From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jesper Dangaard Brouer Subject: Re: [bpf-next v3 8/9] bpf: Provide helper to do forwarding lookups in kernel FIB table Date: Thu, 10 May 2018 09:31:58 +0200 Message-ID: <20180510093158.08a7ed4b@redhat.com> References: <20180510033427.20756-1-dsahern@gmail.com> <20180510033427.20756-9-dsahern@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, borkmann@iogearbox.net, ast@kernel.org, davem@davemloft.net, shm@cumulusnetworks.com, roopa@cumulusnetworks.com, toke@toke.dk, john.fastabend@gmail.com, brouer@redhat.com To: David Ahern Return-path: Received: from mx3-rdu2.redhat.com ([66.187.233.73]:48742 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S934174AbeEJHcD (ORCPT ); Thu, 10 May 2018 03:32:03 -0400 In-Reply-To: <20180510033427.20756-9-dsahern@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: On Wed, 9 May 2018 20:34:26 -0700 David Ahern wrote: > Provide a helper for doing a FIB and neighbor lookup in the kernel > tables from an XDP program. The helper provides a fastpath for forwarding > packets. If the packet is a local delivery or for any reason is not a > simple lookup and forward, the packet continues up the stack. > > If it is to be forwarded, the forwarding can be done directly if the > neighbor is already known. If the neighbor does not exist, the first > few packets go up the stack for neighbor resolution. Once resolved, the > xdp program provides the fast path. > > On successful lookup the nexthop dmac, current device smac and egress > device index are returned. > > The API supports IPv4, IPv6 and MPLS protocols, but only IPv4 and IPv6 > are implemented in this patch. The API includes layer 4 parameters if > the XDP program chooses to do deep packet inspection to allow compare > against ACLs implemented as FIB rules. > > Header rewrite is left to the XDP program. > > The lookup takes 2 flags: > - BPF_FIB_LOOKUP_DIRECT to do a lookup that bypasses FIB rules and goes > straight to the table associated with the device (expert setting for > those looking to maximize throughput) > > - BPF_FIB_LOOKUP_OUTPUT to do a lookup from the egress perspective. > Default is an ingress lookup. > > Initial performance numbers collected by Jesper, forwarded packets/sec: > > Full stack XDP FIB lookup XDP Direct lookup > IPv4 1,947,969 7,074,156 7,415,333 > IPv6 1,728,000 6,165,504 7,262,720 > The "Full stack" tests were with netfilter modules unloaded. Default setting with netfilter conntrack loaded and default Fedora firewall rules, show around 700Kpps. > These number are single CPU core forwarding on a Broadwell > E5-1650 v4 @ 3.60GHz. > > Signed-off-by: David Ahern Acked-by: Jesper Dangaard Brouer This helper is awesome, as it really shows how XDP is meant to work in concert and cooperate with the existing network stack. -- Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer