From: Jakub Kicinski <kuba@kernel.org>
To: Leon Romanovsky <leon@kernel.org>
Cc: Saeed Mahameed <saeedm@nvidia.com>,
Jianbo Liu <jianbol@nvidia.com>,
Eric Dumazet <edumazet@google.com>,
Mark Bloch <mbloch@nvidia.com>,
netdev@vger.kernel.org, Paolo Abeni <pabeni@redhat.com>,
"David S . Miller" <davem@davemloft.net>,
Simon Horman <simon.horman@corigine.com>
Subject: Re: [PATCH net-next 09/12] net/mlx5: Compare with old_dest param to modify rule destination
Date: Fri, 14 Jul 2023 20:30:32 -0700 [thread overview]
Message-ID: <20230714203032.7f1bf5f7@kernel.org> (raw)
In-Reply-To: <20230714203258.GL41919@unreal>
On Fri, 14 Jul 2023 23:32:58 +0300 Leon Romanovsky wrote:
> On Fri, Jul 14, 2023 at 12:16:33PM -0700, Jakub Kicinski wrote:
> > On Fri, 14 Jul 2023 21:40:13 +0300 Leon Romanovsky wrote:
> > > It depends on configuration order, if user configures TC first, it will
> > > be a), if he/she configures IPsec first, it will be b).
> > >
> > > I just think that option b) is really matters.
> >
> > And only b) matches what happens in the kernel with policy based IPsec,
> > right?
>
> Can you please clarify what do you mean "policy based IPsec"?
I mean without a separate xfrm netdev on which you can install TC
rules of its own.
> > IIUC what you're saying -
> > the result depending on order of configuration may be a major source
> > of surprises / hard to debug problems for the user.
>
> When I reviewed patches, I came exactly to an opposite conclusion :)
>
> My rationale was that users who configure IPsec and TC are advanced
> users who knows their data flow and if they find a) option valuable,
> they can do it.
>
> For example, a) allows to limit amount of data sent to IPsec engine.
>
> I believe both a) and b) should be supported.
What does it take to switch between the modes?
Even if we want both modes we should have an explicit switch, I reckon.
Or at least a way to read back what mode we ended up in.
next prev parent reply other threads:[~2023-07-15 3:30 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-11 9:28 [PATCH net-next 00/12] mlx5 IPsec packet offload support in eswitch mode Leon Romanovsky
2023-07-11 9:28 ` [PATCH net-next 01/12] net/mlx5e: Add function to get IPsec offload namespace Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 02/12] net/mlx5e: Change the parameter of IPsec RX skb handle function Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 03/12] net/mlx5e: Prepare IPsec packet offload for switchdev mode Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 04/12] net/mlx5e: Refactor IPsec RX tables creation and destruction Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 05/12] net/mlx5e: Support IPsec packet offload for RX in switchdev mode Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 06/12] net/mlx5e: Handle IPsec offload for RX datapath " Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 07/12] net/mlx5e: Refactor IPsec TX tables creation Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 08/12] net/mlx5e: Support IPsec packet offload for TX in switchdev mode Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 09/12] net/mlx5: Compare with old_dest param to modify rule destination Leon Romanovsky
2023-07-13 0:32 ` Jakub Kicinski
2023-07-13 6:33 ` Leon Romanovsky
2023-07-13 17:04 ` Jakub Kicinski
2023-07-13 17:43 ` Leon Romanovsky
2023-07-13 18:05 ` Jakub Kicinski
2023-07-13 18:58 ` Leon Romanovsky
2023-07-14 3:17 ` Jakub Kicinski
2023-07-14 18:40 ` Leon Romanovsky
2023-07-14 19:16 ` Jakub Kicinski
2023-07-14 20:32 ` Leon Romanovsky
2023-07-15 3:30 ` Jakub Kicinski [this message]
2023-07-16 10:39 ` Leon Romanovsky
2023-07-19 9:29 ` Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 10/12] net/mlx5e: Make IPsec offload work together with eswitch and TC Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 11/12] net/mlx5e: Modify and restore TC rules for IPSec TX rules Leon Romanovsky
2023-07-11 9:29 ` [PATCH net-next 12/12] net/mlx5e: Add get IPsec offload stats for uplink representor Leon Romanovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230714203032.7f1bf5f7@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=jianbol@nvidia.com \
--cc=leon@kernel.org \
--cc=mbloch@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=saeedm@nvidia.com \
--cc=simon.horman@corigine.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).