netdev - Re: [RFC 10/18] net: macsec: enable HW offloading by default (when available)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200221180423.GE3530@kwain>
Date:   Fri, 21 Feb 2020 19:04:23 +0100
From:   Antoine Tenart <antoine.tenart@...tlin.com>
To:     Igor Russkikh <irusskikh@...vell.com>
Cc:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Antoine Tenart <antoine.tenart@...tlin.com>,
        Mark Starovoytov <mstarovoitov@...vell.com>,
        Dmitry Bogdanov <dbogdanov@...vell.com>
Subject: Re: [RFC 10/18] net: macsec: enable HW offloading by default (when
 available)

Hello,

On Fri, Feb 14, 2020 at 06:02:50PM +0300, Igor Russkikh wrote:
> From: Mark Starovoytov <mstarovoitov@...vell.com>
> 
> This patch makes HW offload to be enabled by default (when available).
> This patch along with the next one (reporting real_dev features) are
> both required to fix the issue described below.
> 
> Issue description:
> real_dev features are disabled upon macsec creation.
> 
> Root cause:
> Features limitation (specific to SW MACSec limitation) is being applied
> to HW offloaded case as well.
> This causes 'set_features' request on the real_dev with reduced feature
> set due to chain propagation.
> IF SW MACSec limitations are not applied to HW offloading case (see the
> next path), then we still face an issue, because SW MACSec is enabled by
> default.
> 
> Proposed solution:
> Enable HW offloading by default (when available).

I would say enabling offloading by default is a no-go, and was discussed
when MACsec offloading was initially proposed. But as you said in the
cover letter, a good way to do this would be to allow setting the
offloading mode when the MACsec interface is created (-> an option in
iproute2).

Thanks,
Antoine

-- 
Antoine Ténart, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com