Change Details

Experiments performed on a 12 CPUs i7-8700 @ 3.20 GHz. I got a bhyve VM with 2 vCPUs, with virtio-net as a virtual device and a VALE port (vale:0) as a backend. Use pkt-gen from the host to flood the VM VALE port (DoS attack), e.g.: # pkt-gen -i vale:1 -f tx -H12 No process in the guest tries to receive the packets, which are then dropped at the UDP socket layer. Without this patch, I observe the CPU utilization of the bhyve process to go up to 190%. With this patch, CPU utilization stays ~100%, as expected.

Experiments performed on a 12 CPUs i7-8700 @ 3.20 GHz. I got a bhyve VM with 2 vCPUs, with virtio-net as a virtual device and a VALE port (vale:0) as a backend. Use pkt-gen from the host to flood the VM VALE port (DoS attack), e.g.: ``` # pkt-gen -i vale:1 -f tx -H12 ``` No process in the guest tries to receive the packets, which are then dropped at the UDP socket layer. Without this patch, I observe the CPU utilization of the bhyve process to go up to 190%. With this patch, CPU utilization stays ~100%, as expected.

Experiments performed on a 12 CPUs i7-8700 @ 3.20 GHz. I got a bhyve VM with 2 vCPUs, with virtio-net as a virtual device and a VALE port (vale:0) as a backend. Use pkt-gen from the host to flood the VM VALE port (DoS attack), e.g.: ``` # pkt-gen -i vale:1 -f tx -H12 ``` No process in the guest tries to receive the packets, which are then dropped at the UDP socket layer. Without this patch, I observe the CPU utilization of the bhyve process to go up to 190%. With this patch, CPU utilization stays ~100%, as expected.