Re: [PATCH net-next V4 06/14] net/mlx5e: ipsec: Move RX marker from ft_metadata to flow_tag

[sashiko-bot@kernel.org]

> From: Cosmin Ratiu <cratiu@nvidia.com>
> 
> IPsec used BIT(31) in cqe.ft_metadata as a marker for ingress
> IPsec-decrypted packets. This will conflict with PSP which stores SPI
> in ft_metadata - an SPI with bit 31 set would falsely trigger
> mlx5_ipsec_is_rx_flow().
> 
> Define a new marker for IPsec in flow_tag and use it in steering rules.
> The obj_id stays in ft_metadata bits[23:0].
> Remove the unused MARKER and SYNDROM (sic) macros.
> 
> This is only done for IPsec NIC RX flows. The esw path uses a different
> mechanism and is unaffected: RX handling in mlx5e_rep_tc_receive() makes
> use of a few bits in ft_metadata to detect and hand off IPsec packets to
> mlx5e_ipsec_offload_handle_rx_skb().
> 
> An additional complication is that mlx5e_cqe_regb_chain() used the high
> order bits of ft_metadata to differentiate between TC chains and
> protocol markers. With the IPSec marker moving to flow_tag, this would
> falsely trigger mlx5e_cqe_regb_chain() to believe the chain is set, when
> in fact, ft_metadata is something completely different. Solve that by
> requiring that the new flow_tag proto is NONE, since only those packets
> can carry a chain id in ft_metadata.
> 
> Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
> Reviewed-by: Carolina Jubran <cjubran@nvidia.com>
> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908065244.3799142-1-tariqt@nvidia.com?part=6