From: netdev@kapio-technology.com To: Vladimir Oltean <olteanv@gmail.com> Cc: Ido Schimmel <idosch@nvidia.com>, davem@davemloft.net, kuba@kernel.org, netdev@vger.kernel.org, Andrew Lunn <andrew@lunn.ch>, Vivien Didelot <vivien.didelot@gmail.com>, Florian Fainelli <f.fainelli@gmail.com>, Eric Dumazet <edumazet@google.com>, Paolo Abeni <pabeni@redhat.com>, Jiri Pirko <jiri@resnulli.us>, Ivan Vecera <ivecera@redhat.com>, Roopa Prabhu <roopa@nvidia.com>, Nikolay Aleksandrov <razor@blackwall.org>, Shuah Khan <shuah@kernel.org>, Daniel Borkmann <daniel@iogearbox.net>, linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers Date: Sun, 17 Jul 2022 16:57:50 +0200 [thread overview] Message-ID: <e1c1e7c114f0226b116d9549cea8e7a9@kapio-technology.com> (raw) In-Reply-To: <20220717135951.ho4raw3bzwlgixpb@skbuf> On 2022-07-17 15:59, Vladimir Oltean wrote: > On Sun, Jul 17, 2022 at 03:09:10PM +0200, netdev@kapio-technology.com > wrote: >> On 2022-07-17 14:57, Vladimir Oltean wrote: >> > On Sun, Jul 17, 2022 at 02:21:47PM +0200, netdev@kapio-technology.com >> > wrote: >> > > On 2022-07-13 14:39, Ido Schimmel wrote: >> > > > On Wed, Jul 13, 2022 at 09:09:58AM +0200, netdev@kapio-technology.com >> > > > wrote: >> > > >> > > > >> > > > What are "Storm Prevention" and "zero-DPV" FDB entries? >> > > >> > > They are both FDB entries that at the HW level drops all packets >> > > having a >> > > specific SA, thus using minimum resources. >> > > (thus the name "Storm Prevention" aka, protection against DOS >> > > attacks. We >> > > must remember that we operate with CPU based learning.) >> > >> > DPV means Destination Port Vector, and an ATU entry with a DPV of 0 >> > essentially means a FDB entry pointing nowhere, so it will drop the >> > packet. That's a slight problem with Hans' implementation, the bridge >> > thinks that the locked FDB entry belongs to port X, but in reality it >> > matches on all bridged ports (since it matches by FID). FID allocation >> > in mv88e6xxx is slightly strange, all VLAN-unaware bridge ports, >> > belonging to any bridge, share the same FID, so the FDB databases are >> > not exactly isolated from each other. >> >> But if the locked port is vlan aware and has a pvid, it should not >> block >> other ports. > > I don't understand what you want to say by that. It will block all > other > packets with the same MAC SA that are classified to the same FID. > In case of VLAN-aware bridges, the mv88e6xxx driver allocates a new FID > for each VID (see mv88e6xxx_atu_new). In other words, if a locked port > is VLAN-aware and has a pvid, then whatever the PVID may be, all ports > in that same VLAN are still blocked in the same way. Maybe I am just trying to understand the problem you are posing, so afaics MAC addresses should be unique and having the same MAC address behind a locked port and a not-locked port seems like a mis-configuration regardless of vlan setup? As the zero-DPV entry only blocks the specific SA MAC on a specific vlan, which is behind a locked port, there shouldn't be any problem...? If the host behind a locked port starts sending on another vlan than where it got the first locked entry, another locked entry will occur, as the locked entries are MAC + vlan. > >> Besides the fid will be zero with vlan unaware afaik, and all with >> zero fid do not create locked entries. > > If by 0 you mean 1 (MV88E6XXX_FID_BRIDGED), then you are correct: ports > with FID 0 (MV88E6XXX_FID_STANDALONE) should not create locked FDB > entries, because they are, well, standalone and not bridged. > Again I don't exactly see the relevance though.
