Alexei Starovoitov says: ==================== pull-request: bpf-next 2020-05-14 The following pull-request contains BPF updates for your *net-next* tree. The main changes are: 1) Merged tag 'perf-for-bpf-2020-05-06' from tip tree that includes CAP_PERFMON. 2) support for narrow loads in bpf_sock_addr progs and additional helpers in cg-skb progs, from Andrey. 3) bpf benchmark runner, from Andrii. 4) arm and riscv JIT optimizations, from Luke. 5) bpf iterator infrastructure, from Yonghong. ====================
Showing the changes to include/uapi/linux (2 of 139 files). Show all
Unified · Split
| @@ -116,6 +116,7 @@ enum bpf_cmd { · 115 unmodified lines | ||
| 116 | 116 | BPF_LINK_GET_FD_BY_ID, |
| 117 | 117 | BPF_LINK_GET_NEXT_ID, |
| 118 | 118 | BPF_ENABLE_STATS, |
| 119 | + BPF_ITER_CREATE, | |
| 119 | 120 | }; |
| 120 | 121 | |
| 121 | 122 | enum bpf_map_type { |
| @@ -218,6 +219,7 @@ enum bpf_attach_type { · 96 unmodified lines | ||
| 218 | 219 | BPF_TRACE_FEXIT, |
| 219 | 220 | BPF_MODIFY_RETURN, |
| 220 | 221 | BPF_LSM_MAC, |
| 222 | + BPF_TRACE_ITER, | |
| 221 | 223 | __MAX_BPF_ATTACH_TYPE |
| 222 | 224 | }; |
| 223 | 225 | |
| @@ -228,6 +230,7 @@ enum bpf_link_type { · 4 unmodified lines | ||
| 228 | 230 | BPF_LINK_TYPE_RAW_TRACEPOINT = 1, |
| 229 | 231 | BPF_LINK_TYPE_TRACING = 2, |
| 230 | 232 | BPF_LINK_TYPE_CGROUP = 3, |
| 233 | + BPF_LINK_TYPE_ITER = 4, | |
| 231 | 234 | |
| 232 | 235 | MAX_BPF_LINK_TYPE, |
| 233 | 236 | }; |
| @@ -612,6 +615,11 @@ union bpf_attr { · 378 unmodified lines | ||
| 612 | 615 | __u32 type; |
| 613 | 616 | } enable_stats; |
| 614 | 617 | |
| 618 | + struct { /* struct used by BPF_ITER_CREATE command */ | |
| 619 | + __u32 link_fd; | |
| 620 | + __u32 flags; | |
| 621 | + } iter_create; | |
| 622 | + | |
| 615 | 623 | } __attribute__((aligned(8))); |
| 616 | 624 | |
| 617 | 625 | /* The description below is an attempt at providing documentation to eBPF |
| @@ -667,8 +675,8 @@ union bpf_attr { · 49 unmodified lines | ||
| 667 | 675 | * For tracing programs, safely attempt to read *size* bytes from |
| 668 | 676 | * kernel space address *unsafe_ptr* and store the data in *dst*. |
| 669 | 677 | * |
| 670 | − * Generally, use bpf_probe_read_user() or bpf_probe_read_kernel() | |
| 671 | − * instead. | |
| 678 | + * Generally, use **bpf_probe_read_user**\ () or | |
| 679 | + * **bpf_probe_read_kernel**\ () instead. | |
| 672 | 680 | * Return |
| 673 | 681 | * 0 on success, or a negative error in case of failure. |
| 674 | 682 | * |
| @@ -676,7 +684,7 @@ union bpf_attr { · 1 unmodified line | ||
| 676 | 684 | * Description |
| 677 | 685 | * Return the time elapsed since system boot, in nanoseconds. |
| 678 | 686 | * Does not include time the system was suspended. |
| 679 | − * See: clock_gettime(CLOCK_MONOTONIC) | |
| 687 | + * See: **clock_gettime**\ (**CLOCK_MONOTONIC**) | |
| 680 | 688 | * Return |
| 681 | 689 | * Current *ktime*. |
| 682 | 690 | * |
| @@ -1535,11 +1543,11 @@ union bpf_attr { · 852 unmodified lines | ||
| 1535 | 1543 | * int bpf_probe_read_str(void *dst, u32 size, const void *unsafe_ptr) |
| 1536 | 1544 | * Description |
