BPF: Next Generation of Programmable Datapath
8 likes3,014 views
The document discusses key advancements in programmable datapath technology as showcased at the OVS conference in San Jose, 2016, including the release of OVS 2.6 and the first OVN release. It highlights new BPF helpers that facilitate interaction with the outside world and enhances the flexibility and performance of container networking and security through individualized bytecode generation. Additionally, it reflects on lessons learned regarding the complexity of datapath development and requirements for kernel version compatibility.
BPF: Next Generation of Programmable Datapath
- 1. Next Generation of Programmable Datapath OVS Conference, San Jose, 2016 Thomas Graf
- 2. What happened in 2016 so far?
- 3. OVS 2.6 was released
- 4. First ever OVN release
- 5. OVS Orbit podcast (May 16) Not subscribed yet? ovsorbit.org
- 6. Docker followed (Aug 16)
- 7. What is up next?
- 10. Programs, Maps, Tail Calls
- 11. BPF Helpers: Interacting with the outside world - Map Lookup/Update/Delete - Get ktime - printk to trace buffer - Get random number - Get SMP processor ID - Load/store n bytes in skb data - Replace L3/L4 checksum of skb - Name/UID/GID of current process - Push/pop VLAN header - Set/get tunnel key and options - Tail call - Read/write perf event ring buffer - Redirect/clone to other net_device - Get routing realm - Calculate checksum diff over memory buffer - Change protocol of skb - Change type of skb (local/broadcast/…) - Check for cgroup membership - Access skb->hash or mark invalid - Trim tail of skb - Make skb linear
- 12. Experimenting with BPF ● Apply BPF to container networking & security ● Generate individual bytecode for each container at startup ○ Incredible flexibility and versatility ○ Majority of configuration becomes constant ● Decouple code (bytecode) and state (maps) ○ Allow for regeneration at any time without breaking connections
- 14. Intel Xeon 3.5Ghz Sandy Bridge, 24 cores, 1 TCP flow per core, netperf -t TCP_SENDFILE, 10’000 policies
- 15. Learned Lessons ● Datapath development on steroids. ● Verifier complexity limit requires to split programs into multiple blocks that inherit state. ● We have probably not added the last helper yet. ● Helper requirements define minimal kernel version, so it’s pretty much kernel 4.8+ for anything non trivial.
- 16. Q&A Remember to get your BPF stickers! E-Mail: Twitter [email protected] @tgraf__