linux-kernel - [PATCH] ixgbe: Restore crypto offload for tunnel mode where possile

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 29 Nov 2021 13:09:58 +0000
From:   anton.ivanov@...bridgegreys.com
To:     jesse.brandeburg@...el.com, anthony.l.nguyen@...el.com,
        linux-kernel@...r.kernel.org
Cc:     Anton Ivanov <anton.ivanov@...bridgegreys.com>
Subject: [PATCH] ixgbe: Restore crypto offload for tunnel mode where possile

From: Anton Ivanov <anton.ivanov@...bridgegreys.com>

Commit d785e1fec60179f534fbe8d006c890e5ad186e51 disabled IPSEC
in tunnel mode as not working.

It actually works correctly for TX if (and only if) TSO is disabled on the
interace. Hence, the offload in tunnel mode needs to be disabled only for RX.

CPU usage for TX side softirq thread without the patch ~ 88%. With the
patch < 20%. Tested using iperf. If the RX side is Linux with ixgbe
there is no difference in throughput, because the bottleneck is at
the RX end where the softirq thread is at 100%. If, however, the RX side is
capable of line rate, I would expect this patch to allow Linux to reach
line rate for TX.

Fixes: d785e1fec60179f534fbe8d006c890e5ad186e51 ixgbe: fail to create xfrm offload of IPsec tunnel mode SA

Signed-off-by: Anton Ivanov <anton.ivanov@...bridgegreys.com>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 15 ++++++++++-----
 drivers/net/ethernet/intel/ixgbevf/ipsec.c     | 15 ++++++++++-----
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index e596e1a9fc75..98bd9d91d451 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -575,11 +575,6 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
 		return -EINVAL;
 	}
 
-	if (xs->props.mode != XFRM_MODE_TRANSPORT) {
-		netdev_err(dev, "Unsupported mode for ipsec offload\n");
-		return -EINVAL;
-	}
-
 	if (ixgbe_ipsec_check_mgmt_ip(xs)) {
 		netdev_err(dev, "IPsec IP addr clash with mgmt filters\n");
 		return -EINVAL;
@@ -588,6 +583,11 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
 	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
 		struct rx_sa rsa;
 
+		if (xs->props.mode != XFRM_MODE_TRANSPORT) {
+			netdev_err(dev, "IPsec inbound offload supported only for transport mode\n");
+			return -EINVAL;
+		}
+
 		if (xs->calg) {
 			netdev_err(dev, "Compression offload not supported\n");
 			return -EINVAL;
@@ -699,6 +699,11 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
 	} else {
 		struct tx_sa tsa;
 
+		if (xs->props.mode != XFRM_MODE_TRANSPORT && (dev->features & NETIF_F_TSO)) {
+			netdev_err(dev, "Cannot support tunnel mode IPsec offload and TSO simultaneously\n");
+			return -EINVAL;
+		}
+
 		if (adapter->num_vfs &&
 		    adapter->bridge_mode != BRIDGE_MODE_VEPA)
 			return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
index e3e4676af9e4..ba15f0477649 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
@@ -275,14 +275,14 @@ static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs)
 		return -EINVAL;
 	}
 
-	if (xs->props.mode != XFRM_MODE_TRANSPORT) {
-		netdev_err(dev, "Unsupported mode for ipsec offload\n");
-		return -EINVAL;
-	}
-
 	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
 		struct rx_sa rsa;
 
+		if (xs->props.mode != XFRM_MODE_TRANSPORT) {
+			netdev_err(dev, "IPsec inbound offload supported only for transport mode\n");
+			return -EINVAL;
+		}
+
 		if (xs->calg) {
 			netdev_err(dev, "Compression offload not supported\n");
 			return -EINVAL;
@@ -342,6 +342,11 @@ static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs)
 	} else {
 		struct tx_sa tsa;
 
+		if (xs->props.mode != XFRM_MODE_TRANSPORT && (dev->features & NETIF_F_TSO)) {
+			netdev_err(dev, "Cannot support tunnel mode IPsec offload and TSO simultaneously\n");
+			return -EINVAL;
+		}
+
 		/* find the first unused index */
 		ret = ixgbevf_ipsec_find_empty_idx(ipsec, false);
 		if (ret < 0) {
-- 
2.30.2