Back to home page

OSCL-LXR

 
 

    


0001 .. SPDX-License-Identifier: GPL-2.0
0002 .. include:: <isonum.txt>
0003 
0004 ===============================================
0005 Ethernet switch device driver model (switchdev)
0006 ===============================================
0007 
0008 Copyright |copy| 2014 Jiri Pirko <jiri@resnulli.us>
0009 
0010 Copyright |copy| 2014-2015 Scott Feldman <sfeldma@gmail.com>
0011 
0012 
0013 The Ethernet switch device driver model (switchdev) is an in-kernel driver
0014 model for switch devices which offload the forwarding (data) plane from the
0015 kernel.
0016 
0017 Figure 1 is a block diagram showing the components of the switchdev model for
0018 an example setup using a data-center-class switch ASIC chip.  Other setups
0019 with SR-IOV or soft switches, such as OVS, are possible.
0020 
0021 ::
0022 
0023 
0024                              User-space tools
0025 
0026        user space                   |
0027       +-------------------------------------------------------------------+
0028        kernel                       | Netlink
0029                                     |
0030                      +--------------+-------------------------------+
0031                      |         Network stack                        |
0032                      |           (Linux)                            |
0033                      |                                              |
0034                      +----------------------------------------------+
0035 
0036                            sw1p2     sw1p4     sw1p6
0037                       sw1p1  +  sw1p3  +  sw1p5  +          eth1
0038                         +    |    +    |    +    |            +
0039                         |    |    |    |    |    |            |
0040                      +--+----+----+----+----+----+---+  +-----+-----+
0041                      |         Switch driver         |  |    mgmt   |
0042                      |        (this document)        |  |   driver  |
0043                      |                               |  |           |
0044                      +--------------+----------------+  +-----------+
0045                                     |
0046        kernel                       | HW bus (eg PCI)
0047       +-------------------------------------------------------------------+
0048        hardware                     |
0049                      +--------------+----------------+
0050                      |         Switch device (sw1)   |
0051                      |  +----+                       +--------+
0052                      |  |    v offloaded data path   | mgmt port
0053                      |  |    |                       |
0054                      +--|----|----+----+----+----+---+
0055                         |    |    |    |    |    |
0056                         +    +    +    +    +    +
0057                        p1   p2   p3   p4   p5   p6
0058 
0059                              front-panel ports
0060 
0061 
0062                                     Fig 1.
0063 
0064 
0065 Include Files
0066 -------------
0067 
0068 ::
0069 
0070     #include <linux/netdevice.h>
0071     #include <net/switchdev.h>
0072 
0073 
0074 Configuration
0075 -------------
0076 
0077 Use "depends NET_SWITCHDEV" in driver's Kconfig to ensure switchdev model
0078 support is built for driver.
0079 
0080 
0081 Switch Ports
0082 ------------
0083 
0084 On switchdev driver initialization, the driver will allocate and register a
0085 struct net_device (using register_netdev()) for each enumerated physical switch
0086 port, called the port netdev.  A port netdev is the software representation of
0087 the physical port and provides a conduit for control traffic to/from the
0088 controller (the kernel) and the network, as well as an anchor point for higher
0089 level constructs such as bridges, bonds, VLANs, tunnels, and L3 routers.  Using
0090 standard netdev tools (iproute2, ethtool, etc), the port netdev can also
0091 provide to the user access to the physical properties of the switch port such
0092 as PHY link state and I/O statistics.
0093 
0094 There is (currently) no higher-level kernel object for the switch beyond the
0095 port netdevs.  All of the switchdev driver ops are netdev ops or switchdev ops.
0096 
0097 A switch management port is outside the scope of the switchdev driver model.
0098 Typically, the management port is not participating in offloaded data plane and
0099 is loaded with a different driver, such as a NIC driver, on the management port
0100 device.
0101 
0102 Switch ID
0103 ^^^^^^^^^
0104 
0105 The switchdev driver must implement the net_device operation
0106 ndo_get_port_parent_id for each port netdev, returning the same physical ID for
0107 each port of a switch. The ID must be unique between switches on the same
0108 system. The ID does not need to be unique between switches on different
0109 systems.
0110 
