[PATCH net v2] net/mlx5e: advertise MACsec offload only when supported

[PATCH net v2] net/mlx5e: advertise MACsec offload only when supported

[Ralf Lici]

Commit 339ccec8d43d ("net/mlx5: Enable MACsec offload feature for VLAN
interface") added NETIF_F_HW_MACSEC unconditionally to vlan_features so
that VLAN devices could inherit MACsec offload support.

mlx5e_build_nic_netdev subsequently copies vlan_features into
hw_features and features. As a result, all mlx5e NIC netdevices
advertise MACsec hardware offload, even when the firmware does not
support it and the driver does not install macsec_ops.

Set the MACsec feature bits in mlx5e_macsec_build_netdev, after device
capabilities have been validated. This preserves MACsec-over-VLAN
support and the ethtool feature control on capable devices, without
advertising either on unsupported hardware.

Fixes: 339ccec8d43d ("net/mlx5: Enable MACsec offload feature for VLAN interface")
Cc: stable@vger.kernel.org
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
---
The issue was reproduced on a ConnectX-4 Lx: ethtool -k reported
"macsec-hw-offload: on", while creating a MACsec interface with "offload
mac" failed with EOPNOTSUPP.

Changes since v1 https://lore.kernel.org/netdev/0a27c8b7308121fd00c528fc99fc3866782d3990.1786783174.git.ralf@mandelbit.com/
- Set NETIF_F_HW_MACSEC in hw_features as well, preserving ethtool
  configurability and restoration after an eswitch mode cycle (Sashiko).

 drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 2 ++
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c         | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
index daff53ba7d09..38a3415acf7a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
@@ -1724,6 +1724,8 @@ void mlx5e_macsec_build_netdev(struct mlx5e_priv *priv)
 	mlx5_core_dbg(priv->mdev, "mlx5e: MACsec acceleration enabled\n");
 	netdev->macsec_ops = &macsec_offload_ops;
 	netdev->features |= NETIF_F_HW_MACSEC;
+	netdev->hw_features |= NETIF_F_HW_MACSEC;
+	netdev->vlan_features |= NETIF_F_HW_MACSEC;
 	netif_keep_dst(netdev);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index f0407a850ea8..cb8ebca58ce8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -5851,7 +5851,6 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
 
 	netdev->vlan_features    |= NETIF_F_SG;
 	netdev->vlan_features    |= NETIF_F_HW_CSUM;
-	netdev->vlan_features    |= NETIF_F_HW_MACSEC;
 	netdev->vlan_features    |= NETIF_F_GRO;
 	netdev->vlan_features    |= NETIF_F_TSO;
 	netdev->vlan_features    |= NETIF_F_TSO6;

base-commit: e2466392a0b8496000e12181cb1ee1535eb0da25
-- 
2.54.0

Re: [PATCH net v2] net/mlx5e: advertise MACsec offload only when supported

[Ralf Lici]

Hi,

Gentle ping on this patch in case it got lost in the queue.

Please let me know if there are any comments or if you'd prefer a
respin.

Thanks.

-- 
Ralf Lici
Mandelbit Srl

Re: [PATCH net v2] net/mlx5e: advertise MACsec offload only when supported

[Tariq Toukan]

On 17/09/2026 10:10, Ralf Lici wrote:
> Hi,
> 
> Gentle ping on this patch in case it got lost in the queue.
> 
> Please let me know if there are any comments or if you'd prefer a
> respin.
> 
> Thanks.
> 

Hi,
Sorry for the delay, it was missed during August vacations.

Patch LGTM, you can re-send it yourself and add my tag:
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>

I can also do that, let me know.

Re: [PATCH net v2] net/mlx5e: advertise MACsec offload only when supported

[Ralf Lici]

On Thu, 17 Sep 2026 13:45:44 +0300, Tariq Toukan <tariqt@nvidia.com> wrote:
>
>
> On 17/09/2026 10:10, Ralf Lici wrote:
> > Hi,
> > 
> > Gentle ping on this patch in case it got lost in the queue.
> > 
> > Please let me know if there are any comments or if you'd prefer a
> > respin.
> > 
> > Thanks.
> > 
>
> Hi,
> Sorry for the delay, it was missed during August vacations.
>
> Patch LGTM, you can re-send it yourself and add my tag:
> Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
>
> I can also do that, let me know.
>

No problem, thanks for the review. I'll take care of the resend.

Cheers!

-- 
Ralf Lici
Mandelbit Srl