Re: [Intel-wired-lan] [PATCH iwl-next] ice: detect duplicates in ACL

> -----Original Message-----
> From: Intel-wired-lan <[email protected]> On Behalf
> Of Marcin Szycik
> Sent: Friday, July 24, 2026 11:45 AM
> To: [email protected]
> Cc: [email protected]; Nguyen, Anthony L
> <[email protected]>; Marcin Szycik
> <[email protected]>
> Subject: [Intel-wired-lan] [PATCH iwl-next] ice: detect duplicates in
> ACL
>=20
> Prevent duplicate rules from being added to ACL.
> Also skip checking ACL rules in ice_fdir_is_dup_fltr(), as it's only
> used for fdir.
>=20
Please add test info: HW/ASIC + PF/VF/SR-IOV, kernel version/branch, exact =
repro steps, before/after results (expected vs. observed).

> Fixes: fe9b91ade50e ("ice: create ACL entry")
> Signed-off-by: Marcin Szycik <[email protected]>
> ---
> Not sending to net because the fixed code is on dev-queue.
> Tony, please squash this with the offending commit.
> ---
>  drivers/net/ethernet/intel/ice/ice_acl_main.c | 87
> +++++++++++++++++++
>  drivers/net/ethernet/intel/ice/ice_fdir.c     |  3 +
>  2 files changed, 90 insertions(+)
>=20
> diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> index 7c566077d55a..473b329b37bb 100644
> --- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> @@ -283,6 +283,85 @@ void ice_acl_replay_fltrs(struct ice_pf *pf)
>  	}
>  }
>=20

...

> +/**
> + * ice_acl_is_dup_fltr - test if an ACL filter is already in the list
> + * @hw: hardware data structure
> + * @input: ACL filter to check
> + *
> + * Return: true if an identical filter (same flow type, values, and
> +masks)
> + * already exists at a different location  */ static bool
> +ice_acl_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
> {
> +	struct ice_ntuple_fltr *rule;
> +
> +	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> +		if (!rule->acl_fltr)
> +			continue;
> +
> +		if (!ice_acl_comp_rules(rule, input))
> +			continue;
> +
> +		/* At this point rule and input have same match
> criteria.
> +		 * Different location is a duplicate.
> +		 * Same location with a different queue is an update
> (not a
> +		 * duplicate).
> +		 */
> +		if (rule->fltr_id =3D=3D input->fltr_id &&
> +		    rule->q_index !=3D input->q_index)
> +			continue;
ice_acl_is_dup_fltr() documents that it returns true for an identical filte=
r at a different location,
but the implementation also returns true when the existing rule has the sam=
e fltr_id and the same q_index.
Documentation or implementation should be updated.

> +
> +		return true;
> +	}
> +
> +	return false;
> +}
> +

...

>  		if (rule->flow_type !=3D input->flow_type)
>  			continue;
>=20
> --
> 2.49.0