Commit 81a331a0 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

xfrm: Add an inbound percpu state cache. 



Now that we can have percpu xfrm states, the number of active
states might increase. To get a better lookup performance,
we add a percpu cache to cache the used inbound xfrm states.

Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Tested-by: default avatarAntony Antony <antony.antony@secunet.com>
Tested-by: default avatarTobias Brunner <tobias@strongswan.org>
parent 0045e3d8

include/net/netns/xfrm.h

+1 −0
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ struct netns_xfrm { 
	struct hlist_head	__rcu *state_bysrc;

	struct hlist_head	__rcu *state_byspi;

	struct hlist_head	__rcu *state_byseq;

	struct hlist_head	 __percpu *state_cache_input;

	unsigned int		state_hmask;

	unsigned int		state_num;

	struct work_struct	state_hash_work;

include/net/xfrm.h

+5 −0
Original line number Diff line number Diff line
@@ -185,6 +185,7 @@ struct xfrm_state { 
	struct hlist_node	byspi;

	struct hlist_node	byseq;

	struct hlist_node	state_cache;

	struct hlist_node	state_cache_input;



	refcount_t		refcnt;

	spinlock_t		lock;
@@ -1650,6 +1651,10 @@ int xfrm_state_update(struct xfrm_state *x); 
struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,

				     const xfrm_address_t *daddr, __be32 spi,

				     u8 proto, unsigned short family);

struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark,

					   const xfrm_address_t *daddr,

					   __be32 spi, u8 proto,

					   unsigned short family);

struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,

					    const xfrm_address_t *daddr,

					    const xfrm_address_t *saddr,

net/ipv4/esp4_offload.c

+3 −3
Original line number Diff line number Diff line
@@ -53,7 +53,7 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, 
		if (sp->len == XFRM_MAX_DEPTH)

			goto out_reset;



		x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,

		x = xfrm_input_state_lookup(dev_net(skb->dev), skb->mark,

					    (xfrm_address_t *)&ip_hdr(skb)->daddr,

					    spi, IPPROTO_ESP, AF_INET);

net/ipv6/esp6_offload.c

+3 −3
Original line number Diff line number Diff line
@@ -80,7 +80,7 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head, 
		if (sp->len == XFRM_MAX_DEPTH)

			goto out_reset;



		x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,

		x = xfrm_input_state_lookup(dev_net(skb->dev), skb->mark,

					    (xfrm_address_t *)&ipv6_hdr(skb)->daddr,

					    spi, IPPROTO_ESP, AF_INET6);

net/xfrm/xfrm_input.c

+1 −1
Original line number Diff line number Diff line
@@ -572,7 +572,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) 
			goto drop;

		}



		x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family);

		x = xfrm_input_state_lookup(net, mark, daddr, spi, nexthdr, family);

		if (x == NULL) {

			secpath_reset(skb);

			XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);