| 1537 | 1545 | * Copy a NUL terminated string from an unsafe kernel address |
| 1538 | − * *unsafe_ptr* to *dst*. See bpf_probe_read_kernel_str() for | |
| 1546 | + * *unsafe_ptr* to *dst*. See **bpf_probe_read_kernel_str**\ () for | |
| 1539 | 1547 | * more details. |
| 1540 | 1548 | * |
| 1541 | − * Generally, use bpf_probe_read_user_str() or bpf_probe_read_kernel_str() | |
| 1542 | − * instead. | |
| 1549 | + * Generally, use **bpf_probe_read_user_str**\ () or | |
| 1550 | + * **bpf_probe_read_kernel_str**\ () instead. | |
| 1543 | 1551 | * Return |
| 1544 | 1552 | * On success, the strictly positive length of the string, |
| 1545 | 1553 | * including the trailing NUL character. On error, a negative |
| @@ -1567,7 +1575,7 @@ union bpf_attr { · 21 unmodified lines | ||
| 1567 | 1575 | * |
| 1568 | 1576 | * u64 bpf_get_socket_cookie(struct bpf_sock_ops *ctx) |
| 1569 | 1577 | * Description |
| 1570 | − * Equivalent to bpf_get_socket_cookie() helper that accepts | |
| 1578 | + * Equivalent to **bpf_get_socket_cookie**\ () helper that accepts | |
| 1571 | 1579 | * *skb*, but gets socket from **struct bpf_sock_ops** context. |
| 1572 | 1580 | * Return |
| 1573 | 1581 | * A 8-byte long non-decreasing number. |
| @@ -1596,6 +1604,7 @@ union bpf_attr { · 22 unmodified lines | ||
| 1596 | 1604 | * The option value of length *optlen* is pointed by *optval*. |
| 1597 | 1605 | * |
| 1598 | 1606 | * *bpf_socket* should be one of the following: |
| 1607 | + * | |
| 1599 | 1608 | * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. |
| 1600 | 1609 | * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** |
| 1601 | 1610 | * and **BPF_CGROUP_INET6_CONNECT**. |
| @@ -1664,12 +1673,12 @@ union bpf_attr { · 62 unmodified lines | ||
| 1664 | 1673 | * |
| 1665 | 1674 | * The lower two bits of *flags* are used as the return code if |
| 1666 | 1675 | * the map lookup fails. This is so that the return value can be |
| 1667 | − * one of the XDP program return codes up to XDP_TX, as chosen by | |
| 1668 | − * the caller. Any higher bits in the *flags* argument must be | |
| 1676 | + * one of the XDP program return codes up to **XDP_TX**, as chosen | |
| 1677 | + * by the caller. Any higher bits in the *flags* argument must be | |
| 1669 | 1678 | * unset. |
| 1670 | 1679 | * |
| 1671 | − * See also bpf_redirect(), which only supports redirecting to an | |
| 1672 | − * ifindex, but doesn't require a map to do so. | |
| 1680 | + * See also **bpf_redirect**\ (), which only supports redirecting | |
| 1681 | + * to an ifindex, but doesn't require a map to do so. | |
| 1673 | 1682 | * Return |
| 1674 | 1683 | * **XDP_REDIRECT** on success, or the value of the two lower bits |
| 1675 | 1684 | * of the *flags* argument on error. |
| @@ -1777,7 +1786,7 @@ union bpf_attr { · 101 unmodified lines | ||
| 1777 | 1786 | * the time running for event since last normalization. The |
| 1778 | 1787 | * enabled and running times are accumulated since the perf event |
| 1779 | 1788 | * open. To achieve scaling factor between two invocations of an |
| 1780 | − * eBPF program, users can can use CPU id as the key (which is | |
