[linux-block.git] / include / linux / bpf-cgroup.h

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _BPF_CGROUP_H
#define _BPF_CGROUP_H

#include <linux/bpf.h>
#include <linux/bpf-cgroup-defs.h>
#include <linux/errno.h>
#include <linux/jump_label.h>
#include <linux/percpu.h>
#include <linux/rbtree.h>
#include <uapi/linux/bpf.h>

struct sock;
struct sockaddr;
struct cgroup;
struct sk_buff;
struct bpf_map;
struct bpf_prog;
struct bpf_sock_ops_kern;
struct bpf_cgroup_storage;
struct ctl_table;
struct ctl_table_header;
struct task_struct;

#ifdef CONFIG_CGROUP_BPF

#define CGROUP_ATYPE(type) \
	case BPF_##type: return type

static inline enum cgroup_bpf_attach_type
to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type)
{
	switch (attach_type) {
	CGROUP_ATYPE(CGROUP_INET_INGRESS);
	CGROUP_ATYPE(CGROUP_INET_EGRESS);
	CGROUP_ATYPE(CGROUP_INET_SOCK_CREATE);
	CGROUP_ATYPE(CGROUP_SOCK_OPS);
	CGROUP_ATYPE(CGROUP_DEVICE);
	CGROUP_ATYPE(CGROUP_INET4_BIND);
	CGROUP_ATYPE(CGROUP_INET6_BIND);
	CGROUP_ATYPE(CGROUP_INET4_CONNECT);
	CGROUP_ATYPE(CGROUP_INET6_CONNECT);
	CGROUP_ATYPE(CGROUP_INET4_POST_BIND);
	CGROUP_ATYPE(CGROUP_INET6_POST_BIND);
	CGROUP_ATYPE(CGROUP_UDP4_SENDMSG);
	CGROUP_ATYPE(CGROUP_UDP6_SENDMSG);
	CGROUP_ATYPE(CGROUP_SYSCTL);
	CGROUP_ATYPE(CGROUP_UDP4_RECVMSG);
	CGROUP_ATYPE(CGROUP_UDP6_RECVMSG);
	CGROUP_ATYPE(CGROUP_GETSOCKOPT);
	CGROUP_ATYPE(CGROUP_SETSOCKOPT);
	CGROUP_ATYPE(CGROUP_INET4_GETPEERNAME);
	CGROUP_ATYPE(CGROUP_INET6_GETPEERNAME);
	CGROUP_ATYPE(CGROUP_INET4_GETSOCKNAME);
	CGROUP_ATYPE(CGROUP_INET6_GETSOCKNAME);
	CGROUP_ATYPE(CGROUP_INET_SOCK_RELEASE);
	default:
		return CGROUP_BPF_ATTACH_TYPE_INVALID;
	}
}

#undef CGROUP_ATYPE

extern struct static_key_false cgroup_bpf_enabled_key[MAX_CGROUP_BPF_ATTACH_TYPE];
#define cgroup_bpf_enabled(atype) static_branch_unlikely(&cgroup_bpf_enabled_key[atype])

#define for_each_cgroup_storage_type(stype) \
	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)

struct bpf_cgroup_storage_map;

struct bpf_storage_buffer {
	struct rcu_head rcu;
	char data[];
};

struct bpf_cgroup_storage {
	union {
		struct bpf_storage_buffer *buf;
		void __percpu *percpu_buf;
	};
	struct bpf_cgroup_storage_map *map;
	struct bpf_cgroup_storage_key key;
	struct list_head list_map;
	struct list_head list_cg;
	struct rb_node node;
	struct rcu_head rcu;
};

struct bpf_cgroup_link {
	struct bpf_link link;
	struct cgroup *cgroup;
	enum bpf_attach_type type;
};

struct bpf_prog_list {
	struct list_head node;
	struct bpf_prog *prog;
	struct bpf_cgroup_link *link;
	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
};

int cgroup_bpf_inherit(struct cgroup *cgrp);
void cgroup_bpf_offline(struct cgroup *cgrp);

int __cgroup_bpf_run_filter_skb(struct sock *sk,
				struct sk_buff *skb,
				enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_sk(struct sock *sk,
			       enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
				      struct sockaddr *uaddr,
				      enum cgroup_bpf_attach_type atype,
				      void *t_ctx,
				      u32 *flags);

