github.com/castai/kvisor@v1.7.1-0.20240516114728-b3572a2607b5/pkg/ebpftracer/c/headers/vmlinux.h (about) 1 #ifndef __VMLINUX_H__ 2 #define __VMLINUX_H__ 3 4 ; 5 ; // don't remove: clangd parsing bug https://github.com/clangd/clangd/issues/1167 6 #pragma clang attribute push(__attribute__((preserve_access_index)), apply_to = record) 7 8 typedef signed char __s8; 9 typedef __s8 s8; 10 typedef s8 int8_t; 11 12 typedef short int __s16; 13 typedef __s16 s16; 14 typedef s16 int16_t; 15 16 typedef int __s32; 17 typedef __s32 s32; 18 typedef s32 int32_t; 19 20 typedef long long int __s64; 21 typedef __s64 s64; 22 typedef s64 int64_t; 23 24 typedef unsigned char __u8; 25 typedef __u8 u8; 26 typedef u8 uint8_t; 27 typedef u8 u_int8_t; 28 29 typedef short unsigned int __u16; 30 typedef __u16 u16; 31 typedef __u16 __le16; 32 typedef __u16 __be16; 33 typedef u16 uint16_t; 34 typedef u16 u_int16_t; 35 36 typedef unsigned int __u32; 37 typedef unsigned int uint; 38 typedef __u32 u32; 39 typedef __u32 int32; 40 typedef __u32 __be32; 41 typedef u32 uint32_t; 42 typedef u32 u_int32_t; 43 44 typedef long long unsigned int __u64; 45 typedef __u64 u64; 46 typedef __u64 __le64; 47 typedef __u64 __be64; 48 typedef u64 uint64_t; 49 typedef u64 u_int64_t; 50 51 typedef long int __kernel_long_t; 52 typedef unsigned int __kernel_mode_t; 53 typedef __kernel_mode_t mode_t; 54 typedef __kernel_long_t __kernel_off_t; 55 typedef __kernel_off_t off_t; 56 57 typedef long unsigned int __kernel_ulong_t; 58 59 typedef _Bool bool; 60 61 enum 62 { 63 false = 0, 64 true = 1, 65 }; 66 67 #if defined(__TARGET_ARCH_x86) 68 69 struct thread_info { 70 u32 status; 71 }; 72 73 struct pt_regs { 74 long unsigned int r15; 75 long unsigned int r14; 76 long unsigned int r13; 77 long unsigned int r12; 78 long unsigned int bp; 79 long unsigned int bx; 80 long unsigned int r11; 81 long unsigned int r10; 82 long unsigned int r9; 83 long unsigned int r8; 84 long unsigned int ax; 85 long unsigned int cx; 86 long unsigned int dx; 87 long unsigned int si; 88 long unsigned int di; 89 long unsigned int orig_ax; 90 long unsigned int ip; 91 long unsigned int cs; 92 long unsigned int flags; 93 long unsigned int sp; 94 long unsigned int ss; 95 }; 96 97 #elif defined(__TARGET_ARCH_arm64) 98 99 struct thread_info { 100 long unsigned int flags; 101 }; 102 103 struct user_pt_regs { 104 __u64 regs[31]; 105 __u64 sp; 106 __u64 pc; 107 __u64 pstate; 108 }; 109 110 struct pt_regs { 111 union { 112 struct user_pt_regs user_regs; 113 struct { 114 u64 regs[31]; 115 u64 sp; 116 u64 pc; 117 u64 pstate; 118 }; 119 }; 120 u64 orig_x0; 121 s32 syscallno; 122 u32 unused2; 123 u64 orig_addr_limit; 124 u64 pmr_save; 125 u64 stackframe[2]; 126 u64 lockdep_hardirqs; 127 u64 exit_rcu; 128 }; 129 130 #endif 131 132 // common to all architectures 133 134 enum 135 { 136 BPF_ANY = 0, 137 BPF_NOEXIST = 1, 138 BPF_EXIST = 2, 139 BPF_F_LOCK = 4, 140 }; 141 142 enum 143 { 144 BPF_F_USER_STACK = 256, 145 }; 146 147 enum 148 { 149 BPF_F_CURRENT_CPU = 4294967295, 150 }; 151 152 enum 153 { 154 TCP_ESTABLISHED = 1, 155 TCP_SYN_SENT = 2, 156 TCP_SYN_RECV = 3, 157 TCP_FIN_WAIT1 = 4, 158 TCP_FIN_WAIT2 = 5, 159 