All of lore.kernel.org
 help / color / mirror / Atom feed
* [RFC] [PATCH 0/5] Parallel IPsec v4
@ 2009-06-08  7:07 Steffen Klassert
  2009-06-08  7:08 ` [RFC] [PATCH 1/5] padata: generic interface for parallel processing Steffen Klassert
                   ` (4 more replies)
  0 siblings, 5 replies; 25+ messages in thread
From: Steffen Klassert @ 2009-06-08  7:07 UTC (permalink / raw)
  To: Herbert Xu; +Cc: David Miller, linux-crypto

This patchset adds the 'pcrypt' parallel crypto template. With this template it
is possible to process the crypto requests of a transform in parallel without
getting request reorder. This is in particular interesting for IPsec.

The parallel crypto template is based on a generic parallelization/serialization
method. This method uses the remote softirq invocation infrastructure for
parallelization and serialization. With this method data objects can be
processed in parallel, starting at some given point.
After doing some expensive operations in parallel, it is possible to serialize
again. The parallelized data objects return after serialization in the order as
they were before the parallelization. In the case of IPsec, this makes it
possible to run the expensive parts in parallel without getting packet
reordering.

Changes from v3:

- The generic aead wrapper is dropped.

- tcrypt is extended to test algorithms by name. So it is possible to
  instantiate pcrypt by doing e.g.:
  modprobe tcrypt alg="pcrypt(authenc(hmac(sha1),cbc(aes)))" type=3

Changes from v2:

- The xfrm netlink configuration code is dropped,
  this will be an extra patchset.

- Add generic aead wrapper interface to be able to wrap an aead algorithm
  with an arbitrary crypto template. 

- Convert pcrypt to use the generic aead wrapper.

- Add support for aead algorithms to eseqiv.

- Add support for the pcrypt aead wrapper to authenc. It's now possible to
  choose for pcrypt as the default authenc wrapper with a module parameter.

- Patchset applies to linux-2.6 git current.

Changes from v1:

- cpu_chainiv is dropped, pcrypt uses eseqiv as it's IV generator now.

- Add a xfrm netlink message to be able to choose for pcrypt from userspace.

- Use pcrypt just if it is selected from userspace.

- Patchset applies to 2.6.30-rc3

Steffen

^ permalink raw reply	[flat|nested] 25+ messages in thread
* [RFC] [PATCH 0/5] Parallel IPsec v3
@ 2009-05-13 13:06 Steffen Klassert
  2009-05-13 13:07 ` [RFC] [PATCH 1/5] padata: generic interface for parallel processing Steffen Klassert
  0 siblings, 1 reply; 25+ messages in thread
From: Steffen Klassert @ 2009-05-13 13:06 UTC (permalink / raw)
  To: Herbert Xu; +Cc: David Miller, linux-crypto

This patchset adds the 'pcrypt' parallel crypto template. With this template it
is possible to process the crypto requests of a transform in parallel without
getting request reorder. This is in particular interesting for IPsec.

The parallel crypto template is based on a generic parallelization/serialization
method. This method uses the remote softirq invocation infrastructure for
parallelization and serialization. With this method data objects can be
processed in parallel, starting at some given point.
After doing some expensive operations in parallel, it is possible to serialize
again. The parallelized data objects return after serialization in the order as
they were before the parallelization. In the case of IPsec, this makes it
possible to run the expensive parts in parallel without getting packet
reordering.

Changes from v2:

- The xfrm netlink configuration code is dropped,
  this will be an extra patchset.

- Add generic aead wrapper interface to be able to wrap an aead algorithm
  with an arbitrary crypto template. 

- Convert pcrypt to use the generic aead wrapper.

- Add support for aead algorithms to eseqiv.

- Add support for the pcrypt aead wrapper to authenc. It's now possible to
  choose for pcrypt as the default authenc wrapper with a module parameter.

- Patchset applies to linux-2.6 git current.

Changes from v1:

- cpu_chainiv is dropped, pcrypt uses eseqiv as it's IV generator now.

- Add a xfrm netlink message to be able to choose for pcrypt from userspace.

- Use pcrypt just if it is selected from userspace.