int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
				     struct bpf_sock_ops_kern *sock_ops,
				     enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
				      short access, enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
				   struct ctl_table *table, int write,
				   char **buf, size_t *pcount, loff_t *ppos,
				   enum cgroup_bpf_attach_type atype);

int __cgroup_bpf_run_filter_setsockopt(struct sock *sock, int *level,
				       int *optname, char __user *optval,
				       int *optlen, char **kernel_optval);
int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
				       int optname, char __user *optval,
				       int __user *optlen, int max_optlen,
				       int retval);

int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
					    int optname, void *optval,
					    int *optlen, int retval);

static inline enum bpf_cgroup_storage_type cgroup_storage_type(
	struct bpf_map *map)
{
	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
		return BPF_CGROUP_STORAGE_PERCPU;

	return BPF_CGROUP_STORAGE_SHARED;
}

struct bpf_cgroup_storage *
cgroup_storage_lookup(struct bpf_cgroup_storage_map *map,
		      void *key, bool locked);
struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog,
					enum bpf_cgroup_storage_type stype);
void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
			     struct cgroup *cgroup,
			     enum bpf_attach_type type);
void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *map);

int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key, void *value);
int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key,
				     void *value, u64 flags);

/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb)			      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled(CGROUP_INET_INGRESS))		      \
		__ret = __cgroup_bpf_run_filter_skb(sk, skb,		      \
						    CGROUP_INET_INGRESS); \
									      \
	__ret;								      \
})

#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_INET_EGRESS) && sk && sk == skb->sk) { \
		typeof(sk) __sk = sk_to_full_sk(sk);			       \
		if (sk_fullsock(__sk))					       \
			__ret = __cgroup_bpf_run_filter_skb(__sk, skb,	       \
						      CGROUP_INET_EGRESS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SK_PROG(sk, atype)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype)) {					       \
		__ret = __cgroup_bpf_run_filter_sk(sk, atype);		       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_CREATE)

#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk)			       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_RELEASE)

#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET4_POST_BIND)

#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk)				       \
	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET6_POST_BIND)

#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype)				       \
({									       \
	u32 __unused_flags;						       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype))					       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype,     \
							  NULL,		       \
							  &__unused_flags);    \
	__ret;								       \
})

#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx)		       \
({									       \
	u32 __unused_flags;						       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype))	{				       \
		lock_sock(sk);						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype,     \
							  t_ctx,	       \
							  &__unused_flags);    \
		release_sock(sk);					       \
	}								       \
	__ret;								       \
})

/* BPF_CGROUP_INET4_BIND and BPF_CGROUP_INET6_BIND can return extra flags
 * via upper bits of return code. The only flag that is supported
 * (at bit position 0) is to indicate CAP_NET_BIND_SERVICE capability check
 * should be bypassed (BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE).
 */
#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, bind_flags)	       \
({									       \
	u32 __flags = 0;						       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(atype))	{				       \
		lock_sock(sk);						       \
		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype,     \
							  NULL, &__flags);     \
		release_sock(sk);					       \
		if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE)	       \
			*bind_flags |= BIND_NO_CAP_NET_BIND_SERVICE;	       \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk)				       \
	((cgroup_bpf_enabled(CGROUP_INET4_CONNECT) ||		       \
	  cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) &&		       \
	 (sk)->sk_prot->pre_connect)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET4_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr)			       \
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET6_CONNECT)

#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET4_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET6_CONNECT, NULL)

#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_SENDMSG, t_ctx)

#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_RECVMSG, NULL)

#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr)			\
	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_RECVMSG, NULL)

/* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a
 * fullsock and its parent fullsock cannot be traced by
 * sk_to_full_sk().
 *
 * e.g. sock_ops->sk is a request_sock and it is under syncookie mode.
 * Its listener-sk is not attached to the rsk_listener.
 * In this case, the caller holds the listener-sk (unlocked),
 * set its sock_ops->sk to req_sk, and call this SOCK_OPS"_SK" with
 * the listener-sk such that the cgroup-bpf-progs of the
 * listener-sk will be run.
 *
 * Regardless of syncookie mode or not,
 * calling bpf_setsockopt on listener-sk will not make sense anyway,
 * so passing 'sock_ops->sk == req_sk' to the bpf prog is appropriate here.
 */
#define BPF_CGROUP_RUN_PROG_SOCK_OPS_SK(sock_ops, sk)			\
({									\
	int __ret = 0;							\
	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS))			\
		__ret = __cgroup_bpf_run_filter_sock_ops(sk,		\
							 sock_ops,	\
							 CGROUP_SOCK_OPS); \
	__ret;								\
})

