►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Efficient and Flexible Virtual Machine Networking Through eBPF - Jason Wang, Red Hat
This talk will seek the method to build VM networking infrastructure through eBPF. Traditional networking datapath and several limitations of it will be reviewed first . Then eBPF based method will be introduced: eBPF based filtering allows a user configurable high speed packet filtering solution like virtio-net filter for vhost; eBPF based packet steering allows userspace to inject its own steering policy like RSS; eBPF/XDP based host datapth acceleration allow userspace to build a flexible and efficient datapath on host; eBPF offloading allow guest to offload eBPF tasks like XDP and tc_cls to host for a native packet processing on host. At the end, the performance numbers, challenges and future work will be also discussed.
https://sched.co/Nrtz
A
This
is
a
graphic
which
tip
is
very
typical
for
on
the
kernel-based
virtual
machine
structure,
and
virtue
is
based
basically
the
physical
signal
for
communication
between
host
and
virtual
virtual
machine,
and
we
also
have
a
back
end
little
snack
and
it
will
connect
with
different
virtual
devices
and
the
simplest
is
tap
and
we
are
using
tap
to
combine
with
bridging
new
UVs
and
connected
with
the
other
physical
interface
and
in
simpler
scenario.
We'll
simply
use
magnet
happen.
A
It's
closely
coupled
with
foundational
physical
device
and
in
this
slice
we
mainly
talk
about
the
issues
we
are
facing,
for
example,
fish
efficiency.
First,
you
know
that
the
kernel
based
environment
is
pretty
insufficient
and
not
very
efficient
and
slower
than
the
nearest
based
data
path.
If
your
own
using
PBS,
then
we
can
only
get
10%
of
the
user
space
and,
if
you're
reading
through
all
the
codes,
then
you
can
easily
understand
it.
But
still
there
are
a
lot
of
barriers
to
overcome
and
flexibility
is
not
the
issue
and
we
can
easily
imagine
this.
A
If
we're
adding
this
new
feature,
then
we
have
to
develop
in
different
kernel
modules
and
in
different
levels.
For
example,
we
have
to
redevelop
and
do
debugging
and
optimization
for
kernel,
qme
and
host,
and
if
you
are
doing
this
development
on
kernel,
that
will
be
a
bit
difficult
and
will
be
challenging
and
the
development
for
new
features
is
a
bit
slow
and
we
are
seeking
a
path
just
like
updating
firmware
like
what
physical
and
IC
did.
A
So
if
you
have
come
into
play
and
it's
pretty
efficient,
very
secure
in
internal
virtual
machine
to
the
right
we
can
see.
This
is
the
EPF
code
and
we
have
generic
computing
definition
and
other
tread
code
and
it
will
be
imported
into
kernel
and
attached
to
fixed
cook.
Point
that
would
drive
the
firmware
and
a
PPF
is
basically
a
expanded
version
of
BPF.
Like
the
previous
speaker
mentioned,
it's
evolved
from
the
classic
BPF
and
it's
simply
like
interpreter
and
it's
more
effective
compared
with
cdpf,
and
there
are
lots
of
expansions.
A
For
example,
they
have
more
registers
and
more
instructions
referencing
on
x86
in
our
platform,
and
we
have
lots
of
LLVM
back-end
and
we
can
easily
reflect
the
EVF
code
into
our
more
x86
and
we
allowed
more
user
space.
Space
and
CBP
F
cannot
only
filter
the
packets,
but
a
PDF
can
also
do
the
same,
but
we
will
abstract
it
into
context
and
for
both
reading
and
writing
in
this
environment.
Basically,
we
are
doing
reading
and
writing
for
the
context,
if
we're
only
considering
the
network,
basically
we're
reading
and
writing
on
the
packet.
A
So
we
can
produce
just-in-time
code
and
is
pretty
secure
and
we
have
a
very
fire
in
kernel
and
we
will
minimize
the
risk
of
that
lock
and
it's
very
efficient
in
all
the
mainstream
struct,
it's
the
most
efficient.
We
were
compiling
the
code
into
the
form
that
we
want.
We
can
also
do
BPF
sis
card
for
managing
programs.
So
this
is
what
I've
introduced.
How
can
we
run
a
EPF
destructon?
So,
let's
speed
up.
A
First,
we
have
a
C
program,
PPF
program,
dot,
C,
and
we
will
compile
it
into
BPF
program
down
Oh
using
LLVM
or
clang,
and
that
will
have
a
loader
that
will
we
will
do
assist
card
in
BPF
in
that
we
will
transfer
it
into
a
verifier
and
then
transfer
it
to
JIT
JIT.
And
if
we
don't
have
a
JIT,
then
we
will
directly
run
the
BPF
program
attached
and
run
and
we'll
also
have
one
limitation.
We
were
using
map
which
is
predefined
data
struct.
A
And
also
the
user
control
program
will
borrow
user
program
and
injected
into
different
points.
Different
note,
for
example,
into
socket
case
point
K,
probe,
stress
points,
etc.
The
most
important
is
TC
and
xdp,
and
another
major
changes
that
it
allows
the
exchange
with
kernel,
and
we
can
call
the
other
defined
in
how
far
is
from
Colonel
and
we
combine
it
with
kernel
struct
in
the
story.
A
A
A
A
So
it
was
designed
to
interact
with
existing
struct.
We
can
use
the
current
network,
stack,
configuration,
visibility,
debugging
and
tcp/ip
protocol
stack,
router
and
transmission
struct.
They
can
also
help
with
the
transmission
of
this
XDP.
We
will
not
provide
any
ready
to
view
strategies,
but
we
can
use
all
the
strategies
in
map
and
existing
kernel
and
routers,
and
then
we
can
trust
mitad
and
will
also
provide
a
very
good
format
and
when
the
drivers
not
supporting
the
optimization
of
hex
DP,
we
can
do
it
in
xdp
level.
A
The
performance
might
be
damaged,
but
the
function
remains
the
same
and
about
how
can
we
help
in
the
virtual
environment?
We
can
use
tab
and
makes
DP
support
processes
packaged
earlier,
and
we
have
redirected
exiting
frames
between
tab
and
under
another
XDP,
cable,
ni
c,
to
accelerate
host
data
path
and
transform
the
packages,
and
we
can
speed
up
the
XTP
prog.
We
have
tested
five
data
path.
First,
at
gas
TC
and
traditional
host
x,
vp
data
path.
So
we
can
see
this
performance
is
not
very
good
and
basically
the
lowest.
A
So
it's
less
than
two
MPs
and
the
second
is
we
replaced
it
with
guest
x
DP,
so
we
improved
it
slightly.
The
performance
and
the
third
is
that
we're
doing
the
guest
x
DP
fast,
redirect
on
host
and
the
performance
is
being
improved
dramatically
and
the
fourth
is
that
we're
using
as
TP
+
x,
DP
redirect
and
we
shut
down
the
snap
and
we're
using
linux
next
and
NOS
map
and
on.
A
So
we
can
do
a
lot
of
things
in
this
regard
and
we
are
still
considering
high
level
features
first
of
a
DPF
filter
and
basically
in
production
environment,
we
are
using
lots
of
IP
filters
and
EP
PF
is
based
on
back-end
for
ipad
IP
tables
and
in
upstream
communities.
They
mention
this
be
careful
filters
and
it's
basically
based
on
a
PDF,
and
what
did
it
do.
A
A
Can
you
intercept
this
the
establishment
of
rules
and
they
will
also
create
a
helper
based
on
the
customers
needs
and
the
main
function
listed
will
extract
the
rules
of
IP
table.
Then
it
will
can
become
based
on
a
PDF
backhand
and
based
on
the
support
of
a
PDF,
and
we
were
injected
into
native
ICP
or
hardware.
A
A
We
need
main
logic
and
the
main
logic
is
RFC
and
we
are
now
based
on
sk
d
IP
table
and
we
have
to
transmit
it
into
offload
structure
and
a
flow,
the
environment
and
it's
very
efficient
as
a
solution-
and
this
is
pretty
interesting,
like
I've,
discussed,
attach
new
STD
problem
and
it
has
its
own
logic
for
processing
of
the
packages,
and
there
are
other
issues.
For
example,
we
have
to
minimize
the
load
custard
by
virtual
machines.
So
what
can
we
do?
How
can
we
go
into
this
dps?
A
This
program
is
operating
on
host
and
we
need
to
minimize
the
load
for
virtual
machine
and
xvp.
As
we
know,
it's
based
on
the
logic
that
can
cooperate
with
generic
xdp
and
traditional
data
stack,
and
we
can
use
x,
DP
tap
and
if
it's
on
host,
we
have
a
hardware
available
and
we
can
continue
to
upload
the
program
into
small
and
how
can
we
do
it
and
why
can
we
do
it?
For
example,
EPP
f
is
a
self-contained
definition.
It's
very
flexible.
A
A
B
A
And
offload,
as
he
program
will
only
only
process
the
JIT
package
filtering
and
we
will
reference
on
different
levels
and
different
type
of
powders
and
we'll
process
or
the
packet
on
back-end
and
it's
zero
topic
in
the
process
now
load
casted
onto
the
map,
and
if
we
cannot
finish
with
processing,
then
we
have
to
read
direct
or
the
unfinished
package
into
the
system
and
we
have
to
redo
the
whole
process.
