1 #ifndef _BPF_CGROUP_H 2 #define _BPF_CGROUP_H 3 4 #include <linux/jump_label.h> 5 #include <uapi/linux/bpf.h> 6 7 struct sock; 8 struct cgroup; 9 struct sk_buff; 10 11 #ifdef CONFIG_CGROUP_BPF 12 13 extern struct static_key_false cgroup_bpf_enabled_key; 14 #define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key) 15 16 struct cgroup_bpf { 17 /* 18 * Store two sets of bpf_prog pointers, one for programs that are 19 * pinned directly to this cgroup, and one for those that are effective 20 * when this cgroup is accessed. 21 */ 22 struct bpf_prog *prog[MAX_BPF_ATTACH_TYPE]; 23 struct bpf_prog __rcu *effective[MAX_BPF_ATTACH_TYPE]; 24 }; 25 26 void cgroup_bpf_put(struct cgroup *cgrp); 27 void cgroup_bpf_inherit(struct cgroup *cgrp, struct cgroup *parent); 28 29 void __cgroup_bpf_update(struct cgroup *cgrp, 30 struct cgroup *parent, 31 struct bpf_prog *prog, 32 enum bpf_attach_type type); 33 34 /* Wrapper for __cgroup_bpf_update() protected by cgroup_mutex */ 35 void cgroup_bpf_update(struct cgroup *cgrp, 36 struct bpf_prog *prog, 37 enum bpf_attach_type type); 38 39 int __cgroup_bpf_run_filter_skb(struct sock *sk, 40 struct sk_buff *skb, 41 enum bpf_attach_type type); 42 43 int __cgroup_bpf_run_filter_sk(struct sock *sk, 44 enum bpf_attach_type type); 45 46 /* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */ 47 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \ 48 ({ \ 49 int __ret = 0; \ 50 if (cgroup_bpf_enabled) \ 51 __ret = __cgroup_bpf_run_filter_skb(sk, skb, \ 52 BPF_CGROUP_INET_INGRESS); \ 53 \ 54 __ret; \ 55 }) 56 57 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb) \ 58 ({ \ 59 int __ret = 0; \ 60 if (cgroup_bpf_enabled && sk && sk == skb->sk) { \ 61 typeof(sk) __sk = sk_to_full_sk(sk); \ 62 if (sk_fullsock(__sk)) \ 63 __ret = __cgroup_bpf_run_filter_skb(__sk, skb, \ 64 BPF_CGROUP_INET_EGRESS); \ 65 } \ 66 __ret; \ 67 }) 68 69 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \ 70 ({ \ 71 int __ret = 0; \ 72 if (cgroup_bpf_enabled && sk) { \ 73 __ret = __cgroup_bpf_run_filter_sk(sk, \ 74 BPF_CGROUP_INET_SOCK_CREATE); \ 75 } \ 76 __ret; \ 77 }) 78 79 #else 80 81 struct cgroup_bpf {}; 82 static inline void cgroup_bpf_put(struct cgroup *cgrp) {} 83 static inline void cgroup_bpf_inherit(struct cgroup *cgrp, 84 struct cgroup *parent) {} 85 86 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; }) 87 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; }) 88 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) 89 90 #endif /* CONFIG_CGROUP_BPF */ 91 92 #endif /* _BPF_CGROUP_H */ 93