[PATCH 14/14] net/cnxk: fix custom inbound SA condition check
From: Rahul Bhansali <hidden>
Date: 2026-09-17 07:15:28
Subsystem:
networking drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
From: Rakesh Kudurumalla <redacted>
Custom inbound SA condition should be check when inbound SA create
and destroy.
Fixes: 7eaa499dd0c2 ("net/cnxk: support CN20K inline IPsec session")
Cc: stable@dpdk.org
Signed-off-by: Rakesh Kudurumalla <redacted>
---
drivers/net/cnxk/cn20k_ethdev_sec.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/cnxk/cn20k_ethdev_sec.c b/drivers/net/cnxk/cn20k_ethdev_sec.c
index b365426065..f648340445 100644
--- a/drivers/net/cnxk/cn20k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn20k_ethdev_sec.c@@ -805,9 +805,6 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con if (conf->protocol != RTE_SECURITY_PROTOCOL_IPSEC) return -ENOTSUP; - if (nix->custom_inb_sa) - return -ENOTSUP; - if (rte_security_dynfield_register() < 0) return -ENOTSUP;
@@ -832,6 +829,9 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con ipsec = &conf->ipsec; crypto = conf->crypto_xform; + if (nix->custom_inb_sa && ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) + return -ENOTSUP; + rc = cnxk_ipsec_xform_verify(ipsec, crypto); if (rc) { plt_err("Crypto xform verify failed, rc=%d", rc);
@@ -1083,7 +1083,7 @@ cn20k_eth_sec_session_destroy(void *device, struct rte_security_session *sess) eth_sec = cnxk_eth_sec_sess_get_by_sess(dev, sess); if (!eth_sec) return -ENOENT; - if (dev->nix.custom_inb_sa) + if (dev->nix.custom_inb_sa && eth_sec->inb) return -ENOTSUP; lock = eth_sec->inb ? &dev->inb.lock : &dev->outb.lock;
--
2.34.1