eBPF for Windows
Data Structures | Macros | Typedefs | Enumerations
ebpf_structs.h File Reference
#include <stdbool.h>
#include <stdint.h>
#include "ebpf_windows.h"

Go to the source code of this file.

Data Structures

struct  _ebpf_map_definition_in_memory
 eBPF Map Definition as it is stored in memory. More...
 
struct  _ebpf_map_definition_in_file
 eBPF Map Definition as it appears in the maps section of an ELF file. More...
 
struct  bpf_link_info
 eBPF link information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a link fd. More...
 
struct  bpf_map_info
 eBPF map information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a map fd. More...
 
struct  bpf_prog_info
 eBPF program information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a program fd. More...
 

Macros

#define BPF_ENUM_TO_STRING(X)   #X
 
#define EBPF_ID_NONE   UINT32_MAX
 
#define XDP_FLAGS_REPLACE   0x01
 
#define BPF_OBJ_NAME_LEN   64
 
#define BPF_ANY   0x0
 
#define BPF_NOEXIST   0x1
 
#define BPF_EXIST   0x2
 

Typedefs

typedef enum bpf_map_type ebpf_map_type_t
 
typedef enum ebpf_map_option ebpf_map_option_t
 
typedef enum ebpf_pin_type ebpf_pin_type_t
 
typedef uint32_t ebpf_id_t
 
typedef struct _ebpf_map_definition_in_memory ebpf_map_definition_in_memory_t
 eBPF Map Definition as it is stored in memory. More...
 
typedef struct _ebpf_map_definition_in_file ebpf_map_definition_in_file_t
 eBPF Map Definition as it appears in the maps section of an ELF file. More...
 
typedef enum bpf_prog_type bpf_prog_type_t
 
typedef enum bpf_attach_type bpf_attach_type_t
 

Enumerations

enum  bpf_map_type {
  BPF_MAP_TYPE_UNSPEC = 0, BPF_MAP_TYPE_HASH = 1, BPF_MAP_TYPE_ARRAY = 2, BPF_MAP_TYPE_PROG_ARRAY,
  BPF_MAP_TYPE_PERCPU_HASH = 4, BPF_MAP_TYPE_PERCPU_ARRAY = 5, BPF_MAP_TYPE_HASH_OF_MAPS = 6, BPF_MAP_TYPE_ARRAY_OF_MAPS = 7,
  BPF_MAP_TYPE_LRU_HASH = 8, BPF_MAP_TYPE_LPM_TRIE = 9, BPF_MAP_TYPE_QUEUE = 10, BPF_MAP_TYPE_LRU_PERCPU_HASH = 11,
  BPF_MAP_TYPE_STACK = 12, BPF_MAP_TYPE_RINGBUF = 13
}
 
enum  ebpf_map_option { EBPF_ANY, EBPF_NOEXIST, EBPF_EXIST }
 
enum  ebpf_pin_type { PIN_NONE, PIN_OBJECT_NS, PIN_GLOBAL_NS, PIN_CUSTOM_NS }
 
enum  ebpf_helper_id_t {
  BPF_FUNC_map_lookup_elem = 1, BPF_FUNC_map_update_elem = 2, BPF_FUNC_map_delete_elem = 3, BPF_FUNC_map_lookup_and_delete_elem = 4,
  BPF_FUNC_tail_call = 5, BPF_FUNC_get_prandom_u32 = 6, BPF_FUNC_ktime_get_boot_ns = 7, BPF_FUNC_get_smp_processor_id = 8,
  BPF_FUNC_ktime_get_ns = 9, BPF_FUNC_csum_diff = 10, BPF_FUNC_ringbuf_output = 11, BPF_FUNC_trace_printk2 = 12,
  BPF_FUNC_trace_printk3 = 13, BPF_FUNC_trace_printk4 = 14, BPF_FUNC_trace_printk5 = 15, BPF_FUNC_map_push_elem = 16,
  BPF_FUNC_map_pop_elem = 17, BPF_FUNC_map_peek_elem = 18, BPF_FUNC_get_current_pid_tgid = 19
}
 
