On 02/19/2018 05:37 PM, Pablo Neira Ayuso wrote: [...] > * Simplified infrastructure: We don't need the ebpf verifier complexity > either given we trust the code we generate from the kernel. We don't > need any complex userspace tooling either, just libnftnl and nft > userspace binaries. > > * Hardware offload: We can use this to offload rulesets to the only > smartnic driver that we have in the tree that already implements bpf > offload, hence, we can reuse this work already in place. In addition Dave's points, regarding the above two, this will also only work behind the verifier since NIC offloading piggy-backs on the verifier's program analysis to prepare and generate a dev specific JITed BPF prog, so it's not the same as normal host JITs (and there, the cBPF -> eBPF in kernel migration adds a lot of headaches already due to different underlying assumptions coming from the two flavors, even if both are eBPF insns in the end), and given this, offloading will also only work for eBPF and not cBPF. There's a lot more the verifier is doing internally, like performing various different program rewrites from the context, for helpers (e.g. inlining), and for internal insn mappings that are not exposed (e.g. in calls), so we definitely need to go through it. Thanks, Daniel -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
