123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281open!Ctypes(* The C_types_generated module is generated by the build
system to grab the type definitions from the header files in C to
ensure that offsets and structs are aligned. *)moduleTypes=C_type_description.Types(C_types_generated)moduleFunctions(F:Ctypes.FOREIGN)=structopenF(* ======================================== Generics ======================================== *)letlibbpf_major_version=foreign"libbpf_major_version"(void@->returninguint32_t)letlibbpf_minor_version=foreign"libbpf_minor_version"(void@->returninguint32_t)letlibbpf_version_string=foreign"libbpf_version_string"(void@->returningstring)letlibbpf_strerror=foreign"libbpf_strerror"(int@->ptrchar@->size_t@->returningint)letlibbpf_bpf_attach_type_str=foreign"libbpf_bpf_attach_type_str"(Types.Bpf_attach_type.t@->returningstring)letlibbpf_bpf_link_type_str=foreign"libbpf_bpf_link_type_str"(Types.Bpf_link_type.t@->returningstring)letlibbpf_bpf_map_type_str=foreign"libbpf_bpf_map_type_str"(Types.Bpf_map_type.t@->returningstring)letlibbpf_bpf_prog_type_str=foreign"libbpf_bpf_prog_type_str"(Types.Bpf_prog_type.t@->returningstring)letlibbpf_set_print=foreign"libbpf_set_print"(Types.libbpf_print_fn_t@->returningTypes.libbpf_print_fn_t)(* ================================= Open / Load / Close =================================== *)(** [bpf_object__open path] creates a bpf_object by opening the BPF
ELF object file pointed to by the passed [path] and loading it
into memory.
Returns pointer to the new bpf_object; or NULL is returned on
error, error code is stored in errno. *)letbpf_object__open=foreign"bpf_object__open"(string@->returning(ptr_optTypes.bpf_object))(** [bpf_object__load obj_ptr] loads the BPF object into the
kernel. [obj_ptr] must be a valid BPF object instance returned
by a successful call to [bpf_object__open].
Returns 0, on success; negative error code, otherwise, error code is stored in errno *)letbpf_object__load=foreign"bpf_object__load"(ptrTypes.bpf_object@->returningint)(** [bpf_object__find_program_by_name name] returns the BPF program
of the given [name], if it exists within the passed BPF object
Returns the pointer to the BPF program instance, if such program
exists within the BPF object; or NULL otherwise. *)letbpf_object__find_program_by_name=foreign"bpf_object__find_program_by_name"(ptrTypes.bpf_object@->string@->returning(ptr_optTypes.bpf_program))(** [bpf_object__next_program obj_ptr prog_ptr] returns the next
program after [prog_ptr] found in the passed BPF object *)letbpf_object__next_program=foreign"bpf_object__next_program"(ptrTypes.bpf_object@->ptrTypes.bpf_program@->returning(ptrTypes.bpf_program))(** [bpf_program__pin prog path] pins the BPF program to a file in
the BPF FS specified by a [path]. This increments the programs
reference count, allowing it to stay loaded after the process
which loaded it has exited.
@param prog BPF program to pin, must already be loaded
@param path file path in a BPF file system
@return 0, on success; negative error code, otherwise *)letbpf_program__pin=foreign"bpf_program__pin"(ptrTypes.bpf_program@->ptrchar@->returningint)(** [bpf_program__unpin prog path] unpins the BPF program from a file in the
BPFFS specified by a path. This decrements the programs
reference count. The file pinning the BPF program can also be
unlinked by a different process in which case this function will
return an error.
@param prog BPF program to unpin
@param path file path to the pin in a BPF file system
@return 0, on success; negative error code, otherwise *)letbpf_program__unpin=foreign"bpf_program__unpin"(ptrTypes.bpf_program@->ptrchar@->returningint)(** [bpf_program__attach prog] is a generic function for
attaching a BPF program based on auto-detection of program type,
attach type, and extra paremeters, where applicable.
This is supported for:
- kprobe/kretprobe (depends on SEC() definition)
- uprobe/uretprobe (depends on SEC() definition)
- tracepoint
- raw tracepoint
- tracing programs (typed raw TP/fentry/fexit/fmod_ret)
Returns pointer to the newly created BPF link; or NULL is
returned on error, error code is stored in errno *)letbpf_program__attach=foreign"bpf_program__attach"(ptrTypes.bpf_program@->returning(ptr_optTypes.bpf_link))letbpf_program__fd=foreign"bpf_program__fd"(ptrTypes.bpf_program@->returningint)(** [bpf_link__pin link path] pins the BPF link to a file in the
BPF FS specified by a path. This increments the links reference
count, allowing it to stay loaded after the process which loaded
it has exited.
@param link BPF link to pin, must already be loaded
@param path file path in a BPF file system
@return 0, on success; negative error code, otherwise *)letbpf_link__pin=foreign"bpf_link__pin"(ptrTypes.bpf_link@->ptrchar@->returningint)(** [bpf_link__unpin link path] unpins the BPF link from a file in
the BPFFS specified by a path. This decrements the links
reference count. The file pinning the BPF link can also be
unlinked by a different process in which case this function will
return an error.
@param prog BPF program to unpin
@param path file path to the pin in a BPF file system
@return 0, on success; negative error code, otherwise *)letbpf_link__unpin=foreign"bpf_link__unpin"(ptrTypes.bpf_link@->returningint)(** [bpf_link__destroy link_ptr] Removes the link to the BPF program.
