|WARNING| net/ice: fix ACL entry limit on devices with 8 ports

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/172749

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-09

# DPDK Patch Review

## ERRORS

None identified.

## WARNINGS

**Missing release notes update**

This patch fixes a bug where ACL rule creation silently falls back to the switch engine after the 129th rule on 8-port devices, and now properly rejects rules beyond the hardware limit with an explicit error. This is a user-visible behavior change that should be documented in the release notes under "Fixed Issues" or "net/ice" section.

The fix changes error handling from silent fallback to explicit rejection, which applications may observe as new error returns where none occurred before (even though the silent fallback was itself a bug).

## INFO

**Pre-existing: array size mismatch**

The `hw_entry_id` array in `struct ice_acl_info` is still sized as `MAX_ACL_NORMAL_ENTRIES` (line marked as modified context):

```c
uint64_t hw_entry_id[MAX_ACL_NORMAL_ENTRIES];
```

Now that `max_entries` can be smaller than `MAX_ACL_NORMAL_ENTRIES` on 8-port devices, the array is oversized. While not a correctness issue (array indexing is bounded by the new `max_entries` field), a future cleanup could make the array dynamically allocated or document why the static size remains.

This is pre-existing infrastructure that the patch does not change, so it is not a blocking issue for this fix.

---

The patch correctly addresses the reported issue: it derives the entry limit from the configured ACL depth (which is already halved on 8-port devices), stores it in `pf->acl.max_entries`, and uses that value to reject rules beyond the NORMAL priority band with an explicit error instead of silently falling back. The fix is sound and the bounds check is correct.

Review-Result: WARNING