#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)				       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS) && (sock_ops)->sk) {       \
		typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk);	       \
		if (__sk && sk_fullsock(__sk))				       \
			__ret = __cgroup_bpf_run_filter_sock_ops(__sk,	       \
								 sock_ops,     \
							 CGROUP_SOCK_OPS); \
	}								       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access)	      \
({									      \
	int __ret = 0;							      \
	if (cgroup_bpf_enabled(CGROUP_DEVICE))			      \
		__ret = __cgroup_bpf_check_dev_permission(atype, major, minor, \
							  access,	      \
							  CGROUP_DEVICE); \
									      \
	__ret;								      \
})


#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos)  \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_SYSCTL))			       \
		__ret = __cgroup_bpf_run_filter_sysctl(head, table, write,     \
						       buf, count, pos,        \
						       CGROUP_SYSCTL);     \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen,   \
				       kernel_optval)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_SETSOCKOPT))			       \
		__ret = __cgroup_bpf_run_filter_setsockopt(sock, level,	       \
							   optname, optval,    \
							   optlen,	       \
							   kernel_optval);     \
	__ret;								       \
})

#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen)			       \
({									       \
	int __ret = 0;							       \
	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT))			       \
		get_user(__ret, optlen);				       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, optlen,   \
				       max_optlen, retval)		       \
({									       \
	int __ret = retval;						       \
	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT))			       \
		if (!(sock)->sk_prot->bpf_bypass_getsockopt ||		       \
		    !INDIRECT_CALL_INET_1((sock)->sk_prot->bpf_bypass_getsockopt, \
					tcp_bpf_bypass_getsockopt,	       \
					level, optname))		       \
			__ret = __cgroup_bpf_run_filter_getsockopt(	       \
				sock, level, optname, optval, optlen,	       \
				max_optlen, retval);			       \
	__ret;								       \
})

#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval,      \
					    optlen, retval)		       \
({									       \
	int __ret = retval;						       \
	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT))			       \
		__ret = __cgroup_bpf_run_filter_getsockopt_kern(	       \
			sock, level, optname, optval, optlen, retval);	       \
	__ret;								       \
})

int cgroup_bpf_prog_attach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype, struct bpf_prog *prog);
int cgroup_bpf_prog_detach(const union bpf_attr *attr,
			   enum bpf_prog_type ptype);
int cgroup_bpf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);
int cgroup_bpf_prog_query(const union bpf_attr *attr,
			  union bpf_attr __user *uattr);
#else

static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
static inline void cgroup_bpf_offline(struct cgroup *cgrp) {}

static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype,
					 struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
					 enum bpf_prog_type ptype)
{
	return -EINVAL;
}

static inline int cgroup_bpf_link_attach(const union bpf_attr *attr,
					 struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
					union bpf_attr __user *uattr)
{
	return -EINVAL;
}

static inline int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux,
					    struct bpf_map *map) { return 0; }
static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
static inline void bpf_cgroup_storage_free(
	struct bpf_cgroup_storage *storage) {}
static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key,
						 void *value) {
	return 0;
}
static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
					void *key, void *value, u64 flags) {
	return 0;
}

#define cgroup_bpf_enabled(atype) (0)
#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) ({ 0; })
#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, flags) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; })
#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })
#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) ({ 0; })
#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, \
				       optlen, max_optlen, retval) ({ retval; })
#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval, \
					    optlen, retval) ({ retval; })
#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
				       kernel_optval) ({ 0; })

#define for_each_cgroup_storage_type(stype) for (; false; )

#endif /* CONFIG_CGROUP_BPF */

#endif /* _BPF_CGROUP_H */
Commit	Line	Data
b2441318	1	/* SPDX-License-Identifier: GPL-2.0 */
30070984 DM	2	#ifndef _BPF_CGROUP_H
	3	#define _BPF_CGROUP_H
	4
8bad74f9	5	#include <linux/bpf.h>
fd1740b6	6	#include <linux/bpf-cgroup-defs.h>
f292b87d	7	#include <linux/errno.h>
30070984	8	#include <linux/jump_label.h>
aa0ad5b0	9	#include <linux/percpu.h>
de9cbbaa	10	#include <linux/rbtree.h>
30070984 DM	11	#include <uapi/linux/bpf.h>
	12
	13	struct sock;
4fbac77d	14	struct sockaddr;
30070984 DM	15	struct cgroup;
30070984 DM	16	struct sk_buff;
de9cbbaa RG	17	struct bpf_map;
de9cbbaa RG	18	struct bpf_prog;
40304b2a	19	struct bpf_sock_ops_kern;
de9cbbaa	20	struct bpf_cgroup_storage;
7b146ceb AI	21	struct ctl_table;
7b146ceb AI	22	struct ctl_table_header;
b910eaaa	23	struct task_struct;
30070984 DM	24
30070984 DM	25	#ifdef CONFIG_CGROUP_BPF
6fc88c35 DM	26
	27	#define CGROUP_ATYPE(type) \
	28	case BPF_##type: return type
	29
	30	static inline enum cgroup_bpf_attach_type
	31	to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type)
	32	{
	33	switch (attach_type) {
	34	CGROUP_ATYPE(CGROUP_INET_INGRESS);
	35	CGROUP_ATYPE(CGROUP_INET_EGRESS);
	36	CGROUP_ATYPE(CGROUP_INET_SOCK_CREATE);
	37	CGROUP_ATYPE(CGROUP_SOCK_OPS);
	38	CGROUP_ATYPE(CGROUP_DEVICE);
	39	CGROUP_ATYPE(CGROUP_INET4_BIND);
	40	CGROUP_ATYPE(CGROUP_INET6_BIND);
	41	CGROUP_ATYPE(CGROUP_INET4_CONNECT);
	42	CGROUP_ATYPE(CGROUP_INET6_CONNECT);
	43	CGROUP_ATYPE(CGROUP_INET4_POST_BIND);
	44	CGROUP_ATYPE(CGROUP_INET6_POST_BIND);
	45	CGROUP_ATYPE(CGROUP_UDP4_SENDMSG);
	46	CGROUP_ATYPE(CGROUP_UDP6_SENDMSG);
	47	CGROUP_ATYPE(CGROUP_SYSCTL);
	48	CGROUP_ATYPE(CGROUP_UDP4_RECVMSG);
	49	CGROUP_ATYPE(CGROUP_UDP6_RECVMSG);
	50	CGROUP_ATYPE(CGROUP_GETSOCKOPT);
	51	CGROUP_ATYPE(CGROUP_SETSOCKOPT);
	52	CGROUP_ATYPE(CGROUP_INET4_GETPEERNAME);
	53	CGROUP_ATYPE(CGROUP_INET6_GETPEERNAME);
	54	CGROUP_ATYPE(CGROUP_INET4_GETSOCKNAME);
	55	CGROUP_ATYPE(CGROUP_INET6_GETSOCKNAME);
	56	CGROUP_ATYPE(CGROUP_INET_SOCK_RELEASE);
	57	default:
	58	return CGROUP_BPF_ATTACH_TYPE_INVALID;
	59	}
	60	}
	61
	62	#undef CGROUP_ATYPE
30070984	63
6fc88c35 DM	64	extern struct static_key_false cgroup_bpf_enabled_key[MAX_CGROUP_BPF_ATTACH_TYPE];
6fc88c35 DM	65	#define cgroup_bpf_enabled(atype) static_branch_unlikely(&cgroup_bpf_enabled_key[atype])
30070984	66
8bad74f9 RG	67	#define for_each_cgroup_storage_type(stype) \
8bad74f9 RG	68	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)
aa0ad5b0	69
de9cbbaa RG	70	struct bpf_cgroup_storage_map;
	71
	72	struct bpf_storage_buffer {
	73	struct rcu_head rcu;
d7f10df8	74	char data[];
de9cbbaa RG	75	};
	76
	77	struct bpf_cgroup_storage {
b741f163 RG	78	union {
	79	struct bpf_storage_buffer *buf;
	80	void __percpu *percpu_buf;
	81	};
de9cbbaa RG	82	struct bpf_cgroup_storage_map *map;
de9cbbaa RG	83	struct bpf_cgroup_storage_key key;
7d9c3427 YZ	84	struct list_head list_map;
7d9c3427 YZ	85	struct list_head list_cg;
de9cbbaa RG	86	struct rb_node node;
	87	struct rcu_head rcu;
	88	};
	89
af6eea57 AN	90	struct bpf_cgroup_link {
	91	struct bpf_link link;
	92	struct cgroup *cgroup;
	93	enum bpf_attach_type type;
	94	};
	95
324bda9e AS	96	struct bpf_prog_list {
	97	struct list_head node;
	98	struct bpf_prog *prog;
af6eea57	99	struct bpf_cgroup_link *link;
8bad74f9	100	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
324bda9e AS	101	};
324bda9e AS	102
324bda9e	103	int cgroup_bpf_inherit(struct cgroup *cgrp);
4bfc0bb2	104	void cgroup_bpf_offline(struct cgroup *cgrp);
30070984	105
b2cd1257 DA	106	int __cgroup_bpf_run_filter_skb(struct sock *sk,
b2cd1257 DA	107	struct sk_buff *skb,
6fc88c35	108	enum cgroup_bpf_attach_type atype);
b2cd1257	109
61023658	110	int __cgroup_bpf_run_filter_sk(struct sock *sk,
6fc88c35	111	enum cgroup_bpf_attach_type atype);
61023658	112
4fbac77d AI	113	int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
