linux-kernel - Re: [PATCH net-next v2 0/3] net: ethernet: ti: cpsw: enable bc/mc storm prevention support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 2 Nov 2021 14:36:54 +0200
From:   Grygorii Strashko <grygorii.strashko@...com>
To:     Vladimir Oltean <vladimir.oltean@....com>
CC:     "David S. Miller" <davem@...emloft.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Jakub Kicinski <kuba@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Kishon Vijay Abraham I <kishon@...com>,
        Vignesh Raghavendra <vigneshr@...com>,
        "linux-omap@...r.kernel.org" <linux-omap@...r.kernel.org>,
        Tony Lindgren <tony@...mide.com>, Andrew Lunn <andrew@...n.ch>
Subject: Re: [PATCH net-next v2 0/3] net: ethernet: ti: cpsw: enable bc/mc
 storm prevention support



On 02/11/2021 01:53, Vladimir Oltean wrote:
> On Mon, Nov 01, 2021 at 07:01:19PM +0200, Grygorii Strashko wrote:
>> Hi
>>
>> This series first adds supports for the ALE feature to rate limit number ingress
>> broadcast(BC)/multicast(MC) packets per/sec which main purpose is BC/MC storm
>> prevention.
>>
>> And then enables corresponding support for ingress broadcast(BC)/multicast(MC)
>> packets rate limiting for TI CPSW switchdev and AM65x/J221E CPSW_NUSS drivers by
>> implementing HW offload for simple tc-flower with policer action with matches
>> on dst_mac:
>>   - ff:ff:ff:ff:ff:ff has to be used for BC packets rate limiting
>>   - 01:00:00:00:00:00 fixed value has to be used for MC packets rate limiting
>>
>> Examples:
>> - BC rate limit to 1000pps:
>>    tc qdisc add dev eth0 clsact
>>    tc filter add dev eth0 ingress flower skip_sw dst_mac ff:ff:ff:ff:ff:ff \
>>    action police pkts_rate 1000 pkts_burst 1
>>
>> - MC rate limit to 20000pps:
>>    tc qdisc add dev eth0 clsact
>>    tc filter add dev eth0 ingress flower skip_sw dst_mac 01:00:00:00:00:00 \
>>    action police pkts_rate 10000 pkts_burst 1
>>
>>    pkts_burst - not used.
>>
>> The solution inspired patch from Vladimir Oltean [1].
>>
>> Changes in v2:
>>   - switch to packet-per-second policing introduced by
>>     commit 2ffe0395288a ("net/sched: act_police: add support for packet-per-second policing") [2]
>>
>> v1: https://patchwork.kernel.org/project/netdevbpf/cover/20201114035654.32658-1-grygorii.strashko@ti.com/
>>
>> [1] https://lore.kernel.org/patchwork/patch/1217254/
>> [2] https://patchwork.kernel.org/project/netdevbpf/cover/20210312140831.23346-1-simon.horman@netronome.com/
>>
>> Grygorii Strashko (3):
>>    drivers: net: cpsw: ale: add broadcast/multicast rate limit support
>>    net: ethernet: ti: am65-cpsw: enable bc/mc storm prevention support
>>    net: ethernet: ti: cpsw_new: enable bc/mc storm prevention support
>>
>>   drivers/net/ethernet/ti/am65-cpsw-qos.c | 145 ++++++++++++++++++++
>>   drivers/net/ethernet/ti/am65-cpsw-qos.h |   8 ++
>>   drivers/net/ethernet/ti/cpsw_ale.c      |  66 +++++++++
>>   drivers/net/ethernet/ti/cpsw_ale.h      |   2 +
>>   drivers/net/ethernet/ti/cpsw_new.c      |   4 +-
>>   drivers/net/ethernet/ti/cpsw_priv.c     | 170 ++++++++++++++++++++++++
>>   drivers/net/ethernet/ti/cpsw_priv.h     |   8 ++
>>   7 files changed, 402 insertions(+), 1 deletion(-)
>>
>> -- 
>> 2.17.1
>>
> 
> I don't think I've asked this for v1, but when you say multicast storm
> control, does the hardware police just unknown multicast frames, or all
> multicast frames?
> 

  packets per/sec rate limiting is affects all MC or BC packets once enabled.

-- 
Best regards,
grygorii