peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-30 20:43:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #837 from kernelkit/vlan-iface-termination

Browse Source 
Prevent traffic assigned to locally terminated VLANs from being forwarded
This commit is contained in:
Tobias Waldekranz
2024-11-28 15:07:22 +01:00
committed by GitHub
parent 371db579ea ddfdcb40bb
commit 877e3f3d81
53 changed files with 645 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog.md
+7
View File
@@ -7,11 +7,18 @@ All notable changes to the project are documented in this file.
[v24.11.1][UNRELEASED]
-------------------------
### Changes
- Allow setting IP address directly on VLAN filtering bridges. This
only works when the bridge is an untagged member of a (single) VLAN.
### Fixes
- Fix #685: DSA conduit interface not always detected. Previous
attempt at a fix (v24.10.2) mitigated the issue, but did not
completely solve it.
- Prevent traffic assigned to locally terminated VLANs from being
forwarded, when the underlying ports are simultaneously attached to a
VLAN filtering bridge.
[v24.11.0][] - 2024-11-20
doc/networking.md
+11 -4
View File
@@ -219,10 +219,15 @@ admin@example:/config/interface/br0/> set bridge vlans vlan 10 tagged br0
admin@example:/config/interface/br0/> set bridge vlans vlan 20 tagged br0
```
To route or to manage via a VLAN, a VLAN interface needs to be created
on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
below for more on this topic.
> [!NOTE]
> To route or to manage via a VLAN, a VLAN interface needs to be created
> on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
> below for more on this topic.
> In some use-cases only a single management VLAN on the bridge is used.
> For the example above, if the bridge itself is an untagged member only
> in VLAN 10, IP addresses can be set directly on the bridge without the
> need for dedicated VLAN interfaces on top of the bridge.
#### Multicast Filtering and Snooping
@@ -465,7 +470,9 @@ As conventions, a VLAN interface for VID 20 on top of an Ethernet
interface *eth0* is named *eth0.20*, and a VLAN interface for VID 10 on
top of a bridge interface *br0* is named *vlan10*.
> **Note:** If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a number, Infix will set the interface type automatically for you.
> [!NOTE]
> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
> number, Infix will set the interface type automatically for you.
### Physical Ethernet Interfaces
patches/linux/6.6.52/0001-net-phy-add-support-for-PHY-LEDs-polarity-modes.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 4be3e500b670f7b98e3dd6696b8e51e83f122c65 Mon Sep 17 00:00:00 2001
From: Christian Marangi <ansuelsmth@gmail.com>
Date: Thu, 25 Jan 2024 21:36:59 +0100
Subject: [PATCH 01/34] net: phy: add support for PHY LEDs polarity modes
Subject: [PATCH 01/35] net: phy: add support for PHY LEDs polarity modes
Organization: Addiva Elektronik
Add support for PHY LEDs polarity modes. Some PHY require LED to be set
@@ -22,7 +22,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20240125203702.4552-4-ansuelsmth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/phy/phy_device.c | 16 ++++++++++++++++
include/linux/phy.h | 22 ++++++++++++++++++++++
patches/linux/6.6.52/0002-net-mvmdio-Support-setting-the-MDC-frequency-on-XSMI.patch
+1 -2
View File
@@ -1,7 +1,7 @@
From 4833b140cd11a57dd9f59754cdacfd71bc564c8f Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Mon, 4 Dec 2023 11:08:11 +0100
Subject: [PATCH 02/34] net: mvmdio: Support setting the MDC frequency on XSMI
Subject: [PATCH 02/35] net: mvmdio: Support setting the MDC frequency on XSMI
controllers
Organization: Addiva Elektronik
@@ -14,7 +14,6 @@ Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Tested-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20231204100811.2708884-4-tobias@waldekranz.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
drivers/net/ethernet/marvell/mvmdio.c | 44 +++++++++++++++++++++++++++
1 file changed, 44 insertions(+)
patches/linux/6.6.52/0003-net-dsa-mv88e6xxx-Create-API-to-read-a-single-stat-c.patch
+1 -2
View File
@@ -1,7 +1,7 @@
From 50a2973e8a520a82e9f9ec15a1f69e059ce7a334 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 14 Dec 2023 14:50:23 +0100
Subject: [PATCH 03/34] net: dsa: mv88e6xxx: Create API to read a single stat
Subject: [PATCH 03/35] net: dsa: mv88e6xxx: Create API to read a single stat
counter
Organization: Addiva Elektronik
@@ -16,7 +16,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 162 ++++++++++++++++++-------------
drivers/net/dsa/mv88e6xxx/chip.h | 27 +++---
patches/linux/6.6.52/0004-net-dsa-mv88e6xxx-Give-each-hw-stat-an-ID.patch
+1 -2
View File
@@ -1,7 +1,7 @@
From 5916503e23e7f85796c1f927747e66b9535bac53 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 14 Dec 2023 14:50:25 +0100
Subject: [PATCH 04/34] net: dsa: mv88e6xxx: Give each hw stat an ID
Subject: [PATCH 04/35] net: dsa: mv88e6xxx: Give each hw stat an ID
Organization: Addiva Elektronik
With the upcoming standard counter group support, we are no longer
@@ -16,7 +16,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 138 +++++++++++++++++--------------
1 file changed, 75 insertions(+), 63 deletions(-)
patches/linux/6.6.52/0005-net-dsa-mv88e6xxx-Add-eth-mac-counter-group-support.patch
+1 -2
View File
@@ -1,7 +1,7 @@
From 32dda6562734ec8ee667bc546f3ef56794d5bf82 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 14 Dec 2023 14:50:26 +0100
Subject: [PATCH 05/34] net: dsa: mv88e6xxx: Add "eth-mac" counter group
Subject: [PATCH 05/35] net: dsa: mv88e6xxx: Add "eth-mac" counter group
support
Organization: Addiva Elektronik
@@ -12,7 +12,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 39 ++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
patches/linux/6.6.52/0006-net-dsa-mv88e6xxx-Limit-histogram-counters-to-ingres.patch
+1 -2
View File
@@ -1,7 +1,7 @@
From 36adbdd466ec550cab8b2ae54177f674c02cf631 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 14 Dec 2023 14:50:27 +0100
Subject: [PATCH 06/34] net: dsa: mv88e6xxx: Limit histogram counters to
Subject: [PATCH 06/35] net: dsa: mv88e6xxx: Limit histogram counters to
ingress traffic
Organization: Addiva Elektronik
@@ -27,7 +27,6 @@ Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 6 +++---
drivers/net/dsa/mv88e6xxx/global1.c | 7 +++----
patches/linux/6.6.52/0007-net-dsa-mv88e6xxx-Add-rmon-counter-group-support.patch
+1 -2
View File
@@ -1,7 +1,7 @@
From abfa532c1149525b128b8c76d80965f55e208240 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 14 Dec 2023 14:50:28 +0100
Subject: [PATCH 07/34] net: dsa: mv88e6xxx: Add "rmon" counter group support
Subject: [PATCH 07/35] net: dsa: mv88e6xxx: Add "rmon" counter group support
Organization: Addiva Elektronik
Report the applicable subset of an mv88e6xxx port's counters using
@@ -11,7 +11,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 42 ++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
patches/linux/6.6.52/0009-net-dsa-mv88e6xxx-Add-LED-infrastructure.patch
+2 -2
View File
@@ -1,13 +1,13 @@
From 4407b94b4a08536fccb6eea2826955ff12d63ec2 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 16 Nov 2023 19:44:32 +0100
Subject: [PATCH 09/34] net: dsa: mv88e6xxx: Add LED infrastructure
Subject: [PATCH 09/35] net: dsa: mv88e6xxx: Add LED infrastructure
Organization: Addiva Elektronik
Parse DT for LEDs and register them for devices that support it,
though no actual implementations exist yet.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/Makefile | 1 +
drivers/net/dsa/mv88e6xxx/chip.c | 5 +-
patches/linux/6.6.52/0010-net-dsa-mv88e6xxx-Add-LED-support-for-6393X.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From a5cf5c0353db07e74d7a29dd4d5c2cb7775d5bec Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 16 Nov 2023 21:59:35 +0100
Subject: [PATCH 10/34] net: dsa: mv88e6xxx: Add LED support for 6393X
Subject: [PATCH 10/35] net: dsa: mv88e6xxx: Add LED support for 6393X
Organization: Addiva Elektronik
Trigger support:
@@ -9,7 +9,7 @@ Trigger support:
- "timer"
- "netdev"
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 1 +
drivers/net/dsa/mv88e6xxx/leds.c | 226 +++++++++++++++++++++++++++++++
patches/linux/6.6.52/0011-net-dsa-mv88e6xxx-Fix-timeout-on-waiting-for-PPU-on-.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From be94ec851dbb8e55c3f5e82f197b2dc59566aea2 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 12 Mar 2024 10:27:24 +0100
Subject: [PATCH 11/34] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
Subject: [PATCH 11/35] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
6393X
Organization: Addiva Elektronik
@@ -9,7 +9,7 @@ In a multi-chip setup, delays of up to 750ms are observed before the
device (6393X) signals completion of PPU initialization (Global 1,
register 0, bit 15). Therefore, increase the timeout threshold to 1s.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
patches/linux/6.6.52/0012-net-dsa-Support-MDB-memberships-whose-L2-addresses-o.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 69092f83541e6539ab82eec3052325c403675de4 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 16 Jan 2024 16:00:55 +0100
Subject: [PATCH 12/34] net: dsa: Support MDB memberships whose L2 addresses
Subject: [PATCH 12/35] net: dsa: Support MDB memberships whose L2 addresses
overlap
Organization: Addiva Elektronik
@@ -30,7 +30,7 @@ needed to do this is already in place, since it is also needed on CPU
and DSA ports. Thus, "implement" this by simply removing the guards
which previously skipped reference countung on user ports.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
net/dsa/switch.c | 16 ----------------
1 file changed, 16 deletions(-)
patches/linux/6.6.52/0013-net-phy-marvell10g-Support-firmware-loading-on-88X33.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 7c19df77212d0728874515e97cf297863a6ff2cd Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 19 Sep 2023 18:38:10 +0200
Subject: [PATCH 13/34] net: phy: marvell10g: Support firmware loading on
Subject: [PATCH 13/35] net: phy: marvell10g: Support firmware loading on
88X3310
Organization: Addiva Elektronik
@@ -12,7 +12,7 @@ We have no choice but to bail out of the probe if firmware is not
available, as the device does not have any built-in image on which to
fall back.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/phy/marvell10g.c | 161 +++++++++++++++++++++++++++++++++++
1 file changed, 161 insertions(+)
patches/linux/6.6.52/0014-net-phy-marvell10g-Fix-power-up-when-strapped-to-sta.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 0c34b42b7a72ddf1af6f3534870d647801e493fa Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 21 Nov 2023 20:15:24 +0100
Subject: [PATCH 14/34] net: phy: marvell10g: Fix power-up when strapped to
Subject: [PATCH 14/35] net: phy: marvell10g: Fix power-up when strapped to
start powered down
Organization: Addiva Elektronik
@@ -9,7 +9,7 @@ On devices which are hardware strapped to start powered down (PDSTATE
== 1), make sure that we clear the power-down bit on all units
affected by this setting.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/phy/marvell10g.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
patches/linux/6.6.52/0015-net-phy-marvell10g-Add-LED-support-for-88X3310.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 6576918d3348f8e20802379d568d7632228af4d7 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Wed, 15 Nov 2023 20:58:42 +0100
Subject: [PATCH 15/34] net: phy: marvell10g: Add LED support for 88X3310
Subject: [PATCH 15/35] net: phy: marvell10g: Add LED support for 88X3310
Organization: Addiva Elektronik
Pickup the LEDs from the state in which the hardware reset or
@@ -18,7 +18,7 @@ Trigger support:
- "netdev": Offload link or duplex information to the solid behavior;
tx and/or rx activity to blink behavior.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/phy/marvell10g.c | 422 +++++++++++++++++++++++++++++++++++
1 file changed, 422 insertions(+)
patches/linux/6.6.52/0016-net-phy-marvell10g-Support-LEDs-tied-to-a-single-med.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 1ad7f010e46133c725df5cab4d85f71f689ca191 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 12 Dec 2023 09:51:05 +0100
Subject: [PATCH 16/34] net: phy: marvell10g: Support LEDs tied to a single
Subject: [PATCH 16/35] net: phy: marvell10g: Support LEDs tied to a single
media side
Organization: Addiva Elektronik
@@ -15,7 +15,7 @@ the offloading of the "netdev" trigger, such that LEDs attached to the
RJ45 jack only lights up when a copper link is established, and vice
versa for the SFP cage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/phy/marvell10g.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
patches/linux/6.6.52/0017-nvmem-layouts-onie-tlv-Let-device-probe-even-when-TL.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 11b9a3e328241edede03b6615bb9b0f1a40b9b7d Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Fri, 24 Nov 2023 23:29:55 +0100
Subject: [PATCH 17/34] nvmem: layouts: onie-tlv: Let device probe even when
Subject: [PATCH 17/35] nvmem: layouts: onie-tlv: Let device probe even when
TLV is invalid
Organization: Addiva Elektronik
@@ -14,7 +14,7 @@ be successfully probed.
