Extend XFRM core to allow packet offload configuration
Subsystems (9)
v8 cover Extend XFRM core to allow packet offload configuration
From: Leon Romanovsky <[email protected]>
Changelog:
v8:
* Removed not-related blank line
* Fixed typos in documentation
v7: https://lore.kernel.org/all/[email protected]
As was discussed in IPsec workshop:
* Renamed "full offload" to be "packet offload".
* Added check that offloaded SA and policy have same device while sending packet
* Added to SAD same optimization as was done for SPD to speed-up lookups.
v6: https://lore.kernel.org/all/[email protected]
* Fixed misplaced "!" in sixth patch.
v5: https://lore.kernel.org/all/[email protected]
* Rebased to latest ipsec-next.
* Replaced HW priority patch with solution which mimics separated SPDs for SW and HW. See more description in this cover letter.
* Dropped RFC tag, usecase, API and implementation are clear.
v4: https://lore.kernel.org/all/[email protected]
* Changed title from "PATCH" to "PATCH RFC" per-request.
* Added two new patches: one to update hard/soft limits and another initial take on documentation.
* Added more info about lifetime/rekeying flow to cover letter, see relevant section.
* perf traces for crypto mode will come later.
v3: https://lore.kernel.org/all/[email protected]
* I didn't hear any suggestion what term to use instead of
"packet offload", so left it as is. It is used in commit messages and documentation only and easy to rename.
* Added performance data and background info to cover letter
* Reused xfrm_output_resume() function to support multiple XFRM transformations
* Add PMTU check in addition to driver .xdo_dev_offload_ok validation
* Documentation is in progress, but not part of this series yet.
v2: https://lore.kernel.org/all/[email protected]
* Rebased to latest 6.0-rc1
* Add an extra check in TX datapath patch to validate packets before forwarding to HW.
* Added policy cleanup logic in case of netdev down event
v1: https://lore.kernel.org/all/[email protected]
* Moved comment to be before if (...) in third patch.
v0: https://lore.kernel.org/all/[email protected]
-----------------------------------------------------------------------
The following series extends XFRM core code to handle a new type of IPsec offload - packet offload.
In this mode, the HW is going to be responsible for the whole data path, so both policy and state should be offloaded.
IPsec packet offload is an improved version of IPsec crypto mode, In packet mode, HW is responsible to trim/add headers in addition to decrypt/encrypt. In this mode, the packet arrives to the stack as already decrypted and vice versa for TX (exits to HW as not-encrypted).
Devices that implement IPsec packet offload mode offload policies too. In the RX path, it causes the situation that HW can't effectively handle mixed SW and HW priorities unless users make sure that HW offloaded policies have higher priorities.
It means that we don't need to perform any search of inexact policies and/or priority checks if HW policy was discovered. In such situation, the HW will catch the packets anyway and HW can still implement inexact lookups.
In case specific policy is not found, we will continue with packet lookup and check for existence of HW policies in inexact list.
HW policies are added to the head of SPD to ensure fast lookup, as XFRM iterates over all policies in the loop.
This simple solution allows us to achieve same benefits of separate HW/SW policies databases without over-engineering the code to iterate and manage two databases at the same path.
To not over-engineer the code, HW policies are treated as SW ones and don't take into account netdev to allow reuse of the same priorities for policies databases without over-engineering the code to iterate and manage two databases at the same path.
To not over-engineer the code, HW policies are treated as SW ones and don't take into account netdev to allow reuse of the same priorities for different devices.
* No software fallback
* Fragments are dropped, both in RX and TX
* No sockets policies
* Only IPsec transport mode is implemented
================================================================================
Rekeying:
In order to support rekeying, as XFRM core is skipped, the HW/driver should do the following:
* Count the handled packets
* Raise event that limits are reached
* Drop packets once hard limit is occurred.
The XFRM core calls to newly introduced xfrm_dev_state_update_curlft() function in order to perform sync between device statistics and internal structures. On HW limit event, driver calls to xfrm_state_check_expire() to allow XFRM core take relevant decisions.
This separation between control logic (in XFRM) and data plane allows us to packet reuse SW stack.
================================================================================
Configuration:
iproute2: https://lore.kernel.org/netdev/[email protected]/
Packet offload mode:
ip xfrm state offload packet dev <if-name> dir <in|out> ip xfrm policy .... offload packet dev <if-name>
Crypto offload mode:
ip xfrm state offload crypto dev <if-name> dir <in|out>
or (backward compatibility)
ip xfrm state offload dev <if-name> dir <in|out>
================================================================================
Performance results:
TCP multi-stream, using iperf3 instance per-CPU.
