Re: [Intel-wired-lan] [PATCH iwl-next v2] ice: detect duplicates in ACL

> -----Original Message-----
> From: Marcin Szycik <[email protected]>
> Sent: Wednesday, July 29, 2026 3:05 PM
> To: [email protected]
> Cc: [email protected]; Nguyen, Anthony L
> <[email protected]>; Loktionov, Aleksandr
> <[email protected]>; Marcin Szycik
> <[email protected]>; Nowlin, Alexander
> <[email protected]>
> Subject: [PATCH iwl-next v2] ice: detect duplicates in ACL
>=20
> ntuple filters without masks (fdir) disallow duplicate entries. Extend
> this behaviour to rules with masks (ACL).
> Also skip checking ACL rules in ice_fdir_is_dup_fltr(), as it's only
> used for fdir.
>=20
> Keep the naming convention consistent with ice_fdir_is_dup_fltr() and
> ice_fdir_comp_rules(). ice_fdir_is_dup_fltr() cannot be reused
> directly, as it ignores masks.
>=20
> Before fix: duplicate rules with masks are allowed to be created and
> the duplicate rule cannot be removed:
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     Added rule with ID 31231
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     Added rule with ID 31230
>   sudo ethtool -N eth0 delete 31230
>   sudo ethtool -N eth0 delete 31231
>     rmgr: Cannot delete RX class rule: Invalid argument
>     Cannot delete classification rule
>=20
> After fix: duplicate rule is correctly detected:
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     Added rule with ID 31231
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     rmgr: Cannot insert RX class rule: Invalid argument
>     Cannot insert classification rule
>=20
> Fixes: 3272c00a1247 ("ice: create ACL entry")
> Reported-by: Alexander Nowlin <[email protected]>
> Signed-off-by: Marcin Szycik <[email protected]>
> ---
> v2:
> * Tweak ice_acl_is_dup_fltr() function doc and comments to accurately
>   reflect what is actually happening in the function
> * Add repro steps and expected behaviour to commit msg
> * ice_acl_comp_rules(): rename ipv4_equal -> base_equal in expectation
>   of future changes that might introduce more fields
> ---
> Not sending to net because the fixed code is on dev-queue.
> Tony, please squash this with the offending commit.
> ---
>  drivers/net/ethernet/intel/ice/ice_acl_main.c | 87
> +++++++++++++++++++
>  drivers/net/ethernet/intel/ice/ice_fdir.c     |  3 +
>  2 files changed, 90 insertions(+)
>=20
> diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> index 7c566077d55a..d13e8bc1b701 100644
> --- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> @@ -283,6 +283,85 @@ void ice_acl_replay_fltrs(struct ice_pf *pf)
>  	}
>  }
>=20
> +/**
> + * ice_acl_comp_rules - compare two ACL filters
> + * @a: first ACL filter
> + * @b: second ACL filter
> + *
> + * Return: true if a and b values and masks are identical, false
> +otherwise  */ static bool ice_acl_comp_rules(struct ice_ntuple_fltr
> *a,
> +struct ice_ntuple_fltr *b) {
> +	bool base_equal;
> +
> +	if (a->flow_type !=3D b->flow_type)
> +		return false;
> +
> +	base_equal =3D a->ip.v4.dst_ip =3D=3D b->ip.v4.dst_ip &&
> +		     a->ip.v4.src_ip =3D=3D b->ip.v4.src_ip &&
> +		     a->mask.v4.dst_ip =3D=3D b->mask.v4.dst_ip &&
> +		     a->mask.v4.src_ip =3D=3D b->mask.v4.src_ip;
