Re: [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies

From: Steffen Klassert <steffen.klassert@secunet.com>
To: Leon Romanovsky <leon@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	"Jakub Kicinski" <kuba@kernel.org>, <netdev@vger.kernel.org>
Subject: Re: [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies
Date: Mon, 21 Nov 2022 13:10:40 +0100	[thread overview]
Message-ID: <20221121121040.GY704954@gauss3.secunet.de> (raw)
In-Reply-To: <Y3tiRnbfBcaH7bP0@unreal>

On Mon, Nov 21, 2022 at 01:34:30PM +0200, Leon Romanovsky wrote:
> 
> Sorry, my bad. But why can't we drop all packets that don't have HW
> state? Why do we need to add larval?

The first packet of a flow tiggers an acquire and inserts a larval
state. On a traffic triggered connection, we need this to get
a state with keys installed.

We need this larval state then, because that tells us we sent already an
acquire to userspace. All subsequent packets of that flow will be
dropped without sending another acquire. Otherwise each subsequent
packet will generate another acquire until the keys are negotiated.
If a flow starts sending on a high rate, this would be not so nice
for userspace :)