[mirror_ubuntu-eoan-kernel.git] / include / linux / bpf-cgroup.h

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _BPF_CGROUP_H
#define _BPF_CGROUP_H

#include <linux/bpf.h>
#include <linux/errno.h>
#include <linux/jump_label.h>
#include <linux/percpu.h>
#include <linux/rbtree.h>
#include <uapi/linux/bpf.h>

struct sock;
struct sockaddr;
struct cgroup;
struct sk_buff;
struct bpf_map;
struct bpf_prog;
struct bpf_sock_ops_kern;
struct bpf_cgroup_storage;
struct ctl_table;
struct ctl_table_header;

#ifdef CONFIG_CGROUP_BPF

extern struct static_key_false cgroup_bpf_enabled_key;
#define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)

DECLARE_PER_CPU(struct bpf_cgroup_storage*,
		bpf_cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]);

#define for_each_cgroup_storage_type(stype) \
	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)

struct bpf_cgroup_storage_map;

struct bpf_storage_buffer {
	struct rcu_head rcu;
	char data[0];
};

struct bpf_cgroup_storage {
	union {
		struct bpf_storage_buffer *buf;
		void __percpu *percpu_buf;
	};
	struct bpf_cgroup_storage_map *map;
	struct bpf_cgroup_storage_key key;
	struct list_head list;
	struct rb_node node;
	struct rcu_head rcu;
};

struct bpf_prog_list {
	struct list_head node;
	struct bpf_prog *prog;
	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
};

struct bpf_prog_array;

struct cgroup_bpf {
	/* array of effective progs in this cgroup */
	struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];

	/* attached progs to this cgroup and attach flags
	 * when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
	 * have either zero or one element
	 * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
	 */
	struct list_head progs[MAX_BPF_ATTACH_TYPE];
	u32 flags[MAX_BPF_ATTACH_TYPE];

	/* temp storage for effective prog array used by prog_attach/detach */
	struct bpf_prog_array __rcu *inactive;
};

void cgroup_bpf_put(struct cgroup *cgrp);
int cgroup_bpf_inherit(struct cgroup *cgrp);

int __cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
			enum bpf_attach_type type, u32 flags);
int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
			enum bpf_attach_type type);
int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
		       union bpf_attr __user *uattr);

/* Wrapper for __cgroup_bpf_*() protected by cgroup_mutex */
int cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
		      enum bpf_attach_type type, u32 flags);
int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
		      enum bpf_attach_type type, u32 flags);
int cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
		     union bpf_attr __user *uattr);

int __cgroup_bpf_run_filter_skb(struct sock *sk,
				struct sk_buff *skb,
				enum bpf_attach_type type);

int __cgroup_bpf_run_filter_sk(struct sock *sk,
			       enum bpf_attach_type type);

int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
				      struct sockaddr *uaddr,
				      enum bpf_attach_type type,
				      void *t_ctx);

int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
				     struct bpf_sock_ops_kern *sock_ops,
				     enum bpf_attach_type type);

int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
				      short access, enum bpf_attach_type type);

int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
				   struct ctl_table *table, int write,
				   void __user *buf, size_t *pcount,
				   loff_t *ppos, void **new_buf,
				   enum bpf_attach_type type);

static inline enum bpf_cgroup_storage_type cgroup_storage_type(
	struct bpf_map *map)
{
	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
		return BPF_CGROUP_STORAGE_PERCPU;

	return BPF_CGROUP_STORAGE_SHARED;
}

static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage
					  *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
{
	enum bpf_cgroup_storage_type stype;

	for_each_cgroup_storage_type(stype)
		this_cpu_write(bpf_cgroup_storage[stype], storage[stype]);
}

struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog,
					enum bpf_cgroup_storage_type stype);
void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
			     struct cgroup *cgroup,
			     enum bpf_attach_type type);
void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
int bpf_cgroup_storage_assign(struct bpf_prog *prog, struct bpf_map *map);
void bpf_cgroup_storage_release(struct bpf_prog *prog, struct bpf_map *map);

int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key, void *value);
int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key,
				     void *value, u64 flags);

/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb)			      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled)						      \
		__ret = __cgroup_bpf_run_filter_skb(sk, skb,		      \
						    BPF_CGROUP_INET_INGRESS); \
									      \
	__ret;								      \
})

