Message ID | 1528974690-31600-1-git-send-email-ilias.apalodimas@linaro.org |
---|---|
Headers | show |
Series | Add switchdev on TI-CPSW | expand |
Hi Ilias Thanks for removing the CPU port. That helps a lot moving forward. > - Multicast testing client-port1(tagged on vlan 100) server-port1 > switch-config is provided by TI (https://git.ti.com/switch-config) > and is used to verify correct switch configuration. > 1. switch-config output > - type: vlan , vid = 100, untag_force = 0x4, reg_mcast = 0x6, > unreg_mcast = 0x0, member_list = 0x6 > Server running on sw0p2: iperf -s -u -B 239.1.1.1 -i 1 > Client running on sw0p1: iperf -c 239.1.1.1 -u -b 990m -f m -i 5 -t 3600 > No IGMP reaches the CPU port to add MDBs(since CPU does not receive > unregistered multicast as programmed). Is this something you can work around? Is there a TCAM you can program to detect IGMP and pass the packets to the CPU? Without receiving IGMP, multicast is pretty broken. If i understand right, a multicast listener running on the CPU should work, since you can add an MDB to receive multicast traffic from the two ports. Multicast traffic sent from the CPU also works. What does not work is IGMP snooping of traffic between the two switch ports. You have no access to the IGMP frames, so cannot snoop. So unless you can work around that with a TCAM, i think you just have to blindly pass all multicast between the two ports. > Setting on/off and IFF_MULTICAST (on eth0/eth1/br0) will affect registered > multicast masks programmed in the switch(for port1, port2, cpu port > respectively). > This muct occur before adding VLANs on the interfaces. If you change the > flag after the VLAN configuration you need to re-issue the VLAN config > commands. This you should fix. You should be able to get the stack to tell you about all the configured VLANs, so you can re-program the switch. > - NFS: > The only way for NFS to work is by chrooting to a minimal environment when > switch configuration that will affect connectivity is needed. You might want to look at the commit history for DSA. Florian added a patch which makes NFS root work with DSA. It might give you clues as to what you need to add to make it just work. Andrew
On Mon, Jun 18, 2018 at 05:04:24PM +0200, Andrew Lunn wrote: > Hi Ilias > > Thanks for removing the CPU port. That helps a lot moving forward. > > > - Multicast testing client-port1(tagged on vlan 100) server-port1 > > switch-config is provided by TI (https://git.ti.com/switch-config) > > and is used to verify correct switch configuration. > > 1. switch-config output > > - type: vlan , vid = 100, untag_force = 0x4, reg_mcast = 0x6, > > unreg_mcast = 0x0, member_list = 0x6 > > Server running on sw0p2: iperf -s -u -B 239.1.1.1 -i 1 > > Client running on sw0p1: iperf -c 239.1.1.1 -u -b 990m -f m -i 5 -t 3600 > > No IGMP reaches the CPU port to add MDBs(since CPU does not receive > > unregistered multicast as programmed). > > Is this something you can work around? Is there a TCAM you can program > to detect IGMP and pass the packets to the CPU? Without receiving > IGMP, multicast is pretty broken. Yes it's described in example 2. (i'll explain in detail further down) > > If i understand right, a multicast listener running on the CPU should > work, since you can add an MDB to receive multicast traffic from the > two ports. Multicast traffic sent from the CPU also works. What does > not work is IGMP snooping of traffic between the two switch ports. You > have no access to the IGMP frames, so cannot snoop. So unless you can > work around that with a TCAM, i think you just have to blindly pass > all multicast between the two ports. Yes, if the CPU port is added on the VLAN then unregistered multicast traffic (and thus IGMP joins) will reach the CPU port and everything will work as expected. I think we should not consider this as a "problem" as long as it's descibed properly in Documentation. This switch is excected to support this. What you describe is essentially what happens on "example 2." Enabling the unregistered multicat traffic to be directed to the CPU will cover all use cases that require no user intervention for everything to work. MDBs will automcatically be added/removed to the hardware and traffic will be offloaded. With the current code the user has that possibility, so it's up to him to decide what mode of configuration he prefers. > > > Setting on/off and IFF_MULTICAST (on eth0/eth1/br0) will affect registered > > multicast masks programmed in the switch(for port1, port2, cpu port > > respectively). > > > This muct occur before adding VLANs on the interfaces. If you change the > > flag after the VLAN configuration you need to re-issue the VLAN config > > commands. > > This you should fix. You should be able to get the stack to tell you > about all the configured VLANs, so you can re-program the switch. I was planning fixing these via bridge link commands which would get propagated to the driver for port1/port2 and CPU port. I just didn't find anything relevant to multicast on bridge commands apart from flooding (which is used properly). I think that the proper way to do this is follow the logic that was introduced by VLANs i.e: bridge vlan add dev br0 vid 100 pvid untagged self <---- destined for CPU port and apply it for multicast/flooding etc. This requires iproute2 changes first though. > > > - NFS: > > The only way for NFS to work is by chrooting to a minimal environment when > > switch configuration that will affect connectivity is needed. > > You might want to look at the commit history for DSA. Florian added a > patch which makes NFS root work with DSA. It might give you clues as > to what you need to add to make it just work. I'll have a look. Chrooting is rarely needed in our case anyway. It's only needed when "loss of connectivity" is bound to take place. > > Andrew Thanks Ilias
> Yes, if the CPU port is added on the VLAN then unregistered multicast traffic > (and thus IGMP joins) will reach the CPU port and everything will work as > expected. I think we should not consider this as a "problem" as long as it's > descibed properly in Documentation. This switch is excected to support this. Back to the two e1000e. What would you expect to happen with them? Either IGMP snooping needs to work, or your don't do snooping at all. > What you describe is essentially what happens on "example 2." > Enabling the unregistered multicat traffic to be directed to the CPU will cover > all use cases that require no user intervention for everything to work. MDBs > will automcatically be added/removed to the hardware and traffic will be > offloaded. > With the current code the user has that possibility, so it's up to him to > decide what mode of configuration he prefers. So by default, it just needs to work. You can give the user the option to shoot themselves in the foot, but they need to actively pull the trigger to blow their own foot off. > > > Setting on/off and IFF_MULTICAST (on eth0/eth1/br0) will affect registered > > > multicast masks programmed in the switch(for port1, port2, cpu port > > > respectively). > > > > > This muct occur before adding VLANs on the interfaces. If you change the > > > flag after the VLAN configuration you need to re-issue the VLAN config > > > commands. > > > > This you should fix. You should be able to get the stack to tell you > > about all the configured VLANs, so you can re-program the switch. > I was planning fixing these via bridge link commands which would get propagated > to the driver for port1/port2 and CPU port. I just didn't find anything > relevant to multicast on bridge commands apart from flooding (which is used > properly). I think that the proper way to do this is follow the logic that was > introduced by VLANs i.e: > bridge vlan add dev br0 vid 100 pvid untagged self <---- destined for CPU port > and apply it for multicast/flooding etc. > This requires iproute2 changes first though. No, i think you can do this in the driver. The driver just needs to ask the stack to tell it about all the VLANs again. Or you walk the VLAN tables in the hardware and do the programming based on that. I don't see why user space should be involved at all. What would you expect with two e1000e's? Andrew
On Mon, Jun 18, 2018 at 06:28:36PM +0200, Andrew Lunn wrote: > > Yes, if the CPU port is added on the VLAN then unregistered multicast traffic > > (and thus IGMP joins) will reach the CPU port and everything will work as > > expected. I think we should not consider this as a "problem" as long as it's > > descibed properly in Documentation. This switch is excected to support this. > > Back to the two e1000e. What would you expect to happen with them? > Either IGMP snooping needs to work, or your don't do snooping at > all. That's a different use case, you don't have a CPU port on e1000 and it "just works". You can't do anything to the card and drop the packet. If you want to have the same example imagine something like "i filter and drop IGMP messages on one of the 2 e1000e's on the bridge but i expect IGMP to work". It's a totally different hardware here were this is an option and for TI usecases a valid option. > > > What you describe is essentially what happens on "example 2." > > Enabling the unregistered multicat traffic to be directed to the CPU will cover > > all use cases that require no user intervention for everything to work. MDBs > > will automcatically be added/removed to the hardware and traffic will be > > offloaded. > > With the current code the user has that possibility, so it's up to him to > > decide what mode of configuration he prefers. > > So by default, it just needs to work. You can give the user the option > to shoot themselves in the foot, but they need to actively pull the > trigger to blow their own foot off. Yes it does by default. I don't consider it "foot shooting" though. If we stop thinking about switches connected to user environments and think of industrial ones, my understanding is that this is a common scenarioa that needs to be supported. > > > > > Setting on/off and IFF_MULTICAST (on eth0/eth1/br0) will affect registered > > > > multicast masks programmed in the switch(for port1, port2, cpu