Re: [PATCH bpf-next 1/4] xdp: Support specifying expected existing program when attaching XDP

Yonghong Song
2020-03-20T02:13:59Z

On 3/19/20 6:13 AM, Toke Høiland-Jørgensen wrote:
> From: Toke Høiland-Jørgensen <toke@redhat.com>
>
> While it is currently possible for userspace to specify that an existing
> XDP program should not be replaced when attaching to an interface, there is
> no mechanism to safely replace a specific XDP program with another.
>
> This patch adds a new netlink attribute, IFLA_XDP_EXPECTED_FD, which can be
> set along with IFLA_XDP_FD. If set, the kernel will check that the program
> currently loaded on the interface matches the expected one, and fail the
> operation if it does not. This corresponds to a 'cmpxchg' memory operation.

The patch set itself looks good to me. But previously there is a
discussion regarding a potential similar functionality through bpf_link.
I guess maintainers (Alexei and Daniel) need to weigh in as some
future vision is involved.

>
> A new companion flag, XDP_FLAGS_EXPECT_FD, is also added to explicitly
> request checking of the EXPECTED_FD attribute. This is needed for userspace
> to discover whether the kernel supports the new attribute.
>
> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
> ---
> include/linux/netdevice.h | 2 +-
> include/uapi/linux/if_link.h | 4 +++-
> net/core/dev.c | 25 ++++++++++++++++++++-----
> net/core/rtnetlink.c | 11 +++++++++++
> 4 files changed, 35 insertions(+), 7 deletions(-)
>
> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index b6fedd54cd8e..40b12bd93913 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -3767,7 +3767,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
>
> typedef int (*bpf_op_t)(struct net_device *dev, struct netdev_bpf *bpf);
> int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
> - int fd, u32 flags);
> + int fd, int expected_fd, u32 flags);
> u32 __dev_xdp_query(struct net_device *dev, bpf_op_t xdp_op,
> enum bpf_netdev_command cmd);
> int xdp_umem_query(struct net_device *dev, u16 queue_id); …