| 1789 | + * eBPF program, users can use CPU id as the key (which is | |
| 1781 | 1790 | * typical for perf array usage model) to remember the previous |
| 1782 | 1791 | * value and do the calculation inside the eBPF program. |
| 1783 | 1792 | * Return |
| @@ -1804,6 +1813,7 @@ union bpf_attr { · 20 unmodified lines | ||
| 1804 | 1813 | * *opval* and of length *optlen*. |
| 1805 | 1814 | * |
| 1806 | 1815 | * *bpf_socket* should be one of the following: |
| 1816 | + * | |
| 1807 | 1817 | * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. |
| 1808 | 1818 | * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** |
| 1809 | 1819 | * and **BPF_CGROUP_INET6_CONNECT**. |
| @@ -1825,7 +1835,7 @@ union bpf_attr { · 15 unmodified lines | ||
| 1825 | 1835 | * The first argument is the context *regs* on which the kprobe |
| 1826 | 1836 | * works. |
| 1827 | 1837 | * |
| 1828 | − * This helper works by setting setting the PC (program counter) | |
| 1838 | + * This helper works by setting the PC (program counter) | |
| 1829 | 1839 | * to an override function which is run in place of the original |
| 1830 | 1840 | * probed function. This means the probed function is not run at |
| 1831 | 1841 | * all. The replacement function just returns with the required |
| @@ -1994,10 +2004,11 @@ union bpf_attr { · 162 unmodified lines | ||
| 1994 | 2004 | * |
| 1995 | 2005 | * This helper works for IPv4 and IPv6, TCP and UDP sockets. The |
| 1996 | 2006 | * domain (*addr*\ **->sa_family**) must be **AF_INET** (or |
| 1997 | − * **AF_INET6**). Looking for a free port to bind to can be | |
| 1998 | − * expensive, therefore binding to port is not permitted by the | |
| 1999 | − * helper: *addr*\ **->sin_port** (or **sin6_port**, respectively) | |
| 2000 | − * must be set to zero. | |
| 2007 | + * **AF_INET6**). It's advised to pass zero port (**sin_port** | |
| 2008 | + * or **sin6_port**) which triggers IP_BIND_ADDRESS_NO_PORT-like | |
| 2009 | + * behavior and lets the kernel efficiently pick up an unused | |
| 2010 | + * port as long as 4-tuple is unique. Passing non-zero port might | |
| 2011 | + * lead to degraded performance. | |
| 2001 | 2012 | * Return |
| 2002 | 2013 | * 0 on success, or a negative error in case of failure. |
| 2003 | 2014 | * |
| @@ -2291,7 +2302,7 @@ union bpf_attr { · 287 unmodified lines | ||
| 2291 | 2302 | * **bpf_rc_keydown**\ () again with the same values, or calling |
| 2292 | 2303 | * **bpf_rc_repeat**\ (). |
| 2293 | 2304 | * |
| 2294 | − * Some protocols include a toggle bit, in case the button was | |
| 2305 | + * Some protocols include a toggle bit, in case the button was | |
| 2295 | 2306 | * released and pressed again between consecutive scancodes. |
| 2296 | 2307 | * |
| 2297 | 2308 | * The *ctx* should point to the lirc sample as passed into |
| @@ -2637,7 +2648,6 @@ union bpf_attr { · 339 unmodified lines | ||
| 2637 | 2648 | * |
| 2638 | 2649 | * *th* points to the start of the TCP header, while *th_len* |
| 2639 | 2650 | * contains **sizeof**\ (**struct tcphdr**). |
| 2640 | − * | |
| 2641 | 2651 | * Return |
| 2642 | 2652 | * 0 if *iph* and *th* are a valid SYN cookie ACK, or a negative |