enum  bpf_prog_type {
  BPF_PROG_TYPE_UNSPEC, BPF_PROG_TYPE_XDP, BPF_PROG_TYPE_BIND, BPF_PROG_TYPE_CGROUP_SOCK_ADDR,
  BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SAMPLE = 999
}
 
enum  bpf_link_type { BPF_LINK_TYPE_UNSPEC, BPF_LINK_TYPE_PLAIN, BPF_LINK_TYPE_CGROUP, BPF_LINK_TYPE_XDP }
 
enum  bpf_attach_type {
  BPF_ATTACH_TYPE_UNSPEC, BPF_XDP, BPF_ATTACH_TYPE_BIND, BPF_CGROUP_INET4_CONNECT,
  BPF_CGROUP_INET6_CONNECT, BPF_CGROUP_INET4_RECV_ACCEPT, BPF_CGROUP_INET6_RECV_ACCEPT, BPF_CGROUP_SOCK_OPS,
  BPF_ATTACH_TYPE_SAMPLE, __MAX_BPF_ATTACH_TYPE
}
 

Macro Definition Documentation

◆ BPF_ANY

#define BPF_ANY   0x0

◆ BPF_ENUM_TO_STRING

#define BPF_ENUM_TO_STRING (   X)    #X

◆ BPF_EXIST

#define BPF_EXIST   0x2

◆ BPF_NOEXIST

#define BPF_NOEXIST   0x1

◆ BPF_OBJ_NAME_LEN

#define BPF_OBJ_NAME_LEN   64

◆ EBPF_ID_NONE

#define EBPF_ID_NONE   UINT32_MAX

◆ XDP_FLAGS_REPLACE

#define XDP_FLAGS_REPLACE   0x01

Typedef Documentation

◆ bpf_attach_type_t

◆ bpf_prog_type_t

◆ ebpf_id_t

typedef uint32_t ebpf_id_t

◆ ebpf_map_definition_in_file_t

eBPF Map Definition as it appears in the maps section of an ELF file.

◆ ebpf_map_definition_in_memory_t

eBPF Map Definition as it is stored in memory.

◆ ebpf_map_option_t

◆ ebpf_map_type_t

◆ ebpf_pin_type_t

Enumeration Type Documentation

◆ bpf_attach_type

Enumerator
BPF_ATTACH_TYPE_UNSPEC 

Unspecified attach type.

BPF_XDP 

Attach type for handling incoming packets as early as possible.

Program type: BPF_PROG_TYPE_XDP

BPF_ATTACH_TYPE_BIND 

Attach type for handling socket bind() requests.

Program type: BPF_PROG_TYPE_BIND

BPF_CGROUP_INET4_CONNECT 

Attach type for handling IPv4 TCP connect() or UDP send to a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_INET6_CONNECT 

Attach type for handling IPv6 TCP connect() or UDP send to a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_INET4_RECV_ACCEPT 

Attach type for handling IPv4 TCP accept() or on receiving the first unicast UDP packet from a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_INET6_RECV_ACCEPT 

Attach type for handling IPv6 TCP accept() or on receiving the first unicast UDP packet from a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_SOCK_OPS 

Attach type for handling various socket event notifications.

Program type: BPF_PROG_TYPE_SOCK_OPS

BPF_ATTACH_TYPE_SAMPLE 

Attach type implemented by eBPF Sample Extension driver, used for testing.

Program type: BPF_PROG_TYPE_SAMPLE

__MAX_BPF_ATTACH_TYPE 

◆ bpf_link_type

Enumerator
BPF_LINK_TYPE_UNSPEC 

Unspecified link type.

BPF_LINK_TYPE_PLAIN 

No union members are used in bpf_link_info.

BPF_LINK_TYPE_CGROUP 

cgroup struct is present in bpf_link_info.

BPF_LINK_TYPE_XDP 

xdp struct is present in bpf_link_info.

◆ bpf_map_type

Enumerator
BPF_MAP_TYPE_UNSPEC 

Unspecified map type.

BPF_MAP_TYPE_HASH 

Hash table.

BPF_MAP_TYPE_ARRAY 

Array, where the map key is the array index.

BPF_MAP_TYPE_PROG_ARRAY 

Array of program fds usable with bpf_tail_call, where the map key is the array index.

BPF_MAP_TYPE_PERCPU_HASH 

Per-CPU hash table.

