eBPF for Windows
ebpf_structs.h
Go to the documentation of this file.
1 // Copyright (c) Microsoft Corporation
2 // SPDX-License-Identifier: MIT
3 #pragma once
4 
11 #include "ebpf_windows.h"
12 
13 #define MAX_TAIL_CALL_CNT 33
14 
15 #define BPF_ENUM_TO_STRING(X) #X
16 
17 typedef enum bpf_map_type
18 {
23  3,
35 
36 #define BPF_MAP_TYPE_PER_CPU(X) \
37  ((X) == BPF_MAP_TYPE_PERCPU_HASH || (X) == BPF_MAP_TYPE_PERCPU_ARRAY || (X) == BPF_MAP_TYPE_LRU_PERCPU_HASH)
38 
39 static const char* const _ebpf_map_type_names[] = {
54 };
55 
56 static const char* const _ebpf_map_display_names[] = {
57  "unspec",
58  "hash",
59  "array",
60  "prog_array",
61  "percpu_hash",
62  "percpu_array",
63  "hash_of_maps",
64  "array_of_maps",
65  "lru_hash",
66  "lpm_trie",
67  "queue",
68  "lru_percpu_hash",
69  "stack",
70  "ringbuf",
71 };
72 
73 typedef enum ebpf_map_option
74 {
77  EBPF_EXIST
79 
84 typedef enum ebpf_pin_type
85 {
89 
90 static const char* const _ebpf_pin_type_names[] = {
93 };
94 
95 typedef uint32_t ebpf_id_t;
96 #define EBPF_ID_NONE UINT32_MAX
97 
102 {
104  uint32_t key_size;
105  uint32_t value_size;
106  uint32_t max_entries;
110 
115 {
117  uint32_t key_size;
118  uint32_t value_size;
119  uint32_t max_entries;
120 
125  uint32_t inner_map_idx;
127 
130  uint32_t id;
133  uint32_t inner_id;
135 
136 typedef enum
137 {
164 
165 // Cross-platform BPF program types.
167 {
169 
179 
188  BPF_PROG_TYPE_BIND, // TODO(#333): replace with cross-platform program type
189 
203 
214 
224 
233 };
234 
235 typedef enum bpf_prog_type bpf_prog_type_t;
236 
237 #define XDP_FLAGS_REPLACE 0x01
238 
239 // The link type is used to tell which union member is present
240 // in the bpf_link_info struct. There is exactly one non-zero value
241 // per union member.
243 {
249 };
250 
251 static const char* const _ebpf_link_display_names[] = {
252  "unspec",
253  "plain",
254 };
255 
257 {
259 
265 
271 
278 
285 
292 
299 
305 
311 
317 
319 };
320 
322 
323 // Libbpf itself requires the following structs to be defined, but doesn't
324 // care what fields they have. Applications such as bpftool on the other
325 // hand depend on fields of specific names and types.
326 
327 #ifdef _MSC_VER
328 #pragma warning(push)
329 #pragma warning(disable : 4201) /* nameless struct/union */
330 #endif
336 {
339  enum bpf_link_type type;
343  union
344  {
345  struct
346  {
347  uint32_t ifindex;
348  } xdp;
349  struct
350  {
351  uint64_t cgroup_id;
353  uint8_t attach_data;
354  };
355 };
356 #ifdef _MSC_VER
357 #pragma warning(pop)
358 #endif
359 
360 #define BPF_OBJ_NAME_LEN 64
361 
367 {
368  // Cross-platform fields.
371  uint32_t key_size;
372  uint32_t value_size;
373  uint32_t max_entries;
375  uint32_t map_flags;
376 
377  // Windows-specific fields.
379  uint32_t pinned_path_count;
380 };
381 
382 #define BPF_ANY 0x0
383 #define BPF_NOEXIST 0x1
384 #define BPF_EXIST 0x2
385 
391 {
392  // Cross-platform fields.
394  enum bpf_prog_type type;
395  uint32_t nr_map_ids;
396  uintptr_t map_ids;
398 
399  // Windows-specific fields.
402  uint32_t pinned_path_count;
403  uint32_t link_count;
404 };
bpf_prog_type
Definition: ebpf_structs.h:167
@ BPF_PROG_TYPE_XDP
Program type for handling incoming packets as early as possible.
Definition: ebpf_structs.h:178
@ BPF_PROG_TYPE_BIND
Program type for handling socket bind() requests.
