[linux-block.git] / include / linux / bpf-cgroup.h

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _BPF_CGROUP_H
#define _BPF_CGROUP_H

#include <linux/bpf.h>
#include <linux/bpf-cgroup-defs.h>
#include <linux/errno.h>
#include <linux/jump_label.h>
#include <linux/percpu.h>
#include <linux/rbtree.h>
#include <net/sock.h>
#include <uapi/linux/bpf.h>

struct sock;
struct sockaddr;
struct cgroup;
struct sk_buff;
struct bpf_map;
struct bpf_prog;
struct bpf_sock_ops_kern;
struct bpf_cgroup_storage;
struct ctl_table;
struct ctl_table_header;
struct task_struct;

unsigned int __cgroup_bpf_run_lsm_sock(const void *ctx,
				       const struct bpf_insn *insn);
unsigned int __cgroup_bpf_run_lsm_socket(const void *ctx,
					 const struct bpf_insn *insn);
unsigned int __cgroup_bpf_run_lsm_current(const void *ctx,
					  const struct bpf_insn *insn);

#ifdef CONFIG_CGROUP_BPF

#define CGROUP_ATYPE(type) \
	case BPF_##type: return type

static inline enum cgroup_bpf_attach_type
to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type)
{
	switch (attach_type) {
	CGROUP_ATYPE(CGROUP_INET_INGRESS);
	CGROUP_ATYPE(CGROUP_INET_EGRESS);
	CGROUP_ATYPE(CGROUP_INET_SOCK_CREATE);
	CGROUP_ATYPE(CGROUP_SOCK_OPS);
	CGROUP_ATYPE(CGROUP_DEVICE);
	CGROUP_ATYPE(CGROUP_INET4_BIND);
	CGROUP_ATYPE(CGROUP_INET6_BIND);
	CGROUP_ATYPE(CGROUP_INET4_CONNECT);
	CGROUP_ATYPE(CGROUP_INET6_CONNECT);
	CGROUP_ATYPE(CGROUP_INET4_POST_BIND);
	CGROUP_ATYPE(CGROUP_INET6_POST_BIND);
	CGROUP_ATYPE(CGROUP_UDP4_SENDMSG);
	CGROUP_ATYPE(CGROUP_UDP6_SENDMSG);
	CGROUP_ATYPE(CGROUP_SYSCTL);
	CGROUP_ATYPE(CGROUP_UDP4_RECVMSG);
	CGROUP_ATYPE(CGROUP_UDP6_RECVMSG);
	CGROUP_ATYPE(CGROUP_GETSOCKOPT);
	CGROUP_ATYPE(CGROUP_SETSOCKOPT);
	CGROUP_ATYPE(CGROUP_INET4_GETPEERNAME);
	CGROUP_ATYPE(CGROUP_INET6_GETPEERNAME);
	CGROUP_ATYPE(CGROUP_INET4_GETSOCKNAME);
	CGROUP_ATYPE(CGROUP_INET6_GETSOCKNAME);
	CGROUP_ATYPE(CGROUP_INET_SOCK_RELEASE);
	default:
		return CGROUP_BPF_ATTACH_TYPE_INVALID;
	}
}

#undef CGROUP_ATYPE

extern struct static_key_false cgroup_bpf_enabled_key[MAX_CGROUP_BPF_ATTACH_TYPE];
#define cgroup_bpf_enabled(atype) static_branch_unlikely(&cgroup_bpf_enabled_key[atype])

#define for_each_cgroup_storage_type(stype) \
	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)

struct bpf_cgroup_storage_map;

struct bpf_storage_buffer {
	struct rcu_head rcu;
	char data[];
};

struct bpf_cgroup_storage {
	union {
		struct bpf_storage_buffer *buf;
		void __percpu *percpu_buf;
	};
	struct bpf_cgroup_storage_map *map;
	struct bpf_cgroup_storage_key key;
	struct list_head list_map;
	struct list_head list_cg;
	struct rb_node node;
	struct rcu_head rcu;
};

struct bpf_cgroup_link {
	struct bpf_link link;
	struct cgroup *cgroup;
	enum bpf_attach_type type;
};

struct bpf_prog_list {
	struct hlist_node node;
	struct bpf_prog *prog;
	struct bpf_cgroup_link *link;
	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
};

int cgroup_bpf_inherit(struct cgroup *cgrp);
void cgroup_bpf_offline(struct cgroup *cgrp);

int __cgroup_bpf_run_filter_skb(struct sock *sk,
				struct sk_buff *skb,
				enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_sk(struct sock *sk,
			       enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
				      struct sockaddr *uaddr,
				      enum cgroup_bpf_attach_type atype,
				      void *t_ctx,
				      u32 *flags);

