From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 809C343411; Thu, 30 Nov 2023 15:17:32 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 046BC42E8B; Thu, 30 Nov 2023 15:17:32 +0100 (CET) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mails.dpdk.org (Postfix) with ESMTP id BCDC1402F0 for ; Thu, 30 Nov 2023 15:17:30 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1701353850; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=vSsYTiDogRL+0aYNLzLeZHITTrk49hhkLQG/5rYiBwQ=; b=F0gRreDV3Mri8/NB+kVZlEF70nvytPBLtVDOHmNeOszIctCp5Qcp4aCmyJgTBAPJ9WCrfE CkX6OZSINbCNFS8UjBe5v8PZARRbEJ8oQ1buGKMsUqL+6Kwtz3aP1f1w8LMybKhMFsQehx fhJPwCyICzIzC13My6F/3DOa3r1P7Fc= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-653-jgqkJhqEObGkhUtuc7u--Q-1; Thu, 30 Nov 2023 09:17:28 -0500 X-MC-Unique: jgqkJhqEObGkhUtuc7u--Q-1 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-40b5482879cso11989425e9.0 for ; Thu, 30 Nov 2023 06:17:28 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701353847; x=1701958647; h=in-reply-to:from:references:cc:to:content-language:subject :user-agent:mime-version:date:message-id:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=vSsYTiDogRL+0aYNLzLeZHITTrk49hhkLQG/5rYiBwQ=; b=BlH2c4JFKLYK7NcT4rC6g3sMp/c9AuUVq2rgOdH2oIfPBThNzD5qhiKzgIrErSXL/f t6fkdLaOoZf2/M3a6UFi4w/ZD03P1lPQq5XPbMTR88Pyu4hmhZBmeumOucJw1Qzs9ueI htHL4ZEk/wFeWS/jkPM4VTy4TUmK5cGeSw7llLaUBAhAWcWt2Qg5KblhDqzmv34MhxeV 0vWKg7x6c3QEijHLaKmuAng6e62ZQGCYxUI7pLoMYjf820t8VaIpfbuzWIyARt/1dxho woRWNlZOLuKjKCFXt30qUfzqmVvaNGUDF/0g/I4D0iHyFiSMZ3joE9cHqM9DJrz+fjx8 wpuw== X-Gm-Message-State: AOJu0YxK4zmliFJmCfVfys9HPldIaGmCtacv5eEO4c22I6G8Vs8ZS/Rp AoH54qy3eT6pXx+AqDU8QFaaCJCwpb7p9/ckuLwl3P50WST+MroagOAXd6FVhyZg/Rtykvmt1rn Jr+E= X-Received: by 2002:adf:f742:0:b0:333:1504:c366 with SMTP id z2-20020adff742000000b003331504c366mr5264661wrp.1.1701353847414; Thu, 30 Nov 2023 06:17:27 -0800 (PST) X-Google-Smtp-Source: AGHT+IFhBcV84JBBYoCzPKtYcKftk6SVuo/5D7EtCXiUtQwsolm4mMcA7R+VKxsYo9lrqjbFe1Itfg== X-Received: by 2002:adf:f742:0:b0:333:1504:c366 with SMTP id z2-20020adff742000000b003331504c366mr5264632wrp.1.1701353847010; Thu, 30 Nov 2023 06:17:27 -0800 (PST) Received: from [192.168.0.12] ([78.18.22.228]) by smtp.gmail.com with ESMTPSA id n4-20020a05600c3b8400b0040b40468c98sm5763521wms.10.2023.11.30.06.17.26 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 30 Nov 2023 06:17:26 -0800 (PST) Message-ID: <6c78956f-b3f6-483c-8072-f0e6d8610986@redhat.com> Date: Thu, 30 Nov 2023 14:17:25 +0000 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [v1] net/af_xdp: enable a sock path alongside use_cni To: "Koikkara Reeny, Shibin" , "ferruh.yigit@amd.com" , "stephen@networkplumber.org" , "lihuisong@huawei.com" , "fengchengwen@huawei.com" , "liuyonglong@huawei.com" Cc: "dev@dpdk.org" References: <20231130091332.2315572-1-mtahhan@redhat.com> From: Maryam Tahhan In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: multipart/alternative; boundary="------------Rwlpr6Y5aFyFtee3pCp0zCic" Content-Language: en-US X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org This is a multi-part message in MIME format. --------------Rwlpr6Y5aFyFtee3pCp0zCic Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Shibin No problem. Answer below. BR Maryam On 30/11/2023 13:56, Koikkara Reeny, Shibin wrote: > Hi Maryam, > > I have one more question. > > Regards, > Shibin > >> -----Original Message----- >> From: Koikkara Reeny, Shibin >> Sent: Thursday, November 30, 2023 12:14 PM >> To: Tahhan, Maryam;ferruh.yigit@amd.com; >> stephen@networkplumber.org;lihuisong@huawei.com; >> fengchengwen@huawei.com;liuyonglong@huawei.com >> Cc:dev@dpdk.org; Tahhan, Maryam >> Subject: RE: [v1] net/af_xdp: enable a sock path alongside use_cni >> >> Hi Maryam, >> >> I have added some suggestion below. >> >> Regrads, >> Shibin [snip] >>> Prerequisites >>> @@ -224,7 +225,6 @@ Howto run dpdk-testpmd with CNI plugin: >>> capabilities: >>> add: >>> - CAP_NET_RAW >>> - - CAP_BPF > Why the CAP_BPF is removed? Good question. It's removed because in our case CAP_BPF is only needed when we want to load or unload the XDP program on the interface inside the Pod. In our case the CNI is loading the xdp program on the interface and then we are doing a handshake to get the xskmap file descriptor and so we don't need the CAP_BPF. You will find a detailed listing of the permissions used at different stages when utilizing an XDP prog in this article https://next.redhat.com/2023/07/18/using-ebpf-in-unprivileged-pods/ I'm currently also working on enabling pinned map sharing with the af_xdp vdev eal arguments so we can integrate with bpfman for centralized BPF program lifecycle management [currently under test]. [snip] --------------Rwlpr6Y5aFyFtee3pCp0zCic Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
Hi Shibin

