[PATCH] net/ice: fix L2TPv2 outer MAC address in training packet

[PATCH] net/ice: fix L2TPv2 outer MAC address in training packet

[Shaiq Wani]

flow rules with eth + l2tpv2 patterns fail to match because outer MACs
are written to the wrong location in the training packet.

The pre-scan loop does not detect L2TPV2, so tunnel_type is still 0
when the ETH item is parsed and MACs land in ext_data (inner) instead
of ext_data_outer. Also, ice_fdir_get_gen_prgm_pkt() uses the 'loc'
pointer (past the L2TPv2 header) instead of 'pkt' (Ethernet offset 0).

Detect L2TPV2 in pre-scan, and use 'pkt' for MAC insertion in all
four L2TPv2 training-packet cases.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Fixes: bf662653976e ("net/ice/base: support L2TPv2 flow rule")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
 drivers/net/intel/ice/base/ice_fdir.c   | 16 ++++++++--------
 drivers/net/intel/ice/ice_fdir_filter.c |  2 ++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/net/intel/ice/base/ice_fdir.c b/drivers/net/intel/ice/base/ice_fdir.c
index 2c0cb99854..e1d8b65972 100644
--- a/drivers/net/intel/ice/base/ice_fdir.c
+++ b/drivers/net/intel/ice/base/ice_fdir.c
@@ -4599,16 +4599,16 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 				     input->ip.v6.tc);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_CONTROL:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		ice_pkt_insert_u16(loc, ICE_IPV4_L2TPV2_LEN_SESS_ID_OFFSET,
 				   input->l2tpv2_data.session_id);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2:
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		flags_version = BE16_TO_CPU(input->l2tpv2_data.flags_version);
 		if (flags_version & ICE_L2TPV2_FLAGS_LEN) {
@@ -4622,16 +4622,16 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 		}
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_CONTROL:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		ice_pkt_insert_u16(loc, ICE_IPV6_L2TPV2_LEN_SESS_ID_OFFSET,
 				   input->l2tpv2_data.session_id);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2:
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		flags_version = BE16_TO_CPU(input->l2tpv2_data.flags_version);
 		if (flags_version & ICE_L2TPV2_FLAGS_LEN) {
diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index 3522d77123..1cbc613020 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1911,6 +1911,8 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 	for (item = pattern; item->type != RTE_FLOW_ITEM_TYPE_END; item++) {
 		if (item->type == RTE_FLOW_ITEM_TYPE_VXLAN)
 			tunnel_type = ICE_FDIR_TUNNEL_TYPE_VXLAN;
+		if (item->type == RTE_FLOW_ITEM_TYPE_L2TPV2)
+			tunnel_type = ICE_FDIR_TUNNEL_TYPE_L2TPV2;
 		/* To align with shared code behavior, save gtpu outer
 		 * fields in inner struct.
 		 */
-- 
2.43.0

Re: [PATCH] net/ice: fix L2TPv2 outer MAC address in training packet

[Bruce Richardson]