#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled && sk && sk == skb->sk) {		       \
		typeof(sk) __sk = sk_to_full_sk(sk);			       \
		if (sk_fullsock(__sk))					       \
			__ret = __cgroup_bpf_run_filter_skb(__sk, skb,	       \
						      BPF_CGROUP_INET_EGRESS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SK_PROG(sk, type)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled) {					       \
		__ret = __cgroup_bpf_run_filter_sk(sk, type);		       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE)

#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND)

#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_POST_BIND)

#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, type)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
							  NULL);	       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx)		       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)	{					       \
		lock_sock(sk);						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
							  t_ctx);	       \
		release_sock(sk);					       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_BIND)

#define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_BIND)

#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (cgroup_bpf_enabled && \
					    sk->sk_prot->pre_connect)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_RECVMSG, NULL)

#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_RECVMSG, NULL)

#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled && (sock_ops)->sk) {	       \
		typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk);	       \
		if (__sk && sk_fullsock(__sk))				       \
			__ret = __cgroup_bpf_run_filter_sock_ops(__sk,	       \
								 sock_ops,     \
							 BPF_CGROUP_SOCK_OPS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access)	      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled)						      \
		__ret = __cgroup_bpf_check_dev_permission(type, major, minor, \
							  access,	      \
							  BPF_CGROUP_DEVICE); \
									      \
	__ret;								      \
})


#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos, nbuf)  \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)						       \
		__ret = __cgroup_bpf_run_filter_sysctl(head, table, write,     \
						       buf, count, pos, nbuf,  \
						       BPF_CGROUP_SYSCTL);     \
	__ret;								       \
})

int cgroup_bpf_prog_attach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype, struct bpf_prog *prog);
int cgroup_bpf_prog_detach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype);
int cgroup_bpf_prog_query(const union bpf_attr *attr,
			  union bpf_attr __user *uattr);
#else

struct bpf_prog;
struct cgroup_bpf {};
static inline void cgroup_bpf_put(struct cgroup *cgrp) {}
static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }

static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype,
					 struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
					union bpf_attr __user *uattr)
{
	return -EINVAL;
}

static inline void bpf_cgroup_storage_set(
	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) {}
static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog,
					    struct bpf_map *map) { return 0; }
static inline void bpf_cgroup_storage_release(struct bpf_prog *prog,
					      struct bpf_map *map) {}
static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
static inline void bpf_cgroup_storage_free(
	struct bpf_cgroup_storage *storage) {}
static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key,
						 void *value) {
	return 0;
}
static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
					void *key, void *value, u64 flags) {
	return 0;
}

#define cgroup_bpf_enabled (0)
#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos,nbuf) ({ 0; })

#define for_each_cgroup_storage_type(stype) for (; false; )

