From nobody Fri Sep 25 01:20:29 2026 Received: from MW6PR02CU001.outbound.protection.outlook.com (mail-westus2azon11012045.outbound.protection.outlook.com [52.101.48.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DE7754706B; Thu, 17 Sep 2026 18:10:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.48.45 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668632; cv=fail; b=bsj26XuELtqYxadnvnPD0Fp13jJf/KI1gFRf6cZMBpsILzFOD9x14WUe0CAQeyE6s7G0xqli+0ql7I8zCTos0H7nn5bIB5R00FB8PDgVVokJhc+uFceE/4wvG/UorWgXjBJXnQSzYu9ZnvBOK6adbjIxSPR19I6xerJMor6BA2s= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668632; c=relaxed/simple; bh=qCyvdiA05ak6JSs4M5yJapmUBdkixOc57Yfe396sXaY=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=bvOGIL+WTvAJgVQOG1y2L2acKQjkYn0+z7T44qXPFSUXkfZ8s6J9EHwUBa3G9Yanf9Gv70K0WEeiII8jApcGsl2+QSzfZujkmcgZM/E533GbE+yRK7BIyO/AQ3saGCm1TxqYcnCFgrzALNAPNMmZ5i5I3qvK6MCKnSj/uZCy468= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=WIkBeJ+v; arc=fail smtp.client-ip=52.101.48.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="WIkBeJ+v" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Q1jrFuphR5bWDreHtZDJmK/vblmOVMNA9ObZAq0YI7K3hAnBQrmuwYamD35pv9ZR/e9/B/CkLimuilve45wHfZ3D6jbT+y6/cZKCwv483zl9QATWu9sZNUTUqf8f1m1zpXFnNf6rQwODDJoi30ZhBAvpXLkKYYacWUXa1Mmh9+PXy1EjHE0Lio5aPzWLxWT2Adrn3IL84vu/jZzjUUJDn5ZHM4tX4U4Ngw9wnqvrkogsKMygzASVBKAV0hz5PcVk5VVAoUOUCTjadbSqh+E6WRf1zJfNp/aZH4hkzHqg2X0Xnd3ulbHNDr7dfUl/dW9HmphJwLrGKPwC7u128MYPtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OE9k+J6Gnp57nqKgGIzOiDOABYox1boSyscMnCifaNc=; b=IZqmkO7t9epnyYGIuAPkLNj68r6OyD12ZsX5sJbeKtLTolO/CRI9oUsPrrV6LGgtCTmEgVifMKfs/5mzlE3Z3wvPGTOUqHLQNmjM6LQx90plyrVmuiWhFubAp1oeIvmhiqTD/rcT1rRzGdt6MAUMZ8ZCoW/QZ7sEiFKmpjV5yYQoQpvw21ybTy/7rIgCoxxFg/5mFAE8AglcECpdjrs2OFqW98ID5R7ayWO0fXoerfYFHzIgb9TivfQTUhrfad0jREe3HBDOP9Kv+u9VJrKTruqzClEy9m1PRi7i3edx8C4Mqo6W5ijR4stVmk4DdEUVOP+JoaSIK82RzUVGLPUfMg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OE9k+J6Gnp57nqKgGIzOiDOABYox1boSyscMnCifaNc=; b=WIkBeJ+vVNKrGSEiB5UmTGWXd4ZRps2k9EM2zlY85sr9LLrnJWzj+Y1+fxiqCRyPGRYLBfSenJJzTnJQ/qifqFwZ5Vco6EjEjKzSTZ1gEUKjA2YYqKn5iG/nhgBIBg0AqVirPit0QqR8oBylv2ZKOk3R2ZrctlK8qSdHfJxben3yFw+dvh/PUjsPnpLMT7v5lVcxywJI0g4m6Zja3ShMoct+QhxAES7mgIWuqmLZtUDkNjsog+Kgm8cKaKeAqOv1jVIEeALYAccb6NWPaD9reDXR3Faf+qLxKApnqmeUctqWem3pNRTWwzGqRMWS7L8woIqohwai6cM8j3HkXBEBeQ== Received: from BLAPR05CA0008.namprd05.prod.outlook.com (2603:10b6:208:36e::11) by BY5PR12MB4148.namprd12.prod.outlook.com (2603:10b6:a03:208::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.14; Thu, 17 Sep 2026 18:10:25 +0000 Received: from BL6PEPF00020E62.namprd04.prod.outlook.com (2603:10b6:208:36e:cafe::93) by BLAPR05CA0008.outlook.office365.com (2603:10b6:208:36e::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 17 Sep 2026 18:10:25 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BL6PEPF00020E62.mail.protection.outlook.com (10.167.249.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 17 Sep 2026 18:10:24 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:01 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:00 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.2562.49 via Frontend Transport; Thu, 17 Sep 2026 11:09:54 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Dragos Tatulea , Emeel Hakim , "Gal Pressman" , Jianbo Liu , Leon Romanovsky , open list , , Lior Nahmanson , Mark Bloch , Parav Pandit , Raed Salem , Rahul Rameshbabu , Roi Dayan , Saeed Mahameed , Steffen Klassert , Tariq Toukan Subject: [PATCH net 1/7] net/mlx5e: ipsec: Block eswitch mode changes during policy creation Date: Thu, 17 Sep 2026 20:54:27 +0300 Message-ID: <20260917175433.4090878-2-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260917175433.4090878-1-tariqt@nvidia.com> References: <20260917175433.4090878-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00020E62:EE_|BY5PR12MB4148:EE_ X-MS-Office365-Filtering-Correlation-Id: 4c2bd56f-e33d-4f7f-42c5-08df14e6f250 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|23010399003|82310400026|7416014|376014|1800799024|22082099003|18002099003|11063799006|56012099006|10067099003; X-Microsoft-Antispam-Message-Info: 36oUMUoFxgk40nxFe5nellEyCG+kgMQQLHCZKe17nW7wPSPbrB9N8EcP1/cRFMayblJSIe23foY3vATRjh+k5prxN4KgxBh4cHOzU3DjFPj1x1GlQB5seUv3rE10waHsarfTJQJk7TkV6hGsr8b89tSFKv1zZn+1Ydnrb+xNyC4srJf+AMT8lC5pI1ZoD+YUxnnNM6TPgOgQ5GG4wyPibUzHLYhevBdGes2C1Fmlw1PSJp1KVT7o733svO2BBfG0rxcePfRvR8+cam5IHjZDoQO/SAJ4mniG8CMSvEdfnDydq+4Iir4Ua2qrynW4cNy5BdDyeF7LLYhbb8179yHMwZMbR7MkQ5/huHf6MNz0EzyICKwa9OKDms6G9s/bccTAHAbEzZ2KRCizII4Weu8bekbVdm/7W3rnUX+jB/OuFOmG0f422MSnR6KS3eNB7cZCwg2cdyzAajAFB/pLSYG4/KC5/1J3YglSHp2wsHkgerWU7Obtj9TTrmoU0D2wsV/5OdzAwOOv/s9zcpVnwkfq4cLcJoIKzNPJf2WD2w9OMYYqE+MSrtxdkKhChh+xJDJilZTTyLrOFe7wYMPicRyHYonAVhlolIPgXIG+u09Z444fKz6Unl2bJ8kUJKko6cZKhwUEuSMTm5FtXiBse2XHodRdZs3dZhDJdfbf9PeSgHXraRNS4WYbqRVfKrW0on2Q9Hd9F0o9uO2Y+CWrEPT+wA== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(23010399003)(82310400026)(7416014)(376014)(1800799024)(22082099003)(18002099003)(11063799006)(56012099006)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: TfPw3QX+O/tDTwfP+s4rYuLdPC+kJT3U6sA7ot18zZuLpKq0AJMk9VWA728eSEXL4bvz8v9p2S6MAE8aaPpTMTgUf1c+a/LEMGVPr2Glsppg/ZsWNTRMmkGqIgfQ3UKtkYsy0J3pDU8Ewr69H3Wjby7XYIwCf15DYdvygjr3Nah5yGwAj6BVuEVcMH7ImAzhxrPzBrg2IgsqtkkPkXpMm0idmoGm96oF/E4f1NGjytbuHMWsV1rHnjtFwoY9s4z0g0jLFXYrYbSng0prP1+2UQ5lwHRgJy2tKArl+DgH6w/iMxBfn5jOthxhd7N/6efb4k1HLpxFpjSueedogM91eC9zzBucN/hEsirSaARq3truVAy+0kHQ+Op/nKEvIRpNYtB2L9MAwk5tlM4AKn/S4ajuxu7aqr0m02nJ4ujBMqY1PWdyRaZ6zJ0XedyNrccL X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Sep 2026 18:10:24.7949 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4c2bd56f-e33d-4f7f-42c5-08df14e6f250 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00020E62.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR12MB4148 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Eswitch mode changes can tear down the IPsec context while policy creation is accessing it. The mode-blocking reference acquired when creating a flow table comes too late: the table lookup already accesses the IPsec context before taking that reference. Block mode changes before checking the IPsec context and validating the policy. Release the temporary reference after successful setup, when the flow table holds its own reference, or after unwinding on failure. Unfortunately, simply using mlx5_eswitch_block_mode() for this would introduce a regression where: 1. An offloaded inbound IPsec policy is added on the uplink. 2. A TC flower rule is added on a VF representor. 3. Another uplink IPsec policy using the same RX tables is added. Before this change, the 3rd rule would reuse an existing RX/TX table from 1 and would avoid an mlx5_eswitch_block_mode() check in rx_get()/tx_get(). After this change, the temporary mode block added would reject the 3rd rule because esw->user_count > 0. To avoid that, I was forced to separate the mode blocking from the TC check by introducing a check_users argument to mlx5_eswitch_block_mode(). Fixes: a5b8ca9471d3 ("net/mlx5e: Add XFRM policy offload logic") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec.c | 23 +++++++++++++++---- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 4 ++-- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 11 +++++---- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 10 +++++--- .../mellanox/mlx5/core/eswitch_offloads.c | 7 +++--- 5 files changed, 36 insertions(+), 19 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/dri= vers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c index db260e3d1412..841ecdc2c4d9 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c @@ -806,7 +806,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, goto err_xfrm; } =20 - err =3D mlx5_eswitch_block_mode(priv->mdev); + err =3D mlx5_eswitch_block_mode(priv->mdev, true); if (err) goto unblock_ipsec; =20 @@ -1266,18 +1266,28 @@ static int mlx5e_xfrm_add_policy(struct xfrm_policy= *x, int err; =20 priv =3D netdev_priv(netdev); + /* Block esw mode changes until the policy holds its own block. */ + err =3D mlx5_eswitch_block_mode(priv->mdev, false); + if (err) { + NL_SET_ERR_MSG_MOD(extack, "Eswitch busy, can't add policy"); + return err; + } + if (!priv->ipsec) { NL_SET_ERR_MSG_MOD(extack, "Device doesn't support IPsec packet offload"= ); - return -EOPNOTSUPP; + err =3D -EOPNOTSUPP; + goto unblock_mode; } =20 err =3D mlx5e_xfrm_validate_policy(priv->mdev, x, extack); if (err) - return err; + goto unblock_mode; =20 pol_entry =3D kzalloc_obj(*pol_entry); - if (!pol_entry) - return -ENOMEM; + if (!pol_entry) { + err =3D -ENOMEM; + goto unblock_mode; + } =20 pol_entry->x =3D x; pol_entry->ipsec =3D priv->ipsec; @@ -1293,6 +1303,7 @@ static int mlx5e_xfrm_add_policy(struct xfrm_policy *= x, goto err_fs; =20 x->xdo.offload_handle =3D (unsigned long)pol_entry; + mlx5_eswitch_unblock_mode(priv->mdev); return 0; =20 err_fs: @@ -1300,6 +1311,8 @@ static int mlx5e_xfrm_add_policy(struct xfrm_policy *= x, ipsec_busy: kfree(pol_entry); NL_SET_ERR_MSG_MOD(extack, "Device failed to offload