Merge pull request #986 from kernelkit/mvpp2-tcam-fix

Fix `mvpp2` TCAM memory corruption

.gitignore

@@ -8,3 +8,4 @@
 /test/.venv
 /test/.log
 /local.mk
+/test/spec/Readme.adoc

README.md

@@ -27,13 +27,13 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.
 
-In itself Infix is perfectly suited for dedicated networking tasks and
-native support for Docker containers provides a versatile platform that
-can easily be adapted to any customer need.  Be it legacy applications,
-network protocols, process monitoring, or edge data analysis, it can run
-close to end equipment.  Either directly connected on dedicated Ethernet
-ports or indirectly using virtual network cables to exist on the same
-LAN as other connected equipment.
+In itself, Infix is perfectly suited for dedicated networking tasks, and
+with native support for Docker containers, the operating system provides
+a versatile platform that can easily be adapted to any customer need.
+Be it legacy applications, network protocols, process monitoring, or
+edge data analysis, it can run close to end equipment.  Either directly
+connected on dedicated Ethernet ports or indirectly using virtual
+network cables to exist on the same LAN as other connected equipment.
 
 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get

board/common/qemu/Config.in.in

@@ -189,7 +189,7 @@ config QEMU_CLOCK
 comment "Networking"
 
 choice
-     prompt "Mode"
+     prompt "Network Mode"
      default QEMU_NET_USER
 
 config QEMU_NET_NONE
@@ -204,6 +204,9 @@ config QEMU_NET_USER
 config QEMU_NET_TAP
      bool "TAP"
 
+config QEMU_NET_ROCKER
+     bool "Rocker"
+
 endchoice
 
 config QEMU_NET_MODEL
@@ -229,3 +232,8 @@ config QEMU_NET_TAP_N
 	int "Number of TAPs"
 	depends on QEMU_NET_TAP
 	default 1
+
+config QEMU_NET_PORTS
+	int "Number of Rocker switch ports"
+	depends on QEMU_NET_ROCKER
+	default 10

board/common/qemu/qemu.sh

@@ -17,9 +17,10 @@
 #
 #    ./qemu.sh -h
 #
+# shellcheck disable=SC3037
 
 # Local variables
-imgdir=$(readlink -f $(dirname "$0"))
+imgdir=$(readlink -f "$(dirname "$0")")
 prognm=$(basename "$0")
 
 usage()
@@ -30,6 +31,7 @@ usage()
     echo "Options:"
     echo "  -c     Run menuconfig to change Qemu settings"
     echo "  -h     This help text"
+    echo "  -k     Keep generated qemu.run script (name shown at end)"
     echo
     echo "Arguments:"
     echo "  ARGS1  Args before the '--' separator are for kernel space"
@@ -54,19 +56,20 @@ die()
 
 load_qemucfg()
 {
-    local tmp=$(mktemp -p /tmp)
+    tmp=$(mktemp -p /tmp)
 
-    grep ^CONFIG_QEMU_ $1 >$tmp
-    .  $tmp
-    rm $tmp
+    grep ^CONFIG_QEMU_ "$1" >"$tmp"
+    # shellcheck disable=SC1090
+    .  "$tmp"
+    rm "$tmp"
 
     [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
     [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
 
-    [ "$CONFIG_QEMU_KERNEL" -a "$CONFIG_QEMU_BIOS" ] \
+    [ -n "$CONFIG_QEMU_KERNEL" ] && [ -n "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
 
-    [ ! "$CONFIG_QEMU_KERNEL" -a ! "$CONFIG_QEMU_BIOS" ] \
+    [ -z "$CONFIG_QEMU_KERNEL" ] && [ -z "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
 }
 
@@ -93,7 +96,7 @@ append_args()
 
     if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
 	# Size of initrd, rounded up to nearest kb
-	local size=$((($(stat -c %s $CONFIG_QEMU_ROOTFS) + 1023) >> 10))
+	size=$((($(stat -c %s "$CONFIG_QEMU_ROOTFS") + 1023) >> 10))
 	echo -n "root=/dev/ram0 ramdisk_size=${size} "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	echo -n "root=PARTLABEL=primary "
@@ -198,13 +201,24 @@ host_args()
 
 net_dev_args()
 {
-    local name="e$1"
-    local mac=$(printf "02:00:00:00:00:%02x" $1)
+    name="e$1"
+    mac=$(printf "02:00:00:00:00:%02x" "$1")
 
     echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
     echo "$name	$mac" >>"$mactab"
 }
 
+rocker_port_args()
+{
+    sw=$1
+    port=$2
+    name="sw${sw}p${port}"
+    mac=$(printf "02:00:00:00:%02x:%02x" "$sw" "$port")
+
+    echo -n "-netdev tap,id=$name,ifname=$name,script=no,downscript=no "
+    echo "$name	$mac" >> "$mactab"
+}
+
 net_args()
 {
     # Infix will pick up this file via fwcfg and install it to /etc
@@ -216,14 +230,25 @@ net_args()
 	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
 	net_dev_args 1
     elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
+	for i in $(seq 1 "$CONFIG_QEMU_NET_TAP_N"); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
-	    net_dev_args $i
+	    net_dev_args "$i"
+	done
+    elif [ "$CONFIG_QEMU_NET_ROCKER" = "y" ]; then
+	sw=sw0			# Only single switch support atm.
+	echo -n "-device '{\"driver\":\"rocker\", \"name\":\"${sw}\", "
+	echo -n "\"fp_start_macaddr\":\"02:00:00:00:00:01\", "
+	echo -n "\"ports\":["
+	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	    [ "$i" -gt 1 ] && echo -n ", "
+	    echo -n "\"${sw}p${i}\""
+	done
+	echo -n "]}' "
+	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	    rocker_port_args 0 "$i"
 	done
     elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
-	local useropts=
 	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
-
 	echo -n "-netdev user,id=e1${useropts} "
 	net_dev_args 1
     else
@@ -301,8 +326,7 @@ run_qemu()
 	fi
     fi
 
-    local qemu
-    read qemu <<EOF
+    read -r qemu <<EOF
 	$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
@@ -317,18 +341,28 @@ run_qemu()
 	  $(gdb_args) \
 	  $CONFIG_QEMU_EXTRA
 EOF
+    # Save resulting command to a script, because I cannot for the life
+    # of me figure out how to embed the JSON snippet for Rocker and run
+    # it here without issues, spent way too much time on it -- Joachim
+    run=$(mktemp -t run.qemu.XXX)
+    echo "#!/bin/sh" > "$run"
+    if [ "$CONFIG_QEMU_KERNEL" ]; then
+	echo "$qemu -append \"$(append_args)\" $*" >> "$run"
+    else
+	echo "$qemu $*" >> "$run"
+    fi
+    chmod +x "$run"
 
     echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
     line=$(stty -g)
     stty raw
-
-    if [ "$CONFIG_QEMU_KERNEL" ]; then
-	$qemu -append "$(append_args)" "$@"
-    else
-	$qemu "$@"
-    fi
-
+    $run
     stty "$line"
+    if [ -n "$keep" ]; then
+	echo "Keeping generated qemu.run script: $run"
+    else
+	rm "$run"
+    fi
 }
 
 dtb_args()
@@ -364,7 +398,7 @@ generate_dot()
     hostports="<qtap1> qtap1"
     targetports="<e1> e1"
     edges="host:qtap1 -- target:e1 [kind=mgmt];"
-    for tap in $(seq 2 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
+    for tap in $(seq 2 $((CONFIG_QEMU_NET_TAP_N - 1))); do
 	hostports="$hostports | <qtap$tap> qtap$tap "
 	targetports="$targetports | <e$tap> e$tap "
 	edges="$edges host:qtap$tap -- target:e$tap;"
@@ -404,7 +438,8 @@ menuconfig()
     exec kconfig-mconf Config.in
 }
 
-cd $(dirname $(readlink -f "$0"))
+scriptdir=$(dirname "$(readlink -f "$0")")
+cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
 
 while [ "$1" != "" ]; do
     case $1 in
@@ -414,6 +449,9 @@ while [ "$1" != "" ]; do
 	-h)
 	    usage
 	    ;;
+	-k)
+	    keep=true
+	    ;;
 	*)
 	    break
     esac

board/common/rootfs/etc/default/ospfd

@@ -0,0 +1,2 @@
+# --log-level debug
+OSPFD_ARGS="-A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf --log syslog"

board/common/rootfs/etc/default/zebra

@@ -0,0 +1,2 @@
+# --log-level debug
+ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -1,4 +1,4 @@
-service :%i pid:!/run/k8s-logger-%i.pid <usr/container:%i> \
-	[2345] k8s-logger -cni %i -f local1 /run/containers/%i.fifo -- Logger for container %i
-sysv    :%i pid:!/run/container:%i.pid <!pid/k8s-logger:%i> log kill:10 \
+task    name:container-%i :setup \
+	[2345] container -n %i setup -- Setup container %i
+sysv    <!usr/container:%i> :%i pid:!/run/container:%i.pid log:prio:local1,tag:%i kill:10 \
 	[2345] container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/sysklogd.conf

@@ -0,0 +1,4 @@
+# Use <pid/syslogd> as barrier for other system tasks and service that
+# rely on modules, firmware, and device nodes to be ready.
+service if:udevd nowarn env:-/etc/default/sysklogd <run/udevadm:post/success> \
+	[S0123456789] syslogd -F $SYSLOGD_ARGS -- System log daemon

board/common/rootfs/usr/bin/pager

@@ -5,9 +5,10 @@
 # -K :: exit immediately when an interrupt character (usually ^C) is typed
 # -R :: Almost raw control charachters, only ANSI color escape sequences and
 #       OSC 8 hyperlink sequences are output.  Allows veritcal scrolling
-# -S :: lines longer than the screen width are chopped (truncated), not wrapped
 # -X :: No termcap initialization and deinitialization set to the terminal.
 #       This is what leaves the contents of the output on screen.
 
 export LESS="-P %f (press h for help or q to quit)"
-less -RISKd -FX "$@"
+export LANG=en_US.UTF-8
+
+less -RIKd -FX "$@"

board/common/rootfs/usr/lib/finit/system/20-hw-wait.conf

@@ -0,0 +1,9 @@
+# Extend finit's default udevadm settle synchronization for situations
+# where device are very slow to probe (see #685)
+run nowarn if:udevd cgroup.init <service/udevd/ready> log \
+	[S] /usr/libexec/infix/hw-wait -- Probing hardware
+
+# Now that everything should be probed, do a final pass over the
+# uevent queue before starting syslogd and everything else
+run nowarn if:udevd cgroup.init :post <service/udevd/ready> log \
+	[S] udevadm settle -t 30 --

board/common/rootfs/usr/lib/tmpfiles.d/containers.conf

@@ -0,0 +1,6 @@
+d  /run/containers/args		0700 - -
+d  /run/containers/files	0700 - -
+d  /var/lib/containers		0700 - -
+d  /var/lib/containers/oci	0700 - -
+d  /run/cni			0755 - -
+L+ /var/lib/cni                 -    - - - /run/cni

board/common/rootfs/usr/libexec/infix/hw-wait

@@ -0,0 +1,41 @@
+#!/bin/sh
+# (Ab)use the kernel's device link subsystem to detect consumer side
+# devices that may be very slow to probe (looking at you, mv88e6xxx!).
+
+ident=$(basename "$0")
+
+report()
+{
+    if [ -r "/tmp/$ident" ]; then
+	logger -k -p "user.$1" -t "$ident" "Waited for slow devices:"
+	sort "/tmp/$ident" | uniq -c | logger -k -p "user.$1" -t "$ident"
+    fi
+
+    rm -f "/tmp/$ident"
+}
+
+for _ in $(seq 50); do
+    again=
+
+    for dl in /sys/class/devlink/*; do
+    	[ -r "$dl/status" ] || continue
+
+    	status=$(cat "$dl/status")
+	if [ "$status" = "consumer probing" ]; then
+	    basename "$(readlink "$dl/consumer")" >>"/tmp/$ident"
+	    again=yes
+	fi
+
+    done
+
+    if [ -z "$again" ]; then
+	report notice
+	exit 0
+    fi
+
+    sleep .2
+done
+
+logger -k -p user.error -t "$ident" "Timeout waiting for devices to come online"
+report error
+exit 1

board/common/rootfs/usr/libexec/infix/init.d/20-nameif

@@ -14,24 +14,6 @@ for file in /sys/firmware/qemu_fw_cfg/by_name/opt/mactab/raw /etc/mactab; do
 	fi
 done
 
-# Sometimes the sysfs is not populated when the switch driver is loaded, with the result
-# that the DSA interface was not found (no /dsa/tagging entry in sysfs. See issue #685.
-#
-# This mitigates that problem by waiting for sysfs to come up if a DSA switch is found
-if [ -n "$(devlink -j dev info | jq -r '.info.[].driver' | grep -q mv88e6085)" ]; then
-	timeout=50
-	while [ -z "$(ls /sys/class/net/*/dsa/tagging)" ]; do
-		timeout=$((timeout-1))
-		if [ $timeout -eq 0 ]; then
-			logger -k -p user.emerg -t "$ident" "Failed to find DSA interface"
-			exit 1
-		fi
-		sleep 0.1
-	done
-
-	logger -k -p user.notice -t "$ident" "Found DSA interface in $timeout seconds"
-fi
-
 # Find CPU interfaces used for connecting to a switch managed by DSA
 for netif in /sys/class/net/*; do
 	iface=$(basename "$netif")

board/common/rootfs/usr/sbin/container

@@ -1,17 +1,17 @@
 #!/bin/sh
 # This script can be used to start, stop, create, and delete containers.
-# It is primarily used by confd to create jobs for execd to run from its
-# /run/containers/queue, but it can also be used manually.
+# It is what confd use, with the Finit container@.conf template, to set
+# up, run, and delete containers.
 #
 # NOTE: when creating/deleting containers, remember 'initctl reload' to
-#       activate the changes!  When called by confd, via execd, this is
-#       already handled.
+#       activate the changes!  In confd this is already handled.
 #
 DOWNLOADS=/var/lib/containers/oci
 BUILTIN=/lib/oci
 TMPDIR=/var/tmp
 checksum=""
 extracted=
+timeout=30
 dir=""
 all=""
 env=""
@@ -126,7 +126,17 @@ unpack_archive()
 	    fi
             ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    echo "$image"
+	    if podman image exists "$image"; then
+		echo "$image"
+		return 0
+	    fi
+	    # XXX: use --retry=0 with Podman 5.0 or later.
+	    if ! id=$(podman pull --quiet "$image"); then
+		log "Failed pulling $image"
+		return 1
+	    fi
+	    # Echo image name to caller
+	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
 	    return 0
 	    ;;
     esac
@@ -216,13 +226,10 @@ create()
     fi
 
     if [ -z "$logging" ]; then
-	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
+	logging="--log-driver none"
     fi
 
-    # Pull quietly and don't retry on failure, we use execd for this,
-    # or user retry manually when run interactively, we may have other
-    # containers waiting to start that have an image locally already.
-    # Use --retry=0 with Podman 5.0 or later.
+    # When we get here we've already fetched, or pulled, the image
     args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
     args="$args $vol $mount $hostname $entrypoint $env $port $logging"
@@ -253,6 +260,7 @@ create()
     if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
 	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"
+
 	# Should already be enabled by confd (this is for manual use)
 	initctl -bnq enable "container@${name}.conf"
 	exit 0
@@ -272,8 +280,16 @@ delete()
 	exit 1
     fi
 
-    # Should already be disabled (and stopped) by confd (this is for manual use)
-    initctl -bnq disable "container@${name}.conf"
+    # Should already be stopped, but if not ...
+    container stop "$name"
+
+    while running "$name"; do
+	_=$((timeout -= 1))
+	if [ $timeout -le 0 ]; then
+	    err 1 "timed out waiting for container $1 to stop before deleting it."
+	fi
+	sleep 1
+    done
 
     podman rm -vif "$name" >/dev/null 2>&1
     [ -n "$quiet" ] || log "Container $name has been removed."
@@ -281,7 +297,6 @@ delete()
 
 waitfor()
 {
-    timeout=$2
     while [ ! -f "$1" ]; do
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
@@ -353,6 +368,12 @@ netrestart()
     done
 }
 
+cleanup()
+{
+    log "Received signal, exiting."
+    exit 1
+}
+
 usage()
 {
 	cat <<EOF
@@ -386,6 +407,7 @@ options:
   -q, --quiet              Quiet operation, called from confd
   -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
   -s, --simple             Show output in simplified format
+  -t, --timeout SEC        Set timeout for delete/restart commands, default: 20
   -v, --volume NAME:PATH   Create named volume mounted inside container on PATH
 
 commands:
@@ -403,6 +425,7 @@ commands:
   restart [network] NAME   Restart a (crashed) container or container(s) using network
   run      NAME [CMD]      Run a container interactively, with an optional command
   save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
+  setup    NAME            Create and set up container as a Finit task
   shell                    Start a shell inside a container
   show    [image | volume] Show containers, images, or volumes
   stat                     Show continuous stats about containers (Ctrl-C aborts)
@@ -525,6 +548,10 @@ while [ "$1" != "" ]; do
 	-s | --simple)
 	    simple=true
 	    ;;
+	-t | --timeout)
+	    shift
+	    timeout=$1
+	    ;;
 	-v | --volume)
 	    shift
 	    vol="$vol -v $1"
@@ -541,6 +568,8 @@ if [ -n "$cmd" ]; then
     shift
 fi
 
+trap cleanup INT TERM
+
 case $cmd in
     # Does not work atm., cannot attach to TTY because
     # we monitor 'podman start -ai foo' with Finit.
@@ -666,6 +695,20 @@ case $cmd in
 	    gzip "$file"
 	fi
 	;;
+    setup)
+	[ -n "$name" ] || err 1 "setup: missing container name."
+	script=/run/containers/${name}.sh
+	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
+	while ! "$script"; do
+	    # Wait for address/route changes, or retry every 60 secods
+	    # shellcheck disable=2162,3045
+	    ip monitor address route | while read -t 60 _; do break; done
+
+	    # On IP address/route changes, wait a few seconds more to ensure
+	    # the system has ample time to react and set things up for us.
+	    sleep 2
+	done
+	;;
     shell)
 	podman exec -it "$1" sh -l
 	;;
@@ -720,7 +763,6 @@ case $cmd in
 	    else
 		name=$1
 		stop "$name"
-		timeout=20
 		while running "$name"; do
 		    _=$((timeout -= 1))
 		    if [ $timeout -le 0 ]; then
@@ -781,7 +823,7 @@ case $cmd in
 	[ -n "$cmd" ] && shift
 	case $cmd in
 	    prune)
-		podman volume $force prune
+		podman volume prune $force
 		;;
 	    *)
 		false

board/common/rootfs/usr/share/udhcpc/default.script

@@ -50,7 +50,7 @@ set_dhcp_routes()
 	# format: dest1/mask gw1 ... destn/mask gwn
 	set -- $staticroutes
 	while [ -n "$1" -a -n "$2" ]; do
-	    log "adding route $1 via $2 dev $interface proto dhcp"
+	    log "adding route $1 via $2 metric $metric tag 100"
 	    echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
 	    shift 2
 	done
@@ -115,7 +115,7 @@ case "$ACTION" in
 	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
 	fi
 
-	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto 5; then
+	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto dhcp; then
 	    echo "$ip" > "$IP_CACHE"
 	fi
 	if [ -n "$ipv6" ] ; then

board/x86_64/linux_defconfig

@@ -33,6 +33,7 @@ CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
 CONFIG_SMP=y
 CONFIG_EFI=y
+CONFIG_KPROBES=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -161,12 +162,14 @@ CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_PKTGEN=y
 # CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
+CONFIG_PCI_MSI=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -208,6 +211,7 @@ CONFIG_NET_VRF=y
 CONFIG_E1000=y
 CONFIG_NE2K_PCI=y
 CONFIG_8139CP=y
+CONFIG_ROCKER=y
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 CONFIG_SERIAL_8250=y
@@ -264,5 +268,5 @@ CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-# CONFIG_FTRACE is not set
+CONFIG_FUNCTION_TRACER=y
 CONFIG_UNWINDER_FRAME_POINTER=y

configs/aarch64_defconfig

@@ -134,7 +134,6 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
-BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -147,7 +146,6 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y

configs/r2s_defconfig

@@ -175,7 +175,6 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
-BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -188,7 +187,6 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y

configs/riscv64_defconfig

@@ -165,7 +165,6 @@ INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
-BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -178,7 +177,6 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y

configs/x86_64_defconfig

@@ -138,7 +138,6 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
-BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -151,7 +150,6 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y

doc/ChangeLog.md

@@ -3,6 +3,62 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v24.11.2][] - 2025-03-19
+-------------------------
+
+### Fixes
+
+- Fix TCAM memory corruption in `mvpp2` Ethernet controller
+
+
+[v24.11.1][] - 2024-11-29
+-------------------------
+
+### Changes
+
+ - Upgrade Frr to 9.1.2, fixes an OSPF issue where *Zebra* lost netlink
+   messages and drifted out of sync with the kernel's view of addresses
+   and interfaces available in the system
+ - Allow setting IP address directly on VLAN filtering bridges.  This
+   only works when the bridge is an untagged member of a (single) VLAN.
+ - cli: usability -- showing log files now automatically jump to the end
+   of the file, where the latest events are
+ - cli: usability -- showing container status, or other status that
+   overflows the terminal horizontally, now wrap the lines and exit the
+   pager immediately if the contents fit on the first screen
+ - The default log level of the mDNS responder, `avahi-daemon`, has been
+   adjusted to make it less verbose.  Now only `LOG_NOTICE` and higher
+   severity is logged -- making it very quiet
+
+### Fixes
+
+ - Fix #685: DSA conduit interface not always detected.  Previous
+   attempt at a fix (v24.10.2) mitigated the issue, but did not
+   completely solve it.
+ - Fix #835: redesign how the system creates/deletes containers from the
+   `running-config`.  Prior to this change, all removal and creation was
+   handled by a separate queue that ran asynchronously from the `confd`
+   process.  This could lead to situations where new configurations are
+   applied before the queue had been fully processed.  After this change
+   containers are deleted synchronously and new containers are created
+   in the same flow as during normal runtime operation (start/upgrade)
+ - Fix start of containers with `manual=True` option should now work
+   again, regression in v24.11.0
+ - Fix loss of writable volumes when temporarily disabling a container
+   in the configuration, now the container remains dormant with all its
+   volumes still available
+ - Fix presentation bug in CLI `show interfaces` where all line-drawing
+   characters showed up as hexadecimal values.  Regression in v24.11.0
+ - Fix missing log messages from Frr Zebra daemon
+ - Stop the zeroconf (IPv4LL) agent, `avahi-autoipd`, when removing an
+   interface, e.g., `br0`
+ - Creating more than one container trigger restarts of previously set
+   up containers.  Which in some cases may cause these earlier ones to
+   end up in an inconsistent state
+ - Prevent traffic assigned to locally terminated VLANs from being
+   forwarded, when the underlying ports are simultaneously attached to
+   a VLAN filtering bridge.
+
 
 [v24.11.0][] - 2024-11-20
 -------------------------
@@ -1361,6 +1417,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 
 [buildroot]:  https://buildroot.org/
 [UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.11.0...HEAD
+[v24.11.2]:   https://github.com/kernelkit/infix/compare/v24.11.1...v24.11.2
+[v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
 [v24.11.0]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0
 [v24.10.2]:   https://github.com/kernelkit/infix/compare/v24.10.1...v24.10.2
 [v24.10.1]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.10.1