> +
> +	switch (a->flow_type) {
> +	case ICE_FLTR_PTYPE_NONF_IPV4_TCP:
> +	case ICE_FLTR_PTYPE_NONF_IPV4_UDP:
> +	case ICE_FLTR_PTYPE_NONF_IPV4_SCTP:
> +		return base_equal &&
> +		       a->ip.v4.dst_port =3D=3D b->ip.v4.dst_port &&
> +		       a->ip.v4.src_port =3D=3D b->ip.v4.src_port &&
> +		       a->mask.v4.dst_port =3D=3D b->mask.v4.dst_port &&
> +		       a->mask.v4.src_port =3D=3D b->mask.v4.src_port;
> +	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
> +		return base_equal &&
> +		       a->ip.v4.l4_header =3D=3D b->ip.v4.l4_header &&
> +		       a->ip.v4.proto =3D=3D b->ip.v4.proto &&
> +		       a->ip.v4.ip_ver =3D=3D b->ip.v4.ip_ver &&
> +		       a->ip.v4.tos =3D=3D b->ip.v4.tos &&
> +		       a->mask.v4.l4_header =3D=3D b->mask.v4.l4_header &&
> +		       a->mask.v4.proto =3D=3D b->mask.v4.proto &&
> +		       a->mask.v4.ip_ver =3D=3D b->mask.v4.ip_ver &&
> +		       a->mask.v4.tos =3D=3D b->mask.v4.tos;
> +	default:
> +		return false;
> +	}
> +}
> +
> +/**
> + * ice_acl_is_dup_fltr - test if an ACL filter is already in the list
> + * @hw: hardware data structure
> + * @input: ACL filter to check
> + *
> + * Return: true if a filter with identical match criteria (same flow
> +type,
> + * values, and masks) already exists, unless it is at the same
> location
> +with a
> + * different queue (an update)
> + */
> +static bool
> +ice_acl_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
> {
> +	struct ice_ntuple_fltr *rule;
> +
> +	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> +		if (!rule->acl_fltr)
> +			continue;
> +
> +		if (!ice_acl_comp_rules(rule, input))
> +			continue;
> +
> +		/* At this point rule and input have same match
> criteria.
> +		 * Same location with a different queue is an update,
> not a
> +		 * duplicate - skip it. Everything else is a duplicate.
> +		 */
> +		if (rule->fltr_id =3D=3D input->fltr_id &&
> +		    rule->q_index !=3D input->q_index)
> +			continue;
> +
> +		return true;
> +	}
> +
> +	return false;
> +}
> +
>  /**
>   * ice_acl_add_rule_ethtool - add an ACL rule
>   * @vsi: pointer to target VSI
> @@ -322,6 +401,14 @@ int ice_acl_add_rule_ethtool(struct ice_vsi *vsi,
> struct ethtool_rxnfc *cmd)
>  	if (err)
>  		goto free_input;
>=20
> +	mutex_lock(&hw->fdir_fltr_lock);
> +	if (ice_acl_is_dup_fltr(hw, input)) {
> +		mutex_unlock(&hw->fdir_fltr_lock);
> +		err =3D -EINVAL;
> +		goto free_input;
> +	}
> +	mutex_unlock(&hw->fdir_fltr_lock);
> +
>  	memset(&acts, 0, sizeof(acts));
>  	if (fsp->ring_cookie =3D=3D RX_CLS_FLOW_DISC)
>  		ice_acl_set_act_drop(&acts[0]);
> diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.c
> b/drivers/net/ethernet/intel/ice/ice_fdir.c
> index 1bc91cb41769..1d79138683b0 100644
> --- a/drivers/net/ethernet/intel/ice/ice_fdir.c
> +++ b/drivers/net/ethernet/intel/ice/ice_fdir.c
> @@ -1261,6 +1261,9 @@ bool ice_fdir_is_dup_fltr(struct ice_hw *hw,
> struct ice_ntuple_fltr *input)
>  	bool ret =3D false;
>=20
>  	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> +		if (rule->acl_fltr)
> +			continue;
> +
>  		if (rule->flow_type !=3D input->flow_type)
>  			continue;
>=20
> --
> 2.49.0

Reviewed-by: Aleksandr Loktionov <[email protected]>