Therefore, settle for reporting data corruption issues in the log, and
simply refrain from registering any cells in those cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/nvmem/layouts/onie-tlv.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
patches/linux/6.6.52/0018-net-bridge-avoid-classifying-unknown-multicast-as-mr.patch
+2 -1
View File
@@ -1,7 +1,7 @@
From ce1148b5c2e33541ad13ff2c4769d0b37d4e42b9 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Mon, 4 Mar 2024 16:47:28 +0100
Subject: [PATCH 18/34] net: bridge: avoid classifying unknown multicast as
Subject: [PATCH 18/35] net: bridge: avoid classifying unknown multicast as
mrouters_only
Organization: Addiva Elektronik
@@ -16,6 +16,7 @@ Because a multicast router should always receive both known and unknown
multicast.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
include/uapi/linux/if_bridge.h | 1 +
net/bridge/br.c | 5 +++++
patches/linux/6.6.52/0019-net-bridge-Ignore-router-ports-when-forwarding-L2-mu.patch
+1 -1
View File
@@ -1,7 +1,7 @@
From ce74ee8c5461cc53851ca323b4dfc9937cab0e41 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Tue, 5 Mar 2024 06:44:41 +0100
Subject: [PATCH 19/34] net: bridge: Ignore router ports when forwarding L2
Subject: [PATCH 19/35] net: bridge: Ignore router ports when forwarding L2
multicast
Organization: Addiva Elektronik
patches/linux/6.6.52/0020-net-dsa-Support-EtherType-based-priority-overrides.patch
+2 -2
View File
@@ -1,10 +1,10 @@
From 3c9b05198e0b7193f2dcddc1860cd77f0adbc3a2 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 21 Mar 2024 19:12:15 +0100
Subject: [PATCH 20/34] net: dsa: Support EtherType based priority overrides
Subject: [PATCH 20/35] net: dsa: Support EtherType based priority overrides
Organization: Addiva Elektronik
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
include/net/dsa.h | 4 ++++
net/dsa/slave.c | 56 +++++++++++++++++++++++++++++++++++++++++++++--
patches/linux/6.6.52/0021-net-dsa-mv88e6xxx-Support-EtherType-based-priority-o.patch
+2 -2
View File
@@ -1,11 +1,11 @@
From 333134a4ff2b8dd7fb00a75560254de96d1082ad Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Fri, 22 Mar 2024 16:15:43 +0100
Subject: [PATCH 21/34] net: dsa: mv88e6xxx: Support EtherType based priority
Subject: [PATCH 21/35] net: dsa: mv88e6xxx: Support EtherType based priority
overrides
Organization: Addiva Elektronik
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 64 +++++++++++++++++++++++++++++
drivers/net/dsa/mv88e6xxx/chip.h | 21 ++++++++++
patches/linux/6.6.52/0022-net-phy-Do-not-resume-PHY-when-attaching.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From cdddc24c05cedc0d0fabc48da17ec26aeb7c1ef9 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Wed, 27 Mar 2024 10:10:19 +0100
Subject: [PATCH 22/34] net: phy: Do not resume PHY when attaching
Subject: [PATCH 22/35] net: phy: Do not resume PHY when attaching
Organization: Addiva Elektronik
The PHY should not start negotiating with its link-partner until
@@ -16,7 +16,7 @@ probing (e.g. DSA) would end up with a physical link being
established, even though the corresponding interface was still
administratively down.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/phy/phy_device.c | 1 -
1 file changed, 1 deletion(-)
patches/linux/6.6.52/0023-net-dsa-mv88e6xxx-Improve-indirect-register-access-p.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 1ec21a3fc54fb447501fd7edbf692b00a31fe3ec Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Wed, 27 Mar 2024 15:52:43 +0100
Subject: [PATCH 23/34] net: dsa: mv88e6xxx: Improve indirect register access
Subject: [PATCH 23/35] net: dsa: mv88e6xxx: Improve indirect register access
perf on 6393
Organization: Addiva Elektronik
@@ -14,7 +14,7 @@ Therefore, add a new set of SMI operations which remaps accesses to
such registers to the corresponding directly addressable register. All
other accesses use the regular indirect interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 7 +++
drivers/net/dsa/mv88e6xxx/global1.h | 3 ++
patches/linux/6.6.52/0024-net-bridge-drop-delay-for-applying-strict-multicast-.patch
+2 -1
View File
@@ -1,7 +1,7 @@
From 5d7be493dcaa75ee69d521043062389d7772f8dc Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Thu, 4 Apr 2024 16:36:30 +0200
Subject: [PATCH 24/34] net: bridge: drop delay for applying strict multicast
Subject: [PATCH 24/35] net: bridge: drop delay for applying strict multicast
filtering
Organization: Addiva Elektronik
@@ -19,6 +19,7 @@ A proper fix for upstreaming could be to add a knob to disable the delay.
[2]: https://lore.kernel.org/netdev/20240127175033.9640-1-linus.luessing@c0d3.blue/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
net/bridge/br_multicast.c | 42 +++++++--------------------------------
net/bridge/br_private.h | 4 +---
patches/linux/6.6.52/0025-net-dsa-mv88e6xxx-Honor-ports-being-managed-via-in-b.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 492a824661dbc188b5abeb7434b5cf67c2016415 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Mon, 22 Apr 2024 23:18:01 +0200
Subject: [PATCH 25/34] net: dsa: mv88e6xxx: Honor ports being managed via
Subject: [PATCH 25/35] net: dsa: mv88e6xxx: Honor ports being managed via
in-band-status
Organization: Addiva Elektronik
@@ -14,7 +14,7 @@ This state is the default set up by mv88e6xxx_port_setup_mac(), so all
we have to do is to make the phylink MAC callbacks no-ops in cases
when in-band-status is being used.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++++
1 file changed, 6 insertions(+)
patches/linux/6.6.52/0026-net-dsa-mv88e6xxx-Fix-port-policy-config-on-6393X.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From c9c9597a47b00b720f5223c83ab05bb89481eda8 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Wed, 24 Apr 2024 21:35:26 +0200
Subject: [PATCH 26/34] net: dsa: mv88e6xxx: Fix port policy config on 6393X
Subject: [PATCH 26/35] net: dsa: mv88e6xxx: Fix port policy config on 6393X
Organization: Addiva Elektronik
mv88e6393x_port_policy_{read,write} expect the `pointer` argument to
@@ -16,7 +16,7 @@ never enabled on DSA ports, which broke standalone port isolation in
multichip switch trees made up of 6393X decices.
