| Message ID | cover.1667204360.git.sd@queasysnail.net (mailing list archive) |
|---|---|
| Headers | show |
| Series | macsec: offload-related fixes | expand |
Hello: This series was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Wed, 2 Nov 2022 22:33:11 +0100 you wrote: > I'm working on a dummy offload for macsec on netdevsim. It just has a > small SecY and RXSC table so I can trigger failures easily on the > ndo_* side. It has exposed a couple of issues. > > The first patch is a revert of commit c850240b6c41 ("net: macsec: > report real_dev features when HW offloading is enabled"). That commit > tried to improve the performance of macsec offload by taking advantage > of some of the NIC's features, but in doing so, broke macsec offload > when the lower device supports both macsec and ipsec offload, as the > ipsec offload feature flags were copied from the real device. Since > the macsec device doesn't provide xdo_* ops, the XFRM core rejects the > registration of the new macsec device in xfrm_api_check. > > [...] Here is the summary with links: - [net,v3,1/5] Revert "net: macsec: report real_dev features when HW offloading is enabled" https://git.kernel.org/netdev/net/c/8bcd560ae878 - [net,v3,2/5] macsec: delete new rxsc when offload fails https://git.kernel.org/netdev/net/c/93a30947821c - [net,v3,3/5] macsec: fix secy->n_rx_sc accounting https://git.kernel.org/netdev/net/c/73a4b31c9d11 - [net,v3,4/5] macsec: fix detection of RXSCs when toggling offloading https://git.kernel.org/netdev/net/c/80df4706357a - [net,v3,5/5] macsec: clear encryption keys from the stack after setting up offload https://git.kernel.org/netdev/net/c/aaab73f8fba4 You are awesome, thank you!
I'm working on a dummy offload for macsec on netdevsim. It just has a small SecY and RXSC table so I can trigger failures easily on the ndo_* side. It has exposed a couple of issues. The first patch is a revert of commit c850240b6c41 ("net: macsec: report real_dev features when HW offloading is enabled"). That commit tried to improve the performance of macsec offload by taking advantage of some of the NIC's features, but in doing so, broke macsec offload when the lower device supports both macsec and ipsec offload, as the ipsec offload feature flags were copied from the real device. Since the macsec device doesn't provide xdo_* ops, the XFRM core rejects the registration of the new macsec device in xfrm_api_check. I'm working on re-adding those feature flags when offload is available, but I haven't fully solved that yet. I think it would be safer to do that second part in net-next considering how complex feature interactions tend to be. v2: - better describe the issue introduced by commit c850240b6c41 (Leon Romanovsky) - patch #3: drop unnecessary !! (Leon Romanovsky) v3: - patch #3: drop extra newline (Jakub Kicinski) Sabrina Dubroca (5): Revert "net: macsec: report real_dev features when HW offloading is enabled" macsec: delete new rxsc when offload fails macsec: fix secy->n_rx_sc accounting macsec: fix detection of RXSCs when toggling offloading macsec: clear encryption keys from the stack after setting up offload drivers/net/macsec.c | 50 +++++++++++++++----------------------------- 1 file changed, 17 insertions(+), 33 deletions(-)