eBPF for Windows
Loading...
Searching...
No Matches
bpf2c.h
Go to the documentation of this file.
1// Copyright (c) eBPF for Windows contributors
2// SPDX-License-Identifier: MIT
3#pragma once
4
5#include "ebpf_structs.h"
6
7#if defined(NO_CRT)
8typedef signed char int8_t;
9typedef short int16_t;
10typedef int int32_t;
11typedef long long int64_t;
12typedef unsigned char uint8_t;
13typedef unsigned short uint16_t;
14typedef unsigned int uint32_t;
15typedef unsigned long long uint64_t;
16#define bool _Bool
17#define false 0
18#define true 1
19#define UINT32_MAX ((uint32_t)0xFFFFFFFF)
20
21#else
22#include <stdbool.h>
23#include <stddef.h>
24#include <stdint.h>
25#endif
26
27#ifdef __cplusplus
28extern "C"
29{
30#endif
31
32#define UBPF_STACK_SIZE 512
33
34#define IMMEDIATE(X) (int32_t)(X)
35#define OFFSET(X) (int16_t)(X)
36#define POINTER(X) (uint64_t)(X)
37
38#define READ_ONCE_64(destination, source, offset) \
39 destination = (uint64_t)ReadNoFence64((volatile const long long*)(source + offset))
40#define READ_ONCE_32(destination, source, offset) \
41 destination = (uint32_t)ReadNoFence((volatile const long*)(source + offset))
42#define READ_ONCE_16(destination, source, offset) \
43 destination = (uint16_t)ReadNoFence16((volatile const short*)(source + offset))
44#define READ_ONCE_8(destination, source, offset) \
45 destination = (uint8_t)ReadNoFence8((volatile const char*)(source + offset))
46
47// Sign-extending load macros for RFC 9669 LDXSB/LDXSH/LDXSW instructions.
48#define READ_ONCE_S32(destination, source, offset) \
49 destination = (uint64_t)(int64_t)(int32_t)ReadNoFence((volatile const long*)(source + offset))
50#define READ_ONCE_S16(destination, source, offset) \
51 destination = (uint64_t)(int64_t)(int16_t)ReadNoFence16((volatile const short*)(source + offset))
52#define READ_ONCE_S8(destination, source, offset) \
53 destination = (uint64_t)(int64_t)(int8_t)ReadNoFence8((volatile const char*)(source + offset))
54
55#define WRITE_ONCE_64(destination, source, offset) \
56 WriteNoFence64((volatile long long*)(destination + offset), (long long)source)
57#define WRITE_ONCE_32(destination, source, offset) WriteNoFence((volatile long*)(destination + offset), (long)source)
58#define WRITE_ONCE_16(destination, source, offset) \
59 WriteNoFence16((volatile short*)(destination + offset), (short)source)
60#define WRITE_ONCE_8(destination, source, offset) WriteNoFence8((volatile char*)(destination + offset), (char)source)
61
62#if !defined(htobe16)
63#define htobe16(X) swap16(X)
64#define htobe32(X) swap32(X)
65#define htobe64(X) swap64(X)
66
67#define htole16(X) (X)
68#define htole32(X) (X)
69#define htole64(X) (X)
70#endif
71
72#if !defined(UNREFERENCED_PARAMETER)
73#define UNREFERENCED_PARAMETER(P) (P)
74#endif
75
76 typedef uint64_t (*helper_function_t)(uint64_t, uint64_t, uint64_t, uint64_t, uint64_t, void*);
77
90
97
103 typedef struct _map_entry
104 {
105 // DLLs put the strings into the same section with 4, 8 or 16
106 // byte alignment, so add a 16-byte marker at the start of a map
107 // entry to make it easy to find entries in the maps section.
108 uint64_t zero_marker[2];
109
112 const char* name;
114
121
128 typedef struct _map_initial_values
129 {
131 const char* name; // Name of the map.
132 size_t count; // Number of values in the map.
133 const char** values; // Array of strings containing the initial values.
135
143
149
157
162 typedef struct _program_entry
163 {
164 // DLLs put the strings into the same section, so add a marker
165 // at the start of a program entry to make it easy to find
166 // entries in the programs section.
