From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 68674EA3C5E for ; Thu, 9 Apr 2026 13:00:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id AC20860890; Thu, 9 Apr 2026 13:00:31 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Ga8hA14355ts; Thu, 9 Apr 2026 13:00:30 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org D067F608C0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1775739630; bh=U+AvPkcwmGpLWoOxWjOz4hJK93FfVtCD11FMzz4v4Pk=; h=From:To:Cc:Date:In-Reply-To:References:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=hjduMez3HWirgcfEe0253TCOXwOYB/Y8kAUI+2Q57CpmwaM87Uxkx6Q0eFkcGTyI9 KwZ6R0cj3cctT5kiehdoGQhrO/QcwmNGUgpZIcNUD4SusmnnEK0lFF65FsWuvlyM+6 vEVGL8PMcTSqopP5vhMUZsbZM+8X4y+E9xifell2wG1YzKOuwkZB32CBh78m8KQ0ic MCF6XO5MDu/8wWe0o03qChTxwLJdWYZLZWtpSRNnuRMotQv8tdcRF9N28b+akm7DVg PdhbHK7N0AkpcbP98jPEqucrHBF7VR6k5WFa3WK/Z1F3X9jQe/EyKdeUEhCIem9K5+ 5kNyMpJHlAXqQ== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id D067F608C0; Thu, 9 Apr 2026 13:00:30 +0000 (UTC) Received: from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138]) by lists1.osuosl.org (Postfix) with ESMTP id 44E981F6 for ; Thu, 9 Apr 2026 13:00:29 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 36E8181E5C for ; Thu, 9 Apr 2026 13:00:29 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id oBNoedT2AJ-6 for ; Thu, 9 Apr 2026 13:00:28 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=192.198.163.19; helo=mgamail.intel.com; envelope-from=marcin.szycik@linux.intel.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp1.osuosl.org 5C53581B14 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 5C53581B14 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.19]) by smtp1.osuosl.org (Postfix) with ESMTPS id 5C53581B14 for ; Thu, 9 Apr 2026 13:00:28 +0000 (UTC) X-CSE-ConnectionGUID: +mYhIqwRTauEWILTVEtxOw== X-CSE-MsgGUID: 1hQg5O8rRxqzIOq96vh64Q== X-IronPort-AV: E=McAfee;i="6800,10657,11753"; a="75777543" X-IronPort-AV: E=Sophos;i="6.23,169,1770624000"; d="scan'208";a="75777543" Received: from orviesa002.jf.intel.com ([10.64.159.142]) by fmvoesa113.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Apr 2026 06:00:22 -0700 X-CSE-ConnectionGUID: OPdIi8ZhTM+KRWyRyxHrtw== X-CSE-MsgGUID: JnYADzj5TticgxMhHSKKEQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,169,1770624000"; d="scan'208";a="259208144" Received: from irvmail002.ir.intel.com ([10.43.11.120]) by orviesa002.jf.intel.com with ESMTP; 09 Apr 2026 06:00:19 -0700 Received: from gond.igk.intel.com (gond.igk.intel.com [10.123.220.52]) by irvmail002.ir.intel.com (Postfix) with ESMTP id AF41E2FC57; Thu, 9 Apr 2026 14:00:18 +0100 (IST) From: Marcin Szycik To: intel-wired-lan@lists.osuosl.org Cc: netdev@vger.kernel.org, sandeep.penigalapati@intel.com, ananth.s@intel.com, alexander.duyck@gmail.com, Marcin Szycik , Lukasz Czapnik , Aleksandr Loktionov Date: Thu, 9 Apr 2026 14:00:03 +0200 Message-ID: <20260409120003.2719-11-marcin.szycik@linux.intel.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20260409120003.2719-1-marcin.szycik@linux.intel.com> References: <20260409120003.2719-1-marcin.szycik@linux.intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1775739628; x=1807275628; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RMRl9YrSm+l/Tb6MM0krI2qwrH8y6HxojXkgpB/gqE8=; b=U6PfVPWI4fy1d2vq4aLc1uCx9mBoNAQQfaobcg8KFzGrCzohc9Da0wHh saMgsL7TQs1Ec3RlpyP07osBkY3bqtHPZByxZukoMPZG0rPYCQ3rPALXW mQoS+oayl12alpQczVt1wDB+wVRDUdxJeRZA7FdXN8KZyDqIqVoRuM1tx 4BwY6UTLhiXlb2LU0BIGrK1jE5y1I3QVyNClYLviFW/YPWUvMcmJ+jSdV 7/E4eBB6p6Q0C9q2xbwbmVXkWvIfBri/N4UqR5NgOSDTd0aAAYGc1x+e2 TiHkSQjd7iJNluUlSei096tO0DJH8k0oeAM7/ZGyb+Sp7lsbYxdbAg5Rt A==; X-Mailman-Original-Authentication-Results: smtp1.osuosl.org; dmarc=none (p=none dis=none) header.from=linux.intel.com X-Mailman-Original-Authentication-Results: smtp1.osuosl.