xref: /linux-6.15/include/linux/bpf.h (revision 2d91ecac)
1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
3  */
4 #ifndef _LINUX_BPF_H
5 #define _LINUX_BPF_H 1
6 
7 #include <uapi/linux/bpf.h>
8 #include <uapi/linux/filter.h>
9 
10 #include <linux/workqueue.h>
11 #include <linux/file.h>
12 #include <linux/percpu.h>
13 #include <linux/err.h>
14 #include <linux/rbtree_latch.h>
15 #include <linux/numa.h>
16 #include <linux/mm_types.h>
17 #include <linux/wait.h>
18 #include <linux/refcount.h>
19 #include <linux/mutex.h>
20 #include <linux/module.h>
21 #include <linux/kallsyms.h>
22 #include <linux/capability.h>
23 #include <linux/sched/mm.h>
24 #include <linux/slab.h>
25 #include <linux/percpu-refcount.h>
26 #include <linux/stddef.h>
27 #include <linux/bpfptr.h>
28 #include <linux/btf.h>
29 #include <linux/rcupdate_trace.h>
30 
31 struct bpf_verifier_env;
32 struct bpf_verifier_log;
33 struct perf_event;
34 struct bpf_prog;
35 struct bpf_prog_aux;
36 struct bpf_map;
37 struct sock;
38 struct seq_file;
39 struct btf;
40 struct btf_type;
41 struct exception_table_entry;
42 struct seq_operations;
43 struct bpf_iter_aux_info;
44 struct bpf_local_storage;
45 struct bpf_local_storage_map;
46 struct kobject;
47 struct mem_cgroup;
48 struct module;
49 struct bpf_func_state;
50 
51 extern struct idr btf_idr;
52 extern spinlock_t btf_idr_lock;
53 extern struct kobject *btf_kobj;
54 
55 typedef u64 (*bpf_callback_t)(u64, u64, u64, u64, u64);
56 typedef int (*bpf_iter_init_seq_priv_t)(void *private_data,
57 					struct bpf_iter_aux_info *aux);
58 typedef void (*bpf_iter_fini_seq_priv_t)(void *private_data);
59 struct bpf_iter_seq_info {
60 	const struct seq_operations *seq_ops;
61 	bpf_iter_init_seq_priv_t init_seq_private;
62 	bpf_iter_fini_seq_priv_t fini_seq_private;
63 	u32 seq_priv_size;
64 };
65 
66 /* map is generic key/value storage optionally accessible by eBPF programs */
67 struct bpf_map_ops {
68 	/* funcs callable from userspace (via syscall) */
69 	int (*map_alloc_check)(union bpf_attr *attr);
70 	struct bpf_map *(*map_alloc)(union bpf_attr *attr);
71 	void (*map_release)(struct bpf_map *map, struct file *map_file);
72 	void (*map_free)(struct bpf_map *map);
73 	int (*map_get_next_key)(struct bpf_map *map, void *key, void *next_key);
74 	void (*map_release_uref)(struct bpf_map *map);
75 	void *(*map_lookup_elem_sys_only)(struct bpf_map *map, void *key);
76 	int (*map_lookup_batch)(struct bpf_map *map, const union bpf_attr *attr,
77 				union bpf_attr __user *uattr);
78 	int (*map_lookup_and_delete_elem)(struct bpf_map *map, void *key,
79 					  void *value, u64 flags);
80 	int (*map_lookup_and_delete_batch)(struct bpf_map *map,
81 					   const union bpf_attr *attr,
82 					   union bpf_attr __user *uattr);
83 	int (*map_update_batch)(struct bpf_map *map, const union bpf_attr *attr,
84 				union bpf_attr __user *uattr);
85 	int (*map_delete_batch)(struct bpf_map *map, const union bpf_attr *attr,
86 				union bpf_attr __user *uattr);
87 
88 	/* funcs callable from userspace and from eBPF programs */
89 	void *(*map_lookup_elem)(struct bpf_map *map, void *key);
90 	int (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags);
91 	int (*map_delete_elem)(struct bpf_map *map, void *key);
92 	int (*map_push_elem)(struct bpf_map *map, void *value, u64 flags);
93 	int (*map_pop_elem)(struct bpf_map *map, void *value);
94 	int (*map_peek_elem)(struct bpf_map *map, void *value);
95 	void *(*map_lookup_percpu_elem)(struct bpf_map *map, void *key, u32 cpu);
96 
97 	/* funcs called by prog_array and perf_event_array map */
98 	void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file,
99 				int fd);
100 	void (*map_fd_put_ptr)(void *ptr);
101 	int (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf);
102 	u32 (*map_fd_sys_lookup_elem)(void *ptr);
103 	void (*map_seq_show_elem)(struct bpf_map *map, void *key,
104 				  struct seq_file *m);
105 	int (*map_check_btf)(const struct bpf_map *map,
106 			     const struct btf *btf,
107 			     const struct btf_type *key_type,
108 			     const struct btf_type *value_type);
109 
110 	/* Prog poke tracking helpers. */
111 	int (*map_poke_track)(struct bpf_map *map, struct bpf_prog_aux *aux);
112 	void (*map_poke_untrack)(struct bpf_map *map, struct bpf_prog_aux *aux);
113 	void (*map_poke_run)(struct bpf_map *map, u32 key, struct bpf_prog *old,
114 			     struct bpf_prog *new);
115 
116 	/* Direct value access helpers. */
117 	int (*map_direct_value_addr)(const struct bpf_map *map,
118 				     u64 *imm, u32 off);
119 	int (*map_direct_value_meta)(const struct bpf_map *map,
120 				     u64 imm, u32 *off);
121 	int (*map_mmap)(struct bpf_map *map, struct vm_area_struct *vma);
122 	__poll_t (*map_poll)(struct bpf_map *map, struct file *filp,
123 			     struct poll_table_struct *pts);
124 
125 	/* Functions called by bpf_local_storage maps */
126 	int (*map_local_storage_charge)(struct bpf_local_storage_map *smap,
127 					void *owner, u32 size);
128 	void (*map_local_storage_uncharge)(struct bpf_local_storage_map *smap,
129 					   void *owner, u32 size);
130 	struct bpf_local_storage __rcu ** (*map_owner_storage_ptr)(void *owner);
131 
132 	/* Misc helpers.*/
133 	int (*map_redirect)(struct bpf_map *map, u32 ifindex, u64 flags);
134 
135 	/* map_meta_equal must be implemented for maps that can be
136 	 * used as an inner map.  It is a runtime check to ensure
137 	 * an inner map can be inserted to an outer map.
138 	 *
139 	 * Some properties of the inner map has been used during the
140 	 * verification time.  When inserting an inner map at the runtime,
141 	 * map_meta_equal has to ensure the inserting map has the same
142 	 * properties that the verifier has used earlier.
143 	 */
144 	bool (*map_meta_equal)(const struct bpf_map *meta0,
145 			       const struct bpf_map *meta1);
146 
147 
148 	int (*map_set_for_each_callback_args)(struct bpf_verifier_env *env,
149 					      struct bpf_func_state *caller,
150 					      struct bpf_func_state *callee);
151 	int (*map_for_each_callback)(struct bpf_map *map,
152 				     bpf_callback_t callback_fn,
153 				     void *callback_ctx, u64 flags);
154 
155 	/* BTF id of struct allocated by map_alloc */
156 	int *map_btf_id;
157 
158 	/* bpf_iter info used to open a seq_file */
159 	const struct bpf_iter_seq_info *iter_seq_info;
160 };
161 
162 enum {
163 	/* Support at most 8 pointers in a BPF map value */
164 	BPF_MAP_VALUE_OFF_MAX = 8,
165 	BPF_MAP_OFF_ARR_MAX   = BPF_MAP_VALUE_OFF_MAX +
166 				1 + /* for bpf_spin_lock */
167 				1,  /* for bpf_timer */
168 };
169 
170 enum bpf_kptr_type {
171 	BPF_KPTR_UNREF,
172 	BPF_KPTR_REF,
173 };
174 
175 struct bpf_map_value_off_desc {
176 	u32 offset;
177 	enum bpf_kptr_type type;
178 	struct {
179 		struct btf *btf;
180 		struct module *module;
181 		btf_dtor_kfunc_t dtor;
182 		u32 btf_id;
183 	} kptr;
184 };
185 
186 struct bpf_map_value_off {
187 	u32 nr_off;
188 	struct bpf_map_value_off_desc off[];
189 };
190 
191 struct bpf_map_off_arr {
192 	u32 cnt;
193 	u32 field_off[BPF_MAP_OFF_ARR_MAX];
194 	u8 field_sz[BPF_MAP_OFF_ARR_MAX];
195 };
196 
197 struct bpf_map {
198 	/* The first two cachelines with read-mostly members of which some
199 	 * are also accessed in fast-path (e.g. ops, max_entries).
200 	 */
201 	const struct bpf_map_ops *ops ____cacheline_aligned;
202 	struct bpf_map *inner_map_meta;
203 #ifdef CONFIG_SECURITY
204 	void *security;
205 #endif
206 	enum bpf_map_type map_type;
207 	u32 key_size;
208 	u32 value_size;
209 	u32 max_entries;
210 	u64 map_extra; /* any per-map-type extra fields */
211 	u32 map_flags;
212 	int spin_lock_off; /* >=0 valid offset, <0 error */
213 	struct bpf_map_value_off *kptr_off_tab;
214 	int timer_off; /* >=0 valid offset, <0 error */
215 	u32 id;
216 	int numa_node;
217 	u32 btf_key_type_id;
218 	u32 btf_value_type_id;
219 	u32 btf_vmlinux_value_type_id;
220 	struct btf *btf;
221 #ifdef CONFIG_MEMCG_KMEM
222 	struct mem_cgroup *memcg;
223 #endif
224 	char name[BPF_OBJ_NAME_LEN];
225 	struct bpf_map_off_arr *off_arr;
226 	/* The 3rd and 4th cacheline with misc members to avoid false sharing
227 	 * particularly with refcounting.
228 	 */
229 	atomic64_t refcnt ____cacheline_aligned;
230 	atomic64_t usercnt;
231 	struct work_struct work;
232 	struct mutex freeze_mutex;
233 	atomic64_t writecnt;
234 	/* 'Ownership' of program-containing map is claimed by the first program
235 	 * that is going to use this map or by the first program which FD is
236 	 * stored in the map to make sure that all callers and callees have the
237 	 * same prog type, JITed flag and xdp_has_frags flag.
238 	 */
239 	struct {
240 		spinlock_t lock;
241 		enum bpf_prog_type type;
242 		bool jited;
243 		bool xdp_has_frags;
244 	} owner;
245 	bool bypass_spec_v1;
246 	bool frozen; /* write-once; write-protected by freeze_mutex */
247 };
248 
249 static inline bool map_value_has_spin_lock(const struct bpf_map *map)
250 {
251 	return map->spin_lock_off >= 0;
252 }
253 
254 static inline bool map_value_has_timer(const struct bpf_map *map)
255 {
256 	return map->timer_off >= 0;
257 }
258 
259 static inline bool map_value_has_kptrs(const struct bpf_map *map)
260 {
261 	return !IS_ERR_OR_NULL(map->kptr_off_tab);
262 }
263 
264 static inline void check_and_init_map_value(struct bpf_map *map, void *dst)
265 {
266 	if (unlikely(map_value_has_spin_lock(map)))
267 		memset(dst + map->spin_lock_off, 0, sizeof(struct bpf_spin_lock));
268 	if (unlikely(map_value_has_timer(map)))
269 		memset(dst + map->timer_off, 0, sizeof(struct bpf_timer));
270 	if (unlikely(map_value_has_kptrs(map))) {
271 		struct bpf_map_value_off *tab = map->kptr_off_tab;
272 		int i;
273 
274 		for (i = 0; i < tab->nr_off; i++)
275 			*(u64 *)(dst + tab->off[i].offset) = 0;
276 	}
277 }
278 
279 /* copy everything but bpf_spin_lock and bpf_timer. There could be one of each. */
280 static inline void copy_map_value(struct bpf_map *map, void *dst, void *src)
281 {
282 	u32 curr_off = 0;
283 	int i;
284 
285 	if (likely(!map->off_arr)) {
286 		memcpy(dst, src, map->value_size);
287 		return;
288 	}
289 
290 	for (i = 0; i < map->off_arr->cnt; i++) {
291 		u32 next_off = map->off_arr->field_off[i];
292 
293 		memcpy(dst + curr_off, src + curr_off, next_off - curr_off);
294 		curr_off += map->off_arr->field_sz[i];
295 	}
296 	memcpy(dst + curr_off, src + curr_off, map->value_size - curr_off);
297 }
298 void copy_map_value_locked(struct bpf_map *map, void *dst, void *src,
299 			   bool lock_src);
300 void bpf_timer_cancel_and_free(void *timer);
301 int bpf_obj_name_cpy(char *dst, const char *src, unsigned int size);
302 
303 struct bpf_offload_dev;
304 struct bpf_offloaded_map;
305 
306 struct bpf_map_dev_ops {
307 	int (*map_get_next_key)(struct bpf_offloaded_map *map,
308 				void *key, void *next_key);
309 	int (*map_lookup_elem)(struct bpf_offloaded_map *map,
310 			       void *key, void *value);
311 	int (*map_update_elem)(struct bpf_offloaded_map *map,
312 			       void *key, void *value, u64 flags);
313 	int (*map_delete_elem)(struct bpf_offloaded_map *map, void *key);
314 };
315 
316 struct bpf_offloaded_map {
317 	struct bpf_map map;
318 	struct net_device *netdev;
319 	const struct bpf_map_dev_ops *dev_ops;
320 	void *dev_priv;
321 	struct list_head offloads;
322 };
323 
324 static inline struct bpf_offloaded_map *map_to_offmap(struct bpf_map *map)
325 {
326 	return container_of(map, struct bpf_offloaded_map, map);
327 }
328 
329 static inline bool bpf_map_offload_neutral(const struct bpf_map *map)
330 {
331 	return map->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY;
332 }
333 
334 static inline bool bpf_map_support_seq_show(const struct bpf_map *map)
335 {
336 	return (map->btf_value_type_id || map->btf_vmlinux_value_type_id) &&
337 		map->ops->map_seq_show_elem;
338 }
339 
340 int map_check_no_btf(const struct bpf_map *map,
341 		     const struct btf *btf,
342 		     const struct btf_type *key_type,
343 		     const struct btf_type *value_type);
344 
345 bool bpf_map_meta_equal(const struct bpf_map *meta0,
346 			const struct bpf_map *meta1);
347 
348 extern const struct bpf_map_ops bpf_map_offload_ops;
349 
350 /* bpf_type_flag contains a set of flags that are applicable to the values of
351  * arg_type, ret_type and reg_type. For example, a pointer value may be null,
352  * or a memory is read-only. We classify types into two categories: base types
353  * and extended types. Extended types are base types combined with a type flag.