+----------------------+--------+--------+--------+--------+---------+---------+ | | 1 CPU | 2 CPUs | 4 CPUs | 8 CPUs | 16 CPUs | 32 CPUs | | +--------+--------+--------+--------+---------+---------+ | | BW (Gbps) | +----------------------+--------+--------+-------+---------+---------+---------+ | Baseline | 27.9 | 59 | 93.1 | 92.8 | 93.7 | 94.4 | +----------------------+--------+--------+-------+---------+---------+---------+ | Software IPsec | 6 | 11.9 | 23.3 | 45.9 | 83.8 | 91.8 | +----------------------+--------+--------+-------+---------+---------+---------+ | IPsec crypto offload | 15 | 29.7 | 58.5 | 89.6 | 90.4 | 90.8 | +----------------------+--------+--------+-------+---------+---------+---------+ | IPsec packet offload | 28 | 57 | 90.7 | 91 | 91.3 | 91.9 | +----------------------+--------+--------+-------+---------+---------+---------+
IPsec packet offload mode behaves as baseline and reaches linerate with same amount of CPUs.
Setups details (similar for both sides):
* NIC: ConnectX6-DX dual port, 100 Gbps each. Single port used in the tests.
* CPU: Intel(R) Xeon(R) Platinum 8380 CPU @ 2.30GHz
================================================================================
Series together with mlx5 part:
https://git.kernel.org/pub/scm/linux/kernel/git/leon/linux-rdma.git/log/?h=xfrm-next
Thanks
Leon Romanovsky (8):
xfrm: add new packet offload flag
xfrm: allow state packet offload mode
xfrm: add an interface to offload policy
xfrm: add TX datapath support for IPsec packet offload mode
xfrm: add RX datapath protection for IPsec packet offload mode
xfrm: speed-up lookup of HW policies
xfrm: add support to HW update soft and hard limits
xfrm: document IPsec packet offload mode
Documentation/networking/xfrm_device.rst | 62 +++++++-- .../inline_crypto/ch_ipsec/chcr_ipsec.c | 4 + .../net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 5 + drivers/net/ethernet/intel/ixgbevf/ipsec.c | 5 + .../mellanox/mlx5/core/en_accel/ipsec.c | 4 + drivers/net/netdevsim/ipsec.c | 5 + include/linux/netdevice.h | 4 + include/net/xfrm.h | 124 ++++++++++++++---- include/uapi/linux/xfrm.h | 6 + net/xfrm/xfrm_device.c | 109 +++++++++++++-- net/xfrm/xfrm_output.c | 12 +- net/xfrm/xfrm_policy.c | 106 ++++++++++++++- net/xfrm/xfrm_state.c | 70 +++++++--- net/xfrm/xfrm_user.c | 20 +++ 14 files changed, 474 insertions(+), 62 deletions(-)
Signature · 1 line
2.38.1
PATCH v8 1/8 xfrm: add new packet offload flag
From: Leon Romanovsky <[email protected]>
In the next patches, the xfrm core code will be extended to support new type of offload - packet offload. In that mode, both policy and state should be specially configured in order to perform whole offloaded data path.
Full offload takes care of encryption, decryption, encapsulation and other operations with headers.
As this mode is new for XFRM policy flow, we can "start fresh" with flag bits and release first and second bit for future use.
--- include/net/xfrm.h | 7 +++++++ include/uapi/linux/xfrm.h | 6 ++++++ net/xfrm/xfrm_device.c | 3 +++ net/xfrm/xfrm_user.c | 2 ++ 4 files changed, 18 insertions(+)
include/net/xfrm.h +7 -0
@@ -131,12 +131,19 @@ enum { XFRM_DEV_OFFLOAD_OUT, }; +enum { +XFRM_DEV_OFFLOAD_UNSPECIFIED , +XFRM_DEV_OFFLOAD_CRYPTO , +XFRM_DEV_OFFLOAD_PACKET , +}; +struct xfrm_dev_offload {struct net_device *dev;netdevice_tracker dev_tracker;struct net_device *real_dev;unsigned long offload_handle;u8 dir :2 ; +u8 type :2 ; };struct xfrm_mode {
include/uapi/linux/xfrm.h +6 -0
@@ -519,6 +519,12 @@ struct xfrm_user_offload {*/ #define XFRM_OFFLOAD_IPV6 1#define XFRM_OFFLOAD_INBOUND 2 +/* Two bits above are relevant for state path only, while +* offload is used for both policy and state flows. +* +* In policy offload mode, they are free and can be safely reused. +*/ +#define XFRM_OFFLOAD_PACKET 4struct xfrm_userpolicy_default {#define XFRM_USERPOLICY_UNSPEC 0
net/xfrm/xfrm_device.c +3 -0
@@ -278,12 +278,15 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,else xso->dir =XFRM_DEV_OFFLOAD_OUT ; + xso->type =XFRM_DEV_OFFLOAD_CRYPTO ; + err = dev->xfrmdev_ops->xdo_dev_state_add (x);if (err) { xso->dev =NULL ; xso->dir =0 ; xso->real_dev =NULL ;netdev_put (dev, &xso->dev_tracker); + xso->type =XFRM_DEV_OFFLOAD_UNSPECIFIED ;if (err != -EOPNOTSUPP ) {NL_SET_ERR_MSG (extack,"Device failed to offload this state" );
net/xfrm/xfrm_user.c +2 -0
@@ -943,6 +943,8 @@ static int copy_user_offload(struct xfrm_dev_offload *xso, struct sk_buff *skb) xuo->ifindex = xso->dev->ifindex;if (xso->dir ==XFRM_DEV_OFFLOAD_IN ) xuo->flags =XFRM_OFFLOAD_INBOUND ; +if (xso->type ==XFRM_DEV_OFFLOAD_PACKET ) + xuo->flags |=XFRM_OFFLOAD_PACKET ;return 0 ; }
Signature · 1 line
2.38.1
PATCH v8 2/8 xfrm: allow state packet offload mode
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Allow users to configure xfrm states with packet offload mode. The packet mode must be requested both for policy and state, and such requires us to do not implement fallback.
