[PATCH v7 14/25] net/ixgbe: reimplement security parser

[Medvedkin, Vladimir]

Acked-by: Vladimir Medvedkin <vladimir.medvedkin at intel.com>

On 10/13/2026 1:03 PM, Anatoly Burakov wrote:
> Use the new flow graph API and common flow engine infrastructure to
> implement flow parser for security filter. As a result, flow item checks
> have become more stringent:
>
> - Mask is now explicitly validated to not have unsupported items in it,
>    when previously they were ignored
> - Mask is also validated to mask src/dst addresses, as otherwise it is
>    inconsistent with rte_flow API
> - The security engine was only looking for IPv4/IPv6 pattern items and
>    completely ignored both prefix and suffix. This logic has been replaced
>    by allowing [ETH]/IP/[UDP|ESP] patterns, as is used in ipsec-gw app
>
> Previously, security parser was a special case, now it is a first class
> citizen. All decryption SA tracking has been moved into the engine, as the
> engine is now the authoritative source of new Rx flows and the state of
> the Rx SA table (the Tx SA table is still up to IPsec code to manage).
>
> Because IPsec code does not manage the Rx SA table now, a synchronization
> mechanism is needed to prevent IPsec code from deallocating a security
> session when it is still referenced by security flows, so the security
> session is now atomically refcounted. For Tx, the refcount is effectively
> a noop, whereas for Rx it is now managed by rte_flow security engine.
>
> Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
> ---
>
-- 
Regards,
Vladimir