WARNING: multiple messages have this Message-ID (diff)
From: netdev@kapio-technology.com To: Vladimir Oltean <olteanv@gmail.com> Cc: Ivan Vecera <ivecera@redhat.com>, Andrew Lunn <andrew@lunn.ch>, Florian Fainelli <f.fainelli@gmail.com>, Jiri Pirko <jiri@resnulli.us>, Daniel Borkmann <daniel@iogearbox.net>, bridge@lists.linux-foundation.org, Ido Schimmel <idosch@nvidia.com>, Nikolay Aleksandrov <razor@blackwall.org>, Roopa Prabhu <roopa@nvidia.com>, linux-kernel@vger.kernel.org, Vivien Didelot <vivien.didelot@gmail.com>, Eric Dumazet <edumazet@google.com>, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kuba@kernel.org, Paolo Abeni <pabeni@redhat.com>, Shuah Khan <shuah@kernel.org>, davem@davemloft.net Subject: Re: [Bridge] [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers Date: Sun, 17 Jul 2022 16:57:50 +0200 [thread overview] Message-ID: <e1c1e7c114f0226b116d9549cea8e7a9@kapio-technology.com> (raw) In-Reply-To: <20220717135951.ho4raw3bzwlgixpb@skbuf> On 2022-07-17 15:59, Vladimir Oltean wrote: > On Sun, Jul 17, 2022 at 03:09:10PM +0200, netdev@kapio-technology.com > wrote: >> On 2022-07-17 14:57, Vladimir Oltean wrote: >> > On Sun, Jul 17, 2022 at 02:21:47PM +0200, netdev@kapio-technology.com >> > wrote: >> > > On 2022-07-13 14:39, Ido Schimmel wrote: >> > > > On Wed, Jul 13, 2022 at 09:09:58AM +0200, netdev@kapio-technology.com >> > > > wrote: >> > > >> > > > >> > > > What are "Storm Prevention" and "zero-DPV" FDB entries? >> > > >> > > They are both FDB entries that at the HW level drops all packets >> > > having a >> > > specific SA, thus using minimum resources. >> > > (thus the name "Storm Prevention" aka, protection against DOS >> > > attacks. We >> > > must remember that we operate with CPU based learning.) >> > >> > DPV means Destination Port Vector, and an ATU entry with a DPV of 0 >> > essentially means a FDB entry pointing nowhere, so it will drop the >> > packet. That's a slight problem with Hans' implementation, the bridge >> > thinks that the locked FDB entry belongs to port X, but in reality it >> > matches on all bridged ports (since it matches by FID). FID allocation >> > in mv88e6xxx is slightly strange, all VLAN-unaware bridge ports, >> > belonging to any bridge, share the same FID, so the FDB databases are >> > not exactly isolated from each other. >> >> But if the locked port is vlan aware and has a pvid, it should not >> block >> other ports. > > I don't understand what you want to say by that. It will block all > other > packets with the same MAC SA that are classified to the same FID. > In case of VLAN-aware bridges, the mv88e6xxx driver allocates a new FID > for each VID (see mv88e6xxx_atu_new). In other words, if a locked port > is VLAN-aware and has a pvid, then whatever the PVID may be, all ports > in that same VLAN are still blocked in the same way. Maybe I am just trying to understand the problem you are posing, so afaics MAC addresses should be unique and having the same MAC address behind a locked port and a not-locked port seems like a mis-configuration regardless of vlan setup? As the zero-DPV entry only blocks the specific SA MAC on a specific vlan, which is behind a locked port, there shouldn't be any problem...? If the host behind a locked port starts sending on another vlan than where it got the first locked entry, another locked entry will occur, as the locked entries are MAC + vlan. > >> Besides the fid will be zero with vlan unaware afaik, and all with >> zero fid do not create locked entries. > > If by 0 you mean 1 (MV88E6XXX_FID_BRIDGED), then you are correct: ports > with FID 0 (MV88E6XXX_FID_STANDALONE) should not create locked FDB > entries, because they are, well, standalone and not bridged. > Again I don't exactly see the relevance though.