this policy"); +unblock_mode: + mlx5_eswitch_unblock_mode(priv->mdev); return err; } =20 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 329608c59313..5c72656c623f 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -1127,7 +1127,7 @@ static int rx_get(struct mlx5_core_dev *mdev, struct = mlx5e_ipsec *ipsec, if (rx->ft.refcnt) goto skip; =20 - err =3D mlx5_eswitch_block_mode(mdev); + err =3D mlx5_eswitch_block_mode(mdev, true); if (err) return err; =20 @@ -1416,7 +1416,7 @@ static int tx_get(struct mlx5_core_dev *mdev, struct = mlx5e_ipsec *ipsec, if (tx->ft.refcnt) goto skip; =20 - err =3D mlx5_eswitch_block_mode(mdev); + err =3D mlx5_eswitch_block_mode(mdev, true); if (err) return err; =20 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/ne= t/ethernet/mellanox/mlx5/core/eswitch.c index fc197d1dc9df..0b48cc7a6734 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c @@ -3005,21 +3005,22 @@ void mlx5_esw_put(struct mlx5_core_dev *mdev) /** * mlx5_esw_try_lock() - Take a write lock on esw mode lock. * @esw: eswitch device. + * @check_users: reject the lock if eswitch users exist. * * Should be called by esw mode change routine. * * Return: - * * 0 - esw mode if successfully locked and refcount is 0. - * * -EBUSY - refcount is not 0. - * * -EINVAL - In the middle of switching mode or lock is already held. + * * >=3D 0 - esw mode if successfully locked. + * * -EBUSY - mode change in progress or users exist with check_users set. + * * -EINVAL - lock is already held. */ -int mlx5_esw_try_lock(struct mlx5_eswitch *esw) +int mlx5_esw_try_lock(struct mlx5_eswitch *esw, bool check_users) { if (down_write_trylock(&esw->mode_lock) =3D=3D 0) return -EINVAL; =20 if (esw->eswitch_operation_in_progress || - atomic64_read(&esw->user_count) > 0) { + (check_users && atomic64_read(&esw->user_count) > 0)) { up_write(&esw->mode_lock); return -EBUSY; } diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/ne= t/ethernet/mellanox/mlx5/core/eswitch.h index 8b1f93b13ea9..4a9a1656f6db 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h @@ -946,7 +946,7 @@ bool mlx5_esw_hold(struct mlx5_core_dev *dev); void mlx5_esw_release(struct mlx5_core_dev *dev); void mlx5_esw_get(struct mlx5_core_dev *dev); void mlx5_esw_put(struct mlx5_core_dev *dev); -int mlx5_esw_try_lock(struct mlx5_eswitch *esw); +int mlx5_esw_try_lock(struct mlx5_eswitch *esw, bool check_users); int mlx5_esw_lock(struct mlx5_eswitch *esw); void mlx5_esw_unlock(struct mlx5_eswitch *esw); =20 @@ -970,7 +970,7 @@ bool mlx5_eswitch_is_peer(struct mlx5_eswitch *esw, bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb); void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev); =20 -int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev); +int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev, bool check_users); void mlx5_eswitch_unblock_mode(struct mlx5_core_dev *dev); =20 static inline int mlx5_eswitch_num_vfs(struct mlx5_eswitch *esw) @@ -1081,7 +1081,11 @@ static inline void mlx5_eswitch_unblock_encap(struct= mlx5_core_dev *dev) { } =20 -static inline int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev) { ret= urn 0; } +static inline int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev, + bool check_users) +{ + return 0; +} static inline void mlx5_eswitch_unblock_mode(struct mlx5_core_dev *dev) {} static inline bool mlx5_eswitch_block_ipsec(struct mlx5_core_dev *dev) { diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/d= rivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c index eb74b6260168..996490e11625 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c @@ -4343,7 +4343,7 @@ static int esw_inline_mode_to_devlink(u8 mlx5_mode, u= 8 *mode) return 0; } =20 -int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev) +int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev, bool check_users) { struct mlx5_eswitch *esw =3D dev->priv.eswitch; int err; @@ -4351,8 +4351,7 @@ int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev) if (!mlx5_esw_allowed(esw)) return 0; =20 - /* Take TC into account */ - err =3D mlx5_esw_try_lock(esw); + err =3D mlx5_esw_try_lock(esw, check_users); if (err < 0) return err; =20 @@ -4485,7 +4484,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *dev= link, u16 mode, return 0; =20 mlx5_lag_disable_change(esw->dev); - err =3D mlx5_esw_try_lock(esw); + err =3D mlx5_esw_try_lock(esw, true); if (err < 0) { NL_SET_ERR_MSG_MOD(extack, "Can't change mode, E-Switch is busy"); goto enable_lag; --=20 2.44.0 From nobody Fri Sep 25 01:20:29 2026 Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11012052.outbound.protection.outlook.com [40.107.200.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E91C361967; Thu, 17 Sep 2026 18:10:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.200.52 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668649; cv=fail; b=HMDO1gIH9x5+dosOcagaLLjQE6yRDLA1jmz/u9rFE5Rgg/KklKzzfrO53uOagQhlgqwrXT9NL2u+kWLl+Wbv7CfPn9UxSdLUOalZoyXluiLI7VOQljVzgx5qqvrnwrBsFph6Y0usTqNn53tJqGB4CBiOBoUspwPDK5/xjcNLfyg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668649; c=relaxed/simple; bh=7zfcBYJ6pWoaBL4rK45tVZzzji9iIJ3XGzVvqFcriIQ=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=c9nupfIPctpcX5NZRHtbbj6g7DtqlmGwpGyYrdc9woWe5FCsDzbRwnTsXRI+dUapmubWXNc8qtCe8iif83hdfh+q4x81lyZZdL8B3mPQoICoejkTkcJz1zU52waViZgHtMxJ1B+NnMi/c3j+NyMdsVBvZ7G8d7rM9rRQ2xH9w7M= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=SSFKyN3M; arc=fail smtp.client-ip=40.107.200.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="SSFKyN3M" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sV9PS/jzfT9d7L4oSi1fk+EizOi/+NqZzor7QhC36YRusgm390+fmk6a/qt2yYRiaVUfPaHYlfnSGWxiaiJ5s729SwRm0T1mW5APSqOBx9kJd8xOKC1WQlXAO+iW2nMTuC/MJ0CnpPIrMdDKkt9PfGnI/1BKd5ATzrmK7ih9JZ9SMUPXcDXp23nKw2qbtDtwOHopqbsVVBIgZHgPEZPSLkAnoglaipmvKnRJCUNcGSlry0JWHwNqfXAuJCIwZ7iGYi7+0Ti6OFrDC0jyA8a40/B4THeFMgc2g4pza/DDImcNGIdKV0cWa4Zns1DCpX1FrcDDBfqk9iazaHD+u4I+TQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6NQ2ANzsvNXkp3KH4WS1/hXFAgoGEfz68bvW08b9m2g=; b=b33hJ60CQINpzMxesXJTJfZMl26cXwDi7Ge8N8hNVWTnvUYqYGBVKz6K0AClN2qvip8DCiXf+L+FDhMgkfBwyQ/3MyPz3DFGcEv+M8bYAwYQ8VP5zK580YgnP9OdL852fcl8VtSz4hf7LNdXjAZHAMUl2DfTIkgrQSnladsjrmEuhMsvVSTMzYkrAn1DR7wONK5Fsm7ytw7Zz2ajFSSD5+83xCdyujjKeqsCKRByUbE5G+iTBdni/5CJ87cKKKO3LrXzfEFK80puK9tH8TwGlkf/R4G5Lnz4Rn4Ss24C9HDOoZhLCbZR3ffdTXBYv8BX6vl1xaCbrdnSO5D1K7h3Kw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6NQ2ANzsvNXkp3KH4WS1/hXFAgoGEfz68bvW08b9m2g=; b=SSFKyN3MWNvOnC0ljiKy7ClbrwsSvFhZ/1Yx60D7wR/eMdFFlrVC1S84Gx6k57pjbpwt9w/Xut9PwSUu5zNubpWQ0+r2yJkD6jkAQyh5orvQ2M0JUAz9lP9+liY9YJLu4CwcyKTw8xKJZlXzTVeULZm8i30F3+1yyzZWTOIaqtLLTC2kJITJ1RvXd5mONDg/0yrBiQ9qXaE362SWp3lyC3OynHzCplJDXJN7HYkmRILtfQR/E6kreVTKNThGQ5kjUVxOjPyVWtkHkgtrBgJk7TIunghHJLCFewQcVsBgJ8BVOKuWWa0+x94+wuM37utzkzLO2bLYXeqxTWk5c/TGfw== Received: from BN1PR12CA0020.namprd12.prod.outlook.com (2603:10b6:408:e1::25) by DM4PR12MB6256.namprd12.prod.outlook.com (2603:10b6:8:a3::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.9; Thu, 17 Sep 2026 18:10:33 +0000 Received: from BL6PEPF00020E66.namprd04.prod.outlook.com (2603:10b6:408:e1:cafe::42) by BN1PR12CA0020.outlook.office365.com (2603:10b6:408:e1::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.11 via Frontend Transport; Thu, 17 Sep 2026 18:10:33 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BL6PEPF00020E66.mail.protection.outlook.com (10.167.249.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 17 Sep 2026 18:10:33 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:08 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:07 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.2562.49 via Frontend Transport; Thu, 17 Sep 2026 11:10:01 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Dragos Tatulea , Emeel Hakim , "Gal Pressman" , Jianbo Liu , Leon Romanovsky , open list , , Lior Nahmanson , Mark Bloch , Parav Pandit , Raed Salem , Rahul Rameshbabu , Roi Dayan , Saeed Mahameed , Steffen Klassert , Tariq Toukan Subject: [PATCH net 2/7] net/mlx5e: ipsec: Block eswitch mode changes before accessing priv->ipsec Date: Thu, 17 Sep 2026 20:54:28 +0300 Message-ID: <20260917175433.4090878-3-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260917175433.4090878-1-tariqt@nvidia.com> References: <20260917175433.4090878-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00020E66:EE_|DM4PR12MB6256:EE_ X-MS-Office365-Filtering-Correlation-Id: f69cf094-666f-4d93-409d-08df14e6f748 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|36860700016|376014|7416014|82310400026|1800799024|56012099006|10067099003|22082099003|18002099003|6133799003|11063799006; X-Microsoft-Antispam-Message-Info: CG6+bOZuFStunIbTlVD8jk1uAMAMR12IySBlsMiifY2s+JqTr85nO0ktIq8qn1jLkL1tF0vZGw7ldotiqA3+nHTPbI1gpHsfrzPCXj9jPjJ4r4b/0VaMfNz7j3XG3f54WrW8R1EJQ25175laND/EzlhM8E1nZhTclHsRuflVBjFAt6EXRHIGVpaiVWwGHrAhabN8L46Cy6t5eefkmgSxAKRSrw7Tg07Qj/lx0W5jKGVdfEALUwYLtpuEslBDB20cVs32/6isJG9/bo2lnOWyqksW4eUfjEDJHKIQEhwa4b898WkOu6a/JabMSRjIEBngx+zbzr2y6plyawlDSTMhSjhbGIu4zWyRyRNQ8cXncxVxgduzSFbHD0f7yrfJruxwhtKwHgw0i9CY23ycPSPVBn1J5HH3D/hLbzs63PIu4+b8MAE+f+BsGKtsxQTz9xn2ZJlq3LClzKa9+DKY+Kji9/q615DZu9MZLL5PvwgXbDEIjVO8lY3rbIBtEW9HbZOtdMm5kY35tTxD3otPpPxX4ua6gdXOnYqR8SEEtcWR41QoFG54qKjw9M8fpLnGkl0JyjnReITyk47hZM0D9BstdtHHl2QLAep6Hzbm0/JWOg5H6M5BjPTWipd8smIDTT3F9NJmjk/fNpXO7eComSnIpxzN2gP6xue6P/kmYpJH6h7jRoOYKzWHSpk7bGKCp0Ey4aWCyJ2xkyjXwjkBczXQ+g== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(36860700016)(376014)(7416014)(82310400026)(1800799024)(56012099006)(10067099003)(22082099003)(18002099003)(6133799003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: TPDX0CGcrndcOMzEUwqBGkRKBbD066mh/ZldXKkq9m12AWCqgRykjxunNKk28ZnOhwcgyyF1JAQHETZUDZ724NTJa3LG7P0BF6V9e0oggaRrAtvyBjvxUy+dUtU31Ynm5LZV3hn6YdFtQXL8GifwoVYJq/f3e8YPYeFvg4qv7drqavdLrpMKx8qYwpPacuV7IBzXt6n6wEQgPpV6EEskIDMIZpf7gnu6RQrkIffyaabVdVzL8ywc+8WYaYpVrOltr7MacxVAtHPS1Di8Z6tGy+RVzLMuoV4adsmJjDHDTNiQ7AB+Egw45S5y9pVj3o4Plsf4T+K7fE4J3JYH0DQhk+RQS+XDHNxkWI6bIJZQwvc3ggc+eDjhxkWGYSUE9v4iCBW6I/f3I8YQorWGpq2LIo2n/ChpmJxvVmGdsve/11MEYaFtAsNbWlIwMDRS8uPC X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Sep 2026 18:10:33.1889 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f69cf094-666f-4d93-409d-08df14e6f748 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00020E66.