0111 The switch ID is used to locate ports on a switch and to know if aggregated
0112 ports belong to the same switch.
0113 
0114 Port Netdev Naming
0115 ^^^^^^^^^^^^^^^^^^
0116 
0117 Udev rules should be used for port netdev naming, using some unique attribute
0118 of the port as a key, for example the port MAC address or the port PHYS name.
0119 Hard-coding of kernel netdev names within the driver is discouraged; let the
0120 kernel pick the default netdev name, and let udev set the final name based on a
0121 port attribute.
0122 
0123 Using port PHYS name (ndo_get_phys_port_name) for the key is particularly
0124 useful for dynamically-named ports where the device names its ports based on
0125 external configuration.  For example, if a physical 40G port is split logically
0126 into 4 10G ports, resulting in 4 port netdevs, the device can give a unique
0127 name for each port using port PHYS name.  The udev rule would be::
0128 
0129     SUBSYSTEM=="net", ACTION=="add", ATTR{phys_switch_id}=="<phys_switch_id>", \
0130             ATTR{phys_port_name}!="", NAME="swX$attr{phys_port_name}"
0131 
0132 Suggested naming convention is "swXpYsZ", where X is the switch name or ID, Y
0133 is the port name or ID, and Z is the sub-port name or ID.  For example, sw1p1s0
0134 would be sub-port 0 on port 1 on switch 1.
0135 
0136 Port Features
0137 ^^^^^^^^^^^^^
0138 
0139 NETIF_F_NETNS_LOCAL
0140 
0141 If the switchdev driver (and device) only supports offloading of the default
0142 network namespace (netns), the driver should set this feature flag to prevent
0143 the port netdev from being moved out of the default netns.  A netns-aware
0144 driver/device would not set this flag and be responsible for partitioning
0145 hardware to preserve netns containment.  This means hardware cannot forward
0146 traffic from a port in one namespace to another port in another namespace.
0147 
0148 Port Topology
0149 ^^^^^^^^^^^^^
0150 
0151 The port netdevs representing the physical switch ports can be organized into
0152 higher-level switching constructs.  The default construct is a standalone
0153 router port, used to offload L3 forwarding.  Two or more ports can be bonded
0154 together to form a LAG.  Two or more ports (or LAGs) can be bridged to bridge
0155 L2 networks.  VLANs can be applied to sub-divide L2 networks.  L2-over-L3
0156 tunnels can be built on ports.  These constructs are built using standard Linux
0157 tools such as the bridge driver, the bonding/team drivers, and netlink-based
0158 tools such as iproute2.
0159 
0160 The switchdev driver can know a particular port's position in the topology by
0161 monitoring NETDEV_CHANGEUPPER notifications.  For example, a port moved into a
0162 bond will see its upper master change.  If that bond is moved into a bridge,
0163 the bond's upper master will change.  And so on.  The driver will track such
0164 movements to know what position a port is in in the overall topology by
0165 registering for netdevice events and acting on NETDEV_CHANGEUPPER.
0166 
0167 L2 Forwarding Offload
0168 ---------------------
0169 
0170 The idea is to offload the L2 data forwarding (switching) path from the kernel
0171 to the switchdev device by mirroring bridge FDB entries down to the device.  An
0172 FDB entry is the {port, MAC, VLAN} tuple forwarding destination.
0173 
0174 To offloading L2 bridging, the switchdev driver/device should support:
0175 
0176         - Static FDB entries installed on a bridge port
0177         - Notification of learned/forgotten src mac/vlans from device
0178         - STP state changes on the port
0179         - VLAN flooding of multicast/broadcast and unknown unicast packets
0180 
0181 Static FDB Entries
0182 ^^^^^^^^^^^^^^^^^^
0183 
0184 A driver which implements the ``ndo_fdb_add``, ``ndo_fdb_del`` and
0185 ``ndo_fdb_dump`` operations is able to support the command below, which adds a
0186 static bridge FDB entry::
0187 
0188         bridge fdb add dev DEV ADDRESS [vlan VID] [self] static
0189 
0190 (the "static" keyword is non-optional: if not specified, the entry defaults to
0191 being "local", which means that it should not be forwarded)
0192 
0193 The "self" keyword (optional because it is implicit) has the role of
0194 instructing the kernel to fulfill the operation through the ``ndo_fdb_add``
0195 implementation of the ``DEV`` device itself. If ``DEV`` is a bridge port, this
0196 will bypass the bridge and therefore leave the software database out of sync
0197 with the hardware one.
0198 
0199 To avoid this, the "master" keyword can be used::
0200 
0201         bridge fdb add dev DEV ADDRESS [vlan VID] master static
0202 
0203 The above command instructs the kernel to search for a master interface of
0204 ``DEV`` and fulfill the operation through the ``ndo_fdb_add`` method of that.
0205 This time, the bridge generates a ``SWITCHDEV_FDB_ADD_TO_DEVICE`` notification
0206 which the port driