From: Akhil Goyal <akhil.goyal@nxp.com>
To: "Ananyev, Konstantin" <konstantin.ananyev@intel.com>,
"Smoczynski, MarcinX" <marcinx.smoczynski@intel.com>,
"anoobj@marvell.com" <anoobj@marvell.com>
Cc: "dev@dpdk.org" <dev@dpdk.org>,
"Iremonger, Bernard" <bernard.iremonger@intel.com>
Subject: Re: [dpdk-dev] [PATCH v6 2/4] examples/ipsec-secgw: add fallback session feature
Date: Tue, 15 Oct 2019 14:33:08 +0000 [thread overview]
Message-ID: <VE1PR04MB663949111557D2E0964748C7E6930@VE1PR04MB6639.eurprd04.prod.outlook.com> (raw)
In-Reply-To: <2601191342CEEE43887BDE71AB9772580191975B26@irsmsx105.ger.corp.intel.com>
Hi Konstantin,
>
> Hi Akhil,
>
> > >
> > > Inline processing is limited to a specified subset of traffic. It is
> > > often unable to handle more complicated situations, such as fragmented
> > > traffic. When using inline processing such traffic is dropped.
> > >
> > > Introduce fallback session for inline processing allowing processing
> > > packets that normally would be dropped. A fallback session is
> > > configured by adding 'fallback' keyword with 'lookaside-none' or
> > > 'lookaside-protocol' parameter to an SA configuration.
> > >
> > > Using IPsec anti-replay window or ESN feature with fallback session is
> > > not yet supported when primary session is of type
> > > 'inline-protocol-offload' or fallback session is 'lookaside-protocol'
> > > because SA sequence number is not synchronized between software and
> > > hardware sessions. Fallback sessions are also limited to ingress IPsec
> > > traffic.
> > >
> > > Fallback session feature is not available in the legacy mode.
> > >
> > I started looking this patch, but some initial thoughts looking at the patch
> description.
> >
> > When you say a fallback session will be a lookaside none or lookaside protocol,
> > the packet will be processed asynchronously and might as well reorder.
>
> Yes, we documented it as one of limitations.
> Though as I already mentioned for some use-cases some reordering it is
> acceptable.
Which usecases allow reordering. I think most stacks have replay window of less than 256/128 frames.
>
> > The best possible solution for this would be the synchronous API which are in
> talks
>
> Agree, that would be a way to avoid reordering, but it is not there yet.
>
> > in another patchset or use a SW PMD(eg. Openssl etc.) session and wait till you
> get the packet dequeued.
> > So effectively async APIs will be used to behave synchronously.
> > You can not use hardware PMD session as it will perform very badly for
> fallback packets
> > Because you have to wait till the packet is not getting dequeued back.
>
> We don't plan to support that model because of great performance penalty you
> mentioned.
So what is currently supported with this patchset.
- cpu crypto is not there yet.
- SW PMD you are not supporting that model.
>
> >
> > Having said that, you won't find a device or a scenario where you can use
> > Inline crypto as primary and lookaside proto as fallback.
> > It can only be like inline crypto as primary and lookaside none as fallback.
>
> Yes, correct.
> I thought that we already removed lookaside-proto from supported types.
> If we didn't - will certainly do that.
>
> >
> > BTW, I am ok with Patch 1/4 and 3/4. If no objections from the community, I
> can pick those.
>
> Great to hear.
> What obstacles do you see with others two?
I believe there are some discussion going on between you and Anoob.
> Konstantin
>
> >
> > -Akhil
> >
> > > Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
> > > Tested-by: Bernard Iremonger <bernard.iremonger@intel.com>
> > > Signed-off-by: Marcin Smoczynski <marcinx.smoczynski@intel.com>
> > > ---
next prev parent reply other threads:[~2019-10-15 14:33 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-14 20:48 [dpdk-dev] [PATCH v1 0/2] examples/ipsec-secgw: add fallback session Marcin Smoczynski
2019-08-14 20:48 ` [dpdk-dev] [PATCH v1 1/2] examples/ipsec-secgw: ipsec_sa structure cleanup Marcin Smoczynski
2019-08-14 20:48 ` [dpdk-dev] [PATCH v1 2/2] examples/ipsec-secgw: add fallback session feature Marcin Smoczynski
2019-09-04 14:16 ` [dpdk-dev] [PATCH v2 0/3] examples/ipsec-secgw: add fallback session Marcin Smoczynski
2019-09-04 14:16 ` [dpdk-dev] [PATCH v2 1/3] examples/ipsec-secgw: ipsec_sa structure cleanup Marcin Smoczynski
2019-09-04 14:16 ` [dpdk-dev] [PATCH v2 2/3] examples/ipsec-secgw: add fallback session feature Marcin Smoczynski
