Hi Maryam, I have one more question. Regards, Shibin-----Original Message----- From: Koikkara Reeny, Shibin <shibin.koikkara.reeny@intel.com> Sent: Thursday, November 30, 2023 12:14 PM To: Tahhan, Maryam <mtahhan@redhat.com>; ferruh.yigit@amd.com; stephen@networkplumber.org; lihuisong@huawei.com; fengchengwen@huawei.com; liuyonglong@huawei.com Cc: dev@dpdk.org; Tahhan, Maryam <mtahhan@redhat.com> Subject: RE: [v1] net/af_xdp: enable a sock path alongside use_cni Hi Maryam, I have added some suggestion below. Regrads, Shibin
[snip]
Prerequisites @@ -224,7 +225,6 @@ Howto run dpdk-testpmd with CNI plugin: capabilities: add: - CAP_NET_RAW - - CAP_BPFWhy the CAP_BPF is removed?
Good question. It's removed because in our case CAP_BPF is only
needed when we want to load or unload the XDP program on the
interface inside the Pod. In our case the CNI is loading the xdp
program on the interface and then we are doing a handshake to get
the xskmap file descriptor and so we don't need the CAP_BPF.
You will find a detailed listing of the permissions used at
different stages when utilizing an XDP prog in this article
https://next.redhat.com/2023/07/18/using-ebpf-in-unprivileged-pods/
I'm currently also working on enabling pinned map sharing with the
af_xdp vdev eal arguments so we can integrate with bpfman for
centralized BPF program lifecycle management [currently under
test].