[PATCH iwl-next v2] ice: detect duplicates in ACL

[PATCH iwl-next v2] ice: detect duplicates in ACL

[Marcin Szycik]

ntuple filters without masks (fdir) disallow duplicate entries. Extend
this behaviour to rules with masks (ACL).
Also skip checking ACL rules in ice_fdir_is_dup_fltr(), as it's only
used for fdir.

Keep the naming convention consistent with ice_fdir_is_dup_fltr() and
ice_fdir_comp_rules(). ice_fdir_is_dup_fltr() cannot be reused directly,
as it ignores masks.

Before fix: duplicate rules with masks are allowed to be created and the
duplicate rule cannot be removed:
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    Added rule with ID 31231
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    Added rule with ID 31230
  sudo ethtool -N eth0 delete 31230
  sudo ethtool -N eth0 delete 31231
    rmgr: Cannot delete RX class rule: Invalid argument
    Cannot delete classification rule

After fix: duplicate rule is correctly detected:
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    Added rule with ID 31231
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    rmgr: Cannot insert RX class rule: Invalid argument
    Cannot insert classification rule

Fixes: 3272c00a1247 ("ice: create ACL entry")
Reported-by: Alexander Nowlin <alexander.nowlin@intel.com>
Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
---
v2:
* Tweak ice_acl_is_dup_fltr() function doc and comments to accurately
  reflect what is actually happening in the function
* Add repro steps and expected behaviour to commit msg
* ice_acl_comp_rules(): rename ipv4_equal -> base_equal in expectation
  of future changes that might introduce more fields
---
Not sending to net because the fixed code is on dev-queue.
Tony, please squash this with the offending commit.
---
 drivers/net/ethernet/intel/ice/ice_acl_main.c | 87 +++++++++++++++++++
 drivers/net/ethernet/intel/ice/ice_fdir.c     |  3 +
 2 files changed, 90 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c b/drivers/net/ethernet/intel/ice/ice_acl_main.c
index 7c566077d55a..d13e8bc1b701 100644
--- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
@@ -283,6 +283,85 @@ void ice_acl_replay_fltrs(struct ice_pf *pf)
 	}
 }
 
+/**
+ * ice_acl_comp_rules - compare two ACL filters
+ * @a: first ACL filter
+ * @b: second ACL filter
+ *
+ * Return: true if a and b values and masks are identical, false otherwise
+ */
+static bool
+ice_acl_comp_rules(struct ice_ntuple_fltr *a, struct ice_ntuple_fltr *b)
+{
+	bool base_equal;
+
+	if (a->flow_type != b->flow_type)
+		return false;
+
+	base_equal = a->ip.v4.dst_ip == b->ip.v4.dst_ip &&
+		     a->ip.v4.src_ip == b->ip.v4.src_ip &&
+		     a->mask.v4.dst_ip == b->mask.v4.dst_ip &&
+		     a->mask.v4.src_ip == b->mask.v4.src_ip;
+
+	switch (a->flow_type) {
+	case ICE_FLTR_PTYPE_NONF_IPV4_TCP:
+	case ICE_FLTR_PTYPE_NONF_IPV4_UDP:
+	case ICE_FLTR_PTYPE_NONF_IPV4_SCTP:
+		return base_equal &&
+		       a->ip.v4.dst_port == b->ip.v4.dst_port &&
+		       a->ip.v4.src_port == b->ip.v4.src_port &&
+		       a->mask.v4.dst_port == b->mask.v4.dst_port &&
+		       a->mask.v4.src_port == b->mask.v4.src_port;
+	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
+		return base_equal &&
+		       a->ip.v4.l4_header == b->ip.v4.l4_header &&
+		       a->ip.v4.proto == b->ip.v4.proto &&
+		       a->ip.v4.ip_ver == b->ip.v4.ip_ver &&
+		       a->ip.v4.tos == b->ip.v4.tos &&
+		       a->mask.v4.l4_header == b->mask.v4.l4_header &&
+		       a->mask.v4.proto == b->mask.v4.proto &&
+		       a->mask.v4.ip_ver == b->mask.v4.ip_ver &&
+		       a->mask.v4.tos == b->mask.v4.tos;
+	default:
+		return false;
+	}
+}
+
+/**
+ * ice_acl_is_dup_fltr - test if an ACL filter is already in the list
+ * @hw: hardware data structure
+ * @input: ACL filter to check
+ *
+ * Return: true if a filter with identical match criteria (same flow type,
+ * values, and masks) already exists, unless it is at the same location with a
+ * different queue (an update)
+ */
+static bool
+ice_acl_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
+{
+	struct ice_ntuple_fltr *rule;
+
+	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
+		if (!rule->acl_fltr)
+			continue;
+
+		if (!ice_acl_comp_rules(rule, input))
+			continue;
+
+		/* At this point rule and input have same match criteria.
+		 * Same location with a different queue is an update, not a
+		 * duplicate - skip it. Everything else is a duplicate.
+		 */
+		if (rule->fltr_id == input->fltr_id &&
+		    rule->q_index != input->q_index)
+			continue;
+
+		return true;
+	}
+
+	return false;
+}
+
 /**
  * ice_acl_add_rule_ethtool - add an ACL rule
  * @vsi: pointer to target VSI
@@ -322,6 +401,14 @@ int ice_acl_add_rule_ethtool(struct ice_vsi *vsi, struct ethtool_rxnfc *cmd)
 	if (err)
 		goto free_input;
 
