[PATCH 0/7] net/ice: L2TPv2 flow rule fixes

[PATCH 0/7] net/ice: L2TPv2 flow rule fixes

[Shaiq Wani]

The original L2TPv2 flow support (733640dae75e) mapped every PPP tunnel
variant to a single generic PTYPE and programmed both segments with
identical headers. This caused several interrelated problems:
cross-protocol matches, silent inner-field drops, rule deletion
failures, and unintended side-effects on GTP-U flows.

This series addresses each issue:

  1/7  Use the 30 granular HW PTYPEs (396-425) defined by the DDP
       package instead of the generic ICE_MAC_IPV4_L2TPV2, and
       extend the training-packet switch to cover the new flow types.

  2/7  Add the 8 missing tunnel inset-to-flow-field mappings so
       inner IP/L4 fields are no longer silently dropped during
       field parsing.

  3/7  Pass a segment index to ice_fdir_input_set_hdrs() and expand
       each L2TPv2/PPP ptype into its own case with distinct outer
       and inner header sets. Also always program inner-segment
       headers for tunnel profiles, even when no inner fields are
       extracted, so ptype-only narrowing works.

  4/7  Fix deletion of bare L2TPv2 rules (no PPP) by switching to a
       single-segment profile, and normalize the L2TPv2 flags in the
       SW hash key to prevent lookup mismatches.

  5/7  Stop L2TPv2 tunnel detection from overwriting the GTP-U
       tunnel profile, which caused GTP-U flow rules to fail.

  6/7  Invalidate stale HW profiles when the L2TPv2 subtype changes
       between rule creations.

  7/7  Pin the outer Ethertype (0x0800 / 0x86DD) in L2TPv2 rules
       so IPv4 and IPv6 flows are not cross-matched.

Shaiq Wani (7):
  net/ice: use granular PTYPEs for L2TPv2 PPP
  net/ice: add tunnel inset bits to flow input set map
  net/ice: fix L2TPv2 inner segment header setup
  net/ice: fix bare L2TPv2 flow rule deletion
  net/ice: fix GTP-U failure due to wrong tunnel profile
  net/ice: fix stale profile after L2TPv2 subtype change
  net/ice: pin outer Ethertype for L2TPv2 flow rules

 drivers/net/intel/ice/base/ice_fdir.c    |  12 ++
 drivers/net/intel/ice/ice_fdir_filter.c  | 215 +++++++++++++++++++++--
 drivers/net/intel/ice/ice_generic_flow.c |  28 +--
 3 files changed, 223 insertions(+), 32 deletions(-)

-- 
2.43.0

[PATCH 1/7] net/ice: use granular PTYPEs for L2TPv2 PPP

[Shaiq Wani]

All L2TPv2 PPP variants map to ICE_MAC_IPV4_L2TPV2 (398), so inner
protocol type is not differentiated, allowing cross-protocol flow
matches (e.g. a PPP/IPv4 rule hitting a PPP/IPv6 packet).

