Add new operation (LINK_UPDATE), which allows to replace active bpf_prog from under given bpf_link. Currently this is only supported for bpf_cgroup_link, but will be extended to other kinds of bpf_links in follow-up patches. For bpf_cgroup_link, implemented functionality matches existing semantics for direct bpf_prog attachment (including BPF_F_REPLACE flag). User can either unconditionally set new bpf_prog regardless of which bpf_prog is currently active under given bpf_link, or, optionally, can specify expected active bpf_prog. If active bpf_prog doesn't match expected one, no changes are performed, old bpf_link stays intact and attached, operation returns a failure. cgroup_bpf_replace() operation is resolving race between auto-detachment and bpf_prog update in the same fashion as it's done for bpf_link detachment, except in this case update has no way of succeeding because of target cgroup marked as dying. So in this case error is returned.
Showing the changes to include/uapi/linux (1 of 5 files). Show all
Unified · Split
| @@ -112,6 +112,7 @@ enum bpf_cmd { · 111 unmodified lines | ||
| 112 | 112 | BPF_MAP_UPDATE_BATCH, |
| 113 | 113 | BPF_MAP_DELETE_BATCH, |
| 114 | 114 | BPF_LINK_CREATE, |
| 115 | + BPF_LINK_UPDATE, | |
| 115 | 116 | }; |
| 116 | 117 | |
| 117 | 118 | enum bpf_map_type { |
| @@ -577,6 +578,17 @@ union bpf_attr { · 459 unmodified lines | ||
| 577 | 578 | __u32 attach_type; /* attach type */ |
| 578 | 579 | __u32 flags; /* extra flags */ |
| 579 | 580 | } link_create; |
| 581 | + | |
| 582 | + struct { /* struct used by BPF_LINK_UPDATE command */ | |
| 583 | + __u32 link_fd; /* link fd */ | |
| 584 | + /* new program fd to update link with */ | |
| 585 | + __u32 new_prog_fd; | |
| 586 | + __u32 flags; /* extra flags */ | |
| 587 | + /* expected link's program fd; is specified only if | |
| 588 | + * BPF_F_REPLACE flag is set in flags */ | |
| 589 | + __u32 old_prog_fd; | |
| 590 | + } link_update; | |
| 591 | + | |
| 580 | 592 | } __attribute__((aligned(8))); |
| 581 | 593 | |
| 582 | 594 | /* The description below is an attempt at providing documentation to eBPF |