#endif /* CONFIG_CGROUP_BPF */

#endif /* _BPF_CGROUP_H */
Commit	Line	Data
b2441318	1	/* SPDX-License-Identifier: GPL-2.0 */
30070984 DM	2	#ifndef _BPF_CGROUP_H
	3	#define _BPF_CGROUP_H
	4
8bad74f9	5	#include <linux/bpf.h>
f292b87d	6	#include <linux/errno.h>
30070984	7	#include <linux/jump_label.h>
aa0ad5b0	8	#include <linux/percpu.h>
de9cbbaa	9	#include <linux/rbtree.h>
30070984 DM	10	#include <uapi/linux/bpf.h>
	11
	12	struct sock;
4fbac77d	13	struct sockaddr;
30070984 DM	14	struct cgroup;
30070984 DM	15	struct sk_buff;
de9cbbaa RG	16	struct bpf_map;
de9cbbaa RG	17	struct bpf_prog;
40304b2a	18	struct bpf_sock_ops_kern;
de9cbbaa	19	struct bpf_cgroup_storage;
7b146ceb AI	20	struct ctl_table;
7b146ceb AI	21	struct ctl_table_header;
30070984 DM	22
	23	#ifdef CONFIG_CGROUP_BPF
	24
	25	extern struct static_key_false cgroup_bpf_enabled_key;
	26	#define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)
	27
f294b37e RG	28	DECLARE_PER_CPU(struct bpf_cgroup_storage*,
f294b37e RG	29	bpf_cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]);
8bad74f9 RG	30
	31	#define for_each_cgroup_storage_type(stype) \
	32	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)
aa0ad5b0	33
de9cbbaa RG	34	struct bpf_cgroup_storage_map;
	35
	36	struct bpf_storage_buffer {
	37	struct rcu_head rcu;
	38	char data[0];
	39	};
	40
	41	struct bpf_cgroup_storage {
b741f163 RG	42	union {
	43	struct bpf_storage_buffer *buf;
	44	void __percpu *percpu_buf;
	45	};
de9cbbaa RG	46	struct bpf_cgroup_storage_map *map;
	47	struct bpf_cgroup_storage_key key;
	48	struct list_head list;
	49	struct rb_node node;
	50	struct rcu_head rcu;
	51	};
	52
324bda9e AS	53	struct bpf_prog_list {
	54	struct list_head node;
	55	struct bpf_prog *prog;
8bad74f9	56	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
324bda9e AS	57	};
	58
	59	struct bpf_prog_array;
	60
30070984	61	struct cgroup_bpf {
324bda9e AS	62	/* array of effective progs in this cgroup */
	63	struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];
	64
	65	/* attached progs to this cgroup and attach flags
	66	* when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
	67	* have either zero or one element
	68	* when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
30070984	69	*/
324bda9e AS	70	struct list_head progs[MAX_BPF_ATTACH_TYPE];
	71	u32 flags[MAX_BPF_ATTACH_TYPE];
	72
	73	/* temp storage for effective prog array used by prog_attach/detach */
	74	struct bpf_prog_array __rcu *inactive;
30070984 DM	75	};
	76
	77	void cgroup_bpf_put(struct cgroup *cgrp);
324bda9e	78	int cgroup_bpf_inherit(struct cgroup *cgrp);
30070984	79
324bda9e AS	80	int __cgroup_bpf_attach(struct cgroup cgrp, struct bpf_prog prog,
	81	enum bpf_attach_type type, u32 flags);
	82	int __cgroup_bpf_detach(struct cgroup cgrp, struct bpf_prog prog,
1832f4ef	83	enum bpf_attach_type type);
468e2f64 AS	84	int __cgroup_bpf_query(struct cgroup cgrp, const union bpf_attr attr,
468e2f64 AS	85	union bpf_attr __user *uattr);
30070984	86
324bda9e AS	87	/* Wrapper for __cgroup_bpf_() protected by cgroup_mutex /
	88	int cgroup_bpf_attach(struct cgroup cgrp, struct bpf_prog prog,
	89	enum bpf_attach_type type, u32 flags);
	90	int cgroup_bpf_detach(struct cgroup cgrp, struct bpf_prog prog,
	91	enum bpf_attach_type type, u32 flags);
468e2f64 AS	92	int cgroup_bpf_query(struct cgroup cgrp, const union bpf_attr attr,
468e2f64 AS	93	union bpf_attr __user *uattr);
30070984	94
b2cd1257 DA	95	int __cgroup_bpf_run_filter_skb(struct sock *sk,
	96	struct sk_buff *skb,
	97	enum bpf_attach_type type);
	98
61023658 DA	99	int __cgroup_bpf_run_filter_sk(struct sock *sk,
	100	enum bpf_attach_type type);
	101
4fbac77d AI	102	int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
4fbac77d AI	103	struct sockaddr *uaddr,
1cedee13 AI	104	enum bpf_attach_type type,
1cedee13 AI	105	void *t_ctx);
4fbac77d	106
40304b2a LB	107	int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
	108	struct bpf_sock_ops_kern *sock_ops,
	109	enum bpf_attach_type type);
	110
ebc614f6 RG	111	int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
	112	short access, enum bpf_attach_type type);
	113
7b146ceb AI	114	int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
7b146ceb AI	115	struct ctl_table *table, int write,
4e63acdf	116	void __user buf, size_t pcount,
e1550bfe AI	117	loff_t ppos, void *new_buf,
e1550bfe AI	118	enum bpf_attach_type type);
7b146ceb	119
8bad74f9 RG	120	static inline enum bpf_cgroup_storage_type cgroup_storage_type(
8bad74f9 RG	121	struct bpf_map *map)
aa0ad5b0	122	{
b741f163 RG	123	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
	124	return BPF_CGROUP_STORAGE_PERCPU;