Fix ice_ptype_map[] to use the 30 granular L2TPv2 PTYPEs (396-425)
defined by the DDP package. Also add PPP inner protocol flow types to
ice_fdir_gen_l2tpv2_pkt() so training packets get dynamically built
L2TPv2 headers instead of static templates.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Fixes: bf662653976e ("net/ice/base: support L2TPv2 flow rule")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/base/ice_fdir.c    | 12 ++++++++++
 drivers/net/intel/ice/ice_generic_flow.c | 28 ++++++++++++------------
 2 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/drivers/net/intel/ice/base/ice_fdir.c b/drivers/net/intel/ice/base/ice_fdir.c
index 1846fbc515..a30e87ddcc 100644
--- a/drivers/net/intel/ice/base/ice_fdir.c
+++ b/drivers/net/intel/ice/base/ice_fdir.c
@@ -3886,6 +3886,12 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_CONTROL:
 		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2:
 		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP:
+		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV4:
+		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV4_UDP:
+		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV4_TCP:
+		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV6:
+		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV6_UDP:
+		case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV6_TCP:
 			offset = ICE_FDIR_IPV4_L2TPV2_PPP_PKT_OFF;
 			ice_fdir_gen_l2tpv2_pkt(pkt, &input->l2tpv2_data,
 						idx, offset, tun);
@@ -3893,6 +3899,12 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_CONTROL:
 		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2:
 		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP:
+		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV4:
+		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV4_UDP:
+		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV4_TCP:
+		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV6:
+		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV6_UDP:
+		case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV6_TCP:
 			offset = ICE_FDIR_IPV6_L2TPV2_PPP_PKT_OFF;
 			ice_fdir_gen_l2tpv2_pkt(pkt, &input->l2tpv2_data,
 						idx, offset, tun);
diff --git a/drivers/net/intel/ice/ice_generic_flow.c b/drivers/net/intel/ice/ice_generic_flow.c
index 62f0c334a1..f838a987e7 100644
--- a/drivers/net/intel/ice/ice_generic_flow.c
+++ b/drivers/net/intel/ice/ice_generic_flow.c
@@ -2183,21 +2183,21 @@ static struct ice_ptype_match ice_ptype_map[] = {
 	{pattern_eth_ipv4_ah,				ICE_MAC_IPV4_AH},
 	{pattern_eth_ipv4_l2tp,				ICE_MAC_IPV4_L2TPV3},
 	{pattern_eth_ipv4_udp_l2tpv2,		ICE_MAC_IPV4_L2TPV2},
-	{pattern_eth_ipv4_udp_l2tpv2_ppp,		ICE_MAC_IPV4_L2TPV2},
-	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv4,		ICE_MAC_IPV4_L2TPV2},
-	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv4_udp,	ICE_MAC_IPV4_L2TPV2},
-	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv4_tcp,	ICE_MAC_IPV4_L2TPV2},
-	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv6,		ICE_MAC_IPV4_L2TPV2},
-	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv6_udp,	ICE_MAC_IPV4_L2TPV2},
-	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv6_tcp,	ICE_MAC_IPV4_L2TPV2},
+	{pattern_eth_ipv4_udp_l2tpv2_ppp,		ICE_MAC_IPV4_PPPOL2TPV2},
+	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv4,		ICE_MAC_IPV4_PPPOL2TPV2_IPV4_PAY},
+	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv4_udp,	ICE_MAC_IPV4_PPPOL2TPV2_IPV4_UDP_PAY},
+	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv4_tcp,	ICE_MAC_IPV4_PPPOL2TPV2_IPV4_TCP},
+	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv6,		ICE_MAC_IPV4_PPPOL2TPV2_IPV6_PAY},
+	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv6_udp,	ICE_MAC_IPV4_PPPOL2TPV2_IPV6_UDP_PAY},
+	{pattern_eth_ipv4_udp_l2tpv2_ppp_ipv6_tcp,	ICE_MAC_IPV4_PPPOL2TPV2_IPV6_TCP},
 	{pattern_eth_ipv6_udp_l2tpv2,		ICE_MAC_IPV6_L2TPV2},
-	{pattern_eth_ipv6_udp_l2tpv2_ppp,		ICE_MAC_IPV6_L2TPV2},
-	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv4,		ICE_MAC_IPV6_L2TPV2},
-	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv4_udp,	ICE_MAC_IPV6_L2TPV2},
-	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv4_tcp,	ICE_MAC_IPV6_L2TPV2},
-	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv6,		ICE_MAC_IPV6_L2TPV2},
-	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv6_udp,	ICE_MAC_IPV6_L2TPV2},
-	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv6_tcp,	ICE_MAC_IPV6_L2TPV2},
+	{pattern_eth_ipv6_udp_l2tpv2_ppp,		ICE_MAC_IPV6_PPPOL2TPV2},
+	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv4,		ICE_MAC_IPV6_PPPOL2TPV2_IPV4_PAY},
+	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv4_udp,	ICE_MAC_IPV6_PPPOL2TPV2_IPV4_UDP_PAY},
+	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv4_tcp,	ICE_MAC_IPV6_PPPOL2TPV2_IPV4_TCP},
+	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv6,		ICE_MAC_IPV6_PPPOL2TPV2_IPV6_PAY},
+	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv6_udp,	ICE_MAC_IPV6_PPPOL2TPV2_IPV6_UDP_PAY},
+	{pattern_eth_ipv6_udp_l2tpv2_ppp_ipv6_tcp,	ICE_MAC_IPV6_PPPOL2TPV2_IPV6_TCP},
 
