Hi,
This series opens TX and RX TLS device offload for bond interfaces.
This allows bond interfaces to benefit from capable slave devices.
We add a new ndo_sk_get_slave() to be used to get the slave that corresponds
to a given socket.
The TLS module uses it to interact directly with the lowest device in
chain, and invoke the control operations in tlsdev_ops. This means that the
bond interface doesn't have his own struct tlsdev_ops instance and
derived logic/callbacks.
To keep simple track of the HW and SW TLS contexts, we bind each socket to
a specific slave for the socket's whole lifetime. This is logically valid
(and similar to the SW kTLS behavior) in the following bond configuration,
so we restrict the offload support to it:
((mode == balance-xor) or (mode == 802.3ad))
and xmit_hash_policy == layer3+4.
In this design, TLS TX/RX offload feature flags of the bond device are
independent from the slaves. They reflect the current features state, but
are not directly controllable.
This is because the bond driver is bypassed by the call to ndo_sk_get_slave(),
without him knowing who the caller is.
The bond TLS feature flags are set/cleared only according to the configuration
of the mode and xmit_hash_policy.
Bypass is true only for the control flow. Packets in fast path still go through
the bond logic.
The design here differs from the xfrm/ipsec offload, where the bond driver
has his own copy of struct xfrmdev_ops and callbacks.
Regards,
Tariq
V2:
- Declare RX support.
- Enhance the feature flags logic.
- Slight modifications for bond_set_xfrm_features().
-
RFC:
- New design for the tlsdev_ops calls, introduce and use ndo_sk_get_slave()
to interact directly with the slave netdev.
- Remove bond copy of tlsdev_ops callbacks.
- In TLS module: Use netdev_sk_get_lowest_dev(), give exceptions to some checks
to allow bond support.
Tariq Toukan (8):
net: netdevice: Add operation ndo_sk_get_slave
net/bonding: Take IP hash logic into a helper
net/bonding: Implement ndo_sk_get_slave
net/bonding: Take update_features call out of XFRM funciton
net/bonding: Implement TLS TX device offload
net/bonding: Declare TLS RX device offload support
net/tls: Device offload to use lowest netdevice in chain
net/tls: Except bond interface from some TLS checks
drivers/net/bonding/bond_main.c | 139 +++++++++++++++++++++++++++--
drivers/net/bonding/bond_options.c | 42 +++++++--
include/linux/netdevice.h | 4 +
include/net/bonding.h | 4 +
net/core/dev.c | 32 +++++++
net/tls/tls_device.c | 4 +-
net/tls/tls_device_fallback.c | 2 +-
7 files changed, 211 insertions(+), 16 deletions(-)
--
2.21.0
Do not call the tls_dev_ops of upper devices. Instead, ask them
for the proper slave and communicate with it directly.
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
net/tls/tls_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Hash logic on L3 will be used in a downstream patch for one more use
case.
Take it to a function for a better code reuse.
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
drivers/net/bonding/bond_main.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
@@ -3539,6 +3539,16 @@ static bool bond_flow_dissect(struct bonding *bond, struct sk_buff *skb,returntrue;}+staticu32bond_ip_hash(u32hash,structflow_keys*flow)+{+hash^=(__forceu32)flow_get_u32_dst(flow)^+(__forceu32)flow_get_u32_src(flow);+hash^=(hash>>16);+hash^=(hash>>8);+/* discard lowest hash bit to deal with the common even ports pattern */+returnhash>>1;+}+/***bond_xmit_hash-generateahashvaluebasedonthexmitpolicy*@bond:bondingdevice
In the tls_dev_event handler, ignore tlsdev_ops requirement for bond
interfaces, they do not exist as the interaction is done directly with
the slave.
Also, make the validate function pass when it's called with the upper
bond interface.
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
net/tls/tls_device.c | 2 ++
net/tls/tls_device_fallback.c | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
In preparation for more cases that call netdev_update_features().
While here, move the features logic to the stage where struct bond
is already updated, and pass it as the only parameter to function
bond_set_xfrm_features().
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
drivers/net/bonding/bond_options.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
Implement TLS TX device offload for bonding interfaces.
This allows kTLS sockets running on a bond to benefit from the
device offload on capable slaves.
To allow a simple and fast maintenance of the TLS context in SW and
slaves devices, we bind the TLS socket to a specific slave.
To achieve a behavior similar to SW kTLS, we support only balance-xor
and 802.3ad modes, with xmit_hash_policy=layer3+4. This is enforced
in bond_sk_check(), done in a previous patch.