	125
8bad74f9 RG	126	return BPF_CGROUP_STORAGE_SHARED;
	127	}
	128
	129	static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage
	130	*storage[MAX_BPF_CGROUP_STORAGE_TYPE])
	131	{
	132	enum bpf_cgroup_storage_type stype;
aa0ad5b0	133
f294b37e RG	134	for_each_cgroup_storage_type(stype)
f294b37e RG	135	this_cpu_write(bpf_cgroup_storage[stype], storage[stype]);
aa0ad5b0 RG	136	}
aa0ad5b0 RG	137
8bad74f9 RG	138	struct bpf_cgroup_storage bpf_cgroup_storage_alloc(struct bpf_prog prog,
8bad74f9 RG	139	enum bpf_cgroup_storage_type stype);
de9cbbaa RG	140	void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
	141	void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
	142	struct cgroup *cgroup,
	143	enum bpf_attach_type type);
	144	void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
	145	int bpf_cgroup_storage_assign(struct bpf_prog prog, struct bpf_map map);
	146	void bpf_cgroup_storage_release(struct bpf_prog prog, struct bpf_map map);
	147
b741f163 RG	148	int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key, void *value);
	149	int bpf_percpu_cgroup_storage_update(struct bpf_map map, void key,
	150	void *value, u64 flags);
	151
b2cd1257 DA	152	/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
	153	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \
	154	({ \
	155	int __ret = 0; \
	156	if (cgroup_bpf_enabled) \
	157	__ret = __cgroup_bpf_run_filter_skb(sk, skb, \
	158	BPF_CGROUP_INET_INGRESS); \
	159	\
	160	__ret; \
30070984 DM	161	})
30070984 DM	162
b2cd1257 DA	163	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb) \
	164	({ \
	165	int __ret = 0; \
	166	if (cgroup_bpf_enabled && sk && sk == skb->sk) { \
	167	typeof(sk) __sk = sk_to_full_sk(sk); \
	168	if (sk_fullsock(__sk)) \
	169	__ret = __cgroup_bpf_run_filter_skb(__sk, skb, \
	170	BPF_CGROUP_INET_EGRESS); \
	171	} \
	172	__ret; \
30070984 DM	173	})
30070984 DM	174
aac3fc32	175	#define BPF_CGROUP_RUN_SK_PROG(sk, type) \
61023658 DA	176	({ \
61023658 DA	177	int __ret = 0; \
ee07862f	178	if (cgroup_bpf_enabled) { \
aac3fc32	179	__ret = __cgroup_bpf_run_filter_sk(sk, type); \
61023658 DA	180	} \
	181	__ret; \
	182	})
	183
aac3fc32 AI	184	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \
	185	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE)
	186
	187	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \
	188	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND)
	189
	190	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) \
	191	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_POST_BIND)
	192
4fbac77d AI	193	#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, type) \
	194	({ \
	195	int __ret = 0; \
	196	if (cgroup_bpf_enabled) \
1cedee13 AI	197	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type, \
1cedee13 AI	198	NULL); \
4fbac77d AI	199	__ret; \
	200	})
	201
1cedee13	202	#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx) \
d74bad4e AI	203	({ \
	204	int __ret = 0; \
	205	if (cgroup_bpf_enabled) { \
	206	lock_sock(sk); \
1cedee13 AI	207	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type, \
1cedee13 AI	208	t_ctx); \
d74bad4e AI	209	release_sock(sk); \
	210	} \
	211	__ret; \
	212	})
	213
4fbac77d AI	214	#define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr) \
	215	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_BIND)
	216
	217	#define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr) \
	218	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_BIND)
	219
d74bad4e AI	220	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (cgroup_bpf_enabled && \
	221	sk->sk_prot->pre_connect)
	222
	223	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) \
	224	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_CONNECT)
	225
	226	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) \
	227	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)
	228
	229	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) \
1cedee13	230	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)
d74bad4e AI	231
d74bad4e AI	232	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) \
1cedee13 AI	233	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)
	234
	235	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) \
	236	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)
	237
	238	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \
	239	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)
d74bad4e	240
983695fa DB	241	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) \
	242	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_RECVMSG, NULL)
	243
	244	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) \
