netdev - Re: Severe performance regression in "net: macsec: preserve ingress frame ordering"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 Aug 2020 14:42:01 +0200
From:   Andrew Lunn <andrew@...n.ch>
To:     "Van Leeuwen, Pascal" <pvanleeuwen@...bus.com>
Cc:     Sabrina Dubroca <sd@...asysnail.net>,
        Scott Dial <scott@...ttdial.com>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        Ryan Cox <ryan_cox@....edu>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        Antoine Tenart <antoine.tenart@...tlin.com>,
        "ebiggers@...gle.com" <ebiggers@...gle.com>
Subject: Re: Severe performance regression in "net: macsec: preserve ingress
 frame ordering"

> With networking protocols you often also have a requirement to minimize
> packet reordering, so I understand it's a careful balance. But it is possible
> to serialize the important stuff and still do the crypto out-of-order, which
> would be really beneficial on _some_ platforms (which have HW crypto
> acceleration but no such CPU extensions) at least.

Many Ethernet PHYs are also capable of doing MACSeC as they
send/receive frames. Doing it in hardware in the PHY avoids all these
out-of-order and latency issues. Unfortunately, we are still at the
early days for PHY drivers actually implementing MACSeC offload. At
the moment only the Microsemi PHY and Aquantia PHY via firmware in the
Atlantic NIC support this.

	 Andrew