map_definition_in_file_t definition
Definition: bpf2c.h:70
void * address
Definition: bpf2c.h:69
const char * name
Definition: bpf2c.h:71
Map initial values. This structure contains the initial values for a map. The values are used to init...
Definition: bpf2c.h:81
const char ** values
Definition: bpf2c.h:84
size_t count
Definition: bpf2c.h:83
const char * name
Definition: bpf2c.h:82
Metadata table for a module. This structure is returned by the module's metadata function,...
Definition: bpf2c.h:132
void(* version)(bpf2c_version_t *version)
Definition: bpf2c.h:143
size_t size
Size of this structure. Used for versioning.
Definition: bpf2c.h:133
void(* map_initial_values)((*count) map_initial_values_t **map_initial_values, size_t *count)
Returns the list of initial values for maps in this module.
Definition: bpf2c.h:144
void(* programs)((*count) program_entry_t **programs, size_t *count)
Returns the list of programs in this module.
Definition: bpf2c.h:134
void(* hash)((*size) const uint8_t **hash, size_t *size)
Returns the hash of the ELF file used to generate this module.
Definition: bpf2c.h:140
void(* maps)((*count) map_entry_t **maps, size_t *count)
Returns the list of maps in this module.
Definition: bpf2c.h:137
Program entry. This structure contains the address of the program and additional information about th...
Definition: bpf2c.h:92
uint16_t helper_count
Number of helper functions used by the program.
Definition: bpf2c.h:105
uint64_t zero
Definition: bpf2c.h:96
const char * program_info_hash_type
Type of the program info hash.
Definition: bpf2c.h:111
uint16_t referenced_map_count
Number of maps referenced by the program.
Definition: bpf2c.h:103
const char * program_name
Name of the program.
Definition: bpf2c.h:101
size_t bpf_instruction_count
Number of BPF instructions in the program.
Definition: bpf2c.h:106
size_t program_info_hash_length
Length of the program info hash.
Definition: bpf2c.h:110
uint16_t * referenced_map_indices
List of map indices referenced by the program.
Definition: bpf2c.h:102
ebpf_attach_type_t * expected_attach_type
Expected attach type of the program.
Definition: bpf2c.h:108
const char * pe_section_name
Name of the PE section containing the program.
Definition: bpf2c.h:99
const uint8_t * program_info_hash
Hash of the program info.
Definition: bpf2c.h:109
const char * section_name
Name of the section containing the program.
Definition: bpf2c.h:100
ebpf_program_type_t * program_type
Type of the program.
Definition: bpf2c.h:107
helper_function_entry_t * helpers
List of helper functions used by the program.
Definition: bpf2c.h:104