linux.git/net/tls, branch v5.4-rc2

net/tls: align non temporal copy to cache lines

2019-09-07T16:10:34+00:00

Unlike normal TCP code TLS has to touch the cache lines
it copies into to fill header info. On memory-heavy workloads
having non temporal stores and normal accesses targeting
the same cache line leads to significant overhead.

Measured 3% overhead running 3600 round robin connections
with additional memory heavy workload.

Signed-off-by: Jakub Kicinski 
Reviewed-by: Dirk van der Merwe 
Signed-off-by: David S. Miller

net/tls: remove the record tail optimization

2019-09-07T16:10:34+00:00

For TLS device offload the tag/message authentication code are
filled in by the device. The kernel merely reserves space for
them. Because device overwrites it, the contents of the tag make
do no matter. Current code tries to save space by reusing the
header as the tag. This, however, leads to an additional frag
being created and defeats buffer coalescing (which trickles
all the way down to the drivers).

Remove this optimization, and try to allocate the space for
the tag in the usual way, leave the memory uninitialized.
If memory allocation fails rewind the record pointer so that
we use the already copied user data as tag.

Note that the optimization was actually buggy, as the tag
for TLS 1.2 is 16 bytes, but header is just 13, so the reuse
may had looked past the end of the page..

Signed-off-by: Jakub Kicinski 
Reviewed-by: Dirk van der Merwe 
Signed-off-by: David S. Miller

net/tls: use RCU for the adder to the offload record list

2019-09-07T16:10:34+00:00

All modifications to TLS record list happen under the socket
lock. Since records form an ordered queue readers are only
concerned about elements being removed, additions can happen
concurrently.

Use RCU primitives to ensure the correct access types
(READ_ONCE/WRITE_ONCE).

Signed-off-by: Jakub Kicinski 
Reviewed-by: Dirk van der Merwe 
Signed-off-by: David S. Miller

net/tls: unref frags in order

2019-09-07T16:10:34+00:00

It's generally more cache friendly to walk arrays in order,
especially those which are likely not in cache.

Signed-off-by: Jakub Kicinski 
Reviewed-by: Dirk van der Merwe 
Signed-off-by: David S. Miller

net/tls: dedup the record cleanup

2019-09-05T07:49:49+00:00

If retransmit record hint fall into the cleanup window we will
free it by just walking the list. No need to duplicate the code.

Signed-off-by: Jakub Kicinski 
Reviewed-by: John Hurley 
Reviewed-by: Dirk van der Merwe 
Signed-off-by: David S. Miller

net/tls: clean up the number of #ifdefs for CONFIG_TLS_DEVICE

2019-09-05T07:49:49+00:00

TLS code has a number of #ifdefs which make the code a little
harder to follow. Recent fixes removed the ifdef around the
TLS_HW define, so we can switch to the often used pattern
of defining tls_device functions as empty static inlines
in the header when CONFIG_TLS_DEVICE=n.

Signed-off-by: Jakub Kicinski 
Reviewed-by: John Hurley 
Reviewed-by: Dirk van der Merwe 
Acked-by: John Fastabend 
Signed-off-by: David S. Miller

net/tls: narrow down the critical area of device_offload_lock

2019-09-05T07:49:49+00:00

On setsockopt path we need to hold device_offload_lock from
the moment we check netdev is up until the context is fully
ready to be added to the tls_device_list.

No need to hold it around the get_netdev_for_sock().
Change the code and remove the confusing comment.

Signed-off-by: Jakub Kicinski 
Reviewed-by: John Hurley 
Reviewed-by: Dirk van der Merwe 
Signed-off-by: David S. Miller

net/tls: don't jump to return

2019-09-05T07:49:49+00:00

Reusing parts of error path for normal exit will make
next commit harder to read, untangle the two.

Signed-off-by: Jakub Kicinski 
Reviewed-by: John Hurley 
Reviewed-by: Dirk van der Merwe 
Signed-off-by: David S. Miller

net/tls: use the full sk_proto pointer

2019-09-05T07:49:49+00:00

Since we already have the pointer to the full original sk_proto
stored use that instead of storing all individual callback
pointers as well.

Signed-off-by: Jakub Kicinski 
Reviewed-by: John Hurley 
Reviewed-by: Dirk van der Merwe 
Acked-by: John Fastabend 
Signed-off-by: David S. Miller

net: tls: export protocol version, cipher, tx_conf/rx_conf to socket diag

2019-09-01T06:44:28+00:00

When an application configures kernel TLS on top of a TCP socket, it's
now possible for inet_diag_handler() to collect information regarding the
protocol version, the cipher type and TX / RX configuration, in case
INET_DIAG_INFO is requested.

Signed-off-by: Davide Caratti 
Reviewed-by: Jakub Kicinski 
Signed-off-by: David S. Miller