AF_XDP:将`(SRC-IP, DST-IP, DST-Port)` 映射到`BPF_MAP_TYPE_XSKMAP` 的索引 [英] AF_XDP: map `(SRC-IP, DST-IP, DST-Port)` to index to `BPF_MAP_TYPE_XSKMAP`

问题描述

我想生成多个用户空间进程，每个进程都处理来自单个源的数据包((SRC-IP, DST-IP, DST-Port) 的三倍).

因为要通过 AF-XDP 内核程序传递大量数据包，而且时间很关键，所以我想到了内核程序中的单独映射，该映射事先由用户空间程序填充.

此映射定义了从前面提到的三元组到索引的映射，然后在 bpf_redirect_map(&xsks_map, index, 0) 中使用该映射将数据包发送到用户空间中的特定套接字.

我最初的想法是将 src-ip、destination-ip 和目标端口连接成一个 (32 + 32 + 16) 位值.

是否可以定义具有如此大键大小的映射?哪张地图最适合这个问题?此外，是否可以从用户空间填充地图?

解决方案

A struct as a key

有几种类型的地图可以与 eBPF 一起使用.其中一些是通用的(散列映射、数组等)，而另一些则非常具体(重定向映射、sockmap 等).

您描述的案例听起来像是哈希映射的完美用例.这样的映射将一个 struct 作为键，另一个 struct 作为值.所以你可以有类似的东西:

struct my_key {uint32_t src_ip;uint32_t dst_ip;uint16_t dst_port;};

... 并将其用作密钥.在您的情况下，该值将是 xskmap 的索引，即一个简单的整数.哈希映射对于从给定的键检索值非常有效(对于数组而言，没有线性搜索)，因此您可以获得良好的性能.

哈希映射的密钥大小

键或值的大小没有具体限制，只要大小为 32 位整数即可:)(请注意，在硬件卸载的情况下可能会有大小限制).

从用户空间更新

从用户空间更新哈希映射是完全可行的(尽管某些非常具体的映射类型可能不允许这样做，但是像数组或哈希映射这样的通用映射完全可以).你会这样做:

• 从命令行，使用bpftool，
• 来自 C 程序，在 libbpf 的帮助下，
• 使用您自己的语言.在所有三种情况下，更新本身都是通过调用 bpf() 系统调用来完成的.

I want to spawn multiple user-space processes with each one processing packets from a single source (triple of (SRC-IP, DST-IP, DST-Port)).

Because there are going to pass a lot of packets through the AF-XDP kernel program and time is critical, I thought of a separate map in the kernel-program which is populated by a user-space program beforehand.

This map defines a mapping from the previously mentioned triple to an index which is then used in bpf_redirect_map(&xsks_map, index, 0) to send packets to a specific socket in user-space.

My initial idea was to just concatenate src-ip, destination-ip and destination port into a (32 + 32 + 16)-bit value.

Is it possible to define maps with such a large key-size? Which map would be the best fit for this problem? Furthermore, is it possible to fill the map from user-space?

解决方案

A struct as a key

There are several types of maps that can be used with eBPF. Some of them are generic (hash maps, arrays, ...) and some are very specific (redirect maps, sockmaps, ...).

The case you describes sounds like a perfect use case for a hash maps. Such maps take a struct as a key, and another struct as a value. So you could have something like:

struct my_key {
        uint32_t src_ip;
        uint32_t dst_ip;
        uint16_t dst_port;
};

... and use it as a key. The value, in your case, would be the index for the xskmap, i.e. a simple integer. Hash maps are efficient for retrieving a value from a given key (no linear search as for an array), so you get good performance with that.

Key size for hash maps

There are no specific restrictions for the size of the keys or the values, as long as the size holds on a 32-bit integer :) (Note that there may be size restrictions in the case of hardware offload).

Update from user space

It is perfectly doable to update a hash map from user space (some very specific map types may not allow it, though, but generic maps like are arrays or hash maps are entirely fine). You would do it:

• From the command line, with bpftool,
• From a C program, with the helpers from libbpf,
• In your own language. In all three cases, the update itself is done through a call to the bpf() system call.

这篇关于AF_XDP:将`(SRC-IP, DST-IP, DST-Port)` 映射到`BPF_MAP_TYPE_XSKMAP` 的索引的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！