netdev - Re: [PATCH iwl-next v1] ice: add drop rule matching on not active lport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2181fe8c-44d3-acdd-b474-0faf7a78d69a@intel.com>
Date: Thu, 24 Aug 2023 13:40:14 -0700
From: Tony Nguyen <anthony.l.nguyen@...el.com>
To: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>,
	<intel-wired-lan@...ts.osuosl.org>
CC: <netdev@...r.kernel.org>, <david.m.ertman@...el.com>,
	<wojciech.drewek@...el.com>, Marcin Szycik <marcin.szycik@...el.com>
Subject: Re: [PATCH iwl-next v1] ice: add drop rule matching on not active
 lport



On 8/22/2023 8:57 PM, Michal Swiatkowski wrote:
> Inactive LAG port should not receive any packets, as it can cause adding
> invalid FDBs (bridge offload). Add a drop rule matching on inactive lport
> in LAG.
> 
> Co-developed-by: Marcin Szycik <marcin.szycik@...el.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@...el.com>
> Signed-off-by: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
> ---
>   .../net/ethernet/intel/ice/ice_eswitch_br.c   |  6 +-
>   drivers/net/ethernet/intel/ice/ice_lag.c      | 80 ++++++++++++++++---
>   drivers/net/ethernet/intel/ice/ice_lag.h      |  2 +
>   3 files changed, 72 insertions(+), 16 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch_br.c b/drivers/net/ethernet/intel/ice/ice_eswitch_br.c
> index 67bfd1f61cdd..6ae0269bdf73 100644
> --- a/drivers/net/ethernet/intel/ice/ice_eswitch_br.c
> +++ b/drivers/net/ethernet/intel/ice/ice_eswitch_br.c
> @@ -73,7 +73,7 @@ ice_eswitch_br_ingress_rule_setup(struct ice_adv_rule_info *rule_info,
>   	rule_info->sw_act.vsi_handle = vf_vsi_idx;
>   	rule_info->sw_act.flag |= ICE_FLTR_RX;
>   	rule_info->sw_act.src = pf_id;
> -	rule_info->priority = 5;
> +	rule_info->priority = 2;

I'm not seeing anything in the commit message about changing priority. 
Would be nice to see why this is needed for review and posterity.

>   }
>   
>   static void
> @@ -84,7 +84,7 @@ ice_eswitch_br_egress_rule_setup(struct ice_adv_rule_info *rule_info,
>   	rule_info->sw_act.flag |= ICE_FLTR_TX;
>   	rule_info->flags_info.act = ICE_SINGLE_ACT_LAN_ENABLE;
>   	rule_info->flags_info.act_valid = true;
> -	rule_info->priority = 5;
> +	rule_info->priority = 2;
>   }
>   
>   static int
> @@ -207,7 +207,7 @@ ice_eswitch_br_guard_rule_create(struct ice_hw *hw, u16 vsi_idx,
>   	rule_info.allow_pass_l2 = true;
>   	rule_info.sw_act.vsi_handle = vsi_idx;
>   	rule_info.sw_act.fltr_act = ICE_NOP;
> -	rule_info.priority = 5;
> +	rule_info.priority = 2;
>   
>   	err = ice_add_adv_rule(hw, list, lkups_cnt, &rule_info, rule);
>   	if (err)