2019-09-04 14:16 ` [dpdk-dev] [PATCH v2 3/3] examples/ipsec-secgw: add offload fallback tests Marcin Smoczynski
2019-09-18 6:45 ` [dpdk-dev] [PATCH v2 0/3] examples/ipsec-secgw: add fallback session Anoob Joseph
2019-09-18 8:46 ` Ananyev, Konstantin
2019-09-18 11:40 ` Anoob Joseph
2019-09-18 22:19 ` Ananyev, Konstantin
2019-09-19 2:50 ` Anoob Joseph
2019-09-19 7:33 ` Ananyev, Konstantin
2019-09-19 10:53 ` Anoob Joseph
2019-09-23 11:44 ` [dpdk-dev] [PATCH v3 0/3] " Marcin Smoczynski
2019-09-23 11:44 ` [dpdk-dev] [PATCH v3 1/3] examples/ipsec-secgw: ipsec_sa structure cleanup Marcin Smoczynski
2019-09-23 16:47 ` Ananyev, Konstantin
2019-09-23 11:44 ` [dpdk-dev] [PATCH v3 2/3] examples/ipsec-secgw: add fallback session feature Marcin Smoczynski
2019-09-23 16:49 ` Ananyev, Konstantin
2019-09-23 11:44 ` [dpdk-dev] [PATCH v3 3/3] examples/ipsec-secgw: add offload fallback tests Marcin Smoczynski
2019-09-23 16:50 ` Ananyev, Konstantin
2019-09-23 12:51 ` [dpdk-dev] [PATCH v3 0/3] add fallback session Smoczynski, MarcinX
2019-09-26 9:04 ` Anoob Joseph
2019-09-26 12:38 ` Ananyev, Konstantin
2019-09-29 14:29 ` Anoob Joseph
2019-09-30 13:31 ` Ananyev, Konstantin
2019-10-02 10:14 ` Anoob Joseph
2019-10-03 14:46 ` Ananyev, Konstantin
2019-10-09 15:36 ` Anoob Joseph
2019-10-10 10:55 ` Ananyev, Konstantin
2019-10-13 12:47 ` Anoob Joseph
2019-10-16 12:02 ` Ananyev, Konstantin
2019-10-16 13:36 ` Ananyev, Konstantin
2019-09-27 9:10 ` [dpdk-dev] [PATCH v4 0/4] " Marcin Smoczynski
2019-09-27 9:10 ` [dpdk-dev] [PATCH v4 1/4] examples/ipsec-secgw: ipsec_sa structure cleanup Marcin Smoczynski
2019-09-27 9:10 ` [dpdk-dev] [PATCH v4 2/4] examples/ipsec-secgw: add fallback session feature Marcin Smoczynski
2019-09-27 9:10 ` [dpdk-dev] [PATCH v4 3/4] examples/ipsec-secgw: add frag TTL cmdline option Marcin Smoczynski
2019-09-27 9:10 ` [dpdk-dev] [PATCH v4 4/4] examples/ipsec-secgw: add offload fallback tests Marcin Smoczynski
2019-09-27 15:54 ` [dpdk-dev] [PATCH v5 0/4] add fallback session Marcin Smoczynski
2019-09-27 15:54 ` [dpdk-dev] [PATCH v5 1/4] examples/ipsec-secgw: ipsec_sa structure cleanup Marcin Smoczynski
2019-10-02 15:43 ` Nicolau, Radu
2019-10-03 16:35 ` Iremonger, Bernard
2019-09-27 15:54 ` [dpdk-dev] [PATCH v5 2/4] examples/ipsec-secgw: add fallback session feature Marcin Smoczynski
2019-09-29 17:03 ` Ananyev, Konstantin
2019-09-30 9:13 ` Smoczynski, MarcinX
2019-10-03 16:36 ` Iremonger, Bernard
2019-09-27 15:54 ` [dpdk-dev] [PATCH v5 3/4] examples/ipsec-secgw: add frag TTL cmdline option Marcin Smoczynski
2019-09-30 10:16 ` Ananyev, Konstantin
2019-09-27 15:54 ` [dpdk-dev] [PATCH v5 4/4] examples/ipsec-secgw: add offload fallback tests Marcin Smoczynski
2019-10-03 16:46 ` Iremonger, Bernard
2019-10-07 13:02 ` [dpdk-dev] [PATCH v6 0/4] add fallback session Marcin Smoczynski
2019-10-07 13:02 ` [dpdk-dev] [PATCH v6 1/4] examples/ipsec-secgw: sa structure cleanup Marcin Smoczynski
2019-10-07 13:02 ` [dpdk-dev] [PATCH v6 2/4] examples/ipsec-secgw: add fallback session feature Marcin Smoczynski
2019-10-11 14:40 ` Akhil Goyal
2019-10-11 15:06 ` Ananyev, Konstantin
2019-10-15 14:33 ` Akhil Goyal [this message]
2019-10-16 10:37 ` Ananyev, Konstantin
2019-10-07 13:02 ` [dpdk-dev] [PATCH v6 3/4] examples/ipsec-secgw: add frag TTL cmdline option Marcin Smoczynski
2019-10-07 13:02 ` [dpdk-dev] [PATCH v6 4/4] examples/ipsec-secgw: add offload fallback tests Marcin Smoczynski
2019-10-14 13:48 ` [dpdk-dev] [PATCH v7 0/4] add fallback session Marcin Smoczynski
2019-10-14 13:48 ` [dpdk-dev] [PATCH v7 1/4] examples/ipsec-secgw: sa structure cleanup Marcin Smoczynski
2019-10-14 13:48 ` [dpdk-dev] [PATCH v7 2/4] examples/ipsec-secgw: add fallback session feature Marcin Smoczynski
2019-10-14 13:48 ` [dpdk-dev] [PATCH v7 3/4] examples/ipsec-secgw: add frag TTL cmdline option Marcin Smoczynski
2019-10-14 13:48 ` [dpdk-dev] [PATCH v7 4/4] examples/ipsec-secgw: add offload fallback tests Marcin Smoczynski
2019-10-21 12:29 ` [dpdk-dev] [PATCH v7 0/4] add fallback session Mcnamara, John
2019-10-21 12:32 ` Akhil Goyal
2019-11-05 12:20 ` Akhil Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=VE1PR04MB663949111557D2E0964748C7E6930@VE1PR04MB6639.eurprd04.prod.outlook.com \
--to=akhil.goyal@nxp.com \
--cc=anoobj@marvell.com \
--cc=bernard.iremonger@intel.com \
--cc=dev@dpdk.org \
--cc=konstantin.ananyev@intel.com \
--cc=marcinx.smoczynski@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).