Fixes: 6584b26020fc ("net: dsa: mv88e6xxx: implement .port_set_policy for Amethyst")
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/port.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
patches/linux/6.6.52/0027-net-dsa-mv88e6xxx-Limit-rsvd2cpu-policy-to-user-port.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 4ff224b5f5de1347a1f686aa85cb918a7db18879 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Wed, 24 Apr 2024 22:41:04 +0200
Subject: [PATCH 27/34] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
Subject: [PATCH 27/35] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
ports on 6393X
Organization: Addiva Elektronik
@@ -30,7 +30,7 @@ switch would try to trap it back to the CPU. Given that the CPU is
trusted, instead assume that it indeed meant for the packet to be
forwarded like any other.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/port.c | 31 +++++++++++++++++++++++++------
1 file changed, 25 insertions(+), 6 deletions(-)
patches/linux/6.6.52/0028-usb-core-adjust-log-level-for-unauthorized-devices.patch
+2 -1
View File
@@ -1,7 +1,7 @@
From f0d4beabe769fec594b309c3f1ebb79cfdbede8b Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Mon, 29 Apr 2024 15:14:51 +0200
Subject: [PATCH 28/34] usb: core: adjust log level for unauthorized devices
Subject: [PATCH 28/35] usb: core: adjust log level for unauthorized devices
Organization: Addiva Elektronik
The fact that a USB device currently is not authorized is not an error,
@@ -9,6 +9,7 @@ so let's adjust the log level so these messages slip below radar for the
commonly used 'quiet' log level.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/usb/core/driver.c | 4 ++--
drivers/usb/core/generic.c | 2 +-
patches/linux/6.6.52/0029-net-dsa-mv88e6xxx-Grab-register-lock-during-counter-.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 5f96d718c850084504c53ec0b8d9fcf75ea9996c Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Wed, 15 May 2024 13:50:58 +0200
Subject: [PATCH 29/34] net: dsa: mv88e6xxx: Grab register lock during counter
Subject: [PATCH 29/35] net: dsa: mv88e6xxx: Grab register lock during counter
snapshotting
Organization: Addiva Elektronik
@@ -10,7 +10,7 @@ already holds the lock, opt for pushing the locking down into
mv88e6xxx_stats_snapshot() rather than having it duplicated at each
call site.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
patches/linux/6.6.52/0030-net-bridge-Differentiate-MDB-additions-from-modifica.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 6d4c436335003259cc02a0f015fd3d1d54e988a2 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Thu, 16 May 2024 14:51:54 +0200
Subject: [PATCH 30/34] net: bridge: Differentiate MDB additions from
Subject: [PATCH 30/35] net: bridge: Differentiate MDB additions from
modifications
Organization: Addiva Elektronik
@@ -22,7 +22,7 @@ generated.
Therefore, discriminate new groups from changes to existing groups by
introducing a RTM_SETMDB events to be used in the latter scenario.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
include/uapi/linux/rtnetlink.h | 2 ++
net/bridge/br_mdb.c | 4 ++--
patches/linux/6.6.52/0031-net-dsa-tag_dsa-Use-tag-priority-as-initial-skb-prio.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From c333c612688d5e974b95fcf4b04f185d7cf4f80d Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 28 May 2024 10:38:42 +0200
Subject: [PATCH 31/34] net: dsa: tag_dsa: Use tag priority as initial
Subject: [PATCH 31/35] net: dsa: tag_dsa: Use tag priority as initial
skb->priority
Organization: Addiva Elektronik
@@ -20,7 +20,7 @@ can do with an "ingress-qos-map" on VLAN interfaces. Until that is
implemented, support the setup that is likely to be the most common; a
1:1 mapping from FPri to skb->priority.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
net/dsa/tag_dsa.c | 7 +++++++
1 file changed, 7 insertions(+)
patches/linux/6.6.52/0032-net-dsa-mv88e6xxx-Add-mqprio-qdisc-support.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From 18c025745fd8b8c9b3e688e9d78668a56cf71217 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 28 May 2024 11:04:22 +0200
Subject: [PATCH 32/34] net: dsa: mv88e6xxx: Add mqprio qdisc support
Subject: [PATCH 32/35] net: dsa: mv88e6xxx: Add mqprio qdisc support
Organization: Addiva Elektronik
Add support for attaching mqprio qdisc's to mv88e6xxx ports and use
@@ -25,7 +25,7 @@ Since FPri is always a 3-bit field, even on older chips with only 4
physical queues, always report 8 queues and let the chip's policy
handle the mapping down to the "real" number.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 70 ++++++++++++++++++++++++++++++++
net/dsa/tag_dsa.c | 4 +-
patches/linux/6.6.52/0033-net-dsa-mv88e6xxx-Use-VLAN-prio-over-IP-when-both-ar.patch
+2 -2
View File
@@ -1,7 +1,7 @@
From f2d4ff12c7a0e644cbeac6675b755fb4a87b362a Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Wed, 29 May 2024 13:20:41 +0200
Subject: [PATCH 33/34] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
Subject: [PATCH 33/35] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
are available
Organization: Addiva Elektronik
@@ -23,7 +23,7 @@ main reasons for choosing the new default:
core over trusted VLAN trunks, the packet should keep its original
priority, independent of what inner protocol fields may indicate.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
patches/linux/6.6.52/0034-net-dsa-mb88e6xxx-use-EOPNOTSUPP-for-unsupported-fla.patch
+2 -1
View File
@@ -1,7 +1,7 @@
From ceaaa4f44f9b3ec82c4e0a24c2322aae58fa3aa0 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Wed, 6 Nov 2024 15:39:33 +0100
Subject: [PATCH 34/34] net: dsa: mb88e6xxx: use EOPNOTSUPP for unsupported
Subject: [PATCH 34/35] net: dsa: mb88e6xxx: use EOPNOTSUPP for unsupported
flags
Organization: Addiva Elektronik
@@ -11,6 +11,7 @@ propagate any error.
Follow-up to a5cf5c0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/leds.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
patches/linux/6.6.52/0035-net-dsa-mv88e6xxx-Trap-locally-terminated-VLANs.patch
+160
View File
@@ -0,0 +1,160 @@
From ab93e65511ee508d1b637e4ad0dc6dcddd2c48dc Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 26 Nov 2024 19:45:59 +0100
Subject: [PATCH 35/35] net: dsa: mv88e6xxx: Trap locally terminated VLANs
Organization: Addiva Elektronik
Before this change, in a setup like the following, packets assigned to
VLAN 10 were forwarded between the switch ports, even though the
configuration dictates that they should only be locally terminated.
ip link add dev br0 up type bridge vlan_filtering 1
ip link set dev swp1 master br0
ip link set dev swp2 master br0
ip link add dev swp1.10 link swp1 up type vlan id 10
ip link add dev swp2.10 link swp2 up type vlan id 10
swp1.10 br0 swp2.10
\ / \ /
swp1 swp2
Therefore, make sure that VLANs that are added to the VTU to terminate
a VLAN upper interface, rather than to offload bridge VLANs, are
marked as policy entries. As the VTU policy of user ports is already
set to TRAP (to ensure proper standalone port operation), this will
cause all packets assigned to these VLANs to properly terminated.
