From: Jesper Dangaard Brouer <brouer@redhat.com>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Michael Richardson <mcr@sandelman.ca>,
bloat <bloat@lists.bufferbloat.net>,
brouer@redhat.com, Dave Taht <dave.taht@gmail.com>,
Markos Chandras <markos.chandras@imgtec.com>
Subject: Re: [Bloat] high speed packet and protocol processing in userspace?
Date: Fri, 17 Mar 2017 10:02:14 +0100 [thread overview]
Message-ID: <20170317100214.600bc15f@redhat.com> (raw)
In-Reply-To: <1489681664.28631.221.camel@edumazet-glaptop3.roam.corp.google.com>
On Thu, 16 Mar 2017 09:27:44 -0700 Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Thu, 2017-03-16 at 11:52 -0400, Michael Richardson wrote:
> > Dave Taht <dave.taht@gmail.com> wrote:
> > > Is it faster to execute 17 bpf vm instructions on (nearly) every
> > > packet, or to use all that old stuff?
> >
> > My understanding is that there is a JIT for ebpf.
>
> ebpf is pretty fast.
To Dave what kind of arch are you running on?
AFAIK you were running on MIPS right?
Just checked the kernel tree and I was surprised to see a bpf JIT for mips:
$ ls -1 arch/mips/net/bpf_jit*
arch/mips/net/bpf_jit_asm.S
arch/mips/net/bpf_jit.c
arch/mips/net/bpf_jit.h
But I don't know what state it is in (Markos?)
> > > B) Are there any means of easily abstracting deeper protocol processing
> > > into a higher level grammar, better than tcpdump? I found one tool,
> > > that I like conceptually - for deeply decoding a protocol -
> >
> > tcpdump just exposes the libpcap compiler. It has many annoying limitations.
> >
> > > I've googled, and thunk, and maybe I'm merely asking the wrong
> > > questions, and "the packet analysis tool to end all tools" already
> > > exists?
> >
> > Yes, people have produced them, but they go nowhere because they
> > are too specialized, or too general. The question is: are you
> > trying to build a tcp stack that punts packets at applications, or
> > do "analysis" --- which I interpret to mean to collect statistics.
The main point for getting performance out of eBPF is to avoid writing
a generic framework that need to handle everything. The point is only
to emit the instructions you need for your specific use-case.
You should think about eBPF as a programmable policy (that we don't
need/want to add to the kernel code and maintain forever) See this talk:
https://github.com/iovisor/bpf-docs/blob/master/XDP_Inside_and_Out.pdf
> Note that you can use C to write your parser, then use LLVM to
> generate native eBPF code.
Yes, that is how I use eBPF, writing restricted-C that LLVM compiles
into eBPF code. You can look at examples in the kernel git tree under
samples/bpf/
I've tried to make it easier to get started working with the LLVM setup by:
(1) providing example code that compiles outside kernel tree:
https://github.com/netoptimizer/prototype-kernel/tree/master/kernel/samples/bpf
(2) started documenting howto use eBPF:
https://prototype-kernel.readthedocs.io/en/latest/bpf/index.html
(3) Giving a talk on howto use it:
http://people.netfilter.org/hawk/presentations/OpenSourceDays2017/
https://opensourcedays.org/business/talk?speaker_id=84
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
next prev parent reply other threads:[~2017-03-17 9:02 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-16 15:19 Dave Taht
2017-03-16 15:52 ` Michael Richardson
2017-03-16 16:27 ` Eric Dumazet
2017-03-16 16:44 ` Dave Taht
2017-03-16 17:32 ` Michael Richardson
2017-03-16 20:04 ` Dave Taht
2017-03-17 9:02 ` Jesper Dangaard Brouer [this message]
2017-03-17 12:10 ` Daniel Borkmann
2017-03-17 20:11 ` Jesper Dangaard Brouer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.bufferbloat.net/postorius/lists/bloat.lists.bufferbloat.net/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170317100214.600bc15f@redhat.com \
--to=brouer@redhat.com \
--cc=bloat@lists.bufferbloat.net \
--cc=dave.taht@gmail.com \
--cc=eric.dumazet@gmail.com \
--cc=markos.chandras@imgtec.com \
--cc=mcr@sandelman.ca \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox