On Wed, Aug 10, 2022 at 10:40:45AM +0200, netdev@kapio-technology.com wrote:

On 2022-08-10 09:21, Ido Schimmel wrote:

quoted

On Tue, Aug 09, 2022 at 10:00:49PM +0200, netdev@kapio-technology.com
wrote:

quoted

On 2022-08-09 11:20, Ido Schimmel wrote:

quoted

On Mon, Aug 01, 2022 at 05:33:49PM +0200, netdev@kapio-technology.com
wrote:

quoted

On 2022-07-13 14:39, Ido Schimmel wrote:

quoted

What are "Storm Prevention" and "zero-DPV" FDB entries?

For the zero-DPV entries, I can summarize:

Since a CPU can become saturated from constant SA Miss Violations
from a
denied source, source MAC address are masked by loading a zero-DPV
(Destination Port Vector) entry in the ATU. As the address now
appears in
the database it will not cause more Miss Violations. ANY port trying
to send
a frame to this unauthorized address is discarded. Any locked port
trying to
use this unauthorized address has its frames discarded too (as the
ports SA
bit is not set in the ATU entry).

What happens to unlocked ports that have learning enabled and are trying
to use this address as SMAC? AFAICT, at least in the bridge driver, the
locked entry will roam, but will keep the "locked" flag, which is
probably not what we want. Let's see if we can agree on these semantics
for a "locked" entry:

The next version of this will block forwarding to locked entries in
the
bridge, so they will behave like the zero-DPV entries.

I'm talking about roaming, not forwarding. Let's say you have a locked
entry with MAC X pointing to port Y. Now you get a packet with SMAC X
from port Z which is unlocked. Will the FDB entry roam to port Z? I
think it should, but at least in current implementation it seems that
the "locked" flag will not be reset and having locked entries pointing
to an unlocked port looks like a bug.

Remember that zero-DPV entries blackhole (mask) the MAC, so whenever a
packet appears with the same MAC on another port it is just dropped in the

What do you mean by "same MAC"? As SMAC or DMAC? I'm talking about SMAC
and when the packet is received via an unlocked port. Why would such a
packet be dropped?

HW, so there is no possibility of doing any CPU processing in this case.
Only after the timeout (5 min) can the MAC get a normal ATU on an open port.
For the bridge to do what you suggest, a FDB search would be needed afaics,
and this might be in a process sensitive part of the code, thus leading to
too heavy a cost.

When learning is enabled the bridge already performs a lookup on the
SMAC.

TBH, I don't think this is progressing well because there is too much
discrepancy between how this feature works in the bridge driver and in
the hardware you work with.

I suggest to first define the model in the bridge driver and then take
care of the offload. My suggestion is to send another RFC with only the
bridge changes with emphasize on the following aspects:

* Forwarding rules for "locked" entries. Do they drop matching packets?
Forward them? Or not considered at all for forwarding?

* Roaming rules for "locked" entries. Can they roam between locked
ports? Can they roam from a locked port to an unlocked port and
vice versa? Or are they completely sticky?

* Ageing rule for "locked" entries. Are these entries subject to the
ageing time or are they static? If they are not static, are they
refreshed by incoming traffic from a locked port or not?

* MAB enablement. New option? Overload an existing one? No option?

The commit messages should explain these design choices and new tests
cases should verify the desired behavior.

Once we have an agreement we can work out the switchdev/mv88e6xxx parts
and eventually the entire thing can be merged together. Fair?