From: Leon Romanovsky <leon@kernel.org>
To: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
netdev@vger.kernel.org, Saeed Mahameed <saeedm@nvidia.com>,
Raed Salem <raeds@nvidia.com>
Subject: [GIT PULL v1] Improve IPsec limits, ESN and replay window
Date: Thu, 6 Apr 2023 10:19:02 +0300 [thread overview]
Message-ID: <20230406071902.712388-1-leon@kernel.org> (raw)
This series overcomes existing hardware limitations in Mellanox ConnectX
devices around handling IPsec soft and hard limits.
In addition, the ESN logic is tied and added an interface to configure
replay window sequence numbers through existing iproute2 interface.
ip xfrm state ... [ replay-seq SEQ ] [ replay-oseq SEQ ]
[ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]
Link: https://lore.kernel.org/all/cover.1680162300.git.leonro@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
----------------------------------------------------------------
Changelog:
v1:
* Added Steffen's Acked-by to XFRM patch
https://lore.kernel.org/all/ZC1Prk8HqIcpedcm@gauss3.secunet.de
* Fixed memory leak in "net/mlx5e: Generalize IPsec work structs" patch
https://lore.kernel.org/all/285a1550242363de181bab3a07a69296f66ad9a8.1680162300.git.leonro@nvidia.com
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index 0916309cf296..9a4c4bc64155 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -707,6 +707,7 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x,
release_dwork:
kfree(sa_entry->dwork);
release_work:
+ kfree(sa_entry->work->data);
kfree(sa_entry->work);
err_xfrm:
kfree(sa_entry);
@@ -750,6 +751,7 @@ static void mlx5e_xfrm_free_state(struct xfrm_state *x)
mlx5e_accel_ipsec_fs_del_rule(sa_entry);
mlx5_ipsec_free_sa_ctx(sa_entry);
kfree(sa_entry->dwork);
+ kfree(sa_entry->work->data);
kfree(sa_entry->work);
sa_entry_free:
kfree(sa_entry);
v0: https://lore.kernel.org/all/20230403064154.12443-1-leon@kernel.org
----------------------------------------------------------------
The following changes since commit 5a6cddb89b51d99a7702e63829644a5860dd9c41:
net/mlx5e: Update IPsec per SA packets/bytes count (2023-03-20 11:29:52 +0200)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux.git/ tags/ipsec-esn-replay
for you to fetch changes up to b2f7b01d36a9b94fbd7489bd1228025ea7e7a2f4:
net/mlx5e: Simulate missing IPsec TX limits hardware functionality (2023-04-06 10:12:03 +0300)
----------------------------------------------------------------
Leon Romanovsky (10):
net/mlx5e: Factor out IPsec ASO update function
net/mlx5e: Prevent zero IPsec soft/hard limits
net/mlx5e: Add SW implementation to support IPsec 64 bit soft and hard limits
net/mlx5e: Overcome slow response for first IPsec ASO WQE
xfrm: don't require advance ESN callback for packet offload
net/mlx5e: Remove ESN callbacks if it is not supported
net/mlx5e: Set IPsec replay sequence numbers
net/mlx5e: Reduce contention in IPsec workqueue
net/mlx5e: Generalize IPsec work structs
net/mlx5e: Simulate missing IPsec TX limits hardware functionality
.../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 331 ++++++++++++++++++---
.../ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 47 ++-
.../mellanox/mlx5/core/en_accel/ipsec_fs.c | 31 +-
.../mellanox/mlx5/core/en_accel/ipsec_offload.c | 198 +++++++++---
net/xfrm/xfrm_device.c | 2 +-
5 files changed, 498 insertions(+), 111 deletions(-)
next reply other threads:[~2023-04-06 7:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-06 7:19 Leon Romanovsky [this message]
2023-04-07 19:01 ` [GIT PULL v1] Improve IPsec limits, ESN and replay window Leon Romanovsky
2023-04-08 3:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230406071902.712388-1-leon@kernel.org \
--to=leon@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=raeds@nvidia.com \
--cc=saeedm@nvidia.com \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).