[mirror_ubuntu-hirsute-kernel.git] / include / linux / bpf-cgroup.h

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _BPF_CGROUP_H
#define _BPF_CGROUP_H

#include <linux/bpf.h>
#include <linux/errno.h>
#include <linux/jump_label.h>
#include <linux/percpu.h>
#include <linux/percpu-refcount.h>
#include <linux/rbtree.h>
#include <uapi/linux/bpf.h>

struct sock;
struct sockaddr;
struct cgroup;
struct sk_buff;
struct bpf_map;
struct bpf_prog;
struct bpf_sock_ops_kern;
struct bpf_cgroup_storage;
struct ctl_table;
struct ctl_table_header;
struct task_struct;

#ifdef CONFIG_CGROUP_BPF

extern struct static_key_false cgroup_bpf_enabled_key;
#define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)

#define BPF_CGROUP_STORAGE_NEST_MAX	8

struct bpf_cgroup_storage_info {
	struct task_struct *task;
	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
};

/* For each cpu, permit maximum BPF_CGROUP_STORAGE_NEST_MAX number of tasks
 * to use bpf cgroup storage simultaneously.
 */
DECLARE_PER_CPU(struct bpf_cgroup_storage_info,
		bpf_cgroup_storage_info[BPF_CGROUP_STORAGE_NEST_MAX]);

#define for_each_cgroup_storage_type(stype) \
	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)

struct bpf_cgroup_storage_map;

struct bpf_storage_buffer {
	struct rcu_head rcu;
	char data[];
};

struct bpf_cgroup_storage {
	union {
		struct bpf_storage_buffer *buf;
		void __percpu *percpu_buf;
	};
	struct bpf_cgroup_storage_map *map;
	struct bpf_cgroup_storage_key key;
	struct list_head list_map;
	struct list_head list_cg;
	struct rb_node node;
	struct rcu_head rcu;
};

struct bpf_cgroup_link {
	struct bpf_link link;
	struct cgroup *cgroup;
	enum bpf_attach_type type;
};

struct bpf_prog_list {
	struct list_head node;
	struct bpf_prog *prog;
	struct bpf_cgroup_link *link;
	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
};

struct bpf_prog_array;

struct cgroup_bpf {
	/* array of effective progs in this cgroup */
	struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];

	/* attached progs to this cgroup and attach flags
	 * when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
	 * have either zero or one element
	 * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
	 */
	struct list_head progs[MAX_BPF_ATTACH_TYPE];
	u32 flags[MAX_BPF_ATTACH_TYPE];

	/* list of cgroup shared storages */
	struct list_head storages;

	/* temp storage for effective prog array used by prog_attach/detach */
	struct bpf_prog_array *inactive;

	/* reference counter used to detach bpf programs after cgroup removal */
	struct percpu_ref refcnt;

	/* cgroup_bpf is released using a work queue */
	struct work_struct release_work;
};

int cgroup_bpf_inherit(struct cgroup *cgrp);
void cgroup_bpf_offline(struct cgroup *cgrp);

int __cgroup_bpf_attach(struct cgroup *cgrp,
			struct bpf_prog *prog, struct bpf_prog *replace_prog,
			struct bpf_cgroup_link *link,
			enum bpf_attach_type type, u32 flags);
int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
			struct bpf_cgroup_link *link,
			enum bpf_attach_type type);
int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
		       union bpf_attr __user *uattr);

/* Wrapper for __cgroup_bpf_*() protected by cgroup_mutex */
int cgroup_bpf_attach(struct cgroup *cgrp,
		      struct bpf_prog *prog, struct bpf_prog *replace_prog,
		      struct bpf_cgroup_link *link, enum bpf_attach_type type,
		      u32 flags);
int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
		      enum bpf_attach_type type);
int cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
		     union bpf_attr __user *uattr);

int __cgroup_bpf_run_filter_skb(struct sock *sk,
				struct sk_buff *skb,
				enum bpf_attach_type type);

int __cgroup_bpf_run_filter_sk(struct sock *sk,
			       enum bpf_attach_type type);

