linux-kernel - Re: [PATCH net-next v2 2/3] net: ethernet: ti: am65-cpsw: enable bc/mc storm prevention support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 Nov 2021 00:20:30 +0200
From:   Grygorii Strashko <grygorii.strashko@...com>
To:     Jakub Kicinski <kuba@...nel.org>
CC:     "David S. Miller" <davem@...emloft.net>, <netdev@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        Kishon Vijay Abraham I <kishon@...com>,
        Vignesh Raghavendra <vigneshr@...com>,
        <linux-omap@...r.kernel.org>, Tony Lindgren <tony@...mide.com>,
        Andrew Lunn <andrew@...n.ch>,
        Vladimir Oltean <vladimir.oltean@....com>
Subject: Re: [PATCH net-next v2 2/3] net: ethernet: ti: am65-cpsw: enable
 bc/mc storm prevention support

hi Jakub,

On 03/11/2021 02:38, Jakub Kicinski wrote:
> On Mon, 1 Nov 2021 19:01:21 +0200 Grygorii Strashko wrote:
>>   - 01:00:00:00:00:00 fixed value has to be used for MC packets rate
>>     limiting (exact match)
> 
> This looks like a stretch, why not use a mask? You can require users to
> always install both BC and MC rules if you want to make sure the masked
> rule does not match BC.
> 

Those matching rules are hard coded in HW for packet rate limiting and SW only
enables them and sets requested pps limit.
- 1:BC: HW does exact match on BC MAC address
- 2:MC: HW does match on MC bit (the least-significant bit of the first octet)

Therefore the exact match done in this patch for above dst_mac's with
is_broadcast_ether_addr() and ether_addr_equal().

The K3 cpsw also supports number configurable policiers (bit rate limit) in
ALE for which supports is to be added, and for them MC mask (sort of, it uses
number of ignored bits, like FF-FF-FF-00-00-00) can be used.

-- 
Best regards,
grygorii