[v1] net/af_xdp: enable a sock path alongside use_cni

[Maryam Tahhan]

Hi Shibin

No problem.

Answer below.

BR
Maryam
On 30/11/2023 13:56, Koikkara Reeny, Shibin wrote:
> Hi Maryam,
>
> I have one more question.
>
> Regards,
> Shibin
>
>> -----Original Message-----
>> From: Koikkara Reeny, Shibin<shibin.koikkara.reeny at intel.com>
>> Sent: Thursday, November 30, 2023 12:14 PM
>> To: Tahhan, Maryam<mtahhan at redhat.com>;ferruh.yigit at amd.com;
>> stephen at networkplumber.org;lihuisong at huawei.com;
>> fengchengwen at huawei.com;liuyonglong at huawei.com
>> Cc:dev at dpdk.org; Tahhan, Maryam<mtahhan at redhat.com>
>> Subject: RE: [v1] net/af_xdp: enable a sock path alongside use_cni
>>
>> Hi Maryam,
>>
>> I have added some suggestion below.
>>
>> Regrads,
>> Shibin

[snip]

>>>   Prerequisites
>>> @@ -224,7 +225,6 @@ Howto run dpdk-testpmd with CNI plugin:
>>>             capabilities:
>>>                add:
>>>                  - CAP_NET_RAW
>>> -               - CAP_BPF
> Why the CAP_BPF is removed?


Good question. It's removed because in our case CAP_BPF is only needed 
when we want to load or unload the XDP program on the interface inside 
the Pod. In our case the CNI is loading the xdp program on the interface 
and then we are doing a handshake to get the xskmap file descriptor and 
so we don't need the CAP_BPF.

You will find a detailed listing of the permissions used at different 
stages when utilizing an XDP prog in this article 
https://next.redhat.com/2023/07/18/using-ebpf-in-unprivileged-pods/

I'm currently also working on enabling pinned map sharing with the 
af_xdp vdev eal arguments so we can integrate with bpfman for 
centralized BPF program lifecycle management [currently under test].

[snip]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/dev/attachments/20231130/eaaba875/attachment-0001.htm>