package btf

Get desktop application:
View/edit binary Protocol Buffers messages

https://docs.kernel.org/bpf/btf.html#bpf-type-format-btf

• optional Header header = 1

• optional TypeSection type_section = 2

• optional StringSection string_section = 3

List of Supported Types https://docs.kernel.org/bpf/btf.html#type-encoding

Used in: TypeInfo

• KIND = 0

• INT = 1

• PTR = 2

• ARRAY = 3

• STRUCT = 4

• UNION = 5

• ENUM = 6

• FWD = 7

• TYPEDEF = 8

• VOLATILE = 9

• CONST = 10

• RESTRICT = 11

• FUNC = 12

• FUNCPROTO = 13

• VAR = 14

• DATASEC = 15

• FLOAT = 16

• DECLTAG = 17

• TYPETAG = 18

• ENUM64 = 19

btf_param struct for BTF kind function proto https://docs.kernel.org/bpf/btf.html#btf-kind-func-proto

Used in: FuncProtoTypeData

• int32 name_off = 1

• int32 param_type = 2

Type Encoding https://docs.kernel.org/bpf/btf.html#btf-kind-func-proto

Used in: TypeSection

• int32 name_off = 1

  Specifies the offset in the string table

• optional TypeInfo info = 2

  "info" bits arrangement - bits 0-15: vlen (e.g. # of struct's members) - bits 16-23: unused - bits 24-28: kind (e.g. int, ptr, array...etc) - bits 29-30: unused - bit 31: kind_flag, currently used by struct, union, fwd, enum and enum64. https://docs.kernel.org/bpf/btf.html#type-encoding

• int32 size_or_type = 3

  "size" is used by INT, ENUM, STRUCT, UNION and ENUM64. "size" tells the size of the type it is describing. "type" is used by PTR, TYPEDEF, VOLATILE, CONST, RESTRICT, FUNC, FUNC_PROTO, DECL_TAG and TYPE_TAG. "type" is a type_id referring to another type. https://docs.kernel.org/bpf/btf.html#type-encoding

• oneof extra

  For certain kinds, the common data are followed by kind-specific data. https://docs.kernel.org/bpf/btf.html#type-encoding

  • Empty empty = 4

  • IntTypeData int_type_data = 5

  • FuncProtoTypeData func_proto_type_data = 6

  • StructTypeData struct_type_data = 7

Used in: BtfType

(message has no fields)

https://docs.kernel.org/bpf/btf.html#bpf-prog-load:~:text=The%20func_info%20and%20line_info%20are%20an%20array%20of%20below%2C%20respectively.

Used in: ebpf.Functions

• int32 insn_off = 1

• int32 type_id = 2

BTF func proto extra data https://docs.kernel.org/bpf/btf.html#btf-kind-func-proto

Used in: BtfType

• repeated BtfParam param = 1

The beginning of the BTF Data https://docs.kernel.org/bpf/btf.html#btf-type-and-string-encoding

Used in: Btf

• int32 magic = 1

  Indicates big- or little-endian target

• int32 version = 2

• int32 flags = 3

• int32 hdr_len = 4

• int32 type_off = 5

  offset of type section

• int32 type_len = 6

  length of type section

• int32 str_off = 7

  offset of string section

• int32 str_len = 8

  length of string section

BTF Kind int extra data https://docs.kernel.org/bpf/btf.html#btf-kind-int

Used in: BtfType

• int32 int_info = 1

https://docs.kernel.org/bpf/btf.html#string-encoding

Used in: Btf

• string str = 1

BTF kind struct extra data https://docs.kernel.org/bpf/btf.html#btf-kind-struct

Used in: BtfType

• int32 name_off = 1

• int32 struct_type = 2

• int32 offset = 3

Used in: BtfType

• int32 vlen = 1

• BtfKind kind = 2

• bool kind_flag = 3

https://docs.kernel.org/bpf/btf.html#type-encoding

Used in: Btf

• repeated BtfType btf_type = 1