+	mutex_lock(&hw->fdir_fltr_lock);
+	if (ice_acl_is_dup_fltr(hw, input)) {
+		mutex_unlock(&hw->fdir_fltr_lock);
+		err = -EINVAL;
+		goto free_input;
+	}
+	mutex_unlock(&hw->fdir_fltr_lock);
+
 	memset(&acts, 0, sizeof(acts));
 	if (fsp->ring_cookie == RX_CLS_FLOW_DISC)
 		ice_acl_set_act_drop(&acts[0]);
diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.c b/drivers/net/ethernet/intel/ice/ice_fdir.c
index 1bc91cb41769..1d79138683b0 100644
--- a/drivers/net/ethernet/intel/ice/ice_fdir.c
+++ b/drivers/net/ethernet/intel/ice/ice_fdir.c
@@ -1261,6 +1261,9 @@ bool ice_fdir_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
 	bool ret = false;
 
 	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
+		if (rule->acl_fltr)
+			continue;
+
 		if (rule->flow_type != input->flow_type)
 			continue;
 
-- 
2.49.0

RE: [PATCH iwl-next v2] ice: detect duplicates in ACL

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Marcin Szycik <marcin.szycik@linux.intel.com>
> Sent: Wednesday, July 29, 2026 3:05 PM
> To: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org; Nguyen, Anthony L
> <anthony.l.nguyen@intel.com>; Loktionov, Aleksandr
> <aleksandr.loktionov@intel.com>; Marcin Szycik
> <marcin.szycik@linux.intel.com>; Nowlin, Alexander
> <alexander.nowlin@intel.com>
> Subject: [PATCH iwl-next v2] ice: detect duplicates in ACL
> 
> ntuple filters without masks (fdir) disallow duplicate entries. Extend
> this behaviour to rules with masks (ACL).
> Also skip checking ACL rules in ice_fdir_is_dup_fltr(), as it's only
> used for fdir.
> 
> Keep the naming convention consistent with ice_fdir_is_dup_fltr() and
> ice_fdir_comp_rules(). ice_fdir_is_dup_fltr() cannot be reused
> directly, as it ignores masks.
> 
> Before fix: duplicate rules with masks are allowed to be created and
> the duplicate rule cannot be removed:
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     Added rule with ID 31231
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     Added rule with ID 31230
>   sudo ethtool -N eth0 delete 31230
>   sudo ethtool -N eth0 delete 31231
>     rmgr: Cannot delete RX class rule: Invalid argument
>     Cannot delete classification rule
> 
> After fix: duplicate rule is correctly detected:
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     Added rule with ID 31231
>   sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
>     rmgr: Cannot insert RX class rule: Invalid argument
>     Cannot insert classification rule
> 
> Fixes: 3272c00a1247 ("ice: create ACL entry")
> Reported-by: Alexander Nowlin <alexander.nowlin@intel.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
> ---
> v2:
> * Tweak ice_acl_is_dup_fltr() function doc and comments to accurately
>   reflect what is actually happening in the function
> * Add repro steps and expected behaviour to commit msg
> * ice_acl_comp_rules(): rename ipv4_equal -> base_equal in expectation
>   of future changes that might introduce more fields
> ---
> Not sending to net because the fixed code is on dev-queue.
> Tony, please squash this with the offending commit.
> ---
>  drivers/net/ethernet/intel/ice/ice_acl_main.c | 87
> +++++++++++++++++++
>  drivers/net/ethernet/intel/ice/ice_fdir.c     |  3 +
>  2 files changed, 90 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> index 7c566077d55a..d13e8bc1b701 100644
> --- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> @@ -283,6 +283,85 @@ void ice_acl_replay_fltrs(struct ice_pf *pf)
>  	}
>  }
> 
> +/**
> + * ice_acl_comp_rules - compare two ACL filters
> + * @a: first ACL filter
> + * @b: second ACL filter
> + *
