mbox series

[GIT,PULL] Improve IPsec limits, ESN and replay window

Message ID 20230403064154.12443-1-leon@kernel.org (mailing list archive)
State Superseded
Delegated to: Netdev Maintainers
Headers show
Series [GIT,PULL] Improve IPsec limits, ESN and replay window | expand

Pull-request

https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux.git/ tags/ipsec-esn-replay

Checks

Context Check Description
netdev/tree_selection success Pull request for net
netdev/build_32bit success Errors and warnings before: 259 this patch: 259
netdev/build_clang success Errors and warnings before: 22 this patch: 22
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 247 this patch: 247

Message

Leon Romanovsky April 3, 2023, 6:41 a.m. UTC 
This series overcomes existing hardware limitations in Mellanox ConnectX
devices around handling IPsec soft and hard limits.

In addition, the ESN logic is tied and added an interface to configure
replay window sequence numbers through existing iproute2 interface.

  ip xfrm state ... [ replay-seq SEQ ] [ replay-oseq SEQ ]
                    [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]

Link: https://lore.kernel.org/all/cover.1680162300.git.leonro@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>

----------------------------------------------------------------

The following changes since commit 5a6cddb89b51d99a7702e63829644a5860dd9c41:

  net/mlx5e: Update IPsec per SA packets/bytes count (2023-03-20 11:29:52 +0200)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux.git/ tags/ipsec-esn-replay

for you to fetch changes up to 9f758558e309d11ef31dbdabdb1e3aa1003aebf9:

  net/mlx5e: Simulate missing IPsec TX limits hardware functionality (2023-04-03 09:29:47 +0300)

----------------------------------------------------------------
Leon Romanovsky (10):
      net/mlx5e: Factor out IPsec ASO update function
      net/mlx5e: Prevent zero IPsec soft/hard limits
      net/mlx5e: Add SW implementation to support IPsec 64 bit soft and hard limits
      net/mlx5e: Overcome slow response for first IPsec ASO WQE
      xfrm: don't require advance ESN callback for packet offload
      net/mlx5e: Remove ESN callbacks if it is not supported
      net/mlx5e: Set IPsec replay sequence numbers
      net/mlx5e: Reduce contention in IPsec workqueue
      net/mlx5e: Generalize IPsec work structs
      net/mlx5e: Simulate missing IPsec TX limits hardware functionality

 .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c   | 329 ++++++++++++++++++---
 .../ethernet/mellanox/mlx5/core/en_accel/ipsec.h   |  47 ++-
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c         |  31 +-
 .../mellanox/mlx5/core/en_accel/ipsec_offload.c    | 198 ++++++++++---
 net/xfrm/xfrm_device.c                             |   2 +-
 5 files changed, 496 insertions(+), 111 deletions(-)

Comments

Leon Romanovsky April 4, 2023, 4:30 p.m. UTC | #1 
On Mon, Apr 03, 2023 at 09:41:54AM +0300, Leon Romanovsky wrote:
> This series overcomes existing hardware limitations in Mellanox ConnectX
> devices around handling IPsec soft and hard limits.
> 
> In addition, the ESN logic is tied and added an interface to configure
> replay window sequence numbers through existing iproute2 interface.
> 
>   ip xfrm state ... [ replay-seq SEQ ] [ replay-oseq SEQ ]
>                     [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ]
> 
> Link: https://lore.kernel.org/all/cover.1680162300.git.leonro@nvidia.com
> Signed-off-by: Leon Romanovsky <leon@kernel.org>
> 
> ----------------------------------------------------------------
> 
> The following changes since commit 5a6cddb89b51d99a7702e63829644a5860dd9c41:
> 
>   net/mlx5e: Update IPsec per SA packets/bytes count (2023-03-20 11:29:52 +0200)
> 
> are available in the Git repository at:
> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux.git/ tags/ipsec-esn-replay
> 
> for you to fetch changes up to 9f758558e309d11ef31dbdabdb1e3aa1003aebf9:
> 
>   net/mlx5e: Simulate missing IPsec TX limits hardware functionality (2023-04-03 09:29:47 +0300)
> 
> ----------------------------------------------------------------
> Leon Romanovsky (10):
>       net/mlx5e: Factor out IPsec ASO update function
>       net/mlx5e: Prevent zero IPsec soft/hard limits
>       net/mlx5e: Add SW implementation to support IPsec 64 bit soft and hard limits
>       net/mlx5e: Overcome slow response for first IPsec ASO WQE
>       xfrm: don't require advance ESN callback for packet offload

Hi Steffen,

Can you please provide your Acked-by for this patch?
https://lore.kernel.org/all/9f3dfc3fef2cfcd191f0c5eee7cf0aa74e7f7786.1680162300.git.leonro@nvidia.com

Thanks


>       net/mlx5e: Remove ESN callbacks if it is not supported
>       net/mlx5e: Set IPsec replay sequence numbers
>       net/mlx5e: Reduce contention in IPsec workqueue
>       net/mlx5e: Generalize IPsec work structs
>       net/mlx5e: Simulate missing IPsec TX limits hardware functionality
> 
>  .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c   | 329 ++++++++++++++++++---
>  .../ethernet/mellanox/mlx5/core/en_accel/ipsec.h   |  47 ++-
>  .../mellanox/mlx5/core/en_accel/ipsec_fs.c         |  31 +-
>  .../mellanox/mlx5/core/en_accel/ipsec_offload.c    | 198 ++++++++++---
>  net/xfrm/xfrm_device.c                             |   2 +-
>  5 files changed, 496 insertions(+), 111 deletions(-)