On 2022-07-13 14:39, Ido Schimmel wrote:
On Wed, Jul 13, 2022 at 09:09:58AM +0200, netdev@xxxxxxxxxxxxxxxxxxxx
wrote:
What are "Storm Prevention" and "zero-DPV" FDB entries?
They are both FDB entries that at the HW level drops all packets having
a specific SA, thus using minimum resources.
(thus the name "Storm Prevention" aka, protection against DOS attacks.
We must remember that we operate with CPU based learning.)
There is no decision that I'm aware of. I'm simply trying to understand
how FDB entries that have 'BR_FDB_ENTRY_LOCKED' set are handled in
mv88e6xxx and other devices in this class. We have at least three
different implementations to consolidate:
1. The bridge driver, pure software forwarding. The locked entry is
dynamically created by the bridge. Packets received via the locked port
with a SA corresponding to the locked entry will be dropped, but will
refresh the entry. On the other hand, packets with a DA corresponding
to
the locked entry will be forwarded as known unicast through the locked
port.
2. Hardware implementations like Spectrum that can be programmed to
trap
packets that incurred an FDB miss. Like in the first case, the locked
entry is dynamically created by the bridge driver and also aged by it.
Unlike in the first case, since this entry is not present in hardware,
packets with a DA corresponding to the locked entry will be flooded as
unknown unicast.
3. Hardware implementations like mv88e6xxx that fire an interrupt upon
FDB miss. Need your help to understand how the above works there and
why. Specifically, how locked entries are represented in hardware (if
at
all) and what is the significance of not installing corresponding
entries in hardware.
With the mv88e6xxx, a miss violation with the SA occurs when there is no
entry. If you then add a normal entry with the SA, the port is open for
that SA of course. The zero-DPV entry is an entry that ensures that
there is no more miss violation interrupts from that SA, while dropping
all entries with the SA.
