Libbpf eBPF side
Libbpf contains a number of C header files containing mostly pre-processor macros, forward declarations and type definitions that make it easier to write eBPF programs. This is an index into these useful definitions.
bpf_helper_defs.h
The bpf_helper_defs.h file is automatically generated from the kernel sources. It contains forward declarations for every type that is used by eBPF helper functions and somewhat special forward declarations for the helper functions themselves.
For example, the bpf_map_lookup_elem function is declared as:
static void *(* const bpf_map_lookup_elem)(void *map, const void *key) = (void *) 1;
The normal forward declaration of this function would be
void *bpf_map_lookup_elem(void *map, const void *key);.
But what the special declaration does is it casts a pointer of value 1 to a const static function pointer. This causes the compiler to emit a call 1 instruction which the kernel recognizes as a call to the bpf_map_lookup_elem function.
It is entirely possible to copy parts of this file if you are only interested in specific helper functions and their types and even modify their definitions to suit your needs. Though for most people it will be best to include the whole file.
bpf_helpers.h
The bpf_helpers.h file is the single most useful file in the eBPF side of the libbpf library. It contains a lot of
generic and basic definitions you will use in almost any eBPF program. It also includes the bpf_helper_defs.h file,
so you don't need to include it separately.
The file contains definitions for the following:
- BTF map macros / types
- Attributes
- Global function attributes
SECKERNEL_VERSIONoffsetofcontainer_ofbarrierbarrier_var__bpf_unreachablebpf_tail_call_staticbpf_ksym_existsPrintf macros - Open coded iterator loop macros
bpf_for_eachbpf_forbpf_repeat
bpf_endian.h
The bpf_endian.h file contains macros for endianess conversion. It is useful when you need to convert data between host and network byte order.
The file contains definitions for the following:
bpf_htonsbpf_ntohsbpf_htonlbpf_ntohlbpf_cpu_to_be64bpf_be64_to_cpu
bpf_tracing.h
The bpf_tracing.h file contains macros which are mostly meant for tracing-like program types such as BPF_PROG_TYPE_KPROBE and BPF_PROG_TYPE_TRACING. Most provided functionality is related to the given context to parameters and/or return value.
The file contains definitions for the following:
PT_REGS_PARMPT_REGS_RETPT_REGS_FPPT_REGS_RCPT_REGS_SPPT_REGS_IPPT_REGS_SYSCALL_REGSBPF_PROGBPF_PROG2BPF_KPROBE/BPF_UPROBEBPF_KRETPROBE/BPF_URETPROBEBPF_KSYSCALL/BPF_KPROBE_SYSCALL
bpf_core_read.h
The bpf_core_read.h file contains macros for CO-RE(Compile Once Run Everywhere) operations.
The file contains definitions for the following:
BPF_CORE_READ_BITFIELD_PROBEDBPF_CORE_READ_BITFIELDBPF_CORE_WRITE_BITFIELDbpf_core_field_existsbpf_core_field_sizebpf_core_field_offsetbpf_core_type_id_localbpf_core_type_id_kernelbpf_core_type_existsbpf_core_type_matchesbpf_core_type_sizebpf_core_enum_value_existsbpf_core_enum_valuebpf_core_readbpf_core_read_userbpf_core_read_strbpf_core_read_user_strbpf_core_castBPF_CORE_READ_INTOBPF_CORE_READ_USER_INTOBPF_CORE_READ_STR_INTOBPF_CORE_READ_USER_STR_INTOBPF_CORE_READ_BITFIELD_INTOBPF_CORE_READBPF_CORE_READ_USERBPF_PROBE_READ_INTOBPF_PROBE_READ_USER_INTOBPF_PROBE_READ_STR_INTOBPF_PROBE_READ_USER_STR_INTOBPF_PROBE_READBPF_PROBE_READ_USER