ebpf-for-windows/bpf__helper__defs_8h_source.html

// Copyright (c) eBPF for Windows contributors

// SPDX-License-Identifier: MIT

#pragma once


// This file contains APIs for global helpers that are exposed for

// use by all eBPF programs.  Libbpf has bpf_helper_defs.h which is

// auto-generated but it's not platform-agnostic currently as it

// hard-codes the actual helper IDs.


EBPF_HELPER(void*, bpf_map_lookup_elem, (void* map, void* key));

#ifndef __doxygen

#define bpf_map_lookup_elem ((bpf_map_lookup_elem_t)BPF_FUNC_map_lookup_elem)

#endif


EBPF_HELPER(int64_t, bpf_map_update_elem, (void* map, void* key, void* value, uint64_t flags));

#ifndef __doxygen

#define bpf_map_update_elem ((bpf_map_update_elem_t)BPF_FUNC_map_update_elem)

#endif


EBPF_HELPER(int64_t, bpf_map_delete_elem, (void* map, void* key));

#ifndef __doxygen

#define bpf_map_delete_elem ((bpf_map_delete_elem_t)BPF_FUNC_map_delete_elem)

#endif


EBPF_HELPER(void*, bpf_map_lookup_and_delete_elem, (void* map, void* key));

#ifndef __doxygen

#define bpf_map_lookup_and_delete_elem ((bpf_map_lookup_and_delete_elem_t)BPF_FUNC_map_lookup_and_delete_elem)

#endif


EBPF_HELPER(int64_t, bpf_tail_call, (void* ctx, void* prog_array_map, uint32_t index));

#ifndef __doxygen

#define bpf_tail_call ((bpf_tail_call_t)BPF_FUNC_tail_call)

#endif


EBPF_HELPER(uint32_t, bpf_get_prandom_u32, ());

#ifndef __doxygen

#define bpf_get_prandom_u32 ((bpf_get_prandom_u32_t)BPF_FUNC_get_prandom_u32)

#endif


EBPF_HELPER(uint64_t, bpf_ktime_get_boot_ns, ());

#ifndef __doxygen

#define bpf_ktime_get_boot_ns ((bpf_ktime_get_boot_ns_t)BPF_FUNC_ktime_get_boot_ns)

#endif


EBPF_HELPER(uint64_t, bpf_get_smp_processor_id, ());

#ifndef __doxygen

#define bpf_get_smp_processor_id ((bpf_get_smp_processor_id_t)BPF_FUNC_get_smp_processor_id)

#endif


EBPF_HELPER(uint64_t, bpf_ktime_get_ns, ());

#ifndef __doxygen

#define bpf_ktime_get_ns ((bpf_ktime_get_ns_t)BPF_FUNC_ktime_get_ns)

#endif


EBPF_HELPER(int, bpf_csum_diff, (void* from, int from_size, void* to, int to_size, int seed));

#ifndef __doxygen

#define bpf_csum_diff ((bpf_csum_diff_t)BPF_FUNC_csum_diff)

#endif


EBPF_HELPER(int, bpf_ringbuf_output, (void* ring_buffer, void* data, uint64_t size, uint64_t flags));

#ifndef __doxygen

#define bpf_ringbuf_output ((bpf_ringbuf_output_t)BPF_FUNC_ringbuf_output)

#endif


EBPF_HELPER(long, bpf_trace_printk2, (const char* fmt, uint32_t fmt_size));

#ifndef __doxygen

#define bpf_trace_printk2 ((bpf_trace_printk2_t)BPF_FUNC_trace_printk2)

#endif


EBPF_HELPER(long, bpf_trace_printk3, (const char* fmt, uint32_t fmt_size, uint64_t arg3));

#ifndef __doxygen

#define bpf_trace_printk3 ((bpf_trace_printk3_t)BPF_FUNC_trace_printk3)

#endif


EBPF_HELPER(long, bpf_trace_printk4, (const char* fmt, uint32_t fmt_size, uint64_t arg3, uint64_t arg4));

#ifndef __doxygen

#define bpf_trace_printk4 ((bpf_trace_printk4_t)BPF_FUNC_trace_printk4)

#endif


EBPF_HELPER(long, bpf_trace_printk5, (const char* fmt, uint32_t fmt_size, uint64_t arg3, uint64_t arg4, uint64_t arg5));

#ifndef __doxygen

#define bpf_trace_printk5 ((bpf_trace_printk5_t)BPF_FUNC_trace_printk5)

#endif


#ifndef __doxygen

// The following macros allow bpf_printk to accept a variable number of arguments

// while mapping to separate helper functions that each have a strict prototype

// that can be understood by the verifier.

