From: Herbert Xu <herbert@gondor.apana.org.au>
To: Dmitry Safonov <dima@arista.com>
Cc: linux-kernel@vger.kernel.org, David Ahern <dsahern@kernel.org>,
Eric Dumazet <edumazet@google.com>,
Paolo Abeni <pabeni@redhat.com>, Jakub Kicinski <kuba@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
Andy Lutomirski <luto@amacapital.net>,
Ard Biesheuvel <ardb@kernel.org>,
Bob Gilligan <gilligan@arista.com>,
Dan Carpenter <error27@gmail.com>,
David Laight <David.Laight@aculab.com>,
Dmitry Safonov <0x7f454c46@gmail.com>,
Eric Biggers <ebiggers@kernel.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Francesco Ruggeri <fruggeri05@gmail.com>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
Ivan Delalande <colona@arista.com>,
Leonard Crestez <cdleonard@gmail.com>,
Salam Noureddine <noureddine@arista.com>,
netdev@vger.kernel.org
Subject: Re: [PATCH v6 01/21] net/tcp: Prepare tcp_md5sig_pool for TCP-AO
Date: Mon, 15 May 2023 12:48:46 +0800 [thread overview]
Message-ID: <ZGG5rtuHB4lvLyKI@gondor.apana.org.au> (raw)
In-Reply-To: <20230512202311.2845526-2-dima@arista.com>
On Fri, May 12, 2023 at 09:22:51PM +0100, Dmitry Safonov wrote:
> TCP-AO, similarly to TCP-MD5, needs to allocate tfms on a slow-path,
> which is setsockopt() and use crypto ahash requests on fast paths,
> which are RX/TX softirqs. Also, it needs a temporary/scratch buffer
> for preparing the hash.
>
> Rework tcp_md5sig_pool in order to support other hashing algorithms
> than MD5. It will make it possible to share pre-allocated crypto_ahash
> descriptors and scratch area between all TCP hash users.
>
> Internally tcp_sigpool preferences crypto_clone_ahash() API over
> pre-allocating per-CPU crypto requests. Kudos to Herbert, who provided
> this new crypto API [1]. Currently, there's still per-CPU crypto request
> allocation fallback, that is needed for ciphers, that yet don't support
> cloning (TCP-AO requires cmac(aes128) in RFC5925).
>
> I was a little concerned over GFP_ATOMIC allocations of ahash and
> crypto_request in RX/TX (see tcp_sigpool_start()), so I benchmarked both
> "backends" with different algorithms, using patched version of iperf3[2].
> On my laptop with i7-7600U @ 2.80GHz:
>
> clone-tfm per-CPU-requests
> TCP-MD5 2.25 Gbits/sec 2.30 Gbits/sec
> TCP-AO(hmac(sha1)) 2.53 Gbits/sec 2.54 Gbits/sec
> TCP-AO(hmac(sha512)) 1.67 Gbits/sec 1.64 Gbits/sec
> TCP-AO(hmac(sha384)) 1.77 Gbits/sec 1.80 Gbits/sec
> TCP-AO(hmac(sha224)) 1.29 Gbits/sec 1.30 Gbits/sec
> TCP-AO(hmac(sha3-512)) 481 Mbits/sec 480 Mbits/sec
> TCP-AO(hmac(md5)) 2.07 Gbits/sec 2.12 Gbits/sec
> TCP-AO(hmac(rmd160)) 1.01 Gbits/sec 995 Mbits/sec
> TCP-AO(cmac(aes128)) [not supporetd yet] 2.11 Gbits/sec
>
> So, it seems that my concerns don't have strong grounds and per-CPU
> crypto_request allocation can be dropped/removed from tcp_sigpool once
> ciphers get crypto_clone_ahash() support.
This support is now in the upstream kernel. Please let me know
if you run into any issues using it.
