From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
To: John Fastabend <john.fastabend@gmail.com>
Cc: "Jesper Dangaard Brouer" <jbrouer@redhat.com>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Toke Høiland-Jørgensen" <toke@redhat.com>,
alardam@gmail.com, magnus.karlsson@intel.com,
bjorn.topel@intel.com, andrii.nakryiko@gmail.com,
kuba@kernel.org, ast@kernel.org, netdev@vger.kernel.org,
davem@davemloft.net, hawk@kernel.org, jonathan.lemon@gmail.com,
bpf@vger.kernel.org, jeffrey.t.kirsher@intel.com,
maciejromanfijalkowski@gmail.com,
intel-wired-lan@lists.osuosl.org,
"Marek Majtyka" <marekx.majtyka@intel.com>
Subject: Re: [PATCH v2 bpf 1/5] net: ethtool: add xdp properties flag set
Date: Tue, 8 Dec 2020 00:07:55 +0100 [thread overview]
Message-ID: <20201207230755.GB27205@ranger.igk.intel.com> (raw)
In-Reply-To: <5fce960682c41_5a96208e4@john-XPS-13-9370.notmuch>
On Mon, Dec 07, 2020 at 12:52:22PM -0800, John Fastabend wrote:
> Jesper Dangaard Brouer wrote:
> > On Fri, 4 Dec 2020 16:21:08 +0100
> > Daniel Borkmann <daniel@iogearbox.net> wrote:
> >
> > > On 12/4/20 1:46 PM, Maciej Fijalkowski wrote:
> > > > On Fri, Dec 04, 2020 at 01:18:31PM +0100, Toke Høiland-Jørgensen wrote:
> > > >> alardam@gmail.com writes:
> > > >>> From: Marek Majtyka <marekx.majtyka@intel.com>
> > > >>>
> > > >>> Implement support for checking what kind of xdp functionality a netdev
> > > >>> supports. Previously, there was no way to do this other than to try
> > > >>> to create an AF_XDP socket on the interface or load an XDP program and see
> > > >>> if it worked. This commit changes this by adding a new variable which
> > > >>> describes all xdp supported functions on pretty detailed level:
> > > >>
> > > >> I like the direction this is going! :)
> >
> > (Me too, don't get discouraged by our nitpicking, keep working on this! :-))
> >
> > > >>
> > > >>> - aborted
> > > >>> - drop
> > > >>> - pass
> > > >>> - tx
> > >
> > > I strongly think we should _not_ merge any native XDP driver patchset
> > > that does not support/implement the above return codes.
> >
> > I agree, with above statement.
> >
> > > Could we instead group them together and call this something like
> > > XDP_BASE functionality to not give a wrong impression?
> >
> > I disagree. I can accept that XDP_BASE include aborted+drop+pass.
> >
> > I think we need to keep XDP_TX action separate, because I think that
> > there are use-cases where the we want to disable XDP_TX due to end-user
> > policy or hardware limitations.
>
> How about we discover this at load time though. Meaning if the program
> doesn't use XDP_TX then the hardware can skip resource allocations for
> it. I think we could have verifier or extra pass discover the use of
> XDP_TX and then pass a bit down to driver to enable/disable TX caps.
+1
>
> >
> > Use-case(1): Cloud-provider want to give customers (running VMs) ability
> > to load XDP program for DDoS protection (only), but don't want to allow
> > customer to use XDP_TX (that can implement LB or cheat their VM
> > isolation policy).
>
> Not following. What interface do they want to allow loading on? If its
> the VM interface then I don't see how it matters. From outside the
> VM there should be no way to discover if its done in VM or in tc or
> some other stack.
>
> If its doing some onloading/offloading I would assume they need to
> ensure the isolation, etc. is still maintained because you can't
> let one VMs program work on other VMs packets safely.
>
> So what did I miss, above doesn't make sense to me.
>
> >
> > Use-case(2): Disable XDP_TX on a driver to save hardware TX-queue
> > resources, as the use-case is only DDoS. Today we have this problem
> > with the ixgbe hardware, that cannot load XDP programs on systems with
> > more than 192 CPUs.
>
> The ixgbe issues is just a bug or missing-feature in my opinion.
Not a bug, rather HW limitation?
>
> I think we just document that XDP_TX consumes resources and if users
> care they shouldn't use XD_TX in programs and in that case hardware
> should via program discovery not allocate the resource. This seems
> cleaner in my opinion then more bits for features.
But what if I'm with some limited HW that actually has a support for XDP
and I would like to utilize XDP_TX?
Not all drivers that support XDP consume Tx resources. Recently igb got
support and it shares Tx queues between netstack and XDP.
I feel like we should have a sort-of best effort approach in case we
stumble upon the XDP_TX in prog being loaded and query the driver if it
would be able to provide the Tx resources on the current system, given
that normally we tend to have a queue per core.
In that case igb would say yes, ixgbe would say no and prog would be
rejected.
>
> >
> >
> > > If this is properly documented that these are basic must-have
> > > _requirements_, then users and driver developers both know what the
> > > expectations are.
> >
> > We can still document that XDP_TX is a must-have requirement, when a
> > driver implements XDP.