#define EBPF_CONCATENATE(X, Y) X##Y

#define EBPF_MAKE_HELPER_NAME(PREFIX, ARG_COUNT) EBPF_CONCATENATE(PREFIX, ARG_COUNT)

#define EBPF_GET_NTH_ARG(_1, _2, _3, _4, _5, N, ...) N

#define EBPF_COUNT_VA_ARGS(...) EBPF_GET_NTH_ARG(__VA_ARGS__, 5, 4, 3, 2, 1)

#define EBPF_VA_ARGS_HELPER(PREFIX, ...) EBPF_MAKE_HELPER_NAME(PREFIX, EBPF_COUNT_VA_ARGS(__VA_ARGS__))(__VA_ARGS__)


#undef bpf_trace_printk

#define bpf_trace_printk(fmt, size, ...) ({ EBPF_VA_ARGS_HELPER(bpf_trace_printk, fmt, size, ##__VA_ARGS__); })

#else

long

bpf_trace_printk(const char* fmt, uint32_t size, ...);

#endif


#ifndef __doxygen

#undef bpf_printk

#define bpf_printk(fmt, ...)                                       \

    ({                                                             \

        char ____fmt[] = fmt;                                      \

        bpf_trace_printk(____fmt, sizeof(____fmt), ##__VA_ARGS__); \

    })

#else

long

bpf_printk(const char* fmt, ...);

#endif


EBPF_HELPER(int64_t, bpf_map_push_elem, (void* map, void* value, uint64_t flags));

#ifndef __doxygen

#define bpf_map_push_elem ((bpf_map_push_elem_t)BPF_FUNC_map_push_elem)

#endif


EBPF_HELPER(int64_t, bpf_map_pop_elem, (void* map, void* value));

#ifndef __doxygen

#define bpf_map_pop_elem ((bpf_map_pop_elem_t)BPF_FUNC_map_pop_elem)

#endif


EBPF_HELPER(int64_t, bpf_map_peek_elem, (void* map, void* value));

#ifndef __doxygen

#define bpf_map_peek_elem ((bpf_map_pop_elem_t)BPF_FUNC_map_peek_elem)

#endif


EBPF_HELPER(uint64_t, bpf_get_current_pid_tgid, ());

#ifndef __doxygen

#define bpf_get_current_pid_tgid ((bpf_get_current_pid_tgid_t)BPF_FUNC_get_current_pid_tgid)

#endif


EBPF_HELPER(uint64_t, bpf_get_current_logon_id, (const void* ctx));

#ifndef __doxygen

#define bpf_get_current_logon_id ((bpf_get_current_logon_id_t)BPF_FUNC_get_current_logon_id)

#endif


EBPF_HELPER(int32_t, bpf_is_current_admin, (const void* ctx));

#ifndef __doxygen

#define bpf_is_current_admin ((bpf_is_current_admin_t)BPF_FUNC_is_current_admin)

#endif


EBPF_HELPER(long, bpf_memcpy, (void* destination, uint32_t destination_size, const void* source, uint32_t source_size));

#ifndef __doxygen

#define bpf_memcpy ((bpf_memcpy_t)BPF_FUNC_memcpy)

#endif


EBPF_HELPER(int, bpf_memcmp, (const void* memory1, uint32_t memory1_size, const void* memory2, uint32_t memory2_size));

#ifndef __doxygen

#define bpf_memcmp ((bpf_memcmp_t)BPF_FUNC_memcmp)

#endif


EBPF_HELPER(long, bpf_memset, (void* memory, uint32_t size, int value));