| 2643 | 2653 | * error otherwise. |
| @@ -2820,7 +2830,6 @@ union bpf_attr { · 176 unmodified lines | ||
| 2820 | 2830 | * |
| 2821 | 2831 | * *th* points to the start of the TCP header, while *th_len* |
| 2822 | 2832 | * contains the length of the TCP header. |
| 2823 | − * | |
| 2824 | 2833 | * Return |
| 2825 | 2834 | * On success, lower 32 bits hold the generated SYN cookie in |
| 2826 | 2835 | * followed by 16 bits which hold the MSS value for that cookie, |
| @@ -2903,7 +2912,7 @@ union bpf_attr { · 76 unmodified lines | ||
| 2903 | 2912 | * // size, after checking its boundaries. |
| 2904 | 2913 | * } |
| 2905 | 2914 | * |
| 2906 | − * In comparison, using **bpf_probe_read_user()** helper here | |
| 2915 | + * In comparison, using **bpf_probe_read_user**\ () helper here | |
| 2907 | 2916 | * instead to read the string would require to estimate the length |
| 2908 | 2917 | * at compile time, and would often result in copying more memory |
| 2909 | 2918 | * than necessary. |
| @@ -2921,14 +2930,14 @@ union bpf_attr { · 11 unmodified lines | ||
| 2921 | 2930 | * int bpf_probe_read_kernel_str(void *dst, u32 size, const void *unsafe_ptr) |
| 2922 | 2931 | * Description |
| 2923 | 2932 | * Copy a NUL terminated string from an unsafe kernel address *unsafe_ptr* |
| 2924 | − * to *dst*. Same semantics as with bpf_probe_read_user_str() apply. | |
| 2933 | + * to *dst*. Same semantics as with **bpf_probe_read_user_str**\ () apply. | |
| 2925 | 2934 | * Return |
| 2926 | − * On success, the strictly positive length of the string, including | |
| 2935 | + * On success, the strictly positive length of the string, including | |
| 2927 | 2936 | * the trailing NUL character. On error, a negative value. |
| 2928 | 2937 | * |
| 2929 | 2938 | * int bpf_tcp_send_ack(void *tp, u32 rcv_nxt) |
| 2930 | 2939 | * Description |
| 2931 | − * Send out a tcp-ack. *tp* is the in-kernel struct tcp_sock. | |
| 2940 | + * Send out a tcp-ack. *tp* is the in-kernel struct **tcp_sock**. | |
| 2932 | 2941 | * *rcv_nxt* is the ack_seq to be sent out. |
| 2933 | 2942 | * Return |
| 2934 | 2943 | * 0 on success, or a negative error in case of failure. |
| @@ -2956,19 +2965,19 @@ union bpf_attr { · 21 unmodified lines | ||
| 2956 | 2965 | * int bpf_read_branch_records(struct bpf_perf_event_data *ctx, void *buf, u32 size, u64 flags) |
| 2957 | 2966 | * Description |
| 2958 | 2967 | * For an eBPF program attached to a perf event, retrieve the |
| 2959 | − * branch records (struct perf_branch_entry) associated to *ctx* | |
| 2960 | − * and store it in the buffer pointed by *buf* up to size | |
| 2968 | + * branch records (**struct perf_branch_entry**) associated to *ctx* | |
| 2969 | + * and store it in the buffer pointed by *buf* up to size | |
| 2961 | 2970 | * *size* bytes. |
| 2962 | 2971 | * Return |
| 2963 | 2972 | * On success, number of bytes written to *buf*. On error, a |
| 2964 | 2973 | * negative value. |
| 2965 | 2974 | * |
| 2966 | 2975 | * The *flags* can be set to **BPF_F_GET_BRANCH_RECORDS_SIZE** to |
| 2967 | − * instead return the number of bytes required to store all the | |
