netdev - Re: [PATCH net 0/5] macsec: offload-related fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 24 Oct 2022 10:24:28 +0200
From:   Sabrina Dubroca <sd@...asysnail.net>
To:     Leon Romanovsky <leon@...nel.org>
Cc:     Antoine Tenart <atenart@...nel.org>, netdev@...r.kernel.org,
        Mark Starovoytov <mstarovoitov@...vell.com>,
        Igor Russkikh <irusskikh@...vell.com>
Subject: Re: [PATCH net 0/5] macsec: offload-related fixes

2022-10-23, 10:52:56 +0300, Leon Romanovsky wrote:
> On Thu, Oct 20, 2022 at 03:54:28PM +0200, Sabrina Dubroca wrote:
> > 2022-10-18, 09:28:08 +0300, Leon Romanovsky wrote:
> > > On Fri, Oct 14, 2022 at 04:03:56PM +0200, Antoine Tenart wrote:
> > > > Quoting Leon Romanovsky (2022-10-14 13:03:57)
> > > > > On Fri, Oct 14, 2022 at 09:43:45AM +0200, Sabrina Dubroca wrote:
> > > > > > 2022-10-14, 09:13:39 +0300, Leon Romanovsky wrote:
> > > > > > > On Thu, Oct 13, 2022 at 04:15:38PM +0200, Sabrina Dubroca wrote:
> 
> <...>
> 
> > > > - With the revert: IPsec and MACsec can be offloaded to the lower dev.
> > > >   Some features might not propagate to the MACsec dev, which won't allow
> > > >   some performance optimizations in the MACsec data path.
> > > 
> > > My concern is related to this sentence: "it's not possible to offload macsec
> > > to lower devices that also support ipsec offload", because our devices support
> > > both macsec and IPsec offloads at the same time.
> > > 
> > > I don't want to see anything (even in commit messages) that assumes that IPsec
> > > offload doesn't exist.
> > 
> > I don't understand what you're saying here. Patch #1 from this series
> > is exactly about the macsec device acknowledging that ipsec offload
> > exists. The rest of the patches is strictly macsec stuff and says
> > nothing about ipsec. Can you point out where, in this series, I'm
> > claiming that ipsec offload doesn't exist?
> 
> All this conversation is about one sentence, which I cited above - "it's not possible
> to offload macsec to lower devices that also support ipsec offload". From the comments,
> I think that you wanted to say "macsec offload is not working due to performance
> optimization, where IPsec offload feature flag was exposed from lower device." Did I get
> it correctly, now?

Yes. "In the current state" (that I wrote in front of the sentence you
quoted) refers to the changes introduced by commit c850240b6c41. The
details are present in the commit message for patch 1.

Do you object to the revert, if I rephrase the justification, and then
re-add the features that make sense in net-next?

-- 
Sabrina