int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
				      struct sockaddr *uaddr,
				      enum bpf_attach_type type,
				      void *t_ctx);

int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
				     struct bpf_sock_ops_kern *sock_ops,
				     enum bpf_attach_type type);

int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
				      short access, enum bpf_attach_type type);

int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
				   struct ctl_table *table, int write,
				   char **buf, size_t *pcount, loff_t *ppos,
				   enum bpf_attach_type type);

int __cgroup_bpf_run_filter_setsockopt(struct sock *sock, int *level,
				       int *optname, char __user *optval,
				       int *optlen, char **kernel_optval);
int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
				       int optname, char __user *optval,
				       int __user *optlen, int max_optlen,
				       int retval);

static inline enum bpf_cgroup_storage_type cgroup_storage_type(
	struct bpf_map *map)
{
	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
		return BPF_CGROUP_STORAGE_PERCPU;

	return BPF_CGROUP_STORAGE_SHARED;
}

static inline int bpf_cgroup_storage_set(struct bpf_cgroup_storage
					 *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
{
	enum bpf_cgroup_storage_type stype;
	int i, err = 0;

	preempt_disable();
	for (i = 0; i < BPF_CGROUP_STORAGE_NEST_MAX; i++) {
		if (unlikely(this_cpu_read(bpf_cgroup_storage_info[i].task) != NULL))
			continue;

		this_cpu_write(bpf_cgroup_storage_info[i].task, current);
		for_each_cgroup_storage_type(stype)
			this_cpu_write(bpf_cgroup_storage_info[i].storage[stype],
				       storage[stype]);
		goto out;
	}
	err = -EBUSY;
	WARN_ON_ONCE(1);

out:
	preempt_enable();
	return err;
}

static inline void bpf_cgroup_storage_unset(void)
{
	int i;

	for (i = BPF_CGROUP_STORAGE_NEST_MAX - 1; i >= 0; i--) {
		if (likely(this_cpu_read(bpf_cgroup_storage_info[i].task) != current))
			continue;

		this_cpu_write(bpf_cgroup_storage_info[i].task, NULL);
		return;
	}
}

struct bpf_cgroup_storage *
cgroup_storage_lookup(struct bpf_cgroup_storage_map *map,
		      void *key, bool locked);
struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog,
					enum bpf_cgroup_storage_type stype);
void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
			     struct cgroup *cgroup,
			     enum bpf_attach_type type);
void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *map);

int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key, void *value);
int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key,
				     void *value, u64 flags);

/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb)			      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled)						      \
		__ret = __cgroup_bpf_run_filter_skb(sk, skb,		      \
						    BPF_CGROUP_INET_INGRESS); \
									      \
	__ret;								      \
})

#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled && sk && sk == skb->sk) {		       \
		typeof(sk) __sk = sk_to_full_sk(sk);			       \
		if (sk_fullsock(__sk))					       \
			__ret = __cgroup_bpf_run_filter_skb(__sk, skb,	       \
						      BPF_CGROUP_INET_EGRESS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SK_PROG(sk, type)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled) {					       \
		__ret = __cgroup_bpf_run_filter_sk(sk, type);		       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE)

#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk)			       \
	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_RELEASE)

#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND)

#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_POST_BIND)

#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, type)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
							  NULL);	       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx)		       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)	{					       \
		lock_sock(sk);						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
							  t_ctx);	       \
		release_sock(sk);					       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_INET4_BIND_LOCK(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_BIND, NULL)

#define BPF_CGROUP_RUN_PROG_INET6_BIND_LOCK(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_BIND, NULL)

#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (cgroup_bpf_enabled && \
					    sk->sk_prot->pre_connect)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_RECVMSG, NULL)

#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_RECVMSG, NULL)

/* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a
 * fullsock and its parent fullsock cannot be traced by
 * sk_to_full_sk().
 *
 * e.g. sock_ops->sk is a request_sock and it is under syncookie mode.
 * Its listener-sk is not attached to the rsk_listener.
 * In this case, the caller holds the listener-sk (unlocked),
 * set its sock_ops->sk to req_sk, and call this SOCK_OPS"_SK" with
 * the listener-sk such that the cgroup-bpf-progs of the
 * listener-sk will be run.
 *
 * Regardless of syncookie mode or not,
 * calling bpf_setsockopt on listener-sk will not make sense anyway,
 * so passing 'sock_ops->sk == req_sk' to the bpf prog is appropriate here.
 */
#define BPF_CGROUP_RUN_PROG_SOCK_OPS_SK(sock_ops, sk)			\
({									\
	int __ret = 0;							\
	if (cgroup_bpf_enabled)						\
		__ret = __cgroup_bpf_run_filter_sock_ops(sk,		\
							 sock_ops,	\
							 BPF_CGROUP_SOCK_OPS); \
	__ret;								\
})

#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled && (sock_ops)->sk) {	       \
		typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk);	       \
		if (__sk && sk_fullsock(__sk))				       \
			__ret = __cgroup_bpf_run_filter_sock_ops(__sk,	       \
								 sock_ops,     \
							 BPF_CGROUP_SOCK_OPS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access)	      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled)						      \
		__ret = __cgroup_bpf_check_dev_permission(type, major, minor, \
							  access,	      \
							  BPF_CGROUP_DEVICE); \
									      \
	__ret;								      \
})


#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos)  \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)						       \
		__ret = __cgroup_bpf_run_filter_sysctl(head, table, write,     \
						       buf, count, pos,        \
						       BPF_CGROUP_SYSCTL);     \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen,   \
				       kernel_optval)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)						       \
		__ret = __cgroup_bpf_run_filter_setsockopt(sock, level,	       \
							   optname, optval,    \
							   optlen,	       \
							   kernel_optval);     \
	__ret;								       \
})

#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled)						       \
		get_user(__ret, optlen);				       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, optlen,   \
				       max_optlen, retval)		       \
({									       \
	int __ret = retval;						       \
	if (cgroup_bpf_enabled)						       \
		__ret = __cgroup_bpf_run_filter_getsockopt(sock, level,	       \
							   optname, optval,    \
							   optlen, max_optlen, \
							   retval);	       \
	__ret;								       \
})

int cgroup_bpf_prog_attach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype, struct bpf_prog *prog);
int cgroup_bpf_prog_detach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype);
int cgroup_bpf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);
int cgroup_bpf_prog_query(const union bpf_attr *attr,
			  union bpf_attr __user *uattr);
#else

struct bpf_prog;
struct cgroup_bpf {};
static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
static inline void cgroup_bpf_offline(struct cgroup *cgrp) {}

static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype,
					 struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype)
{
	return -EINVAL;
}

static inline int cgroup_bpf_link_attach(const union bpf_attr *attr,
					 struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
					union bpf_attr __user *uattr)
{
	return -EINVAL;
}

static inline int bpf_cgroup_storage_set(
	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) { return 0; }
static inline void bpf_cgroup_storage_unset(void) {}
static inline int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux,
					    struct bpf_map *map) { return 0; }
static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
static inline void bpf_cgroup_storage_free(
	struct bpf_cgroup_storage *storage) {}
static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key,
						 void *value) {
	return 0;
}
static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
					void *key, void *value, u64 flags) {
	return 0;
}

#define cgroup_bpf_enabled (0)
#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx) ({ 0; })
#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_BIND_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_BIND_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })
#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) ({ 0; })
#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, \
				       optlen, max_optlen, retval) ({ retval; })
#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
				       kernel_optval) ({ 0; })

#define for_each_cgroup_storage_type(stype) for (; false; )

