2025-08-27, 18:51:49 -0700, Jakub Kicinski wrote:

On Tue, 26 Aug 2025 15:16:26 +0200 Sabrina Dubroca wrote:

quoted

This is equivalent to the existing checks allowing either
MACSEC_OFFLOAD_OFF or calling macsec_check_offload.

AFAICT "equivalent" is a bit misleading as we didn't have validation.
But seems low risk.

We didn't have validation, but macsec_check_offload would return false
if offload was not one of {MACSEC_OFFLOAD_PHY,MACSEC_OFFLOAD_MAC}.
So I don't think this is adding any constraints compared to what we
already did.

-- 
Sabrina