> -----Original Message----- > From: Intel-wired-lan <[email protected]> On Behalf Of > Marcin Szycik > Sent: 02 July 2026 16:00 > To: [email protected] > Cc: [email protected]; Penigalapati, Sandeep > <[email protected]>; S, Ananth <[email protected]>; > [email protected]; Nguyen, Anthony L <[email protected]>; > Marcin Szycik <[email protected]>; Cao, Chinh T > <[email protected]> > Subject: [Intel-wired-lan] [PATCH iwl-next v5 09/12] ice: program ACL entry > > From: Real Valiquette <[email protected]> > > Complete the filter programming process; set the flow entry and action into > the scenario and write it to hardware. Configure the VSI for ACL filters. > > With this change, ACL implementation is complete. Filters can be programmed > by specifying the 'm' value of ethtool ntuple command for currently supported > fields (src-ip, dst-ip, src-port, and dst-port). > > For example: > ethtool -N eth0 flow-type tcp4 dst-port 8880 m 0x00ff action 10 or > ethtool -N eth0 flow-type tcp4 src-ip 192.168.0.55 m 0.0.0.255 action -1 > > At this time the following flow-types support mask values: tcp4, udp4, sctp4, > and ip4. > > Co-developed-by: Chinh Cao <[email protected]> > Signed-off-by: Chinh Cao <[email protected]> > Signed-off-by: Real Valiquette <[email protected]> > Co-developed-by: Tony Nguyen <[email protected]> > Signed-off-by: Tony Nguyen <[email protected]> > Signed-off-by: Marcin Szycik <[email protected]> > --- > v5: > * ice_flow_rem_prof_sync(): reset profile extraction if it's unused > after removal > * ice_ntuple_update_list_entry(): add a missing ice_fdir_rem_flow() call > for ACL filter > * ice_acl_rem_entry(): set err in loops only on failure. This way, AQ > commands succeeding in the end won't override errors in the middle. > Final cleanup of entry index will now only happen if all AQ writes > succeeded > * ice_acl_add_rule_ethtool(): remove old entry when updating an entry > (same filter location). Without it, old entry remains in hw after > update, in addition to the new entry. Repro: > ethtool -N $PF1 flow-type tcp4 src-port 8080 m 0x0fff action -1 loc 5 > ethtool -N $PF1 flow-type tcp4 src-port 9090 m 0x0fff action -1 loc 5 > ethtool -N eth0 delete 5 > * ice_flow_acl_add_scen_entry_sync(): free hw counters in exchange > actions and if the entry is being disregarded deallocated. This was > previously done in a later patch, but makes more sense here. > * ice_flow_add_entry(): same as above, move the change from future > patch here > * ice_flow_acl_add_scen_entry_sync(): store entry ID so it can be > properly deleted later > * ice_flow_acl_add_scen_entry_sync(): zero e->acts_cnt on success, so > that ice_flow_acl_free_act_cntr() will be skipped. On failure, free > exist->acts so exist won't carry stale counter references > * Commit message: add ethtool command examples (moved from patch 2) > v4: > * Remove last side effects of using struct ice_fd_hw_prof for ACL > v3: > * Cleanup comments in ice_acl_add_entry(), > ice_flow_acl_find_scen_entry_cond() > * ice_acl_rem_entry(): clear entry from entry bitmap only if programming > succceeded > * ice_acl_rem_entry(): catch ice_acl_scen_free_entry_idx() status > * ice_acl_add_rule_ethtool(): add fdir_fltr_lock around > ice_ntuple_update_list_entry() call > * ice_acl_add_rule_ethtool(): catch ice_ntuple_update_list_entry() > status, add unroll > * ice_flow_acl_find_scen_entry_cond(): remove inner loop when checking > if actions match. Previously it was effectively checking if actions > match *and* are all the same. Note: ACL will always use 1 action in > current software implementation, but it can be extended in the future. > * ice_flow_acl_add_scen_entry_sync(): set exist->acts_cnt = 0 on alloc > fail > v2: > * Use plain alloc instead of devm_ for ice_flow_entry::acts > * Use FIELD_PREP_CONST() for ICE_ACL_RX_*_MISS_CNTR > * Fix wrong struct ice_acl_act_entry alloc count in > ice_flow_acl_add_scen_entry_sync() - was e->entry_sz, which is an > unrelated value > * Only set acts_cnt after successful allocation in > ice_flow_acl_add_scen_entry_sync() > * Return -EINVAL instead of -ENOSPC on wrong index in > ice_acl_scen_free_entry_idx() > --- > drivers/net/ethernet/intel/ice/ice.h | 2 + > drivers/net/ethernet/intel/ice/ice_acl.h | 21 + > .../net/ethernet/intel/ice/ice_adminq_cmd.h | 2 + > drivers/net/ethernet/intel/ice/ice_flow.h | 3 + > drivers/net/ethernet/intel/ice/ice_acl.c | 53 ++- > drivers/net/ethernet/intel/ice/ice_acl_ctrl.c | 256 ++++++++++ > drivers/net/ethernet/intel/ice/ice_acl_main.c | 31 +- > .../ethernet/intel/ice/ice_ethtool_ntuple.c | 51 +- > drivers/net/ethernet/intel/ice/ice_flow.c | 446 +++++++++++++++++- > drivers/net/ethernet/intel/ice/ice_lib.c | 10 +- > 10 files changed, 862 insertions(+), 13 deletions(-) >
Tested-by: Rinitha S <[email protected]> (A Contingent worker at Intel)
