netdev - Re: [PATCH net-next 4/5] net: dsa: mv88e6xxx: Offload bridge learning flag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87k0q5obz9.fsf@waldekranz.com>
Date:   Wed, 17 Mar 2021 19:45:46 +0100
From:   Tobias Waldekranz <tobias@...dekranz.com>
To:     Vladimir Oltean <olteanv@...il.com>
Cc:     davem@...emloft.net, kuba@...nel.org, andrew@...n.ch,
        vivien.didelot@...il.com, f.fainelli@...il.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next 4/5] net: dsa: mv88e6xxx: Offload bridge learning flag

On Wed, Mar 17, 2021 at 16:12, Vladimir Oltean <olteanv@...il.com> wrote:
> On Mon, Mar 15, 2021 at 10:13:59PM +0100, Tobias Waldekranz wrote:
>> +	if (flags.mask & BR_LEARNING) {
>> +		u16 pav = (flags.val & BR_LEARNING) ? (1 << port) : 0;
>> +
>> +		err = mv88e6xxx_port_set_assoc_vector(chip, port, pav);
>> +		if (err)
>> +			goto out;
>> +	}
>> +
>
> If flags.val & BR_LEARNING is off, could you please call
> mv88e6xxx_port_fast_age too? This ensures that existing ATU entries that
> were automatically learned are purged.

This opened up another can of worms.

It turns out that the hardware is incapable of fast aging a LAG. I can
see two workarounds. Both are awful in their own special ways:

1. Iterate over all entries of all FIDs in the ATU, removing all
   matching dynamic entries. This will accomplish the same thing, but it
   is a very expensive operation, and having that in the control path of
   STP does not feel quite right.

2. Flushing all dynamic entries in the entire ATU. Fast, but obviously
   results in a period of lots of flooded packets.

Any opinion on which approach you think would hurt less? Or, even
better, if there is a third way that I have missed.

For this series I am leaning towards making mv88e6xxx_port_fast_age a
no-op for LAG ports. We could then come back to this problem when we add
other LAG-related FDB operations like static FDB entries. Acceptable?