port > > > > respectively). > > > > > > > This muct occur before adding VLANs on the interfaces. If you change the > > > > flag after the VLAN configuration you need to re-issue the VLAN config > > > > commands. > > > > > > This you should fix. You should be able to get the stack to tell you > > > about all the configured VLANs, so you can re-program the switch. > > I was planning fixing these via bridge link commands which would get propagated > > to the driver for port1/port2 and CPU port. I just didn't find anything > > relevant to multicast on bridge commands apart from flooding (which is used > > properly). I think that the proper way to do this is follow the logic that was > > introduced by VLANs i.e: > > bridge vlan add dev br0 vid 100 pvid untagged self <---- destined for CPU port > > and apply it for multicast/flooding etc. > > This requires iproute2 changes first though. > > No, i think you can do this in the driver. The driver just needs to > ask the stack to tell it about all the VLANs again. Or you walk the > VLAN tables in the hardware and do the programming based on that. I > don't see why user space should be involved at all. What would you > expect with two e1000e's? We are pretty much describing the same thing i just thought having a bridge command for it was more appropriate. After the user removes the multicast flag for an interface i'll just walk VLANs and adjust accordingly. It's doable and i'll change it for the patch. Thanks Ilias
On Mon, Jun 18, 2018 at 07:46:02PM +0300, Ilias Apalodimas wrote: > On Mon, Jun 18, 2018 at 06:28:36PM +0200, Andrew Lunn wrote: > > > Yes, if the CPU port is added on the VLAN then unregistered multicast traffic > > > (and thus IGMP joins) will reach the CPU port and everything will work as > > > expected. I think we should not consider this as a "problem" as long as it's > > > descibed properly in Documentation. This switch is excected to support this. > > > > Back to the two e1000e. What would you expect to happen with them? > > Either IGMP snooping needs to work, or your don't do snooping at > > all. > That's a different use case I disagree. That is the exact same use case. I add ports to a bridge and i expect the bridge to either do IGMP snooping, or just forward all multicast. That is the users expectations. That is how the Linux network stack works. If the hardware has limitations you want to try to hide them from the user. > > So by default, it just needs to work. You can give the user the option > > to shoot themselves in the foot, but they need to actively pull the > > trigger to blow their own foot off. > Yes it does by default. I don't consider it "foot shooting" though. > If we stop thinking about switches connected to user environments I never think about switches. I think about a block of acceleration hardware, which i try to offload Linux networking to. And if the hardware cannot accelerate Linux network functions properly, i don't try to offload it. That way it always operates in the same way, and the user expectations are clear. Andrew
On Mon, Jun 18, 2018 at 07:30:25PM +0200, Andrew Lunn wrote: > On Mon, Jun 18, 2018 at 07:46:02PM +0300, Ilias Apalodimas wrote: > > On Mon, Jun 18, 2018 at 06:28:36PM +0200, Andrew Lunn wrote: > > > > Yes, if the CPU port is added on the VLAN then unregistered multicast traffic > > > > (and thus IGMP joins) will reach the CPU port and everything will work as > > > > expected. I think we should not consider this as a "problem" as long as it's > > > > descibed properly in Documentation. This switch is excected to support this. > > > > > > Back to the two e1000e. What would you expect to happen with them? > > > Either IGMP snooping needs to work, or your don't do snooping at > > > all. > > That's a different use case > > I disagree. That is the exact same use case. I add ports to a bridge > and i expect the bridge to either do IGMP snooping, or just forward > all multicast. That is the users expectations. That is how the Linux > network stack works. If the hardware has limitations you want to try > to hide them from the user. Why is this a limitation? Isn't it proper functionality? If you configure the CPU port as "passthrough" (which again is the default) then everything works just like e1000e. The user doesn't have to do anything at all, MDBs are added/deleted based on proper timers/joins etc. If the user chooses to use the cpu port as a kind of internal L-2 filter, that's up to him, but having hardware do the filtering for you isn't something i'd call a limitation. I am not sure what's the case here though. The hardware operates as you want by defaulti. As added functionality the user can, if he chooses to, add the MDBs manually instead of having some piece of code do that for him. This was clearly described in the first RFC since it was the only reason to add a CPU port. Is there a problem with the user controlling these capabilities of the hardware? > > > So by default, it just needs to work. You can give the user the option > > > to shoot themselves in the foot, but they need to actively pull the > > > trigger to blow their own foot off. > > > Yes it does by default. I don't consider it "foot shooting" though. > > If we stop thinking about switches connected to user environments > > I never think about switches. I think about a block of acceleration > hardware, which i try to offload Linux networking to. And if the > hardware cannot accelerate Linux network functions properly, i don't > try to offload it. That way it always operates in the same way, and > the user expectations are clear. > > Andrew The acceleration block is working properly here. The user has the ability to instruct the acceleration block not to accelerate all the traffic but specific cases he chooses to. Isn't that a valid use case since the hardware supports that ? Regards Ilias