#ifndef __doxygen

#define bpf_memset ((bpf_memset_t)BPF_FUNC_memset)

#endif


EBPF_HELPER(

    long, bpf_memmove, (void* destination, uint32_t destination_size, const void* source, uint32_t source_size));

#ifndef __doxygen

#define bpf_memmove ((bpf_memmove_t)BPF_FUNC_memmove)

#endif


EBPF_HELPER(int64_t, bpf_get_socket_cookie, (const void* ctx));

#ifndef __doxygen

#define bpf_get_socket_cookie ((bpf_get_socket_cookie_t)BPF_FUNC_get_socket_cookie)

#endif


EBPF_HELPER(int, bpf_strncpy_s, (char* dest, size_t dest_size, const char* src, size_t count));

#ifndef __doxygen

#define bpf_strncpy_s ((bpf_strncpy_s_t)BPF_FUNC_strncpy_s)

#endif


EBPF_HELPER(int, bpf_strncat_s, (char* dest, size_t dest_size, const char* src, size_t count));

#ifndef __doxygen

#define bpf_strncat_s ((bpf_strncat_s_t)BPF_FUNC_strncat_s)

#endif


EBPF_HELPER(size_t, bpf_strnlen_s, (const char* str, size_t str_size));

#ifndef __doxygen

#define bpf_strnlen_s ((bpf_strnlen_s_t)BPF_FUNC_strnlen_s)

#endif


#if __clang__

#define memcpy(dest, src, dest_size) bpf_memcpy(dest, dest_size, src, dest_size)

#define memcmp(mem1, mem2, mem1_size) bpf_memcmp(mem1, mem1_size, mem2, mem1_size)

#define memset(mem, value, mem_size) bpf_memset(mem, mem_size, value)

#define memmove(dest, src, dest_size) bpf_memmove(dest, dest_size, src, dest_size)

#define memcpy_s bpf_memcpy

#define memmove_s bpf_memmove

#endif


EBPF_HELPER(uint64_t, bpf_ktime_get_boot_ms, ());

#ifndef __doxygen

#define bpf_ktime_get_boot_ms ((bpf_ktime_get_boot_ms_t)BPF_FUNC_ktime_get_boot_ms)

#endif


EBPF_HELPER(uint64_t, bpf_ktime_get_ms, ());

#ifndef __doxygen

#define bpf_ktime_get_ms ((bpf_ktime_get_ms_t)BPF_FUNC_ktime_get_ms)

#endif


EBPF_HELPER(int, bpf_perf_event_output, (void* ctx, void* perf_event_array, uint64_t flags, void* data, uint64_t size));

#ifndef __doxygen

#define bpf_perf_event_output ((bpf_perf_event_output_t)BPF_FUNC_perf_event_output)

#endif

bpf_ringbuf_output
int bpf_ringbuf_output(void *ring_buffer, void *data, uint64_t size, uint64_t flags)
Copy data into the ring buffer map.

bpf_map_delete_elem
int64_t bpf_map_delete_elem(void *map, void *key)
Remove an entry from the map.

bpf_strncpy_s
int bpf_strncpy_s(char *dest, size_t dest_size, const char *src, size_t count)
Copy a string into a buffer, of a fixed size.

bpf_map_push_elem
int64_t bpf_map_push_elem(void *map, void *value, uint64_t flags)
Insert an element at the end of the map (only valid for stack and queue).

bpf_get_current_pid_tgid
uint64_t bpf_get_current_pid_tgid()
Get the current thread ID (PID) and process ID (TGID).

bpf_is_current_admin
int32_t bpf_is_current_admin(const void *ctx)
Get whether the current user is admin. In case of sock_addr attach types, returns whether the user in...

bpf_map_lookup_elem
void * bpf_map_lookup_elem(void *map, void *key)
Get a pointer to an entry in the map.

bpf_ktime_get_ns
uint64_t bpf_ktime_get_ns()
Return time elapsed since boot in nanoseconds excluding time while suspended.