int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
				     struct bpf_sock_ops_kern *sock_ops,
				     enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
				      short access, enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
				   struct ctl_table *table, int write,
				   char **buf, size_t *pcount, loff_t *ppos,
				   enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_setsockopt(struct sock *sock, int *level,
				       int *optname, char __user *optval,
				       int *optlen, char **kernel_optval);
int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
				       int optname, char __user *optval,
				       int __user *optlen, int max_optlen,
				       int retval);

int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
					    int optname, void *optval,
					    int *optlen, int retval);

static inline enum bpf_cgroup_storage_type cgroup_storage_type(
	struct bpf_map *map)
{
	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
		return BPF_CGROUP_STORAGE_PERCPU;

	return BPF_CGROUP_STORAGE_SHARED;
}

struct bpf_cgroup_storage *
cgroup_storage_lookup(struct bpf_cgroup_storage_map *map,
		      void *key, bool locked);
struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog,
					enum bpf_cgroup_storage_type stype);
void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
			     struct cgroup *cgroup,
			     enum bpf_attach_type type);
void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *map);

int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key, void *value);
int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key,
				     void *value, u64 flags);

/* Opportunistic check to see whether we have any BPF program attached*/
static inline bool cgroup_bpf_sock_enabled(struct sock *sk,
					   enum cgroup_bpf_attach_type type)
{
	struct cgroup *cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
	struct bpf_prog_array *array;

	array = rcu_access_pointer(cgrp->bpf.effective[type]);
	return array != &bpf_empty_prog_array.hdr;
}

/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb)			      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled(CGROUP_INET_INGRESS) &&			      \
	    cgroup_bpf_sock_enabled(sk, CGROUP_INET_INGRESS))		      \
		__ret = __cgroup_bpf_run_filter_skb(sk, skb,		      \
						    CGROUP_INET_INGRESS); \
									      \
	__ret;								      \
})

#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_INET_EGRESS) && sk && sk == skb->sk) { \
		typeof(sk) __sk = sk_to_full_sk(sk);			       \
		if (sk_fullsock(__sk) &&				       \
		    cgroup_bpf_sock_enabled(__sk, CGROUP_INET_EGRESS))	       \
			__ret = __cgroup_bpf_run_filter_skb(__sk, skb,	       \
						      CGROUP_INET_EGRESS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SK_PROG(sk, atype)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype)) {					       \
		__ret = __cgroup_bpf_run_filter_sk(sk, atype);		       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_CREATE)

#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk)			       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_RELEASE)

#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET4_POST_BIND)

#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET6_POST_BIND)

#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype))					       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype,     \
							  NULL, NULL);	       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx)		       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype))	{				       \
		lock_sock(sk);						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype,     \
							  t_ctx, NULL);	       \
		release_sock(sk);					       \
	}								       \
	__ret;								       \
})

/* BPF_CGROUP_INET4_BIND and BPF_CGROUP_INET6_BIND can return extra flags
 * via upper bits of return code. The only flag that is supported
 * (at bit position 0) is to indicate CAP_NET_BIND_SERVICE capability check
 * should be bypassed (BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE).
 */
#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, bind_flags)	       \
({									       \
	u32 __flags = 0;						       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype))	{				       \
		lock_sock(sk);						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype,     \
							  NULL, &__flags);     \
		release_sock(sk);					       \
		if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE)	       \
			*bind_flags |= BIND_NO_CAP_NET_BIND_SERVICE;	       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk)				       \
	((cgroup_bpf_enabled(CGROUP_INET4_CONNECT) ||		       \
	  cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) &&		       \
	 (sk)->sk_prot->pre_connect)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET4_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET6_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET4_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET6_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_RECVMSG, NULL)

#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_RECVMSG, NULL)

/* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a
 * fullsock and its parent fullsock cannot be traced by
 * sk_to_full_sk().
 *
 * e.g. sock_ops->sk is a request_sock and it is under syncookie mode.
 * Its listener-sk is not attached to the rsk_listener.
 * In this case, the caller holds the listener-sk (unlocked),
 * set its sock_ops->sk to req_sk, and call this SOCK_OPS"_SK" with
 * the listener-sk such that the cgroup-bpf-progs of the
 * listener-sk will be run.
 *
 * Regardless of syncookie mode or not,
 * calling bpf_setsockopt on listener-sk will not make sense anyway,
 * so passing 'sock_ops->sk == req_sk' to the bpf prog is appropriate here.
 */
#define BPF_CGROUP_RUN_PROG_SOCK_OPS_SK(sock_ops, sk)			\
({									\
	int __ret = 0;							\
	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS))			\
		__ret = __cgroup_bpf_run_filter_sock_ops(sk,		\
							 sock_ops,	\
							 CGROUP_SOCK_OPS); \
	__ret;								\
})