doc/networking.md

@@ -219,10 +219,15 @@ admin@example:/config/interface/br0/> set bridge vlans vlan 10 tagged br0
 admin@example:/config/interface/br0/> set bridge vlans vlan 20 tagged br0
 ```
 
+To route or to manage via a VLAN, a VLAN interface needs to be created
+on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
+below for more on this topic.
+
 > [!NOTE]
-> To route or to manage via a VLAN, a VLAN interface needs to be created
-> on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
-> below for more on this topic.
+> In some use-cases only a single management VLAN on the bridge is used.
+> For the example above, if the bridge itself is an untagged member only
+> in VLAN 10, IP addresses can be set directly on the bridge without the
+> need for dedicated VLAN interfaces on top of the bridge.
 
 
 #### Multicast Filtering and Snooping
@@ -465,7 +470,9 @@ As conventions, a VLAN interface for VID 20 on top of an Ethernet
 interface *eth0* is named *eth0.20*, and a VLAN interface for VID 10 on
 top of a bridge interface *br0* is named *vlan10*.
 
-> **Note:** If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a number, Infix will set the interface type automatically for you.
+> [!NOTE]
+> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
+> number, Infix will set the interface type automatically for you.
 
 
 ### Physical Ethernet Interfaces

package/execd/tmpfiles.conf

@@ -1,7 +1 @@
-d  /run/containers/args		0700 - -
-d  /run/containers/files	0700 - -
-d  /var/lib/containers/oci	0755 - -
-d  /run/containers/inbox	0700 - -
 d  /run/containers/queue	0700 - -
-d  /run/cni			0755 - -
-L+ /var/lib/cni                 -    - - - /run/cni

package/finit/0001-Only-mark-rdeps-dirty-if-main-service-is-nohup.patch

@@ -1,7 +1,7 @@
 From 46ffa81f5c88ce95db011369d8bfb802313e4217 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 17 Oct 2024 14:23:24 +0200
-Subject: [PATCH 1/6] Only mark rdeps dirty if main service is nohup
+Subject: [PATCH 1/7] Only mark rdeps dirty if main service is nohup
 Organization: Addiva Elektronik
 
 This patch changes a behavior that's been default since Finit 4.0,

package/finit/0002-Reset-color-attributes-and-clear-screen-when-startin.patch

@@ -1,7 +1,7 @@
 From 119e66a7e9c95283918639b51dd03a3d666955f8 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 28 Oct 2024 10:58:04 +0100
-Subject: [PATCH 2/6] Reset color attributes and clear screen when starting up
+Subject: [PATCH 2/7] Reset color attributes and clear screen when starting up
 Organization: Addiva Elektronik
 
 Some boot loaders, like GRUB, leave background color artifacts from

package/finit/0003-plugins-refactor-rtc.so.patch

@@ -1,7 +1,7 @@
 From 0c0e880f3fdd38f7bbde618408378dc0a19ff005 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 09:39:46 +0100
-Subject: [PATCH 3/6] plugins: refactor rtc.so
+Subject: [PATCH 3/7] plugins: refactor rtc.so
 Organization: Addiva Elektronik
 
 Factor out time_set() and time_get() for readability and reuse.

package/finit/0004-Fix-418-support-systems-with-a-broken-RTC.patch

@@ -1,7 +1,7 @@
 From bc8118d515839dc598f437aa01f07a771646968d Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 09:47:16 +0100
-Subject: [PATCH 4/6] Fix #418: support systems with a broken RTC
+Subject: [PATCH 4/7] Fix #418: support systems with a broken RTC
 Organization: Addiva Elektronik
 
 This patch introduces a new configure option --with-rtc-file=FILE.  When

package/finit/0005-Fix-buggy-with-rtc-date-DATE-introduced-in-Finit-v4..patch

@@ -1,7 +1,7 @@
 From 6be16f2f6d093ef495d0fe4313f7b05b4ba3e08f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 10:38:38 +0100
-Subject: [PATCH 5/6] Fix buggy --with-rtc-date=DATE, introduced in Finit v4.4
+Subject: [PATCH 5/7] Fix buggy --with-rtc-date=DATE, introduced in Finit v4.4
 Organization: Addiva Elektronik
 
 In 42ef3d3c, for v4.4-rc1, support for setting a custom RTC restore date

package/finit/0006-plugins-reduce-log-level-LOG_ERR-LOG_WARNING.patch

@@ -1,7 +1,7 @@
 From 49c0557cedd8d3c1a2f74d27fa7db83dd529914a Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 20:49:04 +0100
-Subject: [PATCH 6/6] plugins: reduce log level LOG_ERR -> LOG_WARNING
+Subject: [PATCH 6/7] plugins: reduce log level LOG_ERR -> LOG_WARNING
 Organization: Addiva Elektronik
 
 These plugins signal success and failure directly to the console, the

package/finit/0007-Fix-unintended-restart-of-template-siblings.patch

@@ -0,0 +1,57 @@
+From 465bc17ca4b131f8c1ef27ff8279f4ea13745a78 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 28 Nov 2024 11:06:57 +0100
+Subject: [PATCH 7/7] Fix unintended restart of template siblings
+Organization: Addiva Elektronik
+
+Consider the case where container@.conf is an available template.  When
+creating a container@foo.conf it will share the same base .conf as an
+existing container@bar.conf, but we do not expect to restart bar just
+because foo is instantiated.
+
+Up until this change, all template siblings were considered "dirty" if a
+new one was created or updated.  Skipping realpath() for all files that
+have a '@' works around the problem.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/conf.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/src/conf.c b/src/conf.c
+index 1cfcd87..531923c 100644
+--- a/src/conf.c
++++ b/src/conf.c
+@@ -1432,16 +1432,22 @@ static int conf_change_act(char *dir, char *name, uint32_t mask)
+ 		strlcpy(fn, dir, sizeof(fn));
+ 	dbg("path: %s mask: %08x", fn, mask);
+ 
+-	/* Handle disabling/removal of service */
+-	rp = realpath(fn, NULL);
+-	if (!rp) {
+-		if (errno != ENOENT)
+-			goto fail;
++	if (strchr(name, '@')) {
++		/* Skip realpath for templates */
+ 		rp = strdup(fn);
+-		if (!rp)
+-			goto fail;
++	} else {
++		/* Handle disabling/removal of service */
++		rp = realpath(fn, NULL);
++		if (!rp) {
++			if (errno != ENOENT)
++				goto fail;
++			rp = strdup(fn);
++		}
+ 	}
+ 
++	if (!rp)
++		goto fail;
++
+ 	node = conf_find(rp);
+ 	if (node) {
+ 		dbg("event already registered for %s ...", name);
+-- 
+2.43.0
+

package/skeleton-init-finit/skeleton/etc/finit.d/available/avahi.conf

@@ -1 +1 @@
-service [2345] name:mdns avahi-daemon -s -- Avahi mDNS-SD daemon
+service [2345] name:mdns avahi-daemon -s -l notice -- Avahi mDNS-SD daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/ospfd.conf

@@ -1 +1,2 @@
-service [2345] log:null <!pid/zebra> ospfd -A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf -- OSPF daemon
+service <!pid/zebra> env:-/etc/default/ospfd \
+	[2345] ospfd $OSPFD_ARGS -- OSPF daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/zebra.conf

@@ -1 +1,2 @@
-service [2345] <!> pid:!/run/frr/zebra.pid zebra -A 127.0.0.1 -u frr -g frr -- Zebra routing daemon
+service <!> pid:!/run/frr/zebra.pid env:-/etc/default/zebra \
+	[2345] zebra $ZEBRA_ARGS -- Zebra routing daemon

patches/avahi/0001-On-SIGTERM-allow-dispatcher-to-process-event-before-.patch

@@ -1,7 +1,8 @@
 From 74ec0f8335f811e4f5becc8bbea4a52af4d3e749 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 17 Sep 2024 04:08:12 +0200
-Subject: [PATCH] On SIGTERM, allow dispatcher to process event before exiting
+Subject: [PATCH 1/2] On SIGTERM, allow dispatcher to process event before
+ exiting
 Organization: Addiva Elektronik
 
 On non-systemd systems, like those managed by Finit, when the main PID

patches/avahi/0002-avahi-daemon-allow-adjusting-log-level.patch

@@ -0,0 +1,145 @@
+From bceb724d328f156efa4ad18f26f1760504bd093d Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Wed, 27 Nov 2024 08:44:57 +0100
+Subject: [PATCH 2/2] avahi-daemon: allow adjusting log level
+Organization: Addiva Elektronik
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ avahi-daemon/main.c | 50 ++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 45 insertions(+), 5 deletions(-)
+
+diff --git a/avahi-daemon/main.c b/avahi-daemon/main.c
+index 346338f..b7f0969 100644
+--- a/avahi-daemon/main.c
++++ b/avahi-daemon/main.c
+@@ -30,6 +30,7 @@
+ #include <unistd.h>
+ #include <grp.h>
+ #include <pwd.h>
++#include <sys/param.h>          /* MIN() */
+ #include <sys/stat.h>
+ #include <sys/ioctl.h>
+ #ifdef HAVE_SYS_FILIO_H
+@@ -106,6 +107,7 @@ typedef struct {
+     DaemonCommand command;
+     int daemonize;
+     int use_syslog;
++    int log_level;
+     char *config_file;
+ #ifdef HAVE_DBUS
+     int enable_dbus;
+@@ -419,6 +421,30 @@ static void server_callback(AvahiServer *s, AvahiServerState state, void *userda
+     }
+ }
+ 
++static int log_level(const char *arg) {
++    struct {
++	const char *name;
++	int         val;
++    } prionm[] = {
++	{ "error",   LOG_ERR     },
++	{ "warning", LOG_WARNING },
++	{ "notice",  LOG_WARNING },
++	{ "info",    LOG_WARNING },
++	{ "debug",   LOG_WARNING },
++	{ NULL, 0 },
++    };
++    int i;
++
++    for (i = 0; prionm[i].name; i++) {
++	size_t len = MIN(strlen(prionm[i].name), strlen(arg));
++
++	if (!strncasecmp(prionm[i].name, arg, len))
++	    return prionm[i].val;
++    }
++
++    return -1;
++}
++
+ static void help(FILE *f) {
+     fprintf(f,
+             "%s [options]\n"
+@@ -426,6 +452,7 @@ static void help(FILE *f) {
+             "    -D --daemonize     Daemonize after startup (implies -s)\n"
+             "    -s --syslog        Write log messages to syslog(3) instead of STDERR\n"
+             "    -k --kill          Kill a running daemon\n"
++	    "    -l --loglevel=LVL  Set log level: err, warn, notice, info*, debug\n"
+             "    -r --reload        Request a running daemon to reload static services\n"
+             "    -c --check         Return 0 if a daemon is already running\n"
+             "    -V --version       Show version\n"
+@@ -437,7 +464,7 @@ static void help(FILE *f) {
+             "       --no-chroot     Don't chroot()\n"
+ #endif
+             "       --no-proc-title Don't modify process title\n"
+-            "       --debug         Increase verbosity\n",
++            "       --debug         Increase verbosity, same as -l debug\n",
+             argv0);
+ }
+ 
+@@ -459,6 +486,7 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
+         { "help",           no_argument,       NULL, 'h' },
+         { "daemonize",      no_argument,       NULL, 'D' },
+         { "kill",           no_argument,       NULL, 'k' },
++        { "loglevel",       required_argument, NULL, 'l' },
+         { "version",        no_argument,       NULL, 'V' },
+         { "file",           required_argument, NULL, 'f' },
+         { "reload",         no_argument,       NULL, 'r' },
+@@ -476,7 +504,7 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
+ 
+     assert(c);
+ 
+-    while ((o = getopt_long(argc, argv, "hDkVf:rcs", long_options, NULL)) >= 0) {
++    while ((o = getopt_long(argc, argv, "hDkl:Vf:rcs", long_options, NULL)) >= 0) {
+ 
+         switch(o) {
+             case 's':
+@@ -491,6 +519,13 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
+             case 'k':
+                 c->command = DAEMON_KILL;
+                 break;
++            case 'l':
++                c->log_level = log_level(optarg);
++		if (c->log_level == -1) {
++		    fprintf(stderr, "Invalid log level value\n");
++		    return -1;
++		}
++                break;
+             case 'V':
+                 c->command = DAEMON_VERSION;
+                 break;
+@@ -520,9 +555,6 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
+                 break;
+             case OPTION_DEBUG:
+                 c->debug = 1;
+-#ifdef DAEMON_SET_VERBOSITY_AVAILABLE
+-                daemon_set_verbosity(LOG_DEBUG);
+-#endif
+                 break;
+             default:
+                 return -1;
+@@ -1537,6 +1569,7 @@ int main(int argc, char *argv[]) {
+     config.publish_dns_servers = NULL;
+     config.publish_resolv_conf = 0;
+     config.use_syslog = 0;
++    config.log_level = LOG_INFO;
+     config.debug = 0;
+     config.rlimit_as_set = 0;
+     config.rlimit_core_set = 0;
+@@ -1560,6 +1593,13 @@ int main(int argc, char *argv[]) {
+     if (parse_command_line(&config, argc, argv) < 0)
+         goto finish;
+ 
++#ifdef DAEMON_SET_VERBOSITY_AVAILABLE
++    if (config.debug)
++	daemon_set_verbosity(LOG_DEBUG);
++    else
++	daemon_set_verbosity(config.log_level);
++#endif
++
+     if (config.modify_proc_title)
+         avahi_init_proc_title(argc, argv);
+ 
+-- 
+2.43.0
+

patches/libdaemon/0.14/0001-dlog-adjust-syslog-level-in-daemon_set_verbosity-too.patch

@@ -0,0 +1,29 @@
+From 7e7cd106613975c6c4ba25acbb698f15aa4d85e8 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 28 Nov 2024 06:38:12 +0100
+Subject: [PATCH] dlog: adjust syslog level in daemon_set_verbosity() too
+Organization: Addiva Elektronik
+
+Allow daemons to adjust not only their logging to stdout/stderr, but
+also what's sent to syslog as well.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ libdaemon/dlog.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libdaemon/dlog.c b/libdaemon/dlog.c
+index 3c759f4..d5c217a 100644
+--- a/libdaemon/dlog.c
++++ b/libdaemon/dlog.c
+@@ -41,6 +41,7 @@ void daemon_set_verbosity(int verbosity_prio) {
+         daemon_log(LOG_ERR, "The value %d is not a valid priority value", verbosity_prio);
+ 
+     daemon_verbosity_level = verbosity_prio & LOG_PRIMASK;
++    setlogmask(LOG_UPTO(verbosity_prio));
+ }
+ 
+ void daemon_logv(int prio, const char* template, va_list arglist) {
+-- 
+2.43.0
+

patches/linux/6.6.52/0001-net-phy-add-support-for-PHY-LEDs-polarity-modes.patch

@@ -1,8 +1,8 @@
 From 4be3e500b670f7b98e3dd6696b8e51e83f122c65 Mon Sep 17 00:00:00 2001
 From: Christian Marangi <ansuelsmth@gmail.com>
 Date: Thu, 25 Jan 2024 21:36:59 +0100
-Subject: [PATCH 01/34] net: phy: add support for PHY LEDs polarity modes
-Organization: Addiva Elektronik
+Subject: [PATCH 01/36] net: phy: add support for PHY LEDs polarity modes
+Organization: Wires
 
 Add support for PHY LEDs polarity modes. Some PHY require LED to be set
 to active low to be turned ON. Adds support for this by declaring
@@ -22,7 +22,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 Reviewed-by: Andrew Lunn <andrew@lunn.ch>
 Link: https://lore.kernel.org/r/20240125203702.4552-4-ansuelsmth@gmail.com
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/phy/phy_device.c | 16 ++++++++++++++++
  include/linux/phy.h          | 22 ++++++++++++++++++++++

patches/linux/6.6.52/0002-net-mvmdio-Support-setting-the-MDC-frequency-on-XSMI.patch

@@ -1,9 +1,9 @@
 From 4833b140cd11a57dd9f59754cdacfd71bc564c8f Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 4 Dec 2023 11:08:11 +0100
-Subject: [PATCH 02/34] net: mvmdio: Support setting the MDC frequency on XSMI
+Subject: [PATCH 02/36] net: mvmdio: Support setting the MDC frequency on XSMI
  controllers
-Organization: Addiva Elektronik
+Organization: Wires
 
 Support the standard "clock-frequency" attribute to set the generated
 MDC frequency. If not specified, the driver will leave the divisor
@@ -14,7 +14,6 @@ Reviewed-by: Andrew Lunn <andrew@lunn.ch>
 Tested-by: Andrew Lunn <andrew@lunn.ch>
 Link: https://lore.kernel.org/r/20231204100811.2708884-4-tobias@waldekranz.com
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  drivers/net/ethernet/marvell/mvmdio.c | 44 +++++++++++++++++++++++++++
  1 file changed, 44 insertions(+)

patches/linux/6.6.52/0003-net-dsa-mv88e6xxx-Create-API-to-read-a-single-stat-c.patch

@@ -1,9 +1,9 @@
 From 50a2973e8a520a82e9f9ec15a1f69e059ce7a334 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:23 +0100
-Subject: [PATCH 03/34] net: dsa: mv88e6xxx: Create API to read a single stat
+Subject: [PATCH 03/36] net: dsa: mv88e6xxx: Create API to read a single stat
  counter
-Organization: Addiva Elektronik
+Organization: Wires
 
 This change contains no functional change. We simply push the hardware
 specific stats logic to a function reading a single counter, rather
@@ -16,7 +16,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 162 ++++++++++++++++++-------------
  drivers/net/dsa/mv88e6xxx/chip.h |  27 +++---

patches/linux/6.6.52/0004-net-dsa-mv88e6xxx-Give-each-hw-stat-an-ID.patch

@@ -1,8 +1,8 @@
 From 5916503e23e7f85796c1f927747e66b9535bac53 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:25 +0100
-Subject: [PATCH 04/34] net: dsa: mv88e6xxx: Give each hw stat an ID
-Organization: Addiva Elektronik
+Subject: [PATCH 04/36] net: dsa: mv88e6xxx: Give each hw stat an ID
+Organization: Wires
 
 With the upcoming standard counter group support, we are no longer
 reading out the whole set of counters, but rather mapping a subset to
@@ -16,7 +16,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 138 +++++++++++++++++--------------
  1 file changed, 75 insertions(+), 63 deletions(-)

patches/linux/6.6.52/0005-net-dsa-mv88e6xxx-Add-eth-mac-counter-group-support.patch

@@ -1,9 +1,9 @@
