netdev - Re: [PATCH RFC 1/2] net: dsa: integrate with SWITCHDEV for HW bridging

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <54EB6BF5.2020600@gmail.com>
Date:	Mon, 23 Feb 2015 10:05:41 -0800
From:	Florian Fainelli <f.fainelli@...il.com>
To:	Andrew Lunn <andrew@...n.ch>, Guenter Roeck <linux@...ck-us.net>
CC:	netdev <netdev@...r.kernel.org>,
	David Miller <davem@...emloft.net>,
	Vivien Didelot <vivien.didelot@...oirfairelinux.com>,
	jerome.oufella@...oirfairelinux.com,
	Chris Healy <cphealy@...il.com>
Subject: Re: [PATCH RFC 1/2] net: dsa: integrate with SWITCHDEV for HW bridging

On 23/02/15 08:01, Andrew Lunn wrote:
>> I currently use ATU command 110 (flush all non-static entries in a
>> particular FID). I see means to flush either all entries or all
>> non-static entries, but no means to only flush unicast or multicast
>> entries. Does any of the standards distinguish between learned unicast
>> and multicast addresses ? Flushing those selectively might be a
>> challenge.

Lucky you, on Broadcom switches you have to issue an ARL search, get the
results (there are all valid MAC entries, fortunately), and invalidate
the entries one by one for your particular ports of interest, there is
no "flush all non-static entries".

> 
> You might need to walk the table and flush records individually if you
> are only interested in one type.
> 
> We should also consider do we need to make these flush operations
> atomic with respect to other operations? Do we need to disable
> learning, flush, change the port STP status, and then enable learning?

I think we may have to do this to guarantee no race conditions between
flushing the switch's FDB, although it would look like only "joining" a
bridge needs to be a more controlled operation, on leave we can probably
just leave the bridge, flush entries and the switch port will start
learning new MAC addresses, right?

Alternatively, would not setting a very low aging timeout and
maintaining HW learning still allow us to simplify these operations?
-- 
Florian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html