netdev - Re: [PATCH RFC net-next 00/13] RX filtering for DSA switches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 May 2020 20:42:34 +0200
From:   "Allan W. Nielsen" <allan.nielsen@...rochip.com>
To:     Vladimir Oltean <olteanv@...il.com>
CC:     <andrew@...n.ch>, <f.fainelli@...il.com>,
        <vivien.didelot@...il.com>, <davem@...emloft.net>,
        <jiri@...nulli.us>, <idosch@...sch.org>, <kuba@...nel.org>,
        <ivecera@...hat.com>, <netdev@...r.kernel.org>,
        <horatiu.vultur@...rochip.com>, <nikolay@...ulusnetworks.com>,
        <roopa@...ulusnetworks.com>
Subject: Re: [PATCH RFC net-next 00/13] RX filtering for DSA switches

Hi Vladimir,

I'm very happy to see that you started working on this. Let me know if
you need help to update the Ocelot/Felix driver to support this.

/Allan

On 22.05.2020 00:10, Vladimir Oltean wrote:
>EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>
>From: Vladimir Oltean <vladimir.oltean@....com>
>
>This is a WIP series whose stated goal is to allow DSA and switchdev
>drivers to flood less traffic to the CPU while keeping the same level of
>functionality.
>
>The strategy is to whitelist towards the CPU only the {DMAC, VLAN} pairs
>that the operating system has expressed its interest in, either due to
>those being the MAC addresses of one of the switch ports, or addresses
>added to our device's RX filter via calls to dev_uc_add/dev_mc_add.
>Then, the traffic which is not explicitly whitelisted is not sent by the
>hardware to the CPU, under the assumption that the CPU didn't ask for it
>and would have dropped it anyway.
>
>The ground for these patches were the discussions surrounding RX
>filtering with switchdev in general, as well as with DSA in particular:
>
>"[PATCH net-next 0/4] DSA: promisc on master, generic flow dissector code":
>https://www.spinics.net/lists/netdev/msg651922.html
>"[PATCH v3 net-next 2/2] net: dsa: felix: Allow unknown unicast traffic towards the CPU port module":
>https://www.spinics.net/lists/netdev/msg634859.html
>"[PATCH v3 0/2] net: core: Notify on changes to dev->promiscuity":
>https://lkml.org/lkml/2019/8/29/255
>LPC2019 - SwitchDev offload optimizations:
>https://www.youtube.com/watch?v=B1HhxEcU7Jg
>
>Unicast filtering comes to me as most important, and this includes
>termination of MAC addresses corresponding to the network interfaces in
>the system (DSA switch ports, VLAN sub-interfaces, bridge interface).
>The first 4 patches use Ivan Khoronzhuk's IVDF framework for extending
>network interface addresses with a Virtual ID (typically VLAN ID). This
>matches DSA switches perfectly because their FDB already contains keys
>of the {DMAC, VID} form.
>
>Multicast filtering was taken and reworked from Florian Fainelli's
>previous attempts, according to my own understanding of multicast
>forwarding requirements of an IGMP snooping switch. This is the part
>that needs the most extra work, not only in the DSA core but also in
>drivers. For this reason, I've left out of this patchset anything that
>has to do with driver-level configuration (since the audience is a bit
>larger than usual), as I'm trying to focus more on policy for now, and
>the series is already pretty huge.
>
>Florian Fainelli (3):
>  net: bridge: multicast: propagate br_mc_disabled_update() return
>  net: dsa: add ability to program unicast and multicast filters for CPU
>    port
>  net: dsa: wire up multicast IGMP snooping attribute notification
>
>Ivan Khoronzhuk (4):
>  net: core: dev_addr_lists: add VID to device address
>  net: 8021q: vlan_dev: add vid tag to addresses of uc and mc lists
>  net: 8021q: vlan_dev: add vid tag for vlan device own address
>  ethernet: eth: add default vid len for all ethernet kind devices
>
>Vladimir Oltean (6):
>  net: core: dev_addr_lists: export some raw __hw_addr helpers
>  net: dsa: don't use switchdev_notifier_fdb_info in
>    dsa_switchdev_event_work
>  net: dsa: mroute: don't panic the kernel if called without the prepare
>    phase
>  net: bridge: add port flags for host flooding
>  net: dsa: deal with new flooding port attributes from bridge
>  net: dsa: treat switchdev notifications for multicast router connected
>    to port
>
> include/linux/if_bridge.h |   3 +
> include/linux/if_vlan.h   |   2 +
> include/linux/netdevice.h |  11 ++
> include/net/dsa.h         |  17 +++
> net/8021q/Kconfig         |  12 ++
> net/8021q/vlan.c          |   3 +
> net/8021q/vlan.h          |   2 +
> net/8021q/vlan_core.c     |  25 ++++
> net/8021q/vlan_dev.c      | 102 +++++++++++---
> net/bridge/br_if.c        |  40 ++++++
> net/bridge/br_multicast.c |  21 ++-
> net/bridge/br_switchdev.c |   4 +-
> net/core/dev_addr_lists.c | 144 +++++++++++++++----
> net/dsa/Kconfig           |   1 +
> net/dsa/dsa2.c            |   6 +
> net/dsa/dsa_priv.h        |  27 +++-
> net/dsa/port.c            | 155 ++++++++++++++++----
> net/dsa/slave.c           | 288 +++++++++++++++++++++++++++++++-------
> net/dsa/switch.c          |  36 +++++
> net/ethernet/eth.c        |  12 +-
> 20 files changed, 780 insertions(+), 131 deletions(-)
>
>--
>2.25.1
>
/Allan