xfrm: Add support for per cpu xfrm state handling.

Browse source

Currently all flows for a certain SA must be processed by the same
cpu to avoid packet reordering and lock contention of the xfrm
state lock.

To get rid of this limitation, the IETF standardized per cpu SAs
in RFC 9611. This patch implements the xfrm part of it.

We add the cpu as a lookup key for xfrm states and a config option
to generate acquire messages for each cpu.

With that, we can have on each cpu a SA with identical traffic selector
so that flows can be processed in parallel on all cpus.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Tested-by: Antony Antony <antony.antony@secunet.com>
Tested-by: Tobias Brunner <tobias@strongswan.org>

...

This commit is contained in:

Steffen Klassert 2024-10-23 12:53:42 +02:00

parent ab101c553b

commit 1ddf9916ac

6 changed files with 112 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

include/net/xfrm.h

View file

2

include/uapi/linux/xfrm.h

View file

7

net/key/af_key.c

View file

6

net/xfrm/xfrm_compat.c

View file

58

net/xfrm/xfrm_state.c

View file

56

net/xfrm/xfrm_user.c

View file