linux-kernel - Re: [PATCH v2] virtio_net: fix PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Jan 2017 22:45:37 +0200
From:   "Michael S. Tsirkin" <mst@...hat.com>
To:     David Miller <davem@...emloft.net>
Cc:     linux-kernel@...r.kernel.org, jasowang@...hat.com,
        virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org,
        john.fastabend@...il.com
Subject: Re: [PATCH v2] virtio_net: fix PAGE_SIZE > 64k

On Tue, Jan 24, 2017 at 03:09:59PM -0500, David Miller wrote:
> From: "Michael S. Tsirkin" <mst@...hat.com>
> Date: Tue, 24 Jan 2017 21:53:13 +0200
> 
> > I didn't realise. Why can't we? I thought that adjust_header is an
> > optional feature that userspace can test for, so no rush.
> 
> No, we want the base set of XDP features to be present in all drivers
> supporting XDP.

I see, I didn't realize this. In light of this, is there any
guidance *how much* head room is required to be considered
valid? We already have 12 bytes of headroom.


I'm generally sorry it's taking long, a large part of that is difficulty
figuring out the requirements: when we discussed this on LPC my
take-away was that one of the first users will be fighting DDOS attacks.

In light of this, I assumed that
- supporting just DROP (or DROP+TX) would already be useful
- XDP_PASS shouldn't be too slow as some people will run all
  their traffic with XDP enabled
- people actually want this in virtio because they run in a vm

Since then I heard opinions that seem to imply that
- you must support all features, not just DROP, otherwise it's useless
- XDP_PASS is a slow path fallback as people are not expected to mix XDP
  with regular sockets
- DDOS protection and by extension XDP in virtio is a developer's toy anyway

Thus, expect some slowness while I figure it all out.

-- 
MST