TCP_TIME_WAIT = 6, 160 TCP_CLOSE = 7, 161 TCP_CLOSE_WAIT = 8, 162 TCP_LAST_ACK = 9, 163 TCP_LISTEN = 10, 164 TCP_CLOSING = 11, 165 TCP_NEW_SYN_RECV = 12, 166 TCP_MAX_STATES = 13, 167 }; 168 169 enum sock_type 170 { 171 SOCK_STREAM = 1, 172 SOCK_DGRAM = 2, 173 SOCK_RAW = 3, 174 SOCK_RDM = 4, 175 SOCK_SEQPACKET = 5, 176 SOCK_DCCP = 6, 177 SOCK_PACKET = 10, 178 }; 179 180 enum 181 { 182 IPPROTO_IP = 0, 183 IPPROTO_ICMP = 1, 184 IPPROTO_IGMP = 2, 185 IPPROTO_IPIP = 4, 186 IPPROTO_TCP = 6, 187 IPPROTO_EGP = 8, 188 IPPROTO_PUP = 12, 189 IPPROTO_UDP = 17, 190 IPPROTO_IDP = 22, 191 IPPROTO_TP = 29, 192 IPPROTO_DCCP = 33, 193 IPPROTO_IPV6 = 41, 194 IPPROTO_RSVP = 46, 195 IPPROTO_GRE = 47, 196 IPPROTO_ESP = 50, 197 IPPROTO_AH = 51, 198 IPPROTO_MTP = 92, 199 IPPROTO_BEETPH = 94, 200 IPPROTO_ENCAP = 98, 201 IPPROTO_PIM = 103, 202 IPPROTO_COMP = 108, 203 IPPROTO_SCTP = 132, 204 IPPROTO_UDPLITE = 136, 205 IPPROTO_MPLS = 137, 206 IPPROTO_ETHERNET = 143, 207 IPPROTO_RAW = 255, 208 IPPROTO_MPTCP = 262, 209 IPPROTO_MAX = 263, 210 }; 211 212 enum 213 { 214 TCPF_ESTABLISHED = 2, 215 TCPF_SYN_SENT = 4, 216 TCPF_FIN_WAIT1 = 16, 217 TCPF_FIN_WAIT2 = 32, 218 TCPF_TIME_WAIT = 64, 219 TCPF_CLOSE = 128, 220 TCPF_CLOSE_WAIT = 256, 221 TCPF_LAST_ACK = 512, 222 TCPF_LISTEN = 1024, 223 TCPF_CLOSING = 2048, 224 TCPF_NEW_SYN_RECV = 4096, 225 }; 226 227 struct bpf_raw_tracepoint_args { 228 __u64 args[0]; 229 }; 230 231 struct list_head { 232 struct list_head *next; 233 struct list_head *prev; 234 }; 235 236 typedef int __kernel_pid_t; 237 238 typedef __kernel_pid_t pid_t; 239 240 struct hlist_node { 241 struct hlist_node *next; 242 struct hlist_node **pprev; 243 }; 244 245 typedef __kernel_ulong_t __kernel_size_t; 246 247 typedef __kernel_size_t size_t; 248 249 typedef unsigned int __kernel_uid32_t; 250 251 typedef __kernel_uid32_t uid_t; 252 253 typedef struct { 254 uid_t val; 255 } kuid_t; 256 257 struct task_struct { 258 struct thread_info thread_info; 259 unsigned int flags; 260 struct mm_struct *mm; 261 int exit_code; 262 pid_t pid; 263 pid_t tgid; 264 struct task_struct *real_parent; 265 struct task_struct *group_leader; 266 struct pid *thread_pid; 267 struct list_head thread_group; 268 u64 start_time; 269 const struct cred *real_cred; 270 char comm[16]; 271 struct files_struct *files; 272 struct nsproxy *nsproxy; 273 struct css_set *cgroups; 274 struct signal_struct *signal; 275 void *stack; 276 struct sighand_struct *sighand; 277 }; 278 279 typedef struct { 280 int counter; 281 } atomic_t; 282 283 struct signal_struct { 284 atomic_t live; 285 }; 286 287 struct vm_area_struct { 288 long unsigned int vm_flags; 289 struct file *vm_file; 290 }; 291 292 typedef unsigned int __kernel_gid32_t; 293 294 typedef __kernel_gid32_t gid_t; 295 296 typedef struct { 297 gid_t val; 298 } kgid_t; 299 300 typedef struct { 301 u64 val; 302 } kernel_cap_t; 303 304 struct cred { 305 kuid_t uid; 306 kgid_t gid; 307 kuid_t suid; 308 kgid_t sgid; 309 kuid_t euid; 310 kgid_t egid; 311 kuid_t fsuid; 312 kgid_t fsgid; 313 unsigned int securebits; 314 kernel_cap_t cap_inheritable; 315 kernel_cap_t cap_permitted; 316 kernel_cap_t cap_effective; 317 kernel_cap_t cap_bset; 