eBPF for Windows
Data Structures | Macros | Typedefs | Enumerations
ebpf_structs.h File Reference
#include <stdbool.h>
#include <stdint.h>
#include "ebpf_windows.h"

Go to the source code of this file.

Data Structures

struct  _ebpf_map_definition_in_memory
 eBPF Map Definition as it is stored in memory. More...
 
struct  _ebpf_map_definition_in_file
 eBPF Map Definition as it appears in the maps section of an ELF file. More...
 
struct  bpf_link_info
 eBPF link information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a link fd. More...
 
struct  bpf_map_info
 eBPF map information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a map fd. More...
 
struct  bpf_prog_info
 eBPF program information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a program fd. More...
 

Macros

#define BPF_ENUM_TO_STRING(X)   #X
 
#define BPF_MAP_TYPE_PER_CPU(X)    ((X) == BPF_MAP_TYPE_PERCPU_HASH || (X) == BPF_MAP_TYPE_PERCPU_ARRAY || (X) == BPF_MAP_TYPE_LRU_PERCPU_HASH)
 
#define EBPF_ID_NONE   UINT32_MAX
 
#define XDP_FLAGS_REPLACE   0x01
 
#define BPF_OBJ_NAME_LEN   64
 
#define BPF_ANY   0x0
 
#define BPF_NOEXIST   0x1
 
#define BPF_EXIST   0x2
 

Typedefs

typedef enum bpf_map_type ebpf_map_type_t
 
typedef enum ebpf_map_option ebpf_map_option_t
 
typedef enum ebpf_pin_type ebpf_pin_type_t
 
typedef uint32_t ebpf_id_t
 
typedef struct _ebpf_map_definition_in_memory ebpf_map_definition_in_memory_t
 eBPF Map Definition as it is stored in memory. More...
 
typedef struct _ebpf_map_definition_in_file ebpf_map_definition_in_file_t
 eBPF Map Definition as it appears in the maps section of an ELF file. More...
 
typedef enum bpf_prog_type bpf_prog_type_t
 
typedef enum bpf_attach_type bpf_attach_type_t
 

Enumerations

enum  bpf_map_type {
  BPF_MAP_TYPE_UNSPEC = 0 , BPF_MAP_TYPE_HASH = 1 , BPF_MAP_TYPE_ARRAY = 2 , BPF_MAP_TYPE_PROG_ARRAY ,
  BPF_MAP_TYPE_PERCPU_HASH = 4 , BPF_MAP_TYPE_PERCPU_ARRAY = 5 , BPF_MAP_TYPE_HASH_OF_MAPS = 6 , BPF_MAP_TYPE_ARRAY_OF_MAPS = 7 ,
  BPF_MAP_TYPE_LRU_HASH = 8 , BPF_MAP_TYPE_LPM_TRIE = 9 , BPF_MAP_TYPE_QUEUE = 10 , BPF_MAP_TYPE_LRU_PERCPU_HASH = 11 ,
  BPF_MAP_TYPE_STACK = 12 , BPF_MAP_TYPE_RINGBUF = 13
}
 
enum  ebpf_map_option { EBPF_ANY , EBPF_NOEXIST , EBPF_EXIST }
 
enum  ebpf_pin_type { PIN_NONE , PIN_OBJECT_NS , PIN_GLOBAL_NS , PIN_CUSTOM_NS }
 
enum  ebpf_helper_id_t {
  BPF_FUNC_map_lookup_elem = 1 , BPF_FUNC_map_update_elem = 2 , BPF_FUNC_map_delete_elem = 3 , BPF_FUNC_map_lookup_and_delete_elem = 4 ,
  BPF_FUNC_tail_call = 5 , BPF_FUNC_get_prandom_u32 = 6 , BPF_FUNC_ktime_get_boot_ns = 7 , BPF_FUNC_get_smp_processor_id = 8 ,
  BPF_FUNC_ktime_get_ns = 9 , BPF_FUNC_csum_diff = 10 , BPF_FUNC_ringbuf_output = 11 , BPF_FUNC_trace_printk2 = 12 ,
  BPF_FUNC_trace_printk3 = 13 , BPF_FUNC_trace_printk4 = 14 , BPF_FUNC_trace_printk5 = 15 , BPF_FUNC_map_push_elem = 16 ,
  BPF_FUNC_map_pop_elem = 17 , BPF_FUNC_map_peek_elem = 18 , BPF_FUNC_get_current_pid_tgid = 19
}
 