#endif /* CONFIG_CGROUP_BPF */

#endif /* _BPF_CGROUP_H */
Commit	Line	Data
b2441318	1	/* SPDX-License-Identifier: GPL-2.0 */
30070984 DM	2	#ifndef _BPF_CGROUP_H
	3	#define _BPF_CGROUP_H
	4
8bad74f9	5	#include <linux/bpf.h>
f292b87d	6	#include <linux/errno.h>
30070984	7	#include <linux/jump_label.h>
aa0ad5b0	8	#include <linux/percpu.h>
4bfc0bb2	9	#include <linux/percpu-refcount.h>
de9cbbaa	10	#include <linux/rbtree.h>
30070984 DM	11	#include <uapi/linux/bpf.h>
	12
	13	struct sock;
4fbac77d	14	struct sockaddr;
30070984 DM	15	struct cgroup;
30070984 DM	16	struct sk_buff;
de9cbbaa RG	17	struct bpf_map;
de9cbbaa RG	18	struct bpf_prog;
40304b2a	19	struct bpf_sock_ops_kern;
de9cbbaa	20	struct bpf_cgroup_storage;
7b146ceb AI	21	struct ctl_table;
7b146ceb AI	22	struct ctl_table_header;
6280f200	23	struct task_struct;
30070984 DM	24
	25	#ifdef CONFIG_CGROUP_BPF
	26
	27	extern struct static_key_false cgroup_bpf_enabled_key;
	28	#define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)
	29
6280f200 YS	30	#define BPF_CGROUP_STORAGE_NEST_MAX 8
	31
	32	struct bpf_cgroup_storage_info {
	33	struct task_struct *task;
	34	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
	35	};
	36
	37	/* For each cpu, permit maximum BPF_CGROUP_STORAGE_NEST_MAX number of tasks
	38	* to use bpf cgroup storage simultaneously.
	39	*/
	40	DECLARE_PER_CPU(struct bpf_cgroup_storage_info,
	41	bpf_cgroup_storage_info[BPF_CGROUP_STORAGE_NEST_MAX]);
8bad74f9 RG	42
	43	#define for_each_cgroup_storage_type(stype) \
	44	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)
aa0ad5b0	45
de9cbbaa RG	46	struct bpf_cgroup_storage_map;
	47
	48	struct bpf_storage_buffer {
	49	struct rcu_head rcu;
d7f10df8	50	char data[];
de9cbbaa RG	51	};
	52
	53	struct bpf_cgroup_storage {
b741f163 RG	54	union {
	55	struct bpf_storage_buffer *buf;
	56	void __percpu *percpu_buf;
	57	};
de9cbbaa RG	58	struct bpf_cgroup_storage_map *map;
de9cbbaa RG	59	struct bpf_cgroup_storage_key key;
7d9c3427 YZ	60	struct list_head list_map;
7d9c3427 YZ	61	struct list_head list_cg;
de9cbbaa RG	62	struct rb_node node;
	63	struct rcu_head rcu;
	64	};
	65
af6eea57 AN	66	struct bpf_cgroup_link {
	67	struct bpf_link link;
	68	struct cgroup *cgroup;
	69	enum bpf_attach_type type;
	70	};
	71
324bda9e AS	72	struct bpf_prog_list {
	73	struct list_head node;
	74	struct bpf_prog *prog;
af6eea57	75	struct bpf_cgroup_link *link;
8bad74f9	76	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
324bda9e AS	77	};
	78
	79	struct bpf_prog_array;
	80
30070984	81	struct cgroup_bpf {
324bda9e AS	82	/* array of effective progs in this cgroup */
	83	struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];
	84
	85	/* attached progs to this cgroup and attach flags
	86	* when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
	87	* have either zero or one element
	88	* when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
30070984	89	*/
324bda9e AS	90	struct list_head progs[MAX_BPF_ATTACH_TYPE];
	91	u32 flags[MAX_BPF_ATTACH_TYPE];
	92
7d9c3427 YZ	93	/* list of cgroup shared storages */
	94	struct list_head storages;
	95
324bda9e	96	/* temp storage for effective prog array used by prog_attach/detach */
dbcc1ba2	97	struct bpf_prog_array *inactive;
4bfc0bb2 RG	98
	99	/* reference counter used to detach bpf programs after cgroup removal */
	100	struct percpu_ref refcnt;
	101
	102	/* cgroup_bpf is released using a work queue */
	103	struct work_struct release_work;
30070984 DM	104	};
30070984 DM	105
324bda9e	106	int cgroup_bpf_inherit(struct cgroup *cgrp);
4bfc0bb2	107	void cgroup_bpf_offline(struct cgroup *cgrp);
30070984	108
af6eea57 AN	109	int __cgroup_bpf_attach(struct cgroup *cgrp,
	110	struct bpf_prog prog, struct bpf_prog replace_prog,
	111	struct bpf_cgroup_link *link,
324bda9e AS	112	enum bpf_attach_type type, u32 flags);