This
is
the
whole
procedure
and
this
is
the
service
chaining.
We
have
tested
different
data
path,
let's
focus
on
the
number.
A
A
Xcp,
how
can
we
support
the
temporary
device,
for
example,
bomb
team
and
one
features
that
rely
on
the
fundamental
device
to
reflect
the
logic,
for
example
cell
over
the
s
and
software
transmission?
If
the
device
is
employed,
we
have
to
switch
to
the
software
software
Titan
in
the
physical
device
which
supports
SDP
but
Tamar.
It's
not
necessarily
using
xcp
to
calculate
all
the
complex
logic.
B
So
we
can
use
that
and
we
cannot
to
copy
all
the
proceed
program
in
today's
the
pound.
So
this
harder
tips
to
the
virtualization
impose
there
is
no
and
the
pound
Ottoman
de
also.
We
cannot
transfer
this
to
life
as
a
pro
in
this
virtualized
environment,
but
can
also
be
working
in
the
SGP
and
the
unit
environment.
It
relies
on
the
generic
accelerate
accelerate.
B
B
A
B
Logic
can
be
conducted
realized
in
SDP,
but
they
would
have
SP
pass
and
when
the
logic
is
very
complicated,
we
can
use
it
in
the
traditional
path
to
deal
with
it.
This
is
a
park
of
performance,
it's
realized
in
the
Malcolm
black,
and
if
we
just
do
this
gos
piece,
you
can
see
this
the
level
of
4mm
EPS
and
if
we
reach
it
higher
than
we
can
see
the
10
this
the
marked
in
yellow,
because
the
murkland
is
on
logic.
B
B
And
it's
like
we
need
to
upload
that
little
flow
from
the
original
one
to
the
destination
we
need
to
upload.
We
just
need
to
bypass
the
kernel
path.
Okay,
actualize
realized
X,
deep
sniff
flower.
We
need
to
translate
this
upload
the
program
and
to
use
SDP
program
to
make
it
a
member
to
the
SDP,
but
we
cannot
realize
all
the
logical
with
this
activity.
The
path.
B
If
we
cannot
deal
with
a
lot
of
complicated
issues,
we
can
use
that
activity
as
and
focus
on
traditional
didn't
pass,
but
all
should
be
realized
through
XDP
data
path
and
the
rest
when
they
were
list
a
lot
of
the
information
that
they
can
because
of
the
size
of
instructions.
The
limitations
will
be
relieved.
B
B
This
moved
bomb
Berto
one
put
one
and
we'd
like
to
combine
it
with
the
virtual
virtual
one
point
one,
and
there
are
two
more
to
most
once
they're
a
couple.
They
have
the
support
of
the
driver
when
the
zero
copy
is
enabled
the
VF
STP
there
will
be
transferred
and
translated
into
the
fire
that
they
can
be
no
pilot
descriptor,
and
they
don't
need
the
data
package
copy.
Why
it's
generic
it
doesn't
need
any
support
on
a
travel,
but
it's
very
slow.
It's
based
on
the
slow,
STP
xtp.
B
It
has
limitation,
it
used
you
ma'am,
you
mem
is
miss
that
the
SPG
socket
can
only
be
read
and
the
write
in
a
certain
specific
region,
and
we
need
to
use
the
memory
to
make
it
stored
in
its
memory
and
also
the
matches
the
size
of
the
packet
is
about
to
cave,
and
the
metadata
is
very
simple.
You
cannot
support
a
very
complicated
task,
such
as
uploading,
so
how
can
we
apply
F
in
p.m.
B
We
have
this
device?
It
is
FTP
socket.
If
we
get
stuck.
If
you
attach
it
to
them,
we
can
realize
their
allies,
this
virtualized
the
data
path,
and
if
you
printed
on
the
physical
n
IC,
we
can
see
this
data
path
for
this
in
I
see.
But
you
can
see
there's
a
lot
of
issues
here,
so
you
can
use
the
V
Hostin
user
to
have
a
high
efficient
route.
If
you
don't
want
to
go
to
the
route,
you
need
to
realize
the
freedom
copy
of
the
tap
and.
A
B
B
We
introduce
that
a
skip
PT
device
once
the
application,
the
socket
is
generated,
and
it's
bounded
to
this
the
device.
Then
the
instructions
and
all
the
original
data
will
be
transferred
to
the
backend
and
the
socket
will
be
generated
and
all
the
X
x
TP
they
can
all
be
stored.
But
this
application
is
just
activated.
