[Intel-wired-lan] [PATCH iwl-next] ice: detect duplicates in ACL

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces at osuosl.org> On Behalf
> Of Marcin Szycik
> Sent: Friday, July 24, 2026 11:45 AM
> To: intel-wired-lan at lists.osuosl.org
> Cc: netdev at vger.kernel.org; Nguyen, Anthony L
> <anthony.l.nguyen at intel.com>; Marcin Szycik
> <marcin.szycik at linux.intel.com>
> Subject: [Intel-wired-lan] [PATCH iwl-next] ice: detect duplicates in
> ACL
> 
> Prevent duplicate rules from being added to ACL.
> Also skip checking ACL rules in ice_fdir_is_dup_fltr(), as it's only
> used for fdir.
> 
Please add test info: HW/ASIC + PF/VF/SR-IOV, kernel version/branch, exact repro steps, before/after results (expected vs. observed).

> Fixes: fe9b91ade50e ("ice: create ACL entry")
> Signed-off-by: Marcin Szycik <marcin.szycik at linux.intel.com>
> ---
> Not sending to net because the fixed code is on dev-queue.
> Tony, please squash this with the offending commit.
> ---
>  drivers/net/ethernet/intel/ice/ice_acl_main.c | 87
> +++++++++++++++++++
>  drivers/net/ethernet/intel/ice/ice_fdir.c     |  3 +
>  2 files changed, 90 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> index 7c566077d55a..473b329b37bb 100644
> --- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> @@ -283,6 +283,85 @@ void ice_acl_replay_fltrs(struct ice_pf *pf)
>  	}
>  }
> 

...

> +/**
> + * ice_acl_is_dup_fltr - test if an ACL filter is already in the list
> + * @hw: hardware data structure
> + * @input: ACL filter to check
> + *
> + * Return: true if an identical filter (same flow type, values, and
> +masks)
> + * already exists at a different location  */ static bool
> +ice_acl_is_dup_fltr(struct ice_hw *hw, struct ice_ntuple_fltr *input)
> {
> +	struct ice_ntuple_fltr *rule;
> +
> +	list_for_each_entry(rule, &hw->fdir_list_head, fltr_node) {
> +		if (!rule->acl_fltr)
> +			continue;
> +
> +		if (!ice_acl_comp_rules(rule, input))
> +			continue;
> +
> +		/* At this point rule and input have same match
> criteria.
> +		 * Different location is a duplicate.
> +		 * Same location with a different queue is an update
> (not a
> +		 * duplicate).
> +		 */
> +		if (rule->fltr_id == input->fltr_id &&
> +		    rule->q_index != input->q_index)
> +			continue;
ice_acl_is_dup_fltr() documents that it returns true for an identical filter at a different location,
but the implementation also returns true when the existing rule has the same fltr_id and the same q_index.
Documentation or implementation should be updated.

> +
> +		return true;
> +	}
> +
> +	return false;
> +}
> +

...

>  		if (rule->flow_type != input->flow_type)
>  			continue;
> 
> --
> 2.49.0