<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks for reply Maryam.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">My reply is below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Shibin<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Maryam Tahhan <mtahhan@redhat.com>
<br>
<b>Sent:</b> Thursday, November 30, 2023 2:17 PM<br>
<b>To:</b> Koikkara Reeny, Shibin <shibin.koikkara.reeny@intel.com>; ferruh.yigit@amd.com; stephen@networkplumber.org; lihuisong@huawei.com; fengchengwen@huawei.com; liuyonglong@huawei.com<br>
<b>Cc:</b> dev@dpdk.org<br>
<b>Subject:</b> Re: [v1] net/af_xdp: enable a sock path alongside use_cni<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Shibin<br>
<br>
No problem. <br>
<br>
Answer below.<br>
<br>
BR<br>
Maryam<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">On 30/11/2023 13:56, Koikkara Reeny, Shibin wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>Hi Maryam,<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I have one more question.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Regards,<o:p></o:p></pre>
<pre>Shibin<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>-----Original Message-----<o:p></o:p></pre>
<pre>From: Koikkara Reeny, Shibin <a href="mailto:shibin.koikkara.reeny@intel.com"><shibin.koikkara.reeny@intel.com></a><o:p></o:p></pre>
<pre>Sent: Thursday, November 30, 2023 12:14 PM<o:p></o:p></pre>
<pre>To: Tahhan, Maryam <a href="mailto:mtahhan@redhat.com"><mtahhan@redhat.com></a>; <a href="mailto:ferruh.yigit@amd.com">ferruh.yigit@amd.com</a>;<o:p></o:p></pre>
<pre><a href="mailto:stephen@networkplumber.org">stephen@networkplumber.org</a>; <a href="mailto:lihuisong@huawei.com">lihuisong@huawei.com</a>;<o:p></o:p></pre>
<pre><a href="mailto:fengchengwen@huawei.com">fengchengwen@huawei.com</a>; <a href="mailto:liuyonglong@huawei.com">liuyonglong@huawei.com</a><o:p></o:p></pre>
<pre>Cc: <a href="mailto:dev@dpdk.org">dev@dpdk.org</a>; Tahhan, Maryam <a href="mailto:mtahhan@redhat.com"><mtahhan@redhat.com></a><o:p></o:p></pre>
<pre>Subject: RE: [v1] net/af_xdp: enable a sock path alongside use_cni<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Hi Maryam,<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I have added some suggestion below.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Regrads,<o:p></o:p></pre>
<pre>Shibin<o:p></o:p></pre>
</blockquote>
</blockquote>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>[snip]<o:p></o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><o:p> </o:p></pre>
<pre> Prerequisites<o:p></o:p></pre>
<pre>@@ -224,7 +225,6 @@ Howto run dpdk-testpmd with CNI plugin:<o:p></o:p></pre>
<pre> capabilities:<o:p></o:p></pre>
<pre> add:<o:p></o:p></pre>
<pre> - CAP_NET_RAW<o:p></o:p></pre>
<pre>- - CAP_BPF<o:p></o:p></pre>
</blockquote>
</blockquote>
<pre><o:p> </o:p></pre>
<pre>Why the CAP_BPF is removed?<o:p></o:p></pre>
</blockquote>
<p><o:p> </o:p></p>
<p>Good question. It's removed because in our case CAP_BPF is only needed when we want to load or unload the XDP program on the interface inside the Pod. In our case the CNI is loading the xdp program on the interface and then we are doing a handshake to get
the xskmap file descriptor and so we don't need the CAP_BPF. <br>
<br>
You will find a detailed listing of the permissions used at different stages when utilizing an XDP prog in this article
<a href="https://next.redhat.com/2023/07/18/using-ebpf-in-unprivileged-pods/">https://next.redhat.com/2023/07/18/using-ebpf-in-unprivileged-pods/</a>
<br>
<br>
I'm currently also working on enabling pinned map sharing with the af_xdp vdev eal arguments so we can integrate with bpfman for centralized BPF program lifecycle management [currently under test].
<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>Correct me if I am wrong, Don’t we still need the CAP_BPF for bpf operations? <o:p>
</o:p></p>
<p>If CAP_BPF is not need so do we need the CAP_NET_RAW also?<o:p></o:p></p>
<p class="MsoNormal">[snip] <o:p></o:p></p>
</div>
</div>
</body>
</html>