- people - netdevconf.info

0x14: nutsnbolts, devlink enhancements for sub functions management
by Jamal Hadi Salim 03 Feb '20

03 Feb '20

New virtualization deployments call out for high density virtual functions with more frequent lifetime recycling. Unfortunately, PCIe SR-IOV has limited function count and large instantiation overhead. A solution to these challenges is to take a PCIE device and "split" it into multiple subdevices. Each subdevice gets its own virtual port(s), queues as well as named resources; Combined with TC and switchdev offloads this approach overcomes the SR-IOV limitations. In this talk Parav Pandit introduces devlink enhancements to manage such sub functions. Parav first discusses how devlink is used to life cycle, configure and deploy accelerated sub functions with eswitch offloads support. He then discusses the plumbing done using virtbus to achieve persistence naming of netdevices and rdma devices. Parav will also cover how such model addresses smartnic use case where a sub-function NIC is hot plugged in host system in a secure manner. More info: https://netdevconf.info/0x14/session.html?talk-devlink-enhancements-for-sub… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: Moonshot talks + Workshop, Machine Learning For Networking
by Jamal Hadi Salim 02 Feb '20

02 Feb '20

Sorry to dissapoint folks, but we are _not_ going to have any talks on blockchain in 0x14! If this statement infuriates you then please demonstrate your outrage by submiting a proposal when the CFS for 0x15 opens up! Now that we got that out the way... What is Machine Learning? Machine learning (ML) is a subset of artificial intelligence(AI) that lets computer systems solve a specific task without using explicit instructions, relying on patterns and inference instead of human intervention. But How Does ML Apply To Networking? Machine learning can be used to observe patterns in network traffic or configuration and use the resulting data for a variety of things, some sample space: - dynamic congestion control (goodbye named congestion control algos!), see for example applicability of: https://netdevconf.info/0x12/session.html?restructuring-endpoint-congestion… - improve datapath performance - path optimization - anomaly detection from a baseline expectation and using the resulting data either for security or optimization end goals - etc. At 0x14 we have two moonshot talks that look at using ML for networking on Linux. These talks will be part of the ML workshop which is debutting in 0x14. We hope to able to solicit discussions and feedback on the subject and hopefully have this workshop as a fixture in future netdev confs. In the first moonshot talk Marta Plantykow, Piotr Raczynski, Maciej Machnikowski and Pawel Szymanski will discuss an approach to optimize networking performance alongside CPU utilization with ML. Marta et al propose an approach which will use ML to study RSS patterns and the CPU spread and then react dynamically to modify RSS hash parameters to improve CPU spread. The authors will go over the challenges they overcame, show some performance numbers and solicit feedback. More info: https://netdevconf.info/0x14/session.html?talk-performance-optimization-usi… Our second talk is from Maciej Paczkowski, Aleksandra Jereczek, and Patrycja Kochmanska. In this talk Maciej et al integrate into FRR to understand how to best optimize the path selection in an environemnt with multiple simultenous link faults and incestant link flapps. Could routing decisions better helped with ML hooks in the kernel/datapath? Could we make use of offloading some of the algos to AI hardware? The authors will go over the challenges they overcame, and solicit feedback. More info: https://netdevconf.info/0x14/session.html?talk-machine-learning-in-packet-r… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: extending TC with 5-tuple hash offload (dp_hash)
by Jamal Hadi Salim 31 Jan '20

31 Jan '20

In this moonshot talk Rony Efraim Roni, Bar Yanai and Yossi Kuperman come up with a clever way to do efficient forwarding by introducing an offloaded TC hash action. An example use case of this feature is closely emulating what Equal Cost Multipath (ECMP) based forwarding does. ECMP-like can be achieved by enabling policy which will: - First create a hash on a classical 5 tuple in hardware - Kernel s/ware receives the hashid as metadata - Use the resulting hashid as a tc filter chain id and jump to that filter chain - within the destination chain lookup a much smaller set of tc flower rules (in the equivalent 5 tuple space) and execute the associated leaf action(s) such as setting the next hop mac address, etc. Roni et al will suggest the TC extension semantics to define the hash offload and solicit feedback from the community. They will further discuss the challenges involved. More info: https://netdevconf.info/0x14/session.html?talk-extending-tc-with-5-tuple-ha… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutsnbolts talk, SynGate: Issuing SYN cookies in XDP
by Jamal Hadi Salim 31 Jan '20