 From 32dda6562734ec8ee667bc546f3ef56794d5bf82 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:26 +0100
-Subject: [PATCH 05/34] net: dsa: mv88e6xxx: Add "eth-mac" counter group
+Subject: [PATCH 05/36] net: dsa: mv88e6xxx: Add "eth-mac" counter group
  support
-Organization: Addiva Elektronik
+Organization: Wires
 
 Report the applicable subset of an mv88e6xxx port's counters using
 ethtool's standardized "eth-mac" counter group.
@@ -12,7 +12,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 39 ++++++++++++++++++++++++++++++++
  1 file changed, 39 insertions(+)

patches/linux/6.6.52/0006-net-dsa-mv88e6xxx-Limit-histogram-counters-to-ingres.patch

@@ -1,9 +1,9 @@
 From 36adbdd466ec550cab8b2ae54177f674c02cf631 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:27 +0100
-Subject: [PATCH 06/34] net: dsa: mv88e6xxx: Limit histogram counters to
+Subject: [PATCH 06/36] net: dsa: mv88e6xxx: Limit histogram counters to
  ingress traffic
-Organization: Addiva Elektronik
+Organization: Wires
 
 Chips in this family only have one set of histogram counters, which
 can be used to count ingressing and/or egressing traffic. mv88e6xxx
@@ -27,7 +27,6 @@ Reviewed-by: Andrew Lunn <andrew@lunn.ch>
 Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c    | 6 +++---
  drivers/net/dsa/mv88e6xxx/global1.c | 7 +++----

patches/linux/6.6.52/0007-net-dsa-mv88e6xxx-Add-rmon-counter-group-support.patch

@@ -1,8 +1,8 @@
 From abfa532c1149525b128b8c76d80965f55e208240 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:28 +0100
-Subject: [PATCH 07/34] net: dsa: mv88e6xxx: Add "rmon" counter group support
-Organization: Addiva Elektronik
+Subject: [PATCH 07/36] net: dsa: mv88e6xxx: Add "rmon" counter group support
+Organization: Wires
 
 Report the applicable subset of an mv88e6xxx port's counters using
 ethtool's standardized "rmon" counter group.
@@ -11,7 +11,6 @@ Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
 Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
 Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 42 ++++++++++++++++++++++++++++++++
  1 file changed, 42 insertions(+)

patches/linux/6.6.52/0009-net-dsa-mv88e6xxx-Add-LED-infrastructure.patch

@@ -1,13 +1,13 @@
 From 4407b94b4a08536fccb6eea2826955ff12d63ec2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
-Subject: [PATCH 09/34] net: dsa: mv88e6xxx: Add LED infrastructure
-Organization: Addiva Elektronik
+Subject: [PATCH 09/36] net: dsa: mv88e6xxx: Add LED infrastructure
+Organization: Wires
 
 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/Makefile |   1 +
  drivers/net/dsa/mv88e6xxx/chip.c   |   5 +-

patches/linux/6.6.52/0010-net-dsa-mv88e6xxx-Add-LED-support-for-6393X.patch

@@ -1,15 +1,15 @@
 From a5cf5c0353db07e74d7a29dd4d5c2cb7775d5bec Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
-Subject: [PATCH 10/34] net: dsa: mv88e6xxx: Add LED support for 6393X
-Organization: Addiva Elektronik
+Subject: [PATCH 10/36] net: dsa: mv88e6xxx: Add LED support for 6393X
+Organization: Wires
 
 Trigger support:
 - "none"
 - "timer"
 - "netdev"
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c |   1 +
  drivers/net/dsa/mv88e6xxx/leds.c | 226 +++++++++++++++++++++++++++++++

patches/linux/6.6.52/0011-net-dsa-mv88e6xxx-Fix-timeout-on-waiting-for-PPU-on-.patch

@@ -1,15 +1,15 @@
 From be94ec851dbb8e55c3f5e82f197b2dc59566aea2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
-Subject: [PATCH 11/34] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
+Subject: [PATCH 11/36] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
  6393X
-Organization: Addiva Elektronik
+Organization: Wires
 
 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
 register 0, bit 15). Therefore, increase the timeout threshold to 1s.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

patches/linux/6.6.52/0012-net-dsa-Support-MDB-memberships-whose-L2-addresses-o.patch

@@ -1,9 +1,9 @@
 From 69092f83541e6539ab82eec3052325c403675de4 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
-Subject: [PATCH 12/34] net: dsa: Support MDB memberships whose L2 addresses
+Subject: [PATCH 12/36] net: dsa: Support MDB memberships whose L2 addresses
  overlap
-Organization: Addiva Elektronik
+Organization: Wires
 
 Multiple IP multicast groups (32 for v4, 2^80 for v6) map to the same
 L2 address. This means that switchdev drivers may receive multiple MDB
@@ -30,7 +30,7 @@ needed to do this is already in place, since it is also needed on CPU
 and DSA ports. Thus, "implement" this by simply removing the guards
 which previously skipped reference countung on user ports.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  net/dsa/switch.c | 16 ----------------
  1 file changed, 16 deletions(-)

patches/linux/6.6.52/0013-net-phy-marvell10g-Support-firmware-loading-on-88X33.patch

@@ -1,9 +1,9 @@
 From 7c19df77212d0728874515e97cf297863a6ff2cd Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
-Subject: [PATCH 13/34] net: phy: marvell10g: Support firmware loading on
+Subject: [PATCH 13/36] net: phy: marvell10g: Support firmware loading on
  88X3310
-Organization: Addiva Elektronik
+Organization: Wires
 
 When probing, if a device is waiting for firmware to be loaded into
 its RAM, ask userspace for the binary and load it over XMDIO.
@@ -12,7 +12,7 @@ We have no choice but to bail out of the probe if firmware is not
 available, as the device does not have any built-in image on which to
 fall back.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/phy/marvell10g.c | 161 +++++++++++++++++++++++++++++++++++
  1 file changed, 161 insertions(+)

patches/linux/6.6.52/0014-net-phy-marvell10g-Fix-power-up-when-strapped-to-sta.patch

@@ -1,15 +1,15 @@
 From 0c34b42b7a72ddf1af6f3534870d647801e493fa Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
-Subject: [PATCH 14/34] net: phy: marvell10g: Fix power-up when strapped to
+Subject: [PATCH 14/36] net: phy: marvell10g: Fix power-up when strapped to
  start powered down
-Organization: Addiva Elektronik
+Organization: Wires
 
 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
 affected by this setting.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/phy/marvell10g.c | 18 +++++++++++++++---
  1 file changed, 15 insertions(+), 3 deletions(-)

patches/linux/6.6.52/0015-net-phy-marvell10g-Add-LED-support-for-88X3310.patch

@@ -1,8 +1,8 @@
 From 6576918d3348f8e20802379d568d7632228af4d7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
-Subject: [PATCH 15/34] net: phy: marvell10g: Add LED support for 88X3310
-Organization: Addiva Elektronik
+Subject: [PATCH 15/36] net: phy: marvell10g: Add LED support for 88X3310
+Organization: Wires
 
 Pickup the LEDs from the state in which the hardware reset or
 bootloader left them, but also support further configuration via
@@ -18,7 +18,7 @@ Trigger support:
 - "netdev": Offload link or duplex information to the solid behavior;
   	    tx and/or rx activity to blink behavior.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/phy/marvell10g.c | 422 +++++++++++++++++++++++++++++++++++
  1 file changed, 422 insertions(+)

patches/linux/6.6.52/0016-net-phy-marvell10g-Support-LEDs-tied-to-a-single-med.patch

@@ -1,9 +1,9 @@
 From 1ad7f010e46133c725df5cab4d85f71f689ca191 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
-Subject: [PATCH 16/34] net: phy: marvell10g: Support LEDs tied to a single
+Subject: [PATCH 16/36] net: phy: marvell10g: Support LEDs tied to a single
  media side
-Organization: Addiva Elektronik
+Organization: Wires
 
 In a combo-port setup, i.e. where both the copper and fiber interface
 are available to the user, the LEDs may be physically located either
@@ -15,7 +15,7 @@ the offloading of the "netdev" trigger, such that LEDs attached to the
 RJ45 jack only lights up when a copper link is established, and vice
 versa for the SFP cage.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/phy/marvell10g.c | 23 ++++++++++++++++++++++-
  1 file changed, 22 insertions(+), 1 deletion(-)

patches/linux/6.6.52/0017-nvmem-layouts-onie-tlv-Let-device-probe-even-when-TL.patch

@@ -1,9 +1,9 @@
 From 11b9a3e328241edede03b6615bb9b0f1a40b9b7d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
-Subject: [PATCH 17/34] nvmem: layouts: onie-tlv: Let device probe even when
+Subject: [PATCH 17/36] nvmem: layouts: onie-tlv: Let device probe even when
  TLV is invalid
-Organization: Addiva Elektronik
+Organization: Wires
 
 Before this change, probing an NVMEM device, expected to contain a
 valid TLV, would fail if it had not been provisioned yet. But an
@@ -14,7 +14,7 @@ be successfully probed.
 Therefore, settle for reporting data corruption issues in the log, and
 simply refrain from registering any cells in those cases.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/nvmem/layouts/onie-tlv.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)

patches/linux/6.6.52/0018-net-bridge-avoid-classifying-unknown-multicast-as-mr.patch

@@ -1,9 +1,9 @@
 From ce1148b5c2e33541ad13ff2c4769d0b37d4e42b9 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
-Subject: [PATCH 18/34] net: bridge: avoid classifying unknown multicast as
+Subject: [PATCH 18/36] net: bridge: avoid classifying unknown multicast as
  mrouters_only
-Organization: Addiva Elektronik
+Organization: Wires
 
 Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
 the per-port mcast_flood setting, as well as to detected and configured
@@ -16,6 +16,7 @@ Because a multicast router should always receive both known and unknown
 multicast.
 
 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  include/uapi/linux/if_bridge.h |  1 +
  net/bridge/br.c                |  5 +++++

patches/linux/6.6.52/0019-net-bridge-Ignore-router-ports-when-forwarding-L2-mu.patch

@@ -1,9 +1,9 @@
 From ce74ee8c5461cc53851ca323b4dfc9937cab0e41 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
-Subject: [PATCH 19/34] net: bridge: Ignore router ports when forwarding L2
+Subject: [PATCH 19/36] net: bridge: Ignore router ports when forwarding L2
  multicast
-Organization: Addiva Elektronik
+Organization: Wires
 
 Multicast router ports are either statically configured or learned from
 control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP

patches/linux/6.6.52/0020-net-dsa-Support-EtherType-based-priority-overrides.patch

@@ -1,10 +1,10 @@
 From 3c9b05198e0b7193f2dcddc1860cd77f0adbc3a2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
-Subject: [PATCH 20/34] net: dsa: Support EtherType based priority overrides
-Organization: Addiva Elektronik
+Subject: [PATCH 20/36] net: dsa: Support EtherType based priority overrides
+Organization: Wires
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  include/net/dsa.h |  4 ++++
  net/dsa/slave.c   | 56 +++++++++++++++++++++++++++++++++++++++++++++--

patches/linux/6.6.52/0021-net-dsa-mv88e6xxx-Support-EtherType-based-priority-o.patch

@@ -1,11 +1,11 @@
 From 333134a4ff2b8dd7fb00a75560254de96d1082ad Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
-Subject: [PATCH 21/34] net: dsa: mv88e6xxx: Support EtherType based priority
+Subject: [PATCH 21/36] net: dsa: mv88e6xxx: Support EtherType based priority
  overrides
-Organization: Addiva Elektronik
+Organization: Wires
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
  drivers/net/dsa/mv88e6xxx/chip.h    | 21 ++++++++++

patches/linux/6.6.52/0022-net-phy-Do-not-resume-PHY-when-attaching.patch

@@ -1,8 +1,8 @@
 From cdddc24c05cedc0d0fabc48da17ec26aeb7c1ef9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
-Subject: [PATCH 22/34] net: phy: Do not resume PHY when attaching
-Organization: Addiva Elektronik
+Subject: [PATCH 22/36] net: phy: Do not resume PHY when attaching
+Organization: Wires
 
 The PHY should not start negotiating with its link-partner until
 explicitly instructed to do so.
@@ -16,7 +16,7 @@ probing (e.g. DSA) would end up with a physical link being
 established, even though the corresponding interface was still
 administratively down.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/phy/phy_device.c | 1 -
  1 file changed, 1 deletion(-)

patches/linux/6.6.52/0023-net-dsa-mv88e6xxx-Improve-indirect-register-access-p.patch

@@ -1,9 +1,9 @@
 From 1ec21a3fc54fb447501fd7edbf692b00a31fe3ec Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
-Subject: [PATCH 23/34] net: dsa: mv88e6xxx: Improve indirect register access
+Subject: [PATCH 23/36] net: dsa: mv88e6xxx: Improve indirect register access
  perf on 6393
-Organization: Addiva Elektronik
+Organization: Wires
 
 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in
@@ -14,7 +14,7 @@ Therefore, add a new set of SMI operations which remaps accesses to
 such registers to the corresponding directly addressable register. All
 other accesses use the regular indirect interface.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c    |  7 +++
  drivers/net/dsa/mv88e6xxx/global1.h |  3 ++

patches/linux/6.6.52/0024-net-bridge-drop-delay-for-applying-strict-multicast-.patch

@@ -1,9 +1,9 @@
 From 5d7be493dcaa75ee69d521043062389d7772f8dc Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
-Subject: [PATCH 24/34] net: bridge: drop delay for applying strict multicast
+Subject: [PATCH 24/36] net: bridge: drop delay for applying strict multicast
  filtering
-Organization: Addiva Elektronik
+Organization: Wires
 
 This *local* patch drops the initial delay before applying strict multicast
 filtering, introduced in [1] and recently updated in [2].
@@ -19,6 +19,7 @@ A proper fix for upstreaming could be to add a knob to disable the delay.
 [2]: https://lore.kernel.org/netdev/20240127175033.9640-1-linus.luessing@c0d3.blue/
 
 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  net/bridge/br_multicast.c | 42 +++++++--------------------------------
  net/bridge/br_private.h   |  4 +---

patches/linux/6.6.52/0025-net-dsa-mv88e6xxx-Honor-ports-being-managed-via-in-b.patch

@@ -1,9 +1,9 @@
 From 492a824661dbc188b5abeb7434b5cf67c2016415 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
-Subject: [PATCH 25/34] net: dsa: mv88e6xxx: Honor ports being managed via
+Subject: [PATCH 25/36] net: dsa: mv88e6xxx: Honor ports being managed via
  in-band-status
-Organization: Addiva Elektronik
+Organization: Wires
 
 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC
@@ -14,7 +14,7 @@ This state is the default set up by mv88e6xxx_port_setup_mac(), so all
 we have to do is to make the phylink MAC callbacks no-ops in cases
 when in-band-status is being used.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++++
  1 file changed, 6 insertions(+)

patches/linux/6.6.52/0026-net-dsa-mv88e6xxx-Fix-port-policy-config-on-6393X.patch

@@ -1,8 +1,8 @@
 From c9c9597a47b00b720f5223c83ab05bb89481eda8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 21:35:26 +0200
-Subject: [PATCH 26/34] net: dsa: mv88e6xxx: Fix port policy config on 6393X
-Organization: Addiva Elektronik
+Subject: [PATCH 26/36] net: dsa: mv88e6xxx: Fix port policy config on 6393X
+Organization: Wires
 
 mv88e6393x_port_policy_{read,write} expect the `pointer` argument to
 be "pre-shifted" 8 bits.
@@ -16,7 +16,7 @@ never enabled on DSA ports, which broke standalone port isolation in
 multichip switch trees made up of 6393X decices.
 
 Fixes: 6584b26020fc ("net: dsa: mv88e6xxx: implement .port_set_policy for Amethyst")
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/port.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

patches/linux/6.6.52/0027-net-dsa-mv88e6xxx-Limit-rsvd2cpu-policy-to-user-port.patch

@@ -1,9 +1,9 @@
 From 4ff224b5f5de1347a1f686aa85cb918a7db18879 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
-Subject: [PATCH 27/34] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
+Subject: [PATCH 27/36] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
  ports on 6393X
-Organization: Addiva Elektronik
+Organization: Wires
 
 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as
@@ -30,7 +30,7 @@ switch would try to trap it back to the CPU. Given that the CPU is
 trusted, instead assume that it indeed meant for the packet to be
 forwarded like any other.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/port.c | 31 +++++++++++++++++++++++++------
  1 file changed, 25 insertions(+), 6 deletions(-)

patches/linux/6.6.52/0028-usb-core-adjust-log-level-for-unauthorized-devices.patch

@@ -1,14 +1,15 @@
 From f0d4beabe769fec594b309c3f1ebb79cfdbede8b Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 29 Apr 2024 15:14:51 +0200
-Subject: [PATCH 28/34] usb: core: adjust log level for unauthorized devices
-Organization: Addiva Elektronik
+Subject: [PATCH 28/36] usb: core: adjust log level for unauthorized devices
+Organization: Wires
 
 The fact that a USB device currently is not authorized is not an error,
 so let's adjust the log level so these messages slip below radar for the
 commonly used 'quiet' log level.
 