| 2976 | + * instead return the number of bytes required to store all the | |
| 2968 | 2977 | * branch entries. If this flag is set, *buf* may be NULL. |
| 2969 | 2978 | * |
| 2970 | 2979 | * **-EINVAL** if arguments invalid or **size** not a multiple |
| 2971 | − * of sizeof(struct perf_branch_entry). | |
| 2980 | + * of **sizeof**\ (**struct perf_branch_entry**\ ). | |
| 2972 | 2981 | * |
| 2973 | 2982 | * **-ENOENT** if architecture does not support branch records. |
| 2974 | 2983 | * |
| @@ -2976,8 +2985,8 @@ union bpf_attr { · 1 unmodified line | ||
| 2976 | 2985 | * Description |
| 2977 | 2986 | * Returns 0 on success, values for *pid* and *tgid* as seen from the current |
| 2978 | 2987 | * *namespace* will be returned in *nsdata*. |
| 2979 | − * | |
| 2980 | − * On failure, the returned value is one of the following: | |
| 2988 | + * Return | |
| 2989 | + * 0 on success, or one of the following in case of failure: | |
| 2981 | 2990 | * |
| 2982 | 2991 | * **-EINVAL** if dev and inum supplied don't match dev_t and inode number |
| 2983 | 2992 | * with nsfs of current task, or if dev conversion to dev_t lost high bits. |
| @@ -3016,8 +3025,8 @@ union bpf_attr { · 32 unmodified lines | ||
| 3016 | 3025 | * a global identifier that can be assumed unique. If *ctx* is |
| 3017 | 3026 | * NULL, then the helper returns the cookie for the initial |
| 3018 | 3027 | * network namespace. The cookie itself is very similar to that |
| 3019 | − * of bpf_get_socket_cookie() helper, but for network namespaces | |
| 3020 | − * instead of sockets. | |
| 3028 | + * of **bpf_get_socket_cookie**\ () helper, but for network | |
| 3029 | + * namespaces instead of sockets. | |
| 3021 | 3030 | * Return |
| 3022 | 3031 | * A 8-byte long opaque number. |
| 3023 | 3032 | * |
| @@ -3052,22 +3061,98 @@ union bpf_attr { · 28 unmodified lines | ||
| 3052 | 3061 | * |
| 3053 | 3062 | * The *flags* argument must be zero. |
| 3054 | 3063 | * Return |
| 3055 | − * 0 on success, or a negative errno in case of failure. | |
| 3064 | + * 0 on success, or a negative error in case of failure: | |
| 3065 | + * | |
| 3066 | + * **-EINVAL** if specified *flags* are not supported. | |
| 3067 | + * | |
| 3068 | + * **-ENOENT** if the socket is unavailable for assignment. | |
| 3056 | 3069 | * |
| 3057 | − * * **-EINVAL** Unsupported flags specified. | |
| 3058 | − * * **-ENOENT** Socket is unavailable for assignment. | |
| 3059 | − * * **-ENETUNREACH** Socket is unreachable (wrong netns). | |
| 3060 | − * * **-EOPNOTSUPP** Unsupported operation, for example a | |
| 3061 | − * call from outside of TC ingress. | |
| 3062 | − * * **-ESOCKTNOSUPPORT** Socket type not supported (reuseport). | |
| 3070 | + * **-ENETUNREACH** if the socket is unreachable (wrong netns). | |
| 3071 | + * | |
| 3072 | + * **-EOPNOTSUPP** if the operation is not supported, for example | |
| 3073 | + * a call from outside of TC ingress. | |
| 3074 | + * | |
| 3075 | + * **-ESOCKTNOSUPPORT** if the socket type is not supported | |
| 3076 | + * (reuseport). | |
| 3063 | 3077 | * |
| 3064 | 3078 | * u64 bpf_ktime_get_boot_ns(void) |
