On Thu, Sep 28, 2017 at 12:09:05PM -0400, Willem de Bruijn wrote: > Programming from the guest is > indeed different. I don't fully understand that use case.
Generally programming host BPF from guest is a clear win - think DOS protection. Guest runs logic to detect dos attacks, then passes the program to host. Afterwards, host does not need to enter guest if there's a DOS attack. Saves a ton of cycles. The difficulty is making it work well, e.g. how do we handle maps? -- MST