#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS) && (sock_ops)->sk) {       \
		typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk);	       \
		if (__sk && sk_fullsock(__sk))				       \
			__ret = __cgroup_bpf_run_filter_sock_ops(__sk,	       \
								 sock_ops,     \
							 CGROUP_SOCK_OPS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access)	      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled(CGROUP_DEVICE))			      \
		__ret = __cgroup_bpf_check_dev_permission(atype, major, minor, \
							  access,	      \
							  CGROUP_DEVICE); \
									      \
	__ret;								      \
})


#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos)  \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_SYSCTL))			       \
		__ret = __cgroup_bpf_run_filter_sysctl(head, table, write,     \
						       buf, count, pos,        \
						       CGROUP_SYSCTL);     \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen,   \
				       kernel_optval)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_SETSOCKOPT) &&			       \
	    cgroup_bpf_sock_enabled(sock, CGROUP_SETSOCKOPT))		       \
		__ret = __cgroup_bpf_run_filter_setsockopt(sock, level,	       \
							   optname, optval,    \
							   optlen,	       \
							   kernel_optval);     \
	__ret;								       \
})

#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT))			       \
		get_user(__ret, optlen);				       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, optlen,   \
				       max_optlen, retval)		       \
({									       \
	int __ret = retval;						       \
	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT) &&			       \
	    cgroup_bpf_sock_enabled(sock, CGROUP_GETSOCKOPT))		       \
		if (!(sock)->sk_prot->bpf_bypass_getsockopt ||		       \
		    !INDIRECT_CALL_INET_1((sock)->sk_prot->bpf_bypass_getsockopt, \
					tcp_bpf_bypass_getsockopt,	       \
					level, optname))		       \
			__ret = __cgroup_bpf_run_filter_getsockopt(	       \
				sock, level, optname, optval, optlen,	       \
				max_optlen, retval);			       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval,      \
					    optlen, retval)		       \
({									       \
	int __ret = retval;						       \
	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT))			       \
		__ret = __cgroup_bpf_run_filter_getsockopt_kern(	       \
			sock, level, optname, optval, optlen, retval);	       \
	__ret;								       \
})

int cgroup_bpf_prog_attach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype, struct bpf_prog *prog);
int cgroup_bpf_prog_detach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype);
int cgroup_bpf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);
int cgroup_bpf_prog_query(const union bpf_attr *attr,
			  union bpf_attr __user *uattr);

const struct bpf_func_proto *
cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
const struct bpf_func_proto *
cgroup_current_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
#else

static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
static inline void cgroup_bpf_offline(struct cgroup *cgrp) {}

static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype,
					 struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype)
{
	return -EINVAL;
}

static inline int cgroup_bpf_link_attach(const union bpf_attr *attr,
					 struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
					union bpf_attr __user *uattr)
{
	return -EINVAL;
}

static inline const struct bpf_func_proto *
cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
	return NULL;
}

static inline const struct bpf_func_proto *
cgroup_current_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
	return NULL;
}

static inline int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux,
					    struct bpf_map *map) { return 0; }
static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
static inline void bpf_cgroup_storage_free(
	struct bpf_cgroup_storage *storage) {}
static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key,
						 void *value) {
	return 0;
}
static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
					void *key, void *value, u64 flags) {
	return 0;
}

#define cgroup_bpf_enabled(atype) (0)
#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) ({ 0; })
#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, flags) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })
#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) ({ 0; })
#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, \
				       optlen, max_optlen, retval) ({ retval; })
#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval, \
					    optlen, retval) ({ retval; })
#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
				       kernel_optval) ({ 0; })

#define for_each_cgroup_storage_type(stype) for (; false; )

