Re: [PATCH net-next 09/10] net/mlx5e: Create IPsec table with tunnel support only when encap is disabled

From: Leon Romanovsky <leon@kernel.org>
To: Simon Horman <simon.horman@corigine.com>
Cc: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Steffen Klassert <steffen.klassert@secunet.com>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	netdev@vger.kernel.org, Saeed Mahameed <saeedm@nvidia.com>,
	Raed Salem <raeds@nvidia.com>, Emeel Hakim <ehakim@nvidia.com>
Subject: Re: [PATCH net-next 09/10] net/mlx5e: Create IPsec table with tunnel support only when encap is disabled
Date: Thu, 13 Apr 2023 14:21:53 +0300	[thread overview]
Message-ID: <20230413112153.GK17993@unreal> (raw)
In-Reply-To: <20230411124731.GY182481@unreal>

On Tue, Apr 11, 2023 at 03:47:31PM +0300, Leon Romanovsky wrote:
> On Mon, Apr 10, 2023 at 08:10:14PM +0200, Simon Horman wrote:
> > On Mon, Apr 10, 2023 at 07:49:20PM +0300, Leon Romanovsky wrote:
> > > On Mon, Apr 10, 2023 at 04:29:09PM +0200, Simon Horman wrote:
> > > > On Mon, Apr 10, 2023 at 09:19:11AM +0300, Leon Romanovsky wrote:
> > > > > From: Leon Romanovsky <leonro@nvidia.com>
> > > > > 
> > > > > Current hardware doesn't support double encapsulation which is
> > > > > happening when IPsec packet offload tunnel mode is configured
> > > > > together with eswitch encap option.
> > > > > 
> > > > > Any user attempt to add new SA/policy after he/she sets encap mode, will
> > > > > generate the following FW syndrome:
> > > > > 
> > > > >  mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 1904): CREATE_FLOW_TABLE(0x930) op_mod(0x0) failed,
> > > > >  status bad parameter(0x3), syndrome (0xa43321), err(-22)
> > > > > 
> > > > > Make sure that we block encap changes before creating flow steering tables.
> > > > > This is applicable only for packet offload in tunnel mode, while packet
> > > > > offload in transport mode and crypto offload, don't have such limitation
> > > > > as they don't perform encapsulation.
> > > > > 
> > > > > Reviewed-by: Raed Salem <raeds@nvidia.com>
> > > > > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> > > > 
> > > > Hi Raed and Leon,
> > > > 
> > > > some minor feedback from me below.
> > > > 
> > > > > ---
> > > > >  .../mellanox/mlx5/core/en_accel/ipsec.c       |  7 ++++
> > > > >  .../mellanox/mlx5/core/en_accel/ipsec.h       |  1 +
> > > > >  .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 33 +++++++++++++++++--
> > > > >  3 files changed, 38 insertions(+), 3 deletions(-)
> > > > > 
> > > > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > > > > index b64281fd4142..e95004ac7a20 100644
> > > > > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > > > > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > > > > @@ -668,6 +668,13 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x,
> > > > >  	if (err)
> > > > >  		goto err_hw_ctx;
> > > > >  
> > > > > +	if (x->props.mode == XFRM_MODE_TUNNEL &&
> > > > > +	    x->xso.type == XFRM_DEV_OFFLOAD_PACKET &&
> > > > > +	    !mlx5e_ipsec_fs_tunnel_enabled(sa_entry)) {
> > > > > +		NL_SET_ERR_MSG_MOD(extack, "Packet offload tunnel mode is disabled due to encap settings");
> > > > > +		goto err_add_rule;
> > > > 
> > > > The err_add_rule will return err.
> > > > But err is zero here.
> > > > Perhaps it should be set to an negative error code?
> > > 
> > > Thanks, I overlooked it.
> > > 
> > > > 
> > > > Flagged by Smatch as:
> > > > 
> > > > drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c:753 mlx5e_xfrm_free_state() error: we previously assumed 'sa_entry->work' could be null (see line 744)
> > > 
> > > I don't get such warnings from my CI, will try to understand why.
> > > 
> > > What are the command line arguments you use to run smatch?
> > 
> > Hi Leon,
> > 
> > I run Smatch like this:
> > 
> > .../smatch/smatch_scripts/kchecker \
> > 	drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.o
> > 
> > > What is the version of smatch?
> > 
> > I see this with Smatch 1.73.
> > 
> > 
> > In writing this email, I noticed that Smatch seems to flag
> > a problem in net-next. Which seems to be a valid concern.
> > 
> > drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c:753 mlx5e_xfrm_free_state() error: we previously assumed 'sa_entry->work' could be null (see line 744)
> 
> Thanks, I'll take a look when will return to the office.

I tried it now and still don't get this warning.

Thanks