From: Sabrina Dubroca <sd@queasysnail.net>
To: Antoine Tenart <antoine.tenart@bootlin.com>
Cc: Igor Russkikh <Igor.Russkikh@aquantia.com>,
"davem@davemloft.net" <davem@davemloft.net>,
"andrew@lunn.ch" <andrew@lunn.ch>,
"f.fainelli@gmail.com" <f.fainelli@gmail.com>,
"hkallweit1@gmail.com" <hkallweit1@gmail.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"thomas.petazzoni@bootlin.com" <thomas.petazzoni@bootlin.com>,
"alexandre.belloni@bootlin.com" <alexandre.belloni@bootlin.com>,
"allan.nielsen@microchip.com" <allan.nielsen@microchip.com>,
"camelia.groza@nxp.com" <camelia.groza@nxp.com>,
Simon Edelhaus <Simon.Edelhaus@aquantia.com>,
Pavel Belous <Pavel.Belous@aquantia.com>
Subject: Re: [PATCH net-next v2 6/9] net: macsec: hardware offloading infrastructure
Date: Fri, 16 Aug 2019 15:25:00 +0200 [thread overview]
Message-ID: <20190816132500.GA8697@bistromath.localdomain> (raw)
In-Reply-To: <20190813085817.GA3200@kwain>
2019-08-13, 10:58:17 +0200, Antoine Tenart wrote:
> Hi Igor,
>
> On Sat, Aug 10, 2019 at 01:20:32PM +0000, Igor Russkikh wrote:
> > On 08.08.2019 17:05, Antoine Tenart wrote:
> >
> > > The Rx and TX handlers are modified to take in account the special case
> > > were the MACsec transformation happens in the hardware, whether in a PHY
> > > or in a MAC, as the packets seen by the networking stack on both the
> >
> > Don't you think we may eventually may need xmit / handle_frame ops to be
> > a part of macsec_ops?
> >
> > That way software macsec could be extract to just another type of offload.
> > The drawback of current code is it doesn't show explicitly the path of
> > offloaded packets. It is hidden in `handle_not_macsec` and in
> > `macsec_start_xmit` branch. This makes incorrect counters to tick (see my below
> > comment)
> >
> > Another thing is that both xmit / macsec_handle_frame can't now be customized
> > by device driver. But this may be required.
> > We for example have usecases and HW features to allow specific flows to bypass
> > macsec encryption. This is normally used for macsec key control protocols,
> > identified by ethertype. Your phy is also capable on that as I see.
>
> I think this question is linked to the use of a MACsec virtual interface
> when using h/w offloading. The starting point for me was that I wanted
> to reuse the data structures and the API exposed to the userspace by the
> s/w implementation of MACsec. I then had two choices: keeping the exact
> same interface for the user (having a virtual MACsec interface), or
Unless it's really infeasible, yes, that's how things should be done IMO.
> registering the MACsec genl ops onto the real net devices (and making
> the s/w implementation a virtual net dev and a provider of the MACsec
> "offloading" ops).
Please, no :( Let's keep it as close as possible to the software
implementation, unless there's a really good reason not to. It's not
just "ip macsec" btw, wpa_supplicant can also configure MACsec and
would also need some logic to pick the device on which to do the genl
operations in that case.
> The advantages of the first option were that nearly all the logic of the
> s/w implementation could be kept and especially that it would be
> transparent for the user to use both implementations of MACsec. But this
> raised an issue as I had to modify the xmit / handle_frame ops to let
> all the traffic pass. This is because we have no way of knowing if a
> frame was handled by the MACsec h/w or not in ingress. So the virtual
> interface here only serve as the entrypoint for the API...
It's also the interface on which you'll run DHCP or install IP addresses.
> The second option would have the advantage to better represent the actual
> flow, but the way of configuring MACsec would be a bit different for the
> user, whether he wants to use s/w or h/w MACsec. If we were to do this I
> think we could extract the genl functions from the MACsec s/w
> implementation, and let it implement the MACsec ops (exactly as the
> offloading drivers).
>
> I'm open to discussing this :)
>
> As for the need for xmit / handle_frame ops (for a MAC w/ MACsec
> offloading), I'd say the xmit / handle_frame ops of the real net device
> driver could be used as the one of the MACsec virtual interface do not
> do much (regardless of the implementation choice discussed above).
There's no "handle_frame" op on a real device. macsec_handle_frame is
an rx_handler specificity that grabs packets from a real device and
sends them into a virtual device stacked on top of it. A real device
just hands packets over to the stack via NAPI.