| 3065 | 3079 | * Description |
| 3066 | 3080 | * Return the time elapsed since system boot, in nanoseconds. |
| 3067 | 3081 | * Does include the time the system was suspended. |
| 3068 | − * See: clock_gettime(CLOCK_BOOTTIME) | |
| 3082 | + * See: **clock_gettime**\ (**CLOCK_BOOTTIME**) | |
| 3069 | 3083 | * Return |
| 3070 | 3084 | * Current *ktime*. |
| 3085 | + * | |
| 3086 | + * int bpf_seq_printf(struct seq_file *m, const char *fmt, u32 fmt_size, const void *data, u32 data_len) | |
| 3087 | + * Description | |
| 3088 | + * **bpf_seq_printf**\ () uses seq_file **seq_printf**\ () to print | |
| 3089 | + * out the format string. | |
| 3090 | + * The *m* represents the seq_file. The *fmt* and *fmt_size* are for | |
| 3091 | + * the format string itself. The *data* and *data_len* are format string | |
| 3092 | + * arguments. The *data* are a **u64** array and corresponding format string | |
| 3093 | + * values are stored in the array. For strings and pointers where pointees | |
| 3094 | + * are accessed, only the pointer values are stored in the *data* array. | |
| 3095 | + * The *data_len* is the size of *data* in bytes. | |
| 3096 | + * | |
| 3097 | + * Formats **%s**, **%p{i,I}{4,6}** requires to read kernel memory. | |
| 3098 | + * Reading kernel memory may fail due to either invalid address or | |
| 3099 | + * valid address but requiring a major memory fault. If reading kernel memory | |
| 3100 | + * fails, the string for **%s** will be an empty string, and the ip | |
| 3101 | + * address for **%p{i,I}{4,6}** will be 0. Not returning error to | |
| 3102 | + * bpf program is consistent with what **bpf_trace_printk**\ () does for now. | |
| 3103 | + * Return | |
| 3104 | + * 0 on success, or a negative error in case of failure: | |
| 3105 | + * | |
| 3106 | + * **-EBUSY** if per-CPU memory copy buffer is busy, can try again | |
| 3107 | + * by returning 1 from bpf program. | |
| 3108 | + * | |
| 3109 | + * **-EINVAL** if arguments are invalid, or if *fmt* is invalid/unsupported. | |
| 3110 | + * | |
| 3111 | + * **-E2BIG** if *fmt* contains too many format specifiers. | |
| 3112 | + * | |
| 3113 | + * **-EOVERFLOW** if an overflow happened: The same object will be tried again. | |
| 3114 | + * | |
| 3115 | + * int bpf_seq_write(struct seq_file *m, const void *data, u32 len) | |
| 3116 | + * Description | |
| 3117 | + * **bpf_seq_write**\ () uses seq_file **seq_write**\ () to write the data. | |
| 3118 | + * The *m* represents the seq_file. The *data* and *len* represent the | |
| 3119 | + * data to write in bytes. | |
| 3120 | + * Return | |
| 3121 | + * 0 on success, or a negative error in case of failure: | |
| 3122 | + * | |
| 3123 | + * **-EOVERFLOW** if an overflow happened: The same object will be tried again. | |
| 3124 | + * | |
| 3125 | + * u64 bpf_sk_cgroup_id(struct bpf_sock *sk) | |
| 3126 | + * Description | |
| 3127 | + * Return the cgroup v2 id of the socket *sk*. | |
| 3128 | + * | |
| 3129 | + * *sk* must be a non-**NULL** pointer to a full socket, e.g. one | |
| 3130 | + * returned from **bpf_sk_lookup_xxx**\ (), | |
| 3131 | + * **bpf_sk_fullsock**\ (), etc. The format of returned id is | |