Definition: ebpf_structs.h:188
@ BPF_PROG_TYPE_CGROUP_SOCK_ADDR
Program type for handling various socket operations such as connect(), accept() etc.
Definition: ebpf_structs.h:202
@ BPF_PROG_TYPE_UNSPEC
Unspecified program type.
Definition: ebpf_structs.h:168
@ BPF_PROG_TYPE_XDP_TEST
Program type for handling incoming packets as early as possible.
Definition: ebpf_structs.h:223
@ BPF_PROG_TYPE_SOCK_OPS
Program type for handling various socket event notifications such as connection established etc.
Definition: ebpf_structs.h:213
@ BPF_PROG_TYPE_SAMPLE
Program type for handling calls from the eBPF sample extension. Used for testing.
Definition: ebpf_structs.h:232
enum ebpf_map_option ebpf_map_option_t
bpf_link_type
Definition: ebpf_structs.h:243
@ BPF_LINK_TYPE_UNSPEC
Unspecified link type.
Definition: ebpf_structs.h:244
@ BPF_LINK_TYPE_PLAIN
No union members are used in bpf_link_info.
Definition: ebpf_structs.h:245
@ BPF_LINK_TYPE_CGROUP
cgroup struct is present in bpf_link_info.
Definition: ebpf_structs.h:246
@ BPF_LINK_TYPE_XDP
xdp struct is present in bpf_link_info.
Definition: ebpf_structs.h:247
@ BPF_LINK_TYPE_MAX
Definition: ebpf_structs.h:248
enum bpf_prog_type bpf_prog_type_t
Definition: ebpf_structs.h:235
enum bpf_map_type ebpf_map_type_t
#define BPF_ENUM_TO_STRING(X)
Definition: ebpf_structs.h:15
struct _ebpf_map_definition_in_memory ebpf_map_definition_in_memory_t
eBPF Map Definition as it is stored in memory.
enum ebpf_pin_type ebpf_pin_type_t
Pinning type for eBPF objects. The values should match the LIBBPF_PIN_* pin types defined in libbpf.
ebpf_pin_type
Pinning type for eBPF objects. The values should match the LIBBPF_PIN_* pin types defined in libbpf.
Definition: ebpf_structs.h:85
@ LIBBPF_PIN_NONE
Object is not pinned.
Definition: ebpf_structs.h:86
@ LIBBPF_PIN_BY_NAME
Pinning with a global namespace.
Definition: ebpf_structs.h:87
uint32_t ebpf_id_t
Definition: ebpf_structs.h:95
ebpf_helper_id_t
Definition: ebpf_structs.h:137
@ BPF_FUNC_trace_printk2
bpf_trace_printk2 (but use bpf_printk instead)
Definition: ebpf_structs.h:149
@ BPF_FUNC_tail_call
bpf_tail_call
Definition: ebpf_structs.h:142
@ BPF_FUNC_ktime_get_ns
bpf_ktime_get_ns
Definition: ebpf_structs.h:146
@ BPF_FUNC_memset
bpf_memset
Definition: ebpf_structs.h:161
@ BPF_FUNC_get_smp_processor_id
bpf_get_smp_processor_id
Definition: ebpf_structs.h:145
@ BPF_FUNC_get_prandom_u32
bpf_get_prandom_u32
Definition: ebpf_structs.h:143
@ BPF_FUNC_trace_printk3
bpf_trace_printk3 (but use bpf_printk instead)
Definition: ebpf_structs.h:150
@ BPF_FUNC_map_lookup_and_delete_elem
bpf_map_lookup_and_delete_elem
Definition: ebpf_structs.h:141
@ BPF_FUNC_ringbuf_output
bpf_ringbuf_output
Definition: ebpf_structs.h:148
@ BPF_FUNC_memcmp
bpf_memcmp
Definition: ebpf_structs.h:160
@ BPF_FUNC_memmove
bpf_memmove
Definition: ebpf_structs.h:162
@ BPF_FUNC_trace_printk5
bpf_trace_printk5 (but use bpf_printk instead)
Definition: ebpf_structs.h:152
@ BPF_FUNC_is_current_admin
bpf_is_current_admin
Definition: ebpf_structs.h:158
@ BPF_FUNC_map_pop_elem
bpf_map_pop_elem
Definition: ebpf_structs.h:154
@ BPF_FUNC_map_update_elem
bpf_map_update_elem
Definition: ebpf_structs.h:139
@ BPF_FUNC_csum_diff
bpf_csum_diff
Definition: ebpf_structs.h:147
@ BPF_FUNC_map_delete_elem
bpf_map_delete_elem
Definition: ebpf_structs.h:140
@ BPF_FUNC_map_lookup_elem
bpf_map_lookup_elem
Definition: ebpf_structs.h:138
@ BPF_FUNC_trace_printk4
bpf_trace_printk4 (but use bpf_printk instead)
Definition: ebpf_structs.h:151
@ BPF_FUNC_map_peek_elem
bpf_map_peek_elem
Definition: ebpf_structs.h:155
@ BPF_FUNC_ktime_get_boot_ns
bpf_ktime_get_boot_ns
Definition: ebpf_structs.h:144
@ BPF_FUNC_get_current_logon_id
bpf_get_current_logon_id
Definition: ebpf_structs.h:157
@ BPF_FUNC_memcpy
bpf_memcpy
Definition: ebpf_structs.h:159
@ BPF_FUNC_map_push_elem
bpf_map_push_elem
Definition: ebpf_structs.h:153
@ BPF_FUNC_get_current_pid_tgid
bpf_get_current_pid_tgid
Definition: ebpf_structs.h:156
bpf_attach_type
Definition: ebpf_structs.h:257
@ BPF_XDP
Attach type for handling incoming packets as early as possible.