Returns 0 on success or -errno *)letbpf_link__destroy=foreign"bpf_link__destroy"(ptrTypes.bpf_link@->returningint)(** [bpf_object__close obj_ptr] closes a BPF object and releases all
resources. *)letbpf_object__close=foreign"bpf_object__close"(ptrTypes.bpf_object@->returningvoid)(* ======================================== Maps ======================================== *)(* Not explicitly mentioned in the documentation but keys and values look
like they're copied into the internal bpf map structure, so we
don't need to be worried about keeping references around. *)(** [bpf_object__find_map_by_name obj_ptr name] returns BPF map of the given
[name], if it exists within the passed BPF object.
Returns the pointer to the BPF map instance, if such map exists
within the BPF object; or NULL otherwise. *)letbpf_object__find_map_by_name=foreign"bpf_object__find_map_by_name"(ptrTypes.bpf_object@->string@->returning(ptr_optTypes.bpf_map))(** [bpf_map__fd map_ptr] gets the file descriptor of the passed BPF
map
Returns the file descriptor; or -EINVAL in case of an error *)letbpf_map__fd=foreign"bpf_map__fd"(ptrTypes.bpf_map@->returningint)(** [bpf_map__lookup_elem map_ptr key_ptr key_sz val_ptr val_sz
flags] allows to lookup BPF map value corresponding to provided
key.
[bpf_map__lookup_elem] is high-level equivalent of
[bpf_map_lookup_elem] API with added check for key and value
size.
sizes are in bytes of key and value data. For per-CPU BPF maps
value size has to be a product of BPF map value size and number
of possible CPUs in the system (could be fetched with
libbpf_num_possible_cpus()). Note also that for per-CPU values
value size has to be aligned up to closest 8 bytes for alignment
reasons, so expected size is: round_up(value_size, 8)
Returns 0, on success; negative error, otherwise *)letbpf_map__lookup_elem=foreign"bpf_map__lookup_elem"(ptrTypes.bpf_map@->ptrvoid@->size_t@->ptrvoid@->size_t@->uint64_t@->returningint)(** [bpf_map__update_elem map_ptr key_ptr key_sz val_ptr val_sz
flags] allows to insert or update value in BPF map that
corresponds to provided key.
[bpf_map__update_elem] is high-level equivalent of
[bpf_map_update_elem] API with added check for key and value
size.
Check [bpf_map__lookup_elem] for details on sizes.
Returns 0, on success; negative error, otherwise *)letbpf_map__update_elem=foreign"bpf_map__update_elem"(ptrTypes.bpf_map@->ptrvoid@->size_t@->ptrvoid@->size_t@->uint64_t@->returningint)(** [bpf_map__delete_elem map_ptr key_ptr key_sz flags] allows to
delete element in BPF map that corresponds to provided key.
[bpf_map__delete_elem] is high-level equivalent of
[bpf_map_delete_elem] API with added check for key size.
Returns 0, on success; negative error, otherwise *)letbpf_map__delete_elem=foreign"bpf_map__delete_elem"(ptrTypes.bpf_map@->ptrvoid@->size_t@->uint64_t@->returningint)(* ================================== Traffic control ================================== *)letbpf_tc_hook_create=foreign"bpf_tc_hook_create"(ptrTypes.Bpf_tc.hook@->returningint)letbpf_tc_hook_destroy=foreign"bpf_tc_hook_destroy"(ptrTypes.Bpf_tc.hook@->returningint)letbpf_tc_attach=foreign"bpf_tc_attach"(ptrTypes.Bpf_tc.hook@->ptrTypes.Bpf_tc.Opts.t@->returningint)letbpf_tc_detach=foreign"bpf_tc_detach"(ptrTypes.Bpf_tc.hook@->ptrTypes.Bpf_tc.Opts.t@->returningint)(* ====================================== RingBuf ===================================== *)(** [ring_buffer__new map_fd fn ctx_ptr opts] loads the callback
function [fn] into the ring buffer map provided by the file
descriptor [map_fd]. [ctx_ptr] allows the callback function to
access user provided context.
Returns pointer to the ring_buffer manager instance or NULL
otherwise *)letring_buffer__new=foreign"ring_buffer__new"(int@->Types.ring_buffer_sample_fn@->ptrvoid@->ptrTypes.ring_buffer_opts@->returning(ptr_optTypes.ring_buffer))(** [ring_buffer__poll ring_buf_ptr timeout] poll for available
data and consume records, if any are available.
Returns number of records consumed (or INT_MAX, whichever is
less), or negative number, if any of the registered callbacks
returned error. *)letring_buffer__poll=foreign"ring_buffer__poll"(ptrTypes.ring_buffer@->int@->returningint)(** [ring_buffer__free ring_buf_ptr] Frees resources of the ring
buffer manager *)letring_buffer__free=foreign"ring_buffer__free"(ptrTypes.ring_buffer@->returningvoid)(** [ring_buffer__consume ring_buf_ptr] Consume available ring
buffer(s) data without event polling.
Returns number of records consumed across all registered ring
buffers (or INT_MAX, whichever is less), or negative number if
any of the callbacks return error. *)letring_buffer__consume=foreign"ring_buffer__consume"(ptrTypes.ring_buffer@->returningint)(** [ring_buffer__epoll_fd ring_buf_ptr] Gets an fd that can be used
to sleep until data is available in the ring(s) *)letring_buffer__epoll_fd=foreign"ring_buffer__epoll_fd"(ptrTypes.ring_buffer@->returningint)end