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 33 ++++++++++++++++++--------------
include/net/switchdev.h | 4 ++++
net/dsa/slave.c | 4 ++++
3 files changed, 27 insertions(+), 14 deletions(-)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 305abb33b0c6..259eec1a3a1d 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2610,7 +2610,7 @@ static int mv88e6xxx_port_broadcast_sync(struct mv88e6xxx_chip *chip, int port,
}
static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
- u16 vid, u8 member, bool warn)
+ u16 vid, u8 member, bool warn, bool policy)
{
const u8 non_member = MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_NON_MEMBER;
struct mv88e6xxx_vtu_entry vlan;
@@ -2622,9 +2622,7 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
if (!vlan.valid) {
memset(&vlan, 0, sizeof(vlan));
-
- if (vid == MV88E6XXX_VID_STANDALONE)
- vlan.policy = true;
+ vlan.policy = policy;
err = mv88e6xxx_atu_new(chip, &vlan.fid);
if (err)
@@ -2647,6 +2645,9 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
if (err)
return err;
} else if (vlan.member[port] != member) {
+ if (vlan.policy != policy)
+ return -EBUSY;
+
vlan.member[port] = member;
err = mv88e6xxx_vtu_loadpurge(chip, &vlan);
@@ -2693,7 +2694,8 @@ static int mv88e6xxx_port_vlan_add(struct dsa_switch *ds, int port,
mv88e6xxx_reg_lock(chip);
- err = mv88e6xxx_port_vlan_join(chip, port, vlan->vid, member, warn);
+ err = mv88e6xxx_port_vlan_join(chip, port, vlan->vid, member, warn,
+ vlan->from_upper);
if (err) {
dev_err(ds->dev, "p%d: failed to add VLAN %d%c\n", port,
vlan->vid, untagged ? 'u' : 't');
@@ -3433,14 +3435,17 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
if (err)
return err;
- /* On chips that support it, set all downstream DSA ports'
- * VLAN policy to TRAP. In combination with loading
- * MV88E6XXX_VID_STANDALONE as a policy entry in the VTU, this
- * provides a better isolation barrier between standalone
- * ports, as the ATU is bypassed on any intermediate switches
- * between the incoming port and the CPU.
+ /* On chips that support it, set all downstream DSA and user
+ * ports' VLAN policy to TRAP. for downstream DSA ports, in
+ * combination with loading MV88E6XXX_VID_STANDALONE as a
+ * policy entry in the VTU, this provides a better isolation
+ * barrier between standalone ports, as the ATU is bypassed on
+ * any intermediate switches between the incoming port and the
+ * CPU. On user ports we need it to support stacked VLAN
+ * uppers on ports that are simultaneously attached to a VLAN
+ * filtering bridge.
*/
- if (dsa_is_downstream_port(ds, port) &&
+ if ((dsa_is_downstream_port(ds, port) || dsa_is_user_port(ds, port)) &&
chip->info->ops->port_set_policy) {
err = chip->info->ops->port_set_policy(chip, port,
MV88E6XXX_POLICY_MAPPING_VTU,
@@ -3470,7 +3475,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
*/
err = mv88e6xxx_port_vlan_join(chip, port, MV88E6XXX_VID_STANDALONE,
MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_UNMODIFIED,
- false);
+ false, true);
if (err)
return err;
@@ -3484,7 +3489,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
*/
err = mv88e6xxx_port_vlan_join(chip, port, MV88E6XXX_VID_BRIDGED,
MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_UNMODIFIED,
- false);
+ false, false);
if (err)
return err;
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index 8346b0d29542..764cd3dd4645 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -104,6 +104,10 @@ struct switchdev_obj_port_vlan {
* Entries with BRIDGE_VLAN_INFO_BRENTRY unset are not notified at all.
*/
bool changed;
+
+ /* If set, this VLAN object stems from an upper interface
+ * being stacked on/removed from the original device. */
+ bool from_upper;
};
#define SWITCHDEV_OBJ_PORT_VLAN(OBJ) \
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 18d913bcd180..b45c2ac1f1f0 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1762,6 +1762,8 @@ static int dsa_slave_vlan_rx_add_vid(struct net_device *dev, __be16 proto,
.vid = vid,
/* This API only allows programming tagged, non-PVID VIDs */
.flags = 0,
+
+ .from_upper = true,
};
struct netlink_ext_ack extack = {0};
struct dsa_switch *ds = dp->ds;
@@ -1836,6 +1838,8 @@ static int dsa_slave_vlan_rx_kill_vid(struct net_device *dev, __be16 proto,
.vid = vid,
/* This API only allows programming tagged, non-PVID VIDs */
.flags = 0,
+
+ .from_upper = true,
};
struct dsa_switch *ds = dp->ds;
struct netdev_hw_addr *ha;
--
2.43.0
src/confd/yang/confd.inc
+1 -1
View File
@@ -37,7 +37,7 @@ MODULES=(
"ieee802-ethernet-interface@2019-06-21.yang"
"infix-ethernet-interface@2024-02-27.yang"
"infix-factory-default@2023-06-28.yang"
"infix-interfaces@2024-11-15.yang -e vlan-filtering"
"infix-interfaces@2024-11-27.yang -e vlan-filtering"
# from rousette
"ietf-restconf@2017-01-26.yang"
src/confd/yang/containers.inc
+1 -1
View File
@@ -1,6 +1,6 @@
# -*- sh -*-
# REMEMBER TO UPDATE infix-interfaces ALSO IN confd.inc
MODULES=(
"infix-interfaces@2024-11-15.yang -e vlan-filtering -e containers"
"infix-interfaces@2024-11-27.yang -e vlan-filtering -e containers"
"infix-containers@2024-11-15.yang"
)
src/confd/yang/infix-if-bridge.yang
+93 -92
View File
@@ -26,6 +26,15 @@ submodule infix-if-bridge {
contact "kernelkit@googlegroups.com";
description "Linux bridge extension for ietf-interfaces.";
revision 2024-11-28 {
description "Drop must() expressions for IP addres on VLAN bridges.
If a bridge is untagged member of a VLAN it should be
possible to set an IP address on the bridge.
Allow bridge port settings that also apply to the
bridge itself (e.g., PVID) to be configured.";
reference "internal";
}
revision 2024-11-15 {
description "Fix pyang linter warnings, drop unused imports.";
reference "internal";
@@ -424,19 +433,90 @@ submodule infix-if-bridge {
}
}
deviation "/if:interfaces/if:interface/ip:ipv4/ip:enabled" {
deviate add {
must "not(.) or count(../../infix-if:bridge/infix-if:vlans/infix-if:vlan) = 0" {
error-message "IPv4 address is not supported on VLAN filtering bridges.";
}
grouping bridge-port-common {
leaf pvid {
if-feature "vlan-filtering";
type dot1q-types:vlanid;
description "The primary VID assigned to this bridge port.";
}
}
deviation "/if:interfaces/if:interface/ip:ipv6/ip:enabled" {
deviate add {
must "not(.) or count(../../infix-if:bridge/infix-if:vlans/infix-if:vlan) = 0" {
error-message "IPv6 address is not supported on VLAN filtering bridges.";
grouping bridge-port-lower {
leaf bridge {
type if:interface-ref;
must "deref(.)/../bridge and not(. = ../../if:name)" {
error-message "Must refer to a bridge interface (and not itself).";
}
mandatory true;
description "Bridge interface to which this interface is attached.";
}
container flood {
description "Control flooding of unknown BUM traffic.";
leaf broadcast {
description "Flood unknown broadcast traffic on this port.";
type boolean;
default true;
}
leaf unicast {
description "Flood unknown unicast traffic on this port.";
type boolean;
default true;
}
leaf multicast {
description "Flood unknown multicast traffic on this port.
By default this option is enabled to allow MAC multicast
to coexist unregulated with filtering of IP multicast.
Flooding of IP multicast is done as long as the groups
remain 'unknown', i.e., while there are no MDB entries
set manually or automatically by IGMP/MLD.";
type boolean;
default true;
}
}
container multicast {
leaf fast-leave {
description "Assume this port is attached to an end-device.
When enabled the bridge immediately cuts multicast
groups when receiving a membership leave report.
When disabled, group subscriptions linger until the
group specific queries time out.";
type boolean;
}
leaf router {
description "Forward all known multicast on this port.
Enable this for ports connected to a multicast router
that is not PIM or multicast router discovery (mrdisc)
capable.
This setting is also useful for legacy equipment that
does not support IGMP/MLD. However, it is recommended
to instead set up static MDB entries for such ports.";
type mrouter-port;
default auto;
}
}
leaf stp-state {
type stp-state;
config false;
description "The operation state of the bridge port.";
}
leaf default-priority {
if-feature "vlan-filtering";
type dot1q-types:priority-type;
default "0";
description "The default priority assigned to this bridge port.";
}
}
@@ -455,89 +535,10 @@ submodule infix-if-bridge {
description "Extension of the IETF Interfaces model (RFC7223).";
container bridge-port {
description "Bridge association and port specific setttngs.";
leaf bridge {
type if:interface-ref;
must "deref(.)/../bridge and not(. = ../../if:name)" {
error-message "Must refer to a bridge interface (and not itself).";
}
mandatory true;
description "Bridge interface to which this interface is attached.";
}
container flood {
description "Control flooding of unknown BUM traffic.";
leaf broadcast {
description "Flood unknown broadcast traffic on this port.";
type boolean;
default true;
}
leaf unicast {
description "Flood unknown unicast traffic on this port.";
type boolean;
default true;
}
leaf multicast {
description "Flood unknown multicast traffic on this port.
By default this option is enabled to allow MAC multicast
to coexist unregulated with filtering of IP multicast.
Flooding of IP multicast is done as long as the groups
remain 'unknown', i.e., while there are no MDB entries
set manually or automatically by IGMP/MLD.";
type boolean;
default true;
}
}
container multicast {
leaf fast-leave {
description "Assume this port is attached to an end-device.
When enabled the bridge immediately cuts multicast
groups when receiving a membership leave report.
When disabled, group subscriptions linger until the
group specific queries time out.";
type boolean;
}
leaf router {
description "Forward all known multicast on this port.
Enable this for ports connected to a multicast router
that is not PIM or multicast router discovery (mrdisc)
capable.
This setting is also useful for legacy equipment that
does not support IGMP/MLD. However, it is recommended
to instead set up static MDB entries for such ports.";
type mrouter-port;
default auto;
}
}
leaf stp-state {
type stp-state;
config false;
description "The operation state of the bridge port.";
}
leaf pvid {
if-feature "vlan-filtering";
type dot1q-types:vlanid;
description "The primary VID assigned to this bridge port.";
}
leaf default-priority {
if-feature "vlan-filtering";
type dot1q-types:priority-type;
default "0";
description "The default priority assigned to this bridge port.";
description "Bridge association and port specific settings.";
uses bridge-port-common;
uses bridge-port-lower {
when "not(derived-from-or-self(../if:type, 'ianaift:bridge'))";
}
}
}
src/confd/yang/infix-if-bridge@2024-11-15.yang → src/confd/yang/infix-if-bridge@2024-11-28.yang
View File
src/confd/yang/infix-interfaces.yang
+4
View File
@@ -23,6 +23,10 @@ module infix-interfaces {
contact "kernelkit@googlegroups.com";
