Messages in this thread | | | Date | Fri, 1 Sep 2023 15:56:20 +0200 | From | Sabrina Dubroca <> | Subject | Re: [RFC net-next v2 5/5] net: phy: nxp-c45-tja11xx: implement mdo_insert_tx_tag |
| |
2023-09-01, 11:32:19 +0100, Russell King (Oracle) wrote: > On Fri, Sep 01, 2023 at 12:07:32PM +0200, Sabrina Dubroca wrote: > > 2023-09-01, 09:09:06 +0000, Radu Pirea wrote: > > > We can do a flush very simple, but to restore the configuration maybe > > > we should to save the key in the macsec_key structure. I am not sure if > > > the key can be extracted from crypto_aead structure. > > > > Either that or in the driver. I have a small preference for driver, > > because then cases that don't need this restore won't have to keep the > > key in memory, reducing the likelihood of accidentally sharing it. > > OTOH, if we centralize that code, it's easier to make sure everything > > is cleared from kernel memory when we delete the SA. > > Maybe consider about doing it as a library function, so drivers that > need this don't have to reimplement the functionality in randomly > buggy ways?
But then the driver would depend on the macsec module, right? It's not a large module, but that seems a bit undesirable.
I think I'd rather add the key to macsec_key, and only copy it there in case we're offloading (we currently don't allow enabling offloading after installing some SAs/keys so that would be fine). Maybe add a driver flag to request keeping the keys in memory (I don't know if all drivers will require that -- seems like all PHY drivers would, but what about the MAC ones?).
-- Sabrina
| |