Subject: Re: [PATCH net-next 0/3] support changing steering policies in tuntap

From: "Michael S. Tsirkin" <[email-masked]>
Date: Sun, 1 Oct 2017 06:28:04 +0300

On Thu, Sep 28, 2017 at 12:09:05PM -0400, Willem de Bruijn wrote:
> Programming from the guest is
> indeed different. I don't fully understand that use case.

Generally programming host BPF from guest is a clear win - think DOS
protection. Guest runs logic to detect dos attacks, then passes the
program to host.  Afterwards, host does not need to enter guest if
there's a DOS attack. Saves a ton of cycles.

The difficulty is making it work well, e.g. how do we handle maps?

-- 
MST