On 25/10/2022 13:00, Ido Schimmel wrote: > From: "Hans J. Schultz" <netdev@xxxxxxxxxxxxxxxxxxxx> > > When the bridge is offloaded to hardware, FDB entries are learned and > aged-out by the hardware. Some device drivers synchronize the hardware > and software FDBs by generating switchdev events towards the bridge. > > When a port is locked, the hardware must not learn autonomously, as > otherwise any host will blindly gain authorization. Instead, the > hardware should generate events regarding hosts that are trying to gain > authorization and their MAC addresses should be notified by the device > driver as locked FDB entries towards the bridge driver. > > Allow device drivers to notify the bridge driver about such entries by > extending the 'switchdev_notifier_fdb_info' structure with the 'locked' > bit. The bit can only be set by device drivers and not by the bridge > driver. > > Prevent a locked entry from being installed if MAB is not enabled on the > bridge port. By placing this check in the bridge driver we avoid the > need to reflect the 'BR_PORT_MAB' flag to device drivers. > > If an entry already exists in the bridge driver, reject the locked entry > if the current entry does not have the "locked" flag set or if it points > to a different port. The same semantics are implemented in the software > data path. > > Signed-off-by: Hans J. Schultz <netdev@xxxxxxxxxxxxxxxxxxxx> > Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx> > --- > > Notes: > Changes made by me: > > * Reword commit message. > * Forbid locked entries when MAB is not enabled. > * Forbid roaming of locked entries. > * Avoid setting 'locked' bit towards device drivers. > > include/net/switchdev.h | 1 + > net/bridge/br.c | 3 ++- > net/bridge/br_fdb.c | 22 ++++++++++++++++++++-- > net/bridge/br_private.h | 2 +- > net/bridge/br_switchdev.c | 1 + > 5 files changed, 25 insertions(+), 4 deletions(-) > Acked-by: Nikolay Aleksandrov <razor@xxxxxxxxxxxxx>
