1414 * limitations under the License.
1515 *)
1616
17- (* * Shared module for eBPF kernel type definitions *)
17+ (* * Dynamic kernel type detection using BTF parsing *)
1818
19- (* * Well-known eBPF context types that are provided by kernel headers
20- These should be marked as kernel_defined = true **)
21- let well_known_ebpf_types = [
19+ open Printf
20+
21+ (* * Cache for BTF-extracted kernel types to avoid re-parsing *)
22+ let kernel_types_cache : (string, string list) Hashtbl.t = Hashtbl. create 16
23+
24+ (* * Fallback well-known eBPF types for when BTF is not available *)
25+ let fallback_well_known_ebpf_types = [
2226 (* eBPF context structs - provided by linux/bpf.h *)
2327 " xdp_md" ;
2428 " __sk_buff" ;
@@ -44,6 +48,41 @@ let well_known_ebpf_types = [
4448 " bpf_sockopt" ;
4549]
4650
47- (* * Check if a type name is a well-known eBPF kernel type *)
48- let is_well_known_ebpf_type type_name =
49- List. mem type_name well_known_ebpf_types
51+ (* * Extract kernel types from BTF file with caching *)
52+ let get_kernel_types_from_btf btf_path =
53+ match Hashtbl. find_opt kernel_types_cache btf_path with
54+ | Some cached_types -> cached_types
55+ | None ->
56+ let kernel_types =
57+ try
58+ Btf_binary_parser. extract_all_kernel_struct_names btf_path
59+ with
60+ | _ ->
61+ printf " Warning: Failed to extract kernel types from BTF, using fallback list\n " ;
62+ fallback_well_known_ebpf_types
63+ in
64+ Hashtbl. add kernel_types_cache btf_path kernel_types;
65+ kernel_types
66+
67+ (* * Check if a type name is a well-known eBPF kernel type.
68+ Uses BTF if available, otherwise falls back to hardcoded list. *)
69+ let is_well_known_ebpf_type ?btf_path type_name =
70+ match btf_path with
71+ | Some path when Sys. file_exists path ->
72+ let kernel_types = get_kernel_types_from_btf path in
73+ List. mem type_name kernel_types
74+ | _ ->
75+ (* Fallback to hardcoded list when BTF is not available *)
76+ List. mem type_name fallback_well_known_ebpf_types
77+
78+ (* * Clear the kernel types cache (useful for testing or when BTF file changes) *)
79+ let clear_cache () =
80+ Hashtbl. clear kernel_types_cache
81+
82+ (* * Get all known kernel types for the given BTF file (for debugging/inspection) *)
83+ let get_all_kernel_types ?btf_path () =
84+ match btf_path with
85+ | Some path when Sys. file_exists path ->
86+ get_kernel_types_from_btf path
87+ | _ ->
88+ fallback_well_known_ebpf_types
0 commit comments