next prev parent reply other threads:[~2022-07-17 14:58 UTC|newest] Thread overview: 137+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-07-07 15:29 [PATCH v4 net-next 0/6] Extend locked port feature with FDB locked flag (MAC-Auth/MAB) Hans Schultz 2022-07-07 15:29 ` [Bridge] " Hans Schultz 2022-07-07 15:29 ` [PATCH v4 net-next 1/6] net: bridge: add locked entry fdb flag to extend locked port feature Hans Schultz 2022-07-07 15:29 ` [Bridge] " Hans Schultz 2022-07-10 8:20 ` Ido Schimmel 2022-07-10 8:20 ` [Bridge] " Ido Schimmel 2022-07-07 15:29 ` [PATCH v4 net-next 2/6] net: switchdev: add support for offloading of fdb locked flag Hans Schultz 2022-07-07 15:29 ` [Bridge] " Hans Schultz 2022-07-08 8:54 ` Vladimir Oltean 2022-07-08 8:54 ` [Bridge] " Vladimir Oltean 2022-08-02 8:27 ` netdev 2022-08-02 8:27 ` [Bridge] " netdev 2022-08-02 10:13 ` netdev 2022-08-02 10:13 ` [Bridge] " netdev 2022-07-07 15:29 ` [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers Hans Schultz 2022-07-07 15:29 ` [Bridge] " Hans Schultz 2022-07-08 7:12 ` kernel test robot 2022-07-08 8:49 ` Vladimir Oltean 2022-07-08 8:49 ` [Bridge] " Vladimir Oltean 2022-07-08 9:06 ` netdev 2022-07-08 9:06 ` [Bridge] " netdev 2022-07-08 9:15 ` Vladimir Oltean 2022-07-08 9:15 ` [Bridge] " Vladimir Oltean 2022-07-08 9:27 ` netdev 2022-07-08 9:27 ` [Bridge] " netdev 2022-07-08 9:50 ` netdev 2022-07-08 9:50 ` [Bridge] " netdev 2022-07-08 11:56 ` Vladimir Oltean 2022-07-08 11:56 ` [Bridge] " Vladimir Oltean 2022-07-08 12:34 ` netdev 2022-07-08 12:34 ` [Bridge] " netdev 2022-07-10 8:35 ` Ido Schimmel 2022-07-10 8:35 ` [Bridge] " Ido Schimmel 2022-07-13 7:09 ` netdev 2022-07-13 7:09 ` [Bridge] " netdev 2022-07-13 12:39 ` Ido Schimmel 2022-07-13 12:39 ` [Bridge] " Ido Schimmel 2022-07-17 12:21 ` netdev 2022-07-17 12:21 ` [Bridge] " netdev 2022-07-17 12:57 ` Vladimir Oltean 2022-07-17 12:57 ` [Bridge] " Vladimir Oltean 2022-07-17 13:09 ` netdev 2022-07-17 13:09 ` [Bridge] " netdev 2022-07-17 13:59 ` Vladimir Oltean 2022-07-17 13:59 ` [Bridge] " Vladimir Oltean 2022-07-17 14:57 ` netdev [this message] 2022-07-17 14:57 ` netdev 2022-07-17 15:08 ` Vladimir Oltean 2022-07-17 15:08 ` [Bridge] " Vladimir Oltean 2022-07-17 16:10 ` netdev 2022-07-17 16:10 ` [Bridge] " netdev 2022-07-21 11:54 ` Vladimir Oltean 2022-07-21 11:54 ` [Bridge] " Vladimir Oltean 2022-07-17 15:20 ` Ido Schimmel 2022-07-17 15:20 ` [Bridge] " Ido Schimmel 2022-07-17 15:53 ` netdev 2022-07-17 15:53 ` [Bridge] " netdev 2022-07-21 11:59 ` Vladimir Oltean 2022-07-21 11:59 ` [Bridge] " Vladimir Oltean 2022-07-21 13:27 ` Ido Schimmel 2022-07-21 13:27 ` [Bridge] " Ido Schimmel 2022-07-21 14:20 ` Vladimir Oltean 2022-07-21 14:20 ` [Bridge] " Vladimir Oltean 2022-07-24 11:10 ` Ido Schimmel 2022-07-24 11:10 ` [Bridge] " Ido Schimmel 2022-08-01 11:57 ` netdev 2022-08-01 11:57 ` [Bridge] " netdev 2022-08-01 13:14 ` netdev 2022-08-01 13:14 ` [Bridge] " netdev 2022-08-02 12:54 ` netdev 2022-08-02 12:54 ` [Bridge] " netdev 2022-08-01 15:33 ` netdev 2022-08-01 15:33 ` [Bridge] " netdev 2022-08-09 9:20 ` Ido Schimmel 2022-08-09 9:20 ` [Bridge] " Ido Schimmel 2022-08-09 20:00 ` netdev 2022-08-09 20:00 ` [Bridge] " netdev 