lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 27 Mar 2019 00:38:00 +0200
From:   Vladimir Oltean <olteanv@...il.com>
To:     Florian Fainelli <f.fainelli@...il.com>, davem@...emloft.net,
        netdev@...r.kernel.org
Cc:     andrew@...n.ch, vivien.didelot@...il.com, linus.walleij@...aro.org
Subject: Re: [RFC PATCH net-next 10/13] net: dsa: sja1105: Add support for
 traffic through standalone ports

On 3/27/19 12:13 AM, Florian Fainelli wrote:
> On 3/26/19 3:03 PM, Vladimir Oltean wrote:
>> On 3/26/19 4:31 AM, Florian Fainelli wrote:
>>>
>>>
>>> On 3/23/2019 8:23 PM, Vladimir Oltean wrote:
>>>> In order to support this, we are creating a make-shift switch tag out of
>>>> a VLAN trunk configured on the CPU port. Termination on switch ports
>>>> only works when not under a vlan_filtering bridge. We are making use of
>>>> the generic CONFIG_NET_DSA_TAG_8021Q code and leveraging it from our own
>>>> CONFIG_NET_DSA_TAG_SJA1105.
>>>>
>>>> There are two types of traffic: regular and link-local.
>>>> The link-local traffic received on the CPU port is trapped from the
>>>> switch's regular forwarding decisions because it matched one of the two
>>>> DMAC filters for management traffic.
>>>> On transmission, the switch requires special massaging for these
>>>> link-local frames. Due to a weird implementation of the switching IP, by
>>>> default it drops link-local frames that originate on the CPU port. It
>>>> needs to be told where to forward them to, through an SPI command
>>>> ("management route") that is valid for only a single frame.
>>>> So when we're sending link-local traffic, we need to clone skb's from
>>>> DSA and send them in our custom xmit worker that also performs SPI
>>>> access.
>>>>
>>>> For that purpose, the DSA xmit handler and the xmit worker communicate
>>>> through a per-port "skb ring" software structure, with a producer and a
>>>> consumer index. At the moment this structure is rather fragile
>>>> (ping-flooding to a link-local DMAC would cause most of the frames to
>>>> get dropped). I would like to move the management traffic on a separate
>>>> netdev queue that I can stop when the skb ring got full and hardware is
>>>> busy processing, so that we are not forced to drop traffic.
>>>>
>>>> Signed-off-by: Vladimir Oltean <olteanv@...il.com>
>>>
>>> Reviewed-by: Florian Fainelli <f.fainelli@...il.com>
>>>
>>> I do like the idea of setting up specific management queue later on,
>>> although it is not clear to me how you would go about integrating it as
>>> a network device, given the DSA slave and master devices, do you know
>>> roughly how you would proceed?
>>>
>>
>> Actually I was thinking about leveraging the multiqueue support that you
>> added in 55199df6d2af ("net: dsa: Allow switch drivers to indicate
>> number of TX queues") and expose the slave netdev .ndo_select_queue
>> callback towards DSA ports. There I would return queue #0 if
>> sja1105_is_link_local(skb), and queue #1 otherwise.
>> Are there any complications that I'm missing?
> 
> So that queue could be used to steer management traffic, but it would
> still attempt to perform a dev_queue_xmit() using the master DSA network
> device unless you somehow change that and/or parent that queue to a
> different network device that the sja1105 switch driver creates (which
> is doable).
> 

But the problem I'm trying to solve with the management queue is not 
congestion on the master port or inside the switch, but a problem that I 
myself have created by putting some skb's in a ring that is finite (and 
small) in size: the DSA xmit racing with my xmit worker.
Congestion management on the switch is a much ampler issue that I don't 
yet know how to handle. The MACs don't appear to generate pause frames, 
and the pause frames that they receive are trapped to the CPU as 
link-local traffic (DMAC 01-80-C2-00-00-01) where they are simply 
consumed by the master's MAC.

-Vladimir

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