#endif /* CONFIG_CGROUP_BPF */

#endif /* _BPF_CGROUP_H */
Commit	Line	Data
b2441318	1	/* SPDX-License-Identifier: GPL-2.0 */
30070984 DM	2	#ifndef _BPF_CGROUP_H
	3	#define _BPF_CGROUP_H
	4
8bad74f9	5	#include <linux/bpf.h>
fd1740b6	6	#include <linux/bpf-cgroup-defs.h>
f292b87d	7	#include <linux/errno.h>
30070984	8	#include <linux/jump_label.h>
aa0ad5b0	9	#include <linux/percpu.h>
de9cbbaa	10	#include <linux/rbtree.h>
46531a30	11	#include <net/sock.h>
30070984 DM	12	#include <uapi/linux/bpf.h>
	13
	14	struct sock;
4fbac77d	15	struct sockaddr;
30070984 DM	16	struct cgroup;
30070984 DM	17	struct sk_buff;
de9cbbaa RG	18	struct bpf_map;
de9cbbaa RG	19	struct bpf_prog;
40304b2a	20	struct bpf_sock_ops_kern;
de9cbbaa	21	struct bpf_cgroup_storage;
7b146ceb AI	22	struct ctl_table;
7b146ceb AI	23	struct ctl_table_header;
b910eaaa	24	struct task_struct;
30070984	25
69fd337a SF	26	unsigned int __cgroup_bpf_run_lsm_sock(const void *ctx,
	27	const struct bpf_insn *insn);
	28	unsigned int __cgroup_bpf_run_lsm_socket(const void *ctx,
	29	const struct bpf_insn *insn);
	30	unsigned int __cgroup_bpf_run_lsm_current(const void *ctx,
	31	const struct bpf_insn *insn);
	32
30070984	33	#ifdef CONFIG_CGROUP_BPF
6fc88c35 DM	34
	35	#define CGROUP_ATYPE(type) \
	36	case BPF_##type: return type
	37
	38	static inline enum cgroup_bpf_attach_type
	39	to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type)
	40	{
	41	switch (attach_type) {
	42	CGROUP_ATYPE(CGROUP_INET_INGRESS);
	43	CGROUP_ATYPE(CGROUP_INET_EGRESS);
	44	CGROUP_ATYPE(CGROUP_INET_SOCK_CREATE);
	45	CGROUP_ATYPE(CGROUP_SOCK_OPS);
	46	CGROUP_ATYPE(CGROUP_DEVICE);
	47	CGROUP_ATYPE(CGROUP_INET4_BIND);
	48	CGROUP_ATYPE(CGROUP_INET6_BIND);
	49	CGROUP_ATYPE(CGROUP_INET4_CONNECT);
	50	CGROUP_ATYPE(CGROUP_INET6_CONNECT);
	51	CGROUP_ATYPE(CGROUP_INET4_POST_BIND);
	52	CGROUP_ATYPE(CGROUP_INET6_POST_BIND);
	53	CGROUP_ATYPE(CGROUP_UDP4_SENDMSG);
	54	CGROUP_ATYPE(CGROUP_UDP6_SENDMSG);
	55	CGROUP_ATYPE(CGROUP_SYSCTL);
	56	CGROUP_ATYPE(CGROUP_UDP4_RECVMSG);
	57	CGROUP_ATYPE(CGROUP_UDP6_RECVMSG);
	58	CGROUP_ATYPE(CGROUP_GETSOCKOPT);
	59	CGROUP_ATYPE(CGROUP_SETSOCKOPT);
	60	CGROUP_ATYPE(CGROUP_INET4_GETPEERNAME);
	61	CGROUP_ATYPE(CGROUP_INET6_GETPEERNAME);
	62	CGROUP_ATYPE(CGROUP_INET4_GETSOCKNAME);
	63	CGROUP_ATYPE(CGROUP_INET6_GETSOCKNAME);
	64	CGROUP_ATYPE(CGROUP_INET_SOCK_RELEASE);
	65	default:
	66	return CGROUP_BPF_ATTACH_TYPE_INVALID;
	67	}
	68	}
	69
	70	#undef CGROUP_ATYPE
30070984	71
6fc88c35 DM	72	extern struct static_key_false cgroup_bpf_enabled_key[MAX_CGROUP_BPF_ATTACH_TYPE];
6fc88c35 DM	73	#define cgroup_bpf_enabled(atype) static_branch_unlikely(&cgroup_bpf_enabled_key[atype])
30070984	74
8bad74f9 RG	75	#define for_each_cgroup_storage_type(stype) \
8bad74f9 RG	76	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)
aa0ad5b0	77
de9cbbaa RG	78	struct bpf_cgroup_storage_map;
	79
	80	struct bpf_storage_buffer {
	81	struct rcu_head rcu;
d7f10df8	82	char data[];
de9cbbaa RG	83	};
	84
	85	struct bpf_cgroup_storage {
b741f163 RG	86	union {
	87	struct bpf_storage_buffer *buf;
	88	void __percpu *percpu_buf;
	89	};
de9cbbaa RG	90	struct bpf_cgroup_storage_map *map;
de9cbbaa RG	91	struct bpf_cgroup_storage_key key;
7d9c3427 YZ	92	struct list_head list_map;
7d9c3427 YZ	93	struct list_head list_cg;
de9cbbaa RG	94	struct rb_node node;
	95	struct rcu_head rcu;
	96	};
	97
af6eea57 AN	98	struct bpf_cgroup_link {
	99	struct bpf_link link;
	100	struct cgroup *cgroup;
	101	enum bpf_attach_type type;
	102	};
	103
324bda9e	104	struct bpf_prog_list {
00442143	105	struct hlist_node node;
324bda9e	106	struct bpf_prog *prog;
af6eea57	107	struct bpf_cgroup_link *link;
8bad74f9	108	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
324bda9e AS	109	};
324bda9e AS	110
324bda9e	111	int cgroup_bpf_inherit(struct cgroup *cgrp);
4bfc0bb2	112	void cgroup_bpf_offline(struct cgroup *cgrp);
30070984	113
b2cd1257 DA	114	int __cgroup_bpf_run_filter_skb(struct sock *sk,
b2cd1257 DA	115	struct sk_buff *skb,
6fc88c35	116	enum cgroup_bpf_attach_type atype);
b2cd1257	117
61023658	118	int __cgroup_bpf_run_filter_sk(struct sock *sk,
6fc88c35	119	enum cgroup_bpf_attach_type atype);
