Re: [PATCH v4] bpftool: Add 'prepend' option for tcx attach to insert at chain start

[Quentin Monnet]

2026-01-12 12:45 UTC+0900 ~ gyutae.opensource@xxxxxxxxxxxxx
> From: Gyutae Bae <gyutae.bae@xxxxxxxxxxxxx>
> 
> Add support for the 'prepend' option when attaching tcx_ingress and
> tcx_egress programs. This option allows inserting a BPF program at
> the beginning of the TCX chain instead of appending it at the end.
> 
> The implementation uses BPF_F_BEFORE flag which automatically inserts
> the program at the beginning of the chain when no relative reference
> is specified.
> 
> This change includes:
> - Modify do_attach_tcx() to support prepend insertion using BPF_F_BEFORE
> - Update documentation to describe the new 'prepend' option
> - Add bash completion support for the 'prepend' option on tcx attach types
> - Add example usage in the documentation
> - Add validation to reject 'overwrite' for non-XDP attach types
> 
> The 'prepend' option is only valid for tcx_ingress and tcx_egress attach
> types. For XDP attach types, the existing 'overwrite' option remains
> available.
> 
> Example usage:
>   # bpftool net attach tcx_ingress name tc_prog dev lo prepend
> 
> This feature is useful when the order of program execution in the TCX
> chain matters and users need to ensure certain programs run first.
> 
> Co-developed-by: Siwan Kim <siwan.kim@xxxxxxxxxxxxx>
> Signed-off-by: Siwan Kim <siwan.kim@xxxxxxxxxxxxx>
> Signed-off-by: Gyutae Bae <gyutae.bae@xxxxxxxxxxxxx>
> Reviewed-by: Quentin Monnet <qmo@xxxxxxxxxx>
> ---
> Hi Quentin.
> 
> Thank you for the review! I have added the validation for 'overwrite'
> option as you suggested.
> 
> I used a whitelist approach (rejecting non-XDP types) rather than
> a blacklist approach (rejecting TCX types) to be consistent with the
> 'prepend' validation style and to ensure that any future attach types
> will also be rejected by default unless explicitly allowed.


Looks good, thank you!
Quentin