linux-kernel - Re: [PATCH v4] bpftool: Add 'prepend' option for tcx attach to insert at chain start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <56ff9000-34e9-45ae-843e-78baab79e208@iogearbox.net>
Date: Wed, 14 Jan 2026 15:19:42 +0100
From: Daniel Borkmann <daniel@...earbox.net>
To: gyutae.opensource@...ercorp.com, Quentin Monnet <qmo@...nel.org>,
 bpf@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, Alexei Starovoitov <ast@...nel.org>,
 Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau
 <martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>,
 Song Liu <song@...nel.org>, Yonghong Song <yonghong.song@...ux.dev>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
 Jiri Olsa <jolsa@...nel.org>, Gyutae Bae <gyutae.bae@...ercorp.com>,
 Siwan Kim <siwan.kim@...ercorp.com>, Daniel Xu <dxu@...uu.xyz>,
 Jiayuan Chen <jiayuan.chen@...ux.dev>, Tao Chen <chen.dylane@...ux.dev>,
 Kumar Kartikeya Dwivedi <memxor@...il.com>
Subject: Re: [PATCH v4] bpftool: Add 'prepend' option for tcx attach to insert
 at chain start

On 1/12/26 4:45 AM, gyutae.opensource@...ercorp.com wrote:
> From: Gyutae Bae <gyutae.bae@...ercorp.com>
> 
> Add support for the 'prepend' option when attaching tcx_ingress and
> tcx_egress programs. This option allows inserting a BPF program at
> the beginning of the TCX chain instead of appending it at the end.
> 
> The implementation uses BPF_F_BEFORE flag which automatically inserts
> the program at the beginning of the chain when no relative reference
> is specified.
> 
> This change includes:
> - Modify do_attach_tcx() to support prepend insertion using BPF_F_BEFORE
> - Update documentation to describe the new 'prepend' option
> - Add bash completion support for the 'prepend' option on tcx attach types
> - Add example usage in the documentation
> - Add validation to reject 'overwrite' for non-XDP attach types
> 
> The 'prepend' option is only valid for tcx_ingress and tcx_egress attach
> types. For XDP attach types, the existing 'overwrite' option remains
> available.
> 
> Example usage:
>    # bpftool net attach tcx_ingress name tc_prog dev lo prepend
> 
> This feature is useful when the order of program execution in the TCX
> chain matters and users need to ensure certain programs run first.
Acked-by: Daniel Borkmann <daniel@...earbox.net>