31 Jan '20

Lets start with some context. The Problem: TCP SYN DDOS attack. TCP SYN attacks flood a targetted server with SYN requests. Each SYN request received by the server is responded to with a SYN ACK which results in a connection state being created and put in a half-open (SYN RCVD) TCP state awaiting an ACK to come back. *The ACK response never comes* and the SYN requests keep coming in resulting in more half-open state creation in the backlog... At some point, during this attack, there will be a lot of TCP half-open state such that the targeted server's ability to respond to new SYN requests is lost because all the available port resources have been exhausted... How does one defend against SYN flood attack? A popular defense against SYN attacks uses what is known as SYN cookies. So, how do SYN cookies work? When the server sees the TCP SYN, it constructs the SYN ACK using a sequence # created from a cryptographic hash of some of the flow attributes. The computed ACK sequence # has enough flow attributes encoding in it such that can be later (on response to this sequence #) used to reconstruct the original SYN request should the original sender response. Two possibilities on responses: 1) If this was an attack, then the server will never receive a response. It is no big deal since we are not storing any half-open info in the backlog; and therefore no server resources are wasted in anticipation of that response. 2) This is legit client request - in which case there will be a response coming back. When the ACK is received, we look at the ACK sequence # and reconstruct the SYN queue entry using the information that was originally encoded in the SYN ACK. SYN cookies are effective, but: the operation requires the packets traverse the TCP/IP layers all the way up. For a busy server, the extra code path and the hash computation constrains how fast you can issue SYN cookies back. In this talk, Petar Penkov, Eric Dumazet and Stanislav Fomichev discuss SynGate, an XDP-based approach to handling SYN cookies. By moving the response lower in the stack it enables the system to increase the rate at which a host can issue SYN cookies and therefore improving its resilience to SYN flood attacks. Petar et al will detail the design of this solution, the advantages eBPF provided them and, challenges faced during development of of SynGate and finally they will discuss areas they are considering for improvement. More info: https://netdevconf.info/0x14/session.html?talk-issuing-SYN-cookies-in-XDP Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutsnbolts talk, Taking Control of your SmartNIC
by Jamal Hadi Salim 30 Jan '20

30 Jan '20

SmartNICs are introducing a new paradigm in hardware offload/acceleration world - that of introducing additional general purpose processors in the NIC. So try to visualize the NIC as almost its own machine connected to your host. Meaning you can, for example, move your control plane to the NIC. In this talk, Or Gerlitz and Andy Gospodarek start by describing high level view of this class of NICs. They will then explore common deployment methods and models and help us understand better how this new class of NICs operate by exploring: - what is out there in terms of networking open source code/features - automation recipes and scripts to onboard software infra - common kernel offload techniques in use - upstream kernel and distro SoC support Or and Andy will iterate a few working examples that are available for use across devices from multiple, open SmartNIC vendors. They will also discuss approaches of integrating into known cloud orchestration systems like OpenStack and Kubernetes. More info: https://netdevconf.info/0x14/session.html?talk-taking-control-of-your-Smart… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutnbolts talk, Application Device Queues (ADQ) for system-level network I/O performance improvements
by Jamal Hadi Salim 30 Jan '20

30 Jan '20

ADQ(Application Device Queues) support has been in the kernel for a while now. ADQ enables network application data to be isolated to specific (symmetric rx/tx) hardware netdevice queue pair(s). Application specific-data is ingressed towards these dedicated queues and rate controlled in the egress direction - all using policy definitions. ADQ uses standard Linux interfaces to achieve its goals. In this talk, Amritha Nambiar, Kiran Patil and Sridhar Samudrala will: - dig into the details of ADQ architecture and operations. - illustrate collected data on how ADQ helps to improve predictability by reducing jitter, lowering latency and improving throughput. - show, via an example application, how developers can take advantage of ADQ. Amritha et al will also discuss future plans for ADQ such as enabling busy polling on AF_XDP sockets by associating a NAPI_ID to an AF_XDP socket at bind time. More info: https://netdevconf.info/0x14/session.html?talk-ADQ-for-system-level-network… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: Bronze Sponsor, IPv4 Unicast Extensions Project
by Jamal Hadi Salim 29 Jan '20

29 Jan '20

New Sponsor, the IPv4 Unicast Extensions Project. We are grateful for your support! Thank you. IPv4 Unicast Extensions Project is working on extending the unicast portion of the IPv4 address space, including hundreds of millions of addresses that are currently reserved, or are very underutilized. This extension will make more IPv4 addresses usable for providing globally reachable services during the long transition to IPv6, reducing the price of IPv4 addresses to end users. cheers, jamal

1 0

0x14: Moonshot talk, Linux Kernel Network Scripting with Lua
by Jamal Hadi Salim 29 Jan '20