318 kernel_cap_t cap_ambient; 319 struct user_namespace *user_ns; 320 }; 321 322 struct nsproxy { 323 struct uts_namespace *uts_ns; 324 struct ipc_namespace *ipc_ns; 325 struct mnt_namespace *mnt_ns; 326 struct pid_namespace *pid_ns_for_children; 327 struct net *net_ns; 328 struct cgroup_namespace *cgroup_ns; 329 }; 330 331 struct ns_common { 332 unsigned int inum; 333 }; 334 335 struct pid_namespace { 336 unsigned int level; 337 struct ns_common ns; 338 }; 339 340 struct upid { 341 int nr; 342 struct pid_namespace *ns; 343 }; 344 345 struct pid { 346 unsigned int level; 347 struct upid numbers[1]; 348 }; 349 350 struct mnt_namespace { 351 struct ns_common ns; 352 }; 353 354 struct new_utsname { 355 char nodename[65]; 356 }; 357 358 struct uts_namespace { 359 struct new_utsname name; 360 struct ns_common ns; 361 }; 362 363 struct css_set { 364 struct cgroup_subsys_state *subsys[12]; 365 }; 366 367 struct percpu_ref { 368 long unsigned int percpu_count_ptr; 369 struct percpu_ref_data *data; 370 }; 371 372 struct cgroup_subsys_state { 373 struct cgroup *cgroup; 374 }; 375 376 struct timer_list { 377 struct hlist_node entry; 378 long unsigned int expires; 379 void (*function)(struct timer_list *); 380 u32 flags; 381 }; 382 383 struct cgroup_file { 384 struct kernfs_node *kn; 385 long unsigned int notified_at; 386 struct timer_list notify_timer; 387 }; 388 389 struct cgroup { 390 struct kernfs_node *kn; 391 struct cgroup_root *root; 392 }; 393 394 typedef long long int __kernel_loff_t; 395 396 typedef __kernel_loff_t loff_t; 397 398 typedef unsigned short umode_t; 399 400 struct kernfs_node { 401 const char *name; 402 u64 id; 403 }; 404 405 struct cgroup_root { 406 int hierarchy_id; 407 }; 408 409 struct fdtable { 410 struct file **fd; 411 }; 412 413 struct files_struct { 414 struct fdtable *fdt; 415 }; 416 417 struct path { 418 struct vfsmount *mnt; 419 struct dentry *dentry; 420 }; 421 422 typedef unsigned int fmode_t; 423 424 struct dir_context { 425 }; 426 struct iov_iter { 427 }; 428 struct kiocb { 429 }; 430 431 struct file_operations { 432 int (*iterate_shared)(struct file *, struct dir_context *); 433 int (*iterate)(struct file *, struct dir_context *); 434 long (*write_iter)(struct kiocb *, struct iov_iter *); 435 }; 436 437 struct file { 438 union { 439 unsigned int f_iocb_flags; 440 }; 441 struct path f_path; 442 struct inode *f_inode; 443 const struct file_operations *f_op; 444 unsigned int f_flags; 445 void *private_data; 446 }; 447 448 struct pipe_inode_info { 449 struct pipe_buffer *bufs; 450 int head; 451 int ring_size; 452 unsigned int curbuf; 453 }; 454 455 struct pipe_inode_info___v54 { 456 struct pipe_buffer *bufs; 457 unsigned int nrbufs, curbuf, buffers; 458 }; 459 460 struct pipe_buffer { 461 struct page *page; 462 unsigned int offset; 463 unsigned int len; 464 unsigned int flags; 465 }; 466 467 struct public_key_signature { 468 const void *data; 469 }; 470 471 enum zone_type 472 { 473 ZONE_DMA, 474 }; 475 476 struct alloc_context { 477 enum zone_type high_zoneidx; 478 }; 479 480 struct socket { 481 short type; 482 struct file *file; 483 struct sock *sk; 484 }; 485 486 typedef struct { 487 struct