Re: [PATCH net-next V4 06/14] net/mlx5e: ipsec: Move RX marker from ft_metadata to flow_tag
From: sashiko-bot@kernel.org
Date: 2026-09-09 06:55:41
From: Cosmin Ratiu <redacted> IPsec used BIT(31) in cqe.ft_metadata as a marker for ingress IPsec-decrypted packets. This will conflict with PSP which stores SPI in ft_metadata - an SPI with bit 31 set would falsely trigger mlx5_ipsec_is_rx_flow(). Define a new marker for IPsec in flow_tag and use it in steering rules. The obj_id stays in ft_metadata bits[23:0]. Remove the unused MARKER and SYNDROM (sic) macros. This is only done for IPsec NIC RX flows. The esw path uses a different mechanism and is unaffected: RX handling in mlx5e_rep_tc_receive() makes use of a few bits in ft_metadata to detect and hand off IPsec packets to mlx5e_ipsec_offload_handle_rx_skb(). An additional complication is that mlx5e_cqe_regb_chain() used the high order bits of ft_metadata to differentiate between TC chains and protocol markers. With the IPSec marker moving to flow_tag, this would falsely trigger mlx5e_cqe_regb_chain() to believe the chain is set, when in fact, ft_metadata is something completely different. Solve that by requiring that the new flow_tag proto is NONE, since only those packets can carry a chain id in ft_metadata. Signed-off-by: Cosmin Ratiu <redacted> Reviewed-by: Carolina Jubran <redacted> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review · https://sashiko.dev/#/patchset/20260908065244.3799142-1-tariqt@nvidia.com?part=6