On Mon, Apr 06, 2026 at 01:43:55PM +0530, Shaiq Wani wrote:
> flow rules with eth + l2tpv2 patterns fail to match because outer MACs
> are written to the wrong location in the training packet.
> 
> The pre-scan loop does not detect L2TPV2, so tunnel_type is still 0
> when the ETH item is parsed and MACs land in ext_data (inner) instead
> of ext_data_outer. Also, ice_fdir_get_gen_prgm_pkt() uses the 'loc'
> pointer (past the L2TPv2 header) instead of 'pkt' (Ethernet offset 0).
> 
> Detect L2TPV2 in pre-scan, and use 'pkt' for MAC insertion in all
> four L2TPv2 training-packet cases.
> 
> Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
> Fixes: bf662653976e ("net/ice/base: support L2TPv2 flow rule")
> Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
> ---
>  drivers/net/intel/ice/base/ice_fdir.c   | 16 ++++++++--------
>  drivers/net/intel/ice/ice_fdir_filter.c |  2 ++
>  2 files changed, 10 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/intel/ice/base/ice_fdir.c b/drivers/net/intel/ice/base/ice_fdir.c
> index 2c0cb99854..e1d8b65972 100644
> --- a/drivers/net/intel/ice/base/ice_fdir.c
> +++ b/drivers/net/intel/ice/base/ice_fdir.c
> @@ -4599,16 +4599,16 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
>  				     input->ip.v6.tc);
>  		break;
>  	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_CONTROL:
> -		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
> -		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
> +		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
> +		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
>  					input->ext_data_outer.src_mac);
>  		ice_pkt_insert_u16(loc, ICE_IPV4_L2TPV2_LEN_SESS_ID_OFFSET,
>  				   input->l2tpv2_data.session_id);
>  		break;
>  	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2:
>  	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP:
> -		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
> -		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
> +		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
> +		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
>  					input->ext_data_outer.src_mac);
>  		flags_version = BE16_TO_CPU(input->l2tpv2_data.flags_version);
>  		if (flags_version & ICE_L2TPV2_FLAGS_LEN) {
> @@ -4622,16 +4622,16 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
>  		}
>  		break;
>  	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_CONTROL:
> -		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
> -		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
> +		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
> +		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
>  					input->ext_data_outer.src_mac);
>  		ice_pkt_insert_u16(loc, ICE_IPV6_L2TPV2_LEN_SESS_ID_OFFSET,
>  				   input->l2tpv2_data.session_id);
>  		break;
>  	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2:
>  	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP:
> -		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
> -		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
> +		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
> +		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
>  					input->ext_data_outer.src_mac);
>  		flags_version = BE16_TO_CPU(input->l2tpv2_data.flags_version);
>  		if (flags_version & ICE_L2TPV2_FLAGS_LEN) {

My concern with this change is that it makes the code different from all
the code surrouding it - all of which use "loc" rather than "pkt". While
there are some entries at the top of the function using pkt, almost all use
"loc". When do you need to use pkt vs loc? Should that be doucmented in a
comment in the function?

> diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
> index 3522d77123..1cbc613020 100644
> --- a/drivers/net/intel/ice/ice_fdir_filter.c
> +++ b/drivers/net/intel/ice/ice_fdir_filter.c
> @@ -1911,6 +1911,8 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
>  	for (item = pattern; item->type != RTE_FLOW_ITEM_TYPE_END; item++) {
>  		if (item->type == RTE_FLOW_ITEM_TYPE_VXLAN)
>  			tunnel_type = ICE_FDIR_TUNNEL_TYPE_VXLAN;
> +		if (item->type == RTE_FLOW_ITEM_TYPE_L2TPV2)
> +			tunnel_type = ICE_FDIR_TUNNEL_TYPE_L2TPV2;
>  		/* To align with shared code behavior, save gtpu outer
>  		 * fields in inner struct.
>  		 */

While I understand that both changes in this patch are to do with L2TP,
they actually appear as independent fixes. Consider splitting these into
two separate fix patches. [Note too how you have to describe them
separately in the commit log, and you have two fixlines for the patch]

/Bruce

Re: [PATCH] net/ice: fix L2TPv2 outer MAC address in training packet

[Bruce Richardson]

On Mon, Apr 06, 2026 at 01:43:55PM +0530, Shaiq Wani wrote:
> flow rules with eth + l2tpv2 patterns fail to match because outer MACs
> are written to the wrong location in the training packet.
> 
> The pre-scan loop does not detect L2TPV2, so tunnel_type is still 0
> when the ETH item is parsed and MACs land in ext_data (inner) instead
> of ext_data_outer. Also, ice_fdir_get_gen_prgm_pkt() uses the 'loc'
> pointer (past the L2TPv2 header) instead of 'pkt' (Ethernet offset 0).
> 
> Detect L2TPV2 in pre-scan, and use 'pkt' for MAC insertion in all
> four L2TPv2 training-packet cases.
> 
> Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
> Fixes: bf662653976e ("net/ice/base: support L2TPv2 flow rule")
> Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
> ---
>  drivers/net/intel/ice/base/ice_fdir.c   | 16 ++++++++--------
>  drivers/net/intel/ice/ice_fdir_filter.c |  2 ++
>  2 files changed, 10 insertions(+), 8 deletions(-)
> 
Recheck-request: iol-unit-arm64-testing, iol-intel-Functional, rebase=next-net-intel