61023658	120
4fbac77d AI	121	int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
4fbac77d AI	122	struct sockaddr *uaddr,
6fc88c35	123	enum cgroup_bpf_attach_type atype,
77241217 SF	124	void *t_ctx,
77241217 SF	125	u32 *flags);
4fbac77d	126
40304b2a LB	127	int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
40304b2a LB	128	struct bpf_sock_ops_kern *sock_ops,
6fc88c35	129	enum cgroup_bpf_attach_type atype);
40304b2a	130
ebc614f6	131	int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
6fc88c35	132	short access, enum cgroup_bpf_attach_type atype);
ebc614f6	133
7b146ceb AI	134	int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
7b146ceb AI	135	struct ctl_table *table, int write,
4bd6a735	136	char *buf, size_t pcount, loff_t *ppos,
6fc88c35	137	enum cgroup_bpf_attach_type atype);
7b146ceb	138
0d01da6a SF	139	int __cgroup_bpf_run_filter_setsockopt(struct sock sock, int level,
	140	int optname, char __user optval,
	141	int optlen, char *kernel_optval);
	142	int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
	143	int optname, char __user *optval,
	144	int __user *optlen, int max_optlen,
	145	int retval);
	146
9cacf81f SF	147	int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
	148	int optname, void *optval,
	149	int *optlen, int retval);
	150
8bad74f9 RG	151	static inline enum bpf_cgroup_storage_type cgroup_storage_type(
8bad74f9 RG	152	struct bpf_map *map)
aa0ad5b0	153	{
b741f163 RG	154	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
	155	return BPF_CGROUP_STORAGE_PERCPU;
	156
8bad74f9 RG	157	return BPF_CGROUP_STORAGE_SHARED;
	158	}
	159
7d9c3427 YZ	160	struct bpf_cgroup_storage *
	161	cgroup_storage_lookup(struct bpf_cgroup_storage_map *map,
	162	void *key, bool locked);
8bad74f9 RG	163	struct bpf_cgroup_storage bpf_cgroup_storage_alloc(struct bpf_prog prog,
8bad74f9 RG	164	enum bpf_cgroup_storage_type stype);
de9cbbaa RG	165	void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
	166	void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
	167	struct cgroup *cgroup,
	168	enum bpf_attach_type type);
	169	void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
e4730423	170	int bpf_cgroup_storage_assign(struct bpf_prog_aux aux, struct bpf_map map);
de9cbbaa	171
b741f163 RG	172	int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key, void *value);
	173	int bpf_percpu_cgroup_storage_update(struct bpf_map map, void key,
	174	void *value, u64 flags);
	175
46531a30 PB	176	/* Opportunistic check to see whether we have any BPF program attached*/
	177	static inline bool cgroup_bpf_sock_enabled(struct sock *sk,
	178	enum cgroup_bpf_attach_type type)
	179	{
	180	struct cgroup *cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
	181	struct bpf_prog_array *array;
	182
	183	array = rcu_access_pointer(cgrp->bpf.effective[type]);
	184	return array != &bpf_empty_prog_array.hdr;
	185	}
	186
b2cd1257 DA	187	/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
	188	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \
	189	({ \
	190	int __ret = 0; \
46531a30 PB	191	if (cgroup_bpf_enabled(CGROUP_INET_INGRESS) && \
46531a30 PB	192	cgroup_bpf_sock_enabled(sk, CGROUP_INET_INGRESS)) \
b2cd1257	193	__ret = __cgroup_bpf_run_filter_skb(sk, skb, \
6fc88c35	194	CGROUP_INET_INGRESS); \
b2cd1257 DA	195	\
b2cd1257 DA	196	__ret; \
30070984 DM	197	})
30070984 DM	198
b2cd1257 DA	199	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb) \
	200	({ \
	201	int __ret = 0; \
6fc88c35	202	if (cgroup_bpf_enabled(CGROUP_INET_EGRESS) && sk && sk == skb->sk) { \
b2cd1257	203	typeof(sk) __sk = sk_to_full_sk(sk); \
46531a30 PB	204	if (sk_fullsock(__sk) && \
46531a30 PB	205	cgroup_bpf_sock_enabled(__sk, CGROUP_INET_EGRESS)) \
b2cd1257	206	__ret = __cgroup_bpf_run_filter_skb(__sk, skb, \
6fc88c35	207	CGROUP_INET_EGRESS); \
b2cd1257 DA	208	} \
b2cd1257 DA	209	__ret; \
30070984 DM	210	})
30070984 DM	211
6fc88c35	212	#define BPF_CGROUP_RUN_SK_PROG(sk, atype) \
61023658 DA	213	({ \
61023658 DA	214	int __ret = 0; \
6fc88c35 DM	215	if (cgroup_bpf_enabled(atype)) { \
6fc88c35 DM	216	__ret = __cgroup_bpf_run_filter_sk(sk, atype); \