354  *
355  * Currently there are no more than 32 base types in arg_type, ret_type and
356  * reg_types.
357  */
358 #define BPF_BASE_TYPE_BITS	8
359 
360 enum bpf_type_flag {
361 	/* PTR may be NULL. */
362 	PTR_MAYBE_NULL		= BIT(0 + BPF_BASE_TYPE_BITS),
363 
364 	/* MEM is read-only. When applied on bpf_arg, it indicates the arg is
365 	 * compatible with both mutable and immutable memory.
366 	 */
367 	MEM_RDONLY		= BIT(1 + BPF_BASE_TYPE_BITS),
368 
369 	/* MEM was "allocated" from a different helper, and cannot be mixed
370 	 * with regular non-MEM_ALLOC'ed MEM types.
371 	 */
372 	MEM_ALLOC		= BIT(2 + BPF_BASE_TYPE_BITS),
373 
374 	/* MEM is in user address space. */
375 	MEM_USER		= BIT(3 + BPF_BASE_TYPE_BITS),
376 
377 	/* MEM is a percpu memory. MEM_PERCPU tags PTR_TO_BTF_ID. When tagged
378 	 * with MEM_PERCPU, PTR_TO_BTF_ID _cannot_ be directly accessed. In
379 	 * order to drop this tag, it must be passed into bpf_per_cpu_ptr()
380 	 * or bpf_this_cpu_ptr(), which will return the pointer corresponding
381 	 * to the specified cpu.
382 	 */
383 	MEM_PERCPU		= BIT(4 + BPF_BASE_TYPE_BITS),
384 
385 	/* Indicates that the argument will be released. */
386 	OBJ_RELEASE		= BIT(5 + BPF_BASE_TYPE_BITS),
387 
388 	/* PTR is not trusted. This is only used with PTR_TO_BTF_ID, to mark
389 	 * unreferenced and referenced kptr loaded from map value using a load
390 	 * instruction, so that they can only be dereferenced but not escape the
391 	 * BPF program into the kernel (i.e. cannot be passed as arguments to
392 	 * kfunc or bpf helpers).
393 	 */
394 	PTR_UNTRUSTED		= BIT(6 + BPF_BASE_TYPE_BITS),
395 
396 	MEM_UNINIT		= BIT(7 + BPF_BASE_TYPE_BITS),
397 
398 	/* DYNPTR points to memory local to the bpf program. */
399 	DYNPTR_TYPE_LOCAL	= BIT(8 + BPF_BASE_TYPE_BITS),
400 
401 	/* DYNPTR points to a ringbuf record. */
402 	DYNPTR_TYPE_RINGBUF	= BIT(9 + BPF_BASE_TYPE_BITS),
403 
404 	/* Size is known at compile time. */
405 	MEM_FIXED_SIZE		= BIT(10 + BPF_BASE_TYPE_BITS),
406 
407 	__BPF_TYPE_FLAG_MAX,
408 	__BPF_TYPE_LAST_FLAG	= __BPF_TYPE_FLAG_MAX - 1,
409 };
410 
411 #define DYNPTR_TYPE_FLAG_MASK	(DYNPTR_TYPE_LOCAL | DYNPTR_TYPE_RINGBUF)
412 
413 /* Max number of base types. */
414 #define BPF_BASE_TYPE_LIMIT	(1UL << BPF_BASE_TYPE_BITS)
415 
416 /* Max number of all types. */
417 #define BPF_TYPE_LIMIT		(__BPF_TYPE_LAST_FLAG | (__BPF_TYPE_LAST_FLAG - 1))
418 
419 /* function argument constraints */
420 enum bpf_arg_type {
421 	ARG_DONTCARE = 0,	/* unused argument in helper function */
422 
423 	/* the following constraints used to prototype
424 	 * bpf_map_lookup/update/delete_elem() functions
425 	 */
426 	ARG_CONST_MAP_PTR,	/* const argument used as pointer to bpf_map */
427 	ARG_PTR_TO_MAP_KEY,	/* pointer to stack used as map key */
428 	ARG_PTR_TO_MAP_VALUE,	/* pointer to stack used as map value */
429 
430 	/* Used to prototype bpf_memcmp() and other functions that access data
431 	 * on eBPF program stack
432 	 */
433 	ARG_PTR_TO_MEM,		/* pointer to valid memory (stack, packet, map value) */
434 
435 	ARG_CONST_SIZE,		/* number of bytes accessed from memory */
436 	ARG_CONST_SIZE_OR_ZERO,	/* number of bytes accessed from memory or 0 */
437 
438 	ARG_PTR_TO_CTX,		/* pointer to context */
439 	ARG_ANYTHING,		/* any (initialized) argument is ok */
440 	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */
441 	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
442 	ARG_PTR_TO_INT,		/* pointer to int */
443 	ARG_PTR_TO_LONG,	/* pointer to long */
444 	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock (fullsock) */
445 	ARG_PTR_TO_BTF_ID,	/* pointer to in-kernel struct */
446 	ARG_PTR_TO_ALLOC_MEM,	/* pointer to dynamically allocated memory */
447 	ARG_CONST_ALLOC_SIZE_OR_ZERO,	/* number of allocated bytes requested */
448 	ARG_PTR_TO_BTF_ID_SOCK_COMMON,	/* pointer to in-kernel sock_common or bpf-mirrored bpf_sock */
449 	ARG_PTR_TO_PERCPU_BTF_ID,	/* pointer to in-kernel percpu type */
450 	ARG_PTR_TO_FUNC,	/* pointer to a bpf program function */
451 	ARG_PTR_TO_STACK,	/* pointer to stack */
452 	ARG_PTR_TO_CONST_STR,	/* pointer to a null terminated read-only string */
453 	ARG_PTR_TO_TIMER,	/* pointer to bpf_timer */
454 	ARG_PTR_TO_KPTR,	/* pointer to referenced kptr */
455 	ARG_PTR_TO_DYNPTR,      /* pointer to bpf_dynptr. See bpf_type_flag for dynptr type */
456 	__BPF_ARG_TYPE_MAX,
457 
458 	/* Extended arg_types. */
459 	ARG_PTR_TO_MAP_VALUE_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_MAP_VALUE,
460 	ARG_PTR_TO_MEM_OR_NULL		= PTR_MAYBE_NULL | ARG_PTR_TO_MEM,
461 	ARG_PTR_TO_CTX_OR_NULL		= PTR_MAYBE_NULL | ARG_PTR_TO_CTX,
462 	ARG_PTR_TO_SOCKET_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_SOCKET,
463 	ARG_PTR_TO_ALLOC_MEM_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_ALLOC_MEM,
464 	ARG_PTR_TO_STACK_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_STACK,
465 	ARG_PTR_TO_BTF_ID_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_BTF_ID,
466 	/* pointer to memory does not need to be initialized, helper function must fill
467 	 * all bytes or clear them in error case.
468 	 */
469 	ARG_PTR_TO_UNINIT_MEM		= MEM_UNINIT | ARG_PTR_TO_MEM,
470 	/* Pointer to valid memory of size known at compile time. */
471 	ARG_PTR_TO_FIXED_SIZE_MEM	= MEM_FIXED_SIZE | ARG_PTR_TO_MEM,
472 
473 	/* This must be the last entry. Its purpose is to ensure the enum is
474 	 * wide enough to hold the higher bits reserved for bpf_type_flag.
475 	 */
476 	__BPF_ARG_TYPE_LIMIT	= BPF_TYPE_LIMIT,
477 };
478 static_assert(__BPF_ARG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT);
479 
480 /* type of values returned from helper functions */
481 enum bpf_return_type {
482 	RET_INTEGER,			/* function returns integer */
483 	RET_VOID,			/* function doesn't return anything */
484 	RET_PTR_TO_MAP_VALUE,		/* returns a pointer to map elem value */
485 	RET_PTR_TO_SOCKET,		/* returns a pointer to a socket */
486 	RET_PTR_TO_TCP_SOCK,		/* returns a pointer to a tcp_sock */
487 	RET_PTR_TO_SOCK_COMMON,		/* returns a pointer to a sock_common */
488 	RET_PTR_TO_ALLOC_MEM,		/* returns a pointer to dynamically allocated memory */
489 	RET_PTR_TO_MEM_OR_BTF_ID,	/* returns a pointer to a valid memory or a btf_id */
490 	RET_PTR_TO_BTF_ID,		/* returns a pointer to a btf_id */
491 	__BPF_RET_TYPE_MAX,
492 
493 	/* Extended ret_types. */
494 	RET_PTR_TO_MAP_VALUE_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_MAP_VALUE,
495 	RET_PTR_TO_SOCKET_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_SOCKET,
496 	RET_PTR_TO_TCP_SOCK_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_TCP_SOCK,
497 	RET_PTR_TO_SOCK_COMMON_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_SOCK_COMMON,
498 	RET_PTR_TO_ALLOC_MEM_OR_NULL	= PTR_MAYBE_NULL | MEM_ALLOC | RET_PTR_TO_ALLOC_MEM,
499 	RET_PTR_TO_DYNPTR_MEM_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_ALLOC_MEM,
500 	RET_PTR_TO_BTF_ID_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_BTF_ID,
501 
502 	/* This must be the last entry. Its purpose is to ensure the enum is
503 	 * wide enough to hold the higher bits reserved for bpf_type_flag.
504 	 */
505 	__BPF_RET_TYPE_LIMIT	= BPF_TYPE_LIMIT,
506 };
507 static_assert(__BPF_RET_TYPE_MAX <= BPF_BASE_TYPE_LIMIT);
508 
509 /* eBPF function prototype used by verifier to allow BPF_CALLs from eBPF programs
510  * to in-kernel helper functions and for adjusting imm32 field in BPF_CALL
511  * instructions after verifying
512  */
513 struct bpf_func_proto {
514 	u64 (*func)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
515 	bool gpl_only;
516 	bool pkt_access;
517 	enum bpf_return_type ret_type;
518 	union {
519 		struct {
520 			enum bpf_arg_type arg1_type;
521 			enum bpf_arg_type arg2_type;
522 			enum bpf_arg_type arg3_type;
523 			enum bpf_arg_type arg4_type;
524 			enum bpf_arg_type arg5_type;
525 		};
526 		enum bpf_arg_type arg_type[5];
527 	};
528 	union {
529 		struct {
530 			u32 *arg1_btf_id;
531 			u32 *arg2_btf_id;
532 			u32 *arg3_btf_id;
533 			u32 *arg4_btf_id;
534 			u32 *arg5_btf_id;
535 		};
536 		u32 *arg_btf_id[5];
537 		struct {
538 			size_t arg1_size;
539 			size_t arg2_size;
540 			size_t arg3_size;
541 			size_t arg4_size;
542 			size_t arg5_size;
543 		};
544 		size_t arg_size[5];
545 	};
546 	int *ret_btf_id; /* return value btf_id */
547 	bool (*allowed)(const struct bpf_prog *prog);
548 };
549 
550 /* bpf_context is intentionally undefined structure. Pointer to bpf_context is
551  * the first argument to eBPF programs.
552  * For socket filters: 'struct bpf_context *' == 'struct sk_buff *'
553  */
554 struct bpf_context;
555 
556 enum bpf_access_type {
557 	BPF_READ = 1,
558 	BPF_WRITE = 2
559 };
560 
561 /* types of values stored in eBPF registers */
562 /* Pointer types represent:
563  * pointer
564  * pointer + imm
565  * pointer + (u16) var
566  * pointer + (u16) var + imm
567  * if (range > 0) then [ptr, ptr + range - off) is safe to access
568  * if (id > 0) means that some 'var' was added
569  * if (off > 0) means that 'imm' was added
570  */
571 enum bpf_reg_type {
572 	NOT_INIT = 0,		 /* nothing was written into register */
573 	SCALAR_VALUE,		 /* reg doesn't contain a valid pointer */
574 	PTR_TO_CTX,		 /* reg points to bpf_context */
575 	CONST_PTR_TO_MAP,	 /* reg points to struct bpf_map */
576 	PTR_TO_MAP_VALUE,	 /* reg points to map element value */
577 	PTR_TO_MAP_KEY,		 /* reg points to a map element key */
578 	PTR_TO_STACK,		 /* reg == frame_pointer + offset */
579 	PTR_TO_PACKET_META,	 /* skb->data - meta_len */
580 	PTR_TO_PACKET,		 /* reg points to skb->data */
581 	PTR_TO_PACKET_END,	 /* skb->data + headlen */
582 	PTR_TO_FLOW_KEYS,	 /* reg points to bpf_flow_keys */
583 	PTR_TO_SOCKET,		 /* reg points to struct bpf_sock */
584 	PTR_TO_SOCK_COMMON,	 /* reg points to sock_common */
585 	PTR_TO_TCP_SOCK,	 /* reg points to struct tcp_sock */
586 	PTR_TO_TP_BUFFER,	 /* reg points to a writable raw tp's buffer */
587 	PTR_TO_XDP_SOCK,	 /* reg points to struct xdp_sock */
588 	/* PTR_TO_BTF_ID points to a kernel struct that does not need
589 	 * to be null checked by the BPF program. This does not imply the
590 	 * pointer is _not_ null and in practice this can easily be a null
591 	 * pointer when reading pointer chains. The assumption is program
592 	 * context will handle null pointer dereference typically via fault
593 	 * handling. The verifier must keep this in mind and can make no
594 	 * assumptions about null or non-null when doing branch analysis.
