netdev - Re: [PATCH net-next 0/4] devlink: Add port function attributes to enable/disable IPsec crypto and packet offloads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230323102331.682ac5d6@kernel.org>
Date:   Thu, 23 Mar 2023 10:23:31 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Dima Chumak <dchumak@...dia.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>, Jiri Pirko <jiri@...nulli.us>,
        Leon Romanovsky <leon@...nel.org>,
        Saeed Mahameed <saeedm@...dia.com>, <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next 0/4] devlink: Add port function attributes to
 enable/disable IPsec crypto and packet offloads

On Thu, 23 Mar 2023 13:10:55 +0200 Dima Chumak wrote:
> Currently, mlx5 PCI VFs are disabled by default for IPsec functionality.
> A user does not have the ability to enable IPsec support for a PCI VF
> device.
> 
> It is desirable to provide a user with a fine grained control of the PCI
> VF device IPsec capabilities. 

Is it fine grained? How many keys can each VF allocate?

> The above are a hypervisor level control, to set the functionality of
> devices passed through to guests.
> 
> This is achieved by extending existing 'port function' object to control
> capabilities of a function. It enables users to control capability of
> the device before enumeration.
> 
> The series introduces two new boolean attributes of port function:
> ipsec_crypto and ipsec_packet. They can be controlled independently.
> Each to provide a distinct level of IPsec offload support that may
> require different system and/or device firmware resources. 

On a quick read I have no idea what the difference between the two
knobs is :S