We explicitly return an error if requested packet mode can't be configured.
--- .../inline_crypto/ch_ipsec/chcr_ipsec.c | 4 ++++ .../net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 5 ++++ drivers/net/ethernet/intel/ixgbevf/ipsec.c | 5 ++++ .../mellanox/mlx5/core/en_accel/ipsec.c | 4 ++++ drivers/net/netdevsim/ipsec.c | 5 ++++ net/xfrm/xfrm_device.c | 24 +++++++++++++++---- 6 files changed, 42 insertions(+), 5 deletions(-)
drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c +4 -0
@@ -283,6 +283,10 @@ static int ch_ipsec_xfrm_add_state(struct xfrm_state *x)pr_debug ("Cannot offload xfrm states with geniv other than seqiv\n" );return -EINVAL ; } +if (x->xso.type !=XFRM_DEV_OFFLOAD_CRYPTO ) { +pr_debug ("Unsupported xfrm offload\n" ); +return -EINVAL ; + } sa_entry =kzalloc (sizeof (*sa_entry),GFP_KERNEL );if (!sa_entry) {
drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +5 -0
@@ -585,6 +585,11 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)return -EINVAL ; } +if (xs->xso.type !=XFRM_DEV_OFFLOAD_CRYPTO ) { +netdev_err (dev,"Unsupported ipsec offload type\n" ); +return -EINVAL ; + } +if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) {struct rx_sa rsa;
drivers/net/ethernet/intel/ixgbevf/ipsec.c +5 -0
@@ -280,6 +280,11 @@ static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs)return -EINVAL ; } +if (xs->xso.type !=XFRM_DEV_OFFLOAD_CRYPTO ) { +netdev_err (dev,"Unsupported ipsec offload type\n" ); +return -EINVAL ; + } +if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) {struct rx_sa rsa;
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +4 -0
@@ -253,6 +253,10 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)netdev_info (netdev,"Cannot offload xfrm states with geniv other than seqiv\n" );return -EINVAL ; } +if (x->xso.type !=XFRM_DEV_OFFLOAD_CRYPTO ) { +netdev_info (netdev,"Unsupported xfrm offload type\n" ); +return -EINVAL ; + }return 0 ; }
drivers/net/netdevsim/ipsec.c +5 -0
@@ -149,6 +149,11 @@ static int nsim_ipsec_add_sa(struct xfrm_state *xs)return -EINVAL ; } +if (xs->xso.type !=XFRM_DEV_OFFLOAD_CRYPTO ) { +netdev_err (dev,"Unsupported ipsec offload type\n" ); +return -EINVAL ; + } +/* find the first unused index */ ret =nsim_ipsec_find_empty_idx (ipsec);if (ret <0 ) {
net/xfrm/xfrm_device.c +19 -5
@@ -216,6 +216,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,struct xfrm_dev_offload *xso = &x->xso;xfrm_address_t *saddr;xfrm_address_t *daddr; +bool is_packet_offload;if (!x->type_offload) {NL_SET_ERR_MSG (extack,"Type doesn't support offload" );
@@ -228,11 +229,13 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,return -EINVAL ; } -if (xuo->flags & ~(XFRM_OFFLOAD_IPV6 |XFRM_OFFLOAD_INBOUND )) { +if (xuo->flags & + ~(XFRM_OFFLOAD_IPV6 |XFRM_OFFLOAD_INBOUND |XFRM_OFFLOAD_PACKET )) {NL_SET_ERR_MSG (extack,"Unrecognized flags in offload request" );return -EINVAL ; } + is_packet_offload = xuo->flags &XFRM_OFFLOAD_PACKET ; dev =dev_get_by_index (net, xuo->ifindex);if (!dev) {if (!(xuo->flags &XFRM_OFFLOAD_INBOUND )) {
@@ -247,7 +250,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, x->props.family, xfrm_smark_get(0, x));if (IS_ERR (dst)) -return 0 ; +return (is_packet_offload) ? -EINVAL :0 ; dev = dst->dev;
@@ -258,7 +261,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,if (!dev->xfrmdev_ops || !dev->xfrmdev_ops->xdo_dev_state_add) { xso->dev =NULL ;dev_put (dev); -return 0 ; +return (is_packet_offload) ? -EINVAL :0 ; } if (x->props.flags & XFRM_STATE_ESN &&
@@ -278,7 +281,10 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,else xso->dir =XFRM_DEV_OFFLOAD_OUT ; - xso->type =XFRM_DEV_OFFLOAD_CRYPTO ; +if (is_packet_offload) + xso->type =XFRM_DEV_OFFLOAD_PACKET ; +else + xso->type =XFRM_DEV_OFFLOAD_CRYPTO ; err = dev->xfrmdev_ops->xdo_dev_state_add (x);if (err) {
@@ -288,7 +294,15 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,netdev_put (dev, &xso->dev_tracker); xso->type =XFRM_DEV_OFFLOAD_UNSPECIFIED ; -if (err != -EOPNOTSUPP ) { +/* User explicitly requested packet offload mode and configured +* policy in addition to the XFRM state. So be civil to users, +* and return an error instead of taking fallback path. +* +* This WARN_ON() can be seen as a documentation for driver +* authors to do not return -EOPNOTSUPP in packet offload mode. +*/ +WARN_ON (err == -EOPNOTSUPP && is_packet_offload); +if (err != -EOPNOTSUPP || is_packet_offload) {NL_SET_ERR_MSG (extack,"Device failed to offload this state" );return err; }
Signature · 1 line
2.38.1
PATCH v8 3/8 xfrm: add an interface to offload policy
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Extend netlink interface to add and delete XFRM policy from the device. This functionality is a first step to implement packet IPsec offload solution.
--- include/linux/netdevice.h | 3 ++ include/net/xfrm.h | 45 +++++++++++++++++++++++++ net/xfrm/xfrm_device.c | 67 ++++++++++++++++++++++++++++++++++++- net/xfrm/xfrm_policy.c | 69 +++++++++++++++++++++++++++++++++++++++ net/xfrm/xfrm_user.c | 18 ++++++++++ 5 files changed, 201 insertions(+), 1 deletion(-)
include/linux/netdevice.h +3 -0
@@ -1040,6 +1040,9 @@ struct xfrmdev_ops {bool (*xdo_dev_offload_ok) (struct sk_buff *skb,struct xfrm_state *x);void (*xdo_dev_state_advance_esn) (struct xfrm_state *x); +int (*xdo_dev_policy_add) (struct xfrm_policy *x); +void (*xdo_dev_policy_delete) (struct xfrm_policy *x); + void (*xdo_dev_policy_free) (struct xfrm_policy *x); };#endif
include/net/xfrm.h +45 -0
81 lines not on this page · raw message
net/xfrm/xfrm_device.c +66 -1
80 lines not on this page · raw message
net/xfrm/xfrm_policy.c +69 -0
99 lines not on this page · raw message
net/xfrm/xfrm_user.c +18 -0
@@ -1869,6 +1869,15 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net,if (attrs[XFRMA_IF_ID ]) xp->if_id =nla_get_u32 (attrs[XFRMA_IF_ID ]); +/* configure the hardware if offload is requested */ +if (attrs[XFRMA_OFFLOAD_DEV ]) { + err =xfrm_dev_policy_add (net, xp, +nla_data (attrs[XFRMA_OFFLOAD_DEV ]), + p->dir, extack); +if (err) + goto error; + } +return xp; error: *errp = err;
@@ -1908,6 +1917,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,xfrm_audit_policy_add (xp, err ?0 :1 , true);if (err) { +xfrm_dev_policy_delete (xp);security_xfrm_policy_free (xp->security);kfree (xp);return err;
@@ -2020,6 +2030,8 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr err =xfrm_mark_put (skb, &xp->mark);if (!err) err =xfrm_if_id_put (skb, xp->if_id); +if (!err && xp->xdo.dev) + err =copy_user_offload (&xp->xdo, skb);if (err) {nlmsg_cancel (skb, nlh);return err;
@@ -3343,6 +3355,8 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x, err =xfrm_mark_put (skb, &xp->mark);if (!err) err =xfrm_if_id_put (skb, xp->if_id); +if (!err && xp->xdo.dev) + err =copy_user_offload (&xp->xdo, skb);if (err) {nlmsg_cancel (skb, nlh);return err;
@@ -3461,6 +3475,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp, err =xfrm_mark_put (skb, &xp->mark);if (!err) err =xfrm_if_id_put (skb, xp->if_id); +if (!err && xp->xdo.dev) + err =copy_user_offload (&xp->xdo, skb);if (err) {nlmsg_cancel (skb, nlh);return err;
@@ -3544,6 +3560,8 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, const struct km_e err =xfrm_mark_put (skb, &xp->mark);if (!err) err =xfrm_if_id_put (skb, xp->if_id); +if (!err && xp->xdo.dev) + err =copy_user_offload (&xp->xdo, skb);if (err) goto out_free_skb;
Signature · 1 line
2.38.1
PATCH v8 4/8 xfrm: add TX datapath support for IPsec packet offload mode
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
In IPsec packet mode, the device is going to encrypt and encapsulate packets that are associated with offloaded policy. After successful policy lookup to indicate if packets should be offloaded or not, the stack forwards packets to the device to do the magic.