61023658 DA	217	} \
	218	__ret; \
	219	})
	220
aac3fc32	221	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \
6fc88c35	222	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_CREATE)
aac3fc32	223
f5836749	224	#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) \
6fc88c35	225	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_RELEASE)
f5836749	226
aac3fc32	227	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \
6fc88c35	228	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET4_POST_BIND)
aac3fc32 AI	229
aac3fc32 AI	230	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) \
6fc88c35	231	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET6_POST_BIND)
aac3fc32	232
6fc88c35	233	#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) \
4fbac77d AI	234	({ \
4fbac77d AI	235	int __ret = 0; \
6fc88c35 DM	236	if (cgroup_bpf_enabled(atype)) \
6fc88c35 DM	237	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \
d9d31cf8	238	NULL, NULL); \
4fbac77d AI	239	__ret; \
	240	})
	241
6fc88c35	242	#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) \
d74bad4e AI	243	({ \
d74bad4e AI	244	int __ret = 0; \
6fc88c35	245	if (cgroup_bpf_enabled(atype)) { \
d74bad4e	246	lock_sock(sk); \
6fc88c35	247	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \
d9d31cf8	248	t_ctx, NULL); \
d74bad4e AI	249	release_sock(sk); \
	250	} \
	251	__ret; \
	252	})
	253
77241217 SF	254	/* BPF_CGROUP_INET4_BIND and BPF_CGROUP_INET6_BIND can return extra flags
	255	* via upper bits of return code. The only flag that is supported
	256	* (at bit position 0) is to indicate CAP_NET_BIND_SERVICE capability check
	257	* should be bypassed (BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE).
	258	*/
6fc88c35	259	#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, bind_flags) \
77241217 SF	260	({ \
	261	u32 __flags = 0; \
	262	int __ret = 0; \
6fc88c35	263	if (cgroup_bpf_enabled(atype)) { \
77241217	264	lock_sock(sk); \
6fc88c35	265	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \
77241217 SF	266	NULL, &__flags); \
	267	release_sock(sk); \
	268	if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE) \
	269	*bind_flags \|= BIND_NO_CAP_NET_BIND_SERVICE; \
	270	} \
	271	__ret; \
	272	})
4fbac77d	273
a9ed15da	274	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) \
6fc88c35 DM	275	((cgroup_bpf_enabled(CGROUP_INET4_CONNECT) \|\| \
6fc88c35 DM	276	cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) && \
a9ed15da	277	(sk)->sk_prot->pre_connect)
d74bad4e AI	278
d74bad4e AI	279	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) \
6fc88c35	280	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET4_CONNECT)
d74bad4e AI	281
d74bad4e AI	282	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) \
6fc88c35	283	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET6_CONNECT)
d74bad4e AI	284
d74bad4e AI	285	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) \
6fc88c35	286	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET4_CONNECT, NULL)
d74bad4e AI	287
d74bad4e AI	288	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) \
6fc88c35	289	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET6_CONNECT, NULL)
1cedee13 AI	290
1cedee13 AI	291	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) \
6fc88c35	292	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_SENDMSG, t_ctx)
1cedee13 AI	293
1cedee13 AI	294	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \
6fc88c35	295	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_SENDMSG, t_ctx)
d74bad4e	296
983695fa	297	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) \
6fc88c35	298	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_RECVMSG, NULL)
983695fa DB	299
983695fa DB	300	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) \
6fc88c35	301	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_RECVMSG, NULL)
983695fa	302
0813a841 MKL	303	/* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a
	304	* fullsock and its parent fullsock cannot be traced by
	305	* sk_to_full_sk().
	306	*
	307	* e.g. sock_ops->sk is a request_sock and it is under syncookie mode.
	308	* Its listener-sk is not attached to the rsk_listener.