bpf_trace_printk5
long bpf_trace_printk5(const char *fmt, uint32_t fmt_size, uint64_t arg3, uint64_t arg4, uint64_t arg5)
Print debug output.

bpf_strnlen_s
size_t bpf_strnlen_s(const char *str, size_t str_size)
Find the length of a string, up to a certain number of characters.

bpf_strncat_s
int bpf_strncat_s(char *dest, size_t dest_size, const char *src, size_t count)
Concatenate a string to an existing buffer, up to a certain number of characters.

bpf_memcpy
long bpf_memcpy(void *destination, uint32_t destination_size, const void *source, uint32_t source_size)
Copy memory from one location to another.

bpf_map_update_elem
int64_t bpf_map_update_elem(void *map, void *key, void *value, uint64_t flags)
Insert or update an entry in the map.

bpf_get_current_logon_id
uint64_t bpf_get_current_logon_id(const void *ctx)
Get the 64-bit logon ID of the current thread. In case of sock_addr attach types, get the logon ID of...

bpf_tail_call
int64_t bpf_tail_call(void *ctx, void *prog_array_map, uint32_t index)
Perform a tail call into another eBPF program.

bpf_trace_printk4
long bpf_trace_printk4(const char *fmt, uint32_t fmt_size, uint64_t arg3, uint64_t arg4)
Print debug output.

bpf_ktime_get_boot_ms
uint64_t bpf_ktime_get_boot_ms()
Return time elapsed since boot in milliseconds including time while suspended. This function uses a l...

bpf_memmove
long bpf_memmove(void *destination, uint32_t destination_size, const void *source, uint32_t source_size)
Copy memory from one location to another, handling overlapping regions.

bpf_map_pop_elem
int64_t bpf_map_pop_elem(void *map, void *value)
Copy an entry from the map and remove it from the map (only valid for stack and queue)....

bpf_trace_printk3
long bpf_trace_printk3(const char *fmt, uint32_t fmt_size, uint64_t arg3)
Print debug output.

bpf_csum_diff
int bpf_csum_diff(void *from, int from_size, void *to, int to_size, int seed)
Computes difference of checksum values for two input raw buffers using 1's complement arithmetic.

bpf_perf_event_output
int bpf_perf_event_output(void *ctx, void *perf_event_array, uint64_t flags, void *data, uint64_t size)
Copy data into perf event array map.

bpf_get_socket_cookie
int64_t bpf_get_socket_cookie(const void *ctx)
Get the socket cookie associated with the socket context. The context can be bpf_sock_addr struct,...

bpf_trace_printk
long bpf_trace_printk(const char *fmt, uint32_t size,...)
Print debug output. For instructions on viewing the output, see the Using tracing section of the Gett...

bpf_memcmp
int bpf_memcmp(const void *memory1, uint32_t memory1_size, const void *memory2, uint32_t memory2_size)
Compare two memory regions.

bpf_printk
long bpf_printk(const char *fmt,...)
Print debug output. For instructions on viewing the output, see the Using tracing section of the Gett...

bpf_map_lookup_and_delete_elem
void * bpf_map_lookup_and_delete_elem(void *map, void *key)
Get a pointer to an entry in the map and erase that element.

bpf_ktime_get_ms
uint64_t bpf_ktime_get_ms()
Return time elapsed since boot in milliseconds excluding time while suspended. This function uses a l...

bpf_get_prandom_u32
uint32_t bpf_get_prandom_u32()
Get a pseudo-random number.

bpf_get_smp_processor_id
uint64_t bpf_get_smp_processor_id()
Return SMP id of the processor running the program.

bpf_map_peek_elem
int64_t bpf_map_peek_elem(void *map, void *value)
Copy an entry from the map (only valid for stack and queue). Queue peeks at the beginning of the map....

bpf_trace_printk2
long bpf_trace_printk2(const char *fmt, uint32_t fmt_size)
Print debug output.

bpf_memset
long bpf_memset(void *memory, uint32_t size, int value)
Set memory to a specific value.

bpf_ktime_get_boot_ns
uint64_t bpf_ktime_get_boot_ns()
Return time elapsed since boot in nanoseconds including time while suspended.