324bda9e AS	113	int __cgroup_bpf_detach(struct cgroup cgrp, struct bpf_prog prog,
af6eea57	114	struct bpf_cgroup_link *link,
1832f4ef	115	enum bpf_attach_type type);
468e2f64 AS	116	int __cgroup_bpf_query(struct cgroup cgrp, const union bpf_attr attr,
468e2f64 AS	117	union bpf_attr __user *uattr);
30070984	118
324bda9e	119	/* Wrapper for __cgroup_bpf_() protected by cgroup_mutex /
af6eea57 AN	120	int cgroup_bpf_attach(struct cgroup *cgrp,
	121	struct bpf_prog prog, struct bpf_prog replace_prog,
	122	struct bpf_cgroup_link *link, enum bpf_attach_type type,
7dd68b32	123	u32 flags);
324bda9e	124	int cgroup_bpf_detach(struct cgroup cgrp, struct bpf_prog prog,
af6eea57	125	enum bpf_attach_type type);
468e2f64 AS	126	int cgroup_bpf_query(struct cgroup cgrp, const union bpf_attr attr,
468e2f64 AS	127	union bpf_attr __user *uattr);
30070984	128
b2cd1257 DA	129	int __cgroup_bpf_run_filter_skb(struct sock *sk,
	130	struct sk_buff *skb,
	131	enum bpf_attach_type type);
	132
61023658 DA	133	int __cgroup_bpf_run_filter_sk(struct sock *sk,
	134	enum bpf_attach_type type);
	135
4fbac77d AI	136	int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
4fbac77d AI	137	struct sockaddr *uaddr,
1cedee13 AI	138	enum bpf_attach_type type,
1cedee13 AI	139	void *t_ctx);
4fbac77d	140
40304b2a LB	141	int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
	142	struct bpf_sock_ops_kern *sock_ops,
	143	enum bpf_attach_type type);
	144
ebc614f6 RG	145	int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
	146	short access, enum bpf_attach_type type);
	147
7b146ceb AI	148	int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
7b146ceb AI	149	struct ctl_table *table, int write,
4bd6a735	150	char *buf, size_t pcount, loff_t *ppos,
e1550bfe	151	enum bpf_attach_type type);
7b146ceb	152
0d01da6a SF	153	int __cgroup_bpf_run_filter_setsockopt(struct sock sock, int level,
	154	int optname, char __user optval,
	155	int optlen, char *kernel_optval);
	156	int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
	157	int optname, char __user *optval,
	158	int __user *optlen, int max_optlen,
	159	int retval);
	160
8bad74f9 RG	161	static inline enum bpf_cgroup_storage_type cgroup_storage_type(
8bad74f9 RG	162	struct bpf_map *map)
aa0ad5b0	163	{
b741f163 RG	164	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
	165	return BPF_CGROUP_STORAGE_PERCPU;
	166
8bad74f9 RG	167	return BPF_CGROUP_STORAGE_SHARED;
	168	}
	169
6280f200 YS	170	static inline int bpf_cgroup_storage_set(struct bpf_cgroup_storage
6280f200 YS	171	*storage[MAX_BPF_CGROUP_STORAGE_TYPE])
8bad74f9 RG	172	{
8bad74f9 RG	173	enum bpf_cgroup_storage_type stype;
6280f200 YS	174	int i, err = 0;
	175
	176	preempt_disable();
	177	for (i = 0; i < BPF_CGROUP_STORAGE_NEST_MAX; i++) {
	178	if (unlikely(this_cpu_read(bpf_cgroup_storage_info[i].task) != NULL))
	179	continue;
	180
	181	this_cpu_write(bpf_cgroup_storage_info[i].task, current);
	182	for_each_cgroup_storage_type(stype)
	183	this_cpu_write(bpf_cgroup_storage_info[i].storage[stype],
	184	storage[stype]);
	185	goto out;
	186	}
	187	err = -EBUSY;
	188	WARN_ON_ONCE(1);
	189
	190	out:
	191	preempt_enable();
	192	return err;
	193	}
	194
	195	static inline void bpf_cgroup_storage_unset(void)
	196	{
	197	int i;
	198
3f5aca72 YS	199	for (i = BPF_CGROUP_STORAGE_NEST_MAX - 1; i >= 0; i--) {
3f5aca72 YS	200	if (likely(this_cpu_read(bpf_cgroup_storage_info[i].task) != current))
6280f200	201	continue;
aa0ad5b0	202
6280f200 YS	203	this_cpu_write(bpf_cgroup_storage_info[i].task, NULL);
	204	return;
	205	}
aa0ad5b0 RG	206	}
aa0ad5b0 RG	207
7d9c3427 YZ	208	struct bpf_cgroup_storage *
	209	cgroup_storage_lookup(struct bpf_cgroup_storage_map *map,
	210	void *key, bool locked);
8bad74f9 RG	211	struct bpf_cgroup_storage bpf_cgroup_storage_alloc(struct bpf_prog prog,
