1 /* SPDX-License-Identifier: GPL-2.0 */ 1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _BPF_CGROUP_DEFS_H 2 #ifndef _BPF_CGROUP_DEFS_H
3 #define _BPF_CGROUP_DEFS_H 3 #define _BPF_CGROUP_DEFS_H
4 4
5 #ifdef CONFIG_CGROUP_BPF 5 #ifdef CONFIG_CGROUP_BPF
6 6
7 #include <linux/list.h> 7 #include <linux/list.h>
8 #include <linux/percpu-refcount.h> 8 #include <linux/percpu-refcount.h>
9 #include <linux/workqueue.h> 9 #include <linux/workqueue.h>
10 10
11 struct bpf_prog_array; 11 struct bpf_prog_array;
12 12
13 #ifdef CONFIG_BPF_LSM <<
14 /* Maximum number of concurrently attachable p <<
15 #define CGROUP_LSM_NUM 10 <<
16 #else <<
17 #define CGROUP_LSM_NUM 0 <<
18 #endif <<
19 <<
20 enum cgroup_bpf_attach_type { 13 enum cgroup_bpf_attach_type {
21 CGROUP_BPF_ATTACH_TYPE_INVALID = -1, 14 CGROUP_BPF_ATTACH_TYPE_INVALID = -1,
22 CGROUP_INET_INGRESS = 0, 15 CGROUP_INET_INGRESS = 0,
23 CGROUP_INET_EGRESS, 16 CGROUP_INET_EGRESS,
24 CGROUP_INET_SOCK_CREATE, 17 CGROUP_INET_SOCK_CREATE,
25 CGROUP_SOCK_OPS, 18 CGROUP_SOCK_OPS,
26 CGROUP_DEVICE, 19 CGROUP_DEVICE,
27 CGROUP_INET4_BIND, 20 CGROUP_INET4_BIND,
28 CGROUP_INET6_BIND, 21 CGROUP_INET6_BIND,
29 CGROUP_INET4_CONNECT, 22 CGROUP_INET4_CONNECT,
30 CGROUP_INET6_CONNECT, 23 CGROUP_INET6_CONNECT,
31 CGROUP_UNIX_CONNECT, <<
32 CGROUP_INET4_POST_BIND, 24 CGROUP_INET4_POST_BIND,
33 CGROUP_INET6_POST_BIND, 25 CGROUP_INET6_POST_BIND,
34 CGROUP_UDP4_SENDMSG, 26 CGROUP_UDP4_SENDMSG,
35 CGROUP_UDP6_SENDMSG, 27 CGROUP_UDP6_SENDMSG,
36 CGROUP_UNIX_SENDMSG, <<
37 CGROUP_SYSCTL, 28 CGROUP_SYSCTL,
38 CGROUP_UDP4_RECVMSG, 29 CGROUP_UDP4_RECVMSG,
39 CGROUP_UDP6_RECVMSG, 30 CGROUP_UDP6_RECVMSG,
40 CGROUP_UNIX_RECVMSG, <<
41 CGROUP_GETSOCKOPT, 31 CGROUP_GETSOCKOPT,
42 CGROUP_SETSOCKOPT, 32 CGROUP_SETSOCKOPT,
43 CGROUP_INET4_GETPEERNAME, 33 CGROUP_INET4_GETPEERNAME,
44 CGROUP_INET6_GETPEERNAME, 34 CGROUP_INET6_GETPEERNAME,
45 CGROUP_UNIX_GETPEERNAME, <<
46 CGROUP_INET4_GETSOCKNAME, 35 CGROUP_INET4_GETSOCKNAME,
47 CGROUP_INET6_GETSOCKNAME, 36 CGROUP_INET6_GETSOCKNAME,
48 CGROUP_UNIX_GETSOCKNAME, <<
49 CGROUP_INET_SOCK_RELEASE, 37 CGROUP_INET_SOCK_RELEASE,
50 CGROUP_LSM_START, <<
51 CGROUP_LSM_END = CGROUP_LSM_START + CG <<
52 MAX_CGROUP_BPF_ATTACH_TYPE 38 MAX_CGROUP_BPF_ATTACH_TYPE
53 }; 39 };
54 40
55 struct cgroup_bpf { 41 struct cgroup_bpf {
56 /* array of effective progs in this cg 42 /* array of effective progs in this cgroup */
57 struct bpf_prog_array __rcu *effective 43 struct bpf_prog_array __rcu *effective[MAX_CGROUP_BPF_ATTACH_TYPE];
58 44
59 /* attached progs to this cgroup and a 45 /* attached progs to this cgroup and attach flags
60 * when flags == 0 or BPF_F_ALLOW_OVER 46 * when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
61 * have either zero or one element 47 * have either zero or one element
62 * when BPF_F_ALLOW_MULTI the list can 48 * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
63 */ 49 */
64 struct hlist_head progs[MAX_CGROUP_BPF 50 struct hlist_head progs[MAX_CGROUP_BPF_ATTACH_TYPE];
65 u8 flags[MAX_CGROUP_BPF_ATTACH_TYPE]; 51 u8 flags[MAX_CGROUP_BPF_ATTACH_TYPE];
66 52
67 /* list of cgroup shared storages */ 53 /* list of cgroup shared storages */
68 struct list_head storages; 54 struct list_head storages;
69 55
70 /* temp storage for effective prog arr 56 /* temp storage for effective prog array used by prog_attach/detach */
71 struct bpf_prog_array *inactive; 57 struct bpf_prog_array *inactive;
72 58
73 /* reference counter used to detach bp 59 /* reference counter used to detach bpf programs after cgroup removal */
74 struct percpu_ref refcnt; 60 struct percpu_ref refcnt;
75 61
76 /* cgroup_bpf is released using a work 62 /* cgroup_bpf is released using a work queue */
77 struct work_struct release_work; 63 struct work_struct release_work;
78 }; 64 };
79 65
80 #else /* CONFIG_CGROUP_BPF */ 66 #else /* CONFIG_CGROUP_BPF */
81 struct cgroup_bpf {}; 67 struct cgroup_bpf {};
82 #endif /* CONFIG_CGROUP_BPF */ 68 #endif /* CONFIG_CGROUP_BPF */
83 69
84 #endif 70 #endif
85 71
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.