Thanks,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
next prev parent reply other threads:[~2023-05-15 4:49 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-12 20:22 [PATCH v6 00/21] net/tcp: Add TCP-AO support Dmitry Safonov
2023-05-12 20:22 ` [PATCH v6 01/21] net/tcp: Prepare tcp_md5sig_pool for TCP-AO Dmitry Safonov
2023-05-12 23:23 ` kernel test robot
2023-05-15 4:48 ` Herbert Xu [this message]
2023-05-15 16:25 ` Dmitry Safonov
2023-05-16 10:15 ` Herbert Xu
2023-05-19 8:26 ` [PATCH 0/3] crypto: cmac - Add cloning support Herbert Xu
2023-05-19 8:28 ` [PATCH 1/3] crypto: cmac - Use modern init_tfm/exit_tfm Herbert Xu
2023-05-19 8:28 ` [PATCH 2/3] crypto: cipher - Add crypto_clone_cipher Herbert Xu
2023-05-19 13:15 ` Simon Horman
2023-05-19 8:28 ` [PATCH 3/3] crypto: cmac - Add support for cloning Herbert Xu
2023-05-19 8:54 ` Ard Biesheuvel
2023-05-19 9:04 ` [PATCH] crypto: shash - Allow cloning on algorithms with no init_tfm Herbert Xu
2023-05-19 9:31 ` Ard Biesheuvel
2023-05-19 9:35 ` Herbert Xu
2023-05-19 14:41 ` [PATCH 3/3] crypto: cmac - Add support for cloning Dmitry Safonov
2023-05-19 9:49 ` [PATCH 0/3] crypto: cmac - Add cloning support Ard Biesheuvel
2023-05-12 20:22 ` [PATCH v6 02/21] net/tcp: Add TCP-AO config and structures Dmitry Safonov
2023-05-12 20:22 ` [PATCH v6 03/21] net/tcp: Introduce TCP_AO setsockopt()s Dmitry Safonov
2023-05-12 20:22 ` [PATCH v6 04/21] net/tcp: Prevent TCP-MD5 with TCP-AO being set Dmitry Safonov
2023-05-12 20:22 ` [PATCH v6 05/21] net/tcp: Calculate TCP-AO traffic keys Dmitry Safonov
2023-05-12 20:22 ` [PATCH v6 06/21] net/tcp: Add TCP-AO sign to outgoing packets Dmitry Safonov
2023-05-12 20:22 ` [PATCH v6 07/21] net/tcp: Add tcp_parse_auth_options() Dmitry Safonov
2023-05-12 23:02 ` kernel test robot
2023-05-12 20:22 ` [PATCH v6 08/21] net/tcp: Add AO sign to RST packets Dmitry Safonov
2023-05-12 20:22 ` [PATCH v6 09/21] net/tcp: Add TCP-AO sign to twsk Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 10/21] net/tcp: Wire TCP-AO to request sockets Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 11/21] net/tcp: Sign SYN-ACK segments with TCP-AO Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 12/21] net/tcp: Verify inbound TCP-AO signed segments Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 13/21] net/tcp: Add TCP-AO segments counters Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 14/21] net/tcp: Add TCP-AO SNE support Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 15/21] net/tcp: Add tcp_hash_fail() ratelimited logs Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 16/21] net/tcp: Ignore specific ICMPs for TCP-AO connections Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 17/21] net/tcp: Add option for TCP-AO to (not) hash header Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 18/21] net/tcp: Add TCP-AO getsockopt()s Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 19/21] net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 20/21] net/tcp: Add static_key for TCP-AO Dmitry Safonov
2023-05-12 20:23 ` [PATCH v6 21/21] net/tcp: Wire up l3index to TCP-AO Dmitry Safonov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZGG5rtuHB4lvLyKI@gondor.apana.org.au \
--to=herbert@gondor.apana.org.au \
--cc=0x7f454c46@gmail.com \
--cc=David.Laight@aculab.com \
--cc=ardb@kernel.org \
--cc=cdleonard@gmail.com \
--cc=colona@arista.com \
--cc=davem@davemloft.net \
--cc=dima@arista.com \
--cc=dsahern@kernel.org \
--cc=ebiederm@xmission.com \
--cc=ebiggers@kernel.org \
--cc=edumazet@google.com \
--cc=error27@gmail.com \
--cc=fruggeri05@gmail.com \
--cc=gilligan@arista.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=netdev@vger.kernel.org \
--cc=noureddine@arista.com \
--cc=pabeni@redhat.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®