BPF_MAP_TYPE_PERCPU_ARRAY 

Per-CPU array.

BPF_MAP_TYPE_HASH_OF_MAPS 

Hash table, where the map value is another map.

BPF_MAP_TYPE_ARRAY_OF_MAPS 

Array, where the map value is another map.

BPF_MAP_TYPE_LRU_HASH 

Least-recently-used hash table.

BPF_MAP_TYPE_LPM_TRIE 

Longest prefix match trie.

BPF_MAP_TYPE_QUEUE 

Queue.

BPF_MAP_TYPE_LRU_PERCPU_HASH 

Per-CPU least-recently-used hash table.

BPF_MAP_TYPE_STACK 

Stack.

BPF_MAP_TYPE_RINGBUF 

Ring buffer.

◆ bpf_prog_type

Enumerator
BPF_PROG_TYPE_UNSPEC 

Unspecified program type.

BPF_PROG_TYPE_XDP 

Program type for handling incoming packets as early as possible.

eBPF program prototype: xdp_hook_t

Attach type(s): BPF_XDP

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_BIND 

Program type for handling socket bind() requests.

eBPF program prototype: bind_hook_t

Attach type(s): BPF_ATTACH_TYPE_BIND

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_CGROUP_SOCK_ADDR 

Program type for handling various socket operations such as connect(), accept() etc.

eBPF program prototype: sock_addr_hook_t

Attach type(s): BPF_CGROUP_INET4_CONNECT BPF_CGROUP_INET6_CONNECT BPF_CGROUP_INET4_RECV_ACCEPT BPF_CGROUP_INET6_RECV_ACCEPT

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_SOCK_OPS 

Program type for handling various socket event notifications such as connection established etc.

eBPF program prototype: sock_ops_hook_t

Attach type(s): BPF_CGROUP_SOCK_OPS

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_SAMPLE 

Program type for handling calls from the eBPF sample extension. Used for testing.

eBPF program prototype: see the eBPF sample extension.

Attach type(s): BPF_ATTACH_TYPE_SAMPLE

◆ ebpf_helper_id_t

Enumerator
BPF_FUNC_map_lookup_elem 

bpf_map_lookup_elem

BPF_FUNC_map_update_elem 

bpf_map_update_elem

BPF_FUNC_map_delete_elem 

bpf_map_delete_elem

BPF_FUNC_map_lookup_and_delete_elem 

bpf_map_lookup_and_delete_elem

BPF_FUNC_tail_call 

bpf_tail_call

BPF_FUNC_get_prandom_u32 

bpf_get_prandom_u32

BPF_FUNC_ktime_get_boot_ns 

bpf_ktime_get_boot_ns

BPF_FUNC_get_smp_processor_id 

bpf_get_smp_processor_id

BPF_FUNC_ktime_get_ns 

bpf_ktime_get_ns

BPF_FUNC_csum_diff 

bpf_csum_diff

BPF_FUNC_ringbuf_output 

bpf_ringbuf_output

BPF_FUNC_trace_printk2 

bpf_trace_printk2 (but use bpf_printk instead)

BPF_FUNC_trace_printk3 

bpf_trace_printk3 (but use bpf_printk instead)

BPF_FUNC_trace_printk4 

bpf_trace_printk4 (but use bpf_printk instead)

BPF_FUNC_trace_printk5 

bpf_trace_printk5 (but use bpf_printk instead)

BPF_FUNC_map_push_elem 

bpf_map_push_elem

BPF_FUNC_map_pop_elem 

bpf_map_pop_elem

BPF_FUNC_map_peek_elem 

bpf_map_peek_elem

BPF_FUNC_get_current_pid_tgid 

bpf_get_current_pid_tgid

◆ ebpf_map_option

Enumerator
EBPF_ANY 

Create a new element or update an existing element.

EBPF_NOEXIST 

Create a new element only when it does not exist.

EBPF_EXIST 

Update an existing element.

◆ ebpf_pin_type

Enumerator
PIN_NONE 

Object is not pinned.

PIN_OBJECT_NS 

Pinning that is local to an object.

PIN_GLOBAL_NS 

Pinning with a global namespace.

PIN_CUSTOM_NS 

Pinning with a custom path given as section parameter.