[PATCH v2 net-next] tcp: improve inet6_ehashfn() entropy

[PATCH v2 net-next] tcp: improve inet6_ehashfn() entropy

[Eric Dumazet]

Instead of only using the 32 low order bits of the local address,
use all of them.

Xor net_hash_mix(net) with the 32 high order bits of the local address
so that we can use __jhash_mix() three times.

If we were hashing 4 extra bytes, we would need one __jhash_final()
which is a bit expensive.

Using net_hash_mix() at the beginning allows beter register allocation.

We no longer use a cascade of two jhash and inet6_ehash_secret,
this was dubious/weak.

Add a comment explaining why @lport is not part of the jhash computation.

$ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1
add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-24 (-24)
Function                                     old     new   delta
inet6_ehashfn                                330     306     -24
Total: Before=24855958, After=24855934, chg -0.00%

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
v2: do not include @lport in the jhash computation.
    Add a comment explaining why we need @lport being added.

 net/ipv6/inet6_hashtables.c | 40 ++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 72bc68fef48abc2c423c688b47154256828555e4..109fbf620ad7cde54300b937db58ada0d5c80664 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -35,13 +35,43 @@ u32 inet6_ehashfn(const struct net *net,
 		  const struct in6_addr *laddr, const u16 lport,
 		  const struct in6_addr *faddr, const __be16 fport)
 {
-	u32 lhash, fhash;
+	u32 a, b, c;
+
+	/*
+	 * Please look at jhash() implementation for reference.
+	 * Hash laddr + faddr + lport/fport + net_hash_mix.
+	 * Notes:
+	 * We combine laddr[0] (high order 32 bits of local address)
+	 * with net_hash_mix() to avoid using __jhash_final(a, b, c).
+	 *
+	 * We do not include JHASH_INITVAL + 36 contribution
+	 * to initial values of a, b, c.
+	 */
+
+	a = b = c = tcp_ipv6_hash_secret;
+
+	a += (__force u32)laddr->s6_addr32[0] ^ net_hash_mix(net);
+	b += (__force u32)laddr->s6_addr32[1];
+	c += (__force u32)laddr->s6_addr32[2];
+	__jhash_mix(a, b, c);
 
-	lhash = (__force u32)laddr->s6_addr32[3];
-	fhash = __ipv6_addr_jhash(faddr, tcp_ipv6_hash_secret);
+	a += (__force u32)laddr->s6_addr32[3];
+	b += (__force u32)faddr->s6_addr32[0];
+	c += (__force u32)faddr->s6_addr32[1];
+	__jhash_mix(a, b, c);
 
-	return lport + __inet6_ehashfn(lhash, 0, fhash, fport,
-				       inet6_ehash_secret + net_hash_mix(net));
+	a += (__force u32)faddr->s6_addr32[2];
+	b += (__force u32)faddr->s6_addr32[3];
+	c += (__force u32)fport;
+	__jhash_mix(a, b, c);
+
+	/* Note: We need to add @lport instead of fully hashing it.
+	 * See commits 9544d60a2605 ("inet: change lport contribution
+	 * to inet_ehashfn() and inet6_ehashfn()") and d4438ce68bf1
+	 * ("inet: call inet6_ehashfn() once from inet6_hash_connect()")
+	 * for references.
+	 */
+	return lport + c;
 }
 EXPORT_SYMBOL_GPL(inet6_ehashfn);
 
-- 
2.53.0.880.g73c4285caa-goog

Re: [PATCH v2 net-next] tcp: improve inet6_ehashfn() entropy

[Simon Horman]

On Fri, Mar 13, 2026 at 12:03:46PM +0000, Eric Dumazet wrote:
> Instead of only using the 32 low order bits of the local address,
> use all of them.
> 
> Xor net_hash_mix(net) with the 32 high order bits of the local address
> so that we can use __jhash_mix() three times.
> 
> If we were hashing 4 extra bytes, we would need one __jhash_final()
> which is a bit expensive.
> 
> Using net_hash_mix() at the beginning allows beter register allocation.
> 
> We no longer use a cascade of two jhash and inet6_ehash_secret,
> this was dubious/weak.
> 
> Add a comment explaining why @lport is not part of the jhash computation.
> 
> $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1
> add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-24 (-24)
> Function                                     old     new   delta
> inet6_ehashfn                                330     306     -24
> Total: Before=24855958, After=24855934, chg -0.00%
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> v2: do not include @lport in the jhash computation.
>     Add a comment explaining why we need @lport being added.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH v2 net-next] tcp: improve inet6_ehashfn() entropy

[Kuniyuki Iwashima]

On Fri, Mar 13, 2026 at 5:03 AM Eric Dumazet <edumazet@google.com> wrote:
>
> Instead of only using the 32 low order bits of the local address,
> use all of them.
>
> Xor net_hash_mix(net) with the 32 high order bits of the local address
> so that we can use __jhash_mix() three times.
>
> If we were hashing 4 extra bytes, we would need one __jhash_final()
> which is a bit expensive.
>
> Using net_hash_mix() at the beginning allows beter register allocation.
>
> We no longer use a cascade of two jhash and inet6_ehash_secret,
> this was dubious/weak.
>
> Add a comment explaining why @lport is not part of the jhash computation.
>
> $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1
> add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-24 (-24)
> Function                                     old     new   delta
> inet6_ehashfn                                330     306     -24
> Total: Before=24855958, After=24855934, chg -0.00%
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH v2 net-next] tcp: improve inet6_ehashfn() entropy

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 13 Mar 2026 12:03:46 +0000 you wrote:
> Instead of only using the 32 low order bits of the local address,
> use all of them.
> 
> Xor net_hash_mix(net) with the 32 high order bits of the local address
> so that we can use __jhash_mix() three times.
> 
> If we were hashing 4 extra bytes, we would need one __jhash_final()
> which is a bit expensive.
> 
> [...]

Here is the summary with links:
  - [v2,net-next] tcp: improve inet6_ehashfn() entropy
    https://git.kernel.org/netdev/net-next/c/854587e69ef3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html