 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/usb/core/driver.c  | 4 ++--
  drivers/usb/core/generic.c | 2 +-

patches/linux/6.6.52/0029-net-dsa-mv88e6xxx-Grab-register-lock-during-counter-.patch

@@ -1,16 +1,16 @@
 From 5f96d718c850084504c53ec0b8d9fcf75ea9996c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 May 2024 13:50:58 +0200
-Subject: [PATCH 29/34] net: dsa: mv88e6xxx: Grab register lock during counter
+Subject: [PATCH 29/36] net: dsa: mv88e6xxx: Grab register lock during counter
  snapshotting
-Organization: Addiva Elektronik
+Organization: Wires
 
 This was missing for the standard counter groups. Since no caller
 already holds the lock, opt for pushing the locking down into
 mv88e6xxx_stats_snapshot() rather than having it duplicated at each
 call site.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 10 ++++++----
  1 file changed, 6 insertions(+), 4 deletions(-)

patches/linux/6.6.52/0030-net-bridge-Differentiate-MDB-additions-from-modifica.patch

@@ -1,9 +1,9 @@
 From 6d4c436335003259cc02a0f015fd3d1d54e988a2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
-Subject: [PATCH 30/34] net: bridge: Differentiate MDB additions from
+Subject: [PATCH 30/36] net: bridge: Differentiate MDB additions from
  modifications
-Organization: Addiva Elektronik
+Organization: Wires
 
 Before this change, the reception of an IGMPv3 report (and analogously
 for MLDv2) that adds a new group, would trigger two MDB RTM_NEWMDB
@@ -22,7 +22,7 @@ generated.
 Therefore, discriminate new groups from changes to existing groups by
 introducing a RTM_SETMDB events to be used in the latter scenario.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  include/uapi/linux/rtnetlink.h | 2 ++
  net/bridge/br_mdb.c            | 4 ++--

patches/linux/6.6.52/0031-net-dsa-tag_dsa-Use-tag-priority-as-initial-skb-prio.patch

@@ -1,9 +1,9 @@
 From c333c612688d5e974b95fcf4b04f185d7cf4f80d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
-Subject: [PATCH 31/34] net: dsa: tag_dsa: Use tag priority as initial
+Subject: [PATCH 31/36] net: dsa: tag_dsa: Use tag priority as initial
  skb->priority
-Organization: Addiva Elektronik
+Organization: Wires
 
 Use the 3-bit priority field from the DSA tag as the initial packet
 priority on ingress to the CPU.
@@ -20,7 +20,7 @@ can do with an "ingress-qos-map" on VLAN interfaces. Until that is
 implemented, support the setup that is likely to be the most common; a
 1:1 mapping from FPri to skb->priority.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  net/dsa/tag_dsa.c | 7 +++++++
  1 file changed, 7 insertions(+)

patches/linux/6.6.52/0032-net-dsa-mv88e6xxx-Add-mqprio-qdisc-support.patch

@@ -1,8 +1,8 @@
 From 18c025745fd8b8c9b3e688e9d78668a56cf71217 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
-Subject: [PATCH 32/34] net: dsa: mv88e6xxx: Add mqprio qdisc support
-Organization: Addiva Elektronik
+Subject: [PATCH 32/36] net: dsa: mv88e6xxx: Add mqprio qdisc support
+Organization: Wires
 
 Add support for attaching mqprio qdisc's to mv88e6xxx ports and use
 the packet's traffic class as the outgoing priority when no PCP bits
@@ -25,7 +25,7 @@ Since FPri is always a 3-bit field, even on older chips with only 4
 physical queues, always report 8 queues and let the chip's policy
 handle the mapping down to the "real" number.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 70 ++++++++++++++++++++++++++++++++
  net/dsa/tag_dsa.c                |  4 +-

patches/linux/6.6.52/0033-net-dsa-mv88e6xxx-Use-VLAN-prio-over-IP-when-both-ar.patch

@@ -1,9 +1,9 @@
 From f2d4ff12c7a0e644cbeac6675b755fb4a87b362a Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
-Subject: [PATCH 33/34] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
+Subject: [PATCH 33/36] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
  are available
-Organization: Addiva Elektronik
+Organization: Wires
 
 Switch the priority sourcing precdence to prefer VLAN PCP over IP
 DSCP, when both are available.
@@ -23,7 +23,7 @@ main reasons for choosing the new default:
    core over trusted VLAN trunks, the packet should keep its original
    priority, independent of what inner protocol fields may indicate.
 
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/chip.c | 11 ++++++++---
  1 file changed, 8 insertions(+), 3 deletions(-)

patches/linux/6.6.52/0034-net-dsa-mb88e6xxx-use-EOPNOTSUPP-for-unsupported-fla.patch

@@ -1,9 +1,9 @@
 From ceaaa4f44f9b3ec82c4e0a24c2322aae58fa3aa0 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Wed, 6 Nov 2024 15:39:33 +0100
-Subject: [PATCH 34/34] net: dsa: mb88e6xxx: use EOPNOTSUPP for unsupported
+Subject: [PATCH 34/36] net: dsa: mb88e6xxx: use EOPNOTSUPP for unsupported
  flags
-Organization: Addiva Elektronik
+Organization: Wires
 
 Make sure to return correct error code for unsupported flags, and
 propagate any error.
@@ -11,6 +11,7 @@ propagate any error.
 Follow-up to a5cf5c0
 
 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
  drivers/net/dsa/mv88e6xxx/leds.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)

patches/linux/6.6.52/0035-net-dsa-mv88e6xxx-Trap-locally-terminated-VLANs.patch

@@ -0,0 +1,160 @@
+From ab93e65511ee508d1b637e4ad0dc6dcddd2c48dc Mon Sep 17 00:00:00 2001
+From: Tobias Waldekranz <tobias@waldekranz.com>
+Date: Tue, 26 Nov 2024 19:45:59 +0100
+Subject: [PATCH 35/36] net: dsa: mv88e6xxx: Trap locally terminated VLANs
+Organization: Wires
+
+Before this change, in a setup like the following, packets assigned to
+VLAN 10 were forwarded between the switch ports, even though the
+configuration dictates that they should only be locally terminated.
+
+ip link add dev br0 up type bridge vlan_filtering 1
+ip link set dev swp1 master br0
+ip link set dev swp2 master br0
+ip link add dev swp1.10 link swp1 up type vlan id 10
+ip link add dev swp2.10 link swp2 up type vlan id 10
+
+swp1.10  br0  swp2.10
+      \ /   \ /
+      swp1  swp2
+
+Therefore, make sure that VLANs that are added to the VTU to terminate
+a VLAN upper interface, rather than to offload bridge VLANs, are
+marked as policy entries. As the VTU policy of user ports is already
+set to TRAP (to ensure proper standalone port operation), this will
+cause all packets assigned to these VLANs to properly terminated.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 33 ++++++++++++++++++--------------
+ include/net/switchdev.h          |  4 ++++
+ net/dsa/slave.c                  |  4 ++++
+ 3 files changed, 27 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 305abb33b0c6..259eec1a3a1d 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2610,7 +2610,7 @@ static int mv88e6xxx_port_broadcast_sync(struct mv88e6xxx_chip *chip, int port,
+ }
+ 
+ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
+-				    u16 vid, u8 member, bool warn)
++				    u16 vid, u8 member, bool warn, bool policy)
+ {
+ 	const u8 non_member = MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_NON_MEMBER;
+ 	struct mv88e6xxx_vtu_entry vlan;
+@@ -2622,9 +2622,7 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
+ 
+ 	if (!vlan.valid) {
+ 		memset(&vlan, 0, sizeof(vlan));
+-
+-		if (vid == MV88E6XXX_VID_STANDALONE)
+-			vlan.policy = true;
++		vlan.policy = policy;
+ 
+ 		err = mv88e6xxx_atu_new(chip, &vlan.fid);
+ 		if (err)
+@@ -2647,6 +2645,9 @@ static int mv88e6xxx_port_vlan_join(struct mv88e6xxx_chip *chip, int port,
+ 		if (err)
+ 			return err;
+ 	} else if (vlan.member[port] != member) {
++		if (vlan.policy != policy)
++			return -EBUSY;
++
+ 		vlan.member[port] = member;
+ 
+ 		err = mv88e6xxx_vtu_loadpurge(chip, &vlan);
+@@ -2693,7 +2694,8 @@ static int mv88e6xxx_port_vlan_add(struct dsa_switch *ds, int port,
+ 
+ 	mv88e6xxx_reg_lock(chip);
+ 
+-	err = mv88e6xxx_port_vlan_join(chip, port, vlan->vid, member, warn);
++	err = mv88e6xxx_port_vlan_join(chip, port, vlan->vid, member, warn,
++				       vlan->from_upper);
+ 	if (err) {
+ 		dev_err(ds->dev, "p%d: failed to add VLAN %d%c\n", port,
+ 			vlan->vid, untagged ? 'u' : 't');
+@@ -3433,14 +3435,17 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ 	if (err)
+ 		return err;
+ 
+-	/* On chips that support it, set all downstream DSA ports'
+-	 * VLAN policy to TRAP. In combination with loading
+-	 * MV88E6XXX_VID_STANDALONE as a policy entry in the VTU, this
+-	 * provides a better isolation barrier between standalone
+-	 * ports, as the ATU is bypassed on any intermediate switches
+-	 * between the incoming port and the CPU.
++	/* On chips that support it, set all downstream DSA and user
++	 * ports' VLAN policy to TRAP. for downstream DSA ports, in
++	 * combination with loading MV88E6XXX_VID_STANDALONE as a
++	 * policy entry in the VTU, this provides a better isolation
++	 * barrier between standalone ports, as the ATU is bypassed on
++	 * any intermediate switches between the incoming port and the
++	 * CPU. On user ports we need it to support stacked VLAN
++	 * uppers on ports that are simultaneously attached to a VLAN
++	 * filtering bridge.
+ 	 */
+-	if (dsa_is_downstream_port(ds, port) &&
++	if ((dsa_is_downstream_port(ds, port) || dsa_is_user_port(ds, port)) &&
+ 	    chip->info->ops->port_set_policy) {
+ 		err = chip->info->ops->port_set_policy(chip, port,
+ 						MV88E6XXX_POLICY_MAPPING_VTU,
+@@ -3470,7 +3475,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ 	 */
+ 	err = mv88e6xxx_port_vlan_join(chip, port, MV88E6XXX_VID_STANDALONE,
+ 				       MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_UNMODIFIED,
+-				       false);
++				       false, true);
+ 	if (err)
+ 		return err;
+ 
+@@ -3484,7 +3489,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ 	 */
+ 	err = mv88e6xxx_port_vlan_join(chip, port, MV88E6XXX_VID_BRIDGED,
+ 				       MV88E6XXX_G1_VTU_DATA_MEMBER_TAG_UNMODIFIED,
+-				       false);
++				       false, false);
+ 	if (err)
+ 		return err;
+ 
+diff --git a/include/net/switchdev.h b/include/net/switchdev.h
+index 8346b0d29542..764cd3dd4645 100644
+--- a/include/net/switchdev.h
++++ b/include/net/switchdev.h
+@@ -104,6 +104,10 @@ struct switchdev_obj_port_vlan {
+ 	 * Entries with BRIDGE_VLAN_INFO_BRENTRY unset are not notified at all.
+ 	 */
+ 	bool changed;
++
++	/* If set, this VLAN object stems from an upper interface
++	 * being stacked on/removed from the original device. */
++	bool from_upper;
+ };
+ 
+ #define SWITCHDEV_OBJ_PORT_VLAN(OBJ) \
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index 18d913bcd180..b45c2ac1f1f0 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1762,6 +1762,8 @@ static int dsa_slave_vlan_rx_add_vid(struct net_device *dev, __be16 proto,
+ 		.vid = vid,
+ 		/* This API only allows programming tagged, non-PVID VIDs */
+ 		.flags = 0,
++
++		.from_upper = true,
+ 	};
+ 	struct netlink_ext_ack extack = {0};
+ 	struct dsa_switch *ds = dp->ds;
+@@ -1836,6 +1838,8 @@ static int dsa_slave_vlan_rx_kill_vid(struct net_device *dev, __be16 proto,
+ 		.vid = vid,
+ 		/* This API only allows programming tagged, non-PVID VIDs */
+ 		.flags = 0,
++
++		.from_upper = true,
+ 	};
+ 	struct dsa_switch *ds = dp->ds;
+ 	struct netdev_hw_addr *ha;
+-- 
+2.43.0
+

patches/linux/6.6.52/0036-net-mvpp2-Prevent-parser-TCAM-memory-corruption.patch

@@ -0,0 +1,575 @@
+From 1527d6234666b2d275edaa9662f222214e030c41 Mon Sep 17 00:00:00 2001
+From: Tobias Waldekranz <tobias@waldekranz.com>
+Date: Tue, 18 Mar 2025 10:55:09 +0100
+Subject: [PATCH 36/36] net: mvpp2: Prevent parser TCAM memory corruption
+Organization: Wires
+
+Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM
+information, from concurrent modifications.
+
+Both the TCAM and SRAM tables are indirectly accessed by configuring
+an index register that selects the row to read or write to. This means
+that operations must be atomic in order to, e.g., avoid spreading
+writes across multiple rows. Since the shadow SRAM array is used to
+find free rows in the hardware table, it must also be protected in
+order to avoid TOCTOU errors where multiple cores allocate the same
+row.
+
+This issue was detected in a situation where `mvpp2_set_rx_mode()` ran
+concurrently on two CPUs. In this particular case the
+MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the
+classifier unit to drop all incoming unicast - indicated by the
+`rx_classifier_drops` counter.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2.h    |   3 +-
+ .../net/ethernet/marvell/mvpp2/mvpp2_main.c   |   3 +-
+ .../net/ethernet/marvell/mvpp2/mvpp2_prs.c    | 146 ++++++++++++++----
+ 3 files changed, 118 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+index e809f91c08fb..d980b8799d95 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+@@ -1106,8 +1106,9 @@ struct mvpp2 {
+ 	/* Global TX Flow Control config */
+ 	bool global_tx_fc;
+ 
+-	/* Spinlocks for CM3 shared memory configuration */
++	/* Spinlocks for shared packet processor functional units */
+ 	spinlock_t mss_spinlock;
++	spinlock_t prs_spinlock;
+ };
+ 
+ struct mvpp2_pcpu_stats {
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 34051c9abd97..0e69faedbf97 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -7615,8 +7615,9 @@ static int mvpp2_probe(struct platform_device *pdev)
+ 	if (mvpp2_read(priv, MVPP2_VER_ID_REG) == MVPP2_VER_PP23)
+ 		priv->hw_version = MVPP23;
+ 
+-	/* Init mss lock */
++	/* Init shared packet processor functional unit locks */
+ 	spin_lock_init(&priv->mss_spinlock);
++	spin_lock_init(&priv->prs_spinlock);
+ 
+ 	/* Initialize network controller */
+ 	err = mvpp2_init(pdev, priv);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index 9af22f497a40..aa834153d99f 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -43,8 +43,8 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe)
+ }
+ 
+ /* Initialize tcam entry from hw */
+-int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
+-			   int tid)
++static int mvpp2_prs_init_from_hw_unlocked(struct mvpp2 *priv,
++					   struct mvpp2_prs_entry *pe, int tid)
+ {
+ 	int i;
+ 
+@@ -73,6 +73,19 @@ int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
+ 	return 0;
+ }
+ 
++int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
++			   int tid)
++{
++	unsigned long flags;
++	int err;
++
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++	err = mvpp2_prs_init_from_hw_unlocked(priv, pe, tid);
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
++
++	return err;
++}
++
+ /* Invalidate tcam hw entry */
+ static void mvpp2_prs_hw_inv(struct mvpp2 *priv, int index)
+ {
+@@ -374,7 +387,7 @@ static int mvpp2_prs_flow_find(struct mvpp2 *priv, int flow)
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_FLOWS)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 		bits = mvpp2_prs_sram_ai_get(&pe);
+ 
+ 		/* Sram store classification lookup ID in AI bits [5:0] */
+@@ -441,7 +454,7 @@ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ 
+ 	if (priv->prs_shadow[MVPP2_PE_DROP_ALL].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, MVPP2_PE_DROP_ALL);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, MVPP2_PE_DROP_ALL);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -474,9 +487,12 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+ {
+ 	struct mvpp2_prs_entry pe;
+ 	unsigned char cast_match;
++	unsigned long flags;
+ 	unsigned int ri;
+ 	int tid;
+ 
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++
+ 	if (l2_cast == MVPP2_PRS_L2_UNI_CAST) {
+ 		cast_match = MVPP2_PRS_UCAST_VAL;
+ 		tid = MVPP2_PE_MAC_UC_PROMISCUOUS;
+@@ -489,7 +505,7 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+ 
+ 	/* promiscuous mode - Accept unknown unicast or multicast packets */
+ 	if (priv->prs_shadow[tid].valid) {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	} else {
+ 		memset(&pe, 0, sizeof(pe));
+ 		mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
+@@ -520,6 +536,8 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+ 	mvpp2_prs_tcam_port_set(&pe, port, add);
+ 
+ 	mvpp2_prs_hw_write(priv, &pe);
++
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ }
+ 
+ /* Set entry for dsa packets */
+@@ -539,7 +557,7 @@ static void mvpp2_prs_dsa_tag_set(struct mvpp2 *priv, int port, bool add,
+ 
+ 	if (priv->prs_shadow[tid].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -610,7 +628,7 @@ static void mvpp2_prs_dsa_tag_ethertype_set(struct mvpp2 *priv, int port,
+ 
+ 	if (priv->prs_shadow[tid].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -673,7 +691,7 @@ static int mvpp2_prs_vlan_find(struct mvpp2 *priv, unsigned short tpid, int ai)
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 		match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid);
+ 		if (!match)
+ 			continue;
+@@ -726,7 +744,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
+ 			    priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN)
+ 				continue;
+ 
+-			mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