4fbac77d AI	114	struct sockaddr *uaddr,
6fc88c35	115	enum cgroup_bpf_attach_type atype,
77241217 SF	116	void *t_ctx,
77241217 SF	117	u32 *flags);
4fbac77d	118
40304b2a LB	119	int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
40304b2a LB	120	struct bpf_sock_ops_kern *sock_ops,
6fc88c35	121	enum cgroup_bpf_attach_type atype);
40304b2a	122
ebc614f6	123	int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
6fc88c35	124	short access, enum cgroup_bpf_attach_type atype);
ebc614f6	125
7b146ceb AI	126	int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
7b146ceb AI	127	struct ctl_table *table, int write,
4bd6a735	128	char *buf, size_t pcount, loff_t *ppos,
6fc88c35	129	enum cgroup_bpf_attach_type atype);
7b146ceb	130
0d01da6a SF	131	int __cgroup_bpf_run_filter_setsockopt(struct sock sock, int level,
	132	int optname, char __user optval,
	133	int optlen, char *kernel_optval);
	134	int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
	135	int optname, char __user *optval,
	136	int __user *optlen, int max_optlen,
	137	int retval);
	138
9cacf81f SF	139	int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
	140	int optname, void *optval,
	141	int *optlen, int retval);
	142
8bad74f9 RG	143	static inline enum bpf_cgroup_storage_type cgroup_storage_type(
8bad74f9 RG	144	struct bpf_map *map)
aa0ad5b0	145	{
b741f163 RG	146	if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
	147	return BPF_CGROUP_STORAGE_PERCPU;
	148
8bad74f9 RG	149	return BPF_CGROUP_STORAGE_SHARED;
	150	}
	151
7d9c3427 YZ	152	struct bpf_cgroup_storage *
	153	cgroup_storage_lookup(struct bpf_cgroup_storage_map *map,
	154	void *key, bool locked);
8bad74f9 RG	155	struct bpf_cgroup_storage bpf_cgroup_storage_alloc(struct bpf_prog prog,
8bad74f9 RG	156	enum bpf_cgroup_storage_type stype);
de9cbbaa RG	157	void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
	158	void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
	159	struct cgroup *cgroup,
	160	enum bpf_attach_type type);
	161	void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
e4730423	162	int bpf_cgroup_storage_assign(struct bpf_prog_aux aux, struct bpf_map map);
de9cbbaa	163
b741f163 RG	164	int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key, void *value);
	165	int bpf_percpu_cgroup_storage_update(struct bpf_map map, void key,
	166	void *value, u64 flags);
	167
b2cd1257 DA	168	/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
	169	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \
	170	({ \
	171	int __ret = 0; \
6fc88c35	172	if (cgroup_bpf_enabled(CGROUP_INET_INGRESS)) \
b2cd1257	173	__ret = __cgroup_bpf_run_filter_skb(sk, skb, \
6fc88c35	174	CGROUP_INET_INGRESS); \
b2cd1257 DA	175	\
b2cd1257 DA	176	__ret; \
30070984 DM	177	})
30070984 DM	178
b2cd1257 DA	179	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb) \
	180	({ \
	181	int __ret = 0; \
6fc88c35	182	if (cgroup_bpf_enabled(CGROUP_INET_EGRESS) && sk && sk == skb->sk) { \
b2cd1257 DA	183	typeof(sk) __sk = sk_to_full_sk(sk); \
	184	if (sk_fullsock(__sk)) \
	185	__ret = __cgroup_bpf_run_filter_skb(__sk, skb, \
6fc88c35	186	CGROUP_INET_EGRESS); \
b2cd1257 DA	187	} \
b2cd1257 DA	188	__ret; \
30070984 DM	189	})
30070984 DM	190
6fc88c35	191	#define BPF_CGROUP_RUN_SK_PROG(sk, atype) \
61023658 DA	192	({ \
61023658 DA	193	int __ret = 0; \
6fc88c35 DM	194	if (cgroup_bpf_enabled(atype)) { \
6fc88c35 DM	195	__ret = __cgroup_bpf_run_filter_sk(sk, atype); \
61023658 DA	196	} \
	197	__ret; \
	198	})
	199
aac3fc32	200	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \
6fc88c35	201	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_CREATE)
aac3fc32	202
f5836749	203	#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) \
6fc88c35	204	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET_SOCK_RELEASE)
f5836749	205
