From: Leon Romanovsky <leon@kernel.org>
To: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Jakub Kicinski <kuba@kernel.org>,
netdev@vger.kernel.org
Subject: Re: [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies
Date: Mon, 21 Nov 2022 15:01:42 +0200 [thread overview]
Message-ID: <Y3t2tsHDpxjnBAb/@unreal> (raw)
In-Reply-To: <20221121124349.GZ704954@gauss3.secunet.de>
On Mon, Nov 21, 2022 at 01:43:49PM +0100, Steffen Klassert wrote:
> On Mon, Nov 21, 2022 at 02:02:52PM +0200, Leon Romanovsky wrote:
> >
> > I think that something like this will do the trick.
> >
> > diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> > index 5076f9d7a752..d1c9ef857755 100644
> > --- a/net/xfrm/xfrm_state.c
> > +++ b/net/xfrm/xfrm_state.c
> > @@ -1090,6 +1090,28 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
> > }
> > }
> >
> > +static bool xfrm_state_and_policy_mixed(struct xfrm_state *x,
> > + struct xfrm_policy *p)
> > +{
> > + /* Packet offload: both policy and SA should be offloaded */
> > + if (p->xdo.type == XFRM_DEV_OFFLOAD_PACKET &&
> > + x->xso.type != XFRM_DEV_OFFLOAD_PACKET)
> > + return true;
> > +
> > + if (p->xdo.type != XFRM_DEV_OFFLOAD_PACKET &&
> > + x->xso.type == XFRM_DEV_OFFLOAD_PACKET)
> > + return true;
> > +
> > + if (p->xdo.type != XFRM_DEV_OFFLOAD_PACKET)
> > + return false;
> > +
> > + /* Packet offload: both policy and SA should have same device */
> > + if (p->xdo.dev != x->xso.dev)
> > + return true;
> > +
> > + return false;
> > +}
> > +
> > struct xfrm_state *
> > xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
> > const struct flowi *fl, struct xfrm_tmpl *tmpl,
> > @@ -1147,7 +1169,8 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
> >
> > found:
> > x = best;
> > - if (!x && !error && !acquire_in_progress) {
> > + if (!x && !error && !acquire_in_progress &&
> > + pol->xdo.type != XFRM_DEV_OFFLOAD_PACKET) {
> > if (tmpl->id.spi &&
> > (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
> > tmpl->id.proto, encap_family)) != NULL) {
> > @@ -1228,7 +1251,14 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
> > *err = -EAGAIN;
> > x = NULL;
> > }
> > + if (x && xfrm_state_and_policy_mixed(x, pol)) {
> > + *err = -EINVAL;
> > + x = NULL;
>
> If policy and state do not match here, this means the lookup
> returned the wrong state. The correct state might still sit
> in the database. At this point, you should either have found
> a matching state, or no state at all.
I check for "x" because of "x = NULL" above.
Thanks
next prev parent reply other threads:[~2022-11-21 13:02 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-09 12:54 [PATCH xfrm-next v7 0/8] Extend XFRM core to allow packet offload configuration Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 1/8] xfrm: add new packet offload flag Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 2/8] xfrm: allow state packet offload mode Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 3/8] xfrm: add an interface to offload policy Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 4/8] xfrm: add TX datapath support for IPsec packet offload mode Leon Romanovsky
2022-11-17 11:59 ` Steffen Klassert
2022-11-17 12:32 ` Leon Romanovsky
2022-11-18 10:23 ` Steffen Klassert
2022-11-21 11:10 ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 5/8] xfrm: add RX datapath protection " Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 6/8] xfrm: speed-up lookup of HW policies Leon Romanovsky
2022-11-17 12:12 ` Steffen Klassert
2022-11-17 12:51 ` Leon Romanovsky
2022-11-18 10:49 ` Steffen Klassert
2022-11-20 19:17 ` Leon Romanovsky
2022-11-21 9:44 ` Steffen Klassert
2022-11-21 10:27 ` Leon Romanovsky
2022-11-21 11:09 ` Steffen Klassert
2022-11-21 11:15 ` Leon Romanovsky
2022-11-21 11:25 ` Steffen Klassert
2022-11-21 11:34 ` Leon Romanovsky
2022-11-21 12:02 ` Leon Romanovsky
2022-11-21 12:43 ` Steffen Klassert
2022-11-21 13:01 ` Leon Romanovsky [this message]
2022-11-22 13:10 ` Steffen Klassert
2022-11-22 13:57 ` Leon Romanovsky
2022-11-23 8:37 ` Steffen Klassert
2022-11-23 9:36 ` Leon Romanovsky
2022-11-23 12:53 ` Leon Romanovsky
2022-11-24 11:07 ` Steffen Klassert
2022-11-25 6:23 ` Leon Romanovsky
2022-11-21 12:10 ` Steffen Klassert
2022-11-21 13:21 ` Leon Romanovsky
2022-11-22 4:29 ` Herbert Xu
2022-11-22 6:27 ` Leon Romanovsky
2022-11-22 13:00 ` Steffen Klassert
2022-11-22 13:54 ` Leon Romanovsky
2022-11-23 8:23 ` Steffen Klassert
2022-11-23 10:25 ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 7/8] xfrm: add support to HW update soft and hard limits Leon Romanovsky
2022-11-17 12:13 ` Steffen Klassert
2022-11-17 12:32 ` Leon Romanovsky
2022-11-09 12:54 ` [PATCH xfrm-next v7 8/8] xfrm: document IPsec packet offload mode Leon Romanovsky
2022-11-17 12:15 ` Steffen Klassert
2022-11-17 12:33 ` Leon Romanovsky
2022-11-15 18:09 ` [PATCH xfrm-next v7 0/8] Extend XFRM core to allow packet offload configuration Leon Romanovsky
2022-11-15 18:30 ` Steffen Klassert
2022-11-15 19:00 ` Leon Romanovsky
2022-11-16 23:07 ` Saeed Mahameed
2022-11-17 12:20 ` Steffen Klassert
2022-11-17 12:24 ` Leon Romanovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y3t2tsHDpxjnBAb/@unreal \
--to=leon@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).