enum  bpf_prog_type {
  BPF_PROG_TYPE_UNSPEC , BPF_PROG_TYPE_XDP , BPF_PROG_TYPE_BIND , BPF_PROG_TYPE_CGROUP_SOCK_ADDR ,
  BPF_PROG_TYPE_SOCK_OPS , BPF_PROG_TYPE_SAMPLE = 999
}
 
enum  bpf_link_type { BPF_LINK_TYPE_UNSPEC , BPF_LINK_TYPE_PLAIN , BPF_LINK_TYPE_CGROUP , BPF_LINK_TYPE_XDP }
 
enum  bpf_attach_type {
  BPF_ATTACH_TYPE_UNSPEC , BPF_XDP , BPF_ATTACH_TYPE_BIND , BPF_CGROUP_INET4_CONNECT ,
  BPF_CGROUP_INET6_CONNECT , BPF_CGROUP_INET4_RECV_ACCEPT , BPF_CGROUP_INET6_RECV_ACCEPT , BPF_CGROUP_SOCK_OPS ,
  BPF_ATTACH_TYPE_SAMPLE , __MAX_BPF_ATTACH_TYPE
}
 

Macro Definition Documentation

◆ BPF_ANY

#define BPF_ANY   0x0

◆ BPF_ENUM_TO_STRING

#define BPF_ENUM_TO_STRING (   X)    #X

◆ BPF_EXIST

#define BPF_EXIST   0x2

◆ BPF_MAP_TYPE_PER_CPU

#define BPF_MAP_TYPE_PER_CPU (   X)     ((X) == BPF_MAP_TYPE_PERCPU_HASH || (X) == BPF_MAP_TYPE_PERCPU_ARRAY || (X) == BPF_MAP_TYPE_LRU_PERCPU_HASH)

◆ BPF_NOEXIST

#define BPF_NOEXIST   0x1

◆ BPF_OBJ_NAME_LEN

#define BPF_OBJ_NAME_LEN   64

◆ EBPF_ID_NONE

#define EBPF_ID_NONE   UINT32_MAX

◆ XDP_FLAGS_REPLACE

#define XDP_FLAGS_REPLACE   0x01

Typedef Documentation

◆ bpf_attach_type_t

◆ bpf_prog_type_t

◆ ebpf_id_t

typedef uint32_t ebpf_id_t

◆ ebpf_map_definition_in_file_t

eBPF Map Definition as it appears in the maps section of an ELF file.

◆ ebpf_map_definition_in_memory_t

eBPF Map Definition as it is stored in memory.

◆ ebpf_map_option_t

◆ ebpf_map_type_t

◆ ebpf_pin_type_t

Enumeration Type Documentation

◆ bpf_attach_type

Enumerator
BPF_ATTACH_TYPE_UNSPEC 

Unspecified attach type.

BPF_XDP 

Attach type for handling incoming packets as early as possible.

Program type: BPF_PROG_TYPE_XDP

BPF_ATTACH_TYPE_BIND 

Attach type for handling socket bind() requests.

Program type: BPF_PROG_TYPE_BIND

BPF_CGROUP_INET4_CONNECT 

Attach type for handling IPv4 TCP connect() or UDP send to a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_INET6_CONNECT 

Attach type for handling IPv6 TCP connect() or UDP send to a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_INET4_RECV_ACCEPT 

Attach type for handling IPv4 TCP accept() or on receiving the first unicast UDP packet from a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_INET6_RECV_ACCEPT 

Attach type for handling IPv6 TCP accept() or on receiving the first unicast UDP packet from a unique remote address/port tuple.

Program type: BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_SOCK_OPS 

Attach type for handling various socket event notifications.

Program type: BPF_PROG_TYPE_SOCK_OPS

BPF_ATTACH_TYPE_SAMPLE 

Attach type implemented by eBPF Sample Extension driver, used for testing.

Program type: BPF_PROG_TYPE_SAMPLE

__MAX_BPF_ATTACH_TYPE 

◆ bpf_link_type

Enumerator
BPF_LINK_TYPE_UNSPEC 

Unspecified link type.

BPF_LINK_TYPE_PLAIN 

No union members are used in bpf_link_info.

BPF_LINK_TYPE_CGROUP 

cgroup struct is present in bpf_link_info.

BPF_LINK_TYPE_XDP 

xdp struct is present in bpf_link_info.

◆ bpf_map_type

Enumerator
BPF_MAP_TYPE_UNSPEC 

Unspecified map type.

BPF_MAP_TYPE_HASH 

Hash table.

BPF_MAP_TYPE_ARRAY 

Array, where the map key is the array index.

