netdev - Re: [PATCH net-next v1 16/17] net/mlx5: Allow future addition of IPsec object modifiers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 Apr 2022 15:46:55 -0700
From:   Saeed Mahameed <saeedm@...dia.com>
To:     Leon Romanovsky <leon@...nel.org>
Cc:     Paolo Abeni <pabeni@...hat.com>, Jakub Kicinski <kuba@...nel.org>,
        "David S . Miller" <davem@...emloft.net>,
        Leon Romanovsky <leonro@...dia.com>,
        Jason Gunthorpe <jgg@...dia.com>,
        linux-netdev <netdev@...r.kernel.org>,
        Raed Salem <raeds@...dia.com>
Subject: Re: [PATCH net-next v1 16/17] net/mlx5: Allow future addition of
 IPsec object modifiers

On 19 Apr 13:13, Leon Romanovsky wrote:
>From: Leon Romanovsky <leonro@...dia.com>
>
>Currently, all released FW versions support only two IPsec object
>modifiers, and modify_field_select get and set same value with
>proper bits.
>
>However, it is not future compatible, as new FW can have more
>modifiers and "default" will cause to overwrite not-changed fields.
>
>Fix it by setting explicitly fields that need to be overwritten.
>
>Fixes: 7ed92f97a1ad ("net/mlx5e: IPsec: Add Connect-X IPsec ESN update offload support")

Will apply this to net-mlx5 and send this to net.

>Signed-off-by: Huy Nguyen <huyn@...dia.com>
>Reviewed-by: Raed Salem <raeds@...dia.com>
>Signed-off-by: Leon Romanovsky <leonro@...dia.com>
>---
> .../net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c   | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
>index b13e152fe9fc..792724ce7336 100644
>--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
>+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
>@@ -179,6 +179,9 @@ static int mlx5_modify_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry,
> 		return -EOPNOTSUPP;
>
> 	obj = MLX5_ADDR_OF(modify_ipsec_obj_in, in, ipsec_object);
>+	MLX5_SET64(ipsec_obj, obj, modify_field_select,
>+		   MLX5_MODIFY_IPSEC_BITMASK_ESN_OVERLAP |
>+			   MLX5_MODIFY_IPSEC_BITMASK_ESN_MSB);
> 	MLX5_SET(ipsec_obj, obj, esn_msb, attrs->esn);
> 	if (attrs->flags & MLX5_ACCEL_ESP_FLAGS_ESN_STATE_OVERLAP)
> 		MLX5_SET(ipsec_obj, obj, esn_overlap, 1);
>-- 
>2.35.1
>