netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Leon Romanovsky <leon@kernel.org>
To: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Jakub Kicinski <kuba@kernel.org>,
	netdev@vger.kernel.org
Subject: Re: [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies
Date: Mon, 21 Nov 2022 15:01:42 +0200	[thread overview]
Message-ID: <Y3t2tsHDpxjnBAb/@unreal> (raw)
In-Reply-To: <20221121124349.GZ704954@gauss3.secunet.de>

On Mon, Nov 21, 2022 at 01:43:49PM +0100, Steffen Klassert wrote:
> On Mon, Nov 21, 2022 at 02:02:52PM +0200, Leon Romanovsky wrote:
> > 
> > I think that something like this will do the trick.
> > 
> > diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> > index 5076f9d7a752..d1c9ef857755 100644
> > --- a/net/xfrm/xfrm_state.c
> > +++ b/net/xfrm/xfrm_state.c
> > @@ -1090,6 +1090,28 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
> >         }
> >  }
> > 
> > +static bool xfrm_state_and_policy_mixed(struct xfrm_state *x,
> > +                                       struct xfrm_policy *p)
> > +{
> > +       /* Packet offload: both policy and SA should be offloaded */
> > +       if (p->xdo.type == XFRM_DEV_OFFLOAD_PACKET &&
> > +           x->xso.type != XFRM_DEV_OFFLOAD_PACKET)
> > +               return true;
> > +
> > +       if (p->xdo.type != XFRM_DEV_OFFLOAD_PACKET &&
> > +           x->xso.type == XFRM_DEV_OFFLOAD_PACKET)
> > +               return true;
> > +
> > +       if (p->xdo.type != XFRM_DEV_OFFLOAD_PACKET)
> > +               return false;
> > +
> > +       /* Packet offload: both policy and SA should have same device */
> > +       if (p->xdo.dev != x->xso.dev)
> > +               return true;
> > +
> > +       return false;
> > +}
> > +
> >  struct xfrm_state *
> >  xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
> >                 const struct flowi *fl, struct xfrm_tmpl *tmpl,
> > @@ -1147,7 +1169,8 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
> > 
> >  found:
> >         x = best;
> > -       if (!x && !error && !acquire_in_progress) {
> > +       if (!x && !error && !acquire_in_progress &&
> > +           pol->xdo.type != XFRM_DEV_OFFLOAD_PACKET) {
> >                 if (tmpl->id.spi &&
> >                     (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
> >                                               tmpl->id.proto, encap_family)) != NULL) {
> > @@ -1228,7 +1251,14 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
> >                         *err = -EAGAIN;
> >                         x = NULL;
> >                 }
> > +               if (x && xfrm_state_and_policy_mixed(x, pol)) {
> > +                       *err = -EINVAL;
> > +                       x = NULL;
> 
> If policy and state do not match here, this means the lookup
> returned the wrong state. The correct state might still sit
> in the database. At this point, you should either have found
> a matching state, or no state at all.

I check for "x" because of "x = NULL" above.

Thanks

  reply	other threads:[~2022-11-21 13:02 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-09 12:54 [PATCH xfrm-next v7 0/8] Extend XFRM core to allow packet offload configuration Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 1/8] xfrm: add new packet offload flag Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 2/8] xfrm: allow state packet offload mode Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 3/8] xfrm: add an interface to offload policy Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 4/8] xfrm: add TX datapath support for IPsec packet offload mode Leon Romanovsky
2022-11-17 11:59   ` Steffen Klassert
2022-11-17 12:32     ` Leon Romanovsky
2022-11-18 10:23       ` Steffen Klassert
2022-11-21 11:10         ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 5/8] xfrm: add RX datapath protection " Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies Leon Romanovsky
2022-11-17 12:12   ` Steffen Klassert
2022-11-17 12:51     ` Leon Romanovsky
2022-11-18 10:49       ` Steffen Klassert
2022-11-20 19:17         ` Leon Romanovsky
2022-11-21  9:44           ` Steffen Klassert
2022-11-21 10:27             ` Leon Romanovsky
2022-11-21 11:09               ` Steffen Klassert
2022-11-21 11:15                 ` Leon Romanovsky
2022-11-21 11:25                   ` Steffen Klassert
2022-11-21 11:34                     ` Leon Romanovsky
2022-11-21 12:02                       ` Leon Romanovsky
2022-11-21 12:43                         ` Steffen Klassert
2022-11-21 13:01                           ` Leon Romanovsky [this message]
2022-11-22 13:10                             ` Steffen Klassert
2022-11-22 13:57                               ` Leon Romanovsky
2022-11-23  8:37                                 ` Steffen Klassert
2022-11-23  9:36                                   ` Leon Romanovsky
2022-11-23 12:53                                     ` Leon Romanovsky
2022-11-24 11:07                                       ` Steffen Klassert
2022-11-25  6:23                                         ` Leon Romanovsky
2022-11-21 12:10                       ` Steffen Klassert
2022-11-21 13:21                         ` Leon Romanovsky
2022-11-22  4:29                           ` Herbert Xu
2022-11-22  6:27                             ` Leon Romanovsky
2022-11-22 13:00                               ` Steffen Klassert
2022-11-22 13:54                                 ` Leon Romanovsky
2022-11-23  8:23                                   ` Steffen Klassert
2022-11-23 10:25                                     ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 7/8] xfrm: add support to HW update soft and hard limits Leon Romanovsky
2022-11-17 12:13   ` Steffen Klassert
2022-11-17 12:32     ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 8/8] xfrm: document IPsec packet offload mode Leon Romanovsky
2022-11-17 12:15   ` Steffen Klassert
2022-11-17 12:33     ` Leon Romanovsky
2022-11-15 18:09 ` [PATCH xfrm-next v7 0/8] Extend XFRM core to allow packet offload configuration Leon Romanovsky
2022-11-15 18:30   ` Steffen Klassert
2022-11-15 19:00     ` Leon Romanovsky
2022-11-16 23:07       ` Saeed Mahameed
2022-11-17 12:20         ` Steffen Klassert
2022-11-17 12:24           ` Leon Romanovsky

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Y3t2tsHDpxjnBAb/@unreal \
    --to=leon@kernel.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=steffen.klassert@secunet.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).