8bad74f9 RG	212	enum bpf_cgroup_storage_type stype);
de9cbbaa RG	213	void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
	214	void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
	215	struct cgroup *cgroup,
	216	enum bpf_attach_type type);
	217	void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
e4730423	218	int bpf_cgroup_storage_assign(struct bpf_prog_aux aux, struct bpf_map map);
de9cbbaa	219
b741f163 RG	220	int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key, void *value);
	221	int bpf_percpu_cgroup_storage_update(struct bpf_map map, void key,
	222	void *value, u64 flags);
	223
b2cd1257 DA	224	/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
	225	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \
	226	({ \
	227	int __ret = 0; \
	228	if (cgroup_bpf_enabled) \
	229	__ret = __cgroup_bpf_run_filter_skb(sk, skb, \
	230	BPF_CGROUP_INET_INGRESS); \
	231	\
	232	__ret; \
30070984 DM	233	})
30070984 DM	234
b2cd1257 DA	235	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb) \
	236	({ \
	237	int __ret = 0; \
	238	if (cgroup_bpf_enabled && sk && sk == skb->sk) { \
	239	typeof(sk) __sk = sk_to_full_sk(sk); \
	240	if (sk_fullsock(__sk)) \
	241	__ret = __cgroup_bpf_run_filter_skb(__sk, skb, \
	242	BPF_CGROUP_INET_EGRESS); \
	243	} \
	244	__ret; \
30070984 DM	245	})
30070984 DM	246
aac3fc32	247	#define BPF_CGROUP_RUN_SK_PROG(sk, type) \
61023658 DA	248	({ \
61023658 DA	249	int __ret = 0; \
ee07862f	250	if (cgroup_bpf_enabled) { \
aac3fc32	251	__ret = __cgroup_bpf_run_filter_sk(sk, type); \
61023658 DA	252	} \
	253	__ret; \
	254	})
	255
aac3fc32 AI	256	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \
	257	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE)
	258
f5836749 SF	259	#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) \
	260	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_RELEASE)
	261
aac3fc32 AI	262	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \
	263	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND)
	264
	265	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) \
	266	BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_POST_BIND)
	267
4fbac77d AI	268	#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, type) \
	269	({ \
	270	int __ret = 0; \
	271	if (cgroup_bpf_enabled) \
1cedee13 AI	272	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type, \
1cedee13 AI	273	NULL); \
4fbac77d AI	274	__ret; \
	275	})
	276
1cedee13	277	#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx) \
d74bad4e AI	278	({ \
	279	int __ret = 0; \
	280	if (cgroup_bpf_enabled) { \
	281	lock_sock(sk); \
1cedee13 AI	282	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type, \
1cedee13 AI	283	t_ctx); \
d74bad4e AI	284	release_sock(sk); \
	285	} \
	286	__ret; \
	287	})
	288
427167c0 SF	289	#define BPF_CGROUP_RUN_PROG_INET4_BIND_LOCK(sk, uaddr) \
427167c0 SF	290	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_BIND, NULL)
4fbac77d	291
427167c0 SF	292	#define BPF_CGROUP_RUN_PROG_INET6_BIND_LOCK(sk, uaddr) \
427167c0 SF	293	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_BIND, NULL)
4fbac77d	294
d74bad4e AI	295	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (cgroup_bpf_enabled && \
	296	sk->sk_prot->pre_connect)
	297
	298	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) \
	299	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_CONNECT)
	300
	301	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) \
	302	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)
	303
	304	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) \
1cedee13	305	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)
d74bad4e AI	306
d74bad4e AI	307	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) \
