eBPF Offload to Hardware: cls_bpf and XDP Motivation - Avoiding - PowerPoint PPT Presentation

eBPF Offload to Hardware: cls_bpf and XDP

Motivation - Avoiding Whack-a-mole

Motivation - Why eBPF?

Target architecture (NFP based NIC) RX Path

Flow of eBPF Packet

The Flow Processing Core (Fully Programmable)

Mapping eBPF -> NFP

Programming Model

Kernel basics ( before ) ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd fd BPF TC prog verifier cls_bpf verification host JIT modification driver RX XDP TX

Kernel basics ( flow no offload ) ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd fd BPF TC prog verifier cls_bpf s verification host JIT k b modification driver RX XDP TX

Kernel basics ( after ) ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd, skip_* flags fd, skip_* flags BPF TC prog verifier cls_bpf verification offload host JIT object modification ndo HW JIT / driver stats setup translator RX XDP TX & tc maps

Kernel basics ( after ) ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd, skip_* flags fd, skip_* flags BPF TC prog verifier cls_bpf verification offload host JIT object modification ndo HW JIT / driver stats setup translator RX XDP TX & tc maps

Kernel basics ( flow with offload ) ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd, skip_* flags fd, skip_* flags BPF TC prog verifier cls_bpf fallback verification offload host JIT object stats modification metadata ndo HW JIT / driver stats setup translator RX XDP TX & tc maps

Translation and loading ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd, skip_* flags fd, skip_* flags BPF TC prog verifier cls_bpf verification offload host JIT object modification ndo HW JIT / driver stats setup translator RX XDP TX & tc maps (1) Check HW capabilities and image parameters

Translation and loading ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd, skip_* flags fd, skip_* flags BPF TC prog verifier cls_bpf verification offload host JIT object modification ndo HW JIT / driver stats setup translator RX XDP TX & tc (2) Re-run the verifier maps (1) Check HW capabilities and image parameters

Translation and loading ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd, skip_* flags fd, skip_* flags BPF TC prog verifier cls_bpf (3) Collect state/analyze verification offload host JIT object modification ndo HW JIT / driver stats setup translator RX XDP TX & tc (2) Re-run the verifier maps (1) Check HW capabilities and image parameters

Translation and loading ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd fd, skip_* flags fd, skip_* flags BPF TC prog verifier cls_bpf (3) Collect state/analyze verification offload host JIT (4) Optimize object (5) JIT/generate image modification (6) Load image ndo HW JIT / driver stats setup translator RX XDP TX & tc (2) Re-run the verifier maps (1) Check HW capabilities and image parameters

Quick peek at the device path ndo HW JIT / driver descriptor stats setup translator ring RX XDP TX & tc maps kernel space device packet data m bits in descriptors Memory metadata in prepend stats core core core core core core core core maps Data path MAC0 MAC1 MAC2 MAC3

Operations and actions (done or near/mid term) ● ndo HW JIT / driver descriptor stats setup translator ring RX XDP TX & tc maps ● kernel space device ● packet data m bits in descriptors ● Memory metadata in prepend stats ● core core core core core core core core maps Data Path MAC0 MAC1 MAC2 MAC3

Map plans and ideas Use of map by offloaded Map location Mechanism needed program Read only Host + device copy update interception Read/write Device only update/read interception lock out map in kernel space Read + statistics gather update/read interception ● use verifier to check access types; ● add hooks in map code; ● add netdevice for binding the map to the device; ● read + statistics require further investigation; ● only allow read/write offload for skip-sw programs.

Optimizations and verifier future work

Demo Links to eBPF Webinar Start of Webinar: https://www.youtube.com/watch?v=apU5sg0Ui5U Start of Demo: https://youtu.be/apU5sg0Ui5U?t=2003 Also Check out: http://open-nfp.org/the-classroom/

Summary

Kernel basics ( after ) ● program XDP ● type (sk filter, kprobe, cls, xdp) tc ctrl ● license ● ... user space BPF syscall kernel space fd, skip_* flags fd, skip_* flags fd BPF TC prog verifier cls_bpf translation offload host JIT verification object modification ndo HW JIT / driver setup translator RX path XDP TX path tc