netdev - Re: ESP RSS support for NVIDIA Mellanox ConnectX-6 Ethernet Adapter Cards

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 30 Mar 2021 14:29:09 +0800
From:   高钧浩 <gaojunhao0504@...il.com>
To:     Saeed Mahameed <saeed@...nel.org>
Cc:     borisp@...dia.com, netdev@...r.kernel.org, seven.wen@...oud.cn,
        junhao.gao@...oud.cn
Subject: Re: ESP RSS support for NVIDIA Mellanox ConnectX-6 Ethernet Adapter Cards

Saeed Mahameed <saeed@...nel.org> 于2021年3月30日周二 上午4:56写道：
>
> On Mon, 2021-03-29 at 12:33 +0800, 高钧浩 wrote:
> > Hi borisp, saeedm
> >
> >      I have seen mlx5 driver in 5.12.0-rc4 kernel, then find that
> > mlx5e_set_rss_hash_opt only support tcp4/udp4/tcp6/udp6. So mlx5
> > kernel driver doesn't support esp4 rss? Then do you have any plan to
> > support esp4 or other latest mlx5 driver have supported esp4? Then
> > does NVIDIA Mellanox ConnectX-6 Ethernet Adapter Cards support esp4
> > rss in hardware?
> >
>
> Hi Juhano
>
> we do support RSS ESP out of the box on the SPI, src and dst IP fields
>
Hi Saeed

we verified RSS ESP and it is hashed by the SPI, src and dst IP field.
Then in our test, we run ipsec offload in tunnel mode using ESP
protocol, when packets arrive CX-6, the content in packets is
plaintext, and there exist many TCP/UDP flows in one tunnel, so could
we do RSS based on inner src/dst IP field and port etc?
> #define MLX5_HASH_IP_IPSEC_SPI  (MLX5_HASH_FIELD_SEL_SRC_IP   |\
>                                  MLX5_HASH_FIELD_SEL_DST_IP   |\
>                                  MLX5_HASH_FIELD_SEL_IPSEC_SPI)
>
> [MLX5E_TT_IPV4_IPSEC_ESP] = { .l3_prot_type = MLX5_L3_PROT_TYPE_IPV4,
>                               .l4_prot_type = 0,
>                               .rx_hash_fields =
> MLX5_HASH_IP_IPSEC_SPI,
> },
>
> [MLX5E_TT_IPV6_IPSEC_ESP] = { .l3_prot_type = MLX5_L3_PROT_TYPE_IPV6,
>                               .l4_prot_type = 0,
>                               .rx_hash_fields =
> MLX5_HASH_IP_IPSEC_SPI,
> },
>
> But we don't allow rss_hash_opt at the moment.
>
> what exactly are you looking for ?
>
> > static int mlx5e_set_rss_hash_opt(struct mlx5e_priv *priv,
> >                  struct ethtool_rxnfc *nfc)
> > {
> >     int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
> >     enum mlx5e_traffic_types tt;
> >     u8 rx_hash_field = 0;
> >     void *in;
> >     tt = flow_type_to_traffic_type(nfc->flow_type);
> >     if (tt == MLX5E_NUM_INDIR_TIRS)
> >         return -EINVAL;
> >     /* RSS does not support anything other than hashing to queues
> >      * on src IP, dest IP, TCP/UDP src port and TCP/UDP dest
> >      * port.
> >      */
> >     if (nfc->flow_type != TCP_V4_FLOW &&
> >       nfc->flow_type != TCP_V6_FLOW &&
> >       nfc->flow_type != UDP_V4_FLOW &&
> >       nfc->flow_type != UDP_V6_FLOW)
> >         return -EOPNOTSUPP;
> >
> > Best Regards,
> > Junhao
>
>