> -----Original Message-----
> From: Marcin Szycik <[email protected]>
> Sent: Wednesday, July 29, 2026 3:05 PM
> To: [email protected]
> Cc: [email protected]; Nguyen, Anthony L
> <[email protected]>; Loktionov, Aleksandr
> <[email protected]>; Marcin Szycik
> <[email protected]>; Nowlin, Alexander
> <[email protected]>
> Subject: [PATCH iwl-next v2] ice: detect duplicates in ACL
>
> ntuple filters without masks (fdir) disallow duplicate entries. Extend
> this behaviour to rules with masks (ACL).
> Also skip checking ACL rules in ice_fdir_is_dup_fltr(), as it's only
> used for fdir.
>
> Keep the naming convention consistent with ice_fdir_is_dup_fltr() and
> ice_fdir_comp_rules(). ice_fdir_is_dup_fltr() cannot be reused
> directly, as it ignores masks.
>
> Before fix: duplicate rules with masks are allowed to be created and
> the duplicate rule cannot be removed:
> sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
> Added rule with ID 31231
> sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
> Added rule with ID 31230
> sudo ethtool -N eth0 delete 31230
> sudo ethtool -N eth0 delete 31231
> rmgr: Cannot delete RX class rule: Invalid argument
> Cannot delete classification rule
>
> After fix: duplicate rule is correctly detected:
> sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
> Added rule with ID 31231
> sudo ethtool -N eth0 flow-type udp4 src-port 9000 m 0xff00 action 18
> rmgr: Cannot insert RX class rule: Invalid argument
> Cannot insert classification rule
>
> Fixes: 3272c00a1247 ("ice: create ACL entry")
> Reported-by: Alexander Nowlin <[email protected]>
> Signed-off-by: Marcin Szycik <[email protected]>
> ---
> v2:
> * Tweak ice_acl_is_dup_fltr() function doc and comments to accurately
> reflect what is actually happening in the function
> * Add repro steps and expected behaviour to commit msg
> * ice_acl_comp_rules(): rename ipv4_equal -> base_equal in expectation
> of future changes that might introduce more fields
> ---
> Not sending to net because the fixed code is on dev-queue.
> Tony, please squash this with the offending commit.
> ---
> drivers/net/ethernet/intel/ice/ice_acl_main.c | 87
> +++++++++++++++++++
> drivers/net/ethernet/intel/ice/ice_fdir.c | 3 +
> 2 files changed, 90 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> index 7c566077d55a..d13e8bc1b701 100644
> --- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> @@ -283,6 +283,85 @@ void ice_acl_replay_fltrs(struct ice_pf *pf)
> }
> }
>
> +/**
> + * ice_acl_comp_rules - compare two ACL filters
> + * @a: first ACL filter
> + * @b: second ACL filter
> + *
> + * Return: true if a and b values and masks are identical, false
> +otherwise */ static bool ice_acl_comp_rules(struct ice_ntuple_fltr
> *a,
> +struct ice_ntuple_fltr *b) {
> + bool base_equal;
> +
> + if (a->flow_type != b->flow_type)
> + return false;
> +
> + base_equal = a->ip.v4.dst_ip == b->ip.v4.dst_ip &&
> + a->ip.v4.src_ip == b->ip.v4.src_ip &&
> + a->mask.v4.dst_ip == b->mask.v4.dst_ip &&
> + a->mask.v4.src_ip == b->mask.v4.src_ip;
> +
> + switch (a->flow_type) {
> + case ICE_FLTR_PTYPE_NONF_IPV4_TCP:
> + case ICE_FLTR_PTYPE_NONF_IPV4_UDP:
> + case ICE_FLTR_PTYPE_NONF_IPV4_SCTP:
> + return base_equal &&
> + a->ip.v4.dst_port == b->ip.v4.dst_port &&
> + a->ip.v4.src_port == b->ip.v4.src_port &&
> + a->mask.v4.dst_port == b->mask.v4.dst_port &&
> + a->mask.v4.src_port == b->mask.v4.src_port;
> + case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
> + return base_equal &&
> + a->ip.v4.l4_header == b->ip.v4.l4_header &&
> + a->ip.v4.proto == b->ip.v4.proto &&
> + a->ip.v4.ip_ver == b->ip.v4.ip_ver &&
> + a->ip.v4.tos == b->ip.v4.tos &&
> + a->mask.v4.l4_header == b->mask.v4.l4_header &&
> + a->mask.v4.proto == b->mask.v4.proto &&
> + a->mask.v4.ip_ver == b->mask.v4.ip_ver &&
> + a->mask.v4.tos == b->mask.v4.tos;
> + default:
> + return false;
> + }
> +}
> +
> +/**
> + * ice_acl_is_dup_fltr - test if an ACL filter is already in the list
> + * @hw: hardware data structure
> + * @input: ACL filter to check
> + *
> + * Return: true if a filter with identical match criteria (same flow
> +type,
> + * values, and masks) already exists, unless it is at the same
> location
> +with a
> + * different queue (an update)
> + */
> +static bool
> +ice_acl_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
> {
> + struct ice_ntuple_fltr *rule;
> +
> + list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> + if (!rule->acl_fltr)
> + continue;
> +
> + if (!ice_acl_comp_rules(rule, input))
> + continue;
> +
> + /* At this point rule and input have same match
> criteria.
> + * Same location with a different queue is an update,
> not a
> + * duplicate - skip it. Everything else is a duplicate.
> + */
> + if (rule->fltr_id == input->fltr_id &&
> + rule->q_index != input->q_index)
> + continue;
> +
> + return true;
> + }
> +
> + return false;
> +}
> +
> /**
> * ice_acl_add_rule_ethtool - add an ACL rule
> * @vsi: pointer to target VSI
> @@ -322,6 +401,14 @@ int ice_acl_add_rule_ethtool(struct ice_vsi *vsi,
> struct ethtool_rxnfc *cmd)
> if (err)
> goto free_input;
>
> + mutex_lock(&hw->fdir_fltr_lock);
> + if (ice_acl_is_dup_fltr(hw, input)) {
> + mutex_unlock(&hw->fdir_fltr_lock);
> + err = -EINVAL;
> + goto free_input;
> + }
> + mutex_unlock(&hw->fdir_fltr_lock);
> +
> memset(&acts, 0, sizeof(acts));
> if (fsp->ring_cookie == RX_CLS_FLOW_DISC)
> ice_acl_set_act_drop(&acts[0]);
> diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.c
> b/drivers/net/ethernet/intel/ice/ice_fdir.c
> index 1bc91cb41769..1d79138683b0 100644
> --- a/drivers/net/ethernet/intel/ice/ice_fdir.c
> +++ b/drivers/net/ethernet/intel/ice/ice_fdir.c
> @@ -1261,6 +1261,9 @@ bool ice_fdir_is_dup_fltr(struct ice_hw *hw,
> struct ice_ntuple_fltr *input)
> bool ret = false;
>
> list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> + if (rule->acl_fltr)
> + continue;
> +
> if (rule->flow_type != input->flow_type)
> continue;
>
> --
> 2.49.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