BPF_MAP_TYPE_PROG_ARRAY 

Array of program fds usable with bpf_tail_call, where the map key is the array index.

BPF_MAP_TYPE_PERCPU_HASH 

Per-CPU hash table.

BPF_MAP_TYPE_PERCPU_ARRAY 

Per-CPU array.

BPF_MAP_TYPE_HASH_OF_MAPS 

Hash table, where the map value is another map.

BPF_MAP_TYPE_ARRAY_OF_MAPS 

Array, where the map value is another map.

BPF_MAP_TYPE_LRU_HASH 

Least-recently-used hash table.

BPF_MAP_TYPE_LPM_TRIE 

Longest prefix match trie.

BPF_MAP_TYPE_QUEUE 

Queue.

BPF_MAP_TYPE_LRU_PERCPU_HASH 

Per-CPU least-recently-used hash table.

BPF_MAP_TYPE_STACK 

Stack.

BPF_MAP_TYPE_RINGBUF 

Ring buffer.

◆ bpf_prog_type

Enumerator
BPF_PROG_TYPE_UNSPEC 

Unspecified program type.

BPF_PROG_TYPE_XDP 

Program type for handling incoming packets as early as possible.

eBPF program prototype: xdp_hook_t

Attach type(s): BPF_XDP

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_BIND 

Program type for handling socket bind() requests.

eBPF program prototype: bind_hook_t

Attach type(s): BPF_ATTACH_TYPE_BIND

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_CGROUP_SOCK_ADDR 

Program type for handling various socket operations such as connect(), accept() etc.

eBPF program prototype: sock_addr_hook_t

Attach type(s): BPF_CGROUP_INET4_CONNECT BPF_CGROUP_INET6_CONNECT BPF_CGROUP_INET4_RECV_ACCEPT BPF_CGROUP_INET6_RECV_ACCEPT

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_SOCK_OPS 

Program type for handling various socket event notifications such as connection established etc.

eBPF program prototype: sock_ops_hook_t

Attach type(s): BPF_CGROUP_SOCK_OPS

Helpers available: all helpers defined in bpf_helpers.h

BPF_PROG_TYPE_SAMPLE 

Program type for handling calls from the eBPF sample extension. Used for testing.

eBPF program prototype: see the eBPF sample extension.

Attach type(s): BPF_ATTACH_TYPE_SAMPLE

◆ ebpf_helper_id_t

Enumerator
BPF_FUNC_map_lookup_elem 

bpf_map_lookup_elem

BPF_FUNC_map_update_elem 

bpf_map_update_elem

BPF_FUNC_map_delete_elem 

bpf_map_delete_elem

BPF_FUNC_map_lookup_and_delete_elem 

bpf_map_lookup_and_delete_elem

BPF_FUNC_tail_call 

bpf_tail_call

BPF_FUNC_get_prandom_u32 

bpf_get_prandom_u32

BPF_FUNC_ktime_get_boot_ns 

bpf_ktime_get_boot_ns

BPF_FUNC_get_smp_processor_id 

bpf_get_smp_processor_id

BPF_FUNC_ktime_get_ns 

bpf_ktime_get_ns

BPF_FUNC_csum_diff 

bpf_csum_diff

BPF_FUNC_ringbuf_output 

bpf_ringbuf_output

BPF_FUNC_trace_printk2 

bpf_trace_printk2 (but use bpf_printk instead)

BPF_FUNC_trace_printk3 

bpf_trace_printk3 (but use bpf_printk instead)

BPF_FUNC_trace_printk4 

bpf_trace_printk4 (but use bpf_printk instead)

BPF_FUNC_trace_printk5 

bpf_trace_printk5 (but use bpf_printk instead)

BPF_FUNC_map_push_elem 

bpf_map_push_elem

BPF_FUNC_map_pop_elem 

bpf_map_pop_elem

BPF_FUNC_map_peek_elem 

bpf_map_peek_elem

BPF_FUNC_get_current_pid_tgid 

bpf_get_current_pid_tgid

◆ ebpf_map_option

Enumerator
EBPF_ANY 

Create a new element or update an existing element.

EBPF_NOEXIST 

Create a new element only when it does not exist.

EBPF_EXIST 

Update an existing element.

◆ ebpf_pin_type

Enumerator
PIN_NONE 

Object is not pinned.

PIN_OBJECT_NS 

Pinning that is local to an object.

PIN_GLOBAL_NS 

Pinning with a global namespace.

PIN_CUSTOM_NS 

Pinning with a custom path given as section parameter.