Two fixes for TC flower offload in the legacy switch mode. Both
address the same user visible failure, all traffic on a port silently
disappears after installing a filter chain that mixes offloadable and
non offloadable filters.

The first fix covers filters matching on ip_proto alone. The driver
never programmed the protocol lookup, so a filter like "ip_proto udp
action drop" was installed in hardware as a match on eth_type ipv4 and
dropped every IPv4 packet.

The second fix covers the interaction between software only filters and
offloaded drop filters. The E810 switch gives drop rules absolute
precedence over forwarding rules regardless of recipe priority, so a
lower priority drop offloaded into hardware overrides any higher
priority filter that stayed in software. The driver now tracks filters
it could not offload and refuses to offload a drop filter that would
bypass one of them, keeping the drop functional in software instead.

Tested on E810 with the OS default and comms DDP packages, including
the original reproducer from the report, L2TPv3 pass and drop chains
with and without session ID matching, and a shared block bound to two
PF ports.

---
v2:
- track one entry per cookie and filter_dev pair so a shared block
  bound to multiple devices is protected on every binding, and the
  delete path drops one entry per DESTROY invocation (sashiko review
  via Simon Horman)
- collect Reviewed-by from Aleksandr Loktionov on patch 1

v1: https://lore.kernel.org/all/20260910154824.3603687-1-poros@redhat.com/

Petr Oros (2):
  ice: fix TC flower filters matching more than the ip_proto key
  ice: don't offload drop filters that bypass higher priority filters

 drivers/net/ethernet/intel/ice/ice.h        |   1 +
 drivers/net/ethernet/intel/ice/ice_main.c   |   2 +-
 drivers/net/ethernet/intel/ice/ice_repr.c   |   2 +-
 drivers/net/ethernet/intel/ice/ice_tc_lib.c | 196 +++++++++++++++++++-
 drivers/net/ethernet/intel/ice/ice_tc_lib.h |  24 ++-
 5 files changed, 212 insertions(+), 13 deletions(-)

-- 
2.55.0

On Wed, Sep 16, 2026 at 04:41:28PM +0200, Petr Oros wrote:
> Two fixes for TC flower offload in the legacy switch mode. Both
> address the same user visible failure, all traffic on a port silently
> disappears after installing a filter chain that mixes offloadable and
> non offloadable filters.
> 
> The first fix covers filters matching on ip_proto alone. The driver
> never programmed the protocol lookup, so a filter like "ip_proto udp
> action drop" was installed in hardware as a match on eth_type ipv4 and
> dropped every IPv4 packet.
> 
> The second fix covers the interaction between software only filters and
> offloaded drop filters. The E810 switch gives drop rules absolute
> precedence over forwarding rules regardless of recipe priority, so a
> lower priority drop offloaded into hardware overrides any higher
> priority filter that stayed in software. The driver now tracks filters
> it could not offload and refuses to offload a drop filter that would
> bypass one of them, keeping the drop functional in software instead.
> 
> Tested on E810 with the OS default and comms DDP packages, including
> the original reproducer from the report, L2TPv3 pass and drop chains
> with and without session ID matching, and a shared block bound to two
> PF ports.
> 
> ---
> v2:
> - track one entry per cookie and filter_dev pair so a shared block
>   bound to multiple devices is protected on every binding, and the
>   delete path drops one entry per DESTROY invocation (sashiko review
>   via Simon Horman)
> - collect Reviewed-by from Aleksandr Loktionov on patch 1
> 
> v1: https://lore.kernel.org/all/20260910154824.3603687-1-poros@redhat.com/

Thanks for the update.

For the series:

Reviewed-by: Simon Horman <horms@kernel.org>