net *net; 488 } possible_net_t; 489 490 struct in6_addr { 491 union { 492 __u8 u6_addr8[16]; 493 __be16 u6_addr16[8]; 494 __be32 u6_addr32[4]; 495 } in6_u; 496 }; 497 498 struct sock_common { 499 union { 500 struct { 501 __be32 skc_daddr; 502 __be32 skc_rcv_saddr; 503 }; 504 }; 505 union { 506 struct { 507 __be16 skc_dport; 508 __u16 skc_num; 509 }; 510 }; 511 unsigned short skc_family; 512 volatile unsigned char skc_state; 513 int skc_bound_dev_if; 514 struct in6_addr skc_v6_daddr; 515 struct in6_addr skc_v6_rcv_saddr; 516 }; 517 518 struct kobject { 519 const char *name; 520 struct list_head entry; 521 }; 522 523 struct device { 524 struct device *parent; 525 struct kobject kobj; 526 }; 527 528 struct sock { 529 struct sock_common __sk_common; 530 u16 sk_type; 531 u16 sk_protocol; 532 struct socket *sk_socket; 533 }; 534 535 typedef u32 __kernel_dev_t; 536 537 typedef __kernel_dev_t dev_t; 538 539 struct inet_sock { 540 struct sock sk; 541 struct ipv6_pinfo *pinet6; 542 __be32 inet_saddr; 543 __be16 inet_sport; 544 }; 545 546 typedef unsigned short __kernel_sa_family_t; 547 548 struct in_addr { 549 __be32 s_addr; 550 }; 551 552 struct sockaddr_in { 553 __kernel_sa_family_t sin_family; 554 __be16 sin_port; 555 struct in_addr sin_addr; 556 unsigned char __pad[8]; 557 }; 558 559 struct unix_sock { 560 struct unix_address *addr; 561 }; 562 563 struct sockaddr_un { 564 __kernel_sa_family_t sun_family; 565 char sun_path[108]; 566 }; 567 568 struct unix_address { 569 int len; 570 struct sockaddr_un name[0]; 571 }; 572 573 struct ipv6_pinfo { 574 struct in6_addr saddr; 575 __be32 flow_label; 576 }; 577 578 struct sockaddr_in6 { 579 unsigned short sin6_family; 580 __be16 sin6_port; 581 __be32 sin6_flowinfo; 582 struct in6_addr sin6_addr; 583 __u32 sin6_scope_id; 584 }; 585 586 struct msghdr { 587 void *msg_name; 588 }; 589 590 typedef s64 ktime_t; 591 592 struct sk_buff { 593 __u16 network_header; 594 union { 595 ktime_t tstamp; 596 u64 skb_mstamp_ns; 597 }; 598 unsigned char *head; 599 }; 600 601 struct linux_binprm { 602 struct file *file; 603 int argc; 604 int envc; 605 const char *filename; 606 const char *interp; 607 }; 608 609 typedef __s64 time64_t; 610 611 struct timespec64 { 612 time64_t tv_sec; 613 long int tv_nsec; 614 }; 615 616 typedef long long __kernel_time64_t; 617 618 struct __kernel_timespec { 619 __kernel_time64_t tv_sec; 620 long long tv_nsec; 621 }; 622 623 struct inode { 624 umode_t i_mode; 625 struct super_block *i_sb; 626 long unsigned int i_ino; 627 struct timespec64 __i_ctime; 628 loff_t i_size; 629 struct file_operations *i_fop; 630 dev_t i_rdev; 631 }; 632 633 struct super_block { 634 dev_t s_dev; 635 unsigned long s_magic; 636 }; 637 638 struct mm_struct { 639 struct { 640 long unsigned int arg_start; 641 long unsigned int arg_end; 642 long unsigned int env_start; 643 long unsigned int env_end; 644 }; 645 }; 646 647 struct vfsmount { 648 struct dentry *mnt_root; 649 }; 650 651 struct mount { 652 struct mount *mnt_parent; 653 struct dentry *mnt_mountpoint; 654 struct vfsmount mnt; 655 }; 656 657 struct qstr { 658 union { 659 struct { 660 u32 hash; 661 u32 len; 662 }; 663 u64 hash_len; 664 }; 665 const unsigned char *name; 666 }; 667 668 struct dentry { 669 struct dentry *d_parent; 670 struct qstr d_name; 671 struct inode *d_inode; 672 }; 673 674 enum bpf_func_id 675 { 676 BPF_FUNC_probe_write_user = 36, 677 BPF_FUNC_override_return = 58, 678 BPF_FUNC_sk_storage_get = 107, 679 BPF_FUNC_copy_from_user = 148, 680 BPF_FUNC_for_each_map_elem = 164, 681 }; 682 683 #define MODULE_NAME_LEN (64 - sizeof(unsigned long)) 684 685 struct module_kobject { 686 struct kobject kobj; 687 struct module *mod; 688 }; 689 690 struct kset { 691 struct list_head list; 692 }; 693 694 enum mod_mem_type 695 { 696 MOD_TEXT = 0, 697 MOD_DATA, 698 MOD_RODATA, 699 MOD_RO_AFTER_INIT, 700 MOD_INIT_TEXT, 701 MOD_INIT_DATA, 702 MOD_INIT_RODATA, 703 704 MOD_MEM_NUM_TYPES, 705 MOD_INVALID = -1, 706 }; 707 708 struct module_memory { 709 void *base; 710 }; 711 712 struct module { 713 struct list_head list; 714 char name[MODULE_NAME_LEN]; 715 const char *version; 716 const char *srcversion; 717 struct module_kobject mkobj; 718 struct module_memory mem[MOD_MEM_NUM_TYPES]; // kernel versions >= 6.4 719 }; 720 721 struct rb_node { 722 struct rb_node *rb_right; 723 struct rb_node *rb_left; 724 } __attribute__((aligned(sizeof(long)))); 725 726 struct latch_tree_node { 727 struct rb_node node[2]; 728 }; 729 730 struct rb_root { 731 struct rb_node *rb_node; 732 }; 733 734 typedef struct seqcount { 735 unsigned sequence; 736 } seqcount_t; 737 738 typedef struct { 739 seqcount_t seqcount; // kernels equal and above 5.10 740 unsigned sequence; // kernels below 5.10 741 } seqcount_latch_t; 742 743 struct latch_tree_root { 744 seqcount_latch_t seq; 745 struct rb_root tree[2]; 746 }; 747 748 struct mod_tree_node { 749 struct module *mod; 750 struct latch_tree_node node; 751 }; 752 753 struct user_namespace { 754 struct ns_common ns; 755 }; 756 757 struct ipc_namespace { 758 struct ns_common ns; 759 }; 760 761 struct net { 762 struct ns_common ns; 763 }; 764 765 typedef __u32 __wsum; 766 767 struct cgroup_namespace { 768 struct ns_common ns; 769 }; 770 771 typedef __kernel_sa_family_t sa_family_t; 772 773 struct sockaddr { 774 sa_family_t sa_family; 775 }; 776 777 struct iovec { 778 void *iov_base; 779 __kernel_size_t iov_len; 780 }; 781 782 enum bpf_map_type 783 { 784 BPF_MAP_TYPE_UNSPEC = 0, 785 BPF_MAP_TYPE_HASH = 1, 786 BPF_MAP_TYPE_ARRAY = 2, 787 BPF_MAP_TYPE_PROG_ARRAY = 3, 788 BPF_MAP_TYPE_PERF_EVENT_ARRAY = 4, 789 BPF_MAP_TYPE_PERCPU_HASH = 5, 790 BPF_MAP_TYPE_PERCPU_ARRAY = 6, 791 BPF_MAP_TYPE_STACK_TRACE = 7, 792 BPF_MAP_TYPE_CGROUP_ARRAY = 8, 793 BPF_MAP_TYPE_LRU_HASH = 9, 794 BPF_MAP_TYPE_LRU_PERCPU_HASH = 10, 795 BPF_MAP_TYPE_LPM_TRIE = 11, 796 BPF_MAP_TYPE_ARRAY_OF_MAPS = 12, 797 BPF_MAP_TYPE_HASH_OF_MAPS = 13, 798 BPF_MAP_TYPE_DEVMAP = 14, 799 BPF_MAP_TYPE_SOCKMAP = 15, 800 BPF_MAP_TYPE_CPUMAP = 16, 801 BPF_MAP_TYPE_XSKMAP = 17, 802 BPF_MAP_TYPE_SOCKHASH = 18, 803 BPF_MAP_TYPE_CGROUP_STORAGE = 19, 804 BPF_MAP_TYPE_REUSEPORT_SOCKARRAY = 20, 805 BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE = 21, 806 BPF_MAP_TYPE_QUEUE = 22, 807 BPF_MAP_TYPE_STACK = 23, 808 BPF_MAP_TYPE_SK_STORAGE = 24, 809 BPF_MAP_TYPE_DEVMAP_HASH = 25, 810 