From: Leon Romanovsky <leon@kernel.org>
To: Jakub Kicinski <kuba@kernel.org>
Cc: Saeed Mahameed <saeed@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
Paolo Abeni <pabeni@redhat.com>,
Eric Dumazet <edumazet@google.com>,
Saeed Mahameed <saeedm@nvidia.com>,
netdev@vger.kernel.org, Tariq Toukan <tariqt@nvidia.com>
Subject: Re: [pull request][net-next V2 00/15] mlx5 updates 2023-10-19
Date: Thu, 26 Oct 2023 10:29:58 +0300 [thread overview]
Message-ID: <20231026072958.GD2950466@unreal> (raw)
In-Reply-To: <20231025182502.54f79369@kernel.org>
On Wed, Oct 25, 2023 at 06:25:02PM -0700, Jakub Kicinski wrote:
> On Wed, 25 Oct 2023 11:52:02 +0300 Leon Romanovsky wrote:
> > This patch won't fix much without following patch in that series.
> > https://lore.kernel.org/all/20231021064620.87397-8-saeed@kernel.org/
> >
> > Yes, users will see their replay window correctly through "ip xfrm state"
> > command, so this is why it has Fixes line, but it won't change anything
> > in the actual behavior without patch 7 and this is the reason why it was
> > sent to net-next.
>
> Odd ordering of patches, anyone doing backports would totally miss it.
> Neither does the commit message explain the situation nor is it
> possible to grok that fact from the ("pass it to FW") code :(
This is why these patches are bundled together as one series.
>
> > From patch 3:
> > Users can configure IPsec replay window size, but mlx5 driver didn't
> > honor their choice and set always 32bits.
> >
> > From patch 7:
> > After IPsec decryption it isn't enough to only check the IPsec syndrome
> > but need to also check the ASO syndrome in order to verify that the
> > operation was actually successful.
>
> Hm, patch 7 looks like an independent but related fix to my uneducated
> eye, should it also have a Fixes tag?
>
> Is patch 7 needed regardless of what choice of (previously ignored)
> parameters user makes?
Yes, I missed register check and without that replay protection feature
didn't work as one would expect, so it is needed anyway. The patch is
large, complex (IMHO not for -rc7) and I agree with Saeed that "missed register"
sounds like "missed feature".
> One way to deal with the problems from patches
> 3 and 4 could be to reject the de facto unsupported configurations.
> But if the supported config also doesn't check the "syndrome" correctly
> in all cases, that's no bueno..
Patch 4 was discovered before replay window testing, when we run HW vs.
SW interoperability testing. The feature of setting seq/oseq is orthogonal
to replay window.
Thanks
>
next prev parent reply other threads:[~2023-10-26 7:30 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-21 6:46 [pull request][net-next V2 00/15] mlx5 updates 2023-10-19 Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 01/15] xfrm: generalize xdo_dev_state_update_curlft to allow statistics update Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 02/15] xfrm: get global statistics from the offloaded device Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 03/15] net/mlx5e: Honor user choice of IPsec replay window size Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 04/15] net/mlx5e: Ensure that IPsec sequence packet number starts from 1 Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 05/15] net/mlx5e: Unify esw and normal IPsec status table creation/destruction Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 06/15] net/mlx5e: Remove exposure of IPsec RX flow steering struct Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 07/15] net/mlx5e: Add IPsec and ASO syndromes check in HW Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 08/15] net/mlx5e: Connect mlx5 IPsec statistics with XFRM core Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 09/15] net/mlx5e: Delete obsolete IPsec code Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 10/15] net/mlx5: Increase size of irq name buffer Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 11/15] net/mlx5e: Reduce the size of icosq_str Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 12/15] net/mlx5e: Check return value of snprintf writing to fw_version buffer Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 13/15] net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 14/15] net/mlx5: print change on SW reset semaphore returns busy Saeed Mahameed
2023-10-21 6:46 ` [net-next V2 15/15] net/mlx5: Allow sync reset flow when BF MGT interface device is present Saeed Mahameed
2023-10-25 1:02 ` [pull request][net-next V2 00/15] mlx5 updates 2023-10-19 Jakub Kicinski
2023-10-25 8:52 ` Leon Romanovsky
2023-10-26 1:25 ` Jakub Kicinski
2023-10-26 7:29 ` Leon Romanovsky [this message]
2023-10-26 22:26 ` Saeed Mahameed
2023-10-26 22:46 ` Jakub Kicinski
2023-10-27 0:44 ` Saeed Mahameed
2023-10-27 10:08 ` Leon Romanovsky
2023-10-27 22:02 ` Saeed Mahameed
2023-10-29 7:44 ` Leon Romanovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231026072958.GD2950466@unreal \
--to=leon@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=saeed@kernel.org \
--cc=saeedm@nvidia.com \
--cc=tariqt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.