aac3fc32	206	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \
6fc88c35	207	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET4_POST_BIND)
aac3fc32 AI	208
aac3fc32 AI	209	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) \
6fc88c35	210	BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET6_POST_BIND)
aac3fc32	211
6fc88c35	212	#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) \
4fbac77d	213	({ \
77241217	214	u32 __unused_flags; \
4fbac77d	215	int __ret = 0; \
6fc88c35 DM	216	if (cgroup_bpf_enabled(atype)) \
6fc88c35 DM	217	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \
77241217 SF	218	NULL, \
77241217 SF	219	&__unused_flags); \
4fbac77d AI	220	__ret; \
	221	})
	222
6fc88c35	223	#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) \
d74bad4e	224	({ \
77241217	225	u32 __unused_flags; \
d74bad4e	226	int __ret = 0; \
6fc88c35	227	if (cgroup_bpf_enabled(atype)) { \
d74bad4e	228	lock_sock(sk); \
6fc88c35	229	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \
77241217 SF	230	t_ctx, \
77241217 SF	231	&__unused_flags); \
d74bad4e AI	232	release_sock(sk); \
	233	} \
	234	__ret; \
	235	})
	236
77241217 SF	237	/* BPF_CGROUP_INET4_BIND and BPF_CGROUP_INET6_BIND can return extra flags
	238	* via upper bits of return code. The only flag that is supported
	239	* (at bit position 0) is to indicate CAP_NET_BIND_SERVICE capability check
	240	* should be bypassed (BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE).
	241	*/
6fc88c35	242	#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, bind_flags) \
77241217 SF	243	({ \
	244	u32 __flags = 0; \
	245	int __ret = 0; \
6fc88c35	246	if (cgroup_bpf_enabled(atype)) { \
77241217	247	lock_sock(sk); \
6fc88c35	248	__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \
77241217 SF	249	NULL, &__flags); \
	250	release_sock(sk); \
	251	if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE) \
	252	*bind_flags \|= BIND_NO_CAP_NET_BIND_SERVICE; \
	253	} \
	254	__ret; \
	255	})
4fbac77d	256
a9ed15da	257	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) \
6fc88c35 DM	258	((cgroup_bpf_enabled(CGROUP_INET4_CONNECT) \|\| \
6fc88c35 DM	259	cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) && \
a9ed15da	260	(sk)->sk_prot->pre_connect)
d74bad4e AI	261
d74bad4e AI	262	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) \
6fc88c35	263	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET4_CONNECT)
d74bad4e AI	264
d74bad4e AI	265	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) \
6fc88c35	266	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET6_CONNECT)
d74bad4e AI	267
d74bad4e AI	268	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) \
6fc88c35	269	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET4_CONNECT, NULL)
d74bad4e AI	270
d74bad4e AI	271	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) \
6fc88c35	272	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET6_CONNECT, NULL)
1cedee13 AI	273
1cedee13 AI	274	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) \
6fc88c35	275	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_SENDMSG, t_ctx)
1cedee13 AI	276
1cedee13 AI	277	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \
6fc88c35	278	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_SENDMSG, t_ctx)
d74bad4e	279
983695fa	280	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) \
6fc88c35	281	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_RECVMSG, NULL)
983695fa DB	282
983695fa DB	283	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) \
6fc88c35	284	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_RECVMSG, NULL)
983695fa	285
0813a841 MKL	286	/* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a
	287	* fullsock and its parent fullsock cannot be traced by
	288	* sk_to_full_sk().
	289	*
	290	* e.g. sock_ops->sk is a request_sock and it is under syncookie mode.
