From mboxrd@z Thu Jan 1 00:00:00 1970 From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= Subject: Re: [bpf-next v3 8/9] bpf: Provide helper to do forwarding lookups in kernel FIB table Date: Thu, 10 May 2018 11:09:53 +0200 Message-ID: <87lgcryizi.fsf@toke.dk> References: <20180510033427.20756-1-dsahern@gmail.com> <20180510033427.20756-9-dsahern@gmail.com> <20180510093158.08a7ed4b@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Cc: netdev@vger.kernel.org, borkmann@iogearbox.net, ast@kernel.org, davem@davemloft.net, shm@cumulusnetworks.com, roopa@cumulusnetworks.com, john.fastabend@gmail.com, brouer@redhat.com To: Jesper Dangaard Brouer , David Ahern Return-path: Received: from mail.toke.dk ([52.28.52.200]:34547 "EHLO mail.toke.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751313AbeEJJJq (ORCPT ); Thu, 10 May 2018 05:09:46 -0400 In-Reply-To: <20180510093158.08a7ed4b@redhat.com> Sender: netdev-owner@vger.kernel.org List-ID: Jesper Dangaard Brouer writes: > On Wed, 9 May 2018 20:34:26 -0700 > David Ahern wrote: > >> Provide a helper for doing a FIB and neighbor lookup in the kernel >> tables from an XDP program. The helper provides a fastpath for forwarding >> packets. If the packet is a local delivery or for any reason is not a >> simple lookup and forward, the packet continues up the stack. >> >> If it is to be forwarded, the forwarding can be done directly if the >> neighbor is already known. If the neighbor does not exist, the first >> few packets go up the stack for neighbor resolution. Once resolved, the >> xdp program provides the fast path. >> >> On successful lookup the nexthop dmac, current device smac and egress >> device index are returned. >> >> The API supports IPv4, IPv6 and MPLS protocols, but only IPv4 and IPv6 >> are implemented in this patch. The API includes layer 4 parameters if >> the XDP program chooses to do deep packet inspection to allow compare >> against ACLs implemented as FIB rules. >> >> Header rewrite is left to the XDP program. >> >> The lookup takes 2 flags: >> - BPF_FIB_LOOKUP_DIRECT to do a lookup that bypasses FIB rules and goes >> straight to the table associated with the device (expert setting for >> those looking to maximize throughput) >> >> - BPF_FIB_LOOKUP_OUTPUT to do a lookup from the egress perspective. >> Default is an ingress lookup. >> >> Initial performance numbers collected by Jesper, forwarded packets/sec: >> >> Full stack XDP FIB lookup XDP Direct lookup >> IPv4 1,947,969 7,074,156 7,415,333 >> IPv6 1,728,000 6,165,504 7,262,720 >> > > The "Full stack" tests were with netfilter modules unloaded. Default > setting with netfilter conntrack loaded and default Fedora firewall > rules, show around 700Kpps. > >> These number are single CPU core forwarding on a Broadwell >> E5-1650 v4 @ 3.60GHz. >> >> Signed-off-by: David Ahern > > Acked-by: Jesper Dangaard Brouer > > This helper is awesome, as it really shows how XDP is meant to work in > concert and cooperate with the existing network stack. +1! -Toke