0

I want to spawn multiple user-space processes with each one processing packets from a single source (triple of (SRC-IP, DST-IP, DST-Port)).

Because there are going to pass a lot of packets through the AF-XDP kernel program and time is critical, I thought of a separate map in the kernel-program which is populated by a user-space program beforehand.

This map defines a mapping from the previously mentioned triple to an index which is then used in bpf_redirect_map(&xsks_map, index, 0) to send packets to a specific socket in user-space.

My initial idea was to just concatenate src-ip, destination-ip and destination port into a (32 + 32 + 16)-bit value.

Is it possible to define maps with such a large key-size? Which map would be the best fit for this problem? Furthermore, is it possible to fill the map from user-space?

binaryBigInt
  • 1,526
  • 2
  • 18
  • 44
  • 1
    Hash maps accept structs as keys, and have no particular constraints for their size so you should be good. And yes, perfectly possible to fill maps from user space. – Qeole Mar 09 '20 at 11:37

1 Answers1

0

A struct as a key

There are several types of maps that can be used with eBPF. Some of them are generic (hash maps, arrays, ...) and some are very specific (redirect maps, sockmaps, ...).

The case you describes sounds like a perfect use case for a hash maps. Such maps take a struct as a key, and another struct as a value. So you could have something like:

struct my_key {
        uint32_t src_ip;
        uint32_t dst_ip;
        uint16_t dst_port;
};

... and use it as a key. The value, in your case, would be the index for the xskmap, i.e. a simple integer. Hash maps are efficient for retrieving a value from a given key (no linear search as for an array), so you get good performance with that.

Key size for hash maps

There are no specific restrictions for the size of the keys or the values, as long as the size holds on a 32-bit integer :) (Note that there may be size restrictions in the case of hardware offload).

Update from user space

It is perfectly doable to update a hash map from user space (some very specific map types may not allow it, though, but generic maps like are arrays or hash maps are entirely fine). You would do it:

  • From the command line, with bpftool,
  • From a C program, with the helpers from libbpf,
  • In your own language. In all three cases, the update itself is done through a call to the bpf() system call.
Qeole
  • 8,284
  • 1
  • 24
  • 52