netdev - Re: [PATCH net-next V2 5/8] net/bonding: Implement TLS TX device offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210116185425.17636415@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Sat, 16 Jan 2021 18:54:25 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Tariq Toukan <tariqt@...dia.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Boris Pismenny <borisp@...dia.com>, netdev@...r.kernel.org,
        Tariq Toukan <ttoukan.linux@...il.com>,
        Moshe Shemesh <moshe@...dia.com>,
        Jay Vosburgh <j.vosburgh@...il.com>,
        Veaceslav Falico <vfalico@...il.com>,
        Andy Gospodarek <andy@...yhouse.net>,
        John Fastabend <john.fastabend@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Jarod Wilson <jarod@...hat.com>,
        Ivan Vecera <ivecera@...hat.com>
Subject: Re: [PATCH net-next V2 5/8] net/bonding: Implement TLS TX device
 offload

On Thu, 14 Jan 2021 20:01:32 +0200 Tariq Toukan wrote:
> As the bond interface is being bypassed by the TLS module, interacting
> directly against the slaves, there is no way for the bond interface to
> disable its device offload capabilities, as long as the mode/policy
> config allows it.
> Hence, the feature flag is not directly controllable, but just reflects
> the current offload status based on the logic under bond_sk_check().

In that case why set it in ->hw_features ?
IIRC features set only in ->features but not ->hw_features show up to
userspace as "fixed" which I gather is what we want here, no?

> +#if IS_ENABLED(CONFIG_TLS_DEVICE)
> +	bond_dev->hw_features |= BOND_TLS_FEATURES;
> +	if (bond_sk_check(bond))
> +		bond_dev->features |= BOND_TLS_FEATURES;
> +#endif