595 	 * Further, when passed into helpers the helpers can not, without
596 	 * additional context, assume the value is non-null.
597 	 */
598 	PTR_TO_BTF_ID,
599 	/* PTR_TO_BTF_ID_OR_NULL points to a kernel struct that has not
600 	 * been checked for null. Used primarily to inform the verifier
601 	 * an explicit null check is required for this struct.
602 	 */
603 	PTR_TO_MEM,		 /* reg points to valid memory region */
604 	PTR_TO_BUF,		 /* reg points to a read/write buffer */
605 	PTR_TO_FUNC,		 /* reg points to a bpf program function */
606 	__BPF_REG_TYPE_MAX,
607 
608 	/* Extended reg_types. */
609 	PTR_TO_MAP_VALUE_OR_NULL	= PTR_MAYBE_NULL | PTR_TO_MAP_VALUE,
610 	PTR_TO_SOCKET_OR_NULL		= PTR_MAYBE_NULL | PTR_TO_SOCKET,
611 	PTR_TO_SOCK_COMMON_OR_NULL	= PTR_MAYBE_NULL | PTR_TO_SOCK_COMMON,
612 	PTR_TO_TCP_SOCK_OR_NULL		= PTR_MAYBE_NULL | PTR_TO_TCP_SOCK,
613 	PTR_TO_BTF_ID_OR_NULL		= PTR_MAYBE_NULL | PTR_TO_BTF_ID,
614 
615 	/* This must be the last entry. Its purpose is to ensure the enum is
616 	 * wide enough to hold the higher bits reserved for bpf_type_flag.
617 	 */
618 	__BPF_REG_TYPE_LIMIT	= BPF_TYPE_LIMIT,
619 };
620 static_assert(__BPF_REG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT);
621 
622 /* The information passed from prog-specific *_is_valid_access
623  * back to the verifier.
624  */
625 struct bpf_insn_access_aux {
626 	enum bpf_reg_type reg_type;
627 	union {
628 		int ctx_field_size;
629 		struct {
630 			struct btf *btf;
631 			u32 btf_id;
632 		};
633 	};
634 	struct bpf_verifier_log *log; /* for verbose logs */
635 };
636 
637 static inline void
638 bpf_ctx_record_field_size(struct bpf_insn_access_aux *aux, u32 size)
639 {
640 	aux->ctx_field_size = size;
641 }
642 
643 static inline bool bpf_pseudo_func(const struct bpf_insn *insn)
644 {
645 	return insn->code == (BPF_LD | BPF_IMM | BPF_DW) &&
646 	       insn->src_reg == BPF_PSEUDO_FUNC;
647 }
648 
649 struct bpf_prog_ops {
650 	int (*test_run)(struct bpf_prog *prog, const union bpf_attr *kattr,
651 			union bpf_attr __user *uattr);
652 };
653 
654 struct bpf_verifier_ops {
655 	/* return eBPF function prototype for verification */
656 	const struct bpf_func_proto *
657 	(*get_func_proto)(enum bpf_func_id func_id,
658 			  const struct bpf_prog *prog);
659 
660 	/* return true if 'size' wide access at offset 'off' within bpf_context
661 	 * with 'type' (read or write) is allowed
662 	 */
663 	bool (*is_valid_access)(int off, int size, enum bpf_access_type type,
664 				const struct bpf_prog *prog,
665 				struct bpf_insn_access_aux *info);
666 	int (*gen_prologue)(struct bpf_insn *insn, bool direct_write,
667 			    const struct bpf_prog *prog);
668 	int (*gen_ld_abs)(const struct bpf_insn *orig,
669 			  struct bpf_insn *insn_buf);
670 	u32 (*convert_ctx_access)(enum bpf_access_type type,
671 				  const struct bpf_insn *src,
672 				  struct bpf_insn *dst,
673 				  struct bpf_prog *prog, u32 *target_size);
674 	int (*btf_struct_access)(struct bpf_verifier_log *log,
675 				 const struct btf *btf,
676 				 const struct btf_type *t, int off, int size,
677 				 enum bpf_access_type atype,
678 				 u32 *next_btf_id, enum bpf_type_flag *flag);
679 };
680 
681 struct bpf_prog_offload_ops {
682 	/* verifier basic callbacks */
683 	int (*insn_hook)(struct bpf_verifier_env *env,
684 			 int insn_idx, int prev_insn_idx);
685 	int (*finalize)(struct bpf_verifier_env *env);
686 	/* verifier optimization callbacks (called after .finalize) */
687 	int (*replace_insn)(struct bpf_verifier_env *env, u32 off,
688 			    struct bpf_insn *insn);
689 	int (*remove_insns)(struct bpf_verifier_env *env, u32 off, u32 cnt);
690 	/* program management callbacks */
691 	int (*prepare)(struct bpf_prog *prog);
692 	int (*translate)(struct bpf_prog *prog);
693 	void (*destroy)(struct bpf_prog *prog);
694 };
695 
696 struct bpf_prog_offload {
697 	struct bpf_prog		*prog;
698 	struct net_device	*netdev;
699 	struct bpf_offload_dev	*offdev;
700 	void			*dev_priv;
701 	struct list_head	offloads;
702 	bool			dev_state;
703 	bool			opt_failed;
704 	void			*jited_image;
705 	u32			jited_len;
706 };
707 
708 enum bpf_cgroup_storage_type {
709 	BPF_CGROUP_STORAGE_SHARED,
710 	BPF_CGROUP_STORAGE_PERCPU,
711 	__BPF_CGROUP_STORAGE_MAX
712 };
713 
714 #define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX
715 
716 /* The longest tracepoint has 12 args.
717  * See include/trace/bpf_probe.h
718  */
719 #define MAX_BPF_FUNC_ARGS 12
720 
721 /* The maximum number of arguments passed through registers
722  * a single function may have.
723  */
724 #define MAX_BPF_FUNC_REG_ARGS 5
725 
726 struct btf_func_model {
727 	u8 ret_size;
728 	u8 nr_args;
729 	u8 arg_size[MAX_BPF_FUNC_ARGS];
730 };
731 
732 /* Restore arguments before returning from trampoline to let original function
733  * continue executing. This flag is used for fentry progs when there are no
734  * fexit progs.
735  */
736 #define BPF_TRAMP_F_RESTORE_REGS	BIT(0)
737 /* Call original function after fentry progs, but before fexit progs.
738  * Makes sense for fentry/fexit, normal calls and indirect calls.
739  */
740 #define BPF_TRAMP_F_CALL_ORIG		BIT(1)
741 /* Skip current frame and return to parent.  Makes sense for fentry/fexit
742  * programs only. Should not be used with normal calls and indirect calls.
743  */
744 #define BPF_TRAMP_F_SKIP_FRAME		BIT(2)
745 /* Store IP address of the caller on the trampoline stack,
746  * so it's available for trampoline's programs.
747  */
748 #define BPF_TRAMP_F_IP_ARG		BIT(3)
749 /* Return the return value of fentry prog. Only used by bpf_struct_ops. */
750 #define BPF_TRAMP_F_RET_FENTRY_RET	BIT(4)
751 
752 /* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50
753  * bytes on x86.
754  */
755 #define BPF_MAX_TRAMP_LINKS 38
756 
757 struct bpf_tramp_links {
758 	struct bpf_tramp_link *links[BPF_MAX_TRAMP_LINKS];
759 	int nr_links;
760 };
761 
762 struct bpf_tramp_run_ctx;
763 
764 /* Different use cases for BPF trampoline:
765  * 1. replace nop at the function entry (kprobe equivalent)
766  *    flags = BPF_TRAMP_F_RESTORE_REGS
767  *    fentry = a set of programs to run before returning from trampoline
768  *
769  * 2. replace nop at the function entry (kprobe + kretprobe equivalent)
770  *    flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME
771  *    orig_call = fentry_ip + MCOUNT_INSN_SIZE
772  *    fentry = a set of program to run before calling original function
773  *    fexit = a set of program to run after original function
774  *
775  * 3. replace direct call instruction anywhere in the function body
776  *    or assign a function pointer for indirect call (like tcp_congestion_ops->cong_avoid)
777  *    With flags = 0
778  *      fentry = a set of programs to run before returning from trampoline
779  *    With flags = BPF_TRAMP_F_CALL_ORIG
780  *      orig_call = original callback addr or direct function addr
781  *      fentry = a set of program to run before calling original function
782  *      fexit = a set of program to run after original function
783  */
784 struct bpf_tramp_image;
785 int arch_prepare_bpf_trampoline(struct bpf_tramp_image *tr, void *image, void *image_end,
786 				const struct btf_func_model *m, u32 flags,
787 				struct bpf_tramp_links *tlinks,
788 				void *orig_call);
789 /* these two functions are called from generated trampoline */
790 u64 notrace __bpf_prog_enter(struct bpf_prog *prog, struct bpf_tramp_run_ctx *run_ctx);
791 void notrace __bpf_prog_exit(struct bpf_prog *prog, u64 start, struct bpf_tramp_run_ctx *run_ctx);
792 u64 notrace __bpf_prog_enter_sleepable(struct bpf_prog *prog, struct bpf_tramp_run_ctx *run_ctx);
793 void notrace __bpf_prog_exit_sleepable(struct bpf_prog *prog, u64 start,
794 				       struct bpf_tramp_run_ctx *run_ctx);
795 void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr);
796 void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr);
797 
798 struct bpf_ksym {
799 	unsigned long		 start;
800 	unsigned long		 end;
801 	char			 name[KSYM_NAME_LEN];
802 	struct list_head	 lnode;
803 	struct latch_tree_node	 tnode;
804 	bool			 prog;
805 };
806 
807 enum bpf_tramp_prog_type {
808 	BPF_TRAMP_FENTRY,
809 	BPF_TRAMP_FEXIT,
810 	BPF_TRAMP_MODIFY_RETURN,
811 	BPF_TRAMP_MAX,
812 	BPF_TRAMP_REPLACE, /* more than MAX */
813 };
814 
815 struct bpf_tramp_image {
816 	void *image;
817 	struct bpf_ksym ksym;
818 	struct percpu_ref pcref;
819 	void *ip_after_call;
820 	void *ip_epilogue;
821 	union {
822 		struct rcu_head rcu;
823 		struct work_struct work;
824 	};
825 };
826 
827 struct bpf_trampoline {
828 	/* hlist for trampoline_table */
829 	struct hlist_node hlist;
830 	/* serializes access to fields of this trampoline */
831 	struct mutex mutex;
832 	refcount_t refcnt;
833 	u64 key;
834 	struct {
835 		struct btf_func_model model;
836 		void *addr;
837 		bool ftrace_managed;
838 	} func;
839 	/* if !NULL this is BPF_PROG_TYPE_EXT program that extends another BPF
840 	 * program by replacing one of its functions. func.addr is the address
841 	 * of the function it replaced.