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB6256 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu mlx5e_xfrm_add_state() reads priv->ipsec and validates mode-dependent capabilities before blocking eswitch mode changes. A concurrent profile change can free the saved IPsec context and cause use-after-free. Move the mode block before the first context access and release it on all error paths. Keep the atomic acquire-placeholder path exempt, since it creates no hardware state and cannot take sleeping locks. Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode n= ot allowed") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec.c | 34 ++++++++++++------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/dri= vers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c index 841ecdc2c4d9..1488faece80e 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c @@ -771,6 +771,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, struct xfrm_state *x, struct netlink_ext_ack *extack) { + bool is_acq =3D x->xso.flags & XFRM_DEV_OFFLOAD_FLAG_ACQ; struct mlx5e_ipsec_sa_entry *sa_entry =3D NULL; bool allow_tunnel_mode =3D false; struct mlx5e_ipsec *ipsec; @@ -779,20 +780,30 @@ static int mlx5e_xfrm_add_state(struct net_device *de= v, int err; =20 priv =3D netdev_priv(dev); - if (!priv->ipsec) - return -EOPNOTSUPP; + if (!is_acq) { + err =3D mlx5_eswitch_block_mode(priv->mdev, true); + if (err) + return err; + } =20 ipsec =3D priv->ipsec; - gfp =3D (x->xso.flags & XFRM_DEV_OFFLOAD_FLAG_ACQ) ? GFP_ATOMIC : GFP_KER= NEL; + if (!ipsec) { + err =3D -EOPNOTSUPP; + goto unblock_mode; + } + + gfp =3D is_acq ? GFP_ATOMIC : GFP_KERNEL; sa_entry =3D kzalloc_obj(*sa_entry, gfp); - if (!sa_entry) - return -ENOMEM; + if (!sa_entry) { + err =3D -ENOMEM; + goto unblock_mode; + } =20 sa_entry->x =3D x; sa_entry->dev =3D dev; sa_entry->ipsec =3D ipsec; /* Check if this SA is originated from acquire flow temporary SA */ - if (x->xso.flags & XFRM_DEV_OFFLOAD_FLAG_ACQ) { + if (is_acq) { x->xso.offload_handle =3D (unsigned long)sa_entry; return 0; } @@ -806,10 +817,6 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, goto err_xfrm; } =20 - err =3D mlx5_eswitch_block_mode(priv->mdev, true); - if (err) - goto unblock_ipsec; - if (x->props.mode =3D=3D XFRM_MODE_TUNNEL && x->xso.type =3D=3D XFRM_DEV_OFFLOAD_PACKET) { allow_tunnel_mode =3D mlx5e_ipsec_fs_tunnel_allowed(sa_entry); @@ -817,7 +824,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, NL_SET_ERR_MSG_MOD(extack, "Packet offload tunnel mode is disabled due to encap settings"); err =3D -EINVAL; - goto unblock_mode; + goto unblock_ipsec; } } =20 @@ -893,12 +900,13 @@ static int mlx5e_xfrm_add_state(struct net_device *de= v, unblock_encap: if (allow_tunnel_mode) mlx5_eswitch_unblock_encap(priv->mdev); -unblock_mode: - mlx5_eswitch_unblock_mode(priv->mdev); unblock_ipsec: mlx5_eswitch_unblock_ipsec(priv->mdev); err_xfrm: kfree(sa_entry); +unblock_mode: + if (!is_acq) + mlx5_eswitch_unblock_mode(priv->mdev); NL_SET_ERR_MSG_WEAK_MOD(extack, "Device failed to offload this state"); return err; } --=20 2.44.0 From nobody Fri Sep 25 01:20:29 2026 Received: from CO1PR03CU002.outbound.protection.outlook.com (mail-westus2azon11010008.outbound.protection.outlook.com [52.101.46.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7AAF4B44C4; Thu, 17 Sep 2026 18:10:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.46.8 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668655; cv=fail; b=uafvN5XVHLKAwqaPdeFX2oH+uSLIHpYsZa1dyJidWr8iJ+mTjotlWSh/Spm7/+LX0Xhi+YA65WTzEKLsyeJIm5bgiyc0OUI+E1hz5EuKh7MBsDEJwPvK6yaa33Wn2XBJ7lMSSw+FFFujttXdsNLiLaEN19Y5+n5qfl2CtmxSICY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668655; c=relaxed/simple; bh=GSkGoa0wGuocpY5aB5vKv4k4Jgc2zzcc1ejX45Rdvww=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=qEXGCtkKWX2MTIFu1lZd2LwwyIVeydQaYqHbGorH+vLpJAtcPYZXoJ/QtN4H+kyByVU0nhdeTo2kkBvhvBdPnGKnEVZa1BVKwo9D+iScwQxR+pWN/pTR/xdYLvMUNo0YuObB0qrXPBaY0bj/HBp540px+tVlrmXTF4RXkaSOHeA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=LfUlC9A4; arc=fail smtp.client-ip=52.101.46.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="LfUlC9A4" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DUmspFgYy+//wTkNN1bVa9HI+y/yy1yrghg/+dOlZ0lGxT2vwyvTjM+01XNAU9ttLvYQZ5OKTcWnNdqX7j6x9l+kUF4+u5eyBLziodf/N7tMp9SrAOvsV/DouRH478NDeCO0H1tsGTFWF/4BSLQYXQSUzcGf9O5fbJj/ly6BCppIWrV7fJioeTURCV7LFk1JuZgFEGDXTHUhPkUw0QCb3KrjpkfvKTNne+6Ci96FbCmtJmBJpywsTeJITnNWLT0+l//4vBBbNjMsLe9ttCnSOzB7IFZzN1FSCS1kybG29TQENvh8vQ7HlfjB5GMFLwMJ3VRKdrivynIrqHbsgfi/ow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Opjfy1e6VZR0xpq9NLcZbA1S3ltbenwjo43efOWL8go=; b=lBmoo9nYY67sKGjXwhyTRVq8zzHY7c6UcEcTatekCUeussbmj2Y4qWqZHg9Q8V55eXi3Od6OqJS4Z183z7ps0RSw7n6yW3QU0Nq6G1skPWHEVOCvjqB43H33hgWsXyLZKm0MBcn2bn3lw9+zEgOFOzeQ6ls/hUHEJBIZvqp/kAsFtgWQUEkz46qvOsIS9eO7CxNIjyWtNxUjAUbkeY5lhYegZxMrBkSe2im+kZSj8/wu/4oO4Cqws3Q6I3YsqYPbSKsTci0XCW8IkDHWs/XHn5OHUkLyNxrqyTbEiyq558Gvu2wIFSKeJf9F+FW9zii3/vA1TzKM7bQSgdE+TSBIgQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Opjfy1e6VZR0xpq9NLcZbA1S3ltbenwjo43efOWL8go=; b=LfUlC9A41epSxVTj+DOKD6gT2BP6cTLkkTzbfvCXwrHhVGEN+osxeTgtjiHmXgyJMhmmvtOlQ0osDyCtdkaLV/d49MMKVUuNwSz6bVsd3H69REU64o+xQ7nRmrV7fDeLRVXV+/LZCon5fA0YminPG5BGLxy21PRLPkTQLVO6Yy4WE6dEeDBXLFc+FMOUIO7Ia8SwfwO9/Tub7gUyGlNDaHbQKpybw5iYiDdZy3ARQYQD22JfHMNRmc9IocI+dAdD5CFNK8IoPmpCT4YNiFNzMvCgyJrBmXF3paWFE6HtSAcT2w4aqoTpUOPfn5ShO4hb7amejmuRDv78Rahn97i8oQ== Received: from BN1PR12CA0029.namprd12.prod.outlook.com (2603:10b6:408:e1::34) by DS7PR12MB8230.namprd12.prod.outlook.com (2603:10b6:8:ed::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.12; Thu, 17 Sep 2026 18:10:42 +0000 Received: from BL6PEPF00020E66.namprd04.prod.outlook.com (2603:10b6:408:e1:cafe::96) by BN1PR12CA0029.outlook.office365.com (2603:10b6:408:e1::34) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.12 via Frontend Transport; Thu, 17 Sep 2026 18:10:42 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BL6PEPF00020E66.mail.protection.outlook.com (10.167.249.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 17 Sep 2026 18:10:42 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:15 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:14 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.2562.49 via Frontend Transport; Thu, 17 Sep 2026 11:10:08 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Dragos Tatulea , Emeel Hakim , "Gal Pressman" , Jianbo Liu , Leon Romanovsky , open list , , Lior Nahmanson , Mark Bloch , Parav Pandit , Raed Salem , Rahul Rameshbabu , Roi Dayan , Saeed Mahameed , Steffen Klassert , Tariq Toukan Subject: [PATCH net 3/7] net/mlx5e: tc: Tie esw & accel blocking refs to the flow's lifetime Date: Thu, 17 Sep 2026 20:54:29 +0300 Message-ID: <20260917175433.4090878-4-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260917175433.4090878-1-tariqt@nvidia.com> References: <20260917175433.4090878-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00020E66:EE_|DS7PR12MB8230:EE_ X-MS-Office365-Filtering-Correlation-Id: 164e799f-baaf-4d07-b2a1-08df14e6fc8f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|82310400026|36860700016|23010399003|18002099003|22082099003|10067099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: vtNtKxngd91XOkYmNoxQmlSDkMGPjbWerJ/V0ZJn1yRdDHepJAqFfGYm+cOgR2JhJMGzlTl62wVCnsxQHMYx6Njh1w5n/clJvsc2q3Pb2g415w4en9gTl5+Y+6/jFlWa/WKFeGKIn7Ys2Qtiq1TNE46Rxdr40BXlX0AuceX51grQ/SIG1EA1S+7VyYuKjc4wVPGy7hgQnwLHsxi4pkgubimpmMhrLl1PGLp1p28GK65Eg2oB4t13JTICZaD0ImCv4D2dNtArUABEw+2DSbcHRUQo5fyuGCPytReszT2LhTrLquzZBjf0yGL7o/KxMIulHqXLM4pHaajqprM7oTqTQJ4l8n9u8OiT/Z48Tj+8R8wusR+ul/OY//haGCeuC8jI7muosziuxt8x1aeFgK/U4ZA0jwb/C9I0MEcbbSTs2mzUay5yTpeYCzkNwSfieXEJ2GvdhCN1SmFGqVBaTItnE97fmjdH5tzSfHJab41KyqeUtVqB2rzJucuV/Rt7cQePhcqa1Cn3S8KAo9j7V3lIx3wdWVnn8F77Acv3DvFOpjr3j1BwFmfCyTvPTInW0KpV07Dla77RPtFQSpI9JFLsNBetx87XG2Ocejc7bGertJO+PDYhE+skaP/MdmNlzJ3ZGcB9fiJO+39Y05rFLgu92VHS6kuB3+1mWG0V/+o8BmYNvylJFzck506Kpa9YQIeJ2R/llu8AhFkigHSVv8jLJQ== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(82310400026)(36860700016)(23010399003)(18002099003)(22082099003)(10067099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: bVcPBXVOuj0BtpgFZlmqnkcZwEHa12dETr0x4I/QGF+1TjEOisWnBKChlhV2FrxZ7VIbEnoq+gNEpfqD/+SMQqPe9NHLssmp7hBw6z0weVjcnyghiGoqn+KIWTvMPcEKtZwHG9cFvvUL7iJQrFipfMA08W5a2uH+HBJbu7yQUWB7ggKo5qydjrUsrVcHlt/BKVLI/zCfGmOQCC0PTvs3pFqDov5F8fS+D8d/ufPPeXwTh6laoKV+bbBZwU6UVMtwN+bPrTzwafvIaQu8TR5diEowkeNYaysIFIoU/hH33Z6qmDnYn7beI4ecaf9xLVxxBUXbwPfqH+GGAjmJT9tLjshwl9POml+QVm8vV4c/kAXU0z4ZMWrrC5knnenU7ZVo4c4o6bXZf/qR/aWExJNcoXBC5eyF7raz3JzxPzMHYmXJIs5rJkduLNk+ojplJLA2 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Sep 2026 18:10:42.0290 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 164e799f-baaf-4d07-b2a1-08df14e6fc8f X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00020E66.