* [PATCH net 1/1] ixgbe: ensure IPsec VF<->PF compatibility
@ 2022-04-27 17:31 Tony Nguyen
2022-04-28 16:43 ` Jakub Kicinski
0 siblings, 1 reply; 2+ messages in thread
From: Tony Nguyen @ 2022-04-27 17:31 UTC (permalink / raw)
To: davem, kuba, pabeni
Cc: Leon Romanovsky, netdev, anthony.l.nguyen, Raed Salem,
Shannon Nelson, Konrad Jankowski
From: Leon Romanovsky <leonro@nvidia.com>
The VF driver can forward any IPsec flags and such makes the function
is not extendable and prone to backward/forward incompatibility.
If new software runs on VF, it won't know that PF configured something
completely different as it "knows" only XFRM_OFFLOAD_INBOUND flag.
Fixes: eda0333ac293 ("ixgbe: add VF IPsec management")
Reviewed-by: Raed Salem <raeds@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Shannon Nelson <snelson@pensando.io>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index e596e1a9fc75..69d11ff7677d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -903,7 +903,8 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)
/* Tx IPsec offload doesn't seem to work on this
* device, so block these requests for now.
*/
- if (!(sam->flags & XFRM_OFFLOAD_INBOUND)) {
+ sam->flags = sam->flags & ~XFRM_OFFLOAD_IPV6;
+ if (sam->flags != XFRM_OFFLOAD_INBOUND) {
err = -EOPNOTSUPP;
goto err_out;
}
--
2.31.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net 1/1] ixgbe: ensure IPsec VF<->PF compatibility
2022-04-27 17:31 [PATCH net 1/1] ixgbe: ensure IPsec VF<->PF compatibility Tony Nguyen
@ 2022-04-28 16:43 ` Jakub Kicinski
0 siblings, 0 replies; 2+ messages in thread
From: Jakub Kicinski @ 2022-04-28 16:43 UTC (permalink / raw)
To: Tony Nguyen
Cc: davem, pabeni, Leon Romanovsky, netdev, Raed Salem,
Shannon Nelson, Konrad Jankowski
On Wed, 27 Apr 2022 10:31:52 -0700 Tony Nguyen wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
>
> The VF driver can forward any IPsec flags and such makes the function
> is not extendable and prone to backward/forward incompatibility.
>
> If new software runs on VF, it won't know that PF configured something
> completely different as it "knows" only XFRM_OFFLOAD_INBOUND flag.
>
> Fixes: eda0333ac293 ("ixgbe: add VF IPsec management")
> Reviewed-by: Raed Salem <raeds@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> Reviewed-by: Shannon Nelson <snelson@pensando.io>
> Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Commit f049efc7f7cd ("ixgbe: ensure IPsec VF<->PF compatibility") in
net, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-04-28 16:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-04-27 17:31 [PATCH net 1/1] ixgbe: ensure IPsec VF<->PF compatibility Tony Nguyen
2022-04-28 16:43 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).