1 files changed, 47 insertions, 0 deletions

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 9dfeb36f8971..3cf91754a957 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -46,6 +46,31 @@ void bpf_register_map_type(struct bpf_map_type_list *tl);
 void bpf_map_put(struct bpf_map *map);
 struct bpf_map *bpf_map_get(struct fd f);
 
+/* function argument constraints */
+enum bpf_arg_type {
+        ARG_ANYTHING = 0,       /* any argument is ok */
+
+        /* the following constraints used to prototype
+         * bpf_map_lookup/update/delete_elem() functions
+         */
+        ARG_CONST_MAP_PTR,      /* const argument used as pointer to bpf_map */
+        ARG_PTR_TO_MAP_KEY,     /* pointer to stack used as map key */
+        ARG_PTR_TO_MAP_VALUE,   /* pointer to stack used as map value */
+
+        /* the following constraints used to prototype bpf_memcmp() and other
+         * functions that access data on eBPF program stack
+         */
+        ARG_PTR_TO_STACK,       /* any pointer to eBPF program stack */
+        ARG_CONST_STACK_SIZE,   /* number of bytes accessed from stack */
+};
+
+/* type of values returned from helper functions */
+enum bpf_return_type {
+        RET_INTEGER,                    /* function returns integer */
+        RET_VOID,                       /* function doesn't return anything */
+        RET_PTR_TO_MAP_VALUE_OR_NULL,   /* returns a pointer to map elem value or NULL */
+};
+
 /* eBPF function prototype used by verifier to allow BPF_CALLs from eBPF programs
  * to in-kernel helper functions and for adjusting imm32 field in BPF_CALL
  * instructions after verifying
@@ -53,11 +78,33 @@ struct bpf_map *bpf_map_get(struct fd f);
 struct bpf_func_proto {
         u64 (*func)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
         bool gpl_only;
+        enum bpf_return_type ret_type;
+        enum bpf_arg_type arg1_type;
+        enum bpf_arg_type arg2_type;
+        enum bpf_arg_type arg3_type;
+        enum bpf_arg_type arg4_type;
+        enum bpf_arg_type arg5_type;
+};
+
+/* bpf_context is intentionally undefined structure. Pointer to bpf_context is
+ * the first argument to eBPF programs.
+ * For socket filters: 'struct bpf_context *' == 'struct sk_buff *'
+ */
+struct bpf_context;
+
+enum bpf_access_type {
+        BPF_READ = 1,
+        BPF_WRITE = 2
 };
 
 struct bpf_verifier_ops {
         /* return eBPF function prototype for verification */
         const struct bpf_func_proto *(*get_func_proto)(enum bpf_func_id func_id);
+
+        /* return true if 'size' wide access at offset 'off' within bpf_context
+         * with 'type' (read or write) is allowed
+         */
+        bool (*is_valid_access)(int off, int size, enum bpf_access_type type);
 };
 
 struct bpf_prog_type_list {