842 	 */
843 	struct bpf_prog *extension_prog;
844 	/* list of BPF programs using this trampoline */
845 	struct hlist_head progs_hlist[BPF_TRAMP_MAX];
846 	/* Number of attached programs. A counter per kind. */
847 	int progs_cnt[BPF_TRAMP_MAX];
848 	/* Executable image of trampoline */
849 	struct bpf_tramp_image *cur_image;
850 	u64 selector;
851 	struct module *mod;
852 };
853 
854 struct bpf_attach_target_info {
855 	struct btf_func_model fmodel;
856 	long tgt_addr;
857 	const char *tgt_name;
858 	const struct btf_type *tgt_type;
859 };
860 
861 #define BPF_DISPATCHER_MAX 48 /* Fits in 2048B */
862 
863 struct bpf_dispatcher_prog {
864 	struct bpf_prog *prog;
865 	refcount_t users;
866 };
867 
868 struct bpf_dispatcher {
869 	/* dispatcher mutex */
870 	struct mutex mutex;
871 	void *func;
872 	struct bpf_dispatcher_prog progs[BPF_DISPATCHER_MAX];
873 	int num_progs;
874 	void *image;
875 	u32 image_off;
876 	struct bpf_ksym ksym;
877 };
878 
879 static __always_inline __nocfi unsigned int bpf_dispatcher_nop_func(
880 	const void *ctx,
881 	const struct bpf_insn *insnsi,
882 	unsigned int (*bpf_func)(const void *,
883 				 const struct bpf_insn *))
884 {
885 	return bpf_func(ctx, insnsi);
886 }
887 
888 #ifdef CONFIG_BPF_JIT
889 int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
890 int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
891 struct bpf_trampoline *bpf_trampoline_get(u64 key,
892 					  struct bpf_attach_target_info *tgt_info);
893 void bpf_trampoline_put(struct bpf_trampoline *tr);
894 int arch_prepare_bpf_dispatcher(void *image, s64 *funcs, int num_funcs);
895 #define BPF_DISPATCHER_INIT(_name) {				\
896 	.mutex = __MUTEX_INITIALIZER(_name.mutex),		\
897 	.func = &_name##_func,					\
898 	.progs = {},						\
899 	.num_progs = 0,						\
900 	.image = NULL,						\
901 	.image_off = 0,						\
902 	.ksym = {						\
903 		.name  = #_name,				\
904 		.lnode = LIST_HEAD_INIT(_name.ksym.lnode),	\
905 	},							\
906 }
907 
908 #define DEFINE_BPF_DISPATCHER(name)					\
909 	noinline __nocfi unsigned int bpf_dispatcher_##name##_func(	\
910 		const void *ctx,					\
911 		const struct bpf_insn *insnsi,				\
912 		unsigned int (*bpf_func)(const void *,			\
913 					 const struct bpf_insn *))	\
914 	{								\
915 		return bpf_func(ctx, insnsi);				\
916 	}								\
917 	EXPORT_SYMBOL(bpf_dispatcher_##name##_func);			\
918 	struct bpf_dispatcher bpf_dispatcher_##name =			\
919 		BPF_DISPATCHER_INIT(bpf_dispatcher_##name);
920 #define DECLARE_BPF_DISPATCHER(name)					\
921 	unsigned int bpf_dispatcher_##name##_func(			\
922 		const void *ctx,					\
923 		const struct bpf_insn *insnsi,				\
924 		unsigned int (*bpf_func)(const void *,			\
925 					 const struct bpf_insn *));	\
926 	extern struct bpf_dispatcher bpf_dispatcher_##name;
927 #define BPF_DISPATCHER_FUNC(name) bpf_dispatcher_##name##_func
928 #define BPF_DISPATCHER_PTR(name) (&bpf_dispatcher_##name)
929 void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,
930 				struct bpf_prog *to);
931 /* Called only from JIT-enabled code, so there's no need for stubs. */
932 void *bpf_jit_alloc_exec_page(void);
933 void bpf_image_ksym_add(void *data, struct bpf_ksym *ksym);
934 void bpf_image_ksym_del(struct bpf_ksym *ksym);
935 void bpf_ksym_add(struct bpf_ksym *ksym);
936 void bpf_ksym_del(struct bpf_ksym *ksym);
937 int bpf_jit_charge_modmem(u32 size);
938 void bpf_jit_uncharge_modmem(u32 size);
939 bool bpf_prog_has_trampoline(const struct bpf_prog *prog);
940 #else
941 static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
942 					   struct bpf_trampoline *tr)
943 {
944 	return -ENOTSUPP;
945 }
946 static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
947 					     struct bpf_trampoline *tr)
948 {
949 	return -ENOTSUPP;
950 }
951 static inline struct bpf_trampoline *bpf_trampoline_get(u64 key,
952 							struct bpf_attach_target_info *tgt_info)
953 {
954 	return ERR_PTR(-EOPNOTSUPP);
955 }
956 static inline void bpf_trampoline_put(struct bpf_trampoline *tr) {}
957 #define DEFINE_BPF_DISPATCHER(name)
958 #define DECLARE_BPF_DISPATCHER(name)
959 #define BPF_DISPATCHER_FUNC(name) bpf_dispatcher_nop_func
960 #define BPF_DISPATCHER_PTR(name) NULL
961 static inline void bpf_dispatcher_change_prog(struct bpf_dispatcher *d,
962 					      struct bpf_prog *from,
963 					      struct bpf_prog *to) {}
964 static inline bool is_bpf_image_address(unsigned long address)
965 {
966 	return false;
967 }
968 static inline bool bpf_prog_has_trampoline(const struct bpf_prog *prog)
969 {
970 	return false;
971 }
972 #endif
973 
974 struct bpf_func_info_aux {
975 	u16 linkage;
976 	bool unreliable;
977 };
978 
979 enum bpf_jit_poke_reason {
980 	BPF_POKE_REASON_TAIL_CALL,
981 };
982 
983 /* Descriptor of pokes pointing /into/ the JITed image. */
984 struct bpf_jit_poke_descriptor {
985 	void *tailcall_target;
986 	void *tailcall_bypass;
987 	void *bypass_addr;
988 	void *aux;
989 	union {
990 		struct {
991 			struct bpf_map *map;
992 			u32 key;
993 		} tail_call;
994 	};
995 	bool tailcall_target_stable;
996 	u8 adj_off;
997 	u16 reason;
998 	u32 insn_idx;
999 };
1000 
1001 /* reg_type info for ctx arguments */
1002 struct bpf_ctx_arg_aux {
1003 	u32 offset;
1004 	enum bpf_reg_type reg_type;
1005 	u32 btf_id;
1006 };
1007 
1008 struct btf_mod_pair {
1009 	struct btf *btf;
1010 	struct module *module;
1011 };
1012 
1013 struct bpf_kfunc_desc_tab;
1014 
1015 struct bpf_prog_aux {
1016 	atomic64_t refcnt;
1017 	u32 used_map_cnt;
1018 	u32 used_btf_cnt;
1019 	u32 max_ctx_offset;
1020 	u32 max_pkt_offset;
1021 	u32 max_tp_access;
1022 	u32 stack_depth;
1023 	u32 id;
1024 	u32 func_cnt; /* used by non-func prog as the number of func progs */
1025 	u32 func_idx; /* 0 for non-func prog, the index in func array for func prog */
1026 	u32 attach_btf_id; /* in-kernel BTF type id to attach to */
1027 	u32 ctx_arg_info_size;
1028 	u32 max_rdonly_access;
1029 	u32 max_rdwr_access;
1030 	struct btf *attach_btf;
1031 	const struct bpf_ctx_arg_aux *ctx_arg_info;
1032 	struct mutex dst_mutex; /* protects dst_* pointers below, *after* prog becomes visible */
1033 	struct bpf_prog *dst_prog;
1034 	struct bpf_trampoline *dst_trampoline;
1035 	enum bpf_prog_type saved_dst_prog_type;
1036 	enum bpf_attach_type saved_dst_attach_type;
1037 	bool verifier_zext; /* Zero extensions has been inserted by verifier. */
1038 	bool offload_requested;
1039 	bool attach_btf_trace; /* true if attaching to BTF-enabled raw tp */
1040 	bool func_proto_unreliable;
1041 	bool sleepable;
1042 	bool tail_call_reachable;
1043 	bool xdp_has_frags;
1044 	bool use_bpf_prog_pack;
1045 	/* BTF_KIND_FUNC_PROTO for valid attach_btf_id */
1046 	const struct btf_type *attach_func_proto;
1047 	/* function name for valid attach_btf_id */
1048 	const char *attach_func_name;
1049 	struct bpf_prog **func;
1050 	void *jit_data; /* JIT specific data. arch dependent */
1051 	struct bpf_jit_poke_descriptor *poke_tab;
1052 	struct bpf_kfunc_desc_tab *kfunc_tab;
1053 	struct bpf_kfunc_btf_tab *kfunc_btf_tab;
1054 	u32 size_poke_tab;
1055 	struct bpf_ksym ksym;
1056 	const struct bpf_prog_ops *ops;
1057 	struct bpf_map **used_maps;
1058 	struct mutex used_maps_mutex; /* mutex for used_maps and used_map_cnt */
1059 	struct btf_mod_pair *used_btfs;
1060 	struct bpf_prog *prog;
1061 	struct user_struct *user;
1062 	u64 load_time; /* ns since boottime */
1063 	u32 verified_insns;
1064 	struct bpf_map *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE];
1065 	char name[BPF_OBJ_NAME_LEN];
1066 #ifdef CONFIG_SECURITY
1067 	void *security;
1068 #endif
1069 	struct bpf_prog_offload *offload;
1070 	struct btf *btf;
1071 	struct bpf_func_info *func_info;
1072 	struct bpf_func_info_aux *func_info_aux;
1073 	/* bpf_line_info loaded from userspace.  linfo->insn_off
1074 	 * has the xlated insn offset.
1075 	 * Both the main and sub prog share the same linfo.
1076 	 * The subprog can access its first linfo by
1077 	 * using the linfo_idx.
1078 	 */
1079 	struct bpf_line_info *linfo;
1080 	/* jited_linfo is the jited addr of the linfo.  It has a
1081 	 * one to one mapping to linfo:
1082 	 * jited_linfo[i] is the jited addr for the linfo[i]->insn_off.
1083 	 * Both the main and sub prog share the same jited_linfo.
1084 	 * The subprog can access its first jited_linfo by
1085 	 * using the linfo_idx.
1086 	 */
1087 	void **jited_linfo;
1088 	u32 func_info_cnt;
1089 	u32 nr_linfo;
1090 	/* subprog can use linfo_idx to access its first linfo and
1091 	 * jited_linfo.
1092 	 * main prog always has linfo_idx == 0
1093 	 */
1094 	u32 linfo_idx;
1095 	u32 num_exentries;
1096 	struct exception_table_entry *extable;
1097 	union {
1098 		struct work_struct work;
1099 		struct rcu_head	rcu;
1100 	};
1101 };
1102 
1103 struct bpf_prog {
1104 	u16			pages;		/* Number of allocated pages */
1105 	u16			jited:1,	/* Is our filter JIT'ed? */
1106 				jit_requested:1,/* archs need to JIT the prog */
1107 				gpl_compatible:1, /* Is filter GPL compatible? */
1108 				cb_access:1,	/* Is control block accessed? */
1109 				dst_needed:1,	/* Do we need dst entry? */
1110 				blinding_requested:1, /* needs constant blinding */
1111 				blinded:1,	/* Was blinded */
1112 				is_func:1,	/* program is a bpf function */
1113 				kprobe_override:1, /* Do we override a kprobe? */
1114 				has_callchain_buf:1, /* callchain buffer allocated? */
1115 				enforce_expected_attach_type:1, /* Enforce expected_attach_type checking at attach time */
1116 				call_get_stack:1, /* Do we call bpf_get_stack() or bpf_get_stackid() */
1117 				call_get_func_ip:1, /* Do we call get_func_ip() */
1118 				tstamp_type_access:1; /* Accessed __sk_buff->tstamp_type */
1119 	enum bpf_prog_type	type;		/* Type of BPF program */
1120 	enum bpf_attach_type	expected_attach_type; /* For some prog types */
1121 	u32			len;		/* Number of filter blocks */
1122 	u32			jited_len;	/* Size of jited insns in bytes */
1123 	u8			tag[BPF_TAG_SIZE];
1124 	struct bpf_prog_stats __percpu *stats;
1125 	int __percpu		*active;
1126 	unsigned int		(*bpf_func)(const void *ctx,
1127 					    const struct bpf_insn *insn);
1128 	struct bpf_prog_aux	*aux;		/* Auxiliary fields */
1129 	struct sock_fprog_kern	*orig_prog;	/* Original BPF program */
1130 	/* Instructions for interpreter */
1131 	union {
1132 		DECLARE_FLEX_ARRAY(struct sock_filter, insns);
1133 		DECLARE_FLEX_ARRAY(struct bpf_insn, insnsi);
1134 	};
1135 };
1136 
1137 struct bpf_array_aux {
1138 	/* Programs with direct jumps into programs part of this array. */
1139 	struct list_head poke_progs;
1140 	struct bpf_map *map;
1141 	struct mutex poke_mutex;
1142 	struct work_struct work;
1143 };
1144 
1145 struct bpf_link {
1146 	atomic64_t refcnt;
1147 	u32 id;
1148 	enum bpf_link_type type;
1149 	const struct bpf_link_ops *ops;
1150 	struct bpf_prog *prog;
1151 	struct work_struct work;
1152 };
1153 
1154 struct bpf_link_ops {
1155 	void (*release)(struct bpf_link *link);
1156 	void (*dealloc)(struct bpf_link *link);
1157 	int (*detach)(struct bpf_link *link);
1158 	int (*update_prog)(struct bpf_link *link, struct bpf_prog *new_prog,
1159 			   struct bpf_prog *old_prog);
1160 	void (*show_fdinfo)(const struct bpf_link *link, struct seq_file *seq);
1161 	int (*fill_link_info)(const struct bpf_link *link,
1162 			      struct bpf_link_info *info);
1163 };
1164 
1165 struct bpf_tramp_link {
1166 	struct bpf_link link;
1167 	struct hlist_node tramp_hlist;
1168 	u64 cookie;
1169 };
1170 
1171 struct bpf_tracing_link {
1172 	struct bpf_tramp_link link;
1173 	enum bpf_attach_type attach_type;
1174 	struct bpf_trampoline *trampoline;
1175 	struct bpf_prog *tgt_prog;
1176 };
1177 
1178 struct bpf_link_primer {
1179 	struct bpf_link *link;
1180 	struct file *file;
1181 	int fd;
1182 	u32 id;
1183 };
1184 
1185 struct bpf_struct_ops_value;
1186 struct btf_member;
1187 
1188 #define BPF_STRUCT_OPS_MAX_NR_MEMBERS 64
1189 struct bpf_struct_ops {
1190 	const struct bpf_verifier_ops *verifier_ops;
1191 	int (*init)(struct btf *btf);
1192 	int (*check_member)(const struct btf_type *t,
1193 			    const struct btf_member *member);
1194 	int (*init_member)(const struct btf_type *t,
1195 			   const struct btf_member *member,
1196 			   void *kdata, const void *udata);
1197 	int (*reg)(void *kdata);
1198 	void (*unreg)(void *kdata);
1199 	const struct btf_type *type;
1200 	const struct btf_type *value_type;
1201 	const char *name;
1202 	struct btf_func_model func_models[BPF_STRUCT_OPS_MAX_NR_MEMBERS];
1203 	u32 type_id;
1204 	u32 value_id;
1205 };
1206 
1207 #if defined(CONFIG_BPF_JIT) && defined(CONFIG_BPF_SYSCALL)
1208 #define BPF_MODULE_OWNER ((void *)((0xeB9FUL << 2) + POISON_POINTER_DELTA))
1209 const struct bpf_struct_ops *bpf_struct_ops_find(u32 type_id);
1210 void bpf_struct_ops_init(struct btf *btf, struct bpf_verifier_log *log);
1211 bool bpf_struct_ops_get(const void *kdata);
1212 void bpf_struct_ops_put(const void *kdata);
1213 int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map, void *key,
1214 				       void *value);
1215 int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_links *tlinks,
1216 				      struct bpf_tramp_link *link,
1217 				      const struct btf_func_model *model,
1218 				      void *image, void *image_end);
1219 static inline bool bpf_try_module_get(const void *data, struct module *owner)
1220 {
1221 	if (owner == BPF_MODULE_OWNER)
1222 		return bpf_struct_ops_get(data);
1223 	else
1224 		return try_module_get(owner);
1225 }
1226 static inline void bpf_module_put(const void *data, struct module *owner)
1227 {
1228 	if (owner == BPF_MODULE_OWNER)
1229 		bpf_struct_ops_put(data);
1230 	else
1231 		module_put(owner);
1232 }
1233 
1234 #ifdef CONFIG_NET
1235 /* Define it here to avoid the use of forward declaration */
1236 struct bpf_dummy_ops_state {
1237 	int val;
1238 };
1239 
1240 struct bpf_dummy_ops {
1241 	int (*test_1)(struct bpf_dummy_ops_state *cb);
1242 	int (*test_2)(struct bpf_dummy_ops_state *cb, int a1, unsigned short a2,
1243 		      char a3, unsigned long a4);
1244 };
1245 
1246 int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,
1247 			    union bpf_attr __user *uattr);
1248 #endif
1249 #else
1250 static inline const struct bpf_struct_ops *bpf_struct_ops_find(u32 type_id)
1251 {
1252 	return NULL;
1253 }
1254 static inline void bpf_struct_ops_init(struct btf *btf,
1255 				       struct bpf_verifier_log *log)
1256 {
1257 }
1258 static inline bool bpf_try_module_get(const void *data, struct module *owner)
1259 {
1260 	return try_module_get(owner);
1261 }
1262 static inline void bpf_module_put(const void *data, struct module *owner)
1263 {
1264 	module_put(owner);
1265 }
1266 static inline int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map,
1267 						     void *key,
1268 						     void *value)
1269 {
1270 	return -EINVAL;
1271 }
1272 #endif
1273 
1274 struct bpf_array {
1275 	struct bpf_map map;
1276 	u32 elem_size;
1277 	u32 index_mask;
1278 	struct bpf_array_aux *aux;
1279 	union {
1280 		char value[0] __aligned(8);
1281 		void *ptrs[0] __aligned(8);
1282 		void __percpu *pptrs[0] __aligned(8);
1283 	};
1284 };
1285 
1286 #define BPF_COMPLEXITY_LIMIT_INSNS      1000000 /* yes. 1M insns */
1287 #define MAX_TAIL_CALL_CNT 33
1288 
1289 #define BPF_F_ACCESS_MASK	(BPF_F_RDONLY |		\
1290 				 BPF_F_RDONLY_PROG |	\
1291 				 BPF_F_WRONLY |		\
1292 				 BPF_F_WRONLY_PROG)
1293 
1294 #define BPF_MAP_CAN_READ	BIT(0)
1295 #define BPF_MAP_CAN_WRITE	BIT(1)
1296 
1297 static inline u32 bpf_map_flags_to_cap(struct bpf_map *map)
1298 {
1299 	u32 access_flags = map->map_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG);
1300 
1301 	/* Combination of BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG is
1302 	 * not possible.