Definition: ebpf_structs.h:264
@ BPF_CGROUP_INET6_CONNECT
Attach type for handling IPv6 TCP connect() or UDP send to a unique remote address/port tuple.
Definition: ebpf_structs.h:284
@ BPF_ATTACH_TYPE_UNSPEC
Unspecified attach type.
Definition: ebpf_structs.h:258
@ __MAX_BPF_ATTACH_TYPE
Definition: ebpf_structs.h:318
@ BPF_ATTACH_TYPE_BIND
Attach type for handling socket bind() requests.
Definition: ebpf_structs.h:270
@ BPF_XDP_TEST
Attach type for handling incoming packets as early as possible.
Definition: ebpf_structs.h:316
@ BPF_CGROUP_INET6_RECV_ACCEPT
Attach type for handling IPv6 TCP accept() or on receiving the first unicast UDP packet from a unique...
Definition: ebpf_structs.h:298
@ BPF_ATTACH_TYPE_SAMPLE
Attach type implemented by eBPF Sample Extension driver, used for testing.
Definition: ebpf_structs.h:310
@ BPF_CGROUP_SOCK_OPS
Attach type for handling various socket event notifications.
Definition: ebpf_structs.h:304
@ BPF_CGROUP_INET4_RECV_ACCEPT
Attach type for handling IPv4 TCP accept() or on receiving the first unicast UDP packet from a unique...
Definition: ebpf_structs.h:291
@ BPF_CGROUP_INET4_CONNECT
Attach type for handling IPv4 TCP connect() or UDP send to a unique remote address/port tuple.
Definition: ebpf_structs.h:277
struct _ebpf_map_definition_in_file ebpf_map_definition_in_file_t
eBPF Map Definition as it appears in the maps section of an ELF file.
#define BPF_OBJ_NAME_LEN
Definition: ebpf_structs.h:360
enum bpf_attach_type bpf_attach_type_t
Definition: ebpf_structs.h:321
ebpf_map_option
Definition: ebpf_structs.h:74
@ EBPF_ANY
Create a new element or update an existing element.
Definition: ebpf_structs.h:75
@ EBPF_EXIST
Update an existing element.
Definition: ebpf_structs.h:77
@ EBPF_NOEXIST
Create a new element only when it does not exist.
Definition: ebpf_structs.h:76
bpf_map_type
Definition: ebpf_structs.h:18
@ BPF_MAP_TYPE_STACK
Stack.
Definition: ebpf_structs.h:32
@ BPF_MAP_TYPE_RINGBUF
Ring buffer.
Definition: ebpf_structs.h:33
@ BPF_MAP_TYPE_PERCPU_ARRAY
Per-CPU array.
Definition: ebpf_structs.h:25
@ BPF_MAP_TYPE_QUEUE
Queue.
Definition: ebpf_structs.h:30
@ BPF_MAP_TYPE_LRU_PERCPU_HASH
Per-CPU least-recently-used hash table.
Definition: ebpf_structs.h:31
@ BPF_MAP_TYPE_LPM_TRIE
Longest prefix match trie.
Definition: ebpf_structs.h:29
@ BPF_MAP_TYPE_HASH_OF_MAPS
Hash table, where the map value is another map.