> > > @@ -2546,11 +2814,15 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
> > > {
> > > struct macsec_dev *macsec = netdev_priv(dev);
> > > struct macsec_secy *secy = &macsec->secy;
> > > + struct macsec_tx_sc *tx_sc = &secy->tx_sc;
> > > struct pcpu_secy_stats *secy_stats;
> > > + struct macsec_tx_sa *tx_sa;
> > > int ret, len;
> > >
> > > + tx_sa = macsec_txsa_get(tx_sc->sa[tx_sc->encoding_sa]);
> >
> > Declared, but not used?
>
> I'll remove it then.
That's also a refcount leak, so, yes, please get rid of it.
[I'll answer the rest of the patch separately]
--
Sabrina
next prev parent reply other threads:[~2019-08-16 13:25 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-08 14:05 [PATCH net-next v2 0/9] net: macsec: initial support for hardware offloading Antoine Tenart
2019-08-08 14:05 ` [PATCH net-next v2 1/9] net: introduce the MACSEC netdev feature Antoine Tenart
2019-08-08 14:05 ` [PATCH net-next v2 2/9] net: macsec: move some definitions in a dedicated header Antoine Tenart
2019-08-10 12:19 ` Igor Russkikh
2019-08-12 8:17 ` Antoine Tenart
2019-08-08 14:05 ` [PATCH net-next v2 3/9] net: macsec: introduce the macsec_context structure Antoine Tenart
2019-08-08 14:05 ` [PATCH net-next v2 4/9] net: introduce MACsec ops and add a reference in net_device Antoine Tenart
2019-08-09 20:35 ` Jakub Kicinski
2019-08-12 8:18 ` Antoine Tenart
2019-08-08 14:05 ` [PATCH net-next v2 5/9] net: phy: add MACsec ops in phy_device Antoine Tenart
2019-08-14 23:15 ` Florian Fainelli
2019-08-20 10:07 ` Antoine Tenart
2019-08-08 14:05 ` [PATCH net-next v2 6/9] net: macsec: hardware offloading infrastructure Antoine Tenart
2019-08-10 13:20 ` Igor Russkikh
2019-08-13 8:58 ` Antoine Tenart
2019-08-13 13:17 ` Andrew Lunn
2019-08-13 16:18 ` Igor Russkikh
2019-08-13 16:28 ` Andrew Lunn
2019-08-14 8:32 ` Antoine Tenart
2019-08-14 23:28 ` Florian Fainelli
2019-08-16 13:26 ` Sabrina Dubroca
2019-08-20 10:03 ` Antoine Tenart
2019-08-14 8:31 ` Antoine Tenart
2019-08-16 13:29 ` Sabrina Dubroca
2019-08-20 10:01 ` Antoine Tenart
2019-08-20 14:41 ` Sabrina Dubroca
2019-08-21 0:01 ` Andrew Lunn
2019-08-21 9:20 ` Igor Russkikh
2019-08-21 9:27 ` allan.nielsen
2019-08-21 9:24 ` allan.nielsen
2019-08-21 10:01 ` Antoine Tenart
2019-08-21 12:01 ` Igor Russkikh
2019-08-16 13:25 ` Sabrina Dubroca [this message]
2019-08-20 10:07 ` Antoine Tenart
2019-08-10 16:34 ` Andrew Lunn
2019-08-12 8:15 ` Antoine Tenart
2019-08-13 11:46 ` Igor Russkikh
2019-08-08 14:05 ` [PATCH net-next v2 7/9] net: phy: export __phy_read_page/__phy_write_page Antoine Tenart
2019-08-08 14:05 ` [PATCH net-next v2 8/9] net: phy: mscc: macsec initialization Antoine Tenart
2019-08-10 16:53 ` Andrew Lunn
2019-08-12 8:12 ` Antoine Tenart
2019-08-08 14:06 ` [PATCH net-next v2 9/9] net: phy: mscc: macsec support Antoine Tenart
2019-08-09 11:23 ` [PATCH net-next v2 0/9] net: macsec: initial support for hardware offloading Allan W. Nielsen
2019-08-09 11:40 ` Antoine Tenart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190816132500.GA8697@bistromath.localdomain \
--to=sd@queasysnail.net \
--cc=Igor.Russkikh@aquantia.com \
--cc=Pavel.Belous@aquantia.com \
--cc=Simon.Edelhaus@aquantia.com \
--cc=alexandre.belloni@bootlin.com \
--cc=allan.nielsen@microchip.com \
--cc=andrew@lunn.ch \
--cc=antoine.tenart@bootlin.com \
--cc=camelia.groza@nxp.com \
--cc=davem@davemloft.net \
--cc=f.fainelli@gmail.com \
--cc=hkallweit1@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=thomas.petazzoni@bootlin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).