1303 	 */
1304 	if (access_flags & BPF_F_RDONLY_PROG)
1305 		return BPF_MAP_CAN_READ;
1306 	else if (access_flags & BPF_F_WRONLY_PROG)
1307 		return BPF_MAP_CAN_WRITE;
1308 	else
1309 		return BPF_MAP_CAN_READ | BPF_MAP_CAN_WRITE;
1310 }
1311 
1312 static inline bool bpf_map_flags_access_ok(u32 access_flags)
1313 {
1314 	return (access_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG)) !=
1315 	       (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG);
1316 }
1317 
1318 struct bpf_event_entry {
1319 	struct perf_event *event;
1320 	struct file *perf_file;
1321 	struct file *map_file;
1322 	struct rcu_head rcu;
1323 };
1324 
1325 static inline bool map_type_contains_progs(struct bpf_map *map)
1326 {
1327 	return map->map_type == BPF_MAP_TYPE_PROG_ARRAY ||
1328 	       map->map_type == BPF_MAP_TYPE_DEVMAP ||
1329 	       map->map_type == BPF_MAP_TYPE_CPUMAP;
1330 }
1331 
1332 bool bpf_prog_map_compatible(struct bpf_map *map, const struct bpf_prog *fp);
1333 int bpf_prog_calc_tag(struct bpf_prog *fp);
1334 
1335 const struct bpf_func_proto *bpf_get_trace_printk_proto(void);
1336 const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void);
1337 
1338 typedef unsigned long (*bpf_ctx_copy_t)(void *dst, const void *src,
1339 					unsigned long off, unsigned long len);
1340 typedef u32 (*bpf_convert_ctx_access_t)(enum bpf_access_type type,
1341 					const struct bpf_insn *src,
1342 					struct bpf_insn *dst,
1343 					struct bpf_prog *prog,
1344 					u32 *target_size);
1345 
1346 u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size,
1347 		     void *ctx, u64 ctx_size, bpf_ctx_copy_t ctx_copy);
1348 
1349 /* an array of programs to be executed under rcu_lock.
1350  *
1351  * Typical usage:
1352  * ret = bpf_prog_run_array(rcu_dereference(&bpf_prog_array), ctx, bpf_prog_run);
1353  *
1354  * the structure returned by bpf_prog_array_alloc() should be populated
1355  * with program pointers and the last pointer must be NULL.
1356  * The user has to keep refcnt on the program and make sure the program
1357  * is removed from the array before bpf_prog_put().
1358  * The 'struct bpf_prog_array *' should only be replaced with xchg()
1359  * since other cpus are walking the array of pointers in parallel.
1360  */
1361 struct bpf_prog_array_item {
1362 	struct bpf_prog *prog;
1363 	union {
1364 		struct bpf_cgroup_storage *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE];
1365 		u64 bpf_cookie;
1366 	};
1367 };
1368 
1369 struct bpf_prog_array {
1370 	struct rcu_head rcu;
1371 	struct bpf_prog_array_item items[];
1372 };
1373 
1374 struct bpf_empty_prog_array {
1375 	struct bpf_prog_array hdr;
1376 	struct bpf_prog *null_prog;
1377 };
1378 
1379 /* to avoid allocating empty bpf_prog_array for cgroups that
1380  * don't have bpf program attached use one global 'bpf_empty_prog_array'
1381  * It will not be modified the caller of bpf_prog_array_alloc()
1382  * (since caller requested prog_cnt == 0)
1383  * that pointer should be 'freed' by bpf_prog_array_free()
1384  */
1385 extern struct bpf_empty_prog_array bpf_empty_prog_array;
1386 
1387 struct bpf_prog_array *bpf_prog_array_alloc(u32 prog_cnt, gfp_t flags);
1388 void bpf_prog_array_free(struct bpf_prog_array *progs);
1389 /* Use when traversal over the bpf_prog_array uses tasks_trace rcu */
1390 void bpf_prog_array_free_sleepable(struct bpf_prog_array *progs);
1391 int bpf_prog_array_length(struct bpf_prog_array *progs);
1392 bool bpf_prog_array_is_empty(struct bpf_prog_array *array);
1393 int bpf_prog_array_copy_to_user(struct bpf_prog_array *progs,
1394 				__u32 __user *prog_ids, u32 cnt);
1395 
1396 void bpf_prog_array_delete_safe(struct bpf_prog_array *progs,
1397 				struct bpf_prog *old_prog);
1398 int bpf_prog_array_delete_safe_at(struct bpf_prog_array *array, int index);
1399 int bpf_prog_array_update_at(struct bpf_prog_array *array, int index,
1400 			     struct bpf_prog *prog);
1401 int bpf_prog_array_copy_info(struct bpf_prog_array *array,
1402 			     u32 *prog_ids, u32 request_cnt,
1403 			     u32 *prog_cnt);
1404 int bpf_prog_array_copy(struct bpf_prog_array *old_array,
1405 			struct bpf_prog *exclude_prog,
1406 			struct bpf_prog *include_prog,
1407 			u64 bpf_cookie,
1408 			struct bpf_prog_array **new_array);
1409 
1410 struct bpf_run_ctx {};
1411 
1412 struct bpf_cg_run_ctx {
1413 	struct bpf_run_ctx run_ctx;
1414 	const struct bpf_prog_array_item *prog_item;
1415 	int retval;
1416 };
1417 
1418 struct bpf_trace_run_ctx {
1419 	struct bpf_run_ctx run_ctx;
1420 	u64 bpf_cookie;
1421 };
1422 
1423 struct bpf_tramp_run_ctx {
1424 	struct bpf_run_ctx run_ctx;
1425 	u64 bpf_cookie;
1426 	struct bpf_run_ctx *saved_run_ctx;
1427 };
1428 
1429 static inline struct bpf_run_ctx *bpf_set_run_ctx(struct bpf_run_ctx *new_ctx)
1430 {
1431 	struct bpf_run_ctx *old_ctx = NULL;
1432 
1433 #ifdef CONFIG_BPF_SYSCALL
1434 	old_ctx = current->bpf_ctx;
1435 	current->bpf_ctx = new_ctx;
1436 #endif
1437 	return old_ctx;
1438 }
1439 
1440 static inline void bpf_reset_run_ctx(struct bpf_run_ctx *old_ctx)
1441 {
1442 #ifdef CONFIG_BPF_SYSCALL
1443 	current->bpf_ctx = old_ctx;
1444 #endif
1445 }
1446 
1447 /* BPF program asks to bypass CAP_NET_BIND_SERVICE in bind. */
1448 #define BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE			(1 << 0)
1449 /* BPF program asks to set CN on the packet. */
1450 #define BPF_RET_SET_CN						(1 << 0)
1451 
1452 typedef u32 (*bpf_prog_run_fn)(const struct bpf_prog *prog, const void *ctx);
1453 
1454 static __always_inline u32
1455 bpf_prog_run_array(const struct bpf_prog_array *array,
1456 		   const void *ctx, bpf_prog_run_fn run_prog)
1457 {
1458 	const struct bpf_prog_array_item *item;
1459 	const struct bpf_prog *prog;
1460 	struct bpf_run_ctx *old_run_ctx;
1461 	struct bpf_trace_run_ctx run_ctx;
1462 	u32 ret = 1;
1463 
1464 	RCU_LOCKDEP_WARN(!rcu_read_lock_held(), "no rcu lock held");
1465 
1466 	if (unlikely(!array))
1467 		return ret;
1468 
1469 	migrate_disable();
1470 	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
1471 	item = &array->items[0];
1472 	while ((prog = READ_ONCE(item->prog))) {
1473 		run_ctx.bpf_cookie = item->bpf_cookie;
1474 		ret &= run_prog(prog, ctx);
1475 		item++;
1476 	}
1477 	bpf_reset_run_ctx(old_run_ctx);
1478 	migrate_enable();
1479 	return ret;
1480 }
1481 
1482 /* Notes on RCU design for bpf_prog_arrays containing sleepable programs:
1483  *
1484  * We use the tasks_trace rcu flavor read section to protect the bpf_prog_array
1485  * overall. As a result, we must use the bpf_prog_array_free_sleepable
1486  * in order to use the tasks_trace rcu grace period.
1487  *
1488  * When a non-sleepable program is inside the array, we take the rcu read
1489  * section and disable preemption for that program alone, so it can access
1490  * rcu-protected dynamically sized maps.
1491  */
1492 static __always_inline u32
1493 bpf_prog_run_array_sleepable(const struct bpf_prog_array __rcu *array_rcu,
1494 			     const void *ctx, bpf_prog_run_fn run_prog)
1495 {
1496 	const struct bpf_prog_array_item *item;
1497 	const struct bpf_prog *prog;
1498 	const struct bpf_prog_array *array;
1499 	struct bpf_run_ctx *old_run_ctx;
1500 	struct bpf_trace_run_ctx run_ctx;
1501 	u32 ret = 1;
1502 
1503 	might_fault();
1504 
1505 	rcu_read_lock_trace();
1506 	migrate_disable();
1507 
1508 	array = rcu_dereference_check(array_rcu, rcu_read_lock_trace_held());
1509 	if (unlikely(!array))
1510 		goto out;
1511 	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
1512 	item = &array->items[0];
1513 	while ((prog = READ_ONCE(item->prog))) {
1514 		if (!prog->aux->sleepable)
1515 			rcu_read_lock();
1516 
1517 		run_ctx.bpf_cookie = item->bpf_cookie;
1518 		ret &= run_prog(prog, ctx);
1519 		item++;
1520 
1521 		if (!prog->aux->sleepable)
1522 			rcu_read_unlock();
1523 	}
1524 	bpf_reset_run_ctx(old_run_ctx);
1525 out:
1526 	migrate_enable();
1527 	rcu_read_unlock_trace();
1528 	return ret;
1529 }
1530 
1531 #ifdef CONFIG_BPF_SYSCALL
1532 DECLARE_PER_CPU(int, bpf_prog_active);
1533 extern struct mutex bpf_stats_enabled_mutex;
1534 
1535 /*
1536  * Block execution of BPF programs attached to instrumentation (perf,
1537  * kprobes, tracepoints) to prevent deadlocks on map operations as any of
1538  * these events can happen inside a region which holds a map bucket lock
1539  * and can deadlock on it.