	245	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_RECVMSG, NULL)
	246
40304b2a LB	247	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) \
	248	({ \
	249	int __ret = 0; \
	250	if (cgroup_bpf_enabled && (sock_ops)->sk) { \
	251	typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk); \
df39a9f1	252	if (__sk && sk_fullsock(__sk)) \
40304b2a LB	253	__ret = __cgroup_bpf_run_filter_sock_ops(__sk, \
	254	sock_ops, \
	255	BPF_CGROUP_SOCK_OPS); \
	256	} \
	257	__ret; \
	258	})
ebc614f6 RG	259
	260	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access) \
	261	({ \
	262	int __ret = 0; \
	263	if (cgroup_bpf_enabled) \
	264	__ret = __cgroup_bpf_check_dev_permission(type, major, minor, \
	265	access, \
	266	BPF_CGROUP_DEVICE); \
	267	\
	268	__ret; \
	269	})
7b146ceb AI	270
7b146ceb AI	271
e1550bfe	272	#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos, nbuf) \
7b146ceb AI	273	({ \
	274	int __ret = 0; \
	275	if (cgroup_bpf_enabled) \
	276	__ret = __cgroup_bpf_run_filter_sysctl(head, table, write, \
e1550bfe	277	buf, count, pos, nbuf, \
7b146ceb AI	278	BPF_CGROUP_SYSCTL); \
	279	__ret; \
	280	})
	281
fdb5c453 SY	282	int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	283	enum bpf_prog_type ptype, struct bpf_prog *prog);
	284	int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	285	enum bpf_prog_type ptype);
	286	int cgroup_bpf_prog_query(const union bpf_attr *attr,
	287	union bpf_attr __user *uattr);
30070984 DM	288	#else
30070984 DM	289
fdb5c453	290	struct bpf_prog;
30070984 DM	291	struct cgroup_bpf {};
30070984 DM	292	static inline void cgroup_bpf_put(struct cgroup *cgrp) {}
324bda9e	293	static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
30070984	294
fdb5c453 SY	295	static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	296	enum bpf_prog_type ptype,
	297	struct bpf_prog *prog)
	298	{
	299	return -EINVAL;
	300	}
	301
	302	static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	303	enum bpf_prog_type ptype)
	304	{
	305	return -EINVAL;
	306	}
	307
	308	static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
	309	union bpf_attr __user *uattr)
	310	{
	311	return -EINVAL;
	312	}
	313
8bad74f9 RG	314	static inline void bpf_cgroup_storage_set(
8bad74f9 RG	315	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) {}
de9cbbaa RG	316	static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog,
	317	struct bpf_map *map) { return 0; }
	318	static inline void bpf_cgroup_storage_release(struct bpf_prog *prog,
	319	struct bpf_map *map) {}
	320	static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
71b91a50	321	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
de9cbbaa RG	322	static inline void bpf_cgroup_storage_free(
de9cbbaa RG	323	struct bpf_cgroup_storage *storage) {}
b741f163 RG	324	static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key,
	325	void *value) {
	326	return 0;
	327	}
	328	static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
	329	void key, void value, u64 flags) {
	330	return 0;
	331	}
de9cbbaa	332
13193b0f	333	#define cgroup_bpf_enabled (0)
d74bad4e	334	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
30070984 DM	335	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
30070984 DM	336	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
61023658	337	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
4fbac77d AI	338	#define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr) ({ 0; })
4fbac77d AI	339	#define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr) ({ 0; })
aac3fc32 AI	340	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
aac3fc32 AI	341	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
d74bad4e AI	342	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
	343	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
	344	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
	345	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
1cedee13 AI	346	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
1cedee13 AI	347	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
983695fa DB	348	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
983695fa DB	349	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
40304b2a	350	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
ebc614f6	351	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
e1550bfe	352	#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos,nbuf) ({ 0; })
30070984	353
8bad74f9 RG	354	#define for_each_cgroup_storage_type(stype) for (; false; )
8bad74f9 RG	355
30070984 DM	356	#endif /* CONFIG_CGROUP_BPF */
	357
	358	#endif /* _BPF_CGROUP_H */