2022-08-10 7:21 ` Ido Schimmel 2022-08-10 7:21 ` [Bridge] " Ido Schimmel 2022-08-10 8:40 ` netdev 2022-08-10 8:40 ` [Bridge] " netdev 2022-08-11 11:28 ` Ido Schimmel 2022-08-11 11:28 ` [Bridge] " Ido Schimmel 2022-08-12 15:33 ` netdev 2022-08-12 15:33 ` [Bridge] " netdev 2022-08-16 7:51 ` netdev 2022-08-16 7:51 ` [Bridge] " netdev 2022-08-17 6:21 ` Ido Schimmel 2022-08-17 6:21 ` [Bridge] " Ido Schimmel 2022-07-21 11:51 ` Vladimir Oltean 2022-07-21 11:51 ` [Bridge] " Vladimir Oltean 2022-07-08 20:39 ` kernel test robot 2022-07-07 15:29 ` [PATCH v4 net-next 4/6] net: dsa: mv88e6xxx: allow reading FID when handling ATU violations Hans Schultz 2022-07-07 15:29 ` [Bridge] " Hans Schultz 2022-07-07 15:29 ` [PATCH v4 net-next 5/6] net: dsa: mv88e6xxx: mac-auth/MAB implementation Hans Schultz 2022-07-07 15:29 ` [Bridge] " Hans Schultz 2022-07-08 9:46 ` kernel test robot 2022-07-17 0:47 ` Vladimir Oltean 2022-07-17 0:47 ` [Bridge] " Vladimir Oltean 2022-07-17 12:34 ` netdev 2022-07-17 12:34 ` [Bridge] " netdev 2022-07-21 12:04 ` Vladimir Oltean 2022-07-21 12:04 ` [Bridge] " Vladimir Oltean 2022-08-19 8:28 ` netdev 2022-08-19 8:28 ` [Bridge] " netdev 2022-07-07 15:29 ` [PATCH v4 net-next 6/6] selftests: forwarding: add test of MAC-Auth Bypass to locked port tests Hans Schultz 2022-07-07 15:29 ` [Bridge] " Hans Schultz 2022-07-10 7:29 ` Ido Schimmel 2022-07-10 7:29 ` [Bridge] " Ido Schimmel 2022-07-12 12:28 ` netdev 2022-07-12 12:28 ` [Bridge] " netdev 2022-07-08 1:00 ` [PATCH v4 net-next 0/6] Extend locked port feature with FDB locked flag (MAC-Auth/MAB) Jakub Kicinski 2022-07-08 1:00 ` [Bridge] " Jakub Kicinski 2022-08-11 5:09 ` Benjamin Poirier 2022-08-11 5:09 ` [Bridge] " Benjamin Poirier -- strict thread matches above, loose matches on Subject: below -- 2022-08-12 12:29 [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers netdev 2022-08-14 14:55 ` Ido Schimmel 2022-08-19 9:51 ` netdev 2022-08-21 7:08 ` Ido Schimmel 2022-08-21 13:43 ` netdev 2022-08-22 5:40 ` Ido Schimmel 2022-08-22 7:49 ` netdev 2022-08-23 6:48 ` Ido Schimmel 2022-08-23 7:13 ` netdev 2022-08-23 7:24 ` Ido Schimmel 2022-08-23 7:37 ` netdev 2022-08-23 12:36 ` Ido Schimmel 2022-08-24 7:07 ` netdev 2022-08-23 11:41 ` netdev 2022-08-25 9:36 ` Ido Schimmel 2022-08-25 10:28 ` netdev 2022-08-25 15:14 ` netdev 2022-08-24 20:29 ` netdev 2022-08-25 9:23 ` Ido Schimmel 2022-08-25 10:27 ` netdev 2022-08-25 11:58 ` Ido Schimmel 2022-08-25 13:41 ` netdev
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=e1c1e7c114f0226b116d9549cea8e7a9@kapio-technology.com \ --to=netdev@kapio-technology.com \ --cc=andrew@lunn.ch \ --cc=bridge@lists.linux-foundation.org \ --cc=daniel@iogearbox.net \ --cc=davem@davemloft.net \ --cc=edumazet@google.com \ --cc=f.fainelli@gmail.com \ --cc=idosch@nvidia.com \ --cc=ivecera@redhat.com \ --cc=jiri@resnulli.us \ --cc=kuba@kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-kselftest@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=olteanv@gmail.com \ --cc=pabeni@redhat.com \ --cc=razor@blackwall.org \ --cc=roopa@nvidia.com \ --cc=shuah@kernel.org \ --cc=vivien.didelot@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.