On 2022-10-21 19:30, Vladimir Oltean wrote:

On Fri, Oct 21, 2022 at 07:18:59PM +0200, netdev@kapio-technology.com 
wrote:

quoted

On 2022-10-21 18:30, Vladimir Oltean wrote:

quoted

On Fri, Oct 21, 2022 at 03:16:21PM +0200, netdev@kapio-technology.com wrote:

quoted

As it is now in the bridge, the locked port part is handled before learning
in the ingress data path, so with BR_LEARNING and BR_PORT_LOCKED, I think it
will work as it does now except link local packages.

If link-local learning is enabled on a locked port, I think those
addresses should also be learned with the BR_FDB_LOCKED flag. The
creation of those locked FDB entries can be further suppressed by the
BROPT_NO_LL_LEARN flag.

quoted

If your suggestion of BR_LEARNING causing BR_FDB_LOCKED on a locked port, I
guess it would be implemented under br_fdb_update() and BR_LEARNING +
BR_PORT_LOCKED would go together, forcing BR_LEARNING in this case, thus also
for all drivers?

Yes, basically where this is placed right now (in br_handle_frame_finish):

As I don't know what implications it would have for other drivers to 
have learning
forced enabled on locked ports, I cannot say if it is a good idea or 
not.
Right now learning is not forced either way as is, but the consensus 
is that learning
should be off with locked ports, which it would be either way in the 
common case I
think.

I don't think I fully understand what you mean by forcing BR_LEARNING.
A bridge port gets created with a default set of flags as can be seen
in new_nbp().
Those flags include BR_LEARNING but don't include BR_PORT_LOCKED.

The user can decide he wants to make the port use 802.1X without MAB, 
so
he enables BR_PORT_LOCKED and disables BR_LEARNING, all with the same
netlink command (ip link set swp0 type bridge_slave learning off locked 
on).

How was the driver forced into anything?

Well, with this change, to have MAB working, the bridge would need 
learning on
of course, but how things work with the bridge according to the flags, 
they
should also work in the offloaded case if you ask me. There should be no
difference between the two, thus MAB in drivers would have to be with
learning on.