From: Jesper Dangaard Brouer <brouer@redhat.com>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: Tom Herbert <tom@herbertland.com>,
Brenden Blanco <bblanco@plumgrid.com>,
"David S. Miller" <davem@davemloft.net>,
Linux Kernel Network Developers <netdev@vger.kernel.org>,
Martin KaFai Lau <kafai@fb.com>, Ari Saha <as754m@att.com>,
Alexei Starovoitov <alexei.starovoitov@gmail.com>,
Or Gerlitz <gerlitz.or@gmail.com>,
john fastabend <john.fastabend@gmail.com>,
Hannes Frederic Sowa <hannes@stressinduktion.org>,
Thomas Graf <tgraf@suug.ch>,
brouer@redhat.com
Subject: Re: [PATCH v6 01/12] bpf: add XDP prog type for early driver filter
Date: Mon, 11 Jul 2016 14:58:45 +0200 [thread overview]
Message-ID: <20160711145845.215e2c23@redhat.com> (raw)
In-Reply-To: <578371CE.6090305@iogearbox.net>
Trying to sum up the main points of the discussion.
Two main issues:
1) Allowing to load an XDP/eBPF program what use return codes not
compatible with the drivers.
2) Default dropping at this level make is hard to debug / no-metrics.
To solve issue #1, I proposed defining a fallback semantics. I guess,
people didn't like that semantics.
The only other solution I see, is to NOT-allow programs to be loaded
if they want to use return-codes/features not supported by the driver,
e.g reject XDP programs.
Given we cannot automatic deduct used return codes (if prog is table
driven) then we need some kind of versioning or feature codes. Could
this be modeled after NIC "features"?
I guess this could also help HW offload engines, if eBPF programs
register/annotate their needed capabilities upfront?
For issue #2 (default drop): If the solution for issue #1 is to only
loaded compatible programs, then I agree that unknown return code
should default to drop.
For debug-ability, it should be easy to extend the call
bpf_warn_invalid_xdp_action() to log more information for debugging
purposes. Which for performance/DoS reasons should be off by default.
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
Author of http://www.iptv-analyzer.org
LinkedIn: http://www.linkedin.com/in/brouer
next prev parent reply other threads:[~2016-07-11 12:58 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-08 2:15 [PATCH v6 00/12] Add driver bpf hook for early packet drop and forwarding Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 01/12] bpf: add XDP prog type for early driver filter Brenden Blanco
2016-07-09 8:14 ` Jesper Dangaard Brouer
2016-07-09 13:47 ` Tom Herbert
2016-07-10 13:37 ` Jesper Dangaard Brouer
2016-07-10 17:09 ` Brenden Blanco
2016-07-10 20:30 ` Tom Herbert
2016-07-11 10:15 ` Daniel Borkmann
2016-07-11 12:58 ` Jesper Dangaard Brouer [this message]
2016-07-10 20:27 ` Tom Herbert
2016-07-11 11:36 ` Jesper Dangaard Brouer
2016-07-10 20:56 ` Tom Herbert
2016-07-11 16:51 ` Brenden Blanco
2016-07-11 21:21 ` Daniel Borkmann
2016-07-10 21:04 ` Tom Herbert
2016-07-11 13:53 ` Jesper Dangaard Brouer
2016-07-08 2:15 ` [PATCH v6 02/12] net: add ndo to set xdp prog in adapter rx Brenden Blanco
2016-07-10 20:59 ` Tom Herbert
2016-07-11 10:35 ` Daniel Borkmann
2016-07-08 2:15 ` [PATCH v6 03/12] rtnl: add option for setting link xdp prog Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 04/12] net/mlx4_en: add support for fast rx drop bpf program Brenden Blanco
2016-07-09 14:07 ` Or Gerlitz
2016-07-10 15:40 ` Brenden Blanco
2016-07-10 16:38 ` Tariq Toukan
2016-07-09 19:58 ` Saeed Mahameed
2016-07-09 21:37 ` Or Gerlitz
2016-07-10 15:25 ` Tariq Toukan
2016-07-10 16:05 ` Brenden Blanco
2016-07-11 11:48 ` Saeed Mahameed
2016-07-11 21:49 ` Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 05/12] Add sample for adding simple drop program to link Brenden Blanco
2016-07-09 20:21 ` Saeed Mahameed
2016-07-11 11:09 ` Jamal Hadi Salim
2016-07-11 13:37 ` Jesper Dangaard Brouer
2016-07-16 14:55 ` Jamal Hadi Salim
2016-07-08 2:15 ` [PATCH v6 06/12] net/mlx4_en: add page recycle to prepare rx ring for tx support Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 07/12] bpf: add XDP_TX xdp_action for direct forwarding Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 08/12] net/mlx4_en: break out tx_desc write into separate function Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 09/12] net/mlx4_en: add xdp forwarding and data write support Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 10/12] bpf: enable direct packet data write for xdp progs Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 11/12] bpf: add sample for xdp forwarding and rewrite Brenden Blanco
2016-07-08 2:15 ` [PATCH v6 12/12] net/mlx4_en: add prefetch in xdp rx path Brenden Blanco
2016-07-08 3:56 ` Eric Dumazet
2016-07-08 4:16 ` Alexei Starovoitov
2016-07-08 6:56 ` Eric Dumazet
2016-07-08 16:49 ` Brenden Blanco
2016-07-10 20:48 ` Tom Herbert
2016-07-10 20:50 ` Tom Herbert
2016-07-11 14:54 ` Jesper Dangaard Brouer
2016-07-08 15:20 ` Jesper Dangaard Brouer
2016-07-08 16:02 ` [net-next PATCH RFC] mlx4: RX prefetch loop Jesper Dangaard Brouer
2016-07-11 11:09 ` Jesper Dangaard Brouer
2016-07-11 16:00 ` Brenden Blanco
2016-07-11 23:05 ` Alexei Starovoitov
2016-07-12 12:45 ` Jesper Dangaard Brouer
2016-07-12 16:46 ` Alexander Duyck
2016-07-12 19:52 ` Jesper Dangaard Brouer
2016-07-13 1:37 ` Alexei Starovoitov
2016-07-10 16:14 ` [PATCH v6 00/12] Add driver bpf hook for early packet drop and forwarding Tariq Toukan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160711145845.215e2c23@redhat.com \
--to=brouer@redhat.com \
--cc=alexei.starovoitov@gmail.com \
--cc=as754m@att.com \
--cc=bblanco@plumgrid.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=gerlitz.or@gmail.com \
--cc=hannes@stressinduktion.org \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=netdev@vger.kernel.org \
--cc=tgraf@suug.ch \
--cc=tom@herbertland.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).