eBPF for Windows
ebpf_structs.h
Go to the documentation of this file.
1 // Copyright (c) Microsoft Corporation
2 // SPDX-License-Identifier: MIT
3 
4 // This file contains eBPF definitions common to eBPF programs, core execution engine
5 // as well as eBPF API library.
6 
7 #pragma once
8 
9 #if !defined(NO_CRT)
10 #include <stdbool.h>
11 #include <stdint.h>
12 #endif
13 #include "ebpf_windows.h"
14 
15 #define BPF_ENUM_TO_STRING(X) #X
16 
17 typedef enum bpf_map_type
18 {
23  3,
35 
36 #define BPF_MAP_TYPE_PER_CPU(X) \
37  ((X) == BPF_MAP_TYPE_PERCPU_HASH || (X) == BPF_MAP_TYPE_PERCPU_ARRAY || (X) == BPF_MAP_TYPE_LRU_PERCPU_HASH)
38 
39 static const char* const _ebpf_map_type_names[] = {
54 };
55 
56 static const char* const _ebpf_map_display_names[] = {
57  "unspec",
58  "hash",
59  "array",
60  "prog_array",
61  "percpu_hash",
62  "percpu_array",
63  "hash_of_maps",
64  "array_of_maps",
65  "lru_hash",
66  "lpm_trie",
67  "queue",
68  "lru_percpu_hash",
69  "stack",
70  "ringbuf",
71 };
72 
73 typedef enum ebpf_map_option
74 {
79 
80 typedef enum ebpf_pin_type
81 {
87 
88 static const char* const _ebpf_pin_type_names[] = {
93 };
94 
95 typedef uint32_t ebpf_id_t;
96 #define EBPF_ID_NONE UINT32_MAX
97 
102 {
104  uint32_t key_size;
105  uint32_t value_size;
106  uint32_t max_entries;
110 
115 {
117  uint32_t key_size;
118  uint32_t value_size;
119  uint32_t max_entries;
120 
125  uint32_t inner_map_idx;
127 
130  uint32_t id;
133  uint32_t inner_id;
135 
136 typedef enum
137 {
158 
159 // Cross-platform BPF program types.
161 {
163 
173 
182  BPF_PROG_TYPE_BIND, // TODO(#333): replace with cross-platform program type
183 
197 
208 
217 };
218 
220 
221 #define XDP_FLAGS_REPLACE 0x01
222 
223 // The link type is used to tell which union member is present
224 // in the bpf_link_info struct. There is exactly one non-zero value
225 // per union member.
227 {
232 };
233 
234 static const char* const _ebpf_link_display_names[] = {
235  "unspec",
236  "plain",
237 };
238 
240 {
242 
248 
254 
261 
268 
275 
282 
288 
294 
296 };
297 
299 
300 // Libbpf itself requires the following structs to be defined, but doesn't
301 // care what fields they have. Applications such as bpftool on the other
302 // hand depend on fields of specific names and types.
303 
304 #ifdef _MSC_VER
305 #pragma warning(push)
306 #pragma warning(disable : 4201) /* nameless struct/union */
307 #endif
308 
313 {
320  union
321  {
322  struct
323  {
324  uint32_t ifindex;
325  } xdp;
326  struct
327  {
328  uint64_t cgroup_id;
329  } cgroup;
330  uint8_t attach_data;
331  };
332 };
333 #ifdef _MSC_VER
334 #pragma warning(pop)
335 #endif
336 
337 #define BPF_OBJ_NAME_LEN 64
338 
344 {
345  // Cross-platform fields.
348  uint32_t key_size;
349  uint32_t value_size;
350  uint32_t max_entries;
352  uint32_t map_flags;
353 
354  // Windows-specific fields.
356  uint32_t pinned_path_count;
357 };
358 
359 #define BPF_ANY 0x0
360 #define BPF_NOEXIST 0x1
361 #define BPF_EXIST 0x2
362 
368 {
369  // Cross-platform fields.
372  uint32_t nr_map_ids;
373  uintptr_t map_ids;
375 
376  // Windows-specific fields.
379  uint32_t pinned_path_count;
380  uint32_t link_count;
381 };
bpf_attach_type_t
enum bpf_attach_type bpf_attach_type_t
Definition: ebpf_structs.h:298
ebpf_map_definition_in_file_t
struct _ebpf_map_definition_in_file ebpf_map_definition_in_file_t
eBPF Map Definition as it appears in the maps section of an ELF file.
ebpf_map_option_t
enum ebpf_map_option ebpf_map_option_t
BPF_FUNC_map_push_elem
@ BPF_FUNC_map_push_elem
bpf_map_push_elem
Definition: ebpf_structs.h:153
bpf_map_info::map_flags
uint32_t map_flags
Map flags.
Definition: ebpf_structs.h:352
bpf_map_info::name
char name[BPF_OBJ_NAME_LEN]
Null-terminated map name.
Definition: ebpf_structs.h:351
ebpf_pin_type_t
enum ebpf_pin_type ebpf_pin_type_t
BPF_MAP_TYPE_PROG_ARRAY
@ BPF_MAP_TYPE_PROG_ARRAY
Array of program fds usable with bpf_tail_call, where the map key is the array index.
Definition: ebpf_structs.h:22
ebpf_helper_id_t
ebpf_helper_id_t
Definition: ebpf_structs.h:136
bpf_prog_info::pinned_path_count
uint32_t pinned_path_count
Number of pinned paths.
Definition: ebpf_structs.h:379
_ebpf_map_definition_in_file::id
uint32_t id
Definition: ebpf_structs.h:130
_ebpf_map_definition_in_memory::pinning
ebpf_pin_type_t pinning
Definition: ebpf_structs.h:108
bpf_map_info::key_size
uint32_t key_size
Size in bytes of a map key.
Definition: ebpf_structs.h:348
BPF_MAP_TYPE_LRU_HASH
@ BPF_MAP_TYPE_LRU_HASH
Least-recently-used hash table.
Definition: ebpf_structs.h:28
BPF_CGROUP_SOCK_OPS
@ BPF_CGROUP_SOCK_OPS
Attach type for handling various socket event notifications.
Definition: ebpf_structs.h:287
BPF_PROG_TYPE_SOCK_OPS
@ BPF_PROG_TYPE_SOCK_OPS
Program type for handling various socket event notifications such as connection established etc.
Definition: ebpf_structs.h:207
BPF_PROG_TYPE_SAMPLE
@ BPF_PROG_TYPE_SAMPLE
Program type for handling calls from the eBPF sample extension. Used for testing.
Definition: ebpf_structs.h:216
BPF_MAP_TYPE_HASH_OF_MAPS
@ BPF_MAP_TYPE_HASH_OF_MAPS
Hash table, where the map value is another map.
Definition: ebpf_structs.h:26
BPF_CGROUP_INET6_CONNECT
@ BPF_CGROUP_INET6_CONNECT
Attach type for handling IPv6 TCP connect() or UDP send to a unique remote address/port tuple.
Definition: ebpf_structs.h:267
BPF_MAP_TYPE_HASH
@ BPF_MAP_TYPE_HASH
Hash table.
Definition: ebpf_structs.h:20
BPF_FUNC_get_prandom_u32
@ BPF_FUNC_get_prandom_u32
bpf_get_prandom_u32
Definition: ebpf_structs.h:143
BPF_MAP_TYPE_LRU_PERCPU_HASH
@ BPF_MAP_TYPE_LRU_PERCPU_HASH
Per-CPU least-recently-used hash table.
Definition: ebpf_structs.h:31
bpf_prog_type
bpf_prog_type
Definition: ebpf_structs.h:160
BPF_MAP_TYPE_QUEUE
@ BPF_MAP_TYPE_QUEUE
Queue.
Definition: ebpf_structs.h:30
bpf_prog_type_t
enum bpf_prog_type bpf_prog_type_t
Definition: ebpf_structs.h:219
bpf_map_info::pinned_path_count
uint32_t pinned_path_count
Number of pinned paths.
Definition: ebpf_structs.h:356
BPF_ATTACH_TYPE_UNSPEC
@ BPF_ATTACH_TYPE_UNSPEC
Unspecified attach type.
Definition: ebpf_structs.h:241
_ebpf_map_definition_in_memory::key_size
uint32_t key_size
Size in bytes of a map key.
Definition: ebpf_structs.h:104
bpf_map_info::id
ebpf_id_t id
Map ID.
Definition: ebpf_structs.h:346
BPF_ATTACH_TYPE_SAMPLE
@ BPF_ATTACH_TYPE_SAMPLE
Attach type implemented by eBPF Sample Extension driver, used for testing.