167 uint64_t zero;
168
170 uint64_t (*function)(void*, const program_runtime_context_t*);
171 const char* pe_section_name;
172 const char* section_name;
173 const char* program_name;
177 uint16_t helper_count;
181 const uint8_t* program_info_hash;
185
191 typedef struct _bpf2c_version
192 {
193 uint32_t major;
194 uint32_t minor;
195 uint32_t revision;
197
203 typedef struct _metadata_table
204 {
205 size_t size;
206 void (*programs)(
207 _Outptr_result_buffer_maybenull_(*count) program_entry_t** programs,
208 _Out_ size_t* count);
209 void (*maps)(
210 _Outptr_result_buffer_maybenull_(*count) map_entry_t** maps,
211 _Out_ size_t* count);
212 void (*hash)(
213 _Outptr_result_buffer_maybenull_(*size) const uint8_t** hash,
214 _Out_ size_t* size);
217 _Outptr_result_buffer_maybenull_(*count) map_initial_values_t** map_initial_values,
218 _Out_ size_t* count);
220 _Outptr_result_buffer_maybenull_(*count) global_variable_section_info_t** global_variable_sections,
221 _Out_ size_t* count);
223
230 inline uint16_t
231 swap16(uint16_t value)
232 {
233 return value << 8 | value >> 8;
234 }
235
242 inline uint32_t
243 swap32(uint32_t value)
244 {
245 return swap16(value >> 16) | ((uint32_t)swap16(value & ((1 << 16) - 1))) << 16;
246 }
247
254 inline uint64_t
255 swap64(uint64_t value)
256 {
257 return swap32(value >> 32) | ((uint64_t)swap32(value & ((1ull << 32ull) - 1))) << 32;
258 }
259
260#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION 1
261#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(helper_function_entry_t, name)
262#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_TOTAL_SIZE sizeof(helper_function_entry_t)
263#define EBPF_NATIVE_HELPER_FUNCTION_ENTRY_HEADER \
264 {EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION, \
265 EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_SIZE, \
266 EBPF_NATIVE_HELPER_FUNCTION_ENTRY_CURRENT_VERSION_TOTAL_SIZE}
267
268#define EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION 1
269#define EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_SIZE \
270 EBPF_SIZE_INCLUDING_FIELD(helper_function_data_t, tail_call)
271#define EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_TOTAL_SIZE sizeof(helper_function_data_t)
272#define EBPF_NATIVE_HELPER_FUNCTION_DATA_HEADER \
273 {EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION, \
274 EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_SIZE, \
275 EBPF_NATIVE_HELPER_FUNCTION_DATA_CURRENT_VERSION_TOTAL_SIZE}
276
277#define EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION 1
278#define EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(map_entry_t, name)
279#define EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_TOTAL_SIZE sizeof(map_entry_t)
280#define EBPF_NATIVE_MAP_ENTRY_HEADER \
281 {EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION, \
282 EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_SIZE, \
283 EBPF_NATIVE_MAP_ENTRY_CURRENT_VERSION_TOTAL_SIZE}
284
285#define EBPF_NATIVE_MAP_DATA_CURRENT_VERSION 2
286#define EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(map_data_t, array_data)
287#define EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_TOTAL_SIZE sizeof(map_data_t)
288#define EBPF_NATIVE_MAP_DATA_HEADER \
289 {EBPF_NATIVE_MAP_DATA_CURRENT_VERSION, \
290 EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_SIZE, \
291 EBPF_NATIVE_MAP_DATA_CURRENT_VERSION_TOTAL_SIZE}
292
293#define EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION 1
294#define EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_SIZE \
295 EBPF_SIZE_INCLUDING_FIELD(program_entry_t, program_info_hash_type)
296#define EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_TOTAL_SIZE sizeof(program_entry_t)
297#define EBPF_NATIVE_PROGRAM_ENTRY_HEADER \
298 {EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION, \
299 EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_SIZE, \
300 EBPF_NATIVE_PROGRAM_ENTRY_CURRENT_VERSION_TOTAL_SIZE}
301
302#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION 1
303#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_SIZE \
304 EBPF_SIZE_INCLUDING_FIELD(program_runtime_context_t, map_data)
305#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_TOTAL_SIZE sizeof(program_runtime_context_t)
306#define EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_HEADER \
307 {EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION, \
308 EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_SIZE, \
309 EBPF_NATIVE_PROGRAM_RUNTIME_CONTEXT_CURRENT_VERSION_TOTAL_SIZE}
310
311#define EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION 1
312#define EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(map_initial_values_t, values)
313#define EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_TOTAL_SIZE sizeof(map_initial_values_t)
314#define EBPF_NATIVE_MAP_INITIAL_VALUES_HEADER \