 	{pattern_eth_ipv4_pfcp,				ICE_MAC_IPV4_PFCP_SESSION},
 	{pattern_eth_ipv6,				ICE_PTYPE_IPV6_PAY},
-- 
2.43.0

[PATCH 2/7] net/ice: add tunnel inset bits to flow input set map

[Shaiq Wani]

Tunnel inset bits (ICE_INSET_TUN_IPV4_SRC, ICE_INSET_TUN_IPV4_DST,
ICE_INSET_TUN_IPV6_SRC/DST, ICE_INSET_TUN_TCP/UDP_SRC/DST_PORT) are
absent from ice_inset_map[], so inner IP/L4 fields for L2TPv2/PPP
tunnel flow rules are silently ignored during field parsing.

Add the 8 missing tunnel inset-to-flow-field mappings.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/ice_fdir_filter.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index ce80213429..5ee9edc442 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1004,6 +1004,14 @@ ice_fdir_input_set_parse(uint64_t inset, enum ice_flow_field *field)
 		{ICE_INSET_NAT_T_ESP_SPI, ICE_FLOW_FIELD_IDX_NAT_T_ESP_SPI},
 		{ICE_INSET_L2TPV2OIP_SESSION_ID, ICE_FLOW_FIELD_IDX_L2TPV2_SESS_ID},
 		{ICE_INSET_L2TPV2OIP_LEN_SESSION_ID, ICE_FLOW_FIELD_IDX_L2TPV2_LEN_SESS_ID},
+		{ICE_INSET_TUN_IPV4_SRC, ICE_FLOW_FIELD_IDX_IPV4_SA},
+		{ICE_INSET_TUN_IPV4_DST, ICE_FLOW_FIELD_IDX_IPV4_DA},
+		{ICE_INSET_TUN_IPV6_SRC, ICE_FLOW_FIELD_IDX_IPV6_SA},
+		{ICE_INSET_TUN_IPV6_DST, ICE_FLOW_FIELD_IDX_IPV6_DA},
+		{ICE_INSET_TUN_TCP_SRC_PORT, ICE_FLOW_FIELD_IDX_TCP_SRC_PORT},
+		{ICE_INSET_TUN_TCP_DST_PORT, ICE_FLOW_FIELD_IDX_TCP_DST_PORT},
+		{ICE_INSET_TUN_UDP_SRC_PORT, ICE_FLOW_FIELD_IDX_UDP_SRC_PORT},
+		{ICE_INSET_TUN_UDP_DST_PORT, ICE_FLOW_FIELD_IDX_UDP_DST_PORT},
 	};
 
 	for (i = 0, j = 0; i < RTE_DIM(ice_inset_map); i++) {
-- 
2.43.0

[PATCH 3/7] net/ice: fix L2TPv2 inner segment header setup

[Shaiq Wani]

ice_fdir_input_set_hdrs() sets identical headers on both outer and
inner segments and groups all PPP variants into a single fall-through,
so the HW cannot distinguish inner IPv4 from IPv6 or TCP from UDP.

Add a seg_idx parameter and expand each L2TPv2/PPP ptype into its own
case with per-segment header selection.  Also ensure the inner segment
headers are always programmed even when no inner fields are extracted,
so ptype-only narrowing works correctly.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/ice_fdir_filter.c | 160 +++++++++++++++++++++---
 1 file changed, 145 insertions(+), 15 deletions(-)

diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index 5ee9edc442..a0cddaeaef 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1022,7 +1022,8 @@ ice_fdir_input_set_parse(uint64_t inset, enum ice_flow_field *field)
 }
 
 static void
-ice_fdir_input_set_hdrs(enum ice_fltr_ptype flow, struct ice_flow_seg_info *seg)
+ice_fdir_input_set_hdrs(enum ice_fltr_ptype flow, struct ice_flow_seg_info *seg,
+		       int seg_idx)
 {
 	switch (flow) {
 	case ICE_FLTR_PTYPE_NONF_IPV4_UDP:
@@ -1130,16 +1131,77 @@ ice_fdir_input_set_hdrs(enum ice_fltr_ptype flow, struct ice_flow_seg_info *seg)
 				  ICE_FLOW_SEG_HDR_IPV_OTHER);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV4:
-	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV4_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV4_UDP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_UDP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV4_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_TCP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV6:
-	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV6_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV6_UDP:
-		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
-				  ICE_FLOW_SEG_HDR_PPP |
-				  ICE_FLOW_SEG_HDR_IPV6 |
-				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_UDP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP_IPV6_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_TCP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2:
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_CONTROL:
@@ -1148,16 +1210,77 @@ ice_fdir_input_set_hdrs(enum ice_fltr_ptype flow, struct ice_flow_seg_info *seg)
 				  ICE_FLOW_SEG_HDR_IPV_OTHER);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV4:
-	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV4_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV4_UDP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_UDP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV4_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_TCP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV6:
-	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV6_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV6_UDP:
-		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
-				  ICE_FLOW_SEG_HDR_PPP |
-				  ICE_FLOW_SEG_HDR_IPV4 |
-				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_UDP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP_IPV6_TCP:
+		if (seg_idx == 0)
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_L2TPV2 |
+					  ICE_FLOW_SEG_HDR_PPP |
+					  ICE_FLOW_SEG_HDR_IPV4 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		else
+			ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_TCP |
+					  ICE_FLOW_SEG_HDR_IPV6 |
+					  ICE_FLOW_SEG_HDR_IPV_OTHER);
 		break;
 
 	default:
@@ -1192,15 +1315,22 @@ ice_fdir_input_set_conf(struct ice_pf *pf, enum ice_fltr_ptype flow,
 	for (k = 0; k <= ICE_FD_HW_SEG_TUN; k++) {
 		seg = &seg_tun[k];
 		input_set = (k == ICE_FD_HW_SEG_TUN) ? inner_input_set : outer_input_set;
-		if (input_set == 0)
+		if (input_set == 0) {
+			/* For tunnel inner segment, always set headers for
+			 * correct ptype narrowing even if no fields extracted.
+			 */
+			if (k == ICE_FD_HW_SEG_TUN &&
+			    ice_fdir_is_tunnel_profile(ttype))
+				ice_fdir_input_set_hdrs(flow, seg, k);
 			continue;
+		}
 
 		for (i = 0; i < ICE_FLOW_FIELD_IDX_MAX; i++)
 			field[i] = ICE_FLOW_FIELD_IDX_MAX;
 
 		ice_fdir_input_set_parse(input_set, field);
 
-		ice_fdir_input_set_hdrs(flow, seg);
+		ice_fdir_input_set_hdrs(flow, seg, k);
 
 		for (i = 0; field[i] != ICE_FLOW_FIELD_IDX_MAX; i++) {
 			ice_flow_set_fld(seg, field[i],
-- 
2.43.0

[PATCH 4/7] net/ice: fix bare L2TPv2 flow rule deletion

[Shaiq Wani]

Bare L2TPv2 flow rules (no inner PPP) fail on deletion because
ice_fdir_is_tunnel_profile() forces a 2-segment profile with an empty
inner segment the NIC cannot remove. Reset tunnel_type to NONE when
no inner fields are present so a single-segment profile is used.

Also normalize L2TPv2 flags_version in the SW hash key to only the
CTRL/LEN/VER bits, preventing delete lookup mismatches when S/O/P
bits differ from the create path.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/ice_fdir_filter.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index a0cddaeaef..c2fd07e527 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1467,6 +1467,17 @@ ice_fdir_extract_fltr_key(struct ice_fdir_fltr_pattern *key,
 	rte_memcpy(&key->l2tpv2_data, &input->l2tpv2_data, sizeof(key->l2tpv2_data));
 	rte_memcpy(&key->l2tpv2_mask, &input->l2tpv2_mask, sizeof(key->l2tpv2_mask));
 
+	/* Normalize flags: keep only CTRL/LEN/VER bits that affect
+	 * FDIR extraction offsets. Subtypes differing only in S/O/P
+	 * share the same HW entry; masking prevents spurious SW hash
+	 * mismatches and delete failures.
+	 */
+	uint16_t fv_norm = rte_cpu_to_be_16(ICE_L2TPV2_FLAGS_CTRL |
+					     ICE_L2TPV2_FLAGS_LEN |
+					     ICE_L2TPV2_FLAGS_VER);
+	key->l2tpv2_data.flags_version &= fv_norm;
+	key->l2tpv2_mask.flags_version &= fv_norm;
+
 	key->tunnel_type = filter->tunnel_type;
 }
 
@@ -2930,6 +2941,14 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			flow_type = ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP;
 	}
 
+	/* Bare L2TPv2 (no inner fields) must use single-segment profile.
+	 * PPPoL2TPv2 rules must keep the tunnel profile even without
+	 * inner field values, so only reset when PPP is not present.
+	 */
+	if (tunnel_type == ICE_FDIR_TUNNEL_TYPE_L2TPV2 &&
+	    input_set_i == 0 && !ppp_present)
+		tunnel_type = ICE_FDIR_TUNNEL_TYPE_NONE;
+
 	filter->tunnel_type = tunnel_type;
 	filter->input.flow_type = flow_type;
 	filter->input_set_o = input_set_o;
-- 
2.43.0

[PATCH 5/7] net/ice: fix GTP-U failure due to wrong tunnel profile

[Shaiq Wani]

Remove GTP-U tunnel types from ice_fdir_is_tunnel_profile().
GTP-U uses a non-tunnel profile path and should not be marked
as tunnel, which causes training packet generation to fail.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/ice_fdir_filter.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index c2fd07e527..0531208066 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1393,9 +1393,7 @@ static int
 ice_fdir_is_tunnel_profile(enum ice_fdir_tunnel_type tunnel_type)
 {
 	if (tunnel_type == ICE_FDIR_TUNNEL_TYPE_VXLAN ||
-	    tunnel_type == ICE_FDIR_TUNNEL_TYPE_L2TPV2 ||
-	    tunnel_type == ICE_FDIR_TUNNEL_TYPE_GTPU ||
-	    tunnel_type == ICE_FDIR_TUNNEL_TYPE_GTPU_EH)
+	    tunnel_type == ICE_FDIR_TUNNEL_TYPE_L2TPV2)
 		return 1;
 	else
 		return 0;
-- 
2.43.0

[PATCH 6/7] net/ice: fix stale profile after L2TPv2 subtype change

[Shaiq Wani]

After a rule is destroyed, the HW profile for that ptype persists.
If a new rule with the same ptype but a different L2TPv2 subtype is
created (e.g. data then data_l), the old profile is reused via -EEXIST
with stale field extraction offsets.  Since data and data_l have
session_id at different byte offsets, the NIC matches on the wrong
field and packets with mismatched session_id incorrectly hit the rule.

