netdev at kapio-technology.com
2022-Jul-17 12:21 UTC
[Bridge] [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers
On 2022-07-13 14:39, Ido Schimmel wrote:> On Wed, Jul 13, 2022 at 09:09:58AM +0200, netdev at kapio-technology.com > wrote:> > What are "Storm Prevention" and "zero-DPV" FDB entries?They are both FDB entries that at the HW level drops all packets having a specific SA, thus using minimum resources. (thus the name "Storm Prevention" aka, protection against DOS attacks. We must remember that we operate with CPU based learning.)> > There is no decision that I'm aware of. I'm simply trying to understand > how FDB entries that have 'BR_FDB_ENTRY_LOCKED' set are handled in > mv88e6xxx and other devices in this class. We have at least three > different implementations to consolidate: > > 1. The bridge driver, pure software forwarding. The locked entry is > dynamically created by the bridge. Packets received via the locked port > with a SA corresponding to the locked entry will be dropped, but will > refresh the entry. On the other hand, packets with a DA corresponding > to > the locked entry will be forwarded as known unicast through the locked > port. > > 2. Hardware implementations like Spectrum that can be programmed to > trap > packets that incurred an FDB miss. Like in the first case, the locked > entry is dynamically created by the bridge driver and also aged by it. > Unlike in the first case, since this entry is not present in hardware, > packets with a DA corresponding to the locked entry will be flooded as > unknown unicast. > > 3. Hardware implementations like mv88e6xxx that fire an interrupt upon > FDB miss. Need your help to understand how the above works there and > why. Specifically, how locked entries are represented in hardware (if > at > all) and what is the significance of not installing corresponding > entries in hardware. >With the mv88e6xxx, a miss violation with the SA occurs when there is no entry. If you then add a normal entry with the SA, the port is open for that SA of course. The zero-DPV entry is an entry that ensures that there is no more miss violation interrupts from that SA, while dropping all entries with the SA.
Vladimir Oltean
2022-Jul-17 12:57 UTC
[Bridge] [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers
On Sun, Jul 17, 2022 at 02:21:47PM +0200, netdev at kapio-technology.com wrote:> On 2022-07-13 14:39, Ido Schimmel wrote: > > On Wed, Jul 13, 2022 at 09:09:58AM +0200, netdev at kapio-technology.com > > wrote: > > > > > What are "Storm Prevention" and "zero-DPV" FDB entries? > > They are both FDB entries that at the HW level drops all packets having a > specific SA, thus using minimum resources. > (thus the name "Storm Prevention" aka, protection against DOS attacks. We > must remember that we operate with CPU based learning.)DPV means Destination Port Vector, and an ATU entry with a DPV of 0 essentially means a FDB entry pointing nowhere, so it will drop the packet. That's a slight problem with Hans' implementation, the bridge thinks that the locked FDB entry belongs to port X, but in reality it matches on all bridged ports (since it matches by FID). FID allocation in mv88e6xxx is slightly strange, all VLAN-unaware bridge ports, belonging to any bridge, share the same FID, so the FDB databases are not exactly isolated from each other.
Ido Schimmel
2022-Jul-17 15:20 UTC
[Bridge] [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers
On Sun, Jul 17, 2022 at 02:21:47PM +0200, netdev at kapio-technology.com wrote:> On 2022-07-13 14:39, Ido Schimmel wrote: > > On Wed, Jul 13, 2022 at 09:09:58AM +0200, netdev at kapio-technology.com > > wrote: > > > > > What are "Storm Prevention" and "zero-DPV" FDB entries? > > They are both FDB entries that at the HW level drops all packets having a > specific SA, thus using minimum resources. > (thus the name "Storm Prevention" aka, protection against DOS attacks. We > must remember that we operate with CPU based learning.) > > > > > There is no decision that I'm aware of. I'm simply trying to understand > > how FDB entries that have 'BR_FDB_ENTRY_LOCKED' set are handled in > > mv88e6xxx and other devices in this class. We have at least three > > different implementations to consolidate: > > > > 1. The bridge driver, pure software forwarding. The locked entry is > > dynamically created by the bridge. Packets received via the locked port > > with a SA corresponding to the locked entry will be dropped, but will > > refresh the entry. On the other hand, packets with a DA corresponding to > > the locked entry will be forwarded as known unicast through the locked > > port. > > > > 2. Hardware implementations like Spectrum that can be programmed to trap > > packets that incurred an FDB miss. Like in the first case, the locked > > entry is dynamically created by the bridge driver and also aged by it. > > Unlike in the first case, since this entry is not present in hardware, > > packets with a DA corresponding to the locked entry will be flooded as > > unknown unicast. > > > > 3. Hardware implementations like mv88e6xxx that fire an interrupt upon > > FDB miss. Need your help to understand how the above works there and > > why. Specifically, how locked entries are represented in hardware (if at > > all) and what is the significance of not installing corresponding > > entries in hardware. > > > > With the mv88e6xxx, a miss violation with the SA occurs when there is no > entry. If you then add a normal entry with the SA, the port is open for that > SA of course.Good> The zero-DPV entry is an entry that ensures that there is no more miss > violation interrupts from that SA, while dropping all entries with the > SA.Few questions: 1. Is it correct to think of this entry as an entry pointing to a special /dev/null port? 2. After installing this entry, you no longer get miss violation interrupts because packets with this SA incur a mismatch violation (src_port != /dev/null) and therefore discarded in hardware? 3. What happens to packets with a DA matching the zero-DPV entry, are they also discarded in hardware? If so, here we differ from the bridge driver implementation where such packets will be forwarded according to the locked entry and egress the locked port 4. The reason for installing this entry is to suppress further miss violation interrupts? 5. If not replaced, will this entry always age out after the ageing time? Not sure what can refresh it given that traffic does not ingress from the /dev/null port. Thanks