> + * Return: true if a and b values and masks are identical, false
> +otherwise  */ static bool ice_acl_comp_rules(struct ice_ntuple_fltr
> *a,
> +struct ice_ntuple_fltr *b) {
> +	bool base_equal;
> +
> +	if (a->flow_type != b->flow_type)
> +		return false;
> +
> +	base_equal = a->ip.v4.dst_ip == b->ip.v4.dst_ip &&
> +		     a->ip.v4.src_ip == b->ip.v4.src_ip &&
> +		     a->mask.v4.dst_ip == b->mask.v4.dst_ip &&
> +		     a->mask.v4.src_ip == b->mask.v4.src_ip;
> +
> +	switch (a->flow_type) {
> +	case ICE_FLTR_PTYPE_NONF_IPV4_TCP:
> +	case ICE_FLTR_PTYPE_NONF_IPV4_UDP:
> +	case ICE_FLTR_PTYPE_NONF_IPV4_SCTP:
> +		return base_equal &&
> +		       a->ip.v4.dst_port == b->ip.v4.dst_port &&
> +		       a->ip.v4.src_port == b->ip.v4.src_port &&
> +		       a->mask.v4.dst_port == b->mask.v4.dst_port &&
> +		       a->mask.v4.src_port == b->mask.v4.src_port;
> +	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
> +		return base_equal &&
> +		       a->ip.v4.l4_header == b->ip.v4.l4_header &&
> +		       a->ip.v4.proto == b->ip.v4.proto &&
> +		       a->ip.v4.ip_ver == b->ip.v4.ip_ver &&
> +		       a->ip.v4.tos == b->ip.v4.tos &&
> +		       a->mask.v4.l4_header == b->mask.v4.l4_header &&
> +		       a->mask.v4.proto == b->mask.v4.proto &&
> +		       a->mask.v4.ip_ver == b->mask.v4.ip_ver &&
> +		       a->mask.v4.tos == b->mask.v4.tos;
> +	default:
> +		return false;
> +	}
> +}
> +
> +/**
> + * ice_acl_is_dup_fltr - test if an ACL filter is already in the list
> + * @hw: hardware data structure
> + * @input: ACL filter to check
> + *
> + * Return: true if a filter with identical match criteria (same flow
> +type,
> + * values, and masks) already exists, unless it is at the same
> location
> +with a
> + * different queue (an update)
> + */
> +static bool
> +ice_acl_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
> {
> +	struct ice_ntuple_fltr *rule;
> +
> +	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> +		if (!rule->acl_fltr)
> +			continue;
> +
> +		if (!ice_acl_comp_rules(rule, input))
> +			continue;
> +
> +		/* At this point rule and input have same match
> criteria.
> +		 * Same location with a different queue is an update,
> not a
> +		 * duplicate - skip it. Everything else is a duplicate.
> +		 */
> +		if (rule->fltr_id == input->fltr_id &&
> +		    rule->q_index != input->q_index)
> +			continue;
> +
> +		return true;
> +	}
> +
> +	return false;
> +}
> +
>  /**
>   * ice_acl_add_rule_ethtool - add an ACL rule
>   * @vsi: pointer to target VSI
> @@ -322,6 +401,14 @@ int ice_acl_add_rule_ethtool(struct ice_vsi *vsi,
> struct ethtool_rxnfc *cmd)
>  	if (err)
>  		goto free_input;
> 
> +	mutex_lock(&hw->fdir_fltr_lock);
> +	if (ice_acl_is_dup_fltr(hw, input)) {
> +		mutex_unlock(&hw->fdir_fltr_lock);
> +		err = -EINVAL;
> +		goto free_input;
> +	}
> +	mutex_unlock(&hw->fdir_fltr_lock);
> +
>  	memset(&acts, 0, sizeof(acts));
>  	if (fsp->ring_cookie == RX_CLS_FLOW_DISC)
>  		ice_acl_set_act_drop(&acts[0]);
> diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.c
> b/drivers/net/ethernet/intel/ice/ice_fdir.c
> index 1bc91cb41769..1d79138683b0 100644
> --- a/drivers/net/ethernet/intel/ice/ice_fdir.c
> +++ b/drivers/net/ethernet/intel/ice/ice_fdir.c
> @@ -1261,6 +1261,9 @@ bool ice_fdir_is_dup_fltr(struct ice_hw *hw,
> struct ice_ntuple_fltr *input)
>  	bool ret = false;
> 
>  	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> +		if (rule->acl_fltr)
> +			continue;
> +
>  		if (rule->flow_type != input->flow_type)
>  			continue;
> 
> --
> 2.49.0

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>