--- net/xfrm/xfrm_device.c | 15 +++++++++++++-- net/xfrm/xfrm_output.c | 12 +++++++++++- net/xfrm/xfrm_policy.c | 21 ++++++++++++++++++++- 3 files changed, 44 insertions(+), 4 deletions(-)
net/xfrm/xfrm_device.c +13 -2
@@ -120,6 +120,16 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featurif (xo->flags &XFRM_GRO || x->xso.dir ==XFRM_DEV_OFFLOAD_IN )return skb; +/* The packet was sent to HW IPsec packet offload engine, +* but to wrong device. Drop the packet, so it won't skip +* XFRM stack. +*/ +if (x->xso.type ==XFRM_DEV_OFFLOAD_PACKET && x->xso.dev != dev) { +kfree_skb (skb); +dev_core_stats_tx_dropped_inc (dev); +return NULL ; + } +/* This skb was already validated on the upper/virtual dev */ if ((x->xso.dev != dev) && (x->xso.real_dev == dev))return skb;
@@ -385,8 +395,9 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)if (!x->type_offload || x->encap)return false; -if ((!dev || (dev ==xfrm_dst_path (dst)->dev)) && - (!xdst->child->xfrm)) { +if (x->xso.type ==XFRM_DEV_OFFLOAD_PACKET || + ((!dev || (dev ==xfrm_dst_path (dst)->dev)) && + !xdst->child->xfrm)) { mtu =xfrm_state_mtu (x, xdst->child_mtu_cached);if (skb->len <= mtu) goto ok;
net/xfrm/xfrm_output.c +11 -1
@@ -494,7 +494,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)struct xfrm_state *x = dst->xfrm;struct net *net =xs_net (x); -if (err <=0 ) +if (err <=0 || x->xso.type ==XFRM_DEV_OFFLOAD_PACKET ) goto resume; do {
@@ -718,6 +718,16 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)break ; } +if (x->xso.type ==XFRM_DEV_OFFLOAD_PACKET ) { +if (!xfrm_dev_offload_ok (skb, x)) { +XFRM_INC_STATS (net,LINUX_MIB_XFRMOUTERROR ); +kfree_skb (skb); +return -EHOSTUNREACH ; + } + +return xfrm_output_resume (sk, skb,0 ); + } +secpath_reset (skb);if (xfrm_dev_offload_ok (skb, x)) {
net/xfrm/xfrm_policy.c +20 -1
@@ -2619,6 +2619,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,int tos;int family = policy->selector.family;xfrm_address_t saddr, daddr; +struct dst_entry *dst1;xfrm_flowi_addr_get (fl, &saddr, &daddr, family);
@@ -2628,7 +2629,8 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,for (; i < nx; i++) {struct xfrm_dst *xdst =xfrm_alloc_dst (net, family); -struct dst_entry *dst1 = &xdst->u.dst; + + dst1 = &xdst->u.dst; err =PTR_ERR (xdst);if (IS_ERR (xdst)) {
@@ -2708,6 +2710,23 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,if (!dev) goto free_dst; + dst1 = &xdst0->u.dst; +/* Packet offload: both policy and SA should be offloaded */ +if ((policy->xdo.type ==XFRM_DEV_OFFLOAD_PACKET && + dst1->xfrm->xso.type !=XFRM_DEV_OFFLOAD_PACKET ) || + (policy->xdo.type !=XFRM_DEV_OFFLOAD_PACKET && + dst1->xfrm->xso.type ==XFRM_DEV_OFFLOAD_PACKET )) { + err = -EINVAL ; + goto free_dst; + } + +/* Packet offload: both policy and SA should have same device */ +if (policy->xdo.type ==XFRM_DEV_OFFLOAD_PACKET && + policy->xdo.dev != dst1->xfrm->xso.dev) { + err = -EINVAL ; + goto free_dst; + } +xfrm_init_path (xdst0, dst, nfheader_len);xfrm_init_pmtu (bundle, nx);
Signature · 1 line
2.38.1
PATCH v8 5/8 xfrm: add RX datapath protection for IPsec packet offload mode
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Traffic received by device with enabled IPsec packet offload should be forwarded to the stack only after decryption, packet headers and trailers removed.
Such packets are expected to be seen as normal (non-XFRM) ones, while not-supported packets should be dropped by the HW.
