net: dsa: manage flooding on the CPU ports

DSA can treat IFF_PROMISC and IFF_ALLMULTI on standalone user ports as
signifying whether packets with an unknown MAC DA will be received or
not. Since known MAC DAs are handled by FDB/MDB entries, this means that
promiscuity is analogous to including/excluding the CPU port from the
flood domain of those packets.

There are two ways to signal CPU flooding to drivers.

The first (chosen here) is to synthesize a call to
ds->ops->port_bridge_flags() for the CPU port, with a mask of
BR_FLOOD | BR_MCAST_FLOOD. This has the effect of turning on egress
flooding on the CPU port regardless of source.

The alternative would be to create a new ds->ops->port_host_flood()
which is called per user port. Some switches (sja1105) have a flood
domain that is managed per {ingress port, egress port} pair, so it would
make more sense for this kind of switch to not flood the CPU from port A
if just port B requires it. Nonetheless, the sja1105 has other quirks
that prevent it from making use of unicast filtering, and without a
concrete user making use of this feature, I chose not to implement it.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6eb728efac43c0d9462bb6fcc72fd11df898b71d..42436ac6993b27085aa0b7c29cbf3664ff7ddeb1 100644 (file)
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -229,9 +229,44 @@ static int dsa_slave_close(struct net_device *dev)
        return 0;
 }
 
+/* Keep flooding enabled towards this port's CPU port as long as it serves at
+ * least one port in the tree that requires it.
+ */
+static void dsa_port_manage_cpu_flood(struct dsa_port *dp)
+{
+       struct switchdev_brport_flags flags = {
+               .mask = BR_FLOOD | BR_MCAST_FLOOD,
+       };
+       struct dsa_switch_tree *dst = dp->ds->dst;
+       struct dsa_port *cpu_dp = dp->cpu_dp;
+       struct dsa_port *other_dp;
+       int err;
+
+       list_for_each_entry(other_dp, &dst->ports, list) {
+               if (!dsa_port_is_user(other_dp))
+                       continue;
+
+               if (other_dp->cpu_dp != cpu_dp)
+                       continue;
+
+               if (other_dp->slave->flags & IFF_ALLMULTI)
+                       flags.val |= BR_MCAST_FLOOD;
+               if (other_dp->slave->flags & IFF_PROMISC)
+                       flags.val |= BR_FLOOD;
+       }
+
+       err = dsa_port_pre_bridge_flags(dp, flags, NULL);
+       if (err)
+               return;
+
+       dsa_port_bridge_flags(cpu_dp, flags, NULL);
+}
+
 static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
 {
        struct net_device *master = dsa_slave_to_master(dev);
+       struct dsa_port *dp = dsa_slave_to_port(dev);
+       struct dsa_switch *ds = dp->ds;
 
        if (change & IFF_ALLMULTI)
                dev_set_allmulti(master,
@@ -239,6 +274,10 @@ static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
        if (change & IFF_PROMISC)
                dev_set_promiscuity(master,
                                    dev->flags & IFF_PROMISC ? 1 : -1);
+
+       if (dsa_switch_supports_uc_filtering(ds) &&
+           dsa_switch_supports_mc_filtering(ds))
+               dsa_port_manage_cpu_flood(dp);
 }
 
 static void dsa_slave_set_rx_mode(struct net_device *dev)