Definition: ebpf_structs.h:293
ebpf_pin_type
ebpf_pin_type
Definition: ebpf_structs.h:80
_ebpf_map_definition_in_file::inner_map_idx
uint32_t inner_map_idx
Definition: ebpf_structs.h:125
bpf_prog_info::type
enum bpf_prog_type type
Program type, if a cross-platform type.
Definition: ebpf_structs.h:371
BPF_CGROUP_INET4_CONNECT
@ BPF_CGROUP_INET4_CONNECT
Attach type for handling IPv4 TCP connect() or UDP send to a unique remote address/port tuple.
Definition: ebpf_structs.h:260
_ebpf_map_definition_in_file
eBPF Map Definition as it appears in the maps section of an ELF file.
Definition: ebpf_structs.h:114
PIN_OBJECT_NS
@ PIN_OBJECT_NS
Pinning that is local to an object.
Definition: ebpf_structs.h:83
BPF_ATTACH_TYPE_BIND
@ BPF_ATTACH_TYPE_BIND
Attach type for handling socket bind() requests.
Definition: ebpf_structs.h:253
BPF_LINK_TYPE_CGROUP
@ BPF_LINK_TYPE_CGROUP
cgroup struct is present in bpf_link_info.
Definition: ebpf_structs.h:230
ebpf_windows.h
_ebpf_map_definition_in_memory::value_size
uint32_t value_size
Size in bytes of a map value.
Definition: ebpf_structs.h:105
EBPF_EXIST
@ EBPF_EXIST
Update an existing element.
Definition: ebpf_structs.h:77
bpf_prog_info::nr_map_ids
uint32_t nr_map_ids
Number of maps associated with this program.
Definition: ebpf_structs.h:372
BPF_FUNC_trace_printk5
@ BPF_FUNC_trace_printk5
bpf_trace_printk5 (but use bpf_printk instead)
Definition: ebpf_structs.h:152
bpf_map_info::value_size
uint32_t value_size
Size in bytes of a map value.
Definition: ebpf_structs.h:349
BPF_MAP_TYPE_RINGBUF
@ BPF_MAP_TYPE_RINGBUF
Ring buffer.
Definition: ebpf_structs.h:33
BPF_FUNC_map_update_elem
@ BPF_FUNC_map_update_elem
bpf_map_update_elem
Definition: ebpf_structs.h:139
BPF_FUNC_map_pop_elem
@ BPF_FUNC_map_pop_elem
bpf_map_pop_elem
Definition: ebpf_structs.h:154
_ebpf_map_definition_in_file::max_entries
uint32_t max_entries
Maximum number of entries allowed in the map.
Definition: ebpf_structs.h:119
ebpf_map_definition_in_memory_t
struct _ebpf_map_definition_in_memory ebpf_map_definition_in_memory_t
eBPF Map Definition as it is stored in memory.
_ebpf_map_definition_in_memory
eBPF Map Definition as it is stored in memory.
Definition: ebpf_structs.h:101
BPF_MAP_TYPE_UNSPEC
@ BPF_MAP_TYPE_UNSPEC
Unspecified map type.
Definition: ebpf_structs.h:19
BPF_FUNC_ktime_get_ns
@ BPF_FUNC_ktime_get_ns
bpf_ktime_get_ns
Definition: ebpf_structs.h:146
BPF_CGROUP_INET4_RECV_ACCEPT
@ BPF_CGROUP_INET4_RECV_ACCEPT
Attach type for handling IPv4 TCP accept() or on receiving the first unicast UDP packet from a unique...
Definition: ebpf_structs.h:274
BPF_OBJ_NAME_LEN
#define BPF_OBJ_NAME_LEN
Definition: ebpf_structs.h:337
BPF_ENUM_TO_STRING
#define BPF_ENUM_TO_STRING(X)
Definition: ebpf_structs.h:15
BPF_PROG_TYPE_CGROUP_SOCK_ADDR
@ BPF_PROG_TYPE_CGROUP_SOCK_ADDR
Program type for handling various socket operations such as connect(), accept() etc.
Definition: ebpf_structs.h:196
BPF_FUNC_trace_printk2
@ BPF_FUNC_trace_printk2
bpf_trace_printk2 (but use bpf_printk instead)
Definition: ebpf_structs.h:149
EBPF_NOEXIST
@ EBPF_NOEXIST
Create a new element only when it does not exist.