1540  */
1541 static inline void bpf_disable_instrumentation(void)
1542 {
1543 	migrate_disable();
1544 	this_cpu_inc(bpf_prog_active);
1545 }
1546 
1547 static inline void bpf_enable_instrumentation(void)
1548 {
1549 	this_cpu_dec(bpf_prog_active);
1550 	migrate_enable();
1551 }
1552 
1553 extern const struct file_operations bpf_map_fops;
1554 extern const struct file_operations bpf_prog_fops;
1555 extern const struct file_operations bpf_iter_fops;
1556 
1557 #define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
1558 	extern const struct bpf_prog_ops _name ## _prog_ops; \
1559 	extern const struct bpf_verifier_ops _name ## _verifier_ops;
1560 #define BPF_MAP_TYPE(_id, _ops) \
1561 	extern const struct bpf_map_ops _ops;
1562 #define BPF_LINK_TYPE(_id, _name)
1563 #include <linux/bpf_types.h>
1564 #undef BPF_PROG_TYPE
1565 #undef BPF_MAP_TYPE
1566 #undef BPF_LINK_TYPE
1567 
1568 extern const struct bpf_prog_ops bpf_offload_prog_ops;
1569 extern const struct bpf_verifier_ops tc_cls_act_analyzer_ops;
1570 extern const struct bpf_verifier_ops xdp_analyzer_ops;
1571 
1572 struct bpf_prog *bpf_prog_get(u32 ufd);
1573 struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
1574 				       bool attach_drv);
1575 void bpf_prog_add(struct bpf_prog *prog, int i);
1576 void bpf_prog_sub(struct bpf_prog *prog, int i);
1577 void bpf_prog_inc(struct bpf_prog *prog);
1578 struct bpf_prog * __must_check bpf_prog_inc_not_zero(struct bpf_prog *prog);
1579 void bpf_prog_put(struct bpf_prog *prog);
1580 
1581 void bpf_prog_free_id(struct bpf_prog *prog, bool do_idr_lock);
1582 void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock);
1583 
1584 struct bpf_map_value_off_desc *bpf_map_kptr_off_contains(struct bpf_map *map, u32 offset);
1585 void bpf_map_free_kptr_off_tab(struct bpf_map *map);
1586 struct bpf_map_value_off *bpf_map_copy_kptr_off_tab(const struct bpf_map *map);
1587 bool bpf_map_equal_kptr_off_tab(const struct bpf_map *map_a, const struct bpf_map *map_b);
1588 void bpf_map_free_kptrs(struct bpf_map *map, void *map_value);
1589 
1590 struct bpf_map *bpf_map_get(u32 ufd);
1591 struct bpf_map *bpf_map_get_with_uref(u32 ufd);
1592 struct bpf_map *__bpf_map_get(struct fd f);
1593 void bpf_map_inc(struct bpf_map *map);
1594 void bpf_map_inc_with_uref(struct bpf_map *map);
1595 struct bpf_map * __must_check bpf_map_inc_not_zero(struct bpf_map *map);
1596 void bpf_map_put_with_uref(struct bpf_map *map);
1597 void bpf_map_put(struct bpf_map *map);
1598 void *bpf_map_area_alloc(u64 size, int numa_node);
1599 void *bpf_map_area_mmapable_alloc(u64 size, int numa_node);
1600 void bpf_map_area_free(void *base);
1601 bool bpf_map_write_active(const struct bpf_map *map);
1602 void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr);
1603 int  generic_map_lookup_batch(struct bpf_map *map,
1604 			      const union bpf_attr *attr,
1605 			      union bpf_attr __user *uattr);
1606 int  generic_map_update_batch(struct bpf_map *map,
1607 			      const union bpf_attr *attr,
1608 			      union bpf_attr __user *uattr);
1609 int  generic_map_delete_batch(struct bpf_map *map,
1610 			      const union bpf_attr *attr,
1611 			      union bpf_attr __user *uattr);
1612 struct bpf_map *bpf_map_get_curr_or_next(u32 *id);
1613 struct bpf_prog *bpf_prog_get_curr_or_next(u32 *id);
1614 
1615 #ifdef CONFIG_MEMCG_KMEM
1616 void *bpf_map_kmalloc_node(const struct bpf_map *map, size_t size, gfp_t flags,
1617 			   int node);
1618 void *bpf_map_kzalloc(const struct bpf_map *map, size_t size, gfp_t flags);
1619 void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
1620 				    size_t align, gfp_t flags);
1621 #else
1622 static inline void *
1623 bpf_map_kmalloc_node(const struct bpf_map *map, size_t size, gfp_t flags,
1624 		     int node)
1625 {
1626 	return kmalloc_node(size, flags, node);
1627 }
1628 
1629 static inline void *
1630 bpf_map_kzalloc(const struct bpf_map *map, size_t size, gfp_t flags)
1631 {
1632 	return kzalloc(size, flags);
1633 }
1634 
1635 static inline void __percpu *
1636 bpf_map_alloc_percpu(const struct bpf_map *map, size_t size, size_t align,
1637 		     gfp_t flags)
1638 {
1639 	return __alloc_percpu_gfp(size, align, flags);
1640 }
1641 #endif
1642 
1643 extern int sysctl_unprivileged_bpf_disabled;
1644 
1645 static inline bool bpf_allow_ptr_leaks(void)
1646 {
1647 	return perfmon_capable();
1648 }
1649 
1650 static inline bool bpf_allow_uninit_stack(void)
1651 {
1652 	return perfmon_capable();
1653 }
1654 
1655 static inline bool bpf_allow_ptr_to_map_access(void)
1656 {
1657 	return perfmon_capable();
1658 }
1659 
1660 static inline bool bpf_bypass_spec_v1(void)
1661 {
1662 	return perfmon_capable();
1663 }
1664 
1665 static inline bool bpf_bypass_spec_v4(void)
1666 {
1667 	return perfmon_capable();
1668 }
1669 
1670 int bpf_map_new_fd(struct bpf_map *map, int flags);
1671 int bpf_prog_new_fd(struct bpf_prog *prog);
1672 
1673 void bpf_link_init(struct bpf_link *link, enum bpf_link_type type,
1674 		   const struct bpf_link_ops *ops, struct bpf_prog *prog);
1675 int bpf_link_prime(struct bpf_link *link, struct bpf_link_primer *primer);
1676 int bpf_link_settle(struct bpf_link_primer *primer);
1677 void bpf_link_cleanup(struct bpf_link_primer *primer);
1678 void bpf_link_inc(struct bpf_link *link);
1679 void bpf_link_put(struct bpf_link *link);
1680 int bpf_link_new_fd(struct bpf_link *link);
1681 struct file *bpf_link_new_file(struct bpf_link *link, int *reserved_fd);
1682 struct bpf_link *bpf_link_get_from_fd(u32 ufd);
1683 struct bpf_link *bpf_link_get_curr_or_next(u32 *id);
1684 
1685 int bpf_obj_pin_user(u32 ufd, const char __user *pathname);
1686 int bpf_obj_get_user(const char __user *pathname, int flags);
1687 
1688 #define BPF_ITER_FUNC_PREFIX "bpf_iter_"
1689 #define DEFINE_BPF_ITER_FUNC(target, args...)			\
1690 	extern int bpf_iter_ ## target(args);			\
1691 	int __init bpf_iter_ ## target(args) { return 0; }
1692 
1693 struct bpf_iter_aux_info {
1694 	struct bpf_map *map;
1695 };
1696 
1697 typedef int (*bpf_iter_attach_target_t)(struct bpf_prog *prog,
1698 					union bpf_iter_link_info *linfo,
1699 					struct bpf_iter_aux_info *aux);
1700 typedef void (*bpf_iter_detach_target_t)(struct bpf_iter_aux_info *aux);
1701 typedef void (*bpf_iter_show_fdinfo_t) (const struct bpf_iter_aux_info *aux,
1702 					struct seq_file *seq);
1703 typedef int (*bpf_iter_fill_link_info_t)(const struct bpf_iter_aux_info *aux,
1704 					 struct bpf_link_info *info);
1705 typedef const struct bpf_func_proto *
1706 (*bpf_iter_get_func_proto_t)(enum bpf_func_id func_id,
1707 			     const struct bpf_prog *prog);
1708 
1709 enum bpf_iter_feature {
1710 	BPF_ITER_RESCHED	= BIT(0),
1711 };
1712 
1713 #define BPF_ITER_CTX_ARG_MAX 2
1714 struct bpf_iter_reg {
1715 	const char *target;
1716 	bpf_iter_attach_target_t attach_target;
1717 	bpf_iter_detach_target_t detach_target;
1718 	bpf_iter_show_fdinfo_t show_fdinfo;
1719 	bpf_iter_fill_link_info_t fill_link_info;
1720 	bpf_iter_get_func_proto_t get_func_proto;
1721 	u32 ctx_arg_info_size;
1722 	u32 feature;
1723 	struct bpf_ctx_arg_aux ctx_arg_info[BPF_ITER_CTX_ARG_MAX];
1724 	const struct bpf_iter_seq_info *seq_info;
1725 };
1726 
1727 struct bpf_iter_meta {
1728 	__bpf_md_ptr(struct seq_file *, seq);
1729 	u64 session_id;
1730 	u64 seq_num;
1731 };
1732 
1733 struct bpf_iter__bpf_map_elem {
1734 	__bpf_md_ptr(struct bpf_iter_meta *, meta);
1735 	__bpf_md_ptr(struct bpf_map *, map);
1736 	__bpf_md_ptr(void *, key);
1737 	__bpf_md_ptr(void *, value);
1738 };
1739 
1740 int bpf_iter_reg_target(const struct bpf_iter_reg *reg_info);
1741 void bpf_iter_unreg_target(const struct bpf_iter_reg *reg_info);
1742 bool bpf_iter_prog_supported(struct bpf_prog *prog);
1743 const struct bpf_func_proto *
1744 bpf_iter_get_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
1745 int bpf_iter_link_attach(const union bpf_attr *attr, bpfptr_t uattr, struct bpf_prog *prog);
1746 int bpf_iter_new_fd(struct bpf_link *link);
1747 bool bpf_link_is_iter(struct bpf_link *link);
1748 struct bpf_prog *bpf_iter_get_info(struct bpf_iter_meta *meta, bool in_stop);
1749 int bpf_iter_run_prog(struct bpf_prog *prog, void *ctx);
1750 void bpf_iter_map_show_fdinfo(const struct bpf_iter_aux_info *aux,
1751 			      struct seq_file *seq);
1752 int bpf_iter_map_fill_link_info(const struct bpf_iter_aux_info *aux,
1753 				struct bpf_link_info *info);
1754 
1755 int map_set_for_each_callback_args(struct bpf_verifier_env *env,
1756 				   struct bpf_func_state *caller,
1757 				   struct bpf_func_state *callee);
1758 
1759 int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value);
1760 int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value);
1761 int bpf_percpu_hash_update(struct bpf_map *map, void *key, void *value,
1762 			   u64 flags);
1763 int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
1764 			    u64 flags);
1765 
1766 int bpf_stackmap_copy(struct bpf_map *map, void *key, void *value);
1767 
1768 int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
1769 				 void *key, void *value, u64 map_flags);
1770 int bpf_fd_array_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);
1771 int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
1772 				void *key, void *value, u64 map_flags);
1773 int bpf_fd_htab_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);
1774 
1775 int bpf_get_file_flag(int flags);
1776 int bpf_check_uarg_tail_zero(bpfptr_t uaddr, size_t expected_size,
1777 			     size_t actual_size);
1778 
1779 /* memcpy that is used with 8-byte aligned pointers, power-of-8 size and
1780  * forced to use 'long' read/writes to try to atomically copy long counters.
1781  * Best-effort only.  No barriers here, since it _will_ race with concurrent
1782  * updates from BPF programs. Called from bpf syscall and mostly used with
1783  * size 8 or 16 bytes, so ask compiler to inline it.
1784  */
1785 static inline void bpf_long_memcpy(void *dst, const void *src, u32 size)
1786 {
1787 	const long *lsrc = src;
1788 	long *ldst = dst;
1789 
1790 	size /= sizeof(long);
1791 	while (size--)
1792 		*ldst++ = *lsrc++;
1793 }
1794 
1795 /* verify correctness of eBPF program */
1796 int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr);
1797 
1798 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
1799 void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);
1800 #endif
1801 
1802 struct btf *bpf_get_btf_vmlinux(void);
1803 
1804 /* Map specifics */
1805 struct xdp_frame;
1806 struct sk_buff;
1807 struct bpf_dtab_netdev;
1808 struct bpf_cpu_map_entry;
1809 
1810 void __dev_flush(void);
1811 int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf,
1812 		    struct net_device *dev_rx);
1813 int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf,
1814 		    struct net_device *dev_rx);
1815 int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx,
1816 			  struct bpf_map *map, bool exclude_ingress);
1817 int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb,
1818 			     struct bpf_prog *xdp_prog);
1819 int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb,
1820 			   struct bpf_prog *xdp_prog, struct bpf_map *map,
1821 			   bool exclude_ingress);
1822 
1823 void __cpu_map_flush(void);
1824 int cpu_map_enqueue(struct bpf_cpu_map_entry *rcpu, struct xdp_frame *xdpf,
1825 		    struct net_device *dev_rx);
1826 int cpu_map_generic_redirect(struct bpf_cpu_map_entry *rcpu,
1827 			     struct sk_buff *skb);
1828 
1829 /* Return map's numa specified by userspace */
1830 static inline int bpf_map_attr_numa_node(const union bpf_attr *attr)
1831 {
1832 	return (attr->map_flags & BPF_F_NUMA_NODE) ?