--- include/net/xfrm.h | 55 +++++++++++++++++++++++++++------------------- 1 file changed, 32 insertions(+), 23 deletions(-)
include/net/xfrm.h +32 -23
@@ -1102,6 +1102,29 @@ xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unreturn !0 ; } +#ifdef CONFIG_XFRM +static inline struct xfrm_state *xfrm_input_state (struct sk_buff *skb) +{ +struct sec_path *sp =skb_sec_path (skb); + +return sp->xvec[sp->len -1 ]; +} +#endif + +static inline struct xfrm_offload *xfrm_offload (struct sk_buff *skb) +{ +#ifdef CONFIG_XFRM +struct sec_path *sp =skb_sec_path (skb); + +if (!sp || !sp->olen || sp->len != sp->olen) +return NULL ; + +return &sp->ovec[sp->olen -1 ]; +#else +return NULL ; +#endif +} +#ifdef CONFIG_XFRM int __xfrm_policy_check (struct sock *,int dir,struct sk_buff *skb,unsigned short family);
@@ -1133,10 +1156,19 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, {struct net *net =dev_net (skb->dev);int ndir = dir | (reverse ?XFRM_POLICY_MASK +1 :0 ); +struct xfrm_offload *xo =xfrm_offload (skb); +struct xfrm_state *x;if (sk && sk->sk_policy[XFRM_POLICY_IN ])return __xfrm_policy_check (sk, ndir, skb, family); +if (xo) { + x =xfrm_input_state (skb); +if (x->xso.type ==XFRM_DEV_OFFLOAD_PACKET ) +return (xo->flags &CRYPTO_DONE ) && + (xo->status &CRYPTO_SUCCESS ); + } +return __xfrm_check_nopolicy (net, skb, dir) ||__xfrm_check_dev_nopolicy (skb, dir, family) ||__xfrm_policy_check (sk, ndir, skb, family);
@@ -1870,29 +1902,6 @@ static inline void xfrm_states_delete(struct xfrm_state **states, int n) }#endif -#ifdef CONFIG_XFRM -static inline struct xfrm_state *xfrm_input_state (struct sk_buff *skb) -{ -struct sec_path *sp =skb_sec_path (skb); - -return sp->xvec[sp->len -1 ]; -} -#endif - -static inline struct xfrm_offload *xfrm_offload (struct sk_buff *skb) -{ -#ifdef CONFIG_XFRM -struct sec_path *sp =skb_sec_path (skb); - -if (!sp || !sp->olen || sp->len != sp->olen) -return NULL ; - -return &sp->ovec[sp->olen -1 ]; -#else -return NULL ; -#endif -} -void __init xfrm_dev_init (void );#ifdef CONFIG_XFRM_OFFLOAD
Signature · 1 line
2.38.1
PATCH v8 6/8 xfrm: speed-up lookup of HW policies
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Devices that implement IPsec packet offload mode should offload SA and policies too. In RX path, it causes to the situation that HW will always have higher priority over any SW policies.
It means that we don't need to perform any search of inexact policies and/or priority checks if HW policy was discovered. In such situation, the HW will catch the packets anyway and HW can still implement inexact lookups.
In case specific policy is not found, we will continue with packet lookup and check for existence of HW policies in inexact list.
HW policies are added to the head of SPD to ensure fast lookup, as XFRM iterates over all policies in the loop.
The same solution of adding HW SAs at the begging of the list is applied to SA database too. However, we don't need to change lookups as they are sorted by insertion order and not priority.
--- net/xfrm/xfrm_policy.c | 16 ++++++---- net/xfrm/xfrm_state.c | 66 ++++++++++++++++++++++++++++++++---------- 2 files changed, 62 insertions(+), 20 deletions(-)
net/xfrm/xfrm_policy.c +11 -5
@@ -536,7 +536,7 @@ static void xfrm_dst_hash_transfer(struct net *net,__get_hash_thresh (net, pol->family, dir, &dbits, &sbits); h =__addr_hash (&pol->selector.daddr, &pol->selector.saddr, pol->family, nhashmask, dbits, sbits); -if (!entry0) { +if (!entry0 || pol->xdo.type ==XFRM_DEV_OFFLOAD_PACKET ) {hlist_del_rcu (&pol->bydst);hlist_add_head_rcu (&pol->bydst, ndsttable + h); h0 = h;
@@ -867,7 +867,7 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,break ; } -if (newpos) +if (newpos && policy->xdo.type !=XFRM_DEV_OFFLOAD_PACKET )hlist_add_behind_rcu (&policy->bydst, newpos);else hlist_add_head_rcu (&policy->bydst, &n->hhead);
