From: Tariq Toukan <tariqt@nvidia.com>
To: Andrew Lunn <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, <netdev@vger.kernel.org>,
Paolo Abeni <pabeni@redhat.com>,
Sabrina Dubroca <sd@queasysnail.net>
Cc: Aleksandr Loktionov <aleksandr.loktionov@intel.com>,
Alexei Lazar <alazar@nvidia.com>,
Boris Pismenny <borisp@nvidia.com>,
Carolina Jubran <cjubran@nvidia.com>, Chris Mi <cmi@nvidia.com>,
Cosmin Ratiu <cratiu@nvidia.com>,
Daniel Zahka <daniel.zahka@gmail.com>,
Doruk Tan Ozturk <doruk@0sec.ai>,
Dragos Tatulea <dtatulea@nvidia.com>,
Gal Pressman <gal@nvidia.com>,
Jacob Keller <Jacob.e.keller@intel.com>,
Jianbo Liu <jianbol@nvidia.com>, Kees Cook <kees@kernel.org>,
Lama Kayal <lkayal@nvidia.com>, Leon Romanovsky <leon@kernel.org>,
<linux-kernel@vger.kernel.org>, <linux-kselftest@vger.kernel.org>,
<linux-rdma@vger.kernel.org>, Mark Bloch <mbloch@nvidia.com>,
"Patrisious Haddad" <phaddad@nvidia.com>,
Raed Salem <raeds@nvidia.com>,
Rahul Rameshbabu <rrameshbabu@nvidia.com>,
Saeed Mahameed <saeedm@nvidia.com>, Shuah Khan <shuah@kernel.org>,
Shuah Khan <skhan@linuxfoundation.org>,
Simon Horman <horms@kernel.org>,
Stanislav Fomichev <sdf@fomichev.me>,
Stanislav Fomichev <sdf.kernel@gmail.com>,
Tariq Toukan <tariqt@nvidia.com>
Subject: [PATCH net-next V2 06/13] net/mlx5e: ipsec: Move RX marker from ft_metadata to flow_tag
Date: Tue, 4 Aug 2026 11:35:28 +0300 [thread overview]
Message-ID: <20260804083535.2946459-7-tariqt@nvidia.com> (raw)
In-Reply-To: <20260804083535.2946459-1-tariqt@nvidia.com>
From: Cosmin Ratiu <cratiu@nvidia.com>
IPsec used BIT(31) in cqe.ft_metadata as a marker for ingress
IPsec-decrypted packets. This will conflict with PSP which stores SPI
in ft_metadata - an SPI with bit 31 set would falsely trigger
mlx5_ipsec_is_rx_flow().
Define a new marker for IPsec in flow_tag and use it in steering rules.
The obj_id stays in ft_metadata bits[23:0].
Remove the unused MARKER and SYNDROM (sic) macros.
This is only done for IPsec NIC RX flows. The esw path uses a different
mechanism and is unaffected: RX handling in mlx5e_rep_tc_receive() makes
use of a few bits in ft_metadata to detect and hand off IPsec packets to
mlx5e_ipsec_offload_handle_rx_skb().
An additional complication is that mlx5e_cqe_regb_chain() used the high
order bits of ft_metadata to differentiate between TC chains and
protocol markers. With the IPSec marker moving to flow_tag, this would
falsely trigger mlx5e_cqe_regb_chain() to believe the chain is set, when
in fact, ft_metadata is something completely different. Solve that by
requiring that the new flow_tag proto is NONE, since only those packets
can carry a chain id in ft_metadata.
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Carolina Jubran <cjubran@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
.../net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h | 4 +++-
.../net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 9 +++++++--
.../ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 9 +++++----
drivers/net/ethernet/mellanox/mlx5/core/en_tc.h | 7 +++++--
4 files changed, 20 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h
index 67f048ff7afe..8a02e8e9713d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h
@@ -13,13 +13,15 @@
*
* [23:21] = protocol ID (3 bits):
* 0 = none (default)
+ * 1 = IPsec
* 3 = PSP (HW decrypted, PSP header present)
- * 1,2,4-7 = reserved
+ * 2,4-7 = reserved
* [20:16] = reserved
* [15:0] = used by other subsystems (e.g. TC).