No problem.

Answer below.

BR
Maryam
On 30/11/2023 13:56, Koikkara Reeny, Shibin wrote:
Hi Maryam,

I have one more question.

Regards,
Shibin


-----Original Message-----
From: Koikkara Reeny, Shibin <shibin.koikkara.reeny@intel.com>
Sent: Thursday, November 30, 2023 12:14 PM
To: Tahhan, Maryam <mtahhan@redhat.com>; ferruh.yigit@amd.com;
stephen@networkplumber.org; lihuisong@huawei.com;
fengchengwen@huawei.com; liuyonglong@huawei.com
Cc: dev@dpdk.org; Tahhan, Maryam <mtahhan@redhat.com>
Subject: RE: [v1] net/af_xdp: enable a sock path alongside use_cni

Hi Maryam,

I have added some suggestion below.

Regrads,
Shibin

[snip]


 Prerequisites
@@ -224,7 +225,6 @@ Howto run dpdk-testpmd with CNI plugin:
           capabilities:
              add:
                - CAP_NET_RAW
-               - CAP_BPF

Why the CAP_BPF is removed?


Good question. It's removed because in our case CAP_BPF is only needed when we want to load or unload the XDP program on the interface inside the Pod. In our case the CNI is loading the xdp program on the interface and then we are doing a handshake to get the xskmap file descriptor and so we don't need the CAP_BPF.

You will find a detailed listing of the permissions used at different stages when utilizing an XDP prog in this article https://next.redhat.com/2023/07/18/using-ebpf-in-unprivileged-pods/

I'm currently also working on enabling pinned map sharing with the af_xdp vdev eal arguments so we can integrate with bpfman for centralized BPF program lifecycle management [currently under test].

[snip] --------------Rwlpr6Y5aFyFtee3pCp0zCic--