BPF_MAP_TYPE_STRUCT_OPS = 26, 811 BPF_MAP_TYPE_RINGBUF = 27, 812 BPF_MAP_TYPE_INODE_STORAGE = 28, 813 BPF_MAP_TYPE_TASK_STORAGE = 29, 814 }; 815 816 struct bpf_map { 817 u32 id; 818 char name[16]; 819 }; 820 821 struct bpf_sock; 822 823 // TODO: can't CO-RE __sk_buff (check) 824 825 struct __sk_buff { 826 __u32 len; 827 __u32 pkt_type; 828 __u32 mark; 829 __u32 queue_mapping; 830 __u32 protocol; 831 __u32 vlan_present; 832 __u32 vlan_tci; 833 __u32 vlan_proto; 834 __u32 priority; 835 __u32 ingress_ifindex; 836 __u32 ifindex; 837 __u32 tc_index; 838 __u32 cb[5]; 839 __u32 hash; 840 __u32 tc_classid; 841 __u32 data; 842 __u32 data_end; 843 __u32 napi_id; 844 __u32 family; 845 __u32 remote_ip4; 846 __u32 local_ip4; 847 __u32 remote_ip6[4]; 848 __u32 local_ip6[4]; 849 __u32 remote_port; 850 __u32 local_port; 851 __u32 data_meta; 852 union { 853 struct bpf_flow_keys *flow_keys; 854 }; 855 __u64 tstamp; 856 __u32 wire_len; 857 __u32 gso_segs; 858 union { 859 struct bpf_sock *sk; 860 }; 861 __u32 gso_size; 862 }; 863 864 struct ethhdr { 865 unsigned char h_dest[6]; 866 unsigned char h_source[6]; 867 __be16 h_proto; 868 }; 869 870 typedef __u16 __sum16; 871 872 enum kernel_read_file_id 873 { 874 READING_UNKNOWN = 0, 875 READING_FIRMWARE = 1, 876 READING_MODULE = 2, 877 READING_KEXEC_IMAGE = 3, 878 READING_KEXEC_INITRAMFS = 4, 879 READING_POLICY = 5, 880 READING_X509_CERTIFICATE = 6, 881 READING_MAX_ID = 7, 882 }; 883 884 struct kretprobe_instance { 885 }; 886 typedef int kprobe_opcode_t; 887 struct kprobe; 888 889 typedef int (*kprobe_pre_handler_t)(struct kprobe *, struct pt_regs *); 890 typedef void (*kprobe_post_handler_t)(struct kprobe *, struct pt_regs *, unsigned long flags); 891 typedef int (*kretprobe_handler_t)(struct kretprobe_instance *, struct pt_regs *); 892 893 struct kprobe { 894 kprobe_opcode_t *addr; 895 const char *symbol_name; 896 kprobe_pre_handler_t pre_handler; 897 kprobe_post_handler_t post_handler; 898 }; 899 900 struct seq_file { 901 }; 902 903 struct seq_operations { 904 void *(*start)(struct seq_file *m, loff_t *pos); 905 void (*stop)(struct seq_file *m, void *v); 906 void *(*next)(struct seq_file *m, void *v, loff_t *pos); 907 int (*show)(struct seq_file *m, void *v); 908 }; 909 910 enum bpf_attach_type 911 { 912 BPF_CGROUP_INET_INGRESS = 0, 913 BPF_CGROUP_INET_EGRESS = 1, 914 }; 915 916 enum bpf_hdr_start_off 917 { 918 BPF_HDR_START_MAC = 0, 919 BPF_HDR_START_NET = 1, 920 }; 921 922 #define _NSIG 64 923 #define _NSIG_BPW 64 924 #define _NSIG_WORDS (_NSIG / _NSIG_BPW) 925 926 typedef struct { 927 unsigned long sig[_NSIG_WORDS]; 928 } sigset_t; 929 930 struct sigaction { 931 void *sa_handler; 932 unsigned long sa_flags; 933 sigset_t sa_mask; 934 }; 935 936 struct k_sigaction { 937 struct sigaction sa; 938 }; 939 940 struct sighand_struct { 941 struct k_sigaction action[_NSIG]; 942 }; 943 944 enum bpf_cmd 945 { 946 BPF_MAP_CREATE, 947 BPF_MAP_LOOKUP_ELEM, 948 BPF_MAP_UPDATE_ELEM, 949 BPF_MAP_DELETE_ELEM, 950 BPF_MAP_GET_NEXT_KEY, 951 BPF_PROG_LOAD, 952 BPF_OBJ_PIN, 953 BPF_OBJ_GET, 954 BPF_PROG_ATTACH, 955 BPF_PROG_DETACH, 956 BPF_PROG_TEST_RUN, 957 BPF_PROG_RUN = BPF_PROG_TEST_RUN, 958 BPF_PROG_GET_NEXT_ID, 959 BPF_MAP_GET_NEXT_ID, 960 BPF_PROG_GET_FD_BY_ID, 961 BPF_MAP_GET_FD_BY_ID, 962 BPF_OBJ_GET_INFO_BY_FD, 963 BPF_PROG_QUERY, 964 BPF_RAW_TRACEPOINT_OPEN, 965 BPF_BTF_LOAD, 966 BPF_BTF_GET_FD_BY_ID, 967 BPF_TASK_FD_QUERY, 968 BPF_MAP_LOOKUP_AND_DELETE_ELEM, 969 BPF_MAP_FREEZE, 970 BPF_BTF_GET_NEXT_ID, 971 BPF_MAP_LOOKUP_BATCH, 972 BPF_MAP_LOOKUP_AND_DELETE_BATCH, 973 BPF_MAP_UPDATE_BATCH, 974 BPF_MAP_DELETE_BATCH, 975 BPF_LINK_CREATE, 976 BPF_LINK_UPDATE, 977 BPF_LINK_GET_FD_BY_ID, 978 BPF_LINK_GET_NEXT_ID, 979 BPF_ENABLE_STATS, 980 BPF_ITER_CREATE, 981 BPF_LINK_DETACH, 982 BPF_PROG_BIND_MAP, 983 }; 984 985 #define BPF_OBJ_NAME_LEN 16U 986 987 union bpf_attr { 988 struct { /* anonymous struct used by BPF_PROG_LOAD command */ 989 __u32 insn_cnt; 990 __u64 insns; 991 char prog_name[BPF_OBJ_NAME_LEN]; 992 }; 993 994 struct { 995 __u32 prog_fd; 996 union { 997 __u32 target_fd; 998 }; 999 } link_create; 1000 }; 1001 1002 enum bpf_prog_type 1003 { 1004 BPF_PROG_TYPE_UNSPEC, 1005 BPF_PROG_TYPE_SOCKET_FILTER, 1006 BPF_PROG_TYPE_KPROBE, 1007 BPF_PROG_TYPE_SCHED_CLS, 1008 BPF_PROG_TYPE_SCHED_ACT, 1009 BPF_PROG_TYPE_TRACEPOINT, 1010 BPF_PROG_TYPE_XDP, 1011 BPF_PROG_TYPE_PERF_EVENT, 1012 BPF_PROG_TYPE_CGROUP_SKB, 1013 BPF_PROG_TYPE_CGROUP_SOCK, 1014 BPF_PROG_TYPE_LWT_IN, 1015 BPF_PROG_TYPE_LWT_OUT, 1016 BPF_PROG_TYPE_LWT_XMIT, 1017 BPF_PROG_TYPE_SOCK_OPS, 1018 BPF_PROG_TYPE_SK_SKB, 1019 BPF_PROG_TYPE_CGROUP_DEVICE, 1020 BPF_PROG_TYPE_SK_MSG, 1021 BPF_PROG_TYPE_RAW_TRACEPOINT, 1022 BPF_PROG_TYPE_CGROUP_SOCK_ADDR, 1023 BPF_PROG_TYPE_LWT_SEG6LOCAL, 1024 BPF_PROG_TYPE_LIRC_MODE2, 1025 BPF_PROG_TYPE_SK_REUSEPORT, 1026 BPF_PROG_TYPE_FLOW_DISSECTOR, 1027 BPF_PROG_TYPE_CGROUP_SYSCTL, 1028 BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, 1029 BPF_PROG_TYPE_CGROUP_SOCKOPT, 1030 BPF_PROG_TYPE_TRACING, 1031 BPF_PROG_TYPE_STRUCT_OPS, 1032 BPF_PROG_TYPE_EXT, 1033 BPF_PROG_TYPE_LSM, 1034 BPF_PROG_TYPE_SK_LOOKUP, 1035 BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */ 1036 }; 1037 1038 struct bpf_prog_aux { 1039 u32 id; 1040 char name[BPF_OBJ_NAME_LEN]; 1041 }; 1042 1043 struct bpf_prog { 1044 enum bpf_prog_type type; 1045 struct bpf_prog_aux *aux; 1046 }; 1047 1048 struct tracepoint { 1049 const char *name; 1050 }; 1051 1052 struct trace_event_class { 1053 const char *system; 1054 }; 1055 1056 struct trace_event_call { 1057 struct trace_event_class *class; 1058 union { 1059 char *name; 1060 struct tracepoint *tp; 1061 }; 1062 void *module; // only from 5.15 1063 int flags; 1064 }; 1065 1066 struct trace_probe { 1067 struct list_head list; 1068 }; 1069 1070 struct trace_probe_event { 1071 struct trace_event_call call; 1072 struct list_head probes; 1073 }; 1074 1075 struct uprobe_consumer { 1076 int (*ret_handler)(struct uprobe_consumer *self, unsigned long func, struct pt_regs *regs); 1077 }; 1078 1079 struct trace_uprobe { 1080 struct uprobe_consumer consumer; 1081 char *filename; 1082 unsigned long offset; 1083 struct trace_probe tp; 1084 }; 1085 1086 struct kretprobe { 1087 struct kprobe kp; 1088 kretprobe_handler_t handler; 1089 }; 1090 1091 struct trace_kprobe { 1092 struct kretprobe rp; 1093 const char *symbol; 