*/
#define MLX5E_ACCEL_FLOW_TAG_PROTO_MASK GENMASK(23, 21)
#define MLX5E_ACCEL_FLOW_TAG_PROTO_NONE (0 << 21)
+#define MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC (1 << 21)
#define MLX5E_ACCEL_FLOW_TAG_PROTO_PSP (3 << 21)
static inline u32 mlx5e_accel_flow_tag(struct mlx5_cqe64 *cqe)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
index f236672d3a2a..081cb2f31be0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
@@ -5,6 +5,7 @@
#include "en.h"
#include "en/fs.h"
#include "en_accel/en_accel.h"
+#include "en_accel/flow_tag.h"
#include "eswitch.h"
#include "ipsec.h"
#include "fs_core.h"
@@ -190,7 +191,7 @@ static void ipsec_rx_rule_add_match_obj(struct mlx5e_ipsec_sa_entry *sa_entry,
misc_parameters_2.metadata_reg_c_2);
MLX5_SET(fte_match_param, spec->match_value,
misc_parameters_2.metadata_reg_c_2,
- sa_entry->ipsec_obj_id | BIT(31));
+ sa_entry->ipsec_obj_id);
spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS_2;
}
@@ -2066,7 +2067,7 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
if (!attrs->drop) {
if (rx != ipsec->rx_esw)
err = setup_modify_header(ipsec, attrs->type,
- sa_entry->ipsec_obj_id | BIT(31),
+ sa_entry->ipsec_obj_id,
XFRM_DEV_OFFLOAD_IN, &flow_act);
else
err = mlx5_esw_ipsec_rx_setup_modify_header(sa_entry, &flow_act);
@@ -2099,6 +2100,10 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_DROP;
else
flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
+ if (!attrs->drop && rx != ipsec->rx_esw) {
+ spec->flow_context.flags |= FLOW_CONTEXT_HAS_TAG;
+ spec->flow_context.flow_tag = MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC;
+ }
dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
dest[0].ft = rx->ft.status;
dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h
index 45b0d19e735c..6dea5978a40e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h
@@ -38,10 +38,9 @@
#include <net/xfrm.h>
#include "en.h"
#include "en/txrx.h"
+#include "en_accel/flow_tag.h"
-/* Bit31: IPsec marker, Bit30: reserved, Bit29-24: IPsec syndrome, Bit23-0: IPsec obj id */
-#define MLX5_IPSEC_METADATA_MARKER(metadata) ((((metadata) >> 30) & 0x3) == 0x2)
-#define MLX5_IPSEC_METADATA_SYNDROM(metadata) (((metadata) >> 24) & GENMASK(5, 0))
+/* IPsec obj id in ft_metadata bits[23:0] */
#define MLX5_IPSEC_METADATA_HANDLE(metadata) ((metadata) & GENMASK(23, 0))
struct mlx5e_accel_tx_ipsec_state {
@@ -74,7 +73,9 @@ static inline unsigned int mlx5e_ipsec_tx_ids_len(struct mlx5e_accel_tx_ipsec_st
static inline bool mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 *cqe)
{
- return MLX5_IPSEC_METADATA_MARKER(be32_to_cpu(cqe->ft_metadata));
+ u32 proto = mlx5e_accel_flow_tag_proto(cqe);
+
+ return proto == MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC;
}
static inline bool mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg *eseg)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h
index e1b8cb78369f..53b6043e33d2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h
@@ -36,6 +36,7 @@
#include <net/pkt_cls.h>
#include "en.h"
#include "eswitch.h"
+#include "en_accel/flow_tag.h"
#include "en/tc_ct.h"
#include "en/tc_tun.h"
#include "en/tc/int_port.h"
@@ -370,11 +371,13 @@ struct mlx5e_tc_table *mlx5e_tc_table_alloc(void);
void mlx5e_tc_table_free(struct mlx5e_tc_table *tc);
static inline bool mlx5e_cqe_regb_chain(struct mlx5_cqe64 *cqe)