Definition: ebpf_structs.h:26
@ BPF_MAP_TYPE_LRU_HASH
Least-recently-used hash table.
Definition: ebpf_structs.h:28
@ BPF_MAP_TYPE_PERCPU_HASH
Per-CPU hash table.
Definition: ebpf_structs.h:24
@ BPF_MAP_TYPE_ARRAY_OF_MAPS
Array, where the map value is another map.
Definition: ebpf_structs.h:27
@ BPF_MAP_TYPE_UNSPEC
Unspecified map type.
Definition: ebpf_structs.h:19
@ BPF_MAP_TYPE_ARRAY
Array, where the map key is the array index.
Definition: ebpf_structs.h:21
@ BPF_MAP_TYPE_PROG_ARRAY
Array of program fds usable with bpf_tail_call, where the map key is the array index.
Definition: ebpf_structs.h:22
@ BPF_MAP_TYPE_HASH
Hash table.
Definition: ebpf_structs.h:20
GUID ebpf_attach_type_t
Definition: ebpf_windows.h:62
GUID ebpf_program_type_t
Definition: ebpf_windows.h:61
eBPF Map Definition as it appears in the maps section of an ELF file.
Definition: ebpf_structs.h:115
uint32_t inner_id
Definition: ebpf_structs.h:133
uint32_t key_size
Size in bytes of a map key.
Definition: ebpf_structs.h:117
uint32_t max_entries
Maximum number of entries allowed in the map.
Definition: ebpf_structs.h:119
uint32_t inner_map_idx
Definition: ebpf_structs.h:125
ebpf_map_type_t type
Type of map.
Definition: ebpf_structs.h:116
uint32_t value_size
Size in bytes of a map value.
Definition: ebpf_structs.h:118
ebpf_pin_type_t pinning
Definition: ebpf_structs.h:126
uint32_t id
Definition: ebpf_structs.h:130
eBPF Map Definition as it is stored in memory.
Definition: ebpf_structs.h:102
ebpf_map_type_t type
Type of map.
Definition: ebpf_structs.h:103
uint32_t key_size
Size in bytes of a map key.
Definition: ebpf_structs.h:104
ebpf_id_t inner_map_id
Definition: ebpf_structs.h:107
uint32_t max_entries
Maximum number of entries allowed in the map.
Definition: ebpf_structs.h:106
ebpf_pin_type_t pinning
Definition: ebpf_structs.h:108
uint32_t value_size
Size in bytes of a map value.
Definition: ebpf_structs.h:105
eBPF map information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a map fd.
Definition: ebpf_structs.h:367
uint32_t max_entries
Maximum number of entries allowed in the map.
Definition: ebpf_structs.h:373
char name[BPF_OBJ_NAME_LEN]
Null-terminated map name.
Definition: ebpf_structs.h:374
ebpf_map_type_t type
Type of map.
Definition: ebpf_structs.h:370
uint32_t key_size
Size in bytes of a map key.
Definition: ebpf_structs.h:371
ebpf_id_t id
Map ID.
Definition: ebpf_structs.h:369
uint32_t map_flags
Map flags.
Definition: ebpf_structs.h:375
uint32_t pinned_path_count
Number of pinned paths.
Definition: ebpf_structs.h:379
uint32_t value_size
Size in bytes of a map value.
Definition: ebpf_structs.h:372
ebpf_id_t inner_map_id
ID of inner map template.
Definition: ebpf_structs.h:378
eBPF program information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a prog...
Definition: ebpf_structs.h:391
ebpf_attach_type_t attach_type_uuid
Attach type UUID.
Definition: ebpf_structs.h:401
uint32_t pinned_path_count
Number of pinned paths.
Definition: ebpf_structs.h:402
uint32_t link_count
Number of attached links.
Definition: ebpf_structs.h:403
enum bpf_prog_type type
Program type, if a cross-platform type.
Definition: ebpf_structs.h:394
char name[BPF_OBJ_NAME_LEN]
Null-terminated program name.
Definition: ebpf_structs.h:397
uintptr_t map_ids
Pointer to caller-allocated array to fill map IDs into.
Definition: ebpf_structs.h:396
uint32_t nr_map_ids
Number of maps associated with this program.
Definition: ebpf_structs.h:395
ebpf_id_t id
Program ID.
Definition: ebpf_structs.h:393
ebpf_program_type_t type_uuid
Program type UUID.
Definition: ebpf_structs.h:400