mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2024-11-21 18:50:50 +01:00
ef2a572bf6
Inline IPSEC offload moves almost whole IPSEC processing from the CPU/MCU and possibly crypto accelerator, to the network card. The transmitted packet content is not touched by CPU during TX operations, kernel only does the required policy and security association lookups to find out that given flow is offloaded, and then packet is transmitted as plain text to the card. For driver convenience, a metadata is attached to the packet identifying SA which must process the packet. Card does encryption of the payload, padding, calculates authentication, and does the reformat according to the policy. Similarly, on receive, card does the decapsulation, decryption, and authentification. Kernel receives the identifier of SA that was used to process the packet, together with the plain-text packet. Overall, payload octets are only read or written by card DMA engine, removing a lot of memory subsystem overhead, and saving CPU time because IPSEC algos calculations are avoided. If driver declares support for inline IPSEC offload (with the IFCAP2_IPSEC_OFFLOAD capability set and registering method table struct if_ipsec_accel_methods), kernel offers the SPD and SAD to driver. Driver decides which policies and SAs can be offloaded based on hardware capacity, and acks/nacks each SA for given interface to kernel. Kernel needs to keep this information to make a decision to skip software processing on TX, and to assume processing already done on RX. This shadow SPD/SAD database of offloads is rooted from policies (struct secpolicy accel_ifps, struct ifp_handle_sp) and SAs (struct secasvar accel_ipfs, struct ifp_handle_sav). Some extensions to the PF_KEY socket allow to limit interfaces for which given SP/SA could be offloaded (proposed for offload). Also, additional statistics extensions allow to observe allocation/octet/use counters for specific SA. Since SPs and SAs are typically instantiated in non-sleepable context, while offloading them into card is expected to require costly async manipulations of the card state, calls to the driver for offload and termination are executed in the threaded taskqueue. It also solves the issue of allocating resources needed for the offload database. Neither ipf_handle_sp nor ipf_handle_sav do not add reference to the owning SP/SA, the offload must be terminated before last reference is dropped. ipsec_accel only adds transient references to ensure safe pointer ownership by taskqueue. Maintaining the SA counters for hardware-accelerated packets is the duty of the driver. The helper ipsec_accel_drv_sa_lifetime_update() is provided to hide accel infrastructure from drivers which would use expected callout to query hardware periodically for updates. Reviewed by: rscheff (transport, stack integration), np Sponsored by: NVIDIA networking Differential revision: https://reviews.freebsd.org/D44219 |
||
|---|---|---|
| .. | ||
| config.mk | ||
| dtb.build.mk | ||
| dtb.mk | ||
| files | ||
| files.amd64 | ||
| files.arm | ||
| files.arm64 | ||
| files.i386 | ||
| files.powerpc | ||
| files.riscv | ||
| files.x86 | ||
| kern.mk | ||
| kern.opts.mk | ||
| kern.post.mk | ||
| kern.pre.mk | ||
| kmod_syms_prefix.awk | ||
| kmod_syms.awk | ||
| kmod.mk | ||
| kmod.opts.mk | ||
| ldscript.amd64 | ||
| ldscript.arm | ||
| ldscript.arm64 | ||
| ldscript.i386 | ||
| ldscript.kmod.amd64 | ||
| ldscript.kmod.i386 | ||
| ldscript.powerpc | ||
| ldscript.powerpc64 | ||
| ldscript.powerpc64le | ||
| ldscript.powerpcspe | ||
| ldscript.riscv | ||
| Makefile.amd64 | ||
| Makefile.arm | ||
| Makefile.arm64 | ||
| Makefile.i386 | ||
| Makefile.powerpc | ||
| Makefile.riscv | ||
| newvers.sh | ||
| NOTES | ||
| options | ||
| options.amd64 | ||
| options.arm | ||
| options.arm64 | ||
| options.i386 | ||
| options.powerpc | ||
| options.riscv | ||
| std.debug | ||
| std.nodebug | ||
| sysent.mk | ||
| systags.sh | ||
| vdso_amd64_ia32.ldscript | ||
| vdso_amd64.ldscript | ||
| WITHOUT_SOURCELESS | ||
| WITHOUT_SOURCELESS_HOST | ||
| WITHOUT_SOURCELESS_UCODE | ||