| 3132 | + * same as in **bpf_skb_cgroup_id**\ (). | |
| 3133 | + * | |
| 3134 | + * This helper is available only if the kernel was compiled with | |
| 3135 | + * the **CONFIG_SOCK_CGROUP_DATA** configuration option. | |
| 3136 | + * Return | |
| 3137 | + * The id is returned or 0 in case the id could not be retrieved. | |
| 3138 | + * | |
| 3139 | + * u64 bpf_sk_ancestor_cgroup_id(struct bpf_sock *sk, int ancestor_level) | |
| 3140 | + * Description | |
| 3141 | + * Return id of cgroup v2 that is ancestor of cgroup associated | |
| 3142 | + * with the *sk* at the *ancestor_level*. The root cgroup is at | |
| 3143 | + * *ancestor_level* zero and each step down the hierarchy | |
| 3144 | + * increments the level. If *ancestor_level* == level of cgroup | |
| 3145 | + * associated with *sk*, then return value will be same as that | |
| 3146 | + * of **bpf_sk_cgroup_id**\ (). | |
| 3147 | + * | |
| 3148 | + * The helper is useful to implement policies based on cgroups | |
| 3149 | + * that are upper in hierarchy than immediate cgroup associated | |
| 3150 | + * with *sk*. | |
| 3151 | + * | |
| 3152 | + * The format of returned id and helper limitations are same as in | |
| 3153 | + * **bpf_sk_cgroup_id**\ (). | |
| 3154 | + * Return | |
| 3155 | + * The id is returned or 0 in case the id could not be retrieved. | |
| 3071 | 3156 | */ |
| 3072 | 3157 | #define __BPF_FUNC_MAPPER(FN) \ |
| 3073 | 3158 | FN(unspec), \ |
| @@ -3195,7 +3280,11 @@ union bpf_attr { · 121 unmodified lines | ||
| 3195 | 3280 | FN(get_netns_cookie), \ |
| 3196 | 3281 | FN(get_current_ancestor_cgroup_id), \ |
| 3197 | 3282 | FN(sk_assign), \ |
| 3198 | − FN(ktime_get_boot_ns), | |
| 3283 | + FN(ktime_get_boot_ns), \ | |
| 3284 | + FN(seq_printf), \ | |
| 3285 | + FN(seq_write), \ | |
| 3286 | + FN(sk_cgroup_id), \ | |
| 3287 | + FN(sk_ancestor_cgroup_id), | |
| 3199 | 3288 | |
| 3200 | 3289 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |
| 3201 | 3290 | * function eBPF program intends to call |
| @@ -3673,7 +3762,7 @@ struct bpf_sock_addr { · 471 unmodified lines | ||
| 3673 | 3762 | __u32 user_ip6[4]; /* Allows 1,2,4,8-byte read and 4,8-byte write. |
| 3674 | 3763 | * Stored in network byte order. |
| 3675 | 3764 | */ |
| 3676 | − __u32 user_port; /* Allows 4-byte read and write. | |
| 3765 | + __u32 user_port; /* Allows 1,2,4-byte read and 4-byte write. | |
| 3677 | 3766 | * Stored in network byte order |
| 3678 | 3767 | */ |
| 3679 | 3768 | __u32 family; /* Allows 4-byte read, but no write */ |
| @@ -367,8 +367,14 @@ struct vfs_ns_cap_data { · 366 unmodified lines | ||
| 367 | 367 | |
| 368 | 368 | #define CAP_AUDIT_READ 37 |
| 369 | 369 | |
| 370 | +/* | |
| 371 | + * Allow system performance and observability privileged operations | |
| 372 | + * using perf_events, i915_perf and other kernel subsystems | |
| 373 | + */ | |
| 374 | + | |
| 375 | +#define CAP_PERFMON 38 | |
| 370 | 376 | |
| 371 | −#define CAP_LAST_CAP CAP_AUDIT_READ | |
| 377 | +#define CAP_LAST_CAP CAP_PERFMON | |
| 372 | 378 | |
| 373 | 379 | #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) |
| 374 | 380 | |