@@ -92,6 +92,7 @@ enum bpf_cmd {
92
92
BPF_PROG_GET_FD_BY_ID ,
93
93
BPF_MAP_GET_FD_BY_ID ,
94
94
BPF_OBJ_GET_INFO_BY_FD ,
95
+ BPF_PROG_QUERY ,
95
96
};
96
97
97
98
enum bpf_map_type {
@@ -143,11 +144,47 @@ enum bpf_attach_type {
143
144
144
145
#define MAX_BPF_ATTACH_TYPE __MAX_BPF_ATTACH_TYPE
145
146
146
- /* If BPF_F_ALLOW_OVERRIDE flag is used in BPF_PROG_ATTACH command
147
- * to the given target_fd cgroup the descendent cgroup will be able to
148
- * override effective bpf program that was inherited from this cgroup
147
+ /* cgroup-bpf attach flags used in BPF_PROG_ATTACH command
148
+ *
149
+ * NONE(default): No further bpf programs allowed in the subtree.
150
+ *
151
+ * BPF_F_ALLOW_OVERRIDE: If a sub-cgroup installs some bpf program,
152
+ * the program in this cgroup yields to sub-cgroup program.
153
+ *
154
+ * BPF_F_ALLOW_MULTI: If a sub-cgroup installs some bpf program,
155
+ * that cgroup program gets run in addition to the program in this cgroup.
156
+ *
157
+ * Only one program is allowed to be attached to a cgroup with
158
+ * NONE or BPF_F_ALLOW_OVERRIDE flag.
159
+ * Attaching another program on top of NONE or BPF_F_ALLOW_OVERRIDE will
160
+ * release old program and attach the new one. Attach flags has to match.
161
+ *
162
+ * Multiple programs are allowed to be attached to a cgroup with
163
+ * BPF_F_ALLOW_MULTI flag. They are executed in FIFO order
164
+ * (those that were attached first, run first)
165
+ * The programs of sub-cgroup are executed first, then programs of
166
+ * this cgroup and then programs of parent cgroup.
167
+ * When children program makes decision (like picking TCP CA or sock bind)
168
+ * parent program has a chance to override it.
169
+ *
170
+ * A cgroup with MULTI or OVERRIDE flag allows any attach flags in sub-cgroups.
171
+ * A cgroup with NONE doesn't allow any programs in sub-cgroups.
172
+ * Ex1:
173
+ * cgrp1 (MULTI progs A, B) ->
174
+ * cgrp2 (OVERRIDE prog C) ->
175
+ * cgrp3 (MULTI prog D) ->
176
+ * cgrp4 (OVERRIDE prog E) ->
177
+ * cgrp5 (NONE prog F)
178
+ * the event in cgrp5 triggers execution of F,D,A,B in that order.
179
+ * if prog F is detached, the execution is E,D,A,B
180
+ * if prog F and D are detached, the execution is E,A,B
181
+ * if prog F, E and D are detached, the execution is C,A,B
182
+ *
183
+ * All eligible programs are executed regardless of return code from
184
+ * earlier programs.
149
185
*/
150
186
#define BPF_F_ALLOW_OVERRIDE (1U << 0)
187
+ #define BPF_F_ALLOW_MULTI (1U << 1)
151
188
152
189
/* If BPF_F_STRICT_ALIGNMENT is used in BPF_PROG_LOAD command, the
153
190
* verifier will perform strict alignment checking as if the kernel
@@ -175,6 +212,9 @@ enum bpf_attach_type {
175
212
/* Specify numa node during map creation */
176
213
#define BPF_F_NUMA_NODE (1U << 2)
177
214
215
+ /* flags for BPF_PROG_QUERY */
216
+ #define BPF_F_QUERY_EFFECTIVE (1U << 0)
217
+
178
218
#define BPF_OBJ_NAME_LEN 16U
179
219
180
220
union bpf_attr {
@@ -253,6 +293,15 @@ union bpf_attr {
253
293
__u32 info_len ;
254
294
__aligned_u64 info ;
255
295
} info ;
296
+
297
+ struct { /* anonymous struct used by BPF_PROG_QUERY command */
298
+ __u32 target_fd ; /* container object to query */
299
+ __u32 attach_type ;
300
+ __u32 query_flags ;
301
+ __u32 attach_flags ;
302
+ __aligned_u64 prog_ids ;
303
+ __u32 prog_cnt ;
304
+ } query ;
256
305
} __attribute__((aligned (8 )));
257
306
258
307
/* BPF helper function descriptions:
0 commit comments