	291	* Its listener-sk is not attached to the rsk_listener.
	292	* In this case, the caller holds the listener-sk (unlocked),
	293	* set its sock_ops->sk to req_sk, and call this SOCK_OPS"_SK" with
	294	* the listener-sk such that the cgroup-bpf-progs of the
	295	* listener-sk will be run.
	296	*
	297	* Regardless of syncookie mode or not,
	298	* calling bpf_setsockopt on listener-sk will not make sense anyway,
	299	* so passing 'sock_ops->sk == req_sk' to the bpf prog is appropriate here.
	300	*/
	301	#define BPF_CGROUP_RUN_PROG_SOCK_OPS_SK(sock_ops, sk) \
	302	({ \
	303	int __ret = 0; \
6fc88c35	304	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS)) \
0813a841 MKL	305	__ret = __cgroup_bpf_run_filter_sock_ops(sk, \
0813a841 MKL	306	sock_ops, \
6fc88c35	307	CGROUP_SOCK_OPS); \
0813a841 MKL	308	__ret; \
	309	})
	310
40304b2a LB	311	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) \
	312	({ \
	313	int __ret = 0; \
6fc88c35	314	if (cgroup_bpf_enabled(CGROUP_SOCK_OPS) && (sock_ops)->sk) { \
40304b2a	315	typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk); \
df39a9f1	316	if (__sk && sk_fullsock(__sk)) \
40304b2a LB	317	__ret = __cgroup_bpf_run_filter_sock_ops(__sk, \
40304b2a LB	318	sock_ops, \
6fc88c35	319	CGROUP_SOCK_OPS); \
40304b2a LB	320	} \
	321	__ret; \
	322	})
ebc614f6	323
6fc88c35	324	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) \
ebc614f6 RG	325	({ \
ebc614f6 RG	326	int __ret = 0; \
6fc88c35 DM	327	if (cgroup_bpf_enabled(CGROUP_DEVICE)) \
6fc88c35 DM	328	__ret = __cgroup_bpf_check_dev_permission(atype, major, minor, \
ebc614f6	329	access, \
6fc88c35	330	CGROUP_DEVICE); \
ebc614f6 RG	331	\
	332	__ret; \
	333	})
7b146ceb AI	334
7b146ceb AI	335
32927393	336	#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos) \
7b146ceb AI	337	({ \
7b146ceb AI	338	int __ret = 0; \
6fc88c35	339	if (cgroup_bpf_enabled(CGROUP_SYSCTL)) \
7b146ceb	340	__ret = __cgroup_bpf_run_filter_sysctl(head, table, write, \
32927393	341	buf, count, pos, \
6fc88c35	342	CGROUP_SYSCTL); \
7b146ceb AI	343	__ret; \
	344	})
	345
0d01da6a SF	346	#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
	347	kernel_optval) \
	348	({ \
	349	int __ret = 0; \
6fc88c35	350	if (cgroup_bpf_enabled(CGROUP_SETSOCKOPT)) \
0d01da6a SF	351	__ret = __cgroup_bpf_run_filter_setsockopt(sock, level, \
	352	optname, optval, \
	353	optlen, \
	354	kernel_optval); \
	355	__ret; \
	356	})
	357
	358	#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) \
	359	({ \
	360	int __ret = 0; \
6fc88c35	361	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT)) \
0d01da6a SF	362	get_user(__ret, optlen); \
	363	__ret; \
	364	})
	365
	366	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, optlen, \
	367	max_optlen, retval) \
	368	({ \
	369	int __ret = retval; \
6fc88c35	370	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT)) \
9cacf81f SF	371	if (!(sock)->sk_prot->bpf_bypass_getsockopt \|\| \
	372	!INDIRECT_CALL_INET_1((sock)->sk_prot->bpf_bypass_getsockopt, \
	373	tcp_bpf_bypass_getsockopt, \
	374	level, optname)) \
	375	__ret = __cgroup_bpf_run_filter_getsockopt( \
	376	sock, level, optname, optval, optlen, \
	377	max_optlen, retval); \
	378	__ret; \
	379	})
	380
	381	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval, \
	382	optlen, retval) \
	383	({ \
	384	int __ret = retval; \
6fc88c35	385	if (cgroup_bpf_enabled(CGROUP_GETSOCKOPT)) \
9cacf81f SF	386	__ret = __cgroup_bpf_run_filter_getsockopt_kern( \
9cacf81f SF	387	sock, level, optname, optval, optlen, retval); \
0d01da6a SF	388	__ret; \
	389	})
	390
fdb5c453 SY	391	int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	392	enum bpf_prog_type ptype, struct bpf_prog *prog);
	393	int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	394	enum bpf_prog_type ptype);
af6eea57	395	int cgroup_bpf_link_attach(const union bpf_attr attr, struct bpf_prog prog);