315 {EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION, \
316 EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_SIZE, \
317 EBPF_NATIVE_MAP_INITIAL_VALUES_CURRENT_VERSION_TOTAL_SIZE}
318
319#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION 1
320#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_SIZE \
321 EBPF_SIZE_INCLUDING_FIELD(global_variable_section_info_t, initial_data)
322#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_TOTAL_SIZE sizeof(global_variable_section_info_t)
323#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_HEADER \
324 {EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION, \
325 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_SIZE, \
326 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_INFO_CURRENT_VERSION_TOTAL_SIZE}
327
328#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION 1
329#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_SIZE \
330 EBPF_SIZE_INCLUDING_FIELD(global_variable_section_data_t, address_of_map_value)
331#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_TOTAL_SIZE sizeof(global_variable_section_data_t)
332#define EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_HEADER \
333 {EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION, \
334 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_SIZE, \
335 EBPF_NATIVE_GLOBAL_VARIABLE_SECTION_DATA_CURRENT_VERSION_TOTAL_SIZE}
336
337#define EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION 1
338#define EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(metadata_table_t, map_initial_values)
339#define EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_TOTAL_SIZE sizeof(metadata_table_t)
340#define EBPF_NATIVE_METADATA_TABLE_HEADER \
341 {EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION, \
342 EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_SIZE, \
343 EBPF_NATIVE_METADATA_TABLE_CURRENT_VERSION_TOTAL_SIZE}
344
345#ifdef __cplusplus
346}
347#endif
struct _program_runtime_context program_runtime_context_t
struct _global_variable_section_info global_variable_section_info_t
struct _helper_function_data helper_function_data_t
uint64_t swap64(uint64_t value)
Inline function used to implement the 64 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition bpf2c.h:255
uint64_t(* helper_function_t)(uint64_t, uint64_t, uint64_t, uint64_t, uint64_t, void *)
Definition bpf2c.h:76
struct _map_initial_values map_initial_values_t
Map initial values. This structure contains the initial values for a map. The values are used to init...
struct _map_entry map_entry_t
Map entry. This structure contains the address of the map and the map definition. The address is writ...
struct _helper_function_entry helper_function_entry_t
Helper function entry. This structure defines a helper function entry in the metadata table....
uint32_t swap32(uint32_t value)
Inline function used to implement the 32 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition bpf2c.h:243
struct _global_variable_section_data global_variable_section_data_t
uint16_t swap16(uint16_t value)
Inline function used to implement the 16 bit EBPF_OP_LE/EBPF_OP_BE instruction.
Definition bpf2c.h:231
struct _program_entry program_entry_t
Program entry. This structure contains the address of the program and additional information about th...
struct _bpf2c_version bpf2c_version_t
Version information for the bpf2c compiler. This structure contains the version information for the b...
struct _metadata_table metadata_table_t
Metadata table for a module. This structure is returned by the module's metadata function,...
struct _map_data map_data_t
This file contains eBPF definitions common to eBPF programs, core execution engine as well as eBPF AP...
GUID ebpf_attach_type_t
Definition ebpf_windows.h:62
GUID ebpf_program_type_t
Definition ebpf_windows.h:61
Version information for the bpf2c compiler. This structure contains the version information for the b...
Definition bpf2c.h:192
uint32_t major
Definition bpf2c.h:193
uint32_t revision
Definition bpf2c.h:195
uint32_t minor
Definition bpf2c.h:194
Header of an eBPF extension data structure. Every eBPF extension data structure must start with this ...
Definition ebpf_windows.h:198
eBPF Map Definition as it appears in the maps section of an ELF file.
Definition ebpf_structs.h:126
Definition bpf2c.h:145
unsigned char * address_of_map_value
Definition bpf2c.h:147
ebpf_native_module_header_t header
Definition bpf2c.h:146
Definition bpf2c.h:137
size_t size
Definition bpf2c.h:140
const void * initial_data
Definition bpf2c.h:141
const char * name
Definition bpf2c.h:139
ebpf_native_module_header_t header
Definition bpf2c.h:138
Definition bpf2c.h:92
bool tail_call
Definition bpf2c.h:95
helper_function_t address
Definition bpf2c.h:94
ebpf_native_module_header_t header
Definition bpf2c.h:93
Helper function entry. This structure defines a helper function entry in the metadata table....
