netdev - Re: [PATCH net-next v10 00/19] add basic PSP encryption for TCP connections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aLdIUZbwF83DbUiv@x130>
Date: Tue, 2 Sep 2025 12:41:05 -0700
From: Saeed Mahameed <saeed@...nel.org>
To: Daniel Zahka <daniel.zahka@...il.com>
Cc: Donald Hunter <donald.hunter@...il.com>,
	Jakub Kicinski <kuba@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>, Jonathan Corbet <corbet@....net>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	Saeed Mahameed <saeedm@...dia.com>,
	Leon Romanovsky <leon@...nel.org>, Tariq Toukan <tariqt@...dia.com>,
	Boris Pismenny <borisp@...dia.com>,
	Kuniyuki Iwashima <kuniyu@...gle.com>,
	Willem de Bruijn <willemb@...gle.com>,
	David Ahern <dsahern@...nel.org>,
	Neal Cardwell <ncardwell@...gle.com>,
	Patrisious Haddad <phaddad@...dia.com>,
	Raed Salem <raeds@...dia.com>, Jianbo Liu <jianbol@...dia.com>,
	Dragos Tatulea <dtatulea@...dia.com>,
	Rahul Rameshbabu <rrameshbabu@...dia.com>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Toke Høiland-Jørgensen <toke@...hat.com>,
	Alexander Lobakin <aleksander.lobakin@...el.com>,
	Kiran Kella <kiran.kella@...adcom.com>,
	Jacob Keller <jacob.e.keller@...el.com>, netdev@...r.kernel.org
Subject: Re: [PATCH net-next v10 00/19] add basic PSP encryption for TCP
 connections

On 28 Aug 09:29, Daniel Zahka wrote:
>This is v10 of the PSP RFC [1] posted by Jakub Kicinski one year
>ago. General developments since v1 include a fork of packetdrill [2]
>with support for PSP added, as well as some test cases, and an
>implementation of PSP key exchange and connection upgrade [3]
>integrated into the fbthrift RPC library. Both [2] and [3] have been
>tested on server platforms with PSP-capable CX7 NICs. Below is the
>cover letter from the original RFC:
>
>Add support for PSP encryption of TCP connections.
>

[...]

>Raed Salem (9):
>  net/mlx5e: Support PSP offload functionality
>  net/mlx5e: Implement PSP operations .assoc_add and .assoc_del
>  psp: provide encapsulation helper for drivers
>  net/mlx5e: Implement PSP Tx data path
>  net/mlx5e: Add PSP steering in local NIC RX
>  net/mlx5e: Configure PSP Rx flow steering rules
>  psp: provide decapsulation and receive helper for drivers
>  net/mlx5e: Add Rx data path offload
>  net/mlx5e: Implement PSP key_rotate operation
>

[...]

> .../mellanox/mlx5/core/en_accel/psp.c         | 195 +++++
> .../mellanox/mlx5/core/en_accel/psp.h         |  49 ++
> .../mellanox/mlx5/core/en_accel/psp_fs.c      | 736 ++++++++++++++++++
> .../mellanox/mlx5/core/en_accel/psp_fs.h      |  30 +
> .../mellanox/mlx5/core/en_accel/psp_offload.c |  44 ++

A bit too much control path files, psp_offload.c holds only two level
functions for key management and rotation, while psp_fs is.c implementing the 
flow steering part and psp.c is the netdev API facing implementation,
do we really need three files ? You can sparate the logic inside one file
by bottom up design rather than 3 split files.
psp is a well defined protocol, I don't expect it to scale larger than a
1-2k lines of code in mlx5, so let's keep it simple, just consolidate all
files into one en_accel/psp.{c,h} and leave rxtx.c data path separate.

Also As Jakub pointed out on V7, mlx5_ifc changes need to be separated into
own patch, "net/mlx5e: Support PSP offload functionality" need to split at
the point where we cache ps caps on driver load, so main.c and mlx5_if.c in
that patch have to go into own patch and then pulled into mlx5-next branch
to avoid any conflict. Let me know if you need any assistance.


> .../mellanox/mlx5/core/en_accel/psp_rxtx.c    | 200 +++++
> .../mellanox/mlx5/core/en_accel/psp_rxtx.h    | 121 +++
> .../net/ethernet/mellanox/mlx5/core/en_main.c |   9 +
> .../net/ethernet/mellanox/mlx5/core/en_rx.c   |  49 +-
> .../net/ethernet/mellanox/mlx5/core/en_tx.c   |  10 +-
> drivers/net/ethernet/mellanox/mlx5/core/fw.c  |   6 +
> .../ethernet/mellanox/mlx5/core/lib/crypto.h  |   1 +
> .../net/ethernet/mellanox/mlx5/core/main.c    |   1 +
> .../mellanox/mlx5/core/steering/hws/definer.c |   2 +-