| Message ID | 20190505211517.25237-2-hauke@hauke-m.de |
|---|---|
| State | Changes Requested |
| Delegated to: | David Miller |
| Headers | show |
| Series | net: dsa: lantiq: Add bridge offloading | expand |
On 5/5/2019 2:15 PM, Hauke Mehrtens wrote: > Allow the special tag in ingress only on the CPU port and not on all > ports. A packet with a special tag could circumvent the hardware > forwarding and should only be allowed on the CPU port where Linux > controls the port. > > Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Does this warrant a Fixes: tag so it gets backported to -stable trees?
On 5/5/19 11:17 PM, Florian Fainelli wrote: > > > On 5/5/2019 2:15 PM, Hauke Mehrtens wrote: >> Allow the special tag in ingress only on the CPU port and not on all >> ports. A packet with a special tag could circumvent the hardware >> forwarding and should only be allowed on the CPU port where Linux >> controls the port. >> >> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> > > Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> > > Does this warrant a Fixes: tag so it gets backported to -stable trees? > Hi Florian, Yes adding a Fixes tag probably makes sense, someone could use this to circumvent the switch rules. Hauke
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c index d8328866908c..0a2259cb09df 100644 --- a/drivers/net/dsa/lantiq_gswip.c +++ b/drivers/net/dsa/lantiq_gswip.c @@ -461,8 +461,6 @@ static int gswip_port_enable(struct dsa_switch *ds, int port, GSWIP_FDMA_PCTRLp(port)); gswip_switch_mask(priv, 0, GSWIP_SDMA_PCTRL_EN, GSWIP_SDMA_PCTRLp(port)); - gswip_switch_mask(priv, 0, GSWIP_PCE_PCTRL_0_INGRESS, - GSWIP_PCE_PCTRL_0p(port)); if (!dsa_is_cpu_port(ds, port)) { u32 macconf = GSWIP_MDIO_PHY_LINK_AUTO | @@ -578,6 +576,10 @@ static int gswip_setup(struct dsa_switch *ds) gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_STEN, GSWIP_FDMA_PCTRLp(cpu_port)); + /* accept special tag in ingress direction */ + gswip_switch_mask(priv, 0, GSWIP_PCE_PCTRL_0_INGRESS, + GSWIP_PCE_PCTRL_0p(cpu_port)); + gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN, GSWIP_MAC_CTRL_2p(cpu_port)); gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8, GSWIP_MAC_FLEN);
Allow the special tag in ingress only on the CPU port and not on all ports. A packet with a special tag could circumvent the hardware forwarding and should only be allowed on the CPU port where Linux controls the port. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> --- drivers/net/dsa/lantiq_gswip.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)