1833 		attr->numa_node : NUMA_NO_NODE;
1834 }
1835 
1836 struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type);
1837 int array_map_alloc_check(union bpf_attr *attr);
1838 
1839 int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
1840 			  union bpf_attr __user *uattr);
1841 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
1842 			  union bpf_attr __user *uattr);
1843 int bpf_prog_test_run_tracing(struct bpf_prog *prog,
1844 			      const union bpf_attr *kattr,
1845 			      union bpf_attr __user *uattr);
1846 int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
1847 				     const union bpf_attr *kattr,
1848 				     union bpf_attr __user *uattr);
1849 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
1850 			     const union bpf_attr *kattr,
1851 			     union bpf_attr __user *uattr);
1852 int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,
1853 				const union bpf_attr *kattr,
1854 				union bpf_attr __user *uattr);
1855 bool btf_ctx_access(int off, int size, enum bpf_access_type type,
1856 		    const struct bpf_prog *prog,
1857 		    struct bpf_insn_access_aux *info);
1858 
1859 static inline bool bpf_tracing_ctx_access(int off, int size,
1860 					  enum bpf_access_type type)
1861 {
1862 	if (off < 0 || off >= sizeof(__u64) * MAX_BPF_FUNC_ARGS)
1863 		return false;
1864 	if (type != BPF_READ)
1865 		return false;
1866 	if (off % size != 0)
1867 		return false;
1868 	return true;
1869 }
1870 
1871 static inline bool bpf_tracing_btf_ctx_access(int off, int size,
1872 					      enum bpf_access_type type,
1873 					      const struct bpf_prog *prog,
1874 					      struct bpf_insn_access_aux *info)
1875 {
1876 	if (!bpf_tracing_ctx_access(off, size, type))
1877 		return false;
1878 	return btf_ctx_access(off, size, type, prog, info);
1879 }
1880 
1881 int btf_struct_access(struct bpf_verifier_log *log, const struct btf *btf,
1882 		      const struct btf_type *t, int off, int size,
1883 		      enum bpf_access_type atype,
1884 		      u32 *next_btf_id, enum bpf_type_flag *flag);
1885 bool btf_struct_ids_match(struct bpf_verifier_log *log,
1886 			  const struct btf *btf, u32 id, int off,
1887 			  const struct btf *need_btf, u32 need_type_id,
1888 			  bool strict);
1889 
1890 int btf_distill_func_proto(struct bpf_verifier_log *log,
1891 			   struct btf *btf,
1892 			   const struct btf_type *func_proto,
1893 			   const char *func_name,
1894 			   struct btf_func_model *m);
1895 
1896 struct bpf_reg_state;
1897 int btf_check_subprog_arg_match(struct bpf_verifier_env *env, int subprog,
1898 				struct bpf_reg_state *regs);
1899 int btf_check_kfunc_arg_match(struct bpf_verifier_env *env,
1900 			      const struct btf *btf, u32 func_id,
1901 			      struct bpf_reg_state *regs);
1902 int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog,
1903 			  struct bpf_reg_state *reg);
1904 int btf_check_type_match(struct bpf_verifier_log *log, const struct bpf_prog *prog,
1905 			 struct btf *btf, const struct btf_type *t);
1906 
1907 struct bpf_prog *bpf_prog_by_id(u32 id);
1908 struct bpf_link *bpf_link_by_id(u32 id);
1909 
1910 const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id);
1911 void bpf_task_storage_free(struct task_struct *task);
1912 bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog);
1913 const struct btf_func_model *
1914 bpf_jit_find_kfunc_model(const struct bpf_prog *prog,
1915 			 const struct bpf_insn *insn);
1916 struct bpf_core_ctx {
1917 	struct bpf_verifier_log *log;
1918 	const struct btf *btf;
1919 };
1920 
1921 int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
1922 		   int relo_idx, void *insn);
1923 
1924 static inline bool unprivileged_ebpf_enabled(void)
1925 {
1926 	return !sysctl_unprivileged_bpf_disabled;
1927 }
1928 
1929 #else /* !CONFIG_BPF_SYSCALL */
1930 static inline struct bpf_prog *bpf_prog_get(u32 ufd)
1931 {
1932 	return ERR_PTR(-EOPNOTSUPP);
1933 }
1934 
1935 static inline struct bpf_prog *bpf_prog_get_type_dev(u32 ufd,
1936 						     enum bpf_prog_type type,
1937 						     bool attach_drv)
1938 {
1939 	return ERR_PTR(-EOPNOTSUPP);
1940 }
1941 
1942 static inline void bpf_prog_add(struct bpf_prog *prog, int i)
1943 {
1944 }
1945 
1946 static inline void bpf_prog_sub(struct bpf_prog *prog, int i)
1947 {
1948 }
1949 
1950 static inline void bpf_prog_put(struct bpf_prog *prog)
1951 {
1952 }
1953 
1954 static inline void bpf_prog_inc(struct bpf_prog *prog)
1955 {
1956 }
1957 
1958 static inline struct bpf_prog *__must_check
1959 bpf_prog_inc_not_zero(struct bpf_prog *prog)
1960 {
1961 	return ERR_PTR(-EOPNOTSUPP);
1962 }
1963 
1964 static inline void bpf_link_init(struct bpf_link *link, enum bpf_link_type type,
1965 				 const struct bpf_link_ops *ops,
1966 				 struct bpf_prog *prog)
1967 {
1968 }
1969 
1970 static inline int bpf_link_prime(struct bpf_link *link,
1971 				 struct bpf_link_primer *primer)
1972 {
1973 	return -EOPNOTSUPP;
1974 }
1975 
1976 static inline int bpf_link_settle(struct bpf_link_primer *primer)
1977 {
1978 	return -EOPNOTSUPP;
1979 }
1980 
1981 static inline void bpf_link_cleanup(struct bpf_link_primer *primer)
1982 {
1983 }
1984 
1985 static inline void bpf_link_inc(struct bpf_link *link)
1986 {
1987 }
1988 
1989 static inline void bpf_link_put(struct bpf_link *link)
1990 {
1991 }
1992 
1993 static inline int bpf_obj_get_user(const char __user *pathname, int flags)
1994 {
1995 	return -EOPNOTSUPP;
1996 }
1997 
1998 static inline void __dev_flush(void)
1999 {
2000 }
2001 
2002 struct xdp_frame;
2003 struct bpf_dtab_netdev;
2004 struct bpf_cpu_map_entry;
2005 
2006 static inline
2007 int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf,
2008 		    struct net_device *dev_rx)
2009 {
2010 	return 0;
2011 }
2012 
2013 static inline
2014 int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf,
2015 		    struct net_device *dev_rx)
2016 {
2017 	return 0;
2018 }
2019 
2020 static inline
2021 int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx,
2022 			  struct bpf_map *map, bool exclude_ingress)
2023 {
2024 	return 0;
2025 }
2026 
2027 struct sk_buff;
2028 
2029 static inline int dev_map_generic_redirect(struct bpf_dtab_netdev *dst,
2030 					   struct sk_buff *skb,
2031 					   struct bpf_prog *xdp_prog)
2032 {
2033 	return 0;
2034 }
2035 
2036 static inline
2037 int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb,
2038 			   struct bpf_prog *xdp_prog, struct bpf_map *map,
2039 			   bool exclude_ingress)
2040 {
2041 	return 0;
2042 }
2043 
2044 static inline void __cpu_map_flush(void)
2045 {
2046 }
2047 
2048 static inline int cpu_map_enqueue(struct bpf_cpu_map_entry *rcpu,
2049 				  struct xdp_frame *xdpf,
2050 				  struct net_device *dev_rx)
2051 {
2052 	return 0;
2053 }
2054 
2055 static inline int cpu_map_generic_redirect(struct bpf_cpu_map_entry *rcpu,
2056 					   struct sk_buff *skb)
2057 {
2058 	return -EOPNOTSUPP;
2059 }
2060 
2061 static inline struct bpf_prog *bpf_prog_get_type_path(const char *name,
2062 				enum bpf_prog_type type)
2063 {
2064 	return ERR_PTR(-EOPNOTSUPP);
2065 }
2066 
2067 static inline int bpf_prog_test_run_xdp(struct bpf_prog *prog,
2068 					const union bpf_attr *kattr,
2069 					union bpf_attr __user *uattr)
2070 {
2071 	return -ENOTSUPP;
2072 }
2073 
2074 static inline int bpf_prog_test_run_skb(struct bpf_prog *prog,
2075 					const union bpf_attr *kattr,
2076 					union bpf_attr __user *uattr)
2077 {
2078 	return -ENOTSUPP;
2079 }
2080 
2081 static inline int bpf_prog_test_run_tracing(struct bpf_prog *prog,
2082 					    const union bpf_attr *kattr,
2083 					    union bpf_attr __user *uattr)
2084 {
2085 	return -ENOTSUPP;
2086 }
2087 
2088 static inline int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
2089 						   const union bpf_attr *kattr,
2090 						   union bpf_attr __user *uattr)
2091 {
2092 	return -ENOTSUPP;
2093 }
2094 
2095 static inline int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,
2096 					      const union bpf_attr *kattr,
2097 					      union bpf_attr __user *uattr)
2098 {
2099 	return -ENOTSUPP;
2100 }
2101 
2102 static inline void bpf_map_put(struct bpf_map *map)
2103 {
2104 }
2105 
2106 static inline struct bpf_prog *bpf_prog_by_id(u32 id)
2107 {
2108 	return ERR_PTR(-ENOTSUPP);
2109 }
2110 
2111 static inline const struct bpf_func_proto *
2112 bpf_base_func_proto(enum bpf_func_id func_id)
2113 {
2114 	return NULL;
2115 }
2116 
2117 static inline void bpf_task_storage_free(struct task_struct *task)
2118 {
2119 }
2120 
2121 static inline bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
2122 {
2123 	return false;
2124 }
2125 
2126 static inline const struct btf_func_model *
2127 bpf_jit_find_kfunc_model(const struct bpf_prog *prog,
2128 			 const struct bpf_insn *insn)
2129 {
2130 	return NULL;
2131 }
2132 
2133 static inline bool unprivileged_ebpf_enabled(void)
2134 {
2135 	return false;
2136 }
2137 
2138 #endif /* CONFIG_BPF_SYSCALL */
2139 
2140 void __bpf_free_used_btfs(struct bpf_prog_aux *aux,
2141 			  struct btf_mod_pair *used_btfs, u32 len);
2142 
2143 static inline struct bpf_prog *bpf_prog_get_type(u32 ufd,
2144 						 enum bpf_prog_type type)
2145 {
2146 	return bpf_prog_get_type_dev(ufd, type, false);
2147 }
2148 
2149 void __bpf_free_used_maps(struct bpf_prog_aux *aux,
2150 			  struct bpf_map **used_maps, u32 len);
2151 
2152 bool bpf_prog_get_ok(struct bpf_prog *, enum bpf_prog_type *, bool);
2153 
2154 int bpf_prog_offload_compile(struct bpf_prog *prog);
2155 void bpf_prog_offload_destroy(struct bpf_prog *prog);
2156 int bpf_prog_offload_info_fill(struct bpf_prog_info *info,
2157 			       struct bpf_prog *prog);
2158 
2159 int bpf_map_offload_info_fill(struct bpf_map_info *info, struct bpf_map *map);
2160 
2161 int bpf_map_offload_lookup_elem(struct bpf_map *map, void *key, void *value);
2162 int bpf_map_offload_update_elem(struct bpf_map *map,
2163 				void *key, void *value, u64 flags);
2164 int bpf_map_offload_delete_elem(struct bpf_map *map, void *key);
2165 int bpf_map_offload_get_next_key(struct bpf_map *map,
2166 				 void *key, void *next_key);
2167 
2168 bool bpf_offload_prog_map_match(struct bpf_prog *prog, struct bpf_map *map);
2169 
2170 struct bpf_offload_dev *
2171 bpf_offload_dev_create(const struct bpf_prog_offload_ops *ops, void *priv);
2172 void bpf_offload_dev_destroy(struct bpf_offload_dev *offdev);
2173 void *bpf_offload_dev_priv(struct bpf_offload_dev *offdev);
2174 int bpf_offload_dev_netdev_register(struct bpf_offload_dev *offdev,
2175 				    struct net_device *netdev);
2176 void bpf_offload_dev_netdev_unregister(struct bpf_offload_dev *offdev,
2177 				       struct net_device *netdev);
2178 bool bpf_offload_dev_match(struct bpf_prog *prog, struct net_device *netdev);
2179 
2180 void unpriv_ebpf_notify(int new_state);
2181 
2182 #if defined(CONFIG_NET) && defined(CONFIG_BPF_SYSCALL)
2183 int bpf_prog_offload_init(struct bpf_prog *prog, union bpf_attr *attr);
2184 
2185 static inline bool bpf_prog_is_dev_bound(const struct bpf_prog_aux *aux)
2186 {
2187 	return aux->offload_requested;
2188 }
2189 
2190 static inline bool bpf_map_is_dev_bound(struct bpf_map *map)
2191 {
2192 	return unlikely(map->ops == &bpf_map_offload_ops);
2193 }
2194 
2195 struct bpf_map *bpf_map_offload_map_alloc(union bpf_attr *attr);
2196 void bpf_map_offload_map_free(struct bpf_map *map);
2197 int bpf_prog_test_run_syscall(struct bpf_prog *prog,
2198 			      const union bpf_attr *kattr,
2199 			      union bpf_attr __user *uattr);
2200 
2201 int sock_map_get_from_fd(const union bpf_attr *attr, struct bpf_prog *prog);
2202 int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);
2203 int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value, u64 flags);
2204 int sock_map_bpf_prog_query(const union bpf_attr *attr,
2205 			    union bpf_attr __user *uattr);
2206 
2207 void sock_map_unhash(struct sock *sk);
2208 void sock_map_destroy(struct sock *sk);
2209 void sock_map_close(struct sock *sk, long timeout);
2210 #else
2211 static inline int bpf_prog_offload_init(struct bpf_prog *prog,
2212 					union bpf_attr *attr)
2213 {
2214 	return -EOPNOTSUPP;
2215 }
2216 
2217 static inline bool bpf_prog_is_dev_bound(struct bpf_prog_aux *aux)
2218 {