- Patchset applies to 2.6.30-rc3

Steffen

^ permalink raw reply	[flat|nested] 25+ messages in thread
* [RFC PATCH 0/5] IPsec parallelization
@ 2008-12-01  7:16 Steffen Klassert
  2008-12-01  7:17 ` [RFC PATCH 1/5] padata: generic interface for parallel processing Steffen Klassert
  0 siblings, 1 reply; 25+ messages in thread
From: Steffen Klassert @ 2008-12-01  7:16 UTC (permalink / raw)
  To: netdev; +Cc: davem, herbert, klassert

This is a first throw to try to parallelize the expensive part of xfrm by
using a generic parallelization/serialization method. This method uses the
remote softirq invocation infrastructure for parallelization and serialization.
With this method data objects can be processed in parallel, starting 
at some given point. After doing some expensive operations in parallel, 
it is possible to serialize again. The parallelized data objects return after
serialization in the order as they were before the parallelization. 
In the case of xfrm, this makes it possible to run the expensive part in
parallel without getting packet reordering.
 
To use this parallelization method for xfrm, some changes in the crypto system
were necessary. First of all, we need to force disabling async crypto transforms
in the parallelization case, because we can't guarantee the packet order if
the packets are put to a queue during the parallel processing.
A second thing was a very high contended lock in crypto_authenc_hash() if
the crypto system runs in parallel. To get rid of this, the struct aead is
moved to percpu data, what in turn means that we have percpu IV chains now.
However, I'm not that familiar with the crypto system. So I'm not sure whether
this is acceptable as I did it, this needs review.

I did forwarding tests with two quad core machines (Intel Core 2 Quad Q6600) 
used as IPsec routers (xfrm tunnel between the two quad core machines) and two
notebooks T61 used as traffic generators.
With this testing environment I'm geting a throughput up to 910 Mbit/s (ipv4)
and 880 Mbit/s (ipv6) with aes192-sha1 encryption (measured with iperf,
_one_ tcp stream). Without the parallelization I'm getting with the same
environment about 340 Mbit/s (ipv4) and 320 Mbit/s (ipv6).

If somebody wants to test it, the parallelization is switched off by default.
To enable it, do 'echo 1 > /proc/sys/net/core/xfrm_padata'.

Steffen

^ permalink raw reply	[flat|nested] 25+ messages in thread

end of thread, other threads:[~2009-06-29 11:09 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-06-08  7:07 [RFC] [PATCH 0/5] Parallel IPsec v4 Steffen Klassert
2009-06-08  7:08 ` [RFC] [PATCH 1/5] padata: generic interface for parallel processing Steffen Klassert
2009-06-08  7:10 ` [RFC] [PATCH 2/5] pcrypt: Add pcrypt crypto parallelization wrapper Steffen Klassert
2009-06-19 12:21   ` Herbert Xu
2009-06-23  6:21     ` Steffen Klassert
2009-06-19 12:29   ` Herbert Xu
2009-06-23  8:29     ` Steffen Klassert
2009-06-23  8:34       ` Herbert Xu
2009-06-23  9:14         ` Steffen Klassert
2009-06-23  9:18           ` Herbert Xu
2009-06-23 10:19             ` Steffen Klassert
2009-06-23 10:19               ` Herbert Xu
2009-06-08  7:10 ` [RFC] [PATCH 3/5] eseqiv: Add support for aead algorithms Steffen Klassert
2009-06-25 10:46   ` Herbert Xu
2009-06-29 11:12     ` Steffen Klassert
2009-06-08  7:11 ` [RFC] [PATCH 4/5] authenc: Check if the IV is already added to the scatterlist Steffen Klassert
2009-06-08  7:12 ` [RFC] [PATCH 5/5] tcrypt: Test algorithms by name Steffen Klassert
2009-06-19 10:53   ` Herbert Xu
2009-06-19 10:56     ` Herbert Xu
2009-06-19 11:40       ` [PATCH] " Steffen Klassert
2009-06-19 11:47         ` Herbert Xu
2009-06-19 12:38           ` Herbert Xu
2009-06-23  6:04             ` Steffen Klassert
  -- strict thread matches above, loose matches on Subject: below --
2009-05-13 13:06 [RFC] [PATCH 0/5] Parallel IPsec v3 Steffen Klassert
2009-05-13 13:07 ` [RFC] [PATCH 1/5] padata: generic interface for parallel processing Steffen Klassert
2008-12-01  7:16 [RFC PATCH 0/5] IPsec parallelization Steffen Klassert
2008-12-01  7:17 ` [RFC PATCH 1/5] padata: generic interface for parallel processing Steffen Klassert

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.