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB8230 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu TC flow creation acquires an esw user ref and, where required, an IPsec-blocking reference. mlx5e_delete_flower() releases these, but bulk cleanup (mlx5e_tc_nic_cleanup -> _mlx5e_tc_del_flow) destroys the remaining flows without releasing either. When bulk cleanup runs during suspend, the core device survives with stale counters, which can prevent subsequent eswitch mode changes and IPsec offload. For the same reason, two more bugs are that the refs are dropped in mlx5e_delete_flower(), before the flow is actually freed, leaving a window of time where: - a racing esw mode change could pull the rug from underneath the existing flow, leading to use after free. - new IPsec objects might be installed, violating the restriction of mutual exclusion between TC and IPsec. To fix these issues, this patch moves the reference acquisitions in mlx5e_alloc_flow(), before the HW objects are actually allocated, and moves the reference dropping to mlx5e_tc_del_flow(), after the HW objects are deallocated. Fixes: 7dc84de98bab ("net/mlx5: E-Switch, Protect changing mode while addin= g rules") Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclus= ive on a netdev") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 48 ++++++++++++------- 1 file changed, 30 insertions(+), 18 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/= ethernet/mellanox/mlx5/core/en_tc.c index b290beb4369a..44fc421e7b8c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -603,6 +603,10 @@ struct mlx5e_hairpin_entry { =20 static void mlx5e_tc_del_flow(struct mlx5e_priv *priv, struct mlx5e_tc_flow *flow); +static int mlx5e_tc_block_ipsec_offload(struct net_device *filter, + struct mlx5e_priv *priv); +static void mlx5e_tc_unblock_ipsec_offload(struct net_device *filter, + struct mlx5e_priv *priv); =20 struct mlx5e_tc_flow *mlx5e_flow_get(struct mlx5e_tc_flow *flow) { @@ -2158,13 +2162,16 @@ static void mlx5e_tc_del_fdb_peers_flow(struct mlx5= e_tc_flow *flow) static void mlx5e_tc_del_flow(struct mlx5e_priv *priv, struct mlx5e_tc_flow *flow) { + struct net_device *filter_dev =3D flow->attr->parse_attr->filter_dev; + bool peer =3D flow_flag_test(flow, PEER); + if (mlx5e_is_eswitch_flow(flow)) { struct mlx5_devcom_comp_dev *devcom =3D flow->priv->mdev->priv.eswitch->= devcom; =20 - if (flow_flag_test(flow, PEER) || + if (peer || !mlx5_devcom_for_each_peer_begin(devcom)) { mlx5e_tc_del_fdb_flow(priv, flow); - return; + goto out; } =20 mlx5e_tc_del_fdb_peers_flow(flow); @@ -2173,6 +2180,11 @@ static void mlx5e_tc_del_flow(struct mlx5e_priv *pri= v, } else { mlx5e_tc_del_nic_flow(priv, flow); } +out: + if (!peer) { + mlx5e_tc_unblock_ipsec_offload(filter_dev, flow->priv); + mlx5_esw_put(flow->priv->mdev); + } } =20 static bool flow_requires_tunnel_mapping(u32 chain, struct flow_cls_offloa= d *f) @@ -4463,6 +4475,7 @@ mlx5_free_flow_attr_actions(struct mlx5e_tc_flow *flo= w, struct mlx5_flow_attr *a static int mlx5e_alloc_flow(struct mlx5e_priv *priv, int attr_size, struct flow_cls_offload *f, unsigned long flow_flags, + struct net_device *filter_dev, struct mlx5e_tc_flow_parse_attr **__parse_attr, struct mlx5e_tc_flow **__flow) { @@ -4497,11 +4510,23 @@ mlx5e_alloc_flow(struct mlx5e_priv *priv, int attr_= size, init_completion(&flow->init_done); init_completion(&flow->del_hw_done); =20 + parse_attr->filter_dev =3D filter_dev; + attr->parse_attr =3D parse_attr; + /* Non-peer flows own the reservations until final destruction. */ + if (!flow_flag_test(flow, PEER)) { + err =3D mlx5e_tc_block_ipsec_offload(filter_dev, priv); + if (err) + goto err_free_attr; + mlx5_esw_get(priv->mdev); + } + *__flow =3D flow; *__parse_attr =3D parse_attr; =20 return 0; =20 +err_free_attr: + kfree(attr); err_free: kfree(flow); kvfree(parse_attr); @@ -4558,11 +4583,10 @@ __mlx5e_add_fdb_flow(struct mlx5e_priv *priv, flow_flags |=3D BIT(MLX5E_TC_FLOW_FLAG_ESWITCH); attr_size =3D sizeof(struct mlx5_esw_flow_attr); err =3D mlx5e_alloc_flow(priv, attr_size, f, flow_flags, - &parse_attr, &flow); + filter_dev, &parse_attr, &flow); if (err) goto out; =20 - parse_attr->filter_dev =3D filter_dev; mlx5e_flow_esw_attr_init(flow->attr, priv, parse_attr, f, in_rep, in_mdev); @@ -4712,7 +4736,7 @@ mlx5e_add_fdb_flow(struct mlx5e_priv *priv, mlx5e_tc_del_fdb_peers_flow(flow); mlx5_devcom_for_each_peer_end(devcom); clean_flow: - mlx5e_tc_del_fdb_flow(priv, flow); + mlx5e_flow_put(priv, flow); return err; } =20 @@ -4739,11 +4763,10 @@ mlx5e_add_nic_flow(struct mlx5e_priv *priv, flow_flags |=3D BIT(MLX5E_TC_FLOW_FLAG_NIC); attr_size =3D sizeof(struct mlx5_nic_flow_attr); err =3D mlx5e_alloc_flow(priv, attr_size, f, flow_flags, - &parse_attr, &flow); + filter_dev, &parse_attr, &flow); if (err) goto out; =20 - parse_attr->filter_dev =3D filter_dev; mlx5e_flow_attr_init(flow->attr, parse_attr, f); =20 err =3D parse_cls_flower(flow->priv, flow, &parse_attr->spec, @@ -4865,12 +4888,6 @@ int mlx5e_configure_flower(struct net_device *dev, s= truct mlx5e_priv *priv, if (!mlx5_esw_hold(priv->mdev)) return -EBUSY; =20 - err =3D mlx5e_tc_block_ipsec_offload(dev, priv); - if (err) - goto esw_release; - - mlx5_esw_get(priv->mdev); - rcu_read_lock(); flow =3D rhashtable_lookup(tc_ht, &f->cookie, tc_ht_params); if (flow) { @@ -4914,9 +4931,6 @@ int mlx5e_configure_flower(struct net_device *dev, st= ruct mlx5e_priv *priv, err_free: mlx5e_flow_put(priv, flow); out: - mlx5e_tc_unblock_ipsec_offload(dev, priv); - mlx5_esw_put(priv->mdev); -esw_release: mlx5_esw_release(priv->mdev); return err; } @@ -4957,8 +4971,6 @@ int mlx5e_delete_flower(struct net_device *dev, struc= t mlx5e_priv *priv, trace_mlx5e_delete_flower(f); mlx5e_flow_put(priv, flow); =20 - mlx5e_tc_unblock_ipsec_offload(dev, priv); - mlx5_esw_put(priv->mdev); return 0; =20 errout: --=20 2.44.0 From nobody Fri Sep 25 01:20:29 2026 Received: from BYAPR05CU005.outbound.protection.outlook.com (mail-westusazon11010038.outbound.protection.outlook.com [52.101.85.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FF354F85A6; Thu, 17 Sep 2026 18:10:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.85.38 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668662; cv=fail; b=cCZrlVzO22FU8ngT9d2AB17zyNUjfAuww1cbs/EgtH1n1s8Ahiu36ScKqjOVOpqTDPvyhhsUPdPZD7qwPgKMKTNHNLA0NvpLFh1MAZooAxlKWs+3xX/XxwjiLfa7VMuwHy5saZjjuROrlh/OvYky3eoi1+YnJnigV3JaPpYx/CQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668662; c=relaxed/simple; bh=x3L61W/0969CL++/jwdqGVpx4tVFYhuAfcv9v/fgqgg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cg4cWNxtsbX5YWvFEwjGae6862V/aIwOr8u3wfdmIekmzsdFGAY7SxZFyBXv6onHTxv6/VN6dRZRo16QQjBNgWOjEwYjehqYa5UzVA1a1/0sfX38l53AMrdSPKu9K/Ai6x1BsS+1+cAtTKpmFnbSK6duFGdN6YX7zXTZyE/hMcM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=W1TT/XJA; arc=fail smtp.client-ip=52.101.85.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="W1TT/XJA" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=nQ0msimck3a9MXeGGXM0o4BSb1p+VnfmhqTLPAMzf+bn9xDdJJhzsnd7uZaOUfCzL6gbAGYcsfeqxCnUZZEBVizGwczQcuQ4UVNLhX61yjrkddTVujPmXLoqpleofaWTyvfcPOinRNbqaZF/t6IBsSUEKnrk07hh0UNIe1Z7q3TCK37QHaZxCn2uzQkfA7S3ERoCmMbTsu1Cdn9HWPBE1l04o+N7NrRqN6HvMjE9jUOESxCiImNDwwElIW6Yo9FRzoWX6kkRyNwqGb+LHI2PaF6Q5vhDMtY5PtdGAKfBNMoq5w0x+xxRe1gdgpwgrdEPTcnDnbpETr9oHQTL9aL/Pg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OFFCLEh61YJYcReWClWUh9U+C45pSkuR7GCJx8igCro=; b=F0bSUAcoAwDebwPxrtdoh1XZsUcxL+rR/ImUJcX895YU75BRqSpJfxFyAvlBp/V1i7TalMyExMZpT3kTTIy2HxoRaU4OZMeW3houLfskgtcz/gouFxpsVqJ7zB0pL74CI6TTzpNtykspvQEXe3r8ckwaV9T3atyZHBu5ZZpw+6HJuzKlyCHOEHdtlc8lEZ+niRcbpM1SiDQhyzznu1/5E1pOZI7ZwTmHZDZWjipkE70MekSNm3lWnWLTl1JQO5edJxZbqQg12baicYOX1dxdxF2EUK7HIFUtulhKMIuq+VDq1KrcvvbC9GA35QljRQWxcpj12AZNjfPGhw2j8xOEkg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OFFCLEh61YJYcReWClWUh9U+C45pSkuR7GCJx8igCro=; b=W1TT/XJAyATEKUoxoZdC8A/sd/tYEI8YjCTWh9TbqW63u8+LSbXi/v5oRTZYwu5cCisshgUHzouiGqADG3GJUmqH2ABfkjoCZsHvNI+T+E2+cBJFL6WfWQ1kjCoFJ/h43f7m/3oJBkgrOtMu+INT5G2DM8gt4m4lNfGHBioiyE1uP/1ojcx0+PZp7ptSeqAkqG4xk2PCqDtOyASYuWHjPe7DJbaxSzYSkUC+7HmsPbblaugoc36dD2+Nfzex5Dyncd+KAbaz3Eg1FJsdHh+GcG4FaeFH2K8wdFVB8YvZDZknBjM5ZSYNf9kfDZUnhxGc4DvTqlSvT9Q42GCNcMvwWw== Received: from MW4PR04CA0189.namprd04.prod.outlook.com (2603:10b6:303:86::14) by DSWPR12MB999175.namprd12.prod.outlook.com (2603:10b6:8:36f::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.12; Thu, 17 Sep 2026 18:10:52 +0000 Received: from MWH0EPF000C6194.namprd02.prod.outlook.com (2603:10b6:303:86:cafe::8e) by MW4PR04CA0189.outlook.office365.com (2603:10b6:303:86::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.12 via Frontend Transport; Thu, 17 Sep 2026 18:10:51 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MWH0EPF000C6194.mail.protection.outlook.com (10.167.249.