@@ -1348,7 +1348,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)else break ; } -if (newpos) +if (newpos && policy->xdo.type !=XFRM_DEV_OFFLOAD_PACKET )hlist_add_behind_rcu (&policy->bydst, newpos);else hlist_add_head_rcu (&policy->bydst, chain);
@@ -1525,7 +1525,7 @@ static void xfrm_policy_insert_inexact_list(struct hlist_head *chain,break ; } -if (newpos) +if (newpos && policy->xdo.type !=XFRM_DEV_OFFLOAD_PACKET )hlist_add_behind_rcu (&policy->bydst_inexact_list, newpos);else hlist_add_head_rcu (&policy->bydst_inexact_list, chain);
@@ -1562,9 +1562,12 @@ static struct xfrm_policy *xfrm_policy_insert_list(struct hlist_head *chain,break ; } -if (newpos) +if (newpos && policy->xdo.type !=XFRM_DEV_OFFLOAD_PACKET )hlist_add_behind_rcu (&policy->bydst, &newpos->bydst);else +/* Packet offload policies enter to the head +* to speed-up lookups. +*/ hlist_add_head_rcu (&policy->bydst, chain);return delpol;
@@ -2181,6 +2184,9 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,break ; } } +if (ret && ret->xdo.type ==XFRM_DEV_OFFLOAD_PACKET ) + goto skip_inexact; + bin =xfrm_policy_inexact_lookup_rcu (net, type, family, dir, if_id);if (!bin || !xfrm_policy_find_inexact_candidates (&cand, bin, saddr, daddr))
net/xfrm/xfrm_state.c +51 -15
134 lines not on this page · raw message
Signature · 1 line
2.38.1
PATCH v8 7/8 xfrm: add support to HW update soft and hard limits
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Both in RX and TX, the traffic that performs IPsec packet offload transformation is accounted by HW. It is needed to properly handle hard limits that require to drop the packet.
It means that XFRM core needs to update internal counters with the one that accounted by the HW, so new callbacks are introduced in this patch.
In case of soft or hard limit is occurred, the driver should call to xfrm_state_check_expire() that will perform key rekeying exactly as done by XFRM core.
--- include/linux/netdevice.h | 1 + include/net/xfrm.h | 17 +++++++++++++++++ net/xfrm/xfrm_state.c | 4 ++++ 3 files changed, 22 insertions(+)
include/linux/netdevice.h +1 -0
@@ -1040,6 +1040,7 @@ struct xfrmdev_ops {bool (*xdo_dev_offload_ok) (struct sk_buff *skb,struct xfrm_state *x);void (*xdo_dev_state_advance_esn) (struct xfrm_state *x); +void (*xdo_dev_state_update_curlft) (struct xfrm_state *x);int (*xdo_dev_policy_add) (struct xfrm_policy *x);void (*xdo_dev_policy_delete) (struct xfrm_policy *x);void (*xdo_dev_policy_free) (struct xfrm_policy *x);
include/net/xfrm.h +17 -0
@@ -1571,6 +1571,23 @@ struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,struct xfrm_state *xfrm_state_lookup_byspi (struct net *net,__be32 spi,unsigned short family);int xfrm_state_check_expire (struct xfrm_state *x); +#ifdef CONFIG_XFRM_OFFLOAD +static inline void xfrm_dev_state_update_curlft (struct xfrm_state *x) +{ +struct xfrm_dev_offload *xdo = &x->xso; +struct net_device *dev = xdo->dev; + +if (x->xso.type !=XFRM_DEV_OFFLOAD_PACKET ) +return ; + +if (dev && dev->xfrmdev_ops && + dev->xfrmdev_ops->xdo_dev_state_update_curlft) + dev->xfrmdev_ops->xdo_dev_state_update_curlft (x); + +} +#else +static inline void xfrm_dev_state_update_curlft (struct xfrm_state *x) {} +#endif void xfrm_state_insert (struct xfrm_state *x);int xfrm_state_add (struct xfrm_state *x);int xfrm_state_update (struct xfrm_state *x);
net/xfrm/xfrm_state.c +4 -0
@@ -570,6 +570,8 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)int err =0 ;spin_lock (&x->lock); +xfrm_dev_state_update_curlft (x); +if (x->km.state ==XFRM_STATE_DEAD ) goto out;if (x->km.state ==XFRM_STATE_EXPIRED )
@@ -1821,6 +1823,8 @@ EXPORT_SYMBOL(xfrm_state_update);int xfrm_state_check_expire (struct xfrm_state *x) { +xfrm_dev_state_update_curlft (x); +if (!x->curlft.use_time) x->curlft.use_time =ktime_get_real_seconds ();
Signature · 1 line
2.38.1
PATCH v8 8/8 xfrm: document IPsec packet offload mode
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Extend XFRM device offload API description with newly added packet offload mode.