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=U6PfVPWI Subject: [Intel-wired-lan] [PATCH iwl-next v2 10/10] ice: use ACL for ntuple rules that conflict with FDir X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" From: Lukasz Czapnik Flow Director can keep only one input set per flow type. After ACL support was added for ethtool ntuple rules, the driver still only selected ACL for rules with partial masks. That leaves a gap for rules with full masks that still require a different input set than the one already programmed for Flow Director. Such rules go through the FDir path, build a different extraction sequence and then fail because the existing FDir profile cannot be reused. Detect this case before programming the rule. Build the candidate IP flow segment, compare it with the active non-tunneled FDir profile and, when the input sets differ, offload the rule through ACL if ACL is available. Refactor the IP flow segment setup into a helper so the same logic can be used both by the extraction-sequence configuration path and by the conflict check. Signed-off-by: Lukasz Czapnik Signed-off-by: Marcin Szycik Reviewed-by: Aleksandr Loktionov --- v2: * Add this patch --- .../ethernet/intel/ice/ice_ethtool_ntuple.c | 154 ++++++++++++------ 1 file changed, 107 insertions(+), 47 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c b/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c index 21d4f4e3a1d0..13073387376e 100644 --- a/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c @@ -1425,6 +1425,102 @@ ice_set_fdir_vlan_seg(struct ice_flow_seg_info *seg, return 0; } +/** + * ice_set_fdir_ip_flow_seg - set IP flow segment based on ethtool flow type + * @fsp: pointer to ethtool Rx flow specification + * @seg: flow segment for programming + * @perfect_fltr: valid on success; returns true if perfect fltr, false if not + * + * Return: 0 on success and errno in case of error. + */ +static int ice_set_fdir_ip_flow_seg(struct ethtool_rx_flow_spec *fsp, + struct ice_flow_seg_info *seg, + bool *perfect_fltr) +{ + switch (fsp->flow_type & ~FLOW_EXT) { + case TCP_V4_FLOW: + return ice_set_fdir_ip4_seg(seg, &fsp->m_u.tcp_ip4_spec, + ICE_FLOW_SEG_HDR_TCP, perfect_fltr); + case UDP_V4_FLOW: + return ice_set_fdir_ip4_seg(seg, &fsp->m_u.tcp_ip4_spec, + ICE_FLOW_SEG_HDR_UDP, perfect_fltr); + case SCTP_V4_FLOW: + return ice_set_fdir_ip4_seg(seg, &fsp->m_u.tcp_ip4_spec, + ICE_FLOW_SEG_HDR_SCTP, + perfect_fltr); + case IPV4_USER_FLOW: + return ice_set_fdir_ip4_usr_seg(seg, &fsp->m_u.usr_ip4_spec, + perfect_fltr); + case TCP_V6_FLOW: + return ice_set_fdir_ip6_seg(seg, &fsp->m_u.tcp_ip6_spec, + ICE_FLOW_SEG_HDR_TCP, perfect_fltr); + case UDP_V6_FLOW: + return ice_set_fdir_ip6_seg(seg, &fsp->m_u.tcp_ip6_spec, + ICE_FLOW_SEG_HDR_UDP, perfect_fltr); + case SCTP_V6_FLOW: + return ice_set_fdir_ip6_seg(seg, &fsp->m_u.tcp_ip6_spec, + ICE_FLOW_SEG_HDR_SCTP, + perfect_fltr); + case IPV6_USER_FLOW: + return ice_set_fdir_ip6_usr_seg(seg, &fsp->m_u.usr_ip6_spec, + perfect_fltr); + default: + return -EOPNOTSUPP; + } +} + +/** + * ice_fdir_has_input_set_conflict - Check conflict with existing FD filters + * @pf: PF structure + * @fsp: pointer to ethtool Rx flow specification + * + * Checks