From: Steffen Klassert <steffen.klassert@secunet.com>
To: Leon Romanovsky <leon@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"Jakub Kicinski" <kuba@kernel.org>, <netdev@vger.kernel.org>
Subject: Re: [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies
Date: Mon, 21 Nov 2022 10:44:04 +0100 [thread overview]
Message-ID: <20221121094404.GU704954@gauss3.secunet.de> (raw)
In-Reply-To: <Y3p9LvAEQMAGeaCR@unreal>
On Sun, Nov 20, 2022 at 09:17:02PM +0200, Leon Romanovsky wrote:
> On Fri, Nov 18, 2022 at 11:49:07AM +0100, Steffen Klassert wrote:
> > On Thu, Nov 17, 2022 at 02:51:33PM +0200, Leon Romanovsky wrote:
> > > On Thu, Nov 17, 2022 at 01:12:43PM +0100, Steffen Klassert wrote:
> > > > On Wed, Nov 09, 2022 at 02:54:34PM +0200, Leon Romanovsky wrote:
> > > > > From: Leon Romanovsky <leonro@nvidia.com>
> > >
> > > > So this raises the question how to handle acquires with this packet
> > > > offload.
> > >
> > > We handle acquires as SW policies and don't offload them.
> >
> > We trigger acquires with states, not policies. The thing is,
> > we might match a HW policy but create a SW acquire state.
> > This will not match anymore as soon as the lookup is
> > implemented correctly.
>
> For now, all such packets will be dropped as we have offlaoded
> policy but not SA.
I think you missed my point. If the HW policy does not match
the SW acquire state, then each packet will geneate a new
acquire. So you need to make sure that policy and acquire
state will match to send the acquire just once to userspace.
> > > It is not different from any other kernel code, bugs will be fixed.
> >
> > The thing that is different here is, that the concept is already
> > broken. We can't split the datapath to be partially handled in
> > SW and HW in any sane way, this becomes clearer and clearer.
> >
> > The full protocol offload simply does not fit well into HW,
> > but we try to make it fit with a hammer. This is the problem
> > why I do not really like this, and is also the reason why this
> > is still not merged. We might be much better of by doing a
> > HW frindly redesign of the protocol and offload this then.
> > But, yes that takes time and will have issues too.
>
> When you say "protocol", what do you mean? Many users, who have
> deployed IPsec solutions, just want to have same look and feel
> but much faster.
>
> I truly believe that this packet offload fits SW model and the
> (small) amount of changes supports it. There are almost no changes
> to the stack to natively support this offload.
>
> As long as HW involved, you will never have solution without issues,
> and like you said even redesign "will have issues".
Things would be much easier, if we don't need to add HW policies
and states to SW databases. But yes, a redesign might have issues
too. That's why we are still working on the current soluion :)
next prev parent reply other threads:[~2022-11-21 9:44 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-09 12:54 [PATCH xfrm-next v7 0/8] Extend XFRM core to allow packet offload configuration Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 1/8] xfrm: add new packet offload flag Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 2/8] xfrm: allow state packet offload mode Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 3/8] xfrm: add an interface to offload policy Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 4/8] xfrm: add TX datapath support for IPsec packet offload mode Leon Romanovsky
2022-11-17 11:59 ` Steffen Klassert
2022-11-17 12:32 ` Leon Romanovsky
2022-11-18 10:23 ` Steffen Klassert
2022-11-21 11:10 ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 5/8] xfrm: add RX datapath protection " Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies Leon Romanovsky
2022-11-17 12:12 ` Steffen Klassert
2022-11-17 12:51 ` Leon Romanovsky
2022-11-18 10:49 ` Steffen Klassert
2022-11-20 19:17 ` Leon Romanovsky
2022-11-21 9:44 ` Steffen Klassert [this message]
2022-11-21 10:27 ` Leon Romanovsky
2022-11-21 11:09 ` Steffen Klassert
2022-11-21 11:15 ` Leon Romanovsky
2022-11-21 11:25 ` Steffen Klassert
2022-11-21 11:34 ` Leon Romanovsky
2022-11-21 12:02 ` Leon Romanovsky
2022-11-21 12:43 ` Steffen Klassert
2022-11-21 13:01 ` Leon Romanovsky
2022-11-22 13:10 ` Steffen Klassert
2022-11-22 13:57 ` Leon Romanovsky
2022-11-23 8:37 ` Steffen Klassert
2022-11-23 9:36 ` Leon Romanovsky
2022-11-23 12:53 ` Leon Romanovsky
2022-11-24 11:07 ` Steffen Klassert
2022-11-25 6:23 ` Leon Romanovsky
2022-11-21 12:10 ` Steffen Klassert
2022-11-21 13:21 ` Leon Romanovsky
2022-11-22 4:29 ` Herbert Xu
2022-11-22 6:27 ` Leon Romanovsky
2022-11-22 13:00 ` Steffen Klassert
2022-11-22 13:54 ` Leon Romanovsky
2022-11-23 8:23 ` Steffen Klassert
2022-11-23 10:25 ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 7/8] xfrm: add support to HW update soft and hard limits Leon Romanovsky
2022-11-17 12:13 ` Steffen Klassert
2022-11-17 12:32 ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 8/8] xfrm: document IPsec packet offload mode Leon Romanovsky
2022-11-17 12:15 ` Steffen Klassert
2022-11-17 12:33 ` Leon Romanovsky
2022-11-15 18:09 ` [PATCH xfrm-next v7 0/8] Extend XFRM core to allow packet offload configuration Leon Romanovsky
2022-11-15 18:30 ` Steffen Klassert
2022-11-15 19:00 ` Leon Romanovsky
2022-11-16 23:07 ` Saeed Mahameed
2022-11-17 12:20 ` Steffen Klassert
2022-11-17 12:24 ` Leon Romanovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221121094404.GU704954@gauss3.secunet.de \
--to=steffen.klassert@secunet.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).