Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

linux config: add support for xdp sockets and ebpf jit #73328

Merged
merged 1 commit into from Jan 13, 2020
Merged

linux config: add support for xdp sockets and ebpf jit #73328

merged 1 commit into from Jan 13, 2020

Conversation

magenbluten
Copy link
Contributor

@magenbluten magenbluten commented Nov 13, 2019

xdp socket support (AF_XDP) is the new way of implementing high
performance networking on linux. on arch linux and debian this is
already enabled (checked via the links from the nixos manual).

moreover, these flags are suggested by the bpf documentation at cilium:

https://cilium.readthedocs.io/en/latest/bpf/#compiling-the-kernel

additionally the flag BPF_JIT_ALWAYS_ON on was suggested to help
spectre attack mitigations:

torvalds/linux@290af86

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • [x ] NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
Notify maintainers

cc @Mic92 @flokli

xdp socket support (AF_XDP) is the new way of implementing high
performance networking on linux. on arch linux and debian this is
already enabled (checked via the links from the nixos manual).

moreover, these flags are suggested by the bpf documentation at cilium:

https://cilium.readthedocs.io/en/latest/bpf/#compiling-the-kernel

additionally the flag `BPF_JIT_ALWAYS_ON` on was suggested to help
spectre attack mitigations:

torvalds/linux@290af86
@Mic92
Copy link
Member

Mic92 commented Nov 17, 2019

@GrahamcOfBorg build linux

1 similar comment
@flokli
Copy link
Contributor

flokli commented Nov 18, 2019

@GrahamcOfBorg build linux

@FRidh FRidh added this to Needs review in Staging Nov 19, 2019
@Lassulus Lassulus changed the base branch from master to staging January 13, 2020 04:01
@Lassulus Lassulus merged commit bc4921a into NixOS:staging Jan 13, 2020
Staging automation moved this from Needs review to Done Jan 13, 2020
vcunat added a commit that referenced this pull request Feb 9, 2020
This reverts a small bit of af808bd from PR #73328.  Fixes #79304:
tests.installer.simpleUefiSystemdBoot.x86_64-linux

I still don't know why the regression happened, but this feature doesn't
seem important enough to block channel now, though it reportedly helps
to mitigate spectre 2 attack CVE-2017-5715.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Staging
  
Done
Development

Successfully merging this pull request may close these issues.

None yet

5 participants