Netdev List
 help / color / mirror / Atom feed
* [PATCH iwl-next v2] ice: detect duplicates in ACL
@ 2026-07-29 13:05 Marcin Szycik
  2026-07-29 14:15 ` Loktionov, Aleksandr
  0 siblings, 1 reply; 2+ messages in thread
From: Marcin Szycik @ 2026-07-29 13:05 UTC (permalink / raw)
  To: intel-wired-lan
  Cc: netdev, anthony.l.nguyen, aleksandr.loktionov, Marcin Szycik,
	Alexander Nowlin

ntuple filters without masks (fdir) disallow duplicate entries. Extend
this behaviour to rules with masks (ACL).
Also skip checking ACL rules in ice_fdir_is_dup_fltr(), as it's only
used for fdir.

Keep the naming convention consistent with ice_fdir_is_dup_fltr() and
ice_fdir_comp_rules(). ice_fdir_is_dup_fltr() cannot be reused directly,
as it ignores masks.

Before fix: duplicate rules with masks are allowed to be created and the
duplicate rule cannot be removed:
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    Added rule with ID 31231
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    Added rule with ID 31230
  sudo ethtool -N eth0 delete 31230
  sudo ethtool -N eth0 delete 31231
    rmgr: Cannot delete RX class rule: Invalid argument
    Cannot delete classification rule

After fix: duplicate rule is correctly detected:
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    Added rule with ID 31231
  sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
    rmgr: Cannot insert RX class rule: Invalid argument
    Cannot insert classification rule

Fixes: 3272c00a1247 ("ice: create ACL entry")
Reported-by: Alexander Nowlin <alexander.nowlin@intel.com>
Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
---
v2:
* Tweak ice_acl_is_dup_fltr() function doc and comments to accurately
  reflect what is actually happening in the function
* Add repro steps and expected behaviour to commit msg
* ice_acl_comp_rules(): rename ipv4_equal -> base_equal in expectation
  of future changes that might introduce more fields
---
Not sending to net because the fixed code is on dev-queue.
Tony, please squash this with the offending commit.
---
 drivers/net/ethernet/intel/ice/ice_acl_main.c | 87 +++++++++++++++++++
 drivers/net/ethernet/intel/ice/ice_fdir.c     |  3 +
 2 files changed, 90 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c b/drivers/net/ethernet/intel/ice/ice_acl_main.c
index 7c566077d55a..d13e8bc1b701 100644
--- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
@@ -283,6 +283,85 @@ void ice_acl_replay_fltrs(struct ice_pf *pf)
 	}
 }
 
+/**
+ * ice_acl_comp_rules - compare two ACL filters
+ * @a: first ACL filter
+ * @b: second ACL filter
+ *
+ * Return: true if a and b values and masks are identical, false otherwise
+ */
+static bool
+ice_acl_comp_rules(struct ice_ntuple_fltr *a, struct ice_ntuple_fltr *b)
+{
+	bool base_equal;
+
+	if (a->flow_type != b->flow_type)
+		return false;
+
+	base_equal = a->ip.v4.dst_ip == b->ip.v4.dst_ip &&
+		     a->ip.v4.src_ip == b->ip.v4.src_ip &&
+		     a->mask.v4.dst_ip == b->mask.v4.dst_ip &&
+		     a->mask.v4.src_ip == b->mask.v4.src_ip;
+
+	switch (a->flow_type) {
+	case ICE_FLTR_PTYPE_NONF_IPV4_TCP:
+	case ICE_FLTR_PTYPE_NONF_IPV4_UDP:
+	case ICE_FLTR_PTYPE_NONF_IPV4_SCTP:
+		return base_equal &&
+		       a->ip.v4.dst_port == b->ip.v4.dst_port &&
+		       a->ip.v4.src_port == b->ip.v4.src_port &&
+		       a->mask.v4.dst_port == b->mask.v4.dst_port &&
+		       a->mask.v4.src_port == b->mask.v4.src_port;
+	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
+		return base_equal &&
+		       a->ip.v4.l4_header == b->ip.v4.l4_header &&
+		       a->ip.v4.proto == b->ip.v4.proto &&
+		       a->ip.v4.ip_ver == b->ip.v4.ip_ver &&
+		       a->ip.v4.tos == b->ip.v4.tos &&
+		       a->mask.v4.l4_header == b->mask.v4.l4_header &&
+		       a->mask.v4.proto == b->mask.v4.proto &&
+		       a->mask.v4.ip_ver == b->mask.v4.ip_ver &&
+		       a->mask.v4.tos == b->mask.v4.tos;
+	default:
+		return false;
+	}
+}
+
+/**
+ * ice_acl_is_dup_fltr - test if an ACL filter is already in the list
+ * @hw: hardware data structure
+ * @input: ACL filter to check
+ *
+ * Return: true if a filter with identical match criteria (same flow type,
+ * values, and masks) already exists, unless it is at the same location with a
+ * different queue (an update)
+ */
+static bool
+ice_acl_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
+{
+	struct ice_ntuple_fltr *rule;
+
+	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
+		if (!rule->acl_fltr)
+			continue;
+
+		if (!ice_acl_comp_rules(rule, input))
+			continue;
+
+		/* At this point rule and input have same match criteria.
+		 * Same location with a different queue is an update, not a
+		 * duplicate - skip it. Everything else is a duplicate.
+		 */
+		if (rule->fltr_id == input->fltr_id &&
+		    rule->q_index != input->q_index)
+			continue;
+
+		return true;
+	}
+
+	return false;
+}
+
 /**
  * ice_acl_add_rule_ethtool - add an ACL rule
  * @vsi: pointer to target VSI
@@ -322,6 +401,14 @@ int ice_acl_add_rule_ethtool(struct ice_vsi *vsi, struct ethtool_rxnfc *cmd)
 	if (err)
 		goto free_input;
 
+	mutex_lock(&hw->fdir_fltr_lock);
+	if (ice_acl_is_dup_fltr(hw, input)) {
+		mutex_unlock(&hw->fdir_fltr_lock);
+		err = -EINVAL;
+		goto free_input;
+	}
+	mutex_unlock(&hw->fdir_fltr_lock);
+
 	memset(&acts, 0, sizeof(acts));
 	if (fsp->ring_cookie == RX_CLS_FLOW_DISC)
 		ice_acl_set_act_drop(&acts[0]);
diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.c b/drivers/net/ethernet/intel/ice/ice_fdir.c
index 1bc91cb41769..1d79138683b0 100644
--- a/drivers/net/ethernet/intel/ice/ice_fdir.c
+++ b/drivers/net/ethernet/intel/ice/ice_fdir.c
@@ -1261,6 +1261,9 @@ bool ice_fdir_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
 	bool ret = false;
 
 	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
+		if (rule->acl_fltr)
+			continue;
+
 		if (rule->flow_type != input->flow_type)
 			continue;
 
-- 
2.49.0


^ permalink raw reply related	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-29 14:15 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-29 13:05 [PATCH iwl-next v2] ice: detect duplicates in ACL Marcin Szycik
2026-07-29 14:15 ` Loktionov, Aleksandr

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox