netdev - Re: [PATCH net-next 4/5] net: dsa: mv88e6xxx: Offload bridge learning flag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87h7l9o1h7.fsf@waldekranz.com>
Date:   Wed, 17 Mar 2021 23:32:36 +0100
From:   Tobias Waldekranz <tobias@...dekranz.com>
To:     Vladimir Oltean <olteanv@...il.com>
Cc:     davem@...emloft.net, kuba@...nel.org, andrew@...n.ch,
        vivien.didelot@...il.com, f.fainelli@...il.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next 4/5] net: dsa: mv88e6xxx: Offload bridge learning flag

On Wed, Mar 17, 2021 at 21:29, Vladimir Oltean <olteanv@...il.com> wrote:
> On Wed, Mar 17, 2021 at 07:45:46PM +0100, Tobias Waldekranz wrote:
>> On Wed, Mar 17, 2021 at 16:12, Vladimir Oltean <olteanv@...il.com> wrote:
>> > On Mon, Mar 15, 2021 at 10:13:59PM +0100, Tobias Waldekranz wrote:
>> >> +	if (flags.mask & BR_LEARNING) {
>> >> +		u16 pav = (flags.val & BR_LEARNING) ? (1 << port) : 0;
>> >> +
>> >> +		err = mv88e6xxx_port_set_assoc_vector(chip, port, pav);
>> >> +		if (err)
>> >> +			goto out;
>> >> +	}
>> >> +
>> >
>> > If flags.val & BR_LEARNING is off, could you please call
>> > mv88e6xxx_port_fast_age too? This ensures that existing ATU entries that
>> > were automatically learned are purged.
>> 
>> This opened up another can of worms.
>> 
>> It turns out that the hardware is incapable of fast aging a LAG.
>
> You sound pretty definitive about it, do you know why?

The big note saying "Entries associated with a LAG cannot be moved or
removed using these commands" was the first clue :)

This is pure speculation on my part.

In the first iterations of this family of devices (before it was bought
by Marvell), cross-chip LAGs where not supported. You would simply set
multiple bits in the PAV for all LAG members to associate stations with
the LAG. In that scenario you can fast-age a LAG by fast-aging each
individual port.

Later, cross-chip LAGs where added, and enough support was bolted on to
the ATU to support automatic learning, but not enough to support
fast-aging.

>> I can see two workarounds. Both are awful in their own special ways:
>> 
>> 1. Iterate over all entries of all FIDs in the ATU, removing all
>>    matching dynamic entries. This will accomplish the same thing, but it
>>    is a very expensive operation, and having that in the control path of
>>    STP does not feel quite right.
>
> When does it ever feel right? :)
>
> I think of it like a faster 'bridge fdb' command (since 'bridge fdb'
> traverses the ATU super inefficiently, it dumps the whole table for each
> port).
>
> On my system with 24 mv88e6xxx ports, 'time bridge fdb' takes around 34
> seconds. So that means a 'slow age' will take around 1.4 seconds for a
> single LAG.

Well, it also scales linearly with the number of active entries in the
ATU. Here are some times for "bridge fdb" on my system with a single
6390X:

Entries    Time
      1   0.17s
     10   0.48s
    100   3.20s
    200   6.24s
   1000  31.82s

(I used trafgen to generate broadcasts with random SAs)

Then you have to consider that you are not simply walking the ATU, you
also have to write back entries whenever you come across one attached to
the LAG you are fast-aging.

> On the other hand, on my system with 7 sja1105 ports, I have no choice
> but to do slow ageing - the hardware simply doesn't have the concept of
> 'fast ageing'. There, 'time bridge fdb' returns 1.781s, so I expect a
> slow age would take around 0.25 seconds. Of course I'm not happy about
> it, but I think I'll bite the bullet.
>
>> 2. Flushing all dynamic entries in the entire ATU. Fast, but obviously
>>    results in a period of lots of flooded packets.
>
> This one seems like an overreaction to me. Would that even solve the
> problem? Couly you destroy and re-create the trunk?

It would make sure that no entries lingered on the port in question,
absolutely. Unfortunately that would also be true for all other ports :)

Adding/removing a LAG in hardware has no connection to ATU entries
unfortunately.

>> Any opinion on which approach you think would hurt less? Or, even
>> better, if there is a third way that I have missed.
>> 
>> For this series I am leaning towards making mv88e6xxx_port_fast_age a
>> no-op for LAG ports. We could then come back to this problem when we add
>> other LAG-related FDB operations like static FDB entries. Acceptable?
>
> Yeah, I guess that's fair.

Great. I will try to put together a v2 tomorrow.