[PATCH v6 14/25] net/ixgbe: reimplement security parser

[Medvedkin, Vladimir]

Hi Anatoly,
one comment inline

On 10/9/2026 11:59 AM, Anatoly Burakov wrote:
> Use the new flow graph API and common flow engine infrastructure to
> implement flow parser for security filter. As a result, flow item checks
> have become more stringent:
>
> - Mask is now explicitly validated to not have unsupported items in it,
>    when previously they were ignored
> - Mask is also validated to mask src/dst addresses, as otherwise it is
>    inconsistent with rte_flow API
> - The security engine was only looking for IPv4/IPv6 pattern items and
>    completely ignored both prefix and suffix. This logic has been replaced
>    by allowing [ETH]/IP/[UDP|ESP] patterns, as is used in ipsec-gw app
>
> Previously, security parser was a special case, now it is a first class
> citizen. All decryption SA tracking has been moved into the engine, as the
> engine is now the authoritative source of new Rx flows and the state of
> the Rx SA table (the Tx SA table is still up to IPsec code to manage).
>
> Because IPsec code does not manage the Rx SA table now, a synchronization
> mechanism is needed to prevent IPsec code from deallocating a security
> session when it is still referenced by security flows, so the security
> session is now atomically refcounted. For Tx, the refcount is effectively
> a noop, whereas for Rx it is now managed by rte_flow security engine.
>
> Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
> ---
<snip>
>   static inline void
>   ixgbe_crypto_write_rx_ip(struct ixgbe_hw *hw, uint32_t idx,
>   		const struct ipaddr *ip, bool enable)
> @@ -137,195 +131,165 @@ ixgbe_crypto_clear_ipsec_tables(struct rte_eth_dev *dev)
>   		ixgbe_crypto_write_tx_key(hw, i, key, 0, false);
>   	}
>   
> -	memset(priv->rx_ip_tbl, 0, sizeof(priv->rx_ip_tbl));
> -	memset(priv->rx_sa_tbl, 0, sizeof(priv->rx_sa_tbl));
> -	memset(priv->tx_sa_tbl, 0, sizeof(priv->tx_sa_tbl));
> +	*priv->tx_sa_tbl = (struct ixgbe_crypto_tx_sa_table){0};
tx_sa_tbl is an array of 1024 elements. Do we really need to cleanup 
only the first one?
> +}
> +
<snip>

-- 
Regards,
Vladimir