[v3,ipsec-next,0/4] Add support for RFC 9611 per cpu xfrm states.

Message

Steffen Klassert Oct. 23, 2024, 10:53 a.m. UTC

This patchset implements the xfrm part of per cpu SAs as specified in
RFC 9611.

Patch 1 adds the cpu as a lookup key and config option to to generate
acquire messages for each cpu.

Patch 2 caches outbound states at the policy.

Patch 3 caches inbound states on a new percpu state cache.

Patch 4 restricts percpu SA attributes to specific netlink message types.

Please review and test.

---

Changes from v2:

- Rebase to ipsec-next

- Describe new xfrm_policy struct member state_cache_list

- Drop a missplaced semicolon

Changes from v1:

- Add compat layer attributes

- Fix a 'use always slowpath' condition

- Document get_cpu() usage

- Fix forgotten update of xfrm_expire_msgsize()

Thanks!

Comments

Antony Antony Oct. 23, 2024, 2:32 p.m. UTC | #1

Hi Steffen,

On Wed, Oct 23, 2024 at 12:53:41 +0200, Steffen Klassert wrote:
> This patchset implements the xfrm part of per cpu SAs as specified in
> RFC 9611.
> 
> Patch 1 adds the cpu as a lookup key and config option to to generate
> acquire messages for each cpu.
> 
> Patch 2 caches outbound states at the policy.
> 
> Patch 3 caches inbound states on a new percpu state cache.
> 
> Patch 4 restricts percpu SA attributes to specific netlink message types.
> 
> Please review and test.

Tested-by: Antony Antony <[e-mail]>
 
Thanks,
-antony

Tobias Brunner Oct. 23, 2024, 3:49 p.m. UTC | #2

On 23.10.24 12:53, Steffen Klassert wrote:
> This patchset implements the xfrm part of per cpu SAs as specified in
> RFC 9611.
> 
> Patch 1 adds the cpu as a lookup key and config option to to generate
> acquire messages for each cpu.
> 
> Patch 2 caches outbound states at the policy.
> 
> Patch 3 caches inbound states on a new percpu state cache.
> 
> Patch 4 restricts percpu SA attributes to specific netlink message types.
> 
> Please review and test.

Tested-by: Tobias Brunner <[e-mail]>

Regards,
Tobias