{
- u32 chain, reg_b;
+ u32 flow_tag, reg_b, chain;
+ flow_tag = mlx5e_accel_flow_tag_proto(cqe);
reg_b = be32_to_cpu(cqe->ft_metadata);
- if (reg_b >> (MLX5E_TC_TABLE_CHAIN_TAG_BITS + ESW_ZONE_ID_BITS))
+ if (flow_tag != MLX5E_ACCEL_FLOW_TAG_PROTO_NONE ||
+ (reg_b >> (MLX5E_TC_TABLE_CHAIN_TAG_BITS + ESW_ZONE_ID_BITS)))
return false;
chain = reg_b & MLX5E_TC_TABLE_CHAIN_TAG_MASK;
--
2.44.0
next prev parent reply other threads:[~2026-08-04 8:37 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-04 8:35 [PATCH net-next V2 00/13] net/mlx5e: Add support for HW-GRO to PSP Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 01/13] net/mlx5e: Generalize TC <-> IPsec mutual exclusion Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 02/13] net/mlx5e: ipsec: Block TC offload when IPsec is enabled Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 03/13] net/mlx5e: psp: Block TC offload when PSP " Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 04/13] net/mlx5e: macsec: Block TC offload when MACsec " Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 05/13] net/mlx5e: psp: Move RX marker from ft_metadata to flow_tag Tariq Toukan
2026-08-04 8:35 ` Tariq Toukan [this message]
2026-08-04 8:35 ` [PATCH net-next V2 07/13] net/mlx5e: macsec: " Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 08/13] net/mlx5e: psp: Handle HW-decapsulated RX PSP packets Tariq Toukan
2026-08-04 17:34 ` Daniel Zahka
2026-08-10 11:46 ` Cosmin Ratiu
2026-08-04 8:35 ` [PATCH net-next V2 09/13] net/mlx5e: psp: Add an rx_decap steering table Tariq Toukan
2026-08-04 17:19 ` Daniel Zahka
2026-08-10 11:48 ` Cosmin Ratiu
2026-08-04 8:35 ` [PATCH net-next V2 10/13] net/mlx5e: shampo: Flush session on PSP mismatch Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 11/13] net/mlx5e: psp: Dynamically reconfigure based on SHAMPO mode Tariq Toukan
2026-08-04 8:35 ` [PATCH net-next V2 12/13] selftests: drv-net: psp: Fix responder parsing Tariq Toukan
2026-08-08 0:58 ` Jakub Kicinski
2026-08-10 11:42 ` Cosmin Ratiu
2026-08-10 20:33 ` Jakub Kicinski
2026-08-11 12:41 ` Cosmin Ratiu
2026-08-04 8:35 ` [PATCH net-next V2 13/13] selftests: drv-net: psp: Add a test for PSP with HW-GRO Tariq Toukan
2026-08-04 18:05 ` Daniel Zahka
2026-08-10 11:52 ` Cosmin Ratiu
2026-08-08 1:00 ` Jakub Kicinski
2026-08-10 14:30 ` Cosmin Ratiu
2026-08-10 20:31 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260804083535.2946459-7-tariqt@nvidia.com \
--to=tariqt@nvidia.com \
--cc=Jacob.e.keller@intel.com \
--cc=alazar@nvidia.com \
--cc=aleksandr.loktionov@intel.com \
--cc=andrew+netdev@lunn.ch \
--cc=borisp@nvidia.com \
--cc=cjubran@nvidia.com \
--cc=cmi@nvidia.com \
--cc=cratiu@nvidia.com \
--cc=daniel.zahka@gmail.com \
--cc=davem@davemloft.net \
--cc=doruk@0sec.ai \
--cc=dtatulea@nvidia.com \
--cc=edumazet@google.com \
--cc=gal@nvidia.com \
--cc=horms@kernel.org \
--cc=jianbol@nvidia.com \
--cc=kees@kernel.org \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=lkayal@nvidia.com \
--cc=mbloch@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=phaddad@nvidia.com \
--cc=raeds@nvidia.com \
--cc=rrameshbabu@nvidia.com \
--cc=saeedm@nvidia.com \
--cc=sd@queasysnail.net \
--cc=sdf.kernel@gmail.com \
--cc=sdf@fomichev.me \
--cc=shuah@kernel.org \
--cc=skhan@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.