On 10/28/16 at 08:51pm, Shrijeet Mukherjee wrote: > Generally agree, but SRIOV nics with multiple queues can end up in a bad > spot if each buffer was 4K right ? I see a specific page pool to be used > by queues which are enabled for XDP as the easiest to swing solution that > way the memory overhead can be restricted to enabled queues and shared > access issues can be restricted to skb's using that pool no ?
Isn't this clearly a must anyway? I may be missing something fundamental here so please enlighten me :-) If we dedicate a page per packet, that could translate to 14M*4K worth of memory being mapped per second for just a 10G NIC under DoS attack. How can one protect such as system? Is the assumption that we can always drop such packets quickly enough before we start dropping randomly due to memory pressure? If a handshake is required to determine validity of a packet then that is going to be difficult.
