Messages in this thread | | | From | DENG Qingfang <> | Subject | Re: [RFC net-next 2/2] net: dsa: mt7530: trap packets from standalone ports to the CPU | Date | Sat, 31 Jul 2021 01:21:14 +0800 |
| |
On Fri, Jul 30, 2021 at 07:18:52PM +0300, Vladimir Oltean wrote: > > It turns out that only PVC.VLAN_ATTR contributes to VLAN awareness. > > Port matrix mode just skips the VLAN table lookup. The reference > > manual is somehow misleading when describing PORT_VLAN modes (See Page > > 17 of MT7531 Reference Manual, available at > > http://wiki.banana-pi.org/Banana_Pi_BPI-R64#Resources). It states that > > PORT_MEM (VLAN port member) is used for destination if the VLAN table > > lookup hits, but actually it uses **PORT_MEM & PORT_MATRIX** (bitwise > > AND of VLAN port member and port matrix) instead, which means we can > > have two or more separate VLAN-aware bridges with the same PVID and > > traffic won't leak between them. > > Ah, but it's not completely misleading. It does say: > > 2'b01: Fallback mode > > Enable 802.1Q function for all the received frames. > Do not discard received frames due to ingress membership violation. > **Frames whose VID is missed on the VLAN table will be filtered > by the Port Matrix Member**. > > (emphasis mine on the last paragraph) > > > So I came up with a solution: Set PORT_VLAN to fallback mode when in > > VLAN-unaware mode, this way, even VLAN-unaware bridges will use > > independent VLAN filtering. > > If you did indeed test that the Port Matrix is still used to enforce > separation between ports if the VLAN table _does_ match and we're in > fallback mode, then we should be okay.
Yes, that's what I mean. Tested as well.
> > > Then assign all standalone ports to a reserved VLAN. > > You mean all standalone ports to the same VLAN ID, like 4095, or each > standalone port to a separate reserved VLAN ID? As long as address > learning is disabled on the standalone ports, I guess using a single > VLAN ID like 4095 for all of them is just fine, the Port Matrix will > take care of the rest.
I just found a cleaner solution: Leaving standalone ports in port matrix mode. As all bridges use independent VLAN learning, standalone ports' FDB lookup with FID 0 won't hit.
| |