--- Documentation/networking/xfrm_device.rst | 62 ++++++++++++++++++++---- 1 file changed, 53 insertions(+), 9 deletions(-)
Documentation/networking/xfrm_device.rst +53 -9
@@ -5,6 +5,7 @@ XFRM device - offloading the IPsec computations =============================================== Shannon Nelson <[email protected]> +Leon Romanovsky <[email protected]> Overview
@@ -18,10 +19,21 @@ can radically increase throughput and decrease CPU utilization. The XFRM Device interface allows NIC drivers to offer to the stack access to the hardware offload. +Right now, there are two types of hardware offload that kernel supports. + * IPsec crypto offload: + * NIC performs encrypt/decrypt + * Kernel does everything else + * IPsec packet offload: + * NIC performs encrypt/decrypt + * NIC does encapsulation + * Kernel and NIC have SA and policy in-sync + * NIC handles the SA and policies states + * The Kernel talks to the keymanager + Userland access to the offload is typically through a system such as libreswan or KAME/raccoon, but the iproute2 'ip xfrm' command set can be handy when experimenting. An example command might look something -like this:: +like this for crypto offload: ip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \
@@ -29,6 +41,17 @@ like this:: sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \ offload dev eth4 dir in +and for packet offload + + ip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \ + reqid 0x07 replay-window 32 \ + aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ + sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \ + offload packet dev eth4 dir in + + ip x p add src 14.0.0.70 dst 14.0.0.52 offload packet dev eth4 dir in + tmpl src 14.0.0.70 dst 14.0.0.52 proto esp reqid 10000 mode transport + Yes, that's ugly, but that's what shell scripts and/or libreswan are for.
@@ -40,17 +63,24 @@ Callbacks to implement /* from include/linux/netdevice.h */ struct xfrmdev_ops { + /* Crypto and Packet offload callbacks */ int (*xdo_dev_state_add) (struct xfrm_state *x); void (*xdo_dev_state_delete) (struct xfrm_state *x); void (*xdo_dev_state_free) (struct xfrm_state *x); bool (*xdo_dev_offload_ok) (struct sk_buff *skb, struct xfrm_state *x); void (*xdo_dev_state_advance_esn) (struct xfrm_state *x); + + /* Solely packet offload callbacks */ + void (*xdo_dev_state_update_curlft) (struct xfrm_state *x); + int (*xdo_dev_policy_add) (struct xfrm_policy *x); + void (*xdo_dev_policy_delete) (struct xfrm_policy *x); + void (*xdo_dev_policy_free) (struct xfrm_policy *x); }; -The NIC driver offering ipsec offload will need to implement these -callbacks to make the offload available to the network stack's -XFRM subsystem. Additionally, the feature bits NETIF_F_HW_ESP and +The NIC driver offering ipsec offload will need to implement callbacks +relevant to supported offload to make the offload available to the network +stack's XFRM subsystem. Additionally, the feature bits NETIF_F_HW_ESP and NETIF_F_HW_ESP_TX_CSUM will signal the availability of the offload.
@@ -79,7 +109,8 @@ and an indication of whether it is for Rx or Tx. The driver should =========== =================================== 0 success - -EOPNETSUPP offload not supported, try SW IPsec + -EOPNETSUPP offload not supported, try SW IPsec, + not applicable for packet offload mode other fail the request =========== ===================================
@@ -96,6 +127,7 @@ will serviceable. This can check the packet information to be sure the offload can be supported (e.g. IPv4 or IPv6, no IPv4 options, etc) and return true of false to signify its support. +Crypto offload mode: When ready to send, the driver needs to inspect the Tx packet for the offload information, including the opaque context, and set up the packet send accordingly::
@@ -139,13 +171,25 @@ the stack in xfrm_input(). In ESN mode, xdo_dev_state_advance_esn() is called from xfrm_replay_advance_esn(). Driver will check packet seq number and update HW ESN state machine if needed. +Packet offload mode: +HW adds and deletes XFRM headers. So in RX path, XFRM stack is bypassed if HW +reported success. In TX path, the packet lefts kernel without extra header +and not encrypted, the HW is responsible to perform it. + When the SA is removed by the user, the driver's xdo_dev_state_delete() -is asked to disable the offload. Later, xdo_dev_state_free() is called -from a garbage collection routine after all reference counts to the state +and xdo_dev_policy_delete() are asked to disable the offload. Later, +xdo_dev_state_free() and xdo_dev_policy_free() are called from a garbage +collection routine after all reference counts to the state and policy have been removed and any remaining resources can be cleared for the offload state. How these are used by the driver will depend on specific hardware needs. As a netdev is set to DOWN the XFRM stack's netdev listener will call -xdo_dev_state_delete() and xdo_dev_state_free() on any remaining offloaded -states. +xdo_dev_state_delete(), xdo_dev_policy_delete(), xdo_dev_state_free() and +xdo_dev_policy_free() on any remaining offloaded states. + +Outcome of HW handling packets, the XFRM core can't count hard, soft limits. +The HW/driver are responsible to perform it and provide accurate data when +xdo_dev_state_update_curlft() is called. In case of one of these limits +occuried, the driver needs to call to xfrm_state_check_expire() to make sure +that XFRM performs rekeying sequence.
Signature · 1 line
2.38.1