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Thu, 17 Sep 2026 18:10:51 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:22 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:21 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.2562.49 via Frontend Transport; Thu, 17 Sep 2026 11:10:15 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Dragos Tatulea , Emeel Hakim , "Gal Pressman" , Jianbo Liu , Leon Romanovsky , open list , , Lior Nahmanson , Mark Bloch , Parav Pandit , Raed Salem , Rahul Rameshbabu , Roi Dayan , Saeed Mahameed , Steffen Klassert , Tariq Toukan Subject: [PATCH net 4/7] net/mlx5e: macsec: Track hardware object ownership for SA teardown Date: Thu, 17 Sep 2026 20:54:30 +0300 Message-ID: <20260917175433.4090878-5-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260917175433.4090878-1-tariqt@nvidia.com> References: <20260917175433.4090878-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MWH0EPF000C6194:EE_|DSWPR12MB999175:EE_ X-MS-Office365-Filtering-Correlation-Id: 2ee977ce-4ae6-479a-91a0-08df14e701f5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|7416014|1800799024|82310400026|36860700016|6133799003|22082099003|18002099003|11063799006|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: IdH14gWaK1AKdedJbdWxL08P146ChBpSKYaaO3HYbLYkBhpiieLQkarRUYEINPC0OY9YKmT02oBqf55FMxM6Kc37zrjS2prTUFgQKO6AHm5d8/Ku2CVE0xFL5E0CPLI/4MSSBIbIAKEeHGr/cSclvrtBB/W2t69Yf2IGbjBLJLAtqJxH/fNvoQDGu++TacI7Nis4qE6W3KK4z8e5pv55Jim399W3XTCuKUp/PoCFctiP/6DtWwuM4/LH58IYRC/sc8Zf2geOJAyF4J+w1/e8eY6xNwuOkUUxEGcX9zE/Iokhuv+6bBI+nMIMl0gO4HncEeP2rgn8VE7tIVNZ97Ogh7JL2zXruLYEaNq3J7hvYCd+6R03qYZxRmrpFY9fbHb6MN7XycDENhfltQCCF6Mh7Mfz6JoRAC54NEgsPyMSRZ51GJeKfh2LYYhv+iIaxDDeOtMx+GeEnfPoGVeK+VN96zb6i5y2hjw2Ju2NDk5pLvgzei+koF6gOwuLNy26GdaSOs0QWBuzp/I1RLYgscGbOLunfFsJpYtz4ExClyWAooMXA6kWrQIH9G2KoMvH8Dy3f6bG1MPcXaar0sPU2H/Zgv9+umDC/PBLsfJRugT1DJgYe1ZvB9I18u8GCIt3gg5OAFZHSNN9trev9cBP13Axt+/ODORiUXEXvcrlMa153V89h1urAmiL/YOkLFhowxo1VDPl41RWPr0iLywA+swKSA== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(23010399003)(7416014)(1800799024)(82310400026)(36860700016)(6133799003)(22082099003)(18002099003)(11063799006)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: W8fXhGFVV2SgQyGMV7uPOLQAuDglXHfubgsIwnoByU0ihlF+zrRxwdwtYFXrO1CGdLwHyD5WYg1/FwP8Rp8H6btJtdNx90Si0MMAds4Mr+r8aHUG6kd4IQ7X2suKIk0VSXeX7ASOLmHy197oMpV7KdLKasz6A7yTClralmO2xT+nTa8asx7+A731D73vtlz5ZaekZiyue6YVoHT6cKZWfY3PAwRUgLNMkTbyn0u/NWb9Of/xSjr6rXE7eRkuF2EztyTwLVOBvS0zxi0btqdYuNO2kijvz5gcv7KYCPQ+pDMGKZnDt3G8QQf/tgwnG30z18EBzSfp8Wt68V//fXV/ZbeUaAn7ZtfULLUK9FMP2xRjiVPjha55DvEeS6c+PMTCo2g8sueyCExAtvJNlMhax0BhilxFO/dhrAJi/6DcD48LLacoB4JpWoMVWW3jfB3I X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Sep 2026 18:10:51.1329 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2ee977ce-4ae6-479a-91a0-08df14e701f5 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MWH0EPF000C6194.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DSWPR12MB999175 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu A driver MACsec SA can exist without a hardware MACsec object. Adding an inactive RX SA or a TX SA while the SecY is non-operational creates the encryption key but skips MACsec object creation. RX SA deactivation also destroys the hardware object while retaining the driver SA and its object ID. TX SA deletion and the SA teardown performed by RX SC and SecY deletion unconditionally destroy the hardware object. This can issue a destroy command with an unallocated zero ID or an ID that has already been destroyed and potentially reused. Failed RX SA activation can leave the same stale-ID state after steering creation unwinds. Track hardware object creation separately from SA activity. Set the ownership flag after successful creation, clear it on destruction and creation unwind, and check it before destroying the object during SA cleanup. This preserves destruction of objects retained by inactive TX SAs while avoiding destruction of unowned objects. Fixes: 8ff0ac5be144 ("net/mlx5: Add MACsec offload Tx command support") Fixes: aae3454e4d4c ("net/mlx5e: Add MACsec offload Rx command support") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/dr= ivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index daff53ba7d09..20eec345b36c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -58,6 +58,7 @@ struct mlx5e_macsec_async_work { =20 struct mlx5e_macsec_sa { bool active; + bool macsec_obj_created; u8 assoc_num; u32 macsec_obj_id; u32 enc_key_id; @@ -331,7 +332,10 @@ static void mlx5e_macsec_cleanup_sa(struct mlx5e_macse= c *macsec, struct net_device *netdev, u32 fs_id) { mlx5e_macsec_cleanup_sa_fs(macsec, sa, is_tx, netdev, fs_id); - mlx5e_macsec_destroy_object(macsec->mdev, sa->macsec_obj_id); + if (sa->macsec_obj_created) { + mlx5e_macsec_destroy_object(macsec->mdev, sa->macsec_obj_id); + sa->macsec_obj_created =3D false; + } } =20 static int mlx5e_macsec_init_sa_fs(struct macsec_context *ctx, @@ -396,6 +400,7 @@ static int mlx5e_macsec_init_sa(struct macsec_context *= ctx, if (err) goto destroy_macsec_object; } + sa->macsec_obj_created =3D true; =20 return 0; =20 --=20 2.44.0 From nobody Fri Sep 25 01:20:29 2026 Received: from CY3PR05CU001.outbound.protection.outlook.com (mail-westcentralusazon11013055.outbound.protection.outlook.com [40.93.201.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10FFF54707E; Thu, 17 Sep 2026 18:12:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.201.55 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668755; cv=fail; b=gu8173TKylZIZF4ddn+qXNZzpYYJTUDwy1xHDfbnx20c36zawt8mX5z6cQBuyERxqIzN7iIABzQWrVwfUj+eJhR+cUo+wAz08WaRh4M4k/20/rXpR9LD82yF3Uxn7BcNdJs1BvpFAHrHnCI6vlNgFdXzNmFQe21eHSL1jnZZCYY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668755; c=relaxed/simple; bh=PRvlz8O77LAlSYmvTMnIJPRJK9SrptuSrnJ2PJRJTo4=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mYkAppOOqf+qzLi+9yKhFAG17n8+SocLKVEFF20cob/f2hcm3GpBQbDo1vvK9tQb8QBrfRjWqC0e9t4qsMOAHpkzTkRo+ZdW6eLAhdFXz9Xh5L1fkl5/L9/Bw0FLemWIj2MJ9chs11F98aBInJxHS9V10oBccO9qLkT8M1Na+lA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=HM90mBrI; arc=fail smtp.client-ip=40.93.201.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="HM90mBrI" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HnHrgsffpVEkYbi5MWgmlgcWVkwP/KtSanC00SLMzGjcdqPzs9MhXXsj3Qm2WSINT4KNoPDgDFd4kerrN8Gph4ciyxkGX/AEmASJ5Bwoo/hU3SVWmMTwxZtUf/ErzS03RCtoZaltjjlX+a3/lhkAEi7PXpeaM9bbPx+UVDu9TtvoxFW6jH2P8yGlpfobmdTHr4qU5k24fxAEsUKPT0+YzzhZlD9lfE3kJko53y5LjFwUtbCvZd+L9Fpw7D6N//rXv135YtBMqF+z9mSd2MZGMxXLU/SCSCz90VsX5SDKOWwiKrf5jgTqCF0QUl96IwEVZ9VFpEpRwzmi+ASyzUUrMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=z+gktVwIRHfqEvzHQygtkfgvF600EDrKS62Me591WB8=; b=LExg+pLBmGOgffEEPXwjg02L3RGepM/5hPKKz3nd6jeub6eWI1CwTl/NW1qlChvFrpbI5VPbrkJ782WFYrHxolg2rxqzfYUKG+GYKWpaszMuPWx/qDVyN752LM3PgZlvDUrLBW3Z/xb4XgjKyFfRdp2MZcrrOUmJ4G9zZ0WtGdU+OTS+exJX5qIMm46Xwkj+1OTOQkVj8+lwENWK0Ni/7H1NtT+da6QvKmj2xk6QMBpfdFgz+UuiHA77ZY9ojo8Nbm77wtpi/cLVLeQQjvMbL8X8MQGX1a3RwrH26baRqvrXUAaMtQFeFkl8PjG7f9Pprz5+rOLJs96zShVw0GyDpg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=z+gktVwIRHfqEvzHQygtkfgvF600EDrKS62Me591WB8=; b=HM90mBrIhRfHt3qphMCtmYOXyajgUXoZXfHbUqdYiYllnmXKEwU0IRwWS96R+n8z9UtmiGW9//+pzIFr1JGiBrM9up+1LMXyUCeqYWkrN9U1DjxWk4ilK6STMQwePpdD7OxmNqwUmSMdf6qUnchu8yZGDxJaMxstQPcG64h9VbEqu/bMqDoMI7/bgYca8iwczSKaobq2Gu9lVZllXZ6hVp4u5yVbLRpclCX119W1i1pXL0zlW5jnXCU19Sb/H1FgjE+m6OgqB5VlgS8oMZ3t3JoR6yNMuy31GT7xrTicm13uG4Xo1bhrOJN5YWR/5mKHlC0OcQWMd9q49Lm0ZJK49w== Received: from MW3PR06CA0015.namprd06.prod.outlook.com (2603:10b6:303:2a::20) by SA1PR12MB7127.namprd12.prod.outlook.com (2603:10b6:806:29e::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Thu, 17 Sep 2026 18:11:02 +0000 Received: from MWH0EPF000C618E.namprd02.prod.outlook.com (2603:10b6:303:2a:cafe::4b) by MW3PR06CA0015.outlook.office365.com (2603:10b6:303:2a::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.12 via Frontend Transport; Thu, 17 Sep 2026 18:10:59 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MWH0EPF000C618E.mail.protection.outlook.com (10.167.249.