netdev - Re: [PATCH bpf-next] xdp: sample code for redirecting vlan packets to specific cpus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fb0eb1cd-c4c3-d2f8-061b-37ad939bd315@oracle.com>
Date:   Mon, 29 Oct 2018 16:11:03 -0700
From:   Shannon Nelson <shannon.nelson@...cle.com>
To:     John Fastabend <john.fastabend@...il.com>, ast@...nel.org,
        daniel@...earbox.net
Cc:     netdev@...r.kernel.org, eric.dumazet@...il.com,
        silviu.smarandache@...cle.com, shannon.lee.nelson@...il.com
Subject: Re: [PATCH bpf-next] xdp: sample code for redirecting vlan packets to
 specific cpus

On 10/29/2018 3:11 PM, John Fastabend wrote:
> On 10/29/2018 02:19 PM, Shannon Nelson wrote:
>> This is an example of using XDP to redirect the processing of
>> particular vlan packets to specific CPUs.  This is in response
>> to comments received on a kernel patch put forth previously
>> to do something similar using RPS.
>>       https://www.spinics.net/lists/netdev/msg528210.html
>>       [PATCH net-next] net: enable RPS on vlan devices
>>
>> This XDP application watches for inbound vlan-tagged packets
>> and redirects those packets to be processed on a specific CPU
>> as configured in a BPF map.  The BPF map can be modified by
>> this user program, which can also load and unload the kernel
>> XDP code.
>>
>> One example use is for supporting VMs where we can't control the
>> OS being used: we'd like to separate the VM CPU processing from
>> the host's CPUs as a way to help mitigate L1TF related issues.
>> When running the VM's traffic on a vlan we can stick the host's
>> Rx processing on one set of CPUs separate from the VM's CPUs.
>>
>> This example currently uses a vlan key and cpu value in the
>> BPF map, so only can do one CPU per vlan.  This could easily
>> be modified to use a bitpattern of CPUs rather than a CPU id
>> to allow multiple CPUs per vlan.
> 
> Great, so does this solve your use case then? At least on drivers
> with XDP support?

Well, more or less... the actual issue was a request for our UEK5 
distribution, based on v4.14, which doesn't have support for the CPU 
redirect.  Internal discussion continues.

> 
>>
>> Signed-off-by: Shannon Nelson <shannon.nelson@...cle.com>
>> ---
> 
> Some really small and trivial nits below.
> 
> Acked-by: John Fastabend <john.fastabend@...il.com>
> 

Thanks,
sln