1cedee13 AI	308	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)
	309
	310	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) \
	311	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)
	312
	313	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \
	314	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)
d74bad4e	315
983695fa DB	316	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) \
	317	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_RECVMSG, NULL)
	318
	319	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) \
	320	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_RECVMSG, NULL)
	321
0813a841 MKL	322	/* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a
	323	* fullsock and its parent fullsock cannot be traced by
	324	* sk_to_full_sk().
	325	*
	326	* e.g. sock_ops->sk is a request_sock and it is under syncookie mode.
	327	* Its listener-sk is not attached to the rsk_listener.
	328	* In this case, the caller holds the listener-sk (unlocked),
	329	* set its sock_ops->sk to req_sk, and call this SOCK_OPS"_SK" with
	330	* the listener-sk such that the cgroup-bpf-progs of the
	331	* listener-sk will be run.
	332	*
	333	* Regardless of syncookie mode or not,
	334	* calling bpf_setsockopt on listener-sk will not make sense anyway,
	335	* so passing 'sock_ops->sk == req_sk' to the bpf prog is appropriate here.
	336	*/
	337	#define BPF_CGROUP_RUN_PROG_SOCK_OPS_SK(sock_ops, sk) \
	338	({ \
	339	int __ret = 0; \
	340	if (cgroup_bpf_enabled) \
	341	__ret = __cgroup_bpf_run_filter_sock_ops(sk, \
	342	sock_ops, \
	343	BPF_CGROUP_SOCK_OPS); \
	344	__ret; \
	345	})
	346
40304b2a LB	347	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) \
	348	({ \
	349	int __ret = 0; \
	350	if (cgroup_bpf_enabled && (sock_ops)->sk) { \
	351	typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk); \
df39a9f1	352	if (__sk && sk_fullsock(__sk)) \
40304b2a LB	353	__ret = __cgroup_bpf_run_filter_sock_ops(__sk, \
	354	sock_ops, \
	355	BPF_CGROUP_SOCK_OPS); \
	356	} \
	357	__ret; \
	358	})
ebc614f6 RG	359
	360	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access) \
	361	({ \
	362	int __ret = 0; \
	363	if (cgroup_bpf_enabled) \
	364	__ret = __cgroup_bpf_check_dev_permission(type, major, minor, \
	365	access, \
	366	BPF_CGROUP_DEVICE); \
	367	\
	368	__ret; \
	369	})
7b146ceb AI	370
7b146ceb AI	371
32927393	372	#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos) \
7b146ceb AI	373	({ \
	374	int __ret = 0; \
	375	if (cgroup_bpf_enabled) \
	376	__ret = __cgroup_bpf_run_filter_sysctl(head, table, write, \
32927393	377	buf, count, pos, \
7b146ceb AI	378	BPF_CGROUP_SYSCTL); \
	379	__ret; \
	380	})
	381
0d01da6a SF	382	#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
	383	kernel_optval) \
	384	({ \
	385	int __ret = 0; \
	386	if (cgroup_bpf_enabled) \
	387	__ret = __cgroup_bpf_run_filter_setsockopt(sock, level, \
	388	optname, optval, \
	389	optlen, \
	390	kernel_optval); \
	391	__ret; \
	392	})
	393
	394	#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) \
	395	({ \
	396	int __ret = 0; \
	397	if (cgroup_bpf_enabled) \
	398	get_user(__ret, optlen); \
	399	__ret; \
	400	})
	401
	402	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, optlen, \
	403	max_optlen, retval) \
	404	({ \
	405	int __ret = retval; \
	406	if (cgroup_bpf_enabled) \
	407	__ret = __cgroup_bpf_run_filter_getsockopt(sock, level, \
	408	optname, optval, \
	409	optlen, max_optlen, \
	410	retval); \
	411	__ret; \
	412	})
	413
fdb5c453 SY	414	int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	415	enum bpf_prog_type ptype, struct bpf_prog *prog);
	416	int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	417	enum bpf_prog_type ptype);
af6eea57	418	int cgroup_bpf_link_attach(const union bpf_attr attr, struct bpf_prog prog);
fdb5c453 SY	419	int cgroup_bpf_prog_query(const union bpf_attr *attr,
fdb5c453 SY	420	union bpf_attr __user *uattr);
30070984 DM	421	#else
30070984 DM	422
fdb5c453	423	struct bpf_prog;
30070984	424	struct cgroup_bpf {};
324bda9e	425	static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
4bfc0bb2	426	static inline void cgroup_bpf_offline(struct cgroup *cgrp) {}
30070984	427
fdb5c453 SY	428	static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	429	enum bpf_prog_type ptype,
	430	struct bpf_prog *prog)
	431	{
	432	return -EINVAL;
	433	}
	434
	435	static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	436	enum bpf_prog_type ptype)
	437	{
	438	return -EINVAL;
	439	}
	440
af6eea57 AN	441	static inline int cgroup_bpf_link_attach(const union bpf_attr *attr,
	442	struct bpf_prog *prog)
	443	{
	444	return -EINVAL;
	445	}
	446
fdb5c453 SY	447	static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
	448	union bpf_attr __user *uattr)
	449	{
	450	return -EINVAL;
	451	}
	452
6280f200 YS	453	static inline int bpf_cgroup_storage_set(
	454	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) { return 0; }
	455	static inline void bpf_cgroup_storage_unset(void) {}
e4730423	456	static inline int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux,
de9cbbaa	457	struct bpf_map *map) { return 0; }
de9cbbaa	458	static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
71b91a50	459	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
de9cbbaa RG	460	static inline void bpf_cgroup_storage_free(
de9cbbaa RG	461	struct bpf_cgroup_storage *storage) {}
b741f163 RG	462	static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key,
	463	void *value) {
	464	return 0;
	465	}
	466	static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
	467	void key, void value, u64 flags) {
	468	return 0;
	469	}
de9cbbaa	470
13193b0f	471	#define cgroup_bpf_enabled (0)
1b66d253	472	#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx) ({ 0; })
d74bad4e	473	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
30070984 DM	474	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
30070984 DM	475	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
61023658	476	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
f5836749	477	#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; })
427167c0 SF	478	#define BPF_CGROUP_RUN_PROG_INET4_BIND_LOCK(sk, uaddr) ({ 0; })
427167c0 SF	479	#define BPF_CGROUP_RUN_PROG_INET6_BIND_LOCK(sk, uaddr) ({ 0; })
aac3fc32 AI	480	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
aac3fc32 AI	481	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
d74bad4e AI	482	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
	483	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
	484	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
	485	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
1cedee13 AI	486	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
1cedee13 AI	487	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
983695fa DB	488	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
983695fa DB	489	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
40304b2a	490	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
ebc614f6	491	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
32927393	492	#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })
0d01da6a SF	493	#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) ({ 0; })
	494	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, \
	495	optlen, max_optlen, retval) ({ retval; })
	496	#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
	497	kernel_optval) ({ 0; })
30070984	498
8bad74f9 RG	499	#define for_each_cgroup_storage_type(stype) for (; false; )
8bad74f9 RG	500
30070984 DM	501	#endif /* CONFIG_CGROUP_BPF */
	502
	503	#endif /* _BPF_CGROUP_H */