[PATCH v2 net-next 00/10] DSA FDB isolation
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: 2022-02-25 09:23:07
There are use cases which need FDB isolation between standalone ports and bridged ports, as well as isolation between ports of different bridges. Most of these use cases are a result of the fact that packets can now be partially forwarded by the software bridge, so one port might need to send a packet to the CPU but its FDB lookup will see that it can forward it directly to a bridge port where that packet was autonomously learned. So the source port will attempt to shortcircuit the CPU and forward autonomously, which it can't due to the forwarding isolation we have in place. So we will have packet drops instead of proper operation. Additionally, before DSA can implement IFF_UNICAST_FLT for standalone ports, we must have control over which database we install FDB entries corresponding to port MAC addresses in. We don't want to hinder the operation of the bridging layer. DSA does not have a driver API that encourages FDB isolation, so this needs to be created. The basis for this is a new struct dsa_db which annotates each FDB and MDB entry with the database it belongs to. The sja1105 and felix drivers are modified to observe the dsa_db argument, and therefore, enforce the FDB isolation. Compared to the previous RFC patch series from August: https://patchwork.kernel.org/project/netdevbpf/cover/20210818120150.892647-1-vladimir.oltean@nxp.com/ what is different is that I stopped trying to make SWITCHDEV_FDB_{ADD,DEL}_TO_DEVICE blocking, instead I'm making use of the fact that DSA waits for switchdev FDB work items to finish before a port leaves the bridge. This is possible since: https://patchwork.kernel.org/project/netdevbpf/patch/20211024171757.3753288-7-vladimir.oltean@nxp.com/ Additionally, v2 is also rebased over the DSA LAG FDB work. Vladimir Oltean (10): net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging net: dsa: tag_8021q: add support for imprecise RX based on the VBID docs: net: dsa: sja1105: document limitations of tc-flower rule VLAN awareness net: dsa: felix: delete workarounds present due to SVL tag_8021q bridging net: dsa: tag_8021q: merge RX and TX VLANs net: dsa: tag_8021q: rename dsa_8021q_bridge_tx_fwd_offload_vid net: dsa: request drivers to perform FDB isolation net: dsa: pass extack to .port_bridge_join driver methods net: dsa: sja1105: enforce FDB isolation net: mscc: ocelot: enforce FDB isolation when VLAN-unaware Documentation/networking/dsa/sja1105.rst | 27 ++ drivers/net/dsa/b53/b53_common.c | 14 +- drivers/net/dsa/b53/b53_priv.h | 14 +- drivers/net/dsa/dsa_loop.c | 3 +- drivers/net/dsa/hirschmann/hellcreek.c | 9 +- drivers/net/dsa/lan9303-core.c | 16 +- drivers/net/dsa/lantiq_gswip.c | 9 +- drivers/net/dsa/microchip/ksz9477.c | 12 +- drivers/net/dsa/microchip/ksz_common.c | 9 +- drivers/net/dsa/microchip/ksz_common.h | 9 +- drivers/net/dsa/mt7530.c | 15 +- drivers/net/dsa/mv88e6xxx/chip.c | 18 +- drivers/net/dsa/ocelot/felix.c | 221 +++++++++------- drivers/net/dsa/qca8k.c | 15 +- drivers/net/dsa/realtek/rtl8366rb.c | 3 +- drivers/net/dsa/sja1105/sja1105_main.c | 94 ++++--- drivers/net/dsa/sja1105/sja1105_vl.c | 16 +- drivers/net/dsa/xrs700x/xrs700x.c | 3 +- drivers/net/ethernet/mscc/ocelot.c | 200 ++++++++++++-- drivers/net/ethernet/mscc/ocelot.h | 5 +- drivers/net/ethernet/mscc/ocelot_mrp.c | 8 +- drivers/net/ethernet/mscc/ocelot_net.c | 66 ++++- include/linux/dsa/8021q.h | 26 +- include/net/dsa.h | 48 +++- include/soc/mscc/ocelot.h | 31 ++- net/dsa/dsa_priv.h | 8 +- net/dsa/port.c | 76 +++++- net/dsa/switch.c | 109 +++++--- net/dsa/tag_8021q.c | 319 +++++++++-------------- net/dsa/tag_ocelot_8021q.c | 4 +- net/dsa/tag_sja1105.c | 28 +- 31 files changed, 925 insertions(+), 510 deletions(-) -- 2.25.1