mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2026-01-17 00:05:43 +00:00
35dfaad718
This work adds a new, minimal BPF-programmable device called "netkit"
(former PoC code-name "meta") we recently presented at LSF/MM/BPF. The
core idea is that BPF programs are executed within the drivers xmit routine
and therefore e.g. in case of containers/Pods moving BPF processing closer
to the source.
One of the goals was that in case of Pod egress traffic, this allows to
move BPF programs from hostns tcx ingress into the device itself, providing
earlier drop or forward mechanisms, for example, if the BPF program
determines that the skb must be sent out of the node, then a redirect to
the physical device can take place directly without going through per-CPU
backlog queue. This helps to shift processing for such traffic from softirq
to process context, leading to better scheduling decisions/performance (see
measurements in the slides).
In this initial version, the netkit device ships as a pair, but we plan to
extend this further so it can also operate in single device mode. The pair
comes with a primary and a peer device. Only the primary device, typically
residing in hostns, can manage BPF programs for itself and its peer. The
peer device is designated for containers/Pods and cannot attach/detach
BPF programs. Upon the device creation, the user can set the default policy
to 'pass' or 'drop' for the case when no BPF program is attached.
Additionally, the device can be operated in L3 (default) or L2 mode. The
management of BPF programs is done via bpf_mprog, so that multi-attach is
supported right from the beginning with similar API and dependency controls
as tcx. For details on the latter see commit
|
||
|---|---|---|
| .. | ||
| tc_act | ||
| bpf_common.h | ||
| bpf_perf_event.h | ||
| bpf.h | ||
| btf.h | ||
| const.h | ||
| erspan.h | ||
| ethtool.h | ||
| fadvise.h | ||
| fcntl.h | ||
| filter.h | ||
| fs.h | ||
| fscrypt.h | ||
| hw_breakpoint.h | ||
| if_link.h | ||
| if_tun.h | ||
| if_xdp.h | ||
| in.h | ||
| kcmp.h | ||
| kvm.h | ||
| mman.h | ||
| mount.h | ||
| netdev.h | ||
| netlink.h | ||
| openat2.h | ||
| perf_event.h | ||
| pkt_cls.h | ||
| pkt_sched.h | ||
| prctl.h | ||
| sched.h | ||
| seccomp.h | ||
| seg6_local.h | ||
| seg6.h | ||
| stat.h | ||
| stddef.h | ||
| tcp.h | ||
| tls.h | ||
| types.h | ||
| usbdevice_fs.h | ||
| vhost.h | ||