From patchwork Tue Dec 5 05:35:06 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shannon Nelson X-Patchwork-Id: 844550 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=osuosl.org (client-ip=140.211.166.136; helo=silver.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=oracle.com header.i=@oracle.com header.b="ujjR0Ail"; dkim-atps=neutral Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3yrVp20vSZz9sCZ for ; Tue, 5 Dec 2017 16:35:37 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 2487830599; Tue, 5 Dec 2017 05:35:35 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TItF7EaDw7xd; Tue, 5 Dec 2017 05:35:34 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by silver.osuosl.org (Postfix) with ESMTP id 7ABCC3044E; Tue, 5 Dec 2017 05:35:33 +0000 (UTC) X-Original-To: intel-wired-lan@lists.osuosl.org Delivered-To: intel-wired-lan@lists.osuosl.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ash.osuosl.org (Postfix) with ESMTP id BD7CC1CEFB5 for ; Tue, 5 Dec 2017 05:35:28 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id AD72187F60 for ; Tue, 5 Dec 2017 05:35:28 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cdY40verICFh for ; Tue, 5 Dec 2017 05:35:27 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 854C387F56 for ; Tue, 5 Dec 2017 05:35:27 +0000 (UTC) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.21/8.16.0.21) with SMTP id vB55XJrX183996; Tue, 5 Dec 2017 05:35:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id; s=corp-2017-10-26; bh=dZKE5Pvmp/nbS7a6z2ADUjHZzzqkyKmn9qACh9NWZwI=; b=ujjR0AilFM5TzcpKfj3Hkwc07FRhov3ozE26hpS6GojQZVtRDcPXKu/0ufKKmVWo5wY7 cc1+CPsbU5Ki6ayAO7XuFhA3m5tL7RECTHIUbejP3odz0JDU/sHwINErcBIkrNGnDP9L vZBy7OUCKt22a0B4oLcs3E/FhLrOcf135jvoL5PvG/TGlAx/6AjhXqpNu6qzrSCOAFyW L9273LK2i5qCI5ftuvcPfXpa93aM6yNr5iEACU565CUQ90mJrR+fvYmo5EkxulnBYAS/ Dj6DRGWaEY7KDitO2MT/tvocLHLzEcizC4Pfk0NyZafyG6TpqfDWarHJMgxD2d+YjVra QA== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp2130.oracle.com with ESMTP id 2ekpeynjc1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 05 Dec 2017 05:35:25 +0000 Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id vB55ZOrH022020 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 5 Dec 2017 05:35:24 GMT Received: from abhmp0009.oracle.com (abhmp0009.oracle.com [141.146.116.15]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id vB55ZMd0011287; Tue, 5 Dec 2017 05:35:23 GMT Received: from slnelson-mint18.us.oracle.com (/10.159.249.147) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 04 Dec 2017 21:35:22 -0800 From: Shannon Nelson To: intel-wired-lan@lists.osuosl.org, jeffrey.t.kirsher@intel.com Date: Mon, 4 Dec 2017 21:35:06 -0800 Message-Id: <1512452116-14795-1-git-send-email-shannon.nelson@oracle.com> X-Mailer: git-send-email 2.7.4 X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8735 signatures=668637 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1712050083 Subject: [Intel-wired-lan] [next-queue 00/10] ixgbe: Add ipsec offload X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.24 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: steffen.klassert@secunet.com, sowmini.varadhan@oracle.com, netdev@vger.kernel.org MIME-Version: 1.0 Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" This is an implementation of the ipsec hardware offload feature for the ixgbe driver and Intel's 10Gbe series NICs: x540, x550, 82599. These patches apply to net-next v4.14 as well as Jeff Kirsher's next-queue v4.15-rc1-206-ge47375b. The ixgbe NICs support ipsec offload for 1024 Rx and 1024 Tx Security Associations (SAs), using up to 128 inbound IP addresses, and using the rfc4106(gcm(aes)) encryption. This code does not yet support IPv6, checksum offload, or TSO in conjunction with the ipsec offload - those will be added in the future. This code shows improvements in both packet throughput and CPU utilization. For example, here are some quicky numbers that show the magnitude of the performance gain on a single run of "iperf -c " with the ipsec offload on both ends of a point-to-point connection: 9.4 Gbps - normal case 7.6 Gbps - ipsec with offload 343 Mbps - ipsec no offload To set up a similar test case, you first need to be sure you have a recent version of iproute2 that supports the ipsec offload tag, probably something from ip 4.12 or newer would be best. I have a shell script that builds up the appropriate commands for me, but here are the resulting commands for all tcp traffic between 14.0.0.52 and 14.0.0.70: For the left side (14.0.0.52): ip x p add dir out src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp tmpl \ proto esp src 14.0.0.52 dst 14.0.0.70 spi 0x07 mode transport reqid 0x07 ip x p add dir in src 14.0.0.70/24 dst 14.0.0.52/24 proto tcp tmpl \ proto esp dst 14.0.0.52 src 14.0.0.70 spi 0x07 mode transport reqid 0x07 ip x s add proto esp src 14.0.0.52 dst 14.0.0.70 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp offload dev eth4 dir out ip x s add proto esp dst 14.0.0.52 src 14.0.0.70 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.70/24 dst 14.0.0.52/24 proto tcp offload dev eth4 dir in For the right side (14.0.0.70): ip x p add dir out src 14.0.0.70/24 dst 14.0.0.52/24 proto tcp tmpl \ proto esp src 14.0.0.70 dst 14.0.0.52 spi 0x07 mode transport reqid 0x07 ip x p add dir in src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp tmpl \ proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport reqid 0x07 ip x s add proto esp src 14.0.0.70 dst 14.0.0.52 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.70/24 dst 14.0.0.52/24 proto tcp offload dev eth4 dir out ip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp offload dev eth4 dir in In both cases, the command "ip x s flush ; ip x p flush" will clean it all out and remove the offloads. Lastly, thanks to Alex Duyck for his early comments. Shannon Nelson (10): ixgbe: clean up ipsec defines ixgbe: add ipsec register access routines ixgbe: add ipsec engine start and stop routines ixgbe: add ipsec data structures ixgbe: implement ipsec add and remove of offloaded SA ixgbe: restore offloaded SAs after a reset ixgbe: process the Rx ipsec offload ixgbe: process the Tx ipsec offload ixgbe: ipsec offload stats ixgbe: register ipsec offload with the xfrm subsystem drivers/net/ethernet/intel/ixgbe/Makefile | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe.h | 30 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 28 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 900 +++++++++++++++++++++++ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h | 90 +++ drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 53 +- drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 22 +- 8 files changed, 1090 insertions(+), 38 deletions(-) create mode 100644 drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c create mode 100644 drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h