On every VF/SF vport enable, esw_acl_egress_ofld_setup() allocates an
egress ACL flow table and a fwd_grp whenever the device supports
egress_acl_forward_to_vport. The only consumer of that group is the
active/passive fwd2vport rule installed when two representor netdevs
are bonded - a path that almost never fires. As a result, hosts with
many VFs/SFs pay a per-vport flow table and flow group cost for a
feature most ports never use.
Defer the flow table and fwd_grp creation to the moment they are
actually needed, when mlx5e_rep_esw_bond_netevent() drives
mlx5_esw_acl_egress_vport_bond() for the passive vport:
- esw_acl_egress_ofld_setup() now returns early unless
prio_tag_required is set. When prio_tag_required is set the
flow table is still allocated eagerly for the VLAN pop rule, and
its size is grown by one when fwd2vport is supported so the lazy
fwd_grp can later be added without re-creating the table. Only
the VLAN group is built up-front.
- A new helper, esw_acl_egress_ofld_fwd2vport_setup(), allocates
the egress ACL flow table (size 1) and the fwd_grp on demand,
and rolls back the flow table if group creation fails and the
helper had just allocated it. Existing cleanup paths
(esw_acl_egress_ofld_cleanup() -> *_groups_destroy() /
*_table_destroy()) already tolerate NULL fields, so vport
disable continues to free everything that was actually
allocated.
- mlx5_esw_acl_egress_vport_bond() calls the helper for the
passive vport before installing the fwd2vport rule. The active
vport does not need the flow table on its own: with a NULL
fwd_dest, esw_acl_egress_ofld_rules_create() is a no-op unless
prio_tag_required is set, in which case the eager path already
built the table.
mlx5_esw_acl_egress_vport_bond() and mlx5_esw_acl_egress_vport_unbond()
now take esw->state_lock for the duration of the operation, because
they may mutate vport->egress.acl, which is also written by the vport
enable/disable path under the same lock.
Signed-off-by: Yael Chemla <ychemla@nvidia.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260723070427.1861502-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
0b7763e3a0