fdb5c453 SY	396	int cgroup_bpf_prog_query(const union bpf_attr *attr,
fdb5c453 SY	397	union bpf_attr __user *uattr);
30070984 DM	398	#else
30070984 DM	399
324bda9e	400	static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
4bfc0bb2	401	static inline void cgroup_bpf_offline(struct cgroup *cgrp) {}
30070984	402
fdb5c453 SY	403	static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
	404	enum bpf_prog_type ptype,
	405	struct bpf_prog *prog)
	406	{
	407	return -EINVAL;
	408	}
	409
	410	static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
	411	enum bpf_prog_type ptype)
	412	{
	413	return -EINVAL;
	414	}
	415
af6eea57 AN	416	static inline int cgroup_bpf_link_attach(const union bpf_attr *attr,
	417	struct bpf_prog *prog)
	418	{
	419	return -EINVAL;
	420	}
	421
fdb5c453 SY	422	static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
	423	union bpf_attr __user *uattr)
	424	{
	425	return -EINVAL;
	426	}
	427
e4730423	428	static inline int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux,
de9cbbaa	429	struct bpf_map *map) { return 0; }
de9cbbaa	430	static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
71b91a50	431	struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
de9cbbaa RG	432	static inline void bpf_cgroup_storage_free(
de9cbbaa RG	433	struct bpf_cgroup_storage *storage) {}
b741f163 RG	434	static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map map, void key,
	435	void *value) {
	436	return 0;
	437	}
	438	static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
	439	void key, void value, u64 flags) {
	440	return 0;
	441	}
de9cbbaa	442
6fc88c35 DM	443	#define cgroup_bpf_enabled(atype) (0)
6fc88c35 DM	444	#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) ({ 0; })
9dfc685e	445	#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) ({ 0; })
d74bad4e	446	#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
30070984 DM	447	#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
30070984 DM	448	#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
61023658	449	#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
f5836749	450	#define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; })
6fc88c35	451	#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, flags) ({ 0; })
aac3fc32 AI	452	#define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
aac3fc32 AI	453	#define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
d74bad4e AI	454	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
	455	#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
	456	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
	457	#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
1cedee13 AI	458	#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
1cedee13 AI	459	#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
983695fa DB	460	#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
983695fa DB	461	#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
40304b2a	462	#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
6fc88c35	463	#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; })
32927393	464	#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })
0d01da6a SF	465	#define BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen) ({ 0; })
	466	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock, level, optname, optval, \
	467	optlen, max_optlen, retval) ({ retval; })
9cacf81f SF	468	#define BPF_CGROUP_RUN_PROG_GETSOCKOPT_KERN(sock, level, optname, optval, \
9cacf81f SF	469	optlen, retval) ({ retval; })
0d01da6a SF	470	#define BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock, level, optname, optval, optlen, \
0d01da6a SF	471	kernel_optval) ({ 0; })
30070984	472
8bad74f9 RG	473	#define for_each_cgroup_storage_type(stype) for (; false; )
8bad74f9 RG	474
30070984 DM	475	#endif /* CONFIG_CGROUP_BPF */
	476
	477	#endif /* _BPF_CGROUP_H */