[PATCH net-next] tcp: improve inet6_ehashfn() entropy

[PATCH net-next] tcp: improve inet6_ehashfn() entropy

[Eric Dumazet]

Instead of only using the 32 low order bits of the local address,
use all of them.

Xor net_hash_mix(net) with the 32 high order bits of the local address
so that we can use __jhash_mix() three times.

If we were hashing 4 extra bytes, we would need one __jhash_final()
which is a bit expensive.

Using net_hash_mix() at the beginning allows beter register allocation.

We no longer use a cascade of two jhash and inet6_ehash_secret,
this was dubious/weak.

$ scripts/bloat-o-meter -t vmlinux.0 vmlinux
add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-27 (-27)
Function                                     old     new   delta
inet6_ehashfn                                330     303     -27
Total: Before=24855320, After=24855293, chg -0.00%

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/inet6_hashtables.c | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 72bc68fef48abc2c423c688b47154256828555e4..bf3c9bbb2107c05f18ca296cfb7a54d2d0ed558a 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -35,13 +35,37 @@ u32 inet6_ehashfn(const struct net *net,
 		  const struct in6_addr *laddr, const u16 lport,
 		  const struct in6_addr *faddr, const __be16 fport)
 {
-	u32 lhash, fhash;
+	u32 a, b, c;
+
+	/*
+	 * Please look at jhash() implementation for reference.
+	 * Hash laddr + faddr + lport/fport + net_hash_mix.
+	 * Notes:
+	 * We combine laddr[0] (high order 32 bits of local address)
+	 * with net_hash_mix() to avoid using __jhash_final(a, b, c).
+	 *
+	 * We do not include JHASH_INITVAL + 36 contribution
+	 * to initial values of a, b, c.
+	 */
+
+	a = b = c = tcp_ipv6_hash_secret;
+
+	a += (__force u32)laddr->s6_addr32[0] ^ net_hash_mix(net);
+	b += (__force u32)laddr->s6_addr32[1];
+	c += (__force u32)laddr->s6_addr32[2];
+	__jhash_mix(a, b, c);
+
+	a += (__force u32)laddr->s6_addr32[3];
+	b += (__force u32)faddr->s6_addr32[0];
+	c += (__force u32)faddr->s6_addr32[1];
+	__jhash_mix(a, b, c);
 
-	lhash = (__force u32)laddr->s6_addr32[3];
-	fhash = __ipv6_addr_jhash(faddr, tcp_ipv6_hash_secret);
+	a += (__force u32)faddr->s6_addr32[2];
+	b += (__force u32)faddr->s6_addr32[3];
+	c += ((u32)lport << 16) + (__force u32)fport;
+	__jhash_mix(a, b, c);
 
-	return lport + __inet6_ehashfn(lhash, 0, fhash, fport,
-				       inet6_ehash_secret + net_hash_mix(net));
+	return c;
 }
 EXPORT_SYMBOL_GPL(inet6_ehashfn);
 
-- 
2.53.0.473.g4a7958ca14-goog

Re: [PATCH net-next] tcp: improve inet6_ehashfn() entropy

[Eric Dumazet]

On Thu, Mar 12, 2026 at 12:24 PM Eric Dumazet <edumazet@google.com> wrote:
>
> Instead of only using the 32 low order bits of the local address,
> use all of them.
>
> Xor net_hash_mix(net) with the 32 high order bits of the local address
> so that we can use __jhash_mix() three times.
>
> If we were hashing 4 extra bytes, we would need one __jhash_final()
> which is a bit expensive.
>
> Using net_hash_mix() at the beginning allows beter register allocation.
>
> We no longer use a cascade of two jhash and inet6_ehash_secret,
> this was dubious/weak.
>
> $ scripts/bloat-o-meter -t vmlinux.0 vmlinux
> add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-27 (-27)
> Function                                     old     new   delta
> inet6_ehashfn                                330     303     -27
> Total: Before=24855320, After=24855293, chg -0.00%
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---

I will send a V2, it seems I completely forgot this prior patch.

commit 9544d60a2605d1500cf5c3e331a76b9eaf4538c9
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Mar 5 03:45:49 2025 +0000

    inet: change lport contribution to inet_ehashfn() and inet6_ehashfn()

    In order to speedup __inet_hash_connect(), we want to ensure hash values
    for <source address, port X, destination address, destination port>
    are not randomly spread, but monotonically increasing.

    Goal is to allow __inet_hash_connect() to derive the hash value
    of a candidate 4-tuple with a single addition in the following
    patch in the series.

    Given :
      hash_0 = inet_ehashfn(saddr, 0, daddr, dport)
      hash_sport = inet_ehashfn(saddr, sport, daddr, dport)

    Then (hash_sport == hash_0 + sport) for all sport values.