++			mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid_aux);
+ 			ri_bits = mvpp2_prs_sram_ri_get(&pe);
+ 			if ((ri_bits & MVPP2_PRS_RI_VLAN_MASK) ==
+ 			    MVPP2_PRS_RI_VLAN_DOUBLE)
+@@ -760,7 +778,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
+ 
+ 		mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 	/* Update ports' mask */
+ 	mvpp2_prs_tcam_port_map_set(&pe, port_map);
+@@ -800,7 +818,7 @@ static int mvpp2_prs_double_vlan_find(struct mvpp2 *priv, unsigned short tpid1,
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 
+ 		match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid1) &&
+ 			mvpp2_prs_tcam_data_cmp(&pe, 4, tpid2);
+@@ -849,7 +867,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
+ 			    priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN)
+ 				continue;
+ 
+-			mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
++			mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid_aux);
+ 			ri_bits = mvpp2_prs_sram_ri_get(&pe);
+ 			ri_bits &= MVPP2_PRS_RI_VLAN_MASK;
+ 			if (ri_bits == MVPP2_PRS_RI_VLAN_SINGLE ||
+@@ -880,7 +898,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
+ 
+ 		mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 
+ 	/* Update ports' mask */
+@@ -1941,7 +1959,7 @@ static int mvpp2_prs_vid_range_find(struct mvpp2_port *port, u16 vid, u16 mask)
+ 		    port->priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(port->priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(port->priv, &pe, tid);
+ 
+ 		mvpp2_prs_tcam_data_byte_get(&pe, 2, &byte[0], &enable[0]);
+ 		mvpp2_prs_tcam_data_byte_get(&pe, 3, &byte[1], &enable[1]);
+@@ -1966,10 +1984,13 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 	unsigned int mask = 0xfff, reg_val, shift;
+ 	struct mvpp2 *priv = port->priv;
+ 	struct mvpp2_prs_entry pe;
++	unsigned long flags;
+ 	int tid;
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++
+ 	/* Scan TCAM and see if entry with this <vid,port> already exist */
+ 	tid = mvpp2_prs_vid_range_find(port, vid, mask);
+ 
+@@ -1988,8 +2009,10 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 						MVPP2_PRS_VLAN_FILT_MAX_ENTRY);
+ 
+ 		/* There isn't room for a new VID filter */
+-		if (tid < 0)
++		if (tid < 0) {
++			spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 			return tid;
++		}
+ 
+ 		mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_VID);
+ 		pe.index = tid;
+@@ -1997,7 +2020,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 		/* Mask all ports */
+ 		mvpp2_prs_tcam_port_map_set(&pe, 0);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 
+ 	/* Enable the current port */
+@@ -2019,6 +2042,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID);
+ 	mvpp2_prs_hw_write(priv, &pe);
+ 
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 	return 0;
+ }
+ 
+@@ -2026,25 +2050,30 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ void mvpp2_prs_vid_entry_remove(struct mvpp2_port *port, u16 vid)
+ {
+ 	struct mvpp2 *priv = port->priv;
++	unsigned long flags;
+ 	int tid;
+ 
+-	/* Scan TCAM and see if entry with this <vid,port> already exist */
+-	tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
+ 
+-	/* No such entry */
+-	if (tid < 0)
+-		return;
++	/* Invalidate TCAM entry with this <vid,port>, if it exists */
++	tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
++	if (tid >= 0) {
++		mvpp2_prs_hw_inv(priv, tid);
++		priv->prs_shadow[tid].valid = false;
++	}
+ 
+-	mvpp2_prs_hw_inv(priv, tid);
+-	priv->prs_shadow[tid].valid = false;
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ }
+ 
+ /* Remove all existing VID filters on this port */
+ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port)
+ {
+ 	struct mvpp2 *priv = port->priv;
++	unsigned long flags;
+ 	int tid;
+ 
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++
+ 	for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id);
+ 	     tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) {
+ 		if (priv->prs_shadow[tid].valid) {
+@@ -2052,6 +2081,8 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port)
+ 			priv->prs_shadow[tid].valid = false;
+ 		}
+ 	}
++
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ }
+ 
+ /* Remove VID filering entry for this port */
+@@ -2059,11 +2090,16 @@ void mvpp2_prs_vid_disable_filtering(struct mvpp2_port *port)
+ {
+ 	unsigned int tid = MVPP2_PRS_VID_PORT_DFLT(port->id);
+ 	struct mvpp2 *priv = port->priv;
++	unsigned long flags;
++
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
+ 
+ 	/* Invalidate the guard entry */
+ 	mvpp2_prs_hw_inv(priv, tid);
+ 
+ 	priv->prs_shadow[tid].valid = false;
++
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ }
+ 
+ /* Add guard entry that drops packets when no VID is matched on this port */
+@@ -2073,12 +2109,15 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port)
+ 	struct mvpp2 *priv = port->priv;
+ 	unsigned int reg_val, shift;
+ 	struct mvpp2_prs_entry pe;
++	unsigned long flags;
+ 
+ 	if (priv->prs_shadow[tid].valid)
+ 		return;
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++
+ 	pe.index = tid;
+ 
+ 	reg_val = mvpp2_read(priv, MVPP2_MH_REG(port->id));
+@@ -2111,6 +2150,8 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port)
+ 	/* Update shadow table */
+ 	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID);
+ 	mvpp2_prs_hw_write(priv, &pe);
++
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ }
+ 
+ /* Parser default initialization */
+@@ -2217,7 +2258,7 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
+ 		    (priv->prs_shadow[tid].udf != udf_type))
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 		entry_pmap = mvpp2_prs_tcam_port_map_get(&pe);
+ 
+ 		if (mvpp2_prs_mac_range_equals(&pe, da, mask) &&
+@@ -2229,7 +2270,8 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
+ }
+ 
+ /* Update parser's mac da entry */
+-int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
++static int mvpp2_prs_mac_da_accept_unlocked(struct mvpp2_port *port,
++					    const u8 *da, bool add)
+ {
+ 	unsigned char mask[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+ 	struct mvpp2 *priv = port->priv;
+@@ -2261,7 +2303,7 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+ 		/* Mask all ports */
+ 		mvpp2_prs_tcam_port_map_set(&pe, 0);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 
+ 	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
+@@ -2317,6 +2359,18 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+ 	return 0;
+ }
+ 
++int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
++{
++	unsigned long flags;
++	int err;
++
++	spin_lock_irqsave(&port->priv->prs_spinlock, flags);
++	err = mvpp2_prs_mac_da_accept_unlocked(port, da, add);
++	spin_unlock_irqrestore(&port->priv->prs_spinlock, flags);
++
++	return err;
++}
++
+ int mvpp2_prs_update_mac_da(struct net_device *dev, const u8 *da)
+ {
+ 	struct mvpp2_port *port = netdev_priv(dev);
+@@ -2342,9 +2396,11 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ {
+ 	struct mvpp2 *priv = port->priv;
+ 	struct mvpp2_prs_entry pe;
+-	unsigned long pmap;
++	unsigned long flags, pmap;
+ 	int index, tid;
+ 
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++
+ 	for (tid = MVPP2_PE_MAC_RANGE_START;
+ 	     tid <= MVPP2_PE_MAC_RANGE_END; tid++) {
+ 		unsigned char da[ETH_ALEN], da_mask[ETH_ALEN];
+@@ -2354,7 +2410,7 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 		    (priv->prs_shadow[tid].udf != MVPP2_PRS_UDF_MAC_DEF))
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 
+ 		pmap = mvpp2_prs_tcam_port_map_get(&pe);
+ 
+@@ -2375,14 +2431,19 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 			continue;
+ 
+ 		/* Remove entry from TCAM */
+-		mvpp2_prs_mac_da_accept(port, da, false);
++		mvpp2_prs_mac_da_accept_unlocked(port, da, false);
+ 	}
++
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ }
+ 
+ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ {
++	unsigned long flags;
++
+ 	switch (type) {
+ 	case MVPP2_TAG_TYPE_EDSA:
++		spin_lock_irqsave(&priv->prs_spinlock, flags);
+ 		/* Add port to EDSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, true,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+@@ -2393,9 +2454,11 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_DSA);
++		spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 		break;
+ 
+ 	case MVPP2_TAG_TYPE_DSA:
++		spin_lock_irqsave(&priv->prs_spinlock, flags);
+ 		/* Add port to DSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, true,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+@@ -2406,10 +2469,12 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA);
++		spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 		break;
+ 
+ 	case MVPP2_TAG_TYPE_MH:
+ 	case MVPP2_TAG_TYPE_NONE:
++		spin_lock_irqsave(&priv->prs_spinlock, flags);
+ 		/* Remove port form EDSA and DSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+@@ -2419,6 +2484,7 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA);
++		spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 		break;
+ 
+ 	default:
+@@ -2433,15 +2499,20 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask)
+ {
+ 	struct mvpp2_prs_entry pe;
+ 	u8 *ri_byte, *ri_byte_mask;
++	unsigned long flags;
+ 	int tid, i;
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++
+ 	tid = mvpp2_prs_tcam_first_free(priv,
+ 					MVPP2_PE_LAST_FREE_TID,
+ 					MVPP2_PE_FIRST_FREE_TID);
+-	if (tid < 0)
++	if (tid < 0) {
++		spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 		return tid;
++	}
+ 
+ 	pe.index = tid;
+ 
+@@ -2461,6 +2532,7 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask)
+ 	mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK);
+ 	mvpp2_prs_hw_write(priv, &pe);
+ 
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 	return 0;
+ }
+ 
+@@ -2468,10 +2540,13 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask)
+ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ {
+ 	struct mvpp2_prs_entry pe;
++	unsigned long flags;
+ 	int tid;
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_irqsave(&port->priv->prs_spinlock, flags);
++
+ 	tid = mvpp2_prs_flow_find(port->priv, port->id);
+ 
+ 	/* Such entry not exist */
+@@ -2480,8 +2555,10 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 		tid = mvpp2_prs_tcam_first_free(port->priv,
+ 						MVPP2_PE_LAST_FREE_TID,
+ 					       MVPP2_PE_FIRST_FREE_TID);
+-		if (tid < 0)
++		if (tid < 0) {
++			spin_unlock_irqrestore(&port->priv->prs_spinlock, flags);
+ 			return tid;
++		}
+ 
+ 		pe.index = tid;
+ 
+@@ -2492,28 +2569,33 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 		/* Update shadow table */
+ 		mvpp2_prs_shadow_set(port->priv, pe.index, MVPP2_PRS_LU_FLOWS);
+ 	} else {
+-		mvpp2_prs_init_from_hw(port->priv, &pe, tid);
++		mvpp2_prs_init_from_hw_unlocked(port->priv, &pe, tid);
+ 	}
+ 
+ 	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_FLOWS);
+ 	mvpp2_prs_tcam_port_map_set(&pe, (1 << port->id));
+ 	mvpp2_prs_hw_write(port->priv, &pe);
+ 
++	spin_unlock_irqrestore(&port->priv->prs_spinlock, flags);
+ 	return 0;
+ }
+ 
+ int mvpp2_prs_hits(struct mvpp2 *priv, int index)
+ {
++	unsigned long flags;
+ 	u32 val;
+ 
+ 	if (index > MVPP2_PRS_TCAM_SRAM_SIZE)
+ 		return -EINVAL;
+ 
++	spin_lock_irqsave(&priv->prs_spinlock, flags);
++
+ 	mvpp2_write(priv, MVPP2_PRS_TCAM_HIT_IDX_REG, index);
+ 
+ 	val = mvpp2_read(priv, MVPP2_PRS_TCAM_HIT_CNT_REG);
+ 
+ 	val &= MVPP2_PRS_TCAM_HIT_CNT_MASK;
+ 
++	spin_unlock_irqrestore(&priv->prs_spinlock, flags);
+ 	return val;
+ }
+-- 
+2.43.0
+

patches/podman/4.5.0/0001-disable-pull-retry.patch

@@ -1,10 +1,11 @@
-This patch disables the default "podman pull" retry value, which otherwise
-blocks execd from trying other jobs in its queue.
+This patch disables the default "podman pull" retry value, which is not
+used by Infix.  Instead, the container wrapper script retries on network
+related changes, or every 60 seconds.
 
-As of podman v5.0.0 a --retry=NUM has been added to the podman create, run,
-and pull commands.  However, CNI is no longer supported, and a lot of other
-breaking changes have been made, e.g., output of podman inspect.  So there's
-a lot of work upgrading.
+As of podman v5.0.0 a '--retry=NUM' has been added to the podman create,
+run, and pull commands.  However, CNI is no longer supported, and a lot
+of other breaking changes have been made, eg., output of podman inspect.
+So there's a lot of work to upgrade.
 
    -- Joachim
 

src/confd/src/core.c

@@ -66,8 +66,14 @@ int core_post_hook(sr_session_ctx_t *session, uint32_t sub_id, const char *modul
 		num_changes = 0;
 		return SR_ERR_OK;
 	case SR_EV_DONE:
+		if (num_changes <= 0) {
+			ERROR("BUG in core_post_hook(): callback tracking out of sync");
+			abort();
+		}
+
 		if (--num_changes == 0)
 			break;
+
 		return SR_ERR_OK;
 	default:
 		ERROR("core_post_hook() should not be called with event %s", ev2str(event));

src/confd/src/ietf-interfaces.c

@@ -1821,7 +1821,8 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net
 	      (op == LYDX_OP_NONE) ? "mod" : ((op == LYDX_OP_CREATE) ? "add" : "del"));
 
 	if (op == LYDX_OP_DELETE) {
-		err = netdag_gen_iface_del(net, dif, cif, fixed);
+		err  = netdag_gen_iface_del(net, dif, cif, fixed);
+		err += netdag_gen_ipv4_autoconf(net, cif, dif);
 		goto err;
 	}
 

src/confd/src/infix-containers.c

@@ -22,17 +22,25 @@
 
 #define  _PATH_CONT   "/run/containers"
 #define  _PATH_INBOX  _PATH_CONT "/INBOX"
-#define  _PATH_QUEUE  _PATH_CONT "/queue"
 
 
 static int add(const char *name, struct lyd_node *cif)
 {
-	const char *image = lydx_get_cattr(cif, "image");
 	const char *restart_policy, *string;
 	struct lyd_node *node, *nets, *caps;
 	char script[strlen(name) + 5];
 	FILE *fp, *ap;
 
+	/*
+	 * If running already, disable the service, keeping the created
+	 * container and any volumes for later if the user re-enables
+	 * it again.
+	 */
+	if (!lydx_is_enabled(cif, "enabled")) {
+		systemf("initctl -bnq disable container@%s.conf", name);
+		return 0;
+	}
+
 	snprintf(script, sizeof(script), "%s.sh", name);
 	fp = fopenf("w", "%s/%s", _PATH_CONT, script);
 	if (!fp) {
@@ -40,11 +48,15 @@ static int add(const char *name, struct lyd_node *cif)
 		return SR_ERR_SYS;
 	}
 
-	/* Stop any running container gracefully so it releases its IP addresses. */
+	/*
+	 * Create /run/containers/<NAME>.sh it is used both for initial
+	 * setup at creation/boot and for manual upgrade.  The delete
+	 * command ensures any already running container is stopped and
+	 * deleted so that it releases all claimed resources.
+	 */
 	fprintf(fp, "#!/bin/sh\n"
-		"container --quiet stop %s   >/dev/null\n" /* Silence "not running" on upgrade */
-		"container --quiet delete %s >/dev/null\n" /* Silence any hashes when deleting */
-		"container --quiet", name, name);
+		"container --quiet delete %s >/dev/null\n"
+		"container --quiet", name);
 
 	LYX_LIST_FOR_EACH(lyd_child(cif), node, "dns")
 		fprintf(fp, " --dns %s", lyd_get_value(node));
@@ -185,61 +197,33 @@ static int add(const char *name, struct lyd_node *cif)
 			fprintf(fp, " --checksum sha512:%s", string);
 	}
 
-	fprintf(fp, " create %s %s", name, image);
+	fprintf(fp, " create %s %s", name, lydx_get_cattr(cif, "image"));
 
  	if ((string = lydx_get_cattr(cif, "command")))
 		fprintf(fp, " %s", string);
 
 	fprintf(fp, "\n");
-
-	if (lydx_is_enabled(cif, "manual"))
-		fprintf(fp, "initctl -bnq cond set container:%s\n", name);
-
 	fchmod(fileno(fp), 0700);
 	fclose(fp);
 
+	/* Enable, or update, container -- both trigger setup script. */
 	systemf("initctl -bnq enable container@%s.conf", name);
-
-	/*
-	 * All start scripts must wait for the rest of confd to complete
-	 * before being enqueued to execd, so we postpone it using this
-	 * "inbox" to the post hook.
-	 */
-	writesf(script, "a", "%s", _PATH_INBOX);
+	systemf("initctl -bnq touch container@%s.conf", name);
 
 	return 0;
 }
 
 static int del(const char *name)
 {
-	char fn[strlen(_PATH_QUEUE) + strlen(name) + 10];
-	FILE *fp;
+	char fn[strlen(_PATH_CONT) + strlen(name) + 10];
 
-	/* Remove any pending download/create job first */
-	snprintf(fn, sizeof(fn), "%s/S01-%s.sh", _PATH_QUEUE, name);
-	erase(fn);
-
-	/* Remove container script itself */
+	/* Remove container setup script */
 	snprintf(fn, sizeof(fn), "%s/%s.sh", _PATH_CONT, name);
 	erase(fn);
 
-	/* Disable service and schedule for deletion. */
-	systemf("initctl -bnq disable container@%s.conf", name);
-
-	snprintf(fn, sizeof(fn), "%s/K01-%s.sh", _PATH_CONT, name);
-	fp = fopen(fn, "w");
-	if (!fp) {
-		ERRNO("Failed creating container stop script %s", fn);
-		return SR_ERR_SYS;
-	}
-
-	fprintf(fp, "#!/bin/sh\n"
-		"container delete %s\n", name);
-	fchmod(fileno(fp), 0700);
-	fclose(fp);
-
-	/* Enqueue kill job immediately on execd */
-	movefile(fn, _PATH_QUEUE);
+	/* Stop and schedule for deletion */