>
> +1
>
> >
> >
> > > >>> - redirect
> > > >>
> >
> >
> > --
> > Best regards,
> > Jesper Dangaard Brouer
> > MSc.CS, Principal Kernel Engineer at Red Hat
> > LinkedIn: http://www.linkedin.com/in/brouer
> >
>
>
next prev parent reply other threads:[~2020-12-07 23:17 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-04 10:28 [PATCH v2 bpf 0/5] New netdev feature flags for XDP alardam
2020-12-04 10:28 ` [PATCH v2 bpf 1/5] net: ethtool: add xdp properties flag set alardam
2020-12-04 12:18 ` Toke Høiland-Jørgensen
2020-12-04 12:46 ` Maciej Fijalkowski
2020-12-04 15:21 ` Daniel Borkmann
2020-12-04 17:20 ` Toke Høiland-Jørgensen
2020-12-04 22:19 ` Daniel Borkmann
2020-12-07 11:54 ` Jesper Dangaard Brouer
2020-12-07 12:08 ` Toke Høiland-Jørgensen
2020-12-07 12:03 ` Toke Høiland-Jørgensen
2020-12-07 12:54 ` Jesper Dangaard Brouer
2020-12-07 20:52 ` John Fastabend
2020-12-07 22:38 ` Saeed Mahameed
2020-12-07 23:07 ` Maciej Fijalkowski [this message]
2020-12-09 6:03 ` John Fastabend
2020-12-09 9:54 ` Maciej Fijalkowski
2020-12-09 11:52 ` Jesper Dangaard Brouer
2020-12-09 15:41 ` David Ahern
2020-12-09 17:15 ` Saeed Mahameed
2020-12-10 3:34 ` David Ahern
2020-12-10 6:48 ` Saeed Mahameed
2020-12-10 15:30 ` David Ahern
2020-12-10 18:58 ` Saeed Mahameed
2021-01-05 11:56 ` Marek Majtyka
2021-02-01 16:16 ` Toke Høiland-Jørgensen
2021-02-02 11:26 ` Marek Majtyka
2021-02-02 12:05 ` Toke Høiland-Jørgensen
2021-02-02 19:34 ` Jakub Kicinski
2021-02-03 12:50 ` Marek Majtyka
2021-02-03 17:02 ` Jakub Kicinski
2021-02-10 10:53 ` Toke Høiland-Jørgensen
2021-02-10 18:31 ` Jakub Kicinski
2021-02-10 22:52 ` Toke Høiland-Jørgensen
2021-02-12 1:26 ` Jakub Kicinski
2021-02-12 2:05 ` Alexei Starovoitov
2021-02-12 7:02 ` Marek Majtyka
2021-02-16 14:30 ` Toke Høiland-Jørgensen
2020-12-09 15:44 ` David Ahern
2020-12-10 13:32 ` Explaining XDP redirect bulk size design (Was: [PATCH v2 bpf 1/5] net: ethtool: add xdp properties flag set) Jesper Dangaard Brouer
2020-12-10 14:14 ` [Intel-wired-lan] " Magnus Karlsson
2020-12-10 17:30 ` Jesper Dangaard Brouer
2020-12-10 19:20 ` Saeed Mahameed
2020-12-08 1:01 ` [PATCH v2 bpf 1/5] net: ethtool: add xdp properties flag set David Ahern
2020-12-08 8:28 ` Jesper Dangaard Brouer
2020-12-08 11:58 ` Toke Høiland-Jørgensen
2020-12-09 5:50 ` John Fastabend
2020-12-09 10:26 ` Toke Høiland-Jørgensen
2020-12-08 9:00 ` Jesper Dangaard Brouer
2020-12-08 9:42 ` Daniel Borkmann
2020-12-04 12:57 ` Maciej Fijalkowski
2020-12-04 10:28 ` [PATCH v2 bpf 2/5] drivers/net: turn XDP properties on alardam
2020-12-04 12:19 ` Toke Høiland-Jørgensen
2020-12-04 10:28 ` [PATCH v2 bpf 3/5] xsk: add usage of xdp properties flags alardam
2020-12-04 10:29 ` [PATCH v2 bpf 4/5] xsk: add check for full support of XDP in bind alardam
2020-12-04 10:29 ` [PATCH v2 bpf 5/5] ethtool: provide xdp info with XDP_PROPERTIES_GET alardam
2020-12-04 17:20 ` [PATCH v2 bpf 0/5] New netdev feature flags for XDP Jakub Kicinski
2020-12-04 17:26 ` Toke Høiland-Jørgensen
2020-12-04 19:22 ` Jakub Kicinski
2020-12-07 12:04 ` Toke Høiland-Jørgensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201207230755.GB27205@ranger.igk.intel.com \
--to=maciej.fijalkowski@intel.com \
--cc=alardam@gmail.com \
--cc=andrii.nakryiko@gmail.com \
--cc=ast@kernel.org \
--cc=bjorn.topel@intel.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=hawk@kernel.org \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=jbrouer@redhat.com \
--cc=jeffrey.t.kirsher@intel.com \
--cc=john.fastabend@gmail.com \
--cc=jonathan.lemon@gmail.com \
--cc=kuba@kernel.org \
--cc=maciejromanfijalkowski@gmail.com \
--cc=magnus.karlsson@intel.com \
--cc=marekx.majtyka@intel.com \
--cc=netdev@vger.kernel.org \
--cc=toke@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).