29 Jan '20

I'll spend a bit more time summarizing this talk because it will no doubt generate passions in (some) people and curiosity in others. If you thought that eBPF is the only approach to extend the kernel, think again. In this talk, Lourival Vieira Neto et al describe a framework, Lunatik, which facilitates dynamically injecting Lua scripts into the kernel to extend kernel mechanisms. Some context: what is Lua? 1) It is a scripting language that is very widely deployed as an embededable _extension language_. Game programming in particular predominantly uses it for extensions. Openwrt uses it as config language and there are many others listed here: https://en.wikipedia.org/wiki/List_of_applications_using_Lua. Wide deployment means it has seen exposure in many environments. The _extension 2) It is a tiny language (the whole language is about 200KB) that is designed to be easy to embed - in particular in C 3) It is considered relatively secure. Despite the wide deployment over many years there have been very few CVEs reported against Lua in more than a decade. See: https://www.cvedetails.com/product/28436/LUA-LUA.html?vendor_id=13641) Why scripting? Extending kernels with scripts is nothing new. But: The simple answer to this question is to compare a compiler driven approach (think C) vs a scripting language(think Bash or python). The former requires a complex development environment (think eBPF needing latest clang, gcc, correct libbpf, etc) while the later provides faster turnarounds to development and deployment (you need a kernel with the Lua VM but not much after that in terms of tooling) and of course, a much simpler and stable ABI. Script based execution is often not as performant but often more usable relatively speaking. And back to the talk... The Lunatik framework has rich coverage across different kernel hooks and has been used to script different Linux subsystems such as CPUfreq, Sockets, RCU, ULP, Netfilter, and now XDP. Lunatik has been around for a while, just not upstreamed - and to give a little sample space of its deployment: NFLua is currently deployed _in production in over 20 million home routers_! You dont want a rogue script kill your kernel and system. Lourival et al will discuss the challenges and approach taken in allowing script injection into the kernel while still maintaining correctness, isolation, and liveness. They will then describe NFLua and introduce XPDLua, which allows users to extend XDP with Lua. XDPLua aims to replace NFLua. The authors will detail how Lua can be used within XDP: as a standalone to directly invoke currently exposed eBPF helpers or alternatively have eBPF programs invoke Lua scripts. And last but not least: Lourival et al will provide comparison performance data for packet filtering between with Iptables, eBPF, NFLua and XDPLua. sounds exciting? Come to the conference, listen, learn, and engage the speakers! More info: https://netdevconf.info/0x14/session.html?talk-linux-network-scripting-with… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

2 1

0x14: nutsnbolts talk, Storage application performance boost with zero thrashing networking stack
by Jamal Hadi Salim 29 Jan '20

29 Jan '20

There has been an ongoing effort in the community to get Zero-copy working over the last few years - with much success. While both MSG_ZEROCOPY (zero copy transmit) and socket mmap (zero copy receive) have been out in the wild for sometime now, there are no known high scale open source application consumers of these interfaces. In this talk, Or Gerlitz will describe how he makes use of these interfaces to integrate into spdk(https://spdk.io/) - an open source storage framework which uses sockets for nvme-over-tcp in a smart NIC environment. The goal is to use kernel uAPIs while achieving high scale performance. Or will delve into MSG_ZEROCPOY and the challenges that he had to deal with. He will describe the need for an app author to understand and how to best tie-in their app state machine to the interfaces: to address both transactions responses from the peer app and zero-copy notifications from the local socket provider. Should the app use ZC with all or nothing approach or sometimes yes and other-times no? Come to the talk to get the answer and advise on how to effectively use these interfaces. In addition Or will spend time going into the performance analysis details correlating I/O performance visavis CPU cost (which is often tricky to get right with traditional tools like profiler/flame-graphs). More info: https://netdevconf.info/0x14/session.html?talk-storage-application-performa… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutsnbolts talk, Media Redundancy Protocol
by Jamal Hadi Salim 28 Jan '20

28 Jan '20

MRP(Media Redundancy Protocol) is an open standard for ring topologies in industrial ethernet networks defined in common standards-based protocol(IEC 62439-2). In an MRP-enabled network each Ethernet switch is connected to two other switches forming a ring. An MRP-enabled ring can overcome single link point of failures at worst case recovery time of 30ms - which is faster than STP. In this talk Horatiu Vultur will describe the MRP protocol in some detail. They will then proceed to discuss the effort to add support to the kernel; different implementation approaches considered and eventual implementation path taken after receiving feedback on the mailing list. And last but not least, future work will be discussed including hardware offload of MRP as well as preliminary results comparing hardware-offloaded MRP vs non-offloaded version. More info: https://netdevconf.info/0x14/session.html?talk-adding-MRP-to-the-linux-kern… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0