netdev - Re: [RFC PATCH] net: Require socket to allow XPS to set queue mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1472154564.14381.160.camel@edumazet-glaptop3.roam.corp.google.com>
Date:   Thu, 25 Aug 2016 12:49:24 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Alexander Duyck <alexander.h.duyck@...el.com>
Cc:     netdev@...r.kernel.org, rick.jones2@....com
Subject: Re: [RFC PATCH] net: Require socket to allow XPS to set queue
 mapping

On Thu, 2016-08-25 at 12:23 -0700, Alexander Duyck wrote:
> I have been seeing a number of issues where XPS leads to issues with
> packets being reordered in the transmit queues of the device drivers.  The
> main situation where this seems to occur is when a VM us using a tap
> interface to send packets to the network via a NIC that has XPS enabled.
> 
> A bit of looking into this revealed the main issue is that the scheduler
> seems to be migrating the VM between CPUs and as this occurs the traffic
> for a given flow from a VM is following this migration and hopping between
> Tx queues leading to packet reordering.
> 
> A workaround for this is to make certain all the VMs have RPS enabled on
> the tap interfaces, however this requires extra configuration on the host
> for each VM created.
> 
> A simpler approach is provided with this patch.  With it we disable XPS any
> time a socket is not present for a given flow.  By doing this we can avoid
> using XPS for any routing or bridging situations in which XPS is likely
> more of a hinderance than a help.

Yes, but this will destroy isolation for people properly doing VM cpu
pining.

With this patch, DDOS traffic coming from a VM will hit all TX queues.