// Copyright (c) Microsoft Corporation // SPDX-License-Identifier: MIT // This file contains eBPF definitions common to eBPF programs, core execution engine // as well as eBPF API library. #pragma once #if !defined(NO_CRT) #include #endif #include "../external/ebpf-verifier/src/ebpf_base.h" #include "ebpf_windows.h" typedef enum bpf_map_type { BPF_MAP_TYPE_UNSPEC = 0, ///< Unspecified map type. BPF_MAP_TYPE_HASH = 1, ///< Hash table. BPF_MAP_TYPE_ARRAY = 2, ///< Array, where the map key is the array index. BPF_MAP_TYPE_PROG_ARRAY = 3, ///< Array of program fds usable with bpf_tail_call, where the map key is the array index. BPF_MAP_TYPE_PERCPU_HASH = 4, ///< Per-CPU hash table. BPF_MAP_TYPE_PERCPU_ARRAY = 5, ///< Per-CPU array. BPF_MAP_TYPE_HASH_OF_MAPS = 6, ///< Hash table, where the map value is another map. BPF_MAP_TYPE_ARRAY_OF_MAPS = 7, ///< Array, where the map value is another map. BPF_MAP_TYPE_LRU_HASH = 8, ///< Least-recently-used hash table. BPF_MAP_TYPE_LPM_TRIE = 9, ///< Longest prefix match trie. BPF_MAP_TYPE_QUEUE = 10, ///< Queue. BPF_MAP_TYPE_LRU_PERCPU_HASH = 11, ///< Per-CPU least-recently-used hash table. BPF_MAP_TYPE_STACK = 12, ///< Stack. BPF_MAP_TYPE_RINGBUF = 13 ///< Ring buffer. } ebpf_map_type_t; typedef enum ebpf_map_option { EBPF_ANY, ///< Create a new element or update an existing element. EBPF_NOEXIST, ///< Create a new element only when it does not exist. EBPF_EXIST ///< Update an existing element. } ebpf_map_option_t; typedef enum ebpf_pin_type { PIN_NONE, PIN_OBJECT_NS, PIN_GLOBAL_NS, PIN_CUSTOM_NS } ebpf_pin_type_t; typedef uint32_t ebpf_id_t; #define EBPF_ID_NONE UINT32_MAX /** * @brief eBPF Map Definition as it is stored in memory. */ typedef struct _ebpf_map_definition_in_memory { uint32_t size; ///< Size in bytes of the ebpf_map_definition_t structure. ebpf_map_type_t type; ///< Type of map. uint32_t key_size; ///< Size in bytes of a map key. uint32_t value_size; ///< Size in bytes of a map value. uint32_t max_entries; ///< Maximum number of entries allowed in the map. ebpf_id_t inner_map_id; ebpf_pin_type_t pinning; } ebpf_map_definition_in_memory_t; /** * @brief eBPF Map Definition as it appears in the maps section of an ELF file. */ typedef struct _ebpf_map_definition_in_file { uint32_t size; ///< Size in bytes of the ebpf_map_definition_t structure. ebpf_map_type_t type; ///< Type of map. uint32_t key_size; ///< Size in bytes of a map key. uint32_t value_size; ///< Size in bytes of a map value. uint32_t max_entries; ///< Maximum number of entries allowed in the map. /** When a map definition is hard coded in an eBPF program, inner_map_idx * indicates the 0-based index of which map in the maps section of the ELF * file is the inner map template. */ uint32_t inner_map_idx; ebpf_pin_type_t pinning; /** id is the identifier for a map template. */ uint32_t id; /** For a map of map, inner_id is the id of the inner map template. */ uint32_t inner_id; } ebpf_map_definition_in_file_t; typedef enum { BPF_FUNC_map_lookup_elem = 1, BPF_FUNC_map_update_elem = 2, BPF_FUNC_map_delete_elem = 3, BPF_FUNC_map_lookup_and_delete_elem = 4, BPF_FUNC_tail_call = 5, BPF_FUNC_get_prandom_u32 = 6, BPF_FUNC_ktime_get_boot_ns = 7, BPF_FUNC_get_smp_processor_id = 8, BPF_FUNC_ktime_get_ns = 9, BPF_FUNC_csum_diff = 10, BPF_FUNC_ringbuf_output = 11, BPF_FUNC_trace_printk2 = 12, BPF_FUNC_trace_printk3 = 13, BPF_FUNC_trace_printk4 = 14, BPF_FUNC_trace_printk5 = 15, BPF_FUNC_map_push_elem = 16, BPF_FUNC_map_pop_elem = 17, BPF_FUNC_map_peek_elem = 18, } ebpf_helper_id_t; // Cross-platform BPF program types. enum bpf_prog_type { BPF_PROG_TYPE_UNSPEC, BPF_PROG_TYPE_XDP, BPF_PROG_TYPE_BIND, // TODO(#333): replace with cross-platform program type BPF_PROG_TYPE_SAMPLE = 999 }; typedef enum bpf_prog_type bpf_prog_type_t; #define XDP_FLAGS_REPLACE 0x01 // The link type is used to tell which union member is present // in the bpf_link_info struct. There is exactly one non-zero value // per union member. enum bpf_link_type { BPF_LINK_TYPE_UNSPEC, BPF_LINK_TYPE_PLAIN, }; enum bpf_attach_type { BPF_ATTACH_TYPE_UNSPEC, BPF_ATTACH_TYPE_XDP, __MAX_BPF_ATTACH_TYPE, }; // Libbpf itself requires the following structs to be defined, but doesn't // care what fields they have. Applications such as bpftool on the other // hand depend on fields of specific names and types. #pragma warning(push) #pragma warning(disable : 4201) /* nameless struct/union */ struct bpf_link_info { ebpf_id_t id; ///< Link ID. ebpf_id_t prog_id; ///< Program ID. enum bpf_link_type type; ///< Link type. int attach_type; ///< Attach type integer. ebpf_attach_type_t attach_type_uuid; ///< Attach type UUID. ebpf_program_type_t program_type_uuid; ///< Program type UUID. union { struct { uint32_t ifindex; } xdp; }; }; #pragma warning(pop) #define BPF_OBJ_NAME_LEN 64 struct bpf_map_info { // Cross-platform fields. ebpf_id_t id; ///< Map ID. ebpf_map_type_t type; ///< Type of map. uint32_t key_size; ///< Size in bytes of a map key. uint32_t value_size; ///< Size in bytes of a map value. uint32_t max_entries; ///< Maximum number of entries allowed in the map. char name[BPF_OBJ_NAME_LEN]; ///< Null-terminated map name. uint32_t map_flags; ///< Map flags. // Windows-specific fields. ebpf_id_t inner_map_id; ///< ID of inner map template. uint32_t pinned_path_count; ///< Number of pinned paths. }; #define BPF_ANY 0x0 #define BPF_NOEXIST 0x1 #define BPF_EXIST 0x2 struct bpf_prog_info { // Cross-platform fields. ebpf_id_t id; ///< Program ID. enum bpf_prog_type type; ///< Program type, if a cross-platform type. uint32_t nr_map_ids; ///< Number of maps associated with this program. char name[BPF_OBJ_NAME_LEN]; ///< Null-terminated program name. // Windows-specific fields. ebpf_program_type_t type_uuid; ///< Program type UUID. uint32_t pinned_path_count; ///< Number of pinned paths. uint32_t link_count; ///< Number of attached links. };