From: Jesper Dangaard Brouer <brouer@redhat.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: "Björn Töpel" <bjorn.topel@gmail.com>,
magnus.karlsson@intel.com, magnus.karlsson@gmail.com,
ast@kernel.org, daniel@iogearbox.net, netdev@vger.kernel.org,
"Björn Töpel" <bjorn.topel@intel.com>,
u9012063@gmail.com, qi.z.zhang@intel.com, brouer@redhat.com
Subject: Re: [PATCH bpf-next 0/7] Add XDP_ATTACH bind() flag to AF_XDP sockets
Date: Sat, 8 Dec 2018 16:12:12 +0100 [thread overview]
Message-ID: <20181208161212.560db94d@redhat.com> (raw)
In-Reply-To: <20181207212107.365ueu5zale4r46z@ast-mbp.dhcp.thefacebook.com>
On Fri, 7 Dec 2018 13:21:08 -0800
Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> for production I suspect the users would want
> an easy way to stay safe when they're playing with AF_XDP.
> So another builtin program that redirects ssh and ping traffic
> back to the kernel would be a nice addition.
Are you saying a buildin program that need to parse different kinds of
Eth-type headers (DSA, VLAN, QinqQ) and find the TCP port to match port
22 to return XDP_PASS, or else call AF_XDP redurect. That seems to be
pure overhead for this fast-path buildin program for AF_XDP.
Would a solution be to install a NIC hardware filter that redirect SSH
port 22 to another RX-queue. And then have a buildin program that
returns XDP_PASS installed on that RX-queue. And change Bjørns
semantics, such that RX-queue programs takes precedence over the global
XDP program. This would also be a good fail safe in general for XDP.
If the RX-queues take precedence, I can use this fail safe approach.
E.g. when I want to test my new global XDP program, I'll use ethtool
match my management IP and send that to a specific RX-queue and my
fail-safe BPF program.
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
next prev parent reply other threads:[~2018-12-08 15:12 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-07 11:44 [PATCH bpf-next 0/7] Add XDP_ATTACH bind() flag to AF_XDP sockets Björn Töpel
2018-12-07 11:44 ` [PATCH bpf-next 1/7] xsk: simplify AF_XDP socket teardown Björn Töpel
2018-12-07 11:44 ` [PATCH bpf-next 2/7] xsk: add XDP_ATTACH bind() flag Björn Töpel
2018-12-07 11:44 ` [PATCH bpf-next 3/7] bpf: add bpf_xsk_redirect function Björn Töpel
2018-12-07 11:44 ` [PATCH bpf-next 4/7] bpf: prepare for builtin bpf program Björn Töpel
2018-12-07 11:44 ` [PATCH bpf-next 5/7] bpf: add function to load builtin BPF program Björn Töpel
2018-12-07 11:44 ` [PATCH bpf-next 6/7] xsk: load a builtin XDP program on XDP_ATTACH Björn Töpel
2018-12-10 2:17 ` Jakub Kicinski
2018-12-10 7:29 ` Björn Töpel
2018-12-07 13:42 ` [PATCH bpf-next 0/7] Add XDP_ATTACH bind() flag to AF_XDP sockets Jesper Dangaard Brouer
2018-12-07 14:01 ` Björn Töpel
2018-12-08 14:52 ` Jesper Dangaard Brouer
2018-12-08 18:43 ` Björn Töpel
2018-12-08 20:42 ` Jesper Dangaard Brouer
2018-12-07 15:27 ` Björn Töpel
2018-12-07 21:21 ` Alexei Starovoitov
2018-12-08 9:31 ` Björn Töpel
2018-12-08 15:12 ` Jesper Dangaard Brouer [this message]
2018-12-08 16:55 ` Andrew Lunn
2018-12-08 20:37 ` Jesper Dangaard Brouer
2018-12-08 20:48 ` Andrew Lunn
2018-12-08 18:50 ` Björn Töpel
[not found] ` <20181207114431.18038-8-bjorn.topel@gmail.com>
2018-12-08 10:08 ` [PATCH bpf-next 7/7] samples: bpf: add support for XDP_ATTACH to xdpsock Zhang, Qi Z
2018-12-10 14:01 ` [PATCH bpf-next 0/7] Add XDP_ATTACH bind() flag to AF_XDP sockets Björn Töpel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181208161212.560db94d@redhat.com \
--to=brouer@redhat.com \
--cc=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=bjorn.topel@gmail.com \
--cc=bjorn.topel@intel.com \
--cc=daniel@iogearbox.net \
--cc=magnus.karlsson@gmail.com \
--cc=magnus.karlsson@intel.com \
--cc=netdev@vger.kernel.org \
--cc=qi.z.zhang@intel.com \
--cc=u9012063@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).