On Mon, Jul 29, 2019 at 1:48 PM Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote: > > On Mon, Jul 29, 2019 at 09:59:12AM -0700, Petar Penkov wrote: > > From: Petar Penkov <ppenkov@xxxxxxxxxx> > > > > This patch series introduces a BPF helper function that allows generating SYN > > cookies from BPF. Currently, this helper is enabled at both the TC hook and the > > XDP hook. > > > > The first two patches in the series add/modify several TCP helper functions to > > allow for SKB-less operation, as is the case at the XDP hook. > > > > The third patch introduces the bpf_tcp_gen_syncookie helper function which > > generates a SYN cookie for either XDP or TC programs. The return value of > > this function contains both the MSS value, encoded in the cookie, and the > > cookie itself. > > > > The last three patches sync tools/ and add a test. > > > > Performance evaluation: > > I sent 10Mpps to a fixed port on a host with 2 10G bonded Mellanox 4 NICs from > > random IPv6 source addresses. Without XDP I observed 7.2Mpps (syn-acks) being > > sent out if the IPv6 packets carry 20 bytes of TCP options or 7.6Mpps if they > > carry no options. If I attached a simple program that checks if a packet is > > IPv6/TCP/SYN, looks up the socket, issues a cookie, and sends it back out after > > swapping src/dest, recomputing the checksum, and setting the ACK flag, I > > observed 10Mpps being sent back out. > Thank you for reviewing this so quickly! > Is it 10m because trafic gen is 10m? Yes, I believe so. > What is cpu utilization at this rate? > Is it cpu or nic limited if you crank up the syn flood? > Original 7M with all cores or single core? My receiver was configured with 16rx queues and 16 cores. 7M all cores are at 100% so I believe this case is CPU limited. At XDP, all cores are at roughly 40%. I couldn't reliably generate higher SYN flood rate than that, and the highest numbers I could see for XDP did not go past 10.65Mpps with ~42% utilization on each core. I think I am hitting a NIC limit here since the CPUs are free. > > The patch set looks good to me. > I'd like Eric to review it one more time before applying. >
