mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-21 22:04:43 +04:00
Julius Bairaktaris
9536cc0945
The ACL engine has 512 entries, and the driver uses two at fixed indices with no way to install a rule from userspace. Add an allocator that places a rule on the entry chains the hardware can merge, with range compares on even entries, move the two small-packet rules onto it, and implement cls_flower_add and cls_flower_del for MAC, IPv4, IPv6, L4 port and port range, ICMP, IP protocol, DSCP, TCP flag and fragment keys, refusing any other key. The actions are pass, drop, trap, skbedit priority, redirect, mirred mirror, which claims both of the port mirror's analyzers, pedit of the DSCP byte and police on one of the 512 ACL meters, and set_rxnfc gives ethtool -N the queue action, refusing queues 12 to 143, the CPU port queues the scheduler does not serve, and a VF or RSS context, which the switch does not have. The engine matches the highest PRI, so a rule's priority is the 9-bit span minus its tc preference. The address family comes from the control key, since cls_flower registers both address keys over one union, and from the registered address key where ethtool_rx_flow_rule_create() leaves the control key out. On IPQ8074 every accepted action installs in_hw, an ICMP drop filter drops in the switch, and a pedit to 0x88 moves the datagrams to another egress queue. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/25700 Signed-off-by: Robert Marko <robimarko@gmail.com>