Remove the HW profile in ice_fdir_destroy_filter when the last
filter for a given ptype is destroyed so the next rule creates a fresh
profile with the correct offsets.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/ice_fdir_filter.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index 0531208066..5ea74a4a5c 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1777,6 +1777,17 @@ ice_fdir_destroy_filter(struct ice_adapter *ad,
 
 	ice_fdir_cnt_update(pf, filter->input.flow_type, is_tun, false);
 
+	/* Remove the FDIR HW profile when no filters of this ptype
+	 * remain.  The profile encodes field extraction offsets that
+	 * vary between L2TPv2 subtypes (e.g. data vs data_l).  If the
+	 * profile is not removed, a subsequent rule with a different
+	 * subtype but the same ptype reuses the stale profile via
+	 * -EEXIST and the NIC extracts session_id from the wrong
+	 * offset, causing mismatched packets to hit the rule.
+	 */
+	if (pf->fdir_fltr_cnt[filter->input.flow_type][is_tun] == 0)
+		ice_fdir_prof_rm(pf, filter->input.flow_type, is_tun);
+
 	if (filter->mark_flag == 1)
 		ice_fdir_rx_parsing_enable(ad, 0);
 
-- 
2.43.0

[PATCH 7/7] net/ice: pin outer Ethertype for L2TPv2 flow rules

[Shaiq Wani]

L2TPv2 flow rules do not include the outer Ethertype in the input set,
so a rule created for outer IPv6 also matches packets with outer IPv4
(and vice versa). The hardware profile cannot distinguish the two
families because nothing in the match key differentiates them.

Add ICE_INSET_ETHERTYPE to input_set_o and set ext_data.ether_type to
0x0800 or 0x86DD based on the outer L3 item, so the profile includes
the Ethertype field and rejects cross-family mismatches.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/ice_fdir_filter.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index 5ea74a4a5c..2f843d66b9 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -2958,6 +2958,19 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 	    input_set_i == 0 && !ppp_present)
 		tunnel_type = ICE_FDIR_TUNNEL_TYPE_NONE;
 
+	/* Match outer IPv4/IPv6 for L2TPv2 via Ethertype. */
+	if (tunnel_type == ICE_FDIR_TUNNEL_TYPE_L2TPV2) {
+		if (l3 == RTE_FLOW_ITEM_TYPE_IPV4) {
+			input_set_o |= ICE_INSET_ETHERTYPE;
+			filter->input.ext_data.ether_type =
+				rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV4);
+		} else if (l3 == RTE_FLOW_ITEM_TYPE_IPV6) {
+			input_set_o |= ICE_INSET_ETHERTYPE;
+			filter->input.ext_data.ether_type =
+				rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV6);
+		}
+	}
+
 	filter->tunnel_type = tunnel_type;
 	filter->input.flow_type = flow_type;
 	filter->input_set_o = input_set_o;
-- 
2.43.0

回复: [PATCH 7/7] net/ice: pin outer Ethertype for L2TPv2 flow rules

[Jiale, SongX]

-----邮件原件-----
发件人: Shaiq Wani <shaiq.wani@intel.com> 
发送时间: 2026年4月27日 10:31
收件人: dev@dpdk.org; Richardson, Bruce <bruce.richardson@intel.com>; Singh, Aman Deep <aman.deep.singh@intel.com>
主题: [PATCH 7/7] net/ice: pin outer Ethertype for L2TPv2 flow rules

L2TPv2 flow rules do not include the outer Ethertype in the input set, so a rule created for outer IPv6 also matches packets with outer IPv4 (and vice versa). The hardware profile cannot distinguish the two families because nothing in the match key differentiates them.

Add ICE_INSET_ETHERTYPE to input_set_o and set ext_data.ether_type to
0x0800 or 0x86DD based on the outer L3 item, so the profile includes the Ethertype field and rejects cross-family mismatches.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
Tested-by: Jiale Song <songx.jiale@intel.com>