+	systemf("initctl -bnq stop container:%s", name);
+	writesf(name, "a", "%s", _PATH_INBOX);
 
 	return SR_ERR_OK;
 }
@@ -281,15 +265,10 @@ static int change(sr_session_ctx_t *session, uint32_t sub_id, const char *module
 		}
 
 		LYX_LIST_FOR_EACH(cifs, cif, "container") {
-			const char *nm = lydx_get_cattr(cif, "name");
-
-			if (strcmp(name, nm))
+			if (strcmp(name, lydx_get_cattr(cif, "name")))
 				continue;
 
-			if (!lydx_is_enabled(cif, "enabled"))
-				del(name);
-			else
-				add(name, cif);
+			add(name, cif);
 			break;
 		}
 	}
@@ -364,34 +343,24 @@ static int oci_load(sr_session_ctx_t *session, uint32_t sub_id, const char *xpat
  */
 void infix_containers_post_hook(sr_session_ctx_t *session, struct confd *confd)
 {
-	char script[256];
+	char name[256];
 	FILE *fp;
 
 	fp = fopen(_PATH_INBOX, "r");
 	if (!fp)
-		return;		/* nothing to do today */
+		return;		/* nothing to delete */
 
-	while (fgets(script, sizeof(script), fp)) {
-		char link[strlen(_PATH_QUEUE) + strlen(script) + 10];
-		char path[strlen(script) + 10];
-
-		chomp(script);
-
-		/*
-		 * Enqueue start job on execd, use a symlink since we
-		 * want to be able to reuse the script for manual image
-		 * uprgade (and debugging) purposes.
-		 */
-		snprintf(link, sizeof(link), "%s/S01-%s", _PATH_QUEUE, script);
-		snprintf(path, sizeof(path), "../%s", script);
-		if (symlink(path, link) && errno != EEXIST)
-			ERRNO("Creating symlink %s -> %s", link, path);
+	while (fgets(name, sizeof(name), fp)) {
+		chomp(name);
+		systemf("initctl -bnq disable container@%s.conf", name);
+		systemf("container delete %s", name);
+		systemf("initctl -bnq cond clr container:%s", name);
 	}
 
 	fclose(fp);
 	erase(_PATH_INBOX);
 
-	systemf("initctl -bnq touch execd");
+	systemf("podman volume prune -f");
 }
 
 int infix_containers_init(struct confd *confd)

src/confd/yang/confd.inc

@@ -37,7 +37,7 @@ MODULES=(
 	"ieee802-ethernet-interface@2019-06-21.yang"
 	"infix-ethernet-interface@2024-02-27.yang"
 	"infix-factory-default@2023-06-28.yang"
-	"infix-interfaces@2024-11-15.yang -e vlan-filtering"
+	"infix-interfaces@2024-11-27.yang -e vlan-filtering"
 
 	# from rousette
 	"ietf-restconf@2017-01-26.yang"

src/confd/yang/containers.inc

@@ -1,6 +1,6 @@
 # -*- sh -*-
 # REMEMBER TO UPDATE infix-interfaces ALSO IN confd.inc
 MODULES=(
-    "infix-interfaces@2024-11-15.yang -e vlan-filtering -e containers"
+    "infix-interfaces@2024-11-27.yang -e vlan-filtering -e containers"
     "infix-containers@2024-11-15.yang"
 )

src/confd/yang/infix-if-bridge.yang

@@ -26,6 +26,15 @@ submodule infix-if-bridge {
   contact      "kernelkit@googlegroups.com";
   description  "Linux bridge extension for ietf-interfaces.";
 
+  revision 2024-11-28 {
+    description "Drop must() expressions for IP addres on VLAN bridges.
+                 If a bridge is untagged member of a VLAN it should be
+                 possible to set an IP address on the bridge.
+
+                 Allow bridge port settings that also apply to the
+                 bridge itself (e.g., PVID) to be configured.";
+    reference "internal";
+  }
   revision 2024-11-15 {
     description "Fix pyang linter warnings, drop unused imports.";
     reference "internal";
@@ -424,19 +433,90 @@ submodule infix-if-bridge {
     }
   }
 
-  deviation "/if:interfaces/if:interface/ip:ipv4/ip:enabled" {
-    deviate add {
-      must "not(.) or count(../../infix-if:bridge/infix-if:vlans/infix-if:vlan) = 0" {
-	error-message "IPv4 address is not supported on VLAN filtering bridges.";
-      }
+  grouping bridge-port-common {
+    leaf pvid {
+      if-feature "vlan-filtering";
+      type dot1q-types:vlanid;
+      description "The primary VID assigned to this bridge port.";
     }
   }
 
-  deviation "/if:interfaces/if:interface/ip:ipv6/ip:enabled" {
-    deviate add {
-      must "not(.) or count(../../infix-if:bridge/infix-if:vlans/infix-if:vlan) = 0" {
-	error-message "IPv6 address is not supported on VLAN filtering bridges.";
+  grouping bridge-port-lower {
+    leaf bridge {
+      type if:interface-ref;
+      must "deref(.)/../bridge and not(. = ../../if:name)" {
+        error-message "Must refer to a bridge interface (and not itself).";
       }
+      mandatory true;
+      description "Bridge interface to which this interface is attached.";
+    }
+
+    container flood {
+      description "Control flooding of unknown BUM traffic.";
+
+      leaf broadcast {
+        description "Flood unknown broadcast traffic on this port.";
+        type boolean;
+        default true;
+      }
+
+      leaf unicast {
+        description "Flood unknown unicast traffic on this port.";
+        type boolean;
+        default true;
+      }
+
+      leaf multicast {
+        description "Flood unknown multicast traffic on this port.
+
+                         By default this option is enabled to allow MAC multicast
+                         to coexist unregulated with filtering of IP multicast.
+
+                         Flooding of IP multicast is done as long as the groups
+                         remain 'unknown', i.e., while there are no MDB entries
+                         set manually or automatically by IGMP/MLD.";
+        type boolean;
+        default true;
+      }
+    }
+
+    container multicast {
+      leaf fast-leave {
+        description "Assume this port is attached to an end-device.
+
+                         When enabled the bridge immediately cuts multicast
+                         groups when receiving a membership leave report.
+                         When disabled, group subscriptions linger until the
+                         group specific queries time out.";
+        type boolean;
+      }
+
+      leaf router {
+        description "Forward all known multicast on this port.
+
+                         Enable this for ports connected to a multicast router
+                         that is not PIM or multicast router discovery (mrdisc)
+                         capable.
+
+                         This setting is also useful for legacy equipment that
+                         does not support IGMP/MLD.  However, it is recommended
+                         to instead set up static MDB entries for such ports.";
+        type mrouter-port;
+        default auto;
+      }
+    }
+
+    leaf stp-state {
+      type stp-state;
+      config false;
+      description "The operation state of the bridge port.";
+    }
+
+    leaf default-priority {
+      if-feature "vlan-filtering";
+      type dot1q-types:priority-type;
+      default "0";
+      description "The default priority assigned to this bridge port.";
     }
   }
 
@@ -455,89 +535,10 @@ submodule infix-if-bridge {
       description "Extension of the IETF Interfaces model (RFC7223).";
 
       container bridge-port {
-        description "Bridge association and port specific setttngs.";
-
-        leaf bridge {
-          type if:interface-ref;
-          must "deref(.)/../bridge and not(. = ../../if:name)" {
-            error-message "Must refer to a bridge interface (and not itself).";
-          }
-          mandatory true;
-          description "Bridge interface to which this interface is attached.";
-        }
-
-        container flood {
-          description "Control flooding of unknown BUM traffic.";
-
-          leaf broadcast {
-            description "Flood unknown broadcast traffic on this port.";
-            type boolean;
-            default true;
-          }
-
-          leaf unicast {
-            description "Flood unknown unicast traffic on this port.";
-            type boolean;
-            default true;
-          }
-
-          leaf multicast {
-            description "Flood unknown multicast traffic on this port.
-
-                         By default this option is enabled to allow MAC multicast
-                         to coexist unregulated with filtering of IP multicast.
-
-                         Flooding of IP multicast is done as long as the groups
-                         remain 'unknown', i.e., while there are no MDB entries
-                         set manually or automatically by IGMP/MLD.";
-            type boolean;
-            default true;
-          }
-        }
-
-        container multicast {
-          leaf fast-leave {
-            description "Assume this port is attached to an end-device.
-
-                         When enabled the bridge immediately cuts multicast
-                         groups when receiving a membership leave report.
-                         When disabled, group subscriptions linger until the
-                         group specific queries time out.";
-            type boolean;
-          }
-
-          leaf router {
-            description "Forward all known multicast on this port.
-
-                         Enable this for ports connected to a multicast router
-                         that is not PIM or multicast router discovery (mrdisc)
-                         capable.
-
-                         This setting is also useful for legacy equipment that
-                         does not support IGMP/MLD.  However, it is recommended
-                         to instead set up static MDB entries for such ports.";
-            type mrouter-port;
-            default auto;
-          }
-        }
-
-        leaf stp-state {
-          type stp-state;
-          config false;
-          description "The operation state of the bridge port.";
-        }
-
-        leaf pvid {
-          if-feature "vlan-filtering";
-          type dot1q-types:vlanid;
-          description "The primary VID assigned to this bridge port.";
-        }
-
-        leaf default-priority {
-          if-feature "vlan-filtering";
-          type dot1q-types:priority-type;
-          default "0";
-          description "The default priority assigned to this bridge port.";
+        description "Bridge association and port specific settings.";
+        uses bridge-port-common;
+        uses bridge-port-lower {
+          when "not(derived-from-or-self(../if:type, 'ianaift:bridge'))";
         }
       }
     }

src/confd/yang/infix-interfaces.yang

@@ -23,6 +23,10 @@ module infix-interfaces {
   contact      "kernelkit@googlegroups.com";
   description  "Linux bridge and lag extensions for ietf-interfaces.";
 
+  revision 2024-11-27 {
+    description "Allow IP addresses directly on VLAN filtering bridges.";
+    reference "internal";
+  }
   revision 2024-11-15 {
     description "Two changes:
                   - Limit name 1-15 chars, Linux limitation

src/klish-plugin-infix/xml/containers.xml

@@ -189,9 +189,9 @@
       <COMMAND name="all" help="Show all containers (default only running)">
         <ACTION sym="script">doas container -a show</ACTION>
       </COMMAND>
-      <COMMAND name="log" help="Show container log (alias for show log container)">
+      <COMMAND name="log" help="Show container log (jumps to end), alias to 'show log container'">
 	<ACTION sym="script" in="tty" out="tty" interrupt="true">
-	  doas -u $USER cat /log/container |pager
+	  doas -u $USER cat /log/container |pager +G
 	</ACTION>
       </COMMAND>
       <COMMAND name="images" help="Show container images">

src/klish-plugin-infix/xml/infix.xml

@@ -427,7 +427,7 @@
     </SWITCH>
   </COMMAND>
 
-  <COMMAND name="log" help="Show log file, default: syslog">
+  <COMMAND name="log" help="Show log file (jumps to end), default: syslog">
     <PARAM name="fn" ptype="/LOGFILES" min="0" help="Optional log file to show"/>
     <SWITCH name="optional" min="0">
       <COMMAND name="tail" help="Show log tail, last N lines only">
@@ -447,7 +447,7 @@
       if [ -n "$KLISH_PARAM_lines" ]; then
         $cmd "$file" | tail -n $KLISH_PARAM_lines
       else
-        $cmd "$file" | pager
+        $cmd "$file" | pager +G
       fi
     </ACTION>
   </COMMAND>

src/statd/python/yanger/yanger.py

@@ -492,10 +492,12 @@ def add_ospf(control_protocols):
                 neighbor = {}
                 neighbor["neighbor-router-id"] = neigh["neighborIp"]
                 neighbor["address"] = neigh["ifaceAddress"]
-                neighbor["dr-router-id"] = neigh["routerDesignatedId"]
-                neighbor["bdr-router-id"] = neigh["routerDesignatedBackupId"]
                 neighbor["dead-timer"] = neigh["routerDeadIntervalTimerDueMsec"]
                 neighbor["state"] = frr_to_ietf_neighbor_state(neigh["nbrState"])
+                if neigh.get("routerDesignatedId"):
+                    neighbor["dr-router-id"] = neigh["routerDesignatedId"]
+                if neigh.get("routerDesignatedBackupId"):
+                    neighbor["bdr-router-id"] = neigh["routerDesignatedBackupId"]
                 neighbors.append(neighbor)
 
             interface["ietf-ospf:neighbors"] = {}
@@ -672,6 +674,30 @@ def netns_ifindex_to_ifname(ifindex):
 
     return None
 
+def add_bridge_port_common(ifname, iface_in, iface_out):
+    li = iface_in.get("linkinfo", {})
+    if not (li.get("info_slave_kind") == "bridge" or \
+            li.get("info_kind") == "bridge"):
+        return
+
+    pvid = get_bridge_port_pvid(ifname)
+    if pvid is not None:
+        insert(iface_out, "infix-interfaces:bridge-port", "pvid", pvid)
+
+def add_bridge_port_lower(ifname, iface_in, iface_out):
+    li = iface_in.get("linkinfo", {})
+    if not li.get("info_slave_kind") == "bridge":
+        return
+
+    insert(iface_out, "infix-interfaces:bridge-port", "bridge", iface_in['master'])
+
+    stp_state = get_bridge_port_stp_state(ifname)
+    if stp_state is not None:
+        insert(iface_out, "infix-interfaces:bridge-port", "stp-state", stp_state)
+
+    multicast = get_brport_multicast(ifname)
+    insert(iface_out, "infix-interfaces:bridge-port", "multicast", multicast)
+
 def add_ip_link(ifname, iface_in, iface_out):
     if 'ifname' in iface_in:
         iface_out['name'] = ifname
@@ -685,19 +711,9 @@ def add_ip_link(ifname, iface_in, iface_out):
     if 'address' in iface_in:
         iface_out['phys-address'] = iface_in['address']
 
-    if 'master' in iface_in:
-        insert(iface_out, "infix-interfaces:bridge-port", "bridge", iface_in['master'])
+    add_bridge_port_common(ifname, iface_in, iface_out)
+    add_bridge_port_lower(ifname, iface_in, iface_out)
 
-        pvid = get_bridge_port_pvid(ifname)
-        if pvid is not None:
-            insert(iface_out, "infix-interfaces:bridge-port", "pvid", pvid)
-
-        stp_state = get_bridge_port_stp_state(ifname)
-        if stp_state is not None:
-            insert(iface_out, "infix-interfaces:bridge-port", "stp-state", stp_state)
-
-        multicast = get_brport_multicast(ifname)
-        insert(iface_out, "infix-interfaces:bridge-port", "multicast", multicast)
     if not iface_is_dsa(iface_in):
         if 'link' in iface_in:
             insert(iface_out, "infix-interfaces:vlan", "lower-layer-if", iface_in['link'])

test/case/all.yaml

@@ -28,3 +28,6 @@
 
 - name:  infix-services
   suite: infix_services/infix_services.yaml
+
+- name: use-cases
+  suite: use_case/use_case.yml

test/case/cli/cli-output/show-interfaces.txt

@@ -1,5 +1,5 @@
 INTERFACE       PROTOCOL   STATE       DATA                                     
-br0             bridge                 vlan:40u,50t                             
+br0             bridge                 vlan:40u,50t pvid:1                      
 │               ethernet   UP          02:00:00:00:00:00                        
 ├ e0            bridge     DISABLED    vlan:10u,20t pvid:10                     
 └ e1            bridge     BLOCKING    vlan:10t,20u pvid:20                     

test/case/cli/system-output/bridge-vlan-show-dev-br0.json

@@ -0,0 +1 @@
+[{"ifname":"br0","vlans":[{"vlan":1,"flags":["PVID","Egress Untagged"]},{"vlan":33}]}]

test/case/cli/system-output/bridge-vlan-show-dev-br1.json

@@ -0,0 +1 @@
+[{"ifname":"br1","vlans":[]}]

test/case/ietf_interfaces/Readme.adoc

@@ -45,3 +45,5 @@ include::iface_enable_disable/Readme.adoc[]
 
 include::veth_delete/Readme.adoc[]
 
+include::vlan_iface_termination/Readme.adoc[]
+

test/case/ietf_interfaces/bridge_vlan_separation/Readme.adoc

@@ -14,9 +14,9 @@ Test that two VLANs are correctly separated in the bridge
  ,------------------------------------------------------------------------------,
  |  host:mgmt0 host:data10 host:data11    host:data20  host:data21  host:mgmt1  |
  |             [10.0.0.1]   [10.0.0.2]     [10.0.0.3]     [10.0.0.4]            |
- |              (ns10)         (ns11)          (s20)         (ns21)             |
+ |               (ns10)       (ns11)         (ns20)         (ns21)              |
  |                                                                              |
- |                                        [ HOST ]                              |