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 17 Sep 2026 18:10:58 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:29 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:28 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.2562.49 via Frontend Transport; Thu, 17 Sep 2026 11:10:22 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Dragos Tatulea , Emeel Hakim , "Gal Pressman" , Jianbo Liu , Leon Romanovsky , open list , , Lior Nahmanson , Mark Bloch , Parav Pandit , Raed Salem , Rahul Rameshbabu , Roi Dayan , Saeed Mahameed , Steffen Klassert , Tariq Toukan Subject: [PATCH net 5/7] net/mlx5e: macsec: Delete remaining SecYs during cleanup Date: Thu, 17 Sep 2026 20:54:31 +0300 Message-ID: <20260917175433.4090878-6-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260917175433.4090878-1-tariqt@nvidia.com> References: <20260917175433.4090878-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MWH0EPF000C618E:EE_|SA1PR12MB7127:EE_ X-MS-Office365-Filtering-Correlation-Id: 7048d741-d595-43fa-69e9-08df14e7068f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|7416014|376014|82310400026|1800799024|36860700016|23010399003|6133799003|18002099003|22082099003|5023799004|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: hpsJQa1BiuUSR4pa+sJ8AWHPkbarf1YeGQFT2T4a1AaQ3ZZXsVLvztYkRlrOyEsR64gGqo0ACPfvJkhPnPkNepQhBpRCEY7ma1YHFSNukc1gP2rEdShbnWtcADFY4pAwCxaYe6T7c0cyGHhA87W44LFBFqybuylOJ0kIyJqnDF0Lc4nkWyob24ojlGXbpIZbNJkeIPEiX4K+hJXwTaixIPKTF58JQtTTzFXSCU7spJgFrLjd71HkWU/sn+lKF9C7zOFSi/JngaL7I+XQaGGYjKGfPJYEqCKpI4gFOQmtdUUpz49l1WHec1PtDriu/EKHJH8V/FQzxEQXyvutb2E8WuAs5yjv9X2MNNhfLlNBDXcozFxzKBmkmrFmzLc1l3XZHUZ2rixNS5PV7Nux4Lj/q/I+W6QF5ircFvsF+LGUeLrK/KCgNC8/FR/h9IpnsX+36LZGHR6+lB8h5gdh8kONoh9yyuM9ReFwQNoWBNKurdwjt3KPTPI1FmslsJK4UubnbRgiOkFhVllpp4sVmjnpdpgh2mXiTlZQnVDhNw5ICKIYzzwWAZyRkylD9SHH/DFG9Yh+9yjfYQ/vTUt5sSTAZsNliY1OpwYK1P12hbLI0RpYcuJkIRB1/pIKas9x/3F5pdfuv4KDn/rK7UAFvriUcSrCXA7KeLanZdlagGQXX1BTslfF1LwVSA/IDJ7/hKHaPQgHThh8bQuPgRVisnR36g== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(7416014)(376014)(82310400026)(1800799024)(36860700016)(23010399003)(6133799003)(18002099003)(22082099003)(5023799004)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: pQijS6vLcdKAjZO1DcVTw4oD7bOGe41BoqKzY9ctlIISke/e/tKhkTvkw6mDQg2Jmh4X4rjn2XhedoHS7tfsBAFtP3r9Q56YXQPVAOznKX/xS8OHaTZZN0SAZNZPtuDiqEbO+U9eSD9dmif85UDA2+30ZvixTkBg5YlE1ST/Tchk1Ry2q3KdBNbrdliE0V+U5I7cXt1SSjSyeOijI5MQWyQ5yeWFcizJQa/T+yTtKp4AP9isSuZStecmIPM+fXM4HjJEWPowlnzWGN84yK6Y97clcNqT2G52fuMEC5cAxp+Fi9h6YiSfv80YUG09bkVuAmAkaPZEN/qG7luzUCAwUcGcu2ZFSXHe5CggjyWsJ8MoJHz0JnRFpf5eT3LZxRn1pz4rrwpUz7C7ySUxoVoBIVYq/dgayE9rQ5l2oyoUgvcS9nrnl2tT+kDKZfBan8a5 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Sep 2026 18:10:58.8562 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 7048d741-d595-43fa-69e9-08df14e7068f X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MWH0EPF000C618E.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR12MB7127 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Suspend invokes MACsec cleanup without unregistering the netdev, so offloaded SecYs may still exist. Cleanup frees their owning context without deleting them, leaking driver state, encryption keys, MACsec objects and steering resources. This change deletes all remaining SecYs, which releases all HW objects and avoids leaks. But this only fixes resource teardown. On resume, the macsec driver may still potentially have a lot of state it considers offloaded, but the resumed device will have a clean slate. Fixing that is outside the scope of this patch. Fixes: 3fd3fb6b6b88 ("net/mlx5e: Move MACsec initialization from profile in= it stage to profile enable stage") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/macsec.c | 53 ++++++++++++------- 1 file changed, 35 insertions(+), 18 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/dr= ivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index 20eec345b36c..84ce388d3846 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -1238,33 +1238,21 @@ static int mlx5e_macsec_upd_secy(struct macsec_cont= ext *ctx) return err; } =20 -static int mlx5e_macsec_del_secy(struct macsec_context *ctx) +static void macsec_del_secy(struct mlx5e_macsec *macsec, + struct mlx5e_macsec_device *macsec_device) { - struct mlx5e_priv *priv =3D macsec_netdev_priv(ctx->netdev); - struct mlx5e_macsec_device *macsec_device; + struct net_device *netdev =3D (struct net_device *)macsec_device->netdev; struct mlx5e_macsec_rx_sc *rx_sc, *tmp; struct mlx5e_macsec_sa *tx_sa; - struct mlx5e_macsec *macsec; struct list_head *list; - int err =3D 0; int i; =20 - mutex_lock(&priv->macsec->lock); - macsec =3D priv->macsec; - macsec_device =3D mlx5e_macsec_get_macsec_device_context(macsec, ctx); - if (!macsec_device) { - netdev_err(ctx->netdev, "MACsec offload: Failed to find device context\n= "); - err =3D -EINVAL; - - goto out; - } - for (i =3D 0; i < MACSEC_NUM_AN; ++i) { tx_sa =3D macsec_device->tx_sa[i]; if (!tx_sa) continue; =20 - mlx5e_macsec_cleanup_sa(macsec, tx_sa, true, ctx->secy->netdev, 0); + mlx5e_macsec_cleanup_sa(macsec, tx_sa, true, netdev, 0); mlx5_destroy_encryption_key(macsec->mdev, tx_sa->enc_key_id); kfree(tx_sa); macsec_device->tx_sa[i] =3D NULL; @@ -1272,7 +1260,7 @@ static int mlx5e_macsec_del_secy(struct macsec_contex= t *ctx) =20 list =3D &macsec_device->macsec_rx_sc_list_head; list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) - macsec_del_rxsc_ctx(macsec, rx_sc, ctx->secy->netdev); + macsec_del_rxsc_ctx(macsec, rx_sc, netdev); =20 kfree(macsec_device->dev_addr); macsec_device->dev_addr =3D NULL; @@ -1280,7 +1268,24 @@ static int mlx5e_macsec_del_secy(struct macsec_conte= xt *ctx) list_del_rcu(&macsec_device->macsec_device_list_element); --macsec->num_of_devices; kfree(macsec_device); +} + +static int mlx5e_macsec_del_secy(struct macsec_context *ctx) +{ + struct mlx5e_priv *priv =3D macsec_netdev_priv(ctx->netdev); + struct mlx5e_macsec *macsec =3D priv->macsec; + struct mlx5e_macsec_device *macsec_device; + int err =3D 0; =20 + mutex_lock(&macsec->lock); + macsec_device =3D mlx5e_macsec_get_macsec_device_context(macsec, ctx); + if (!macsec_device) { + netdev_err(ctx->netdev, "MACsec offload: Failed to find device context\n= "); + err =3D -EINVAL; + goto out; + } + + macsec_del_secy(macsec, macsec_device); out: mutex_unlock(&macsec->lock); =20 @@ -1796,6 +1801,7 @@ int mlx5e_macsec_init(struct mlx5e_priv *priv) =20 void mlx5e_macsec_cleanup(struct mlx5e_priv *priv) { + struct mlx5e_macsec_device *macsec_device, *tmp; struct mlx5e_macsec *macsec =3D priv->macsec; struct mlx5_core_dev *mdev =3D priv->mdev; =20 @@ -1803,9 +1809,20 @@ void mlx5e_macsec_cleanup(struct mlx5e_priv *priv) return; =20 mlx5_notifier_unregister(mdev, &macsec->nb); - mlx5_macsec_fs_cleanup(mdev->macsec_fs); destroy_workqueue(macsec->wq); + + mutex_lock(&macsec->lock); + list_for_each_entry_safe(macsec_device, tmp, + &macsec->macsec_device_list_head, + macsec_device_list_element) + macsec_del_secy(macsec, macsec_device); + mutex_unlock(&macsec->lock); + + xa_destroy(&macsec->sc_xarray); + mlx5_macsec_fs_cleanup(mdev->macsec_fs); + mdev->macsec_fs =3D NULL; mlx5e_macsec_aso_cleanup(&macsec->aso, mdev); mutex_destroy(&macsec->lock); kfree(macsec); + priv->macsec =3D NULL; } --=20 2.44.0 From nobody Fri Sep 25 01:20:29 2026 Received: from BL0PR03CU003.outbound.protection.outlook.com (mail-eastusazon11012050.outbound.protection.outlook.com [52.101.53.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 339D94F93C4; Thu, 17 Sep 2026 18:11:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.53.50 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668678; cv=fail; b=Qpv7h/Luju/vYNkJO4cPP8s0OZkIOuShNJWTy2Vs4dIGr6rLztavO0NBKxNwQJ6m+bZRPGSRRsCmBjDJLVJLwRqQqhz8hamq5nHYIQlqJ7Z93/5CqeaXQJTWTlbRyFHYKkd6KQHiHt9yZ8/bkRhrCOI+2KB8w1o7uD9rajvdqzk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668678; c=relaxed/simple; bh=wRjnL6V9v3iKoWkgYcBRozar8i5dAVNoj+x0xmDE9aw=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Qc09nkcTmsvQ+JsChp5HBQmFHlOw/kyVz6cX61Dasm0PL8XW9eLVdW5+KfdbLB1gRg9tlHXG92dAevMzbK48Q9LaU7E8QCpCwD4ZePzoXeVwq5N7HRaE0x6l8YwfHSzZELCfYRKm10zy7IDLBxGWvEwh8ztd1VS1oN+9HfAbqMY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=BPkwmgSv; arc=fail smtp.client-ip=52.101.53.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="BPkwmgSv" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YBdNv2IlK+i/rLLr7cyLsVl8zqeZE85R+aWlP48DmisgXbgbUpAR+vcg83GjHluw+wWSpvvaSQcgvMrHUOgFqRw2n0PQQVIFQ0a/aY3kUOmqnXSKUjnH8e4ThFb1NcfXVZS0+AARsC9iK7vmpu4RCCe8P+4XbOW7Ncq37i1hMoLZPdeDugWxQAZjTgRhkrpcrIgY+bx1s8uAfIdnoJmVdGBWqkAcXOxsMoXOHgC6qi413mduFwZcXeGtwnIFhe015IWifeJ4nD3wSHrbFnTZCxHvlHmoD+TOxP297vNOarTO4oykn3I5Ld/5LiFoWL5oKXSVFz70OuT7mEOj4U+NNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LvLXZunHvYl2GT7QyEqEC0eoCQqHBTtaPy291Z5VHyQ=; b=ULRjf+Uq9b3BRZ5DkVjbLbpNqgwPnLJMLNKdAvPAxV6gLQ6QuXH4WteTtUvGwFGyaniDYErEuYLd9/Quf0sQ/sHRVgppyS4AQVeIu9UwWlqyfrpVrYKNxXkgk6EAWrF//meCJCdGok+F1PhVAHEUI5lYA+gIlgRZL0tVKnudm4q2eHt2ERAQlpaiAN3u/GEY3JCu6EOyCeJJJtC6ZuXK7hU5gbbzlJdhbL+iMrvs3aock2KvR3Zlrs6GSWvaoUhuVI6rZD+EgP2+6UPYjgPIewitM0qDHY0NGDlKYskHpKWlT/2bK4Hhly3amGYiozA/rn0937syC1xwxmTuXHw+dA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LvLXZunHvYl2GT7QyEqEC0eoCQqHBTtaPy291Z5VHyQ=; b=BPkwmgSvGnKST2mj7Cpxjf8+K4kVWEepW/61MfxYQWse35IZkpKYpYsZjTPwmnFipCDP1ael/j5nS7+u5PVtIsFTJLlJ2Wsfizv4Li3ePIto6iac485lCWzouKP5vbYzKqZS3CiVnOxt/8vfi7PbbaRmvWyFYXIMWYgM1rFB/bRs5fbONCo5l01xuZSwVj8cT+Q7C+kE5UUHrlxDs4sR5dxidYI0eY7inuWKFHbiRcUVLHjVYCjTGP6Y6s+WKLF6XgLy80JIuzmTf+lTFOCCgPQA7aBlAGMSYQH9hBv0aq9p0wk/XVJ1ZtBO9socrRMx5EvS21wQTMjMPpl8j6o1Hg== Received: from CH0PR03CA0216.namprd03.prod.outlook.com (2603:10b6:610:e7::11) by IA0PR12MB8327.namprd12.prod.outlook.com (2603:10b6:208:40e::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.12; Thu, 17 Sep 2026 18:11:06 +0000 Received: from BL6PEPF00020E61.namprd04.prod.outlook.com (2603:10b6:610:e7:cafe::2e) by CH0PR03CA0216.outlook.office365.com (2603:10b6:610:e7::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.12 via Frontend Transport; Thu, 17 Sep 2026 18:11:06 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BL6PEPF00020E61.mail.protection.outlook.com (10.167.249.