Messages in this thread |  | | Date | Sun, 1 Oct 2017 06:28:04 +0300 | From | "Michael S. Tsirkin" <> | Subject | Re: [PATCH net-next 0/3] support changing steering policies in tuntap |
| |
On Thu, Sep 28, 2017 at 12:09:05PM -0400, Willem de Bruijn wrote: > Programming from the guest is > indeed different. I don't fully understand that use case.
Generally programming host BPF from guest is a clear win - think DOS protection. Guest runs logic to detect dos attacks, then passes the program to host. Afterwards, host does not need to enter guest if there's a DOS attack. Saves a ton of cycles.
The difficulty is making it work well, e.g. how do we handle maps?
-- MST
|  |