netdev - ipsec tunnel performance degrade

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Apr 2019 14:29:24 +0000
From:   Vakul Garg <vakul.garg@....com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: ipsec tunnel performance degrade

Hi

Post kernel 4.9, I am experiencing more than 50% degrade in ipsec performance on my arm64 based systems (with onchip crypto accelerator).
(We use only lts kernels). My understanding is that it is mainly due to xfrm flow cache removal in version 4.12.

I am not sure whether any subsequent work could recover the lost performance.
With kernel 4.19, I see that xfrm_state_find() is taking a lot of cpu (more than 15%).
Further, perf show that a lot of atomic primitives such as __ll_sc___cmpxchg_case_mb_4(), 
__ll_sc_atomic_sub_return() are being invoked. On 16 core system, they consume more than 30% of cpu.

These are getting called mainly from xfrm_lookup_with_ifid().

Can someone please help?

Regards

Vakul