description "Linux bridge and lag extensions for ietf-interfaces.";
revision 2024-11-27 {
description "Allow IP addresses directly on VLAN filtering bridges.";
reference "internal";
}
revision 2024-11-15 {
description "Two changes:
- Limit name 1-15 chars, Linux limitation
src/confd/yang/infix-interfaces@2024-11-15.yang → src/confd/yang/infix-interfaces@2024-11-27.yang
View File
src/statd/python/yanger/yanger.py
+26 -12
View File
@@ -674,6 +674,30 @@ def netns_ifindex_to_ifname(ifindex):
return None
def add_bridge_port_common(ifname, iface_in, iface_out):
li = iface_in.get("linkinfo", {})
if not (li.get("info_slave_kind") == "bridge" or \
li.get("info_kind") == "bridge"):
return
pvid = get_bridge_port_pvid(ifname)
if pvid is not None:
insert(iface_out, "infix-interfaces:bridge-port", "pvid", pvid)
def add_bridge_port_lower(ifname, iface_in, iface_out):
li = iface_in.get("linkinfo", {})
if not li.get("info_slave_kind") == "bridge":
return
insert(iface_out, "infix-interfaces:bridge-port", "bridge", iface_in['master'])
stp_state = get_bridge_port_stp_state(ifname)
if stp_state is not None:
insert(iface_out, "infix-interfaces:bridge-port", "stp-state", stp_state)
multicast = get_brport_multicast(ifname)
insert(iface_out, "infix-interfaces:bridge-port", "multicast", multicast)
def add_ip_link(ifname, iface_in, iface_out):
if 'ifname' in iface_in:
iface_out['name'] = ifname
@@ -687,19 +711,9 @@ def add_ip_link(ifname, iface_in, iface_out):
if 'address' in iface_in:
iface_out['phys-address'] = iface_in['address']
if 'master' in iface_in:
insert(iface_out, "infix-interfaces:bridge-port", "bridge", iface_in['master'])
add_bridge_port_common(ifname, iface_in, iface_out)
add_bridge_port_lower(ifname, iface_in, iface_out)
pvid = get_bridge_port_pvid(ifname)
if pvid is not None:
insert(iface_out, "infix-interfaces:bridge-port", "pvid", pvid)
stp_state = get_bridge_port_stp_state(ifname)
if stp_state is not None:
insert(iface_out, "infix-interfaces:bridge-port", "stp-state", stp_state)
multicast = get_brport_multicast(ifname)
insert(iface_out, "infix-interfaces:bridge-port", "multicast", multicast)
if not iface_is_dsa(iface_in):
if 'link' in iface_in:
insert(iface_out, "infix-interfaces:vlan", "lower-layer-if", iface_in['link'])
test/case/cli/cli-output/show-interfaces.txt
+1 -1
View File
@@ -1,5 +1,5 @@
INTERFACE PROTOCOL STATE DATA 
br0 bridge  vlan:40u,50t
br0 bridge  vlan:40u,50t pvid:1
│ ethernet UP 02:00:00:00:00:00
├ e0 bridge DISABLED vlan:10u,20t pvid:10
└ e1 bridge BLOCKING vlan:10t,20u pvid:20
test/case/cli/system-output/bridge-vlan-show-dev-br0.json
+1
View File
@@ -0,0 +1 @@
[{"ifname":"br0","vlans":[{"vlan":1,"flags":["PVID","Egress Untagged"]},{"vlan":33}]}]
test/case/cli/system-output/bridge-vlan-show-dev-br1.json
+1
View File
@@ -0,0 +1 @@
[{"ifname":"br1","vlans":[]}]
test/case/ietf_interfaces/Readme.adoc
+2
View File
@@ -45,3 +45,5 @@ include::iface_enable_disable/Readme.adoc[]
include::veth_delete/Readme.adoc[]
include::vlan_iface_termination/Readme.adoc[]
test/case/ietf_interfaces/ietf_interfaces.yaml
+3
View File
@@ -61,3 +61,6 @@
- name: iface_enable_disable
case: iface_enable_disable/test.py
- name: vlan_iface_termination
case: vlan_iface_termination/test.py
test/case/ietf_interfaces/vlan_iface_termination/Readme.adoc
+51
View File
@@ -0,0 +1,51 @@
=== VLAN Interface Termination
==== Description
Verify that VLANs stacked on top of an interfaces that are also
attached to a VLAN filtering bridge are always locally terminated.
....
.---------------------------.
| target |
| |
| data0.10 br0 data1.10 |
| \ / \ / |
'------data0-----data1------'
| |
| |
.------data0-----data1------.
| / : \ |
| data0.10 : data1.10 |
| : |
| host |
| : |
'---------------------------'
....
In this setup, even though VLAN 10 is allowed to ingress and egress on
both `data0` and `data1`, _bridging_ of packets from one to the other
must _not_ be allowed.
==== Topology
ifdef::topdoc[]
image::../../test/case/ietf_interfaces/vlan_iface_termination/topology.svg[VLAN Interface Termination topology]
endif::topdoc[]
ifndef::topdoc[]
ifdef::testgroup[]
image::vlan_iface_termination/topology.svg[VLAN Interface Termination topology]
endif::testgroup[]
ifndef::testgroup[]
image::topology.svg[VLAN Interface Termination topology]
endif::testgroup[]
endif::topdoc[]
==== Test sequence
. Set up topology and attach to target
. Configure bridge and VLAN interfaces on target
. Configure IP addresses and VLAN interfaces on host
. Verify that host:data0 reaches host:data1 with untagged packets
. Verify that traffic on VLAN 10 from host:data0 does not reach host:data1
. Verify that host:data0 can reach target on VLAN 10
. Verify that host:data1 can reach target on VLAN 10
<<<
test/case/ietf_interfaces/vlan_iface_termination/test.py
Executable
+144
View File
@@ -0,0 +1,144 @@
#!/usr/bin/env python3
r"""VLAN Interface Termination
Verify that VLANs stacked on top of an interfaces that are also
attached to a VLAN filtering bridge are always locally terminated.
....
.---------------------------.
| target |
| |
| data0.10 br0 data1.10 |
| \ / \ / |
'------data0-----data1------'
| |
| |
.------data0-----data1------.
| / : \ |
| data0.10 : data1.10 |
| : |
| host |
| : |
'---------------------------'
....
In this setup, even though VLAN 10 is allowed to ingress and egress on
both `data0` and `data1`, _bridging_ of packets from one to the other
must _not_ be allowed.
