Subject: Re: [pull request][net-next V2 00/15] mlx5 updates 2023-10-19

From: Leon Romanovsky <[email-masked]>
Date: Thu, 26 Oct 2023 10:29:58 +0300

On Wed, Oct 25, 2023 at 06:25:02PM -0700, Jakub Kicinski wrote:
> On Wed, 25 Oct 2023 11:52:02 +0300 Leon Romanovsky wrote:
> > This patch won't fix much without following patch in that series.
> > https://lore.kernel.org/all/[email-masked]/
> > 
> > Yes, users will see their replay window correctly through "ip xfrm state"
> > command, so this is why it has Fixes line, but it won't change anything
> > in the actual behavior without patch 7 and this is the reason why it was
> > sent to net-next.
> 
> Odd ordering of patches, anyone doing backports would totally miss it.
> Neither does the commit message explain the situation nor is it
> possible to grok that fact from the ("pass it to FW") code :(

This is why these patches are bundled together as one series.

> 
> > From patch 3:
> >  Users can configure IPsec replay window size, but mlx5 driver didn't
> >  honor their choice and set always 32bits.
> > 
> > From patch 7:
> >  After IPsec decryption it isn't enough to only check the IPsec syndrome
> >  but need to also check the ASO syndrome in order to verify that the
> >  operation was actually successful.
> 
> Hm, patch 7 looks like an independent but related fix to my uneducated
> eye, should it also have a Fixes tag?
> 
> Is patch 7 needed regardless of what choice of (previously ignored)
> parameters user makes?

Yes, I missed register check and without that replay protection feature
didn't work as one would expect, so it is needed anyway. The patch is
large, complex (IMHO not for -rc7) and I agree with Saeed that "missed register"
sounds like "missed feature".

> One way to deal with the problems from patches 
> 3 and 4 could be to reject the de facto unsupported configurations.
> But if the supported config also doesn't check the "syndrome" correctly
> in all cases, that's no bueno..

Patch 4 was discovered before replay window testing, when we run HW vs.
SW interoperability testing. The feature of setting seq/oseq is orthogonal
to replay window.

Thanks