Definition: ebpf_structs.h:76
ebpf_program_type_t
GUID ebpf_program_type_t
Definition: ebpf_windows.h:38
BPF_MAP_TYPE_PERCPU_ARRAY
@ BPF_MAP_TYPE_PERCPU_ARRAY
Per-CPU array.
Definition: ebpf_structs.h:25
PIN_NONE
@ PIN_NONE
Object is not pinned.
Definition: ebpf_structs.h:82
bpf_prog_info::type_uuid
ebpf_program_type_t type_uuid
Program type UUID.
Definition: ebpf_structs.h:377
_ebpf_map_definition_in_file::value_size
uint32_t value_size
Size in bytes of a map value.
Definition: ebpf_structs.h:118
ebpf_map_option
ebpf_map_option
Definition: ebpf_structs.h:73
BPF_FUNC_ringbuf_output
@ BPF_FUNC_ringbuf_output
bpf_ringbuf_output
Definition: ebpf_structs.h:148
BPF_FUNC_map_lookup_elem
@ BPF_FUNC_map_lookup_elem
bpf_map_lookup_elem
Definition: ebpf_structs.h:138
PIN_CUSTOM_NS
@ PIN_CUSTOM_NS
Pinning with a custom path given as section parameter.
Definition: ebpf_structs.h:85
ebpf_id_t
uint32_t ebpf_id_t
Definition: ebpf_structs.h:95
_ebpf_map_definition_in_memory::inner_map_id
ebpf_id_t inner_map_id
Definition: ebpf_structs.h:107
BPF_LINK_TYPE_PLAIN
@ BPF_LINK_TYPE_PLAIN
No union members are used in bpf_link_info.
Definition: ebpf_structs.h:229
_ebpf_map_definition_in_file::inner_id
uint32_t inner_id
Definition: ebpf_structs.h:133
bpf_attach_type
bpf_attach_type
Definition: ebpf_structs.h:239
BPF_FUNC_map_peek_elem
@ BPF_FUNC_map_peek_elem
bpf_map_peek_elem
Definition: ebpf_structs.h:155
BPF_MAP_TYPE_ARRAY_OF_MAPS
@ BPF_MAP_TYPE_ARRAY_OF_MAPS
Array, where the map value is another map.
Definition: ebpf_structs.h:27
bpf_map_type
bpf_map_type
Definition: ebpf_structs.h:17
EBPF_ANY
@ EBPF_ANY
Create a new element or update an existing element.
Definition: ebpf_structs.h:75
BPF_FUNC_map_delete_elem
@ BPF_FUNC_map_delete_elem
bpf_map_delete_elem
Definition: ebpf_structs.h:140
BPF_LINK_TYPE_XDP
@ BPF_LINK_TYPE_XDP
xdp struct is present in bpf_link_info.
Definition: ebpf_structs.h:231
BPF_PROG_TYPE_BIND
@ BPF_PROG_TYPE_BIND
Program type for handling socket bind() requests.
Definition: ebpf_structs.h:182
bpf_map_info::max_entries
uint32_t max_entries
Maximum number of entries allowed in the map.
Definition: ebpf_structs.h:350
bpf_prog_info::link_count
uint32_t link_count
Number of attached links.
Definition: ebpf_structs.h:380
BPF_FUNC_map_lookup_and_delete_elem
@ BPF_FUNC_map_lookup_and_delete_elem
bpf_map_lookup_and_delete_elem
Definition: ebpf_structs.h:141
_ebpf_map_definition_in_memory::max_entries
uint32_t max_entries
Maximum number of entries allowed in the map.
Definition: ebpf_structs.h:106
BPF_FUNC_ktime_get_boot_ns
@ BPF_FUNC_ktime_get_boot_ns
bpf_ktime_get_boot_ns
Definition: ebpf_structs.h:144
__MAX_BPF_ATTACH_TYPE
@ __MAX_BPF_ATTACH_TYPE
Definition: ebpf_structs.h:295
bpf_prog_info::id
ebpf_id_t id
Program ID.
Definition: ebpf_structs.h:370
BPF_LINK_TYPE_UNSPEC
@ BPF_LINK_TYPE_UNSPEC
Unspecified link type.