That's
the
back
end
STP,
so
you
can
achieve
the
same
performance.
B
So
it's
just
the
responsible
for
some
startup
a
stop
and
the
configuration
is
very
simple
tasks
and
the
EBT
have
faced
the
hope
me
host
data
pass.
We
did
a
deal
with
because
well
developing
different
they're,
willing
outs
and
the
different
way
out.
I
think
it's
very
complicated
and
painful,
and
that
we
need
to
to
requires
migration
for
the
parka
fix
and
when
the
new
ring
layout
requires
a
lot
of
hard
work.
So
we
think
that
we
can
decouple
the
ring.
B
B
Can
be
attached
to
the
GNU
GPL
program,
but
we
have
lot
of
issues
here.
One
is
the
performance
and
how
to
realize
the
batching
and
the
work
flow
is
the
similar
when
I
guess
the
Trevor
access
news
and
but
the
pakery
is
licked
and
to
the
hosts
when
the
extreme
friend
come
to
the
host
and
it
will
activated
all
the
code
a
kind
of
code,
but
we
need
to
design
that
it
very
carefully
mrs.
status.
B
So
PPP
order
is
only
a
skeleton
and
the
virtual
net
is
just
or
its
original,
and
it
can
also
be
and
only
be
realized
in
native
part,
RFC
and
all
of
the
XDP
data
path.
We
are
building
a
prototype
and
officer
s
XD,
because
it's
still
artists,
E
and
F
2,
X,
2
P
path.
Through
the
data
path.
We
are
still
planning
it.
B
B
What
does
it
come?
How
it
is,
oh
and
to
add
it
in
to
it?
So
this
the
program
we
need
to
be
injected
into
the
kernel,
and
it
has
a
self
encode,
then
through
the
loader
that
it
can
be
injected
into
the
kernel.
So
it's
a
kind
of
the
self
code.
So
if
you
want
to
compile
a
packet
now
at
home,
it's
just
a
binary
file,
you
can
have
it
in
to
dip
all
sorts
of
forms,
because
the
binary
is
compatible
with
is
compatible.
It
doesn't
need
to
be
released
together
with
the
kernel.
B
A
B
B
B
B
B
A
A
B
Kind
of
a
situation
where
we
need
xtp
activity
k.
If
you
want
to
mca
applications
xtp
for
scenarios,
you
need
to
connect
it
to
the
user.
If
you
want
to
do
the
DDoS
a
lot
balance
this
is
the
up
is
down
the
traditional
protocol.
Then
it's
very
suitable
Facebook
has
its
own
pure,
active
xtb,
which
were
pretty
post
passed
through
the
its
own
load.
Balance
I
think
XTP
is
very
suitable
when
the
yeah
it
turns
up
its
advantages.
We
don't
need
to
deploy
another
one.
B
B
A
So
I
can
see
that
there
are
Strax
chatty
beep
as
for
the
SDP,
and
yes,
it
didn't
get
us
the
famous
dieter.
Why
well?
This
is
Sturm
planet.
You
can
reference
on
that
car
through
and
there
are
just
the
same
as
directly
doing
that
on
that
map.
So
it's
worthy
supporting
this,
but
EMU
supports
not
secured.
So
on
top,
if
we're.
B
A
This
one
that
we
need
the
tab
to
support
zero
copy
and
if
we
want
to
bypass
tap
it-
and
we
have
to
wait
you-
you
change
the
ring
layout
and
directly
put
it
on
your
new
ring
layout.
Will
it
be
better
or
we
converted
directly
on
XDP
and
put
it
in
the
HR
ring?
Well,
it's
there
any
better
way.
Well,
I
think
the
so-called
better
way
is
just
an
option.
You
can
establish
your
own,
we
host
a
user,
so
this
is
not
the
most
optimal
optimal
way.
A
B
A
Xcp
has
limits
in
the
future.
We
will
do
more
work
on
it,
for
example,
make
sure
the
mega
data
can
support
XD
and
check
them
long,
and
that
might
help
you
well
for
the
loop,
the
upstream
or
we're
still
doing
bone
the
pathway
and,
for
example,
the
volume
is
fixed,
for
example,
one
point
four
thousand:
if
it's
convertible,
then
we
need
some
tricks
and
we
can
break
it
using
our
compilers
and
well.
A
You
can
introduce
a
kernel
helper,
a
generic.
You
cannot
help
her,
for
example,
check
Sam
and
we
can
make
sure
the
system
Co
on
the
kernel
helper
and
that
there
will
be
no
limitations
for
you.
You
can
run
all
tests.
You
want
ok
times
limit,
it
comes
up,
so
any
questions
you
want
more
than
welcome
to
come
privately.