1 /* SPDX-License-Identifier: GPL-2.0 */
5 #include <linux/errno.h>
6 #include <linux/jump_label.h>
7 #include <linux/percpu.h>
8 #include <linux/rbtree.h>
9 #include <uapi/linux/bpf.h>
17 struct bpf_sock_ops_kern;
18 struct bpf_cgroup_storage;
20 #ifdef CONFIG_CGROUP_BPF
22 extern struct static_key_false cgroup_bpf_enabled_key;
23 #define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)
25 DECLARE_PER_CPU(void*, bpf_cgroup_storage);
27 struct bpf_cgroup_storage_map;
29 struct bpf_storage_buffer {
34 struct bpf_cgroup_storage {
35 struct bpf_storage_buffer *buf;
36 struct bpf_cgroup_storage_map *map;
37 struct bpf_cgroup_storage_key key;
38 struct list_head list;
43 struct bpf_prog_list {
44 struct list_head node;
45 struct bpf_prog *prog;
48 struct bpf_prog_array;
51 /* array of effective progs in this cgroup */
52 struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];
54 /* attached progs to this cgroup and attach flags
55 * when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
56 * have either zero or one element
57 * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
59 struct list_head progs[MAX_BPF_ATTACH_TYPE];
60 u32 flags[MAX_BPF_ATTACH_TYPE];
62 /* temp storage for effective prog array used by prog_attach/detach */
63 struct bpf_prog_array __rcu *inactive;
66 void cgroup_bpf_put(struct cgroup *cgrp);
67 int cgroup_bpf_inherit(struct cgroup *cgrp);
69 int __cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
70 enum bpf_attach_type type, u32 flags);
71 int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
72 enum bpf_attach_type type, u32 flags);
73 int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
74 union bpf_attr __user *uattr);
76 /* Wrapper for __cgroup_bpf_*() protected by cgroup_mutex */
77 int cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
78 enum bpf_attach_type type, u32 flags);
79 int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
80 enum bpf_attach_type type, u32 flags);
81 int cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
82 union bpf_attr __user *uattr);
84 int __cgroup_bpf_run_filter_skb(struct sock *sk,
86 enum bpf_attach_type type);
88 int __cgroup_bpf_run_filter_sk(struct sock *sk,
89 enum bpf_attach_type type);
91 int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
92 struct sockaddr *uaddr,
93 enum bpf_attach_type type,
96 int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
97 struct bpf_sock_ops_kern *sock_ops,
98 enum bpf_attach_type type);
100 int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
101 short access, enum bpf_attach_type type);
103 static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage *storage)
105 struct bpf_storage_buffer *buf;
110 buf = READ_ONCE(storage->buf);
111 this_cpu_write(bpf_cgroup_storage, &buf->data[0]);
114 struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog);
115 void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
116 void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
117 struct cgroup *cgroup,
118 enum bpf_attach_type type);
119 void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
120 int bpf_cgroup_storage_assign(struct bpf_prog *prog, struct bpf_map *map);
121 void bpf_cgroup_storage_release(struct bpf_prog *prog, struct bpf_map *map);
123 /* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
124 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \
127 if (cgroup_bpf_enabled) \
128 __ret = __cgroup_bpf_run_filter_skb(sk, skb, \
129 BPF_CGROUP_INET_INGRESS); \
134 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb) \
137 if (cgroup_bpf_enabled && sk && sk == skb->sk) { \
138 typeof(sk) __sk = sk_to_full_sk(sk); \
139 if (sk_fullsock(__sk)) \
140 __ret = __cgroup_bpf_run_filter_skb(__sk, skb, \
141 BPF_CGROUP_INET_EGRESS); \
146 #define BPF_CGROUP_RUN_SK_PROG(sk, type) \
149 if (cgroup_bpf_enabled) { \
150 __ret = __cgroup_bpf_run_filter_sk(sk, type); \
155 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \
156 BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE)
158 #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \
159 BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND)
161 #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) \
162 BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_POST_BIND)
164 #define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, type) \
167 if (cgroup_bpf_enabled) \
168 __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type, \
173 #define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx) \
176 if (cgroup_bpf_enabled) { \
178 __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type, \
185 #define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr) \
186 BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_BIND)
188 #define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr) \
189 BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_BIND)
191 #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (cgroup_bpf_enabled && \
192 sk->sk_prot->pre_connect)
194 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) \
195 BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_CONNECT)
197 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) \
198 BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)
200 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) \
201 BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)
203 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) \
204 BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)
206 #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) \
207 BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)
209 #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \
210 BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)
212 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) \
215 if (cgroup_bpf_enabled && (sock_ops)->sk) { \
216 typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk); \
217 if (__sk && sk_fullsock(__sk)) \
218 __ret = __cgroup_bpf_run_filter_sock_ops(__sk, \
220 BPF_CGROUP_SOCK_OPS); \
225 #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access) \
228 if (cgroup_bpf_enabled) \
229 __ret = __cgroup_bpf_check_dev_permission(type, major, minor, \
231 BPF_CGROUP_DEVICE); \
235 int cgroup_bpf_prog_attach(const union bpf_attr *attr,
236 enum bpf_prog_type ptype, struct bpf_prog *prog);
237 int cgroup_bpf_prog_detach(const union bpf_attr *attr,
238 enum bpf_prog_type ptype);
239 int cgroup_bpf_prog_query(const union bpf_attr *attr,
240 union bpf_attr __user *uattr);
244 struct cgroup_bpf {};
245 static inline void cgroup_bpf_put(struct cgroup *cgrp) {}
246 static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
248 static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
249 enum bpf_prog_type ptype,
250 struct bpf_prog *prog)
255 static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
256 enum bpf_prog_type ptype)
261 static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
262 union bpf_attr __user *uattr)
267 static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage *storage) {}
268 static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog,
269 struct bpf_map *map) { return 0; }
270 static inline void bpf_cgroup_storage_release(struct bpf_prog *prog,
271 struct bpf_map *map) {}
272 static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
273 struct bpf_prog *prog) { return 0; }
274 static inline void bpf_cgroup_storage_free(
275 struct bpf_cgroup_storage *storage) {}
277 #define cgroup_bpf_enabled (0)
278 #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
279 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
280 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
281 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
282 #define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr) ({ 0; })
283 #define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr) ({ 0; })
284 #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
285 #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
286 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
287 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
288 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
289 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
290 #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
291 #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
292 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
293 #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
295 #endif /* CONFIG_CGROUP_BPF */
297 #endif /* _BPF_CGROUP_H */