2219 	return false;
2220 }
2221 
2222 static inline bool bpf_map_is_dev_bound(struct bpf_map *map)
2223 {
2224 	return false;
2225 }
2226 
2227 static inline struct bpf_map *bpf_map_offload_map_alloc(union bpf_attr *attr)
2228 {
2229 	return ERR_PTR(-EOPNOTSUPP);
2230 }
2231 
2232 static inline void bpf_map_offload_map_free(struct bpf_map *map)
2233 {
2234 }
2235 
2236 static inline int bpf_prog_test_run_syscall(struct bpf_prog *prog,
2237 					    const union bpf_attr *kattr,
2238 					    union bpf_attr __user *uattr)
2239 {
2240 	return -ENOTSUPP;
2241 }
2242 
2243 #ifdef CONFIG_BPF_SYSCALL
2244 static inline int sock_map_get_from_fd(const union bpf_attr *attr,
2245 				       struct bpf_prog *prog)
2246 {
2247 	return -EINVAL;
2248 }
2249 
2250 static inline int sock_map_prog_detach(const union bpf_attr *attr,
2251 				       enum bpf_prog_type ptype)
2252 {
2253 	return -EOPNOTSUPP;
2254 }
2255 
2256 static inline int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value,
2257 					   u64 flags)
2258 {
2259 	return -EOPNOTSUPP;
2260 }
2261 
2262 static inline int sock_map_bpf_prog_query(const union bpf_attr *attr,
2263 					  union bpf_attr __user *uattr)
2264 {
2265 	return -EINVAL;
2266 }
2267 #endif /* CONFIG_BPF_SYSCALL */
2268 #endif /* CONFIG_NET && CONFIG_BPF_SYSCALL */
2269 
2270 #if defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL)
2271 void bpf_sk_reuseport_detach(struct sock *sk);
2272 int bpf_fd_reuseport_array_lookup_elem(struct bpf_map *map, void *key,
2273 				       void *value);
2274 int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, void *key,
2275 				       void *value, u64 map_flags);
2276 #else
2277 static inline void bpf_sk_reuseport_detach(struct sock *sk)
2278 {
2279 }
2280 
2281 #ifdef CONFIG_BPF_SYSCALL
2282 static inline int bpf_fd_reuseport_array_lookup_elem(struct bpf_map *map,
2283 						     void *key, void *value)
2284 {
2285 	return -EOPNOTSUPP;
2286 }
2287 
2288 static inline int bpf_fd_reuseport_array_update_elem(struct bpf_map *map,
2289 						     void *key, void *value,
2290 						     u64 map_flags)
2291 {
2292 	return -EOPNOTSUPP;
2293 }
2294 #endif /* CONFIG_BPF_SYSCALL */
2295 #endif /* defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL) */
2296 
2297 /* verifier prototypes for helper functions called from eBPF programs */
2298 extern const struct bpf_func_proto bpf_map_lookup_elem_proto;
2299 extern const struct bpf_func_proto bpf_map_update_elem_proto;
2300 extern const struct bpf_func_proto bpf_map_delete_elem_proto;
2301 extern const struct bpf_func_proto bpf_map_push_elem_proto;
2302 extern const struct bpf_func_proto bpf_map_pop_elem_proto;
2303 extern const struct bpf_func_proto bpf_map_peek_elem_proto;
2304 extern const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto;
2305 
2306 extern const struct bpf_func_proto bpf_get_prandom_u32_proto;
2307 extern const struct bpf_func_proto bpf_get_smp_processor_id_proto;
2308 extern const struct bpf_func_proto bpf_get_numa_node_id_proto;
2309 extern const struct bpf_func_proto bpf_tail_call_proto;
2310 extern const struct bpf_func_proto bpf_ktime_get_ns_proto;
2311 extern const struct bpf_func_proto bpf_ktime_get_boot_ns_proto;
2312 extern const struct bpf_func_proto bpf_get_current_pid_tgid_proto;
2313 extern const struct bpf_func_proto bpf_get_current_uid_gid_proto;
2314 extern const struct bpf_func_proto bpf_get_current_comm_proto;
2315 extern const struct bpf_func_proto bpf_get_stackid_proto;
2316 extern const struct bpf_func_proto bpf_get_stack_proto;
2317 extern const struct bpf_func_proto bpf_get_task_stack_proto;
2318 extern const struct bpf_func_proto bpf_get_stackid_proto_pe;
2319 extern const struct bpf_func_proto bpf_get_stack_proto_pe;
2320 extern const struct bpf_func_proto bpf_sock_map_update_proto;
2321 extern const struct bpf_func_proto bpf_sock_hash_update_proto;
2322 extern const struct bpf_func_proto bpf_get_current_cgroup_id_proto;
2323 extern const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto;
2324 extern const struct bpf_func_proto bpf_msg_redirect_hash_proto;
2325 extern const struct bpf_func_proto bpf_msg_redirect_map_proto;
2326 extern const struct bpf_func_proto bpf_sk_redirect_hash_proto;
2327 extern const struct bpf_func_proto bpf_sk_redirect_map_proto;
2328 extern const struct bpf_func_proto bpf_spin_lock_proto;
2329 extern const struct bpf_func_proto bpf_spin_unlock_proto;
2330 extern const struct bpf_func_proto bpf_get_local_storage_proto;
2331 extern const struct bpf_func_proto bpf_strtol_proto;
2332 extern const struct bpf_func_proto bpf_strtoul_proto;
2333 extern const struct bpf_func_proto bpf_tcp_sock_proto;
2334 extern const struct bpf_func_proto bpf_jiffies64_proto;
2335 extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto;
2336 extern const struct bpf_func_proto bpf_event_output_data_proto;
2337 extern const struct bpf_func_proto bpf_ringbuf_output_proto;
2338 extern const struct bpf_func_proto bpf_ringbuf_reserve_proto;
2339 extern const struct bpf_func_proto bpf_ringbuf_submit_proto;
2340 extern const struct bpf_func_proto bpf_ringbuf_discard_proto;
2341 extern const struct bpf_func_proto bpf_ringbuf_query_proto;
2342 extern const struct bpf_func_proto bpf_ringbuf_reserve_dynptr_proto;
2343 extern const struct bpf_func_proto bpf_ringbuf_submit_dynptr_proto;
2344 extern const struct bpf_func_proto bpf_ringbuf_discard_dynptr_proto;
2345 extern const struct bpf_func_proto bpf_skc_to_tcp6_sock_proto;
2346 extern const struct bpf_func_proto bpf_skc_to_tcp_sock_proto;
2347 extern const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto;
2348 extern const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto;
2349 extern const struct bpf_func_proto bpf_skc_to_udp6_sock_proto;
2350 extern const struct bpf_func_proto bpf_skc_to_unix_sock_proto;
2351 extern const struct bpf_func_proto bpf_skc_to_mptcp_sock_proto;
2352 extern const struct bpf_func_proto bpf_copy_from_user_proto;
2353 extern const struct bpf_func_proto bpf_snprintf_btf_proto;
2354 extern const struct bpf_func_proto bpf_snprintf_proto;
2355 extern const struct bpf_func_proto bpf_per_cpu_ptr_proto;
2356 extern const struct bpf_func_proto bpf_this_cpu_ptr_proto;
2357 extern const struct bpf_func_proto bpf_ktime_get_coarse_ns_proto;
2358 extern const struct bpf_func_proto bpf_sock_from_file_proto;
2359 extern const struct bpf_func_proto bpf_get_socket_ptr_cookie_proto;
2360 extern const struct bpf_func_proto bpf_task_storage_get_proto;
2361 extern const struct bpf_func_proto bpf_task_storage_delete_proto;
2362 extern const struct bpf_func_proto bpf_for_each_map_elem_proto;
2363 extern const struct bpf_func_proto bpf_btf_find_by_name_kind_proto;
2364 extern const struct bpf_func_proto bpf_sk_setsockopt_proto;
2365 extern const struct bpf_func_proto bpf_sk_getsockopt_proto;
2366 extern const struct bpf_func_proto bpf_find_vma_proto;
2367 extern const struct bpf_func_proto bpf_loop_proto;
2368 extern const struct bpf_func_proto bpf_copy_from_user_task_proto;
2369 
2370 const struct bpf_func_proto *tracing_prog_func_proto(
2371   enum bpf_func_id func_id, const struct bpf_prog *prog);
2372 
2373 /* Shared helpers among cBPF and eBPF. */
2374 void bpf_user_rnd_init_once(void);
2375 u64 bpf_user_rnd_u32(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
2376 u64 bpf_get_raw_cpu_id(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
2377 
2378 #if defined(CONFIG_NET)
2379 bool bpf_sock_common_is_valid_access(int off, int size,
2380 				     enum bpf_access_type type,
2381 				     struct bpf_insn_access_aux *info);
2382 bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type,
2383 			      struct bpf_insn_access_aux *info);
2384 u32 bpf_sock_convert_ctx_access(enum bpf_access_type type,
2385 				const struct bpf_insn *si,
2386 				struct bpf_insn *insn_buf,
2387 				struct bpf_prog *prog,
2388 				u32 *target_size);
2389 #else
2390 static inline bool bpf_sock_common_is_valid_access(int off, int size,
2391 						   enum bpf_access_type type,
2392 						   struct bpf_insn_access_aux *info)
2393 {
2394 	return false;
2395 }
2396 static inline bool bpf_sock_is_valid_access(int off, int size,
2397 					    enum bpf_access_type type,
2398 					    struct bpf_insn_access_aux *info)
2399 {
2400 	return false;
2401 }
2402 static inline u32 bpf_sock_convert_ctx_access(enum bpf_access_type type,
2403 					      const struct bpf_insn *si,
2404 					      struct bpf_insn *insn_buf,
2405 					      struct bpf_prog *prog,
2406 					      u32 *target_size)
2407 {
2408 	return 0;
2409 }
2410 #endif
2411 
2412 #ifdef CONFIG_INET
2413 struct sk_reuseport_kern {
2414 	struct sk_buff *skb;
2415 	struct sock *sk;
2416 	struct sock *selected_sk;
2417 	struct sock *migrating_sk;
2418 	void *data_end;
2419 	u32 hash;
2420 	u32 reuseport_id;
2421 	bool bind_inany;
2422 };
2423 bool bpf_tcp_sock_is_valid_access(int off, int size, enum bpf_access_type type,
2424 				  struct bpf_insn_access_aux *info);
2425 
2426 u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type,
2427 				    const struct bpf_insn *si,
2428 				    struct bpf_insn *insn_buf,
2429 				    struct bpf_prog *prog,
2430 				    u32 *target_size);
2431 
2432 bool bpf_xdp_sock_is_valid_access(int off, int size, enum bpf_access_type type,
2433 				  struct bpf_insn_access_aux *info);
2434 
2435 u32 bpf_xdp_sock_convert_ctx_access(enum bpf_access_type type,
2436 				    const struct bpf_insn *si,
2437 				    struct bpf_insn *insn_buf,
2438 				    struct bpf_prog *prog,
2439 				    u32 *target_size);
2440 #else
2441 static inline bool bpf_tcp_sock_is_valid_access(int off, int size,
2442 						enum bpf_access_type type,
2443 						struct bpf_insn_access_aux *info)
2444 {
2445 	return false;
2446 }
2447 
2448 static inline u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type,
2449 						  const struct bpf_insn *si,
2450 						  struct bpf_insn *insn_buf,
2451 						  struct bpf_prog *prog,
2452 						  u32 *target_size)
2453 {
2454 	return 0;
2455 }
2456 static inline bool bpf_xdp_sock_is_valid_access(int off, int size,
2457 						enum bpf_access_type type,
2458 						struct bpf_insn_access_aux *info)
2459 {
2460 	return false;
2461 }
2462 
2463 static inline u32 bpf_xdp_sock_convert_ctx_access(enum bpf_access_type type,
2464 						  const struct bpf_insn *si,
2465 						  struct bpf_insn *insn_buf,
2466 						  struct bpf_prog *prog,
2467 						  u32 *target_size)
2468 {
2469 	return 0;
2470 }
2471 #endif /* CONFIG_INET */
2472 
2473 enum bpf_text_poke_type {
2474 	BPF_MOD_CALL,
2475 	BPF_MOD_JUMP,
2476 };
2477 
2478 int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
2479 		       void *addr1, void *addr2);
2480 
2481 void *bpf_arch_text_copy(void *dst, void *src, size_t len);
2482 int bpf_arch_text_invalidate(void *dst, size_t len);
2483 
2484 struct btf_id_set;
2485 bool btf_id_set_contains(const struct btf_id_set *set, u32 id);
2486 
2487 #define MAX_BPRINTF_VARARGS		12
2488 
2489 int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
2490 			u32 **bin_buf, u32 num_args);
2491 void bpf_bprintf_cleanup(void);
2492 
2493 /* the implementation of the opaque uapi struct bpf_dynptr */
2494 struct bpf_dynptr_kern {
2495 	void *data;
2496 	/* Size represents the number of usable bytes of dynptr data.
2497 	 * If for example the offset is at 4 for a local dynptr whose data is
2498 	 * of type u64, the number of usable bytes is 4.
2499 	 *
2500 	 * The upper 8 bits are reserved. It is as follows:
2501 	 * Bits 0 - 23 = size
2502 	 * Bits 24 - 30 = dynptr type
2503 	 * Bit 31 = whether dynptr is read-only
2504 	 */
2505 	u32 size;
2506 	u32 offset;
2507 } __aligned(8);
2508 
2509 enum bpf_dynptr_type {
2510 	BPF_DYNPTR_TYPE_INVALID,
2511 	/* Points to memory that is local to the bpf program */
2512 	BPF_DYNPTR_TYPE_LOCAL,
2513 	/* Underlying data is a ringbuf record */
2514 	BPF_DYNPTR_TYPE_RINGBUF,
2515 };
2516 
2517 void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data,
2518 		     enum bpf_dynptr_type type, u32 offset, u32 size);
2519 void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr);
2520 int bpf_dynptr_check_size(u32 size);
2521 
2522 #endif /* _LINUX_BPF_H */
2523