[PATCH v3] net/ice: detect L2TPv2 tunnel type in pre-scan loop

[Shaiq Wani]

The pre-scan in ice_fdir_parse_pattern() recognises VXLAN and
GTPU items but not L2TPV2.  When an L2TPv2 item is present, tunnel_type
stays NONE, so the ETH item handler stores MAC addresses in the inner
ext_data struct instead of ext_data_outer resulting in rule not matching.

Add ICE_FDIR_TUNNEL_TYPE_L2TPV2 detection alongside the existing VXLAN
check.

Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
v3:
- Fixed check-patch issue.
v2:
- Split from combined outer-MAC patch into a seperate fix.

 drivers/net/intel/ice/ice_fdir_filter.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/intel/ice/ice_fdir_filter.c b/drivers/net/intel/ice/ice_fdir_filter.c
index 3522d77123..1cbc613020 100644
--- a/drivers/net/intel/ice/ice_fdir_filter.c
+++ b/drivers/net/intel/ice/ice_fdir_filter.c
@@ -1911,6 +1911,8 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 	for (item = pattern; item->type != RTE_FLOW_ITEM_TYPE_END; item++) {
 		if (item->type == RTE_FLOW_ITEM_TYPE_VXLAN)
 			tunnel_type = ICE_FDIR_TUNNEL_TYPE_VXLAN;
+		if (item->type == RTE_FLOW_ITEM_TYPE_L2TPV2)
+			tunnel_type = ICE_FDIR_TUNNEL_TYPE_L2TPV2;
 		/* To align with shared code behavior, save gtpu outer
 		 * fields in inner struct.
 		 */
-- 
2.43.0

[PATCH v3] net/ice: fix L2TPv2 outer MAC in training packet

[Shaiq Wani]

In ice_fdir_get_gen_prgm_pkt() there are two pointers into the
training-packet buffer:

pkt  – start of the full packet (outer Ethernet header, offset 0)
loc  – start of the current protocol segment; equals pkt for
       non-tunnel flows but points past the tunnel header for
       tunnel flows

The L2TPv2 cases wrote the outer source and destination MAC addresses
through loc.  For non-tunnel L2TPv2, loc == pkt so this happened to
work, but it is semantically wrong: outer Ethernet fields must always
be written relative to pkt so the code remains correct regardless of
the tunnel/non-tunnel path taken.

Replace loc with pkt in the four L2TPv2 MAC-insertion case blocks
(IPv4 control, IPv4 data/PPP, IPv6 control, IPv6 data/PPP)

Fixes: bf662653976e ("net/ice/base: support L2TPv2 flow rule")
Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
---
v3:
- Fixed checkpatch issue.
- Moved comment after all declarations.
v2:
- Split from combined outer-MAC patch into separate fix.
- Add comment documenting difference between pkt vs loc pointers.

 drivers/net/intel/ice/base/ice_fdir.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/net/intel/ice/base/ice_fdir.c b/drivers/net/intel/ice/base/ice_fdir.c
index 2c0cb99854..1846fbc515 100644
--- a/drivers/net/intel/ice/base/ice_fdir.c
+++ b/drivers/net/intel/ice/base/ice_fdir.c
@@ -3835,6 +3835,12 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 	u16 pos;
 	u16 offset;
 