On 06/18/2018 12:49 PM, Ilias Apalodimas wrote: > On Mon, Jun 18, 2018 at 07:30:25PM +0200, Andrew Lunn wrote: >> On Mon, Jun 18, 2018 at 07:46:02PM +0300, Ilias Apalodimas wrote: >>> On Mon, Jun 18, 2018 at 06:28:36PM +0200, Andrew Lunn wrote: >>>>> Yes, if the CPU port is added on the VLAN then unregistered multicast traffic >>>>> (and thus IGMP joins) will reach the CPU port and everything will work as >>>>> expected. I think we should not consider this as a "problem" as long as it's >>>>> descibed properly in Documentation. This switch is excected to support this. >>>> >>>> Back to the two e1000e. What would you expect to happen with them? >>>> Either IGMP snooping needs to work, or your don't do snooping at >>>> all. >>> That's a different use case >> >> I disagree. That is the exact same use case. I add ports to a bridge >> and i expect the bridge to either do IGMP snooping, or just forward >> all multicast. That is the users expectations. That is how the Linux >> network stack works. If the hardware has limitations you want to try >> to hide them from the user. > Why is this a limitation? Isn't it proper functionality? > If you configure the CPU port as "passthrough" (which again is > the default) then everything works just like e1000e. The user doesn't have to do > anything at all, MDBs are added/deleted based on proper timers/joins etc. > If the user chooses to use the cpu port as a kind of internal L-2 filter, > that's up to him, but having hardware do the filtering for you isn't something > i'd call a limitation. > > I am not sure what's the case here though. The hardware operates as you want > by defaulti. As added functionality the user can, if he chooses to, add the > MDBs manually instead of having some piece of code do that for him. > This was clearly described in the first RFC since it was the only reason to add > a CPU port. Is there a problem with the user controlling these capabilities of > the hardware? >>>> So by default, it just needs to work. You can give the user the option >>>> to shoot themselves in the foot, but they need to actively pull the >>>> trigger to blow their own foot off. >> >>> Yes it does by default. I don't consider it "foot shooting" though. >>> If we stop thinking about switches connected to user environments >> >> I never think about switches. I think about a block of acceleration >> hardware, which i try to offload Linux networking to. And if the >> hardware cannot accelerate Linux network functions properly, i don't >> try to offload it. That way it always operates in the same way, and >> the user expectations are clear. Yeh. Sry, but the user expectations depends on application area. For the industrial & automotive application It's not only about acceleration only - it's about filtering (hm, hw filtering is acceleration also :), which is the strict requirement. Yes, CPSW will help Linux networking stuck to accelerate packet forwarding, but it's expected to do this only for *allowed* traffic. One of the main points is to prevent DoS attacks when Linux Host will not be able to perform required operations and will stuck processing some network (mcast) traffic. Example, remote control/monitoring stations where one Port connected to the private sensor/control network and another is wan/trunk port. Plus, Linux Host is running industrial application which monitor/control some hw by itself - activity on WAN port should have minimal effect on ability of Linux Host industrial application to perform it target function and prevent packets flooding to the private network. As result, after boot, such systems are expected to work following the rule: "everything is prohibited which is not explicitly allowed". And that's exactly what CPSW allows to achieve by filling manually/statically ALE VLAN/FDB/MDB tables and this way prevent IGMP/.. Flood Attacks. Hope, above will help understand our use-cases and why we "annoyingly" asking about possibility to do manual/static configuration and not rely on IGMP or other great, but not applicable for all use cases, networking technologies. > The acceleration block is working properly here. The user has the ability to > instruct the acceleration block not to accelerate all the traffic but specific > cases he chooses to. Isn't that a valid use case since the hardware supports > that ? -- regards, -grygorii