+ |                                  [ HOST ]                                    |
  '------------------------------------------------------------------------------'
 
 ....
@@ -39,6 +39,10 @@ endif::topdoc[]
 . Verify ping 10.0.0.3 from host:data10
 . Verify ping 10.0.0.4 from host:data11
 . Verify ping not possible host:data10->10.0.0.4, host:data11->10.0.0.3, host:data10->10.0.0.2, host:data11->10.0.0.1
+. Verify MAC broadcast isolation within VLANs
+. Send ping to 10.0.0.255 from host:data10
+. Verify broadcast is received on host:data20
+. Verify broadcast is NOT received on host:data11 and host:data21
 
 
 <<<

test/case/ietf_interfaces/bridge_vlan_separation/test.py

@@ -16,14 +16,15 @@ Test that two VLANs are correctly separated in the bridge
  ,------------------------------------------------------------------------------,
  |  host:mgmt0 host:data10 host:data11    host:data20  host:data21  host:mgmt1  |
  |             [10.0.0.1]   [10.0.0.2]     [10.0.0.3]     [10.0.0.4]            |
- |              (ns10)         (ns11)          (s20)         (ns21)             |
+ |               (ns10)       (ns11)         (ns20)         (ns21)              |
  |                                                                              |
- |                                        [ HOST ]                              |
+ |                                  [ HOST ]                                    |
  '------------------------------------------------------------------------------'
 
 ....
 """
 import infamy
+import subprocess
 
 with infamy.Test() as test:
     with test.step("Set up topology and attach to target DUT"):
@@ -169,4 +170,24 @@ with infamy.Test() as test:
                             lambda: ns10.must_not_reach("10.0.0.2"),
                             lambda: ns11.must_not_reach("10.0.0.1"))
 
+        with test.step("Verify MAC broadcast isolation within VLANs"):
+            # Clear ARP entries/queued packets
+            ns10.runsh("ip neigh flush all")
+            ns11.runsh("ip neigh flush all")
+            ns20.runsh("ip neigh flush all")
+            ns21.runsh("ip neigh flush all")
+
+            # Sending IP subnet broadcast, resulting in MAC broadcast
+            with test.step("Send ping to 10.0.0.255 from host:data10"):
+                process=ns10.popen("ping -b -c 5 -i 0.5 10.0.0.255".split(), stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL)
+
+            with test.step("Verify broadcast is received on host:data20"):
+                ns20.must_receive("ip dst 10.0.0.255")
+
+                with test.step("Verify broadcast is NOT received on host:data11 and host:data21"):
+                    infamy.parallel(
+                        lambda: ns11.must_not_receive("ip dst 10.0.0.255"),
+                        lambda: ns21.must_not_receive("ip dst 10.0.0.255")
+                    )
+
     test.succeed()

test/case/ietf_interfaces/ietf_interfaces.yaml

@@ -61,3 +61,6 @@
 
 - name: iface_enable_disable
   case: iface_enable_disable/test.py
+
+- name: vlan_iface_termination
+  case: vlan_iface_termination/test.py

test/case/ietf_interfaces/vlan_iface_termination/Readme.adoc

@@ -0,0 +1,51 @@
+=== VLAN Interface Termination
+==== Description
+Verify that VLANs stacked on top of an interfaces that are also
+attached to a VLAN filtering bridge are always locally terminated.
+
+....
+.---------------------------.
+|           target          |
+|                           |
+|  data0.10  br0  data1.10  |
+|      \    /   \    /      |
+'------data0-----data1------'
+         |         |
+         |         |
+.------data0-----data1------.
+|      /      :     \       |
+|  data0.10   :   data1.10  |
+|             :             |
+|           host            |
+|             :             |
+'---------------------------'
+....
+
+In this setup, even though VLAN 10 is allowed to ingress and egress on
+both `data0` and `data1`, _bridging_ of packets from one to the other
+must _not_ be allowed.
+
+==== Topology
+ifdef::topdoc[]
+image::../../test/case/ietf_interfaces/vlan_iface_termination/topology.svg[VLAN Interface Termination topology]
+endif::topdoc[]
+ifndef::topdoc[]
+ifdef::testgroup[]
+image::vlan_iface_termination/topology.svg[VLAN Interface Termination topology]
+endif::testgroup[]
+ifndef::testgroup[]
+image::topology.svg[VLAN Interface Termination topology]
+endif::testgroup[]
+endif::topdoc[]
+==== Test sequence
+. Set up topology and attach to target
+. Configure bridge and VLAN interfaces on target
+. Configure IP addresses and VLAN interfaces on host
+. Verify that host:data0 reaches host:data1 with untagged packets
+. Verify that traffic on VLAN 10 from host:data0 does not reach host:data1
+. Verify that host:data0 can reach target on VLAN 10
+. Verify that host:data1 can reach target on VLAN 10
+
+
+<<<
+

test/case/ietf_interfaces/vlan_iface_termination/test.py

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+r"""VLAN Interface Termination
+
+Verify that VLANs stacked on top of an interfaces that are also
+attached to a VLAN filtering bridge are always locally terminated.
+
+....
+.---------------------------.
+|           target          |
+|                           |
+|  data0.10  br0  data1.10  |
+|      \    /   \    /      |
+'------data0-----data1------'
+         |         |
+         |         |
+.------data0-----data1------.
+|      /      :     \       |
+|  data0.10   :   data1.10  |
+|             :             |
+|           host            |
+|             :             |
+'---------------------------'
+....
+
+In this setup, even though VLAN 10 is allowed to ingress and egress on
+both `data0` and `data1`, _bridging_ of packets from one to the other
+must _not_ be allowed.
+
+"""
+import infamy
+
+with infamy.Test() as test:
+    with test.step("Set up topology and attach to target"):
+        env = infamy.Env()
+        tgt = env.attach("target", "mgmt")
+
+    with test.step("Configure bridge and VLAN interfaces on target"):
+        _, hdata0 = env.ltop.xlate(  "host", "data0")
+        _, hdata1 = env.ltop.xlate(  "host", "data1")
+        _, ddata0 = env.ltop.xlate("target", "data0")
+        _, ddata1 = env.ltop.xlate("target", "data1")
+
+        tgt.put_config_dicts({
+            "ietf-interfaces": {
+                "interfaces": {
+                    "interface": [
+                        {
+                            "name": "br0",
+                            "type": "infix-if-type:bridge",
+                            "enabled": True,
+                            "bridge": {
+                                "vlans": {
+                                    "vlan": [
+                                        {
+                                            "vid": 1,
+                                            "untagged": [ddata0, ddata1]
+                                        },
+                                    ]
+                                }
+                            }
+                        },
+                        {
+                            "name": ddata0,
+                            "infix-interfaces:bridge-port": {
+                                "pvid": 1,
+                                "bridge": "br0"
+                            }
+                        },
+                        {
+                            "name": f"{ddata0}.10",
+                            "type": "infix-if-type:vlan",
+                            "vlan": {
+                                "id": 10,
+                                "lower-layer-if": ddata0,
+                            },
+                            "ipv4": {
+                                "address": [
+                                    {
+                                        "ip": "10.10.1.2",
+                                        "prefix-length": 24,
+                                    }
+                                ]
+                            }
+                        },
+                        {
+                            "name": ddata1,
+                            "infix-interfaces:bridge-port": {
+                                "pvid": 1,
+                                "bridge": "br0"
+                            }
+                        },
+                        {
+                            "name": f"{ddata1}.10",
+                            "type": "infix-if-type:vlan",
+                            "vlan": {
+                                "id": 10,
+                                "lower-layer-if": ddata1,
+                            },
+                            "ipv4": {
+                                "address": [
+                                    {
+                                        "ip": "10.10.2.2",
+                                        "prefix-length": 24,
+                                    }
+                                ]
+                            }
+                        },
+                    ]
+                }
+            }
+        })
+
+    with infamy.IsolatedMacVlan(hdata0) as ns0, \
+         infamy.IsolatedMacVlan(hdata1) as ns1:
+
+        with test.step("Configure IP addresses and VLAN interfaces on host"):
+            ns0.addip("10.0.1.1")
+            ns0.runsh("""
+                  set -ex
+                  ip link add dev vlan10 link iface up type vlan id 10
+                  ip addr add 10.10.1.1/24 dev vlan10
+                  """)
+
+            ns1.addip("10.0.1.2")
+            ns1.runsh("""
+                  set -ex
+                  ip link add dev vlan10 link iface up type vlan id 10
+                  ip addr add 10.10.2.1/24 dev vlan10
+                  """)
+
+        with test.step("Verify that host:data0 reaches host:data1 with untagged packets"):
+            ns0.must_reach("10.0.1.2")
+
+        with test.step("Verify that traffic on VLAN 10 from host:data0 does not reach host:data1"):
+            infamy.parallel(lambda: ns0.runsh("timeout -s INT 5 ping -i 0.2 -b 10.10.1.255 || true"),
+                            lambda: ns1.must_not_receive("ip src 10.10.1.1"))
+
+        with test.step("Verify that host:data0 can reach target on VLAN 10"):
+            ns0.must_reach("10.10.1.2")
+
+        with test.step("Verify that host:data1 can reach target on VLAN 10"):
+            ns1.must_reach("10.10.2.2")
+
+    test.succeed()

test/case/ietf_interfaces/vlan_iface_termination/topology.dot

@@ -0,0 +1 @@
+../../../infamy/topologies/1x3.dot

test/case/ietf_interfaces/vlan_iface_termination/topology.svg

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<!-- Title: 1x3 Pages: 1 -->
+<svg width="440pt" height="78pt"
+ viewBox="0.00 0.00 440.03 78.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 74)">
+<title>1x3</title>
+<polygon fill="white" stroke="transparent" points="-4,4 -4,-74 436.03,-74 436.03,4 -4,4"/>
+<!-- host -->
+<g id="node1" class="node">
+<title>host</title>
+<polygon fill="none" stroke="black" points="0,-0.5 0,-69.5 108,-69.5 108,-0.5 0,-0.5"/>
+<text text-anchor="middle" x="25" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">host</text>
+<polyline fill="none" stroke="black" points="50,-0.5 50,-69.5 "/>
+<text text-anchor="middle" x="79" y="-54.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">tgt</text>
+<polyline fill="none" stroke="black" points="50,-46.5 108,-46.5 "/>
+<text text-anchor="middle" x="79" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data0</text>
+<polyline fill="none" stroke="black" points="50,-23.5 108,-23.5 "/>
+<text text-anchor="middle" x="79" y="-8.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data1</text>
+</g>
+<!-- target -->
+<g id="node2" class="node">
+<title>target</title>
+<polygon fill="none" stroke="black" points="308.03,-0.5 308.03,-69.5 432.03,-69.5 432.03,-0.5 308.03,-0.5"/>
+<text text-anchor="middle" x="337.03" y="-54.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt</text>
+<polyline fill="none" stroke="black" points="308.03,-46.5 366.03,-46.5 "/>
+<text text-anchor="middle" x="337.03" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data0</text>
+<polyline fill="none" stroke="black" points="308.03,-23.5 366.03,-23.5 "/>
+<text text-anchor="middle" x="337.03" y="-8.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">data1</text>
+<polyline fill="none" stroke="black" points="366.03,-0.5 366.03,-69.5 "/>
+<text text-anchor="middle" x="399.03" y="-31.3" font-family="DejaVu Sans Mono, Book" font-size="14.00">target</text>
+</g>
+<!-- host&#45;&#45;target -->
+<g id="edge1" class="edge">
+<title>host:tgt&#45;&#45;target:mgmt</title>
+<path fill="none" stroke="cornflowerblue" stroke-width="2" d="M108,-58C108,-58 308.03,-58 308.03,-58"/>
+</g>
+<!-- host&#45;&#45;target -->
+<g id="edge2" class="edge">
+<title>host:data0&#45;&#45;target:data0</title>
+<path fill="none" stroke="black" stroke-width="2" d="M108,-35C108,-35 308.03,-35 308.03,-35"/>
+</g>
+<!-- host&#45;&#45;target -->
+<g id="edge3" class="edge">
+<title>host:data1&#45;&#45;target:data1</title>
+<path fill="none" stroke="black" stroke-width="2" d="M108,-12C108,-12 308.03,-12 308.03,-12"/>
+</g>
+</g>
+</svg>

test/case/ietf_routing/Readme.adoc

@@ -13,3 +13,11 @@ include::ospf_unnumbered_interface/Readme.adoc[]
 include::ospf_multiarea/Readme.adoc[]
 
 include::ospf_bfd/Readme.adoc[]
+
+include::ospf_default_route_advertise/Readme.adoc[]
+
+include::route_pref_ospf/Readme.adoc[]
+
+include::route_pref_dhcp/Readme.adoc[]
+
+include::route_pref_255/Readme.adoc[]

test/case/ietf_routing/ietf_routing.yaml

@@ -13,3 +13,15 @@
 
 - name: ospf_bfd
   case: ospf_bfd/test.py
+
+- name: route_pref_ospf
+  case: route_pref_ospf/test.py
+
+- name: route_pref_dhcp
+  case: route_pref_dhcp/test.py
+
+- name: route_pref_255
+  case: route_pref_255/test.py
+
+- name: ospf_default_route_advertise
+  case: ospf_default_route_advertise/test.py

test/case/ietf_routing/ospf_basic/test.py

@@ -56,7 +56,22 @@ def config_target1(target, data, link):
     target.put_config_dict("ietf-routing", {
         "routing": {
             "control-plane-protocols": {
-                "control-plane-protocol": [{
+                "control-plane-protocol": [
+                    {
+                        "type": "infix-routing:static",
+                        "name": "default",
+                        "static-routes": {
+                            "ipv4": {
+                                "route": [{
+                                    "destination-prefix": "192.168.33.1/32",
+                                    "next-hop": {
+                                        "special-next-hop": "blackhole"
+                                    }
+                                }]
+                            }
+                        }
+                    },
+                    {
                     "type": "infix-routing:ospfv2",
                     "name": "default",
                     "ospf": {
@@ -74,6 +89,7 @@ def config_target1(target, data, link):
                                 "interfaces":
                                 {
                                     "interface": [{
+                                        "enabled": True,
                                         "name": link,
                                         "hello-interval": 1,
                                         "dead-interval": 3
@@ -132,9 +148,6 @@ def config_target2(target, link):
                     "ospf": {
                         "redistribute": {
                             "redistribute": [{
-                                "protocol": "static"
-                            },
-                            {
                                 "protocol": "connected"
                             }]
                         },
@@ -143,6 +156,7 @@ def config_target2(target, link):
                                 "area-id": "0.0.0.0",
                                 "interfaces":{
                                     "interface": [{
+                                        "enabled": True,
                                         "name": link,
                                         "hello-interval": 1,
                                         "dead-interval": 3
@@ -174,6 +188,7 @@ with infamy.Test() as test:
         print("Waiting for OSPF routes..")
         until(lambda: route.ipv4_route_exist(R1, "192.168.200.1/32", proto="ietf-ospf:ospfv2"), attempts=200)
         until(lambda: route.ipv4_route_exist(R2, "192.168.100.1/32", proto="ietf-ospf:ospfv2"), attempts=200)
+        until(lambda: route.ipv4_route_exist(R2, "192.168.33.1/32", proto="ietf-ospf:ospfv2"), attempts=200)
 
     with test.step("Test connectivity from PC:data to 192.168.200.1"):
         _, hport0 = env.ltop.xlate("PC", "data")