eBPF for Windows
Go to the documentation of this file.
1 // Copyright (c) eBPF for Windows contributors
2 // SPDX-License-Identifier: MIT
3 #pragma once
5 #include "ebpf_result.h"
6 #include "ebpf_structs.h"
7 #include "ebpf_windows.h"
12 {
13  uint16_t version;
14  uint16_t count;
31  _In_ const void* extension_client_binding_context, _Inout_ void* program_context, _Out_ uint32_t* result);
47  _In_ const void* extension_client_binding_context, size_t state_size, _Out_writes_(state_size) void* state);
61  _In_ const void* extension_client_binding_context,
62  _Inout_ void* program_context,
63  _Out_ uint32_t* result,
64  _In_ const void* state);
76  _In_ const void* extension_client_binding_context, _Inout_ void* state);
79 {
80  uint16_t version;
81  uint16_t count;
88 typedef struct _ebpf_extension_data
89 {
91  const void* data;
95 {
102 /***
103  * The state of the execution context when the eBPF program was invoked.
104  * This is used to cache state that won't change during the execution of
105  * the eBPF program and is expensive to query.
106  */
108 {
109  uint64_t epoch_state[4];
110  union
111  {
112  uint64_t thread;
113  uint32_t cpu;
114  } id;
115  uint8_t current_irql;
116  struct
117  {
118  const void* next_program;
119  uint32_t count;
struct _ebpf_attach_provider_data ebpf_attach_provider_data_t
struct _ebpf_extension_dispatch_table ebpf_extension_dispatch_table_t
struct _ebpf_extension_data ebpf_extension_data_t
struct _ebpf_extension_program_dispatch_table ebpf_extension_program_dispatch_table_t
ebpf_result_t(* _ebpf_extension_dispatch_function)()
Definition: ebpf_extension.h:9
ebpf_result_t(* ebpf_program_batch_begin_invoke_function_t)(const void *extension_client_binding_context, size_t state_size, _Out_writes_(state_size) void *state)
Prepare the eBPF program for batch invocation.
Definition: ebpf_extension.h:46
ebpf_result_t(* ebpf_program_batch_invoke_function_t)(const void *extension_client_binding_context, _Inout_ void *program_context, uint32_t *result, const void *state)
Invoke the eBPF program in batch mode.
Definition: ebpf_extension.h:60
struct _ebpf_execution_context_state ebpf_execution_context_state_t
ebpf_result_t(* ebpf_program_batch_end_invoke_function_t)(const void *extension_client_binding_context, _Inout_ void *state)
Clean up the eBPF program after batch invocation.
Definition: ebpf_extension.h:75
ebpf_result_t(* ebpf_program_invoke_function_t)(const void *extension_client_binding_context, _Inout_ void *program_context, uint32_t *result)
Invoke the eBPF program.
Definition: ebpf_extension.h:30
enum ebpf_result ebpf_result_t
This file contains eBPF definitions common to eBPF programs, core execution engine as well as eBPF AP...
Definition: ebpf_structs.h:244
enum bpf_attach_type bpf_attach_type_t
Definition: ebpf_structs.h:322
GUID ebpf_program_type_t
Definition: ebpf_windows.h:61
Definition: ebpf_extension.h:95
ebpf_extension_header_t header
Definition: ebpf_extension.h:96
ebpf_program_type_t supported_program_type
Definition: ebpf_extension.h:97
bpf_attach_type_t bpf_attach_type
Definition: ebpf_extension.h:98
enum bpf_link_type link_type
Definition: ebpf_extension.h:99
Definition: ebpf_extension.h:108
union _ebpf_execution_context_state::@6 id
struct _ebpf_execution_context_state::@7 tail_call_state
uint8_t current_irql
Definition: ebpf_extension.h:115
uint32_t count
Definition: ebpf_extension.h:119
uint64_t epoch_state[4]
Definition: ebpf_extension.h:109
uint64_t thread
Definition: ebpf_extension.h:112
const void * next_program
Definition: ebpf_extension.h:118
uint32_t cpu
Definition: ebpf_extension.h:113
Definition: ebpf_extension.h:89
ebpf_extension_header_t header
Definition: ebpf_extension.h:90
const void * data
Definition: ebpf_extension.h:91
Definition: ebpf_extension.h:12
uint16_t version
Version of the dispatch table.
Definition: ebpf_extension.h:13
uint16_t count
Number of entries in the dispatch table.
Definition: ebpf_extension.h:14
_Field_size_(count) _ebpf_extension_dispatch_function function[1]
Header of an eBPF extension data structure. Every eBPF extension data structure must start with this ...
Definition: ebpf_windows.h:153
Definition: ebpf_extension.h:79
ebpf_program_invoke_function_t ebpf_program_invoke_function
Definition: ebpf_extension.h:82
ebpf_program_batch_begin_invoke_function_t ebpf_program_batch_begin_invoke_function
Definition: ebpf_extension.h:83
ebpf_program_batch_end_invoke_function_t ebpf_program_batch_end_invoke_function
Definition: ebpf_extension.h:85
uint16_t version
Version of the dispatch table.
Definition: ebpf_extension.h:80
ebpf_program_batch_invoke_function_t ebpf_program_batch_invoke_function
Definition: ebpf_extension.h:84
uint16_t count
Number of entries in the dispatch table.
Definition: ebpf_extension.h:81