From mboxrd@z Thu Jan 1 00:00:00 1970 From: Shannon Nelson Subject: [PATCH next-queue 1/2] ixgbe: disallow ipsec tx offload when in sr-iov mode Date: Wed, 22 Aug 2018 15:59:40 -0700 Message-ID: <1534978781-25779-1-git-send-email-shannon.nelson@oracle.com> Cc: steffen.klassert@secunet.com, netdev@vger.kernel.org To: jeffrey.t.kirsher@intel.com Return-path: Received: from aserp2120.oracle.com ([141.146.126.78]:45610 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726424AbeHWC0t (ORCPT ); Wed, 22 Aug 2018 22:26:49 -0400 Sender: netdev-owner@vger.kernel.org List-ID: There seems to be a problem in the x540's internal switch wherein if SR/IOV mode is enabled and an offloaded IPsec packet is sent to a local VF, the packet is silently dropped. This might never be a problem as it is somewhat a corner case, but if someone happens to be using IPsec offload from the PF to a VF that just happens to get migrated to the local box, communication will mysteriously fail. Not good. A simple way to protect from this is to simply not allow any IPsec offloads for outgoing packets when num_vfs != 0. This doesn't help any offloads that were created before SR/IOV was enabled, but we'll get to that later. Signed-off-by: Shannon Nelson --- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c index 68395ab..24076b4 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c @@ -697,6 +697,9 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs) } else { struct tx_sa tsa; + if (adapter->num_vfs) + return -EOPNOTSUPP; + /* find the first unused index */ ret = ixgbe_ipsec_find_empty_idx(ipsec, false); if (ret < 0) { -- 2.7.4