| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250224124956.GB53094@unreal>
Date: Mon, 24 Feb 2025 14:49:56 +0200
From: Leon Romanovsky <leonro@...dia.com>
To: Chiachang Wang <chiachangwang@...gle.com>
CC: <netdev@...r.kernel.org>, <steffen.klassert@...unet.com>,
<chiahcangwang@...gle.com>, <stanleyjhu@...gle.com>, <yumike@...gle.com>
Subject: Re: [PATCH ipsec v3 1/1] xfrm: Migrate offload configuration
On Mon, Feb 24, 2025 at 06:15:54AM +0000, Chiachang Wang wrote:
> Add hardware offload configuration to XFRM_MSG_MIGRATE
> using an option netlink attribute XFRMA_OFFLOAD_DEV.
>
> In the existing xfrm_state_migrate(), the xfrm_init_state()
> is called assuming no hardware offload by default. Even the
> original xfrm_state is configured with offload, the setting will
> be reset. If the device is configured with hardware offload,
> it's reasonable to allow the device to maintain its hardware
> offload mode. But the device will end up with offload disabled
> after receiving a migration event when the device migrates the
> connection from one netdev to another one.
>
> The devices that support migration may work with different
> underlying networks, such as mobile devices. The hardware setting
> should be forwarded to the different netdev based on the
> migration configuration. This change provides the capability
> for user space to migrate from one netdev to another.
>
> Test: Tested with kernel test in the Android tree located
> in https://android.googlesource.com/kernel/tests/
> The xfrm_tunnel_test.py under the tests folder in
> particular.
> Signed-off-by: Chiachang Wang <chiachangwang@...gle.com>
> ---
>
> v2 -> v3:
> - Modify af_key to fix kbuild error
> v1 -> v2:
> - Address review feedback to correct the logic in the
> xfrm_state_migrate in the migration offload configuration
> change.
> - Revise the commit message for "xfrm: Migrate offload configuration"
> ---
> include/net/xfrm.h | 8 ++++++--
> net/key/af_key.c | 2 +-
> net/xfrm/xfrm_policy.c | 4 ++--
> net/xfrm/xfrm_state.c | 14 +++++++++++---
> net/xfrm/xfrm_user.c | 15 +++++++++++++--
> 5 files changed, 33 insertions(+), 10 deletions(-)
>
> diff --git a/include/net/xfrm.h b/include/net/xfrm.h
> index ed4b83696c77..9e916d812af7 100644
> --- a/include/net/xfrm.h
> +++ b/include/net/xfrm.h
> @@ -1876,12 +1876,16 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n
> u32 if_id);
> struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
> struct xfrm_migrate *m,
> - struct xfrm_encap_tmpl *encap);
> + struct xfrm_encap_tmpl *encap,
> + struct net *net,
> + struct xfrm_user_offload *xuo,
> + struct netlink_ext_ack *extack);
> int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
> struct xfrm_migrate *m, int num_bundles,
> struct xfrm_kmaddress *k, struct net *net,
> struct xfrm_encap_tmpl *encap, u32 if_id,
> - struct netlink_ext_ack *extack);
> + struct netlink_ext_ack *extack,
> + struct xfrm_user_offload *xuo);
> #endif
>
> int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
> diff --git a/net/key/af_key.c b/net/key/af_key.c
> index c56bb4f451e6..efc2a91f4c48 100644
> --- a/net/key/af_key.c
> +++ b/net/key/af_key.c
> @@ -2630,7 +2630,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
> }
>
> return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i,
> - kma ? &k : NULL, net, NULL, 0, NULL);
> + kma ? &k : NULL, net, NULL, 0, NULL, NULL);
>
> out:
> return err;
> diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
> index 6551e588fe52..82f755e39110 100644
> --- a/net/xfrm/xfrm_policy.c
> +++ b/net/xfrm/xfrm_policy.c
> @@ -4630,7 +4630,7 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
> struct xfrm_migrate *m, int num_migrate,
> struct xfrm_kmaddress *k, struct net *net,
> struct xfrm_encap_tmpl *encap, u32 if_id,
> - struct netlink_ext_ack *extack)
> + struct netlink_ext_ack *extack, struct xfrm_user_offload *xuo)
> {
> int i, err, nx_cur = 0, nx_new = 0;
> struct xfrm_policy *pol = NULL;
> @@ -4663,7 +4663,7 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
> if ((x = xfrm_migrate_state_find(mp, net, if_id))) {
> x_cur[nx_cur] = x;
> nx_cur++;
> - xc = xfrm_state_migrate(x, mp, encap);
> + xc = xfrm_state_migrate(x, mp, encap, net, xuo, extack);
> if (xc) {
> x_new[nx_new] = xc;
> nx_new++;
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index ad2202fa82f3..0b5f7e90f4f3 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -2122,22 +2122,30 @@ EXPORT_SYMBOL(xfrm_migrate_state_find);
>
> struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
> struct xfrm_migrate *m,
> - struct xfrm_encap_tmpl *encap)
> + struct xfrm_encap_tmpl *encap,
> + struct net *net,
> + struct xfrm_user_offload *xuo,
> + struct netlink_ext_ack *extack)
> {
> struct xfrm_state *xc;
> -
> + bool offload = (xuo);
There is no need in extra variable, rely on validity of pointer.
> xc = xfrm_state_clone(x, encap);
> if (!xc)
> return NULL;
>
> xc->props.family = m->new_family;
>
> - if (xfrm_init_state(xc) < 0)
> + if (__xfrm_init_state(xc, true, offload, NULL) < 0)
> goto error;
Please rebase this patch on top of https://lore.kernel.org/netdev/cover.1739972570.git.leon@kernel.org/
The __xfrm_init_state() was changed there. You can use xfrm_init_state()
instead.
>
> + x->km.state = XFRM_STATE_VALID;
> memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
> memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
It should be placed inside xfrm_state_clone() and worth to rename it.
>
> + /* configure the hardware if offload is requested */
> + if (offload && xfrm_dev_state_add(net, xc, xuo, extack))
> + goto error;
> +
> /* add state */
> if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) {
> /* a care is needed when the destination address of the
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index 5877eabe9d95..4c2c74078e65 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -3069,6 +3069,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
> int n = 0;
> struct net *net = sock_net(skb->sk);
> struct xfrm_encap_tmpl *encap = NULL;
> + struct xfrm_user_offload *xuo = NULL;
> u32 if_id = 0;
>
> if (!attrs[XFRMA_MIGRATE]) {
> @@ -3099,11 +3100,21 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
> if (attrs[XFRMA_IF_ID])
> if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
>
> + if (attrs[XFRMA_OFFLOAD_DEV]) {
> + xuo = kmemdup(nla_data(attrs[XFRMA_OFFLOAD_DEV]),
> + sizeof(*xuo), GFP_KERNEL);
> + if (!xuo) {
> + err = -ENOMEM;
> + goto error;
> + }
> + }
> +
> err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap,
> - if_id, extack);
> + if_id, extack, xuo);
>
> +error:
> kfree(encap);
> -
> + kfree(xuo);
> return err;
> }
> #else
> --
> 2.48.1.601.g30ceb7b040-goog
>
>
Powered by blists - more mailing lists