	309	* In this case, the caller holds the listener-sk (unlocked),
	310	* set its sock_ops->sk to req_sk, and call this SOCK_OPS"_SK" with
	311	* the listener-sk such that the cgroup-bpf-progs of the
	312	* listener-sk will be run.
	313	*
	314	* Regardless of syncookie mode or not,
	315	* calling bpf_setsockopt on listener-sk will not make sense anyway,
	316	* so passing 'sock_ops->sk == req_sk' to the bpf prog is appropriate here.
	317	*/
	318	#define BPF_CGROUP_RUN_PROG_SOCK_OPS_SK(sock_ops, sk) \
	319	({ \
	320	int __ret = 0; \
6fc88c35	321	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS)) \
0813a841 MKL	322	__ret = __cgroup_bpf_run_filter_sock_ops(sk, \
0813a841 MKL	323	sock_ops, \
6fc88c35	324	CGROUP_SOCK_OPS); \
0813a841 MKL	325	__ret; \
	326	})
	327
40304b2a LB	328	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) \
	329	({ \
	330	int __ret = 0; \
6fc88c35	331	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS) && (sock_ops)->sk) { \
40304b2a	332	typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk); \
df39a9f1	333	if (__sk && sk_fullsock(__sk)) \
40304b2a LB	334	__ret = __cgroup_bpf_run_filter_sock_ops(__sk, \
40304b2a LB	335	sock_ops, \
6fc88c35	336	CGROUP_SOCK_OPS); \
40304b2a LB	337	} \
	338	__ret; \
	339	})
ebc614f6	340
6fc88c35	341	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) \
ebc614f6 RG	342	({ \
ebc614f6 RG	343	int __ret = 0; \
6fc88c35 DM	344	if (cgroup_bpf_enabled(CGROUP_DEVICE)) \
6fc88c35 DM	345	__ret = __cgroup_bpf_check_dev_permission(atype, major, minor, \
ebc614f6	346	access, \
6fc88c35	347	CGROUP_DEVICE); \
ebc614f6 RG	348	\
	349	__ret; \
	350	})
7b146ceb AI	351
7b146ceb AI	352
32927393	353	#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos) \
7b146ceb AI	354	({ \
7b146ceb AI	355	int __ret = 0; \
6fc88c35	356	if (cgroup_bpf_enabled(CGROUP_SYSCTL)) \
7b146ceb	357	__ret = __cgroup_bpf_run_filter_sysctl(head, table, write, \
32927393	358	buf, count, pos, \
6fc88c35	359	CGROUP_SYSCTL); \
7b146ceb AI	360	__ret; \
	361	})
	362
0d01da6a SF	363	#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
	364	kernel_optval) \
	365	({ \
	366	int __ret = 0; \
46531a30 PB	367	if (cgroup_bpf_enabled(CGROUP_SETSOCKOPT) && \
46531a30 PB	368	cgroup_bpf_sock_enabled(sock, CGROUP_SETSOCKOPT)) \
0d01da6a SF	369	__ret = __cgroup_bpf_run_filter_setsockopt(sock, level, \
	370	optname, optval, \
	371	optlen, \
	372	kernel_optval); \
	373	__ret; \
	374	})
	375
	376	#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) \
	377	({ \
	378	int __ret = 0; \
6fc88c35	379	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT)) \
0d01da6a SF	380	get_user(__ret, optlen); \
	381	__ret; \
	382	})
	383
	384	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, optlen, \
	385	max_optlen, retval) \
	386	({ \
	387	int __ret = retval; \
46531a30 PB	388	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT) && \
46531a30 PB	389	cgroup_bpf_sock_enabled(sock, CGROUP_GETSOCKOPT)) \
9cacf81f SF	390	if (!(sock)->sk_prot->bpf_bypass_getsockopt \|\| \
	391	!INDIRECT_CALL_INET_1((sock)->sk_prot->bpf_bypass_getsockopt, \
	392	tcp_bpf_bypass_getsockopt, \
	393	level, optname)) \
	394	__ret = __cgroup_bpf_run_filter_getsockopt( \
	395	sock, level, optname, optval, optlen, \
	396	max_optlen, retval); \
	397	__ret; \
	398	})
	399
	400	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval, \
	401	optlen, retval) \
	402	({ \
	403	int __ret = retval; \
6fc88c35	404	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT)) \
9cacf81f SF	405	__ret = __cgroup_bpf_run_filter_getsockopt_kern( \
9cacf81f SF	406	sock, level, optname, optval, optlen, retval); \
0d01da6a SF	407	__ret; \
	408	})
	409
fdb5c453 SY	410	int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	411	enum bpf_prog_type ptype, struct bpf_prog *prog);
	412	int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	413	enum bpf_prog_type ptype);
af6eea57	414	int cgroup_bpf_link_attach(const union bpf_attr attr, struct bpf_prog prog);
fdb5c453 SY	415	int cgroup_bpf_prog_query(const union bpf_attr *attr,
fdb5c453 SY	416	union bpf_attr __user *uattr);