Definition bpf2c.h:85
const char * name
Definition bpf2c.h:88
uint32_t helper_id
Definition bpf2c.h:87
ebpf_native_module_header_t header
Definition bpf2c.h:86
Definition bpf2c.h:116
uintptr_t address
Definition bpf2c.h:118
uint8_t * array_data
Direct pointer to array map data (NULL for non-array maps).
Definition bpf2c.h:119
ebpf_native_module_header_t header
Definition bpf2c.h:117
Map entry. This structure contains the address of the map and the map definition. The address is writ...
Definition bpf2c.h:104
ebpf_map_definition_in_file_t definition
Definition bpf2c.h:111
uint64_t zero_marker[2]
Definition bpf2c.h:108
ebpf_native_module_header_t header
Definition bpf2c.h:110
const char * name
Definition bpf2c.h:112
Map initial values. This structure contains the initial values for a map. The values are used to init...
Definition bpf2c.h:129
const char ** values
Definition bpf2c.h:133
size_t count
Definition bpf2c.h:132
ebpf_native_module_header_t header
Definition bpf2c.h:130
const char * name
Definition bpf2c.h:131
Metadata table for a module. This structure is returned by the module's metadata function,...
Definition bpf2c.h:204
void(* version)(bpf2c_version_t *version)
Definition bpf2c.h:215
size_t size
Size of this structure. Used for versioning.
Definition bpf2c.h:205
void(* map_initial_values)((*count) map_initial_values_t **map_initial_values, size_t *count)
Returns the list of initial values for maps in this module.
Definition bpf2c.h:216
void(* global_variable_sections)((*count) global_variable_section_info_t **global_variable_sections, size_t *count)
Returns the list of global variables in this module.
Definition bpf2c.h:219
void(* programs)((*count) program_entry_t **programs, size_t *count)
Returns the list of programs in this module.
Definition bpf2c.h:206
void(* hash)((*size) const uint8_t **hash, size_t *size)
Returns the hash of the ELF file used to generate this module.
Definition bpf2c.h:212
void(* maps)((*count) map_entry_t **maps, size_t *count)
Returns the list of maps in this module.
Definition bpf2c.h:209
Program entry. This structure contains the address of the program and additional information about th...
Definition bpf2c.h:163
uint16_t helper_count
Number of helper functions used by the program.
Definition bpf2c.h:177
uint64_t zero
Definition bpf2c.h:167
const char * program_info_hash_type
Type of the program info hash.
Definition bpf2c.h:183
uint16_t referenced_map_count
Number of maps referenced by the program.
Definition bpf2c.h:175
const char * program_name
Name of the program.
Definition bpf2c.h:173
size_t bpf_instruction_count
Number of BPF instructions in the program.
Definition bpf2c.h:178
uint64_t(* function)(void *, const program_runtime_context_t *)
Address of the program.
Definition bpf2c.h:170
ebpf_native_module_header_t header
Definition bpf2c.h:169
size_t program_info_hash_length
Length of the program info hash.
Definition bpf2c.h:182
uint16_t * referenced_map_indices
List of map indices referenced by the program.
Definition bpf2c.h:174
ebpf_attach_type_t * expected_attach_type
Expected attach type of the program.
Definition bpf2c.h:180
const char * pe_section_name
Name of the PE section containing the program.
Definition bpf2c.h:171
const uint8_t * program_info_hash
Hash of the program info.
Definition bpf2c.h:181
const char * section_name
Name of the section containing the program.
Definition bpf2c.h:172
ebpf_program_type_t * program_type
Type of the program.
Definition bpf2c.h:179
helper_function_entry_t * helpers
List of helper functions used by the program.
Definition bpf2c.h:176
Definition bpf2c.h:151
map_data_t * map_data
Definition bpf2c.h:154
global_variable_section_data_t * global_variable_section_data
Definition bpf2c.h:155
helper_function_data_t * helper_data
Definition bpf2c.h:153
ebpf_native_module_header_t header
Definition bpf2c.h:152