Definition: ebpf_structs.h:228
ebpf_map_type_t
enum bpf_map_type ebpf_map_type_t
BPF_MAP_TYPE_STACK
@ BPF_MAP_TYPE_STACK
Stack.
Definition: ebpf_structs.h:32
_ebpf_map_definition_in_file::key_size
uint32_t key_size
Size in bytes of a map key.
Definition: ebpf_structs.h:117
bpf_prog_info
eBPF program information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a prog...
Definition: ebpf_structs.h:367
BPF_FUNC_trace_printk3
@ BPF_FUNC_trace_printk3
bpf_trace_printk3 (but use bpf_printk instead)
Definition: ebpf_structs.h:150
bpf_map_info::inner_map_id
ebpf_id_t inner_map_id
ID of inner map template.
Definition: ebpf_structs.h:355
bpf_link_type
bpf_link_type
Definition: ebpf_structs.h:226
BPF_CGROUP_INET6_RECV_ACCEPT
@ BPF_CGROUP_INET6_RECV_ACCEPT
Attach type for handling IPv6 TCP accept() or on receiving the first unicast UDP packet from a unique...
Definition: ebpf_structs.h:281
BPF_FUNC_csum_diff
@ BPF_FUNC_csum_diff
bpf_csum_diff
Definition: ebpf_structs.h:147
_ebpf_map_definition_in_memory::type
ebpf_map_type_t type
Type of map.
Definition: ebpf_structs.h:103
BPF_FUNC_trace_printk4
@ BPF_FUNC_trace_printk4
bpf_trace_printk4 (but use bpf_printk instead)
Definition: ebpf_structs.h:151
PIN_GLOBAL_NS
@ PIN_GLOBAL_NS
Pinning with a global namespace.
Definition: ebpf_structs.h:84
BPF_MAP_TYPE_LPM_TRIE
@ BPF_MAP_TYPE_LPM_TRIE
Longest prefix match trie.
Definition: ebpf_structs.h:29
BPF_PROG_TYPE_XDP
@ BPF_PROG_TYPE_XDP
Program type for handling incoming packets as early as possible.
Definition: ebpf_structs.h:172
BPF_PROG_TYPE_UNSPEC
@ BPF_PROG_TYPE_UNSPEC
Unspecified program type.
Definition: ebpf_structs.h:162
_ebpf_map_definition_in_file::pinning
ebpf_pin_type_t pinning
Definition: ebpf_structs.h:126
BPF_MAP_TYPE_ARRAY
@ BPF_MAP_TYPE_ARRAY
Array, where the map key is the array index.
Definition: ebpf_structs.h:21
BPF_FUNC_get_smp_processor_id
@ BPF_FUNC_get_smp_processor_id
bpf_get_smp_processor_id
Definition: ebpf_structs.h:145
bpf_prog_info::map_ids
uintptr_t map_ids
Pointer to caller-allocated array to fill map IDs into.
Definition: ebpf_structs.h:373
ebpf_attach_type_t
GUID ebpf_attach_type_t
Definition: ebpf_windows.h:39
BPF_FUNC_get_current_pid_tgid
@ BPF_FUNC_get_current_pid_tgid
bpf_get_current_pid_tgid
Definition: ebpf_structs.h:156
bpf_prog_info::name
char name[BPF_OBJ_NAME_LEN]
Null-terminated program name.
Definition: ebpf_structs.h:374
BPF_MAP_TYPE_PERCPU_HASH
@ BPF_MAP_TYPE_PERCPU_HASH
Per-CPU hash table.
Definition: ebpf_structs.h:24
_ebpf_map_definition_in_file::type
ebpf_map_type_t type
Type of map.
Definition: ebpf_structs.h:116
BPF_XDP
@ BPF_XDP
Attach type for handling incoming packets as early as possible.
Definition: ebpf_structs.h:247
bpf_prog_info::attach_type_uuid
ebpf_attach_type_t attach_type_uuid
Attach type UUID.
Definition: ebpf_structs.h:378
BPF_FUNC_tail_call
@ BPF_FUNC_tail_call
bpf_tail_call
Definition: ebpf_structs.h:142
bpf_map_info
eBPF map information. This structure can be retrieved by calling bpf_obj_get_info_by_fd on a map fd.
Definition: ebpf_structs.h:343
bpf_map_info::type
ebpf_map_type_t type
Type of map.
Definition: ebpf_structs.h:347