dea6a4e1 SF	417
	418	const struct bpf_func_proto *
	419	cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
	420	const struct bpf_func_proto *
	421	cgroup_current_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
30070984 DM	422	#else
30070984 DM	423
324bda9e	424	static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
4bfc0bb2	425	static inline void cgroup_bpf_offline(struct cgroup *cgrp) {}
30070984	426
fdb5c453 SY	427	static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	428	enum bpf_prog_type ptype,
	429	struct bpf_prog *prog)
	430	{
	431	return -EINVAL;
	432	}
	433
	434	static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	435	enum bpf_prog_type ptype)
	436	{
	437	return -EINVAL;
	438	}
	439
af6eea57 AN	440	static inline int cgroup_bpf_link_attach(const union bpf_attr *attr,
	441	struct bpf_prog *prog)
	442	{
	443	return -EINVAL;
	444	}
	445
fdb5c453 SY	446	static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
	447	union bpf_attr __user *uattr)
	448	{
	449	return -EINVAL;
	450	}
	451
dea6a4e1 SF	452	static inline const struct bpf_func_proto *
	453	cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
	454	{
	455	return NULL;
	456	}
	457
	458	static inline const struct bpf_func_proto *
	459	cgroup_current_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
	460	{
	461	return NULL;
	462	}
	463
e4730423	464	static inline int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux,
de9cbbaa	465	struct bpf_map *map) { return 0; }
de9cbbaa	466	static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
71b91a50	467	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
de9cbbaa RG	468	static inline void bpf_cgroup_storage_free(
de9cbbaa RG	469	struct bpf_cgroup_storage *storage) {}
b741f163 RG	470	static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key,
	471	void *value) {
	472	return 0;
	473	}
	474	static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
	475	void key, void value, u64 flags) {
	476	return 0;
	477	}
de9cbbaa	478
6fc88c35 DM	479	#define cgroup_bpf_enabled(atype) (0)
6fc88c35 DM	480	#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) ({ 0; })
9dfc685e	481	#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) ({ 0; })
d74bad4e	482	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
30070984 DM	483	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
30070984 DM	484	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
61023658	485	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
f5836749	486	#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; })
6fc88c35	487	#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, flags) ({ 0; })
aac3fc32 AI	488	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
aac3fc32 AI	489	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
d74bad4e AI	490	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
	491	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
	492	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
	493	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
1cedee13 AI	494	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
1cedee13 AI	495	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
983695fa DB	496	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
983695fa DB	497	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
40304b2a	498	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
6fc88c35	499	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; })
32927393	500	#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })
0d01da6a SF	501	#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) ({ 0; })
	502	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, \
	503	optlen, max_optlen, retval) ({ retval; })
9cacf81f SF	504	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval, \
9cacf81f SF	505	optlen, retval) ({ retval; })
0d01da6a SF	506	#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
0d01da6a SF	507	kernel_optval) ({ 0; })
30070984	508
8bad74f9 RG	509	#define for_each_cgroup_storage_type(stype) for (; false; )
8bad74f9 RG	510
30070984 DM	511	#endif /* CONFIG_CGROUP_BPF */
	512
	513	#endif /* _BPF_CGROUP_H */