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 17 Sep 2026 18:11:05 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:36 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:35 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.2562.49 via Frontend Transport; Thu, 17 Sep 2026 11:10:29 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Dragos Tatulea , Emeel Hakim , "Gal Pressman" , Jianbo Liu , Leon Romanovsky , open list , , Lior Nahmanson , Mark Bloch , Parav Pandit , Raed Salem , Rahul Rameshbabu , Roi Dayan , Saeed Mahameed , Steffen Klassert , Tariq Toukan Subject: [PATCH net 6/7] net/mlx5e: Serialize TC and IPsec offload exclusion counters Date: Thu, 17 Sep 2026 20:54:32 +0300 Message-ID: <20260917175433.4090878-7-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260917175433.4090878-1-tariqt@nvidia.com> References: <20260917175433.4090878-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00020E61:EE_|IA0PR12MB8327:EE_ X-MS-Office365-Filtering-Correlation-Id: b8ba8505-92a9-426e-f338-08df14e70aab X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|23010399003|376014|7416014|1800799024|56012099006|10067099003|11063799006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: 6GJlxSoq7MRJl7iRgEq0oaL443vvyn9ceUKXgh9tHOSwEn3JiGy5kM1sUUiuqaH9TbAqop6IHUH2imK++qevPBlkGGmgOHaR4VvhjcfGurY9AhpdBc73HIEm1idPVS9qb5S8MRabn7z2sZQFekQLczGSyeSL1blzDKvaOr/mWSv/dOBobEjRHpKXv/LjJi44SBpFzzz7DHQKq4WAaosjaSJc57s2NLkhzapcGl0MOmlYqaGPH+gAKEUULeF76tsmDtOaPBnfs9Xz3S4+KE2ptEYmvtwLFfHNdD6Vw51OmsYCrxm+ZYg3wdWLkxBye+6Qz1D1wGyp7Pl1ZMvPc0jMn62iPOU4+IBo22xiugbEkyNUlAB2LqZtO3f5jaQShvToidihns9Sdt/joRWSZ1/nCNQrBX97ZzoAiS1cl+0fSkJARt7WPPMIT7lgwUWe2ibTIm6xibJhoccmbGk4VT0434vtGODyc9u+WPcB/rOR90QrY8HeXuC0u0TSub5qBX3yFG0OUiA57EAsvK9odY7L+EkTZgzgoj0E3U0upj6t2T41GFHzB3WYKXCi/PF1/MOk3q6vYhbOBGu9ZPhCLuYZSBf5ZnNaCgqrD2T0s7eQLVXewktK+Pse5RpL3TELLEcCJbEqxv4B4d5fBu7l85wz6UR77lwSYi1Pz2etZ3liSqofycMNuaCm12rp/Fi72E2WEX3QL/9Y0oBv1w2BcyeiVg== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(23010399003)(376014)(7416014)(1800799024)(56012099006)(10067099003)(11063799006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ekK8epkDQbXR9py2GDULjTfjAi18uKvbs0BQAEx10IKcfif6SWMJqN6R8fMpmChAJSB8bUiPTKAGz9KprfJAhcIsjSc6EUFYmcuFZ3e8pdYorsI9tpxHb+G/cVx56HvA/NAV/VzSOLlZ5/Lx/EMMifbHxocSoljId5VECan7zp4vliT8NJARLwF1pN08zJViWKMzkvQR+o1vigHmE4J4zpxo+npHcWtEm8mI9pLBs5jHq5MS1pP37d22q4V6Kjnr6mQvrcUCK/RstaS7f1dUHq3SIRn5fywemFWS5wHUzVZWS309cecNol/cjcrIAQ7PHAV9O7I/C76RVTZBYGO28Hqspr/QRKcmhBB3D5mY61uHHSNqVgHFZivPyC1fMO+FJuy6ACjry26cTB63fNyXjlrlWY5MX4fP8QlNphc0xpJPj9UQjeJoxTpqqU8ptj5n X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Sep 2026 18:11:05.6939 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b8ba8505-92a9-426e-f338-08df14e70aab X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00020E61.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR12MB8327 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu The counters enforcing TC and IPsec packet offload mutual exclusion are not consistently serialized. The IPsec add path conditionally takes the eswitch write lock, but neither release path takes it. The TC add path only holds the eswitch read lock, and devices without an eswitch cannot rely on that lock at all. Concurrent read-modify-write operations on the same counter can lose an update. A stale nonzero count can keep rejecting offload requests after the last user has gone, while an undercount can allow conflicting offloads to coexist. Move the counters into mdev->offload_block and protect all checks, increments and decrements with a dedicated mutex. Keep the opposing-counter check and reservation in the same critical section, independent of eswitch availability. Initialize the lock for the core device lifetime and add warnings for unbalanced releases. Remove the now-unused mlx5_esw_lock() helper. Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclus= ive on a netdev") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 43 ++++++------------- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 18 +++++--- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 12 ------ .../net/ethernet/mellanox/mlx5/core/eswitch.h | 1 - .../net/ethernet/mellanox/mlx5/core/main.c | 3 ++ include/linux/mlx5/driver.h | 7 ++- 6 files changed, 32 insertions(+), 52 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 5c72656c623f..2b856d0db917 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -2574,45 +2574,26 @@ void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_p= riv *priv, void *ipsec_stats) } } =20 -#ifdef CONFIG_MLX5_ESWITCH static int mlx5e_ipsec_block_tc_offload(struct mlx5_core_dev *mdev) { - struct mlx5_eswitch *esw =3D mdev->priv.eswitch; - int err =3D 0; - - if (esw) { - err =3D mlx5_esw_lock(esw); - if (err) - return err; - } - - if (mdev->num_block_ipsec) { - err =3D -EBUSY; - goto unlock; - } + int ret =3D 0; =20 - mdev->num_block_tc++; - -unlock: - if (esw) - mlx5_esw_unlock(esw); - - return err; -} -#else -static int mlx5e_ipsec_block_tc_offload(struct mlx5_core_dev *mdev) -{ - if (mdev->num_block_ipsec) - return -EBUSY; + mutex_lock(&mdev->offload_block.lock); + if (mdev->offload_block.num_block_ipsec) + ret =3D -EBUSY; + else + mdev->offload_block.num_block_tc++; + mutex_unlock(&mdev->offload_block.lock); =20 - mdev->num_block_tc++; - return 0; + return ret; } -#endif =20 static void mlx5e_ipsec_unblock_tc_offload(struct mlx5_core_dev *mdev) { - mdev->num_block_tc--; + mutex_lock(&mdev->offload_block.lock); + if (!WARN_ON_ONCE(!mdev->offload_block.num_block_tc)) + mdev->offload_block.num_block_tc--; + mutex_unlock(&mdev->offload_block.lock); } =20 int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/= ethernet/mellanox/mlx5/core/en_tc.c index 44fc421e7b8c..89463d18880c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -4856,16 +4856,19 @@ static bool is_tc_ipsec_order_check_needed(struct n= et_device *filter, struct mlx static int mlx5e_tc_block_ipsec_offload(struct net_device *filter, struct = mlx5e_priv *priv) { struct mlx5_core_dev *mdev =3D priv->mdev; + int ret =3D 0; =20 if (!is_tc_ipsec_order_check_needed(filter, priv)) return 0; =20 - if (mdev->num_block_tc) - return -EBUSY; - - mdev->num_block_ipsec++; + mutex_lock(&mdev->offload_block.lock); + if (mdev->offload_block.num_block_tc) + ret =3D -EBUSY; + else + mdev->offload_block.num_block_ipsec++; + mutex_unlock(&mdev->offload_block.lock); =20 - return 0; + return ret; } =20 static void mlx5e_tc_unblock_ipsec_offload(struct net_device *filter, stru= ct mlx5e_priv *priv) @@ -4873,7 +4876,10 @@ static void mlx5e_tc_unblock_ipsec_offload(struct ne= t_device *filter, struct mlx if (!is_tc_ipsec_order_check_needed(filter, priv)) return; =20 - priv->mdev->num_block_ipsec--; + mutex_lock(&priv->mdev->offload_block.lock); + if (!WARN_ON_ONCE(!priv->mdev->offload_block.num_block_ipsec)) + priv->mdev->offload_block.num_block_ipsec--; + mutex_unlock(&priv->mdev->offload_block.lock); } =20 int mlx5e_configure_flower(struct net_device *dev, struct mlx5e_priv *priv, diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/ne= t/ethernet/mellanox/mlx5/core/eswitch.c index 0b48cc7a6734..989ca26e8851 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c @@ -3028,18 +3028,6 @@ int mlx5_esw_try_lock(struct mlx5_eswitch *esw, bool= check_users) return esw->mode; } =20 -int mlx5_esw_lock(struct mlx5_eswitch *esw) -{ - down_write(&esw->mode_lock); - - if (esw->eswitch_operation_in_progress) { - up_write(&esw->mode_lock); - return -EBUSY; - } - - return 0; -} - /** * mlx5_esw_unlock() - Release write lock on esw mode lock * @esw: eswitch device. diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/ne= t/ethernet/mellanox/mlx5/core/eswitch.h index 4a9a1656f6db..d52146cff496 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h @@ -947,7 +947,6 @@ void mlx5_esw_release(struct mlx5_core_dev *dev); void mlx5_esw_get(struct mlx5_core_dev *dev); void mlx5_esw_put(struct mlx5_core_dev *dev); int mlx5_esw_try_lock(struct mlx5_eswitch *esw, bool check_users); -int mlx5_esw_lock(struct mlx5_eswitch *esw); void mlx5_esw_unlock(struct mlx5_eswitch *esw); =20 void esw_vport_change_handle_locked(struct mlx5_vport *vport); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/e= thernet/mellanox/mlx5/core/main.c index 5f28d906c35b..46b34c80c458 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c @@ -1810,6 +1810,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int pro= file_idx) lockdep_register_key(&dev->lock_key); mutex_init(&dev->intf_state_mutex); lockdep_set_class(&dev->intf_state_mutex, &dev->lock_key); + mutex_init(&dev->offload_block.lock); mutex_init(&dev->mlx5e_res.uplink_netdev_lock); mutex_init(&dev->wc_state_lock); =20 @@ -1901,6 +1902,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int pro= file_idx) mutex_destroy(&priv->alloc_mutex); mutex_destroy(&priv->bfregs.wc_head.lock); mutex_destroy(&priv->bfregs.reg_head.lock); + mutex_destroy(&dev->offload_block.lock); mutex_destroy(&dev->intf_state_mutex); lockdep_unregister_key(&dev->lock_key); return err; @@ -1928,6 +1930,7 @@ void mlx5_mdev_uninit(struct mlx5_core_dev *dev) mutex_destroy(&priv->bfregs.reg_head.lock); mutex_destroy(&dev->wc_state_lock); mutex_destroy(&dev->mlx5e_res.uplink_netdev_lock); + mutex_destroy(&dev->offload_block.lock); mutex_destroy(&dev->intf_state_mutex); lockdep_unregister_key(&dev->lock_key); } diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 83d0a83bbfbc..4e207bf49c31 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -788,8 +788,11 @@ struct mlx5_core_dev { u32 vsc_addr; struct mlx5_hv_vhca *hv_vhca; struct mlx5_hwmon *hwmon; - u64 num_block_tc; - u64 num_block_ipsec; + struct { + struct mutex lock; + u64 num_block_tc; + u64 num_block_ipsec; + } offload_block; #ifdef CONFIG_MLX5_MACSEC struct mlx5_macsec_fs *macsec_fs; /* MACsec notifier chain to sync MACsec core and IB database */ --=20 2.44.0 From nobody Fri Sep 25 01:20:29 2026 Received: from PH7PR06CU001.outbound.protection.outlook.com (mail-westus3azon11010066.outbound.protection.outlook.com [52.101.201.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2FCA94F93BD; Thu, 17 Sep 2026 18:11:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.201.66 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668677; cv=fail; b=iTdC4tMNQKF/7++YQYSI6rXivo2WUNbt8reqBOHT86Npsdgplm4fXHW9/jBSObXA+8Yz8DTJDoh6No2KCqxNP428eVy5BBCuJUKgXAk++fBWlxfBVT4bmTwdBQHa49IOzevH+SZLD5anRBadNQHijUyNumJCRR0ofD8ipTNf01c= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789668677; c=relaxed/simple; bh=JY+425xCMi47BtA/EI1b8bFmU9+6jdynEQH6uhqDqVY=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=RCbAf2GhIg5OaGG6bFCbTYhCKG2Osn5C0hczaZ/RNJxk+6XEBcnnXOaa4R3Rh/S4BFiDUXUlRdQenmOpRIJ2RLsQdIq7H38y5jj9JPzZYlw8yZBlJPKzrKJNfP9C+1VIUI8T+L4TsGdNa0lfwlYi8MEzSJuvifpFFCARsyrXvX4= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=F6iPhFg1; arc=fail smtp.client-ip=52.101.201.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="F6iPhFg1" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tFF9vEh6z4zfSq8O2eRJ4Ig+iH9mKSqRJ3YinB3MjM00QfsyXaxp1JpV1NKIVlQgZmRyuDRQP4bRsl/Wuw3ALGl+/hkwHklzv0U8FAx8uCP2ags9Qm+CM6xVkklU39jV7Ho078Z6CG9W2oNCi5swOQltN9iHjVMUvUTqqWjQPjNlw2YqlozomYv4JCThheDrFfxQm23ZzTg6nHXZG2OjOLF+fWRgl/aUekU+wWTSucMKT4vet9of9jaateLa2YfDmHMgiBPFAAOm4+3F39eEwgI9yu6+M/wYzSQxSG62OVqnYPVxDOneRReONaJy7laHE+AVpjxUhM+Rk6iRWNmx9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1WSRkB9p7B1WkV0ZDmZT74nZ6lsqbxP/uKjSV608p5M=; b=v4clwhQnBJf8el+zyvzoxX/ap7h1wbv5x5S8udR2+6RFQ3zjDtKINZapzNUwX/qql8wiQ5EGO2QtKXLH7YJRcBnV55HsQPdfGvT6wz4/3rJuAyth4VgMWsV9jQhaXnHngIR1bw7H3knWo2xhWRcSYFjHWDJaRvA7uERs2ppHOUbBEyy33VVzm9n7DYMNPfXyJ7VhQ3mXdKGCLc0UjfUphL0zVCV/otpQ/ulk90oHeVgo5xGOTkVAZ1iWc0K1BfctkTUFhXFPP4EWlengEurD24Z8K4X9yw1abM42eUabVxVZtBHfnYFVXaKjZgNMs77Hi7EX/VTmrQr6phmBqSdNPg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1WSRkB9p7B1WkV0ZDmZT74nZ6lsqbxP/uKjSV608p5M=; b=F6iPhFg137SrpmL/KyqVgxAM5NAn7G48jEEDvdnRkju4ka3Bqjy5k+MblF4gYnp3+N6NhTOaTsa+wE5uDfJUd1s840u1E97IXd0R/u+bgK/agksv6zCIspu81jVQlJamarZBzNJoA/ZR85jEsoIkmO5Q4sG+IZiAIJcUgEhvBBAWxkS/p652bwA9z+j5FImEGx42mLdYE9rTpohKzSzF7nOGoBh/Xo2v3Y+N6NBUPzeS6g69NG1dpJ4UKyWdyZ1iC2VI0EghhQ0bb8UQBtMDlKz2fAPS33164wZrrOqlgyIxTGFLHHIjHBz6lbjPeu8Hm8e4lHFLwMOOzXKFVgZ5CQ== Received: from MW4PR04CA0188.namprd04.prod.outlook.com (2603:10b6:303:86::13) by PH0PR12MB8824.namprd12.prod.outlook.com (2603:10b6:510:26f::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.13; Thu, 17 Sep 2026 18:11:12 +0000 Received: from MWH0EPF000C6194.namprd02.prod.outlook.com (2603:10b6:303:86:cafe::8) by MW4PR04CA0188.outlook.office365.com (2603:10b6:303:86::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.12 via Frontend Transport; Thu, 17 Sep 2026 18:11:12 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MWH0EPF000C6194.mail.protection.outlook.com (10.167.249.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Thu, 17 Sep 2026 18:11:12 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:42 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Thu, 17 Sep 2026 11:10:42 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.2562.49 via Frontend Transport; Thu, 17 Sep 2026 11:10:36 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Dragos Tatulea , Emeel Hakim , "Gal Pressman" , Jianbo Liu , Leon Romanovsky , open list , , Lior Nahmanson , Mark Bloch , Parav Pandit , Raed Salem , Rahul Rameshbabu , Roi Dayan , Saeed Mahameed , Steffen Klassert , Tariq Toukan Subject: [PATCH net 7/7] net/mlx5e: shampo: Do not merge PSP packets Date: Thu, 17 Sep 2026 20:54:33 +0300 Message-ID: <20260917175433.4090878-8-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260917175433.4090878-1-tariqt@nvidia.com> References: <20260917175433.4090878-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MWH0EPF000C6194:EE_|PH0PR12MB8824:EE_ X-MS-Office365-Filtering-Correlation-Id: 5ca943b7-7acb-4100-f664-08df14e70e91 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|23010399003|7416014|376014|82310400026|36860700016|3023799007|10067099003|11063799006|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: jYmXe0XZLKsGLcBKHvYe/DXGU8ClOCRewjThWVEfEvEEslRNvzo2K591N0hksEAiMJLyXTTJn0PC+RRz39+p6DZOclvhuIQZvaFqov4ssvq+pc1Vzj4pG1VvxigF8dYTzC1orZLsfhSj0WHy29bDZAJmd3UWzz3r4AgHL+WY+q9jz4Q4+2qjnYQFECVS/9XvRIcWsv+sE9Cj37Uyn1MpTADNut3aRHoOON0mw6nJFdsN/Vj4dSW3m7OT7t6DQ487Cd+xWTHp5RJE+zkY6AJ7Daopu+pjU6Yx/A5rq3V7xHXO9hChjdt/R9hC27x97RfssxK/oer8ahGIHXt6moSBGy/nbvHGJKpwUA2b17MwDg2bVmSzVW/+BuEADgxDdtc1lyeTTAU/DduKz6UemiO/L1zoOw+516eJHw5Xr8yH+Gsgl+E5rRrMLd8vlnaNldH7Dd5z5eEuWUY/UTOpgtiyom0jTaQspgdZVjriAHeLxFaADOZr/v7ibuSDxxN+ivDLrV36zs/teN386al7iqqgs/YeiH5wGcfBl3RhVY/5tS6boufKqi4vKzuidF+BVs7vhnaCo30PTNH8AhOAdDbY9+VR2nDCwo89oSRZXc9piYd5HQJItjhIkPBvZ6xYvMOr4Gj2D6Wxwd7h2g5JmA2wnvXpV8fqkWPytiHpbRpHbkS5C0wpV0EZxssxpO7fCAzg27y5RqI+wto25E9iCmJYRA== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(7416014)(376014)(82310400026)(36860700016)(3023799007)(10067099003)(11063799006)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Aol9Azlu4LWugktsICgqFVEKKCDEwhvWursCyLRgxC8XZhX38Fc7NjcpOmPnnJUSYRuISLL0f4pwG2qqw27QqVynZu6dDpX1Q5jnFbHDIQ9GoHBwsQCMsbPqPJOxa1dqWAVwnAQBRkvci54wvjx6if0K+hHRikHVDyzh43tCAOozqfVD/iQAgVCdnSbiHfCJljhDyXJRE0/RPb85YCmXKINet00cPuspQdgYf/xazFcdoLLV1+E2KSYZMBtZCEqyXHI4Jmvmmv4v3ApLqMCFBs9oRcWT+BioBDa2VdVvmu8ykgTFZ0KshEsiTPAWfhoYC0CDoWesbvj23hQQF/ssdxf9frQczEW8mRkBUFdUBU7C2TFdlyim1p2q56xBaJLaSVzXCUO3geGhYn0Rkk/lK2TW/Gy1ka5VZes7CEx7n39B++InokPGMmoCIUq34W0x X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Sep 2026 18:11:12.2964 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5ca943b7-7acb-4100-f664-08df14e70e91 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MWH0EPF000C6194.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR12MB8824 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu PSP packets are UDP-encapsulated, and enabling HW GRO (SHAMPO in mlx5) makes it possible to merge those packets in a silly way: IP|UDP1|PSP1|payload1|UDP2|PSP2|payload2|... That happens because the HW GRO machinery doesn't know about PSP and considers it part of the UDP payload. This patch enforces no match in SW. Fixes: 29d7f433fcec ("net/mlx5e: Add Rx data path offload") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/= ethernet/mellanox/mlx5/core/en_rx.c index 7bd0606a5253..5e07cc8586f6 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -2224,6 +2224,16 @@ static bool mlx5e_hw_gro_skb_has_enough_space(struct= sk_buff *skb, return page_size * nr_frags + data_bcnt <=3D GRO_LEGACY_MAX_SIZE; } =20 +static bool mlx5e_hw_gro_psp_match(struct sk_buff *skb, struct mlx5_cqe64 = *cqe) +{ +#ifdef CONFIG_MLX5_EN_PSP + /* PSP packets cannot be merged. */ + return !mlx5e_psp_is_rx_flow(cqe); +#else + return true; +#endif +} + static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct m= lx5_cqe64 *cqe) { u16 data_bcnt =3D mpwrq_get_cqe_byte_cnt(cqe) - cqe->shampo.header_size; @@ -2266,8 +2276,9 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct m= lx5e_rq *rq, struct mlx5_cq } =20 if (*skb && - !(match && mlx5e_hw_gro_skb_has_enough_space(*skb, data_bcnt, - page_size))) { + !(match && + mlx5e_hw_gro_skb_has_enough_space(*skb, data_bcnt, page_size) && + mlx5e_hw_gro_psp_match(*skb, cqe))) { match =3D false; mlx5e_shampo_flush_skb(rq, cqe, match); } --=20 2.44.0