Commit 5ed47bd79ceb for kernel

commit 5ed47bd79cebee8429d06c6640aac7ac7c4805ca
Author: Cosmin Ratiu <cratiu@nvidia.com>
Date:   Wed Nov 11 10:13:37 2026 +0200

    net/mlx5e: IPsec, don't match upper proto selectors in crypto offload TX

    The mentioned commit introduced support for upper protocol selectors
    (protocol & ports) to mlx5 IPsec offload. In crypto offload mode this
    causes offloaded TX SAs to stop matching traffic.

    In tx_add_rule(), setup_fte_upper_proto_match() is called for all
    offload types and programs a match on the upper protocol (TCP/UDP) and
    ports. For crypto offload, setup_fte_esp() is then called and sets
    ip_protocol to ESP. The resulting rule requires both ESP as the IP
    protocol and TCP/UDP ports, which no packet can satisfy, so TX crypto
    offload silently stops working for such SAs.

    In crypto offload mode the stack builds the ESP packet and the HW only
    encrypts it, so the SA rule should only match on the SPI. Move the
    setup_fte_upper_proto_match() call under the XFRM_DEV_OFFLOAD_PACKET
    case, where the rule matches the plaintext packet and upper protocol
    selectors apply.

    The other three callers are unaffected: rx_add_rule_sa_selector() is
    already only invoked for packet offload, and tx_add_policy() /
    rx_add_policy() are only reachable in packet offload mode, since xfrm
    policy offload is exclusively of type XFRM_DEV_OFFLOAD_PACKET.

    Fixes: a7385187a386 ("net/mlx5e: IPsec, support upper protocol selector field offload")
    Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
    Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
    Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
    Link: https://patch.msgid.link/20261111081337.3129580-1-tariqt@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
index 55de9abbd72b..5c69e89b13a7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
@@ -2194,7 +2194,6 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
 	}

 	setup_fte_no_frags(spec);
-	setup_fte_upper_proto_match(spec, &attrs->upspec);

 	switch (attrs->type) {
 	case XFRM_DEV_OFFLOAD_CRYPTO:
@@ -2207,6 +2206,7 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
 		setup_fte_reg_a(spec);
 		break;
 	case XFRM_DEV_OFFLOAD_PACKET:
+		setup_fte_upper_proto_match(spec, &attrs->upspec);
 		setup_fte_reg_c4(spec, attrs->reqid);
 		err = setup_pkt_reformat(ipsec, attrs, &flow_act);
 		if (err)