For the above configuration, the SW implementation keeps picking the
same exact slave for all the socket's SKBs. The device offload behaves
similarly, making the decision once at the connection creation.
Per socket, the TLS module should work directly with the lowest netdev
in chain, to call the tls_dev_ops operations.
As the bond interface is being bypassed by the TLS module, interacting
directly against the slaves, there is no way for the bond interface to
disable its device offload capabilities, as long as the mode/policy
config allows it.
Hence, the feature flag is not directly controllable, but just reflects
the current offload status based on the logic under bond_sk_check().
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
drivers/net/bonding/bond_main.c | 30 ++++++++++++++++++++++++++++++
drivers/net/bonding/bond_options.c | 27 +++++++++++++++++++++++++--
include/net/bonding.h | 2 ++
3 files changed, 57 insertions(+), 2 deletions(-)
Following the description in previous patch (for TX):
As the bond interface is being bypassed by the TLS module, interacting
directly against the slaves, there is no way for the bond interface to
disable its device offload capabilities, as long as the mode/policy
config allows it.
Hence, the feature flag is not directly controllable, but just reflects
the offload status based on the logic under bond_sk_check().
Here we just declare RX device offload support, and expose it via the
NETIF_F_HW_TLS_RX flag.
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
include/net/bonding.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
ndo_sk_get_slave returns the slave that corresponds to a given socket.
Additionally, we implement a helper netdev_sk_get_lowest_dev() to get
the lowest slave netdevice.
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
include/linux/netdevice.h | 4 ++++
net/core/dev.c | 32 ++++++++++++++++++++++++++++++++
2 files changed, 36 insertions(+)
Add ndo_sk_get_slave() implementation for bond interfaces.
Support only for the cases where the socket's and SKBs' hash
yields identical value for the whole connection lifetime.
Here we restrict it to L3+4 sockets only, with
xmit_hash_policy==LAYER34 and bond modes xor/802.3ad.
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
---
drivers/net/bonding/bond_main.c | 93 +++++++++++++++++++++++++++++++++
include/net/bonding.h | 2 +
2 files changed, 95 insertions(+)
From: Jakub Kicinski <kuba@kernel.org> Date: 2021-01-17 02:52:20
On Thu, 14 Jan 2021 20:01:28 +0200 Tariq Toukan wrote:
ndo_sk_get_slave returns the slave that corresponds to a given socket.
Additionally, we implement a helper netdev_sk_get_lowest_dev() to get
the lowest slave netdevice.
Please don't add new uses of the word "slave" outside of the bond,
and preferably even there.
From: Jakub Kicinski <kuba@kernel.org> Date: 2021-01-17 02:55:25
On Thu, 14 Jan 2021 20:01:32 +0200 Tariq Toukan wrote:
As the bond interface is being bypassed by the TLS module, interacting
directly against the slaves, there is no way for the bond interface to
disable its device offload capabilities, as long as the mode/policy
config allows it.
Hence, the feature flag is not directly controllable, but just reflects
the current offload status based on the logic under bond_sk_check().
In that case why set it in ->hw_features ?
IIRC features set only in ->features but not ->hw_features show up to
userspace as "fixed" which I gather is what we want here, no?
On Thu, 14 Jan 2021 20:01:28 +0200 Tariq Toukan wrote:
quoted
ndo_sk_get_slave returns the slave that corresponds to a given socket.
Additionally, we implement a helper netdev_sk_get_lowest_dev() to get
the lowest slave netdevice.
Please don't add new uses of the word "slave" outside of the bond,
and preferably even there.
On Thu, 14 Jan 2021 20:01:32 +0200 Tariq Toukan wrote:
quoted
As the bond interface is being bypassed by the TLS module, interacting
directly against the slaves, there is no way for the bond interface to
disable its device offload capabilities, as long as the mode/policy
config allows it.
Hence, the feature flag is not directly controllable, but just reflects
the current offload status based on the logic under bond_sk_check().
In that case why set it in ->hw_features ?
IIRC features set only in ->features but not ->hw_features show up to
userspace as "fixed" which I gather is what we want here, no?
On one hand, by showing "off [Fixed]" we might hide the fact that bond
driver now does support the TLS offload feature, you simply need to
choose the proper mode/xmit_policy.
On the other hand, as the feature flag toggling has totally no impact, I
don't see a point in opening it for toggling.
So yeah, I'll fix.