netdev - Re: [PATCH net-next] nfp: support IPsec offloading for NFP3800

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Jan 2023 15:36:35 +0200
From:   Leon Romanovsky <leon@...nel.org>
To:     Simon Horman <simon.horman@...igine.com>
Cc:     David Miller <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
        oss-drivers@...igine.com,
        Huanhuan Wang <huanhuan.wang@...igine.com>
Subject: Re: [PATCH net-next] nfp: support IPsec offloading for NFP3800

On Mon, Jan 23, 2023 at 02:15:44PM +0100, Simon Horman wrote:
> On Sun, Jan 22, 2023 at 10:50:24AM +0200, Leon Romanovsky wrote:
> > On Thu, Jan 19, 2023 at 12:38:42PM +0100, Simon Horman wrote:
> > > From: Huanhuan Wang <huanhuan.wang@...igine.com>
> > > 
> > > Add IPsec offloading support for NFP3800.
> > > Including data plane and control plane.
> > > 
> > > Data plane: add IPsec packet process flow in NFP3800 datapath (NFDK).
> > > 
> > > Control plane: add a algorithm support distinction of flow
> > > in xfrm hook function xdo_dev_state_add as NFP3800
> > > supports a different set of IPsec algorithms.
> > > 
> > > This matches existing support for the NFP6000/NFP4000 and
> > > their NFD3 datapath.
> > > 
> > > Signed-off-by: Huanhuan Wang <huanhuan.wang@...igine.com>
> > > Signed-off-by: Simon Horman <simon.horman@...igine.com>
> > > ---
> > >  drivers/net/ethernet/netronome/nfp/Makefile   |  2 +-
> > >  .../net/ethernet/netronome/nfp/crypto/ipsec.c |  9 ++++
> > >  drivers/net/ethernet/netronome/nfp/nfd3/dp.c  |  5 +-
> > >  drivers/net/ethernet/netronome/nfp/nfdk/dp.c  | 47 +++++++++++++++++--
> > >  .../net/ethernet/netronome/nfp/nfdk/ipsec.c   | 17 +++++++
> > >  .../net/ethernet/netronome/nfp/nfdk/nfdk.h    |  8 ++++
> > >  6 files changed, 79 insertions(+), 9 deletions(-)
> > >  create mode 100644 drivers/net/ethernet/netronome/nfp/nfdk/ipsec.c
> > 
> > <...>
> > 
> > >  	md_bytes = sizeof(meta_id) +
> > >  		   !!md_dst * NFP_NET_META_PORTID_SIZE +
> > > -		   vlan_insert * NFP_NET_META_VLAN_SIZE;
> > > +		   vlan_insert * NFP_NET_META_VLAN_SIZE +
> > > +		   *ipsec * NFP_NET_META_IPSEC_FIELD_SIZE;
> > 
> > *ipsec is boolean variable, so you are assuming that true is always 1.
> > I'm not sure that it is always correct.
> 
> Thanks, I do see what you are saying.
> 
> But I think what is there is consistent with the existing
> use if md_dst and vlan_insert.

It doesn't make it correct.

Thanks