+	/* pkt  = start of full packet buffer (outer Ethernet header, offset 0).
+	 * loc  = start of current protocol segment; equals pkt for non-tunnel
+	 *        flows, but points past the tunnel header for tunnel flows.
+	 * Use pkt for outer L2 fields, loc for the active segment.
+	 */
+
 	if (input->flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER) {
 		switch (input->ip.v4.proto) {
 		case ICE_IP_PROTO_TCP:
@@ -4599,16 +4605,16 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 				     input->ip.v6.tc);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_CONTROL:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		ice_pkt_insert_u16(loc, ICE_IPV4_L2TPV2_LEN_SESS_ID_OFFSET,
 				   input->l2tpv2_data.session_id);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2:
 	case ICE_FLTR_PTYPE_NONF_IPV4_L2TPV2_PPP:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		flags_version = BE16_TO_CPU(input->l2tpv2_data.flags_version);
 		if (flags_version & ICE_L2TPV2_FLAGS_LEN) {
@@ -4622,16 +4628,16 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 		}
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_CONTROL:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		ice_pkt_insert_u16(loc, ICE_IPV6_L2TPV2_LEN_SESS_ID_OFFSET,
 				   input->l2tpv2_data.session_id);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2:
 	case ICE_FLTR_PTYPE_NONF_IPV6_L2TPV2_PPP:
-		ice_pkt_insert_mac_addr(loc, input->ext_data_outer.dst_mac);
-		ice_pkt_insert_mac_addr(loc + ETH_ALEN,
+		ice_pkt_insert_mac_addr(pkt, input->ext_data_outer.dst_mac);
+		ice_pkt_insert_mac_addr(pkt + ETH_ALEN,
 					input->ext_data_outer.src_mac);
 		flags_version = BE16_TO_CPU(input->l2tpv2_data.flags_version);
 		if (flags_version & ICE_L2TPV2_FLAGS_LEN) {
-- 
2.43.0

Re: [PATCH v3] net/ice: detect L2TPv2 tunnel type in pre-scan loop

[Bruce Richardson]

On Thu, Apr 09, 2026 at 01:14:40PM +0530, Shaiq Wani wrote:
> The pre-scan in ice_fdir_parse_pattern() recognises VXLAN and
> GTPU items but not L2TPV2.  When an L2TPv2 item is present, tunnel_type
> stays NONE, so the ETH item handler stores MAC addresses in the inner
> ext_data struct instead of ext_data_outer resulting in rule not matching.
> 
> Add ICE_FDIR_TUNNEL_TYPE_L2TPV2 detection alongside the existing VXLAN
> check.
> 
> Fixes: 733640dae75e ("net/ice: support L2TPv2 flow pattern matching")
> Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Applied to dpdk-next-net-intel.

Thanks,
/Bruce

Re: [PATCH v3] net/ice: fix L2TPv2 outer MAC in training packet

[Bruce Richardson]

On Thu, Apr 09, 2026 at 01:14:41PM +0530, Shaiq Wani wrote:
> In ice_fdir_get_gen_prgm_pkt() there are two pointers into the
> training-packet buffer:
> 
> pkt  – start of the full packet (outer Ethernet header, offset 0)
> loc  – start of the current protocol segment; equals pkt for
>        non-tunnel flows but points past the tunnel header for
>        tunnel flows
> 
> The L2TPv2 cases wrote the outer source and destination MAC addresses
> through loc.  For non-tunnel L2TPv2, loc == pkt so this happened to
> work, but it is semantically wrong: outer Ethernet fields must always
> be written relative to pkt so the code remains correct regardless of
> the tunnel/non-tunnel path taken.
> 
> Replace loc with pkt in the four L2TPv2 MAC-insertion case blocks
> (IPv4 control, IPv4 data/PPP, IPv6 control, IPv6 data/PPP)
> 
> Fixes: bf662653976e ("net/ice/base: support L2TPv2 flow rule")
> Signed-off-by: Shaiq Wani <shaiq.wani@intel.com>
> ---
> v3:
> - Fixed checkpatch issue.
> - Moved comment after all declarations.
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Applied to dpdk-next-net-intel.

Thanks,
/Bruce