1094 struct trace_probe tp; 1095 }; 1096 1097 struct perf_event { 1098 struct trace_event_call *tp_event; 1099 }; 1100 1101 struct bpf_verifier_env { 1102 struct bpf_prog *prog; 1103 }; 1104 1105 struct bpf_insn { 1106 __u8 code; /* opcode */ 1107 __u8 dst_reg : 4; /* dest register */ 1108 __u8 src_reg : 4; /* source register */ 1109 __s16 off; /* signed offset */ 1110 __s32 imm; /* signed immediate constant */ 1111 }; 1112 1113 const int TRACE_EVENT_FL_TRACEPOINT_BIT = 4; 1114 const int TRACE_EVENT_FL_TRACEPOINT = (1 << TRACE_EVENT_FL_TRACEPOINT_BIT); 1115 1116 // 1117 // COMPLETE NETWORK TYPES 1118 // 1119 // NOTE: It is not required that types are complete in this file, as tracee uses 1120 // CO-RE for calculating struct field offsets. The thing is: for protocol 1121 // headers, sometimes, the type is an exact copy of the header that will 1122 // receive a payload copy. This makes it impossible not to have the full 1123 // types declared. Also, something else to note: protocol header types are 1124 // or, at least, should be, immutable among different kernel versions. 1125 // 1126 1127 struct iphdr { 1128 __u8 ihl : 4; 1129 __u8 version : 4; 1130 __u8 tos; 1131 __be16 tot_len; 1132 __be16 id; 1133 __be16 frag_off; 1134 __u8 ttl; 1135 __u8 protocol; 1136 __sum16 check; 1137 __be32 saddr; 1138 __be32 daddr; 1139 }; 1140 1141 struct ipv6hdr { 1142 __u8 priority : 4; 1143 __u8 version : 4; 1144 __u8 flow_lbl[3]; 1145 __be16 payload_len; 1146 __u8 nexthdr; 1147 __u8 hop_limit; 1148 struct in6_addr saddr; 1149 struct in6_addr daddr; 1150 }; 1151 1152 struct tcphdr { 1153 __be16 source; 1154 __be16 dest; 1155 __be32 seq; 1156 __be32 ack_seq; 1157 __u16 res1 : 4; 1158 __u16 doff : 4; 1159 __u16 fin : 1; 1160 __u16 syn : 1; 1161 __u16 rst : 1; 1162 __u16 psh : 1; 1163 __u16 ack : 1; 1164 __u16 urg : 1; 1165 __u16 ece : 1; 1166 __u16 cwr : 1; 1167 __be16 window; 1168 __sum16 check; 1169 __be16 urg_ptr; 1170 }; 1171 1172 struct udphdr { 1173 __be16 source; 1174 __be16 dest; 1175 __be16 len; 1176 __sum16 check; 1177 }; 1178 1179 struct icmphdr { 1180 __u8 type; 1181 __u8 code; 1182 __sum16 checksum; 1183 union { 1184 struct { 1185 __be16 id; 1186 __be16 sequence; 1187 } echo; 1188 __be32 gateway; 1189 struct { 1190 __be16 __unused; 1191 __be16 mtu; 1192 } frag; 1193 __u8 reserved[4]; 1194 } un; 1195 }; 1196 1197 struct icmpv6_echo { 1198 __be16 identifier; 1199 __be16 sequence; 1200 }; 1201 1202 struct icmpv6_nd_advt { 1203 __u32 reserved : 5; 1204 __u32 override : 1; 1205 __u32 solicited : 1; 1206 __u32 router : 1; 1207 __u32 reserved2 : 24; 1208 }; 1209 1210 struct icmpv6_nd_ra { 1211 __u8 hop_limit; 1212 __u8 reserved : 3; 1213 __u8 router_pref : 2; 1214 __u8 home_agent : 1; 1215 __u8 other : 1; 1216 __u8 managed : 1; 1217 __be16 rt_lifetime; 1218 }; 1219 1220 struct icmp6hdr { 1221 __u8 icmp6_type; 1222 __u8 icmp6_code; 1223 __sum16 icmp6_cksum; 1224 union { 1225 __be32 un_data32[1]; 1226 __be16 un_data16[2]; 1227 __u8 un_data8[4]; 1228 struct icmpv6_echo u_echo; 1229 struct icmpv6_nd_advt u_nd_advt; 1230 struct icmpv6_nd_ra u_nd_ra; 1231 } icmp6_dataun; 1232 }; 1233 1234 #pragma clang attribute pop 1235 1236 #endif