if adding this filter to Flow Director would cause an input set + * mismatch with existing filters for the same flow type by building + * the segment and comparing with existing profiles. + * + * Return: true if there's a conflict (use ACL), false otherwise (can use FD) + */ +static bool ice_fdir_has_input_set_conflict(struct ice_pf *pf, + struct ethtool_rx_flow_spec *fsp) +{ + struct ice_flow_seg_info *test_seg, *old_seg; + bool perfect_fltr, conflict = false; + struct ice_fd_hw_prof *hw_prof; + struct ice_hw *hw = &pf->hw; + enum ice_fltr_ptype flow; + int err; + + flow = ice_ethtool_flow_to_fltr(fsp->flow_type & ~FLOW_EXT); + if (flow >= ICE_FLTR_PTYPE_MAX || !hw->fdir_prof || + !hw->fdir_prof[flow]) { + return false; + } + + hw_prof = hw->fdir_prof[flow]; + old_seg = hw_prof->fdir_seg[ICE_FD_HW_SEG_NON_TUN]; + + if (!old_seg || hw->fdir_fltr_cnt[flow] == 0) + return false; + + test_seg = kzalloc_obj(*test_seg); + if (!test_seg) + return false; + + err = ice_set_fdir_ip_flow_seg(fsp, test_seg, &perfect_fltr); + if (err) { + kfree(test_seg); + return false; + } + + /* Compare the test segment with the existing segment */ + if (memcmp(old_seg, test_seg, sizeof(*test_seg)) != 0) + conflict = true; + + kfree(test_seg); + + return conflict; +} + /** * ice_cfg_fdir_xtrct_seq - Configure extraction sequence for the given filter * @pf: PF structure @@ -1455,57 +1551,16 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp, return -ENOMEM; } - switch (fsp->flow_type & ~FLOW_EXT) { - case TCP_V4_FLOW: - ret = ice_set_fdir_ip4_seg(seg, &fsp->m_u.tcp_ip4_spec, - ICE_FLOW_SEG_HDR_TCP, - &perfect_filter); - break; - case UDP_V4_FLOW: - ret = ice_set_fdir_ip4_seg(seg, &fsp->m_u.tcp_ip4_spec, - ICE_FLOW_SEG_HDR_UDP, - &perfect_filter); - break; - case SCTP_V4_FLOW: - ret = ice_set_fdir_ip4_seg(seg, &fsp->m_u.tcp_ip4_spec, - ICE_FLOW_SEG_HDR_SCTP, - &perfect_filter); - break; - case IPV4_USER_FLOW: - ret = ice_set_fdir_ip4_usr_seg(seg, &fsp->m_u.usr_ip4_spec, - &perfect_filter); - break; - case TCP_V6_FLOW: - ret = ice_set_fdir_ip6_seg(seg, &fsp->m_u.tcp_ip6_spec, - ICE_FLOW_SEG_HDR_TCP, - &perfect_filter); - break; - case UDP_V6_FLOW: - ret = ice_set_fdir_ip6_seg(seg, &fsp->m_u.tcp_ip6_spec, - ICE_FLOW_SEG_HDR_UDP, - &perfect_filter); - break; - case SCTP_V6_FLOW: - ret = ice_set_fdir_ip6_seg(seg, &fsp->m_u.tcp_ip6_spec, - ICE_FLOW_SEG_HDR_SCTP, - &perfect_filter); - break; - case IPV6_USER_FLOW: - ret = ice_set_fdir_ip6_usr_seg(seg, &fsp->m_u.usr_ip6_spec, - &perfect_filter); - break; - case ETHER_FLOW: + if ((fsp->flow_type & ~FLOW_EXT) == ETHER_FLOW) { ret = ice_set_ether_flow_seg(dev, seg, &fsp->m_u.ether_spec); if (!ret && (fsp->m_ext.vlan_etype || fsp->m_ext.vlan_tci)) { - if (!ice_fdir_vlan_valid(dev, fsp)) { + if (!ice_fdir_vlan_valid(dev, fsp)) ret = -EINVAL; - break; - } - ret = ice_set_fdir_vlan_seg(seg, &fsp->m_ext); + else + ret = ice_set_fdir_vlan_seg(seg, &fsp->m_ext); } - break; - default: - ret = -EINVAL; + } else { + ret = ice_set_fdir_ip_flow_seg(fsp, seg, &perfect_filter); } if (ret) goto err_exit; @@ -2241,6 +2296,11 @@ int ice_add_ntuple_ethtool(struct ice_vsi *vsi, struct ethtool_rxnfc *cmd) if (pf->hw.acl_tbl && ice_is_acl_filter(fsp)) return ice_acl_add_rule_ethtool(vsi, cmd); + /* Check if this would cause input set conflict with existing FD filters + */ + if (pf->hw.acl_tbl && ice_fdir_has_input_set_conflict(pf, fsp)) + return ice_acl_add_rule_ethtool(vsi, cmd); + ret = ice_cfg_fdir_xtrct_seq(pf, fsp, &userdata); if (ret) return ret; -- 2.49.0