netdev - Re: [RFC PATCH] net: Require socket to allow XPS to set queue mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 25 Aug 2016 14:42:34 -0700
From:   Tom Herbert <tom@...bertland.com>
To:     Eric Dumazet <eric.dumazet@...il.com>
Cc:     Alexander Duyck <alexander.h.duyck@...el.com>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Rick Jones <rick.jones2@....com>
Subject: Re: [RFC PATCH] net: Require socket to allow XPS to set queue mapping

On Thu, Aug 25, 2016 at 12:49 PM, Eric Dumazet <eric.dumazet@...il.com> wrote:
> On Thu, 2016-08-25 at 12:23 -0700, Alexander Duyck wrote:
>> I have been seeing a number of issues where XPS leads to issues with
>> packets being reordered in the transmit queues of the device drivers.  The
>> main situation where this seems to occur is when a VM us using a tap
>> interface to send packets to the network via a NIC that has XPS enabled.
>>
>> A bit of looking into this revealed the main issue is that the scheduler
>> seems to be migrating the VM between CPUs and as this occurs the traffic
>> for a given flow from a VM is following this migration and hopping between
>> Tx queues leading to packet reordering.
>>
>> A workaround for this is to make certain all the VMs have RPS enabled on
>> the tap interfaces, however this requires extra configuration on the host
>> for each VM created.
>>
>> A simpler approach is provided with this patch.  With it we disable XPS any
>> time a socket is not present for a given flow.  By doing this we can avoid
>> using XPS for any routing or bridging situations in which XPS is likely
>> more of a hinderance than a help.
>
> Yes, but this will destroy isolation for people properly doing VM cpu
> pining.
>
> With this patch, DDOS traffic coming from a VM will hit all TX queues.
>
As I said the other thread, the better solution is to start tracking
flows coming out of VMs.

Tom

>
>
>
>