"""
import infamy
with infamy.Test() as test:
with test.step("Set up topology and attach to target"):
env = infamy.Env()
tgt = env.attach("target", "mgmt")
with test.step("Configure bridge and VLAN interfaces on target"):
_, hdata0 = env.ltop.xlate( "host", "data0")
_, hdata1 = env.ltop.xlate( "host", "data1")
_, ddata0 = env.ltop.xlate("target", "data0")
_, ddata1 = env.ltop.xlate("target", "data1")
tgt.put_config_dicts({
"ietf-interfaces": {
"interfaces": {
"interface": [
{
"name": "br0",
"type": "infix-if-type:bridge",
"enabled": True,
"bridge": {
"vlans": {
"vlan": [
{
"vid": 1,
"untagged": [ddata0, ddata1]
},
]
}
}
},
{
"name": ddata0,
"infix-interfaces:bridge-port": {
"pvid": 1,
"bridge": "br0"
}
},
{
"name": f"{ddata0}.10",
"type": "infix-if-type:vlan",
"vlan": {
"id": 10,
"lower-layer-if": ddata0,
},
"ipv4": {
"address": [
{
"ip": "10.10.1.2",
"prefix-length": 24,
}
]
}
},
{
"name": ddata1,
"infix-interfaces:bridge-port": {
"pvid": 1,
"bridge": "br0"
}
},
{
"name": f"{ddata1}.10",
"type": "infix-if-type:vlan",
"vlan": {
"id": 10,
"lower-layer-if": ddata1,
},
"ipv4": {
"address": [
{
"ip": "10.10.2.2",
"prefix-length": 24,
}
]
}
},
]
}
}
})
with infamy.IsolatedMacVlan(hdata0) as ns0, \
infamy.IsolatedMacVlan(hdata1) as ns1:
with test.step("Configure IP addresses and VLAN interfaces on host"):
ns0.addip("10.0.1.1")
ns0.runsh("""
set -ex
ip link add dev vlan10 link iface up type vlan id 10
ip addr add 10.10.1.1/24 dev vlan10
""")
ns1.addip("10.0.1.2")
ns1.runsh("""
set -ex
ip link add dev vlan10 link iface up type vlan id 10
ip addr add 10.10.2.1/24 dev vlan10
""")
with test.step("Verify that host:data0 reaches host:data1 with untagged packets"):
ns0.must_reach("10.0.1.2")
with test.step("Verify that traffic on VLAN 10 from host:data0 does not reach host:data1"):
infamy.parallel(lambda: ns0.runsh("timeout -s INT 5 ping -i 0.2 -b 10.10.1.255 || true"),
lambda: ns1.must_not_receive("ip src 10.10.1.1"))
with test.step("Verify that host:data0 can reach target on VLAN 10"):
ns0.must_reach("10.10.1.2")
with test.step("Verify that host:data1 can reach target on VLAN 10"):
ns1.must_reach("10.10.2.2")
test.succeed()
test/case/ietf_interfaces/vlan_iface_termination/topology.dot
Symlink
+1
View File
@@ -0,0 +1 @@
../../../infamy/topologies/1x3.dot
test/case/ietf_interfaces/vlan_iface_termination/topology.svg
+51
View File
@@ -0,0 +1,51 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<!-- Title: 1x3 Pages: 1 -->
<svg width="440pt" height="78pt"
viewBox="0.00 0.00 440.03 78.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 74)">
<title>1x3</title>
<polygon fill="white" stroke="transparent" points="-4,4 -4,-74 436.03,-74 436.03,4 -4,4"/>
<!-- host -->
<g id="node1" class="node">
<title>host</title>
<polygon fill="none" stroke="black" points="0,-0.5 0,-69.5 108,-69.5 108,-0.5 0,-0.5"/>
<text text-anchor="middle" x="25" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">host</text>
<polyline fill="none" stroke="black" points="50,-0.5 50,-69.5 "/>
<text text-anchor="middle" x="79" y="-54.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">tgt</text>
<polyline fill="none" stroke="black" points="50,-46.5 108,-46.5 "/>
<text text-anchor="middle" x="79" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data0</text>
<polyline fill="none" stroke="black" points="50,-23.5 108,-23.5 "/>
<text text-anchor="middle" x="79" y="-8.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data1</text>
</g>
<!-- target -->
<g id="node2" class="node">
<title>target</title>
<polygon fill="none" stroke="black" points="308.03,-0.5 308.03,-69.5 432.03,-69.5 432.03,-0.5 308.03,-0.5"/>
<text text-anchor="middle" x="337.03" y="-54.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt</text>
<polyline fill="none" stroke="black" points="308.03,-46.5 366.03,-46.5 "/>
<text text-anchor="middle" x="337.03" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data0</text>
<polyline fill="none" stroke="black" points="308.03,-23.5 366.03,-23.5 "/>
<text text-anchor="middle" x="337.03" y="-8.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data1</text>
<polyline fill="none" stroke="black" points="366.03,-0.5 366.03,-69.5 "/>
<text text-anchor="middle" x="399.03" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">target</text>
</g>
<!-- host&#45;&#45;target -->
<g id="edge1" class="edge">
<title>host:tgt&#45;&#45;target:mgmt</title>
<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M108,-58C108,-58 308.03,-58 308.03,-58"/>
</g>
<!-- host&#45;&#45;target -->
<g id="edge2" class="edge">
<title>host:data0&#45;&#45;target:data0</title>
<path fill="none" stroke="black" stroke-width="2" d="M108,-35C108,-35 308.03,-35 308.03,-35"/>
</g>
<!-- host&#45;&#45;target -->
<g id="edge3" class="edge">
<title>host:data1&#45;&#45;target:data1</title>
<path fill="none" stroke="black" stroke-width="2" d="M108,-12C108,-12 308.03,-12 308.03,-12"/>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 2.8 KiB

test/case/use_case/ospf_container/test.py
+28 -18
View File
@@ -64,19 +64,14 @@ BODY = "<html><body><p>Router responding</p></body></html>"
def create_vlan_bridge(ns):
return ns.runsh("""
ip link add dev br0 type bridge
ip link set dev br0 up
ip link set dev iface1 up
ip link set dev iface2 up
ip link add dev br0 type bridge vlan_filtering 1 vlan_default_pvid 0
ip link set dev iface1 master br0
ip link set dev iface2 master br0
ip link set dev br0 type bridge vlan_filtering 1
bridge vlan del dev br0 vid 1 self
bridge vlan del dev iface1 vid 1
bridge vlan del dev iface2 vid 1
bridge vlan add dev br0 vid 8 self
bridge vlan add dev iface1 vid 8
bridge vlan add dev iface2 vid 8
ip link set dev iface1 up
ip link set dev iface2 up
ip link set dev br0 up
""")
@@ -140,7 +135,8 @@ table ip nat {
"name": ring1,
"ietf-ip:ipv6": {},
"infix-interfaces:bridge-port": {
"bridge": "br0"
"bridge": "br0",
"pvid": 1,
}
},
{
@@ -163,7 +159,8 @@ table ip nat {
"name": ring2,
"ietf-ip:ipv6": {},
"infix-interfaces:bridge-port": {
"bridge": "br0"
"bridge": "br0",
"pvid": 1,
}
},
{
@@ -195,6 +192,22 @@ table ip nat {
{
"name": "br0",
"type": "infix-if-type:bridge",
"infix-interfaces:bridge": {
"vlans": {
"vlan": [
{
"vid": 1,
"untagged": ["br0", ring1, ring2, "veth0b", "veth2b"],
},
],
},
"ieee-group-forward": [
"lldp"
]
},
"infix-interfaces:bridge-port": {
"pvid": 1,
},
"ietf-ip:ipv4": {
"enabled": True,
"forwarding": True,
@@ -205,11 +218,6 @@ table ip nat {
},
"ietf-ip:ipv6": {
"enabled": True
},
"infix-interfaces:bridge": {
"ieee-group-forward": [
"lldp"
]
}
},
{
@@ -255,7 +263,8 @@ table ip nat {
"name": "veth0b",
"type": "infix-if-type:veth",
"infix-interfaces:bridge-port": {
"bridge": "br0"
"bridge": "br0",
"pvid": 1,
},
"infix-interfaces:veth": {
"peer": "veth0a"
@@ -306,7 +315,8 @@ table ip nat {
"name": "veth2b",
"type": "infix-if-type:veth",
"infix-interfaces:bridge-port": {
"bridge": "br0"
"bridge": "br0",
"pvid": 1,
},
"infix-interfaces:veth": {
"peer": "veth2a"