Messages in this thread |  | | Date | Sun, 17 Jul 2022 14:21:47 +0200 | From | netdev@kapio-te ... | Subject | Re: [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers |
| |
On 2022-07-13 14:39, Ido Schimmel wrote: > On Wed, Jul 13, 2022 at 09:09:58AM +0200, netdev@kapio-technology.com > wrote:
> > What are "Storm Prevention" and "zero-DPV" FDB entries?
They are both FDB entries that at the HW level drops all packets having a specific SA, thus using minimum resources. (thus the name "Storm Prevention" aka, protection against DOS attacks. We must remember that we operate with CPU based learning.)
> > There is no decision that I'm aware of. I'm simply trying to understand > how FDB entries that have 'BR_FDB_ENTRY_LOCKED' set are handled in > mv88e6xxx and other devices in this class. We have at least three > different implementations to consolidate: > > 1. The bridge driver, pure software forwarding. The locked entry is > dynamically created by the bridge. Packets received via the locked port > with a SA corresponding to the locked entry will be dropped, but will > refresh the entry. On the other hand, packets with a DA corresponding > to > the locked entry will be forwarded as known unicast through the locked > port. > > 2. Hardware implementations like Spectrum that can be programmed to > trap > packets that incurred an FDB miss. Like in the first case, the locked > entry is dynamically created by the bridge driver and also aged by it. > Unlike in the first case, since this entry is not present in hardware, > packets with a DA corresponding to the locked entry will be flooded as > unknown unicast. > > 3. Hardware implementations like mv88e6xxx that fire an interrupt upon > FDB miss. Need your help to understand how the above works there and > why. Specifically, how locked entries are represented in hardware (if > at > all) and what is the significance of not installing corresponding > entries in hardware. >
With the mv88e6xxx, a miss violation with the SA occurs when there is no entry. If you then add a normal entry with the SA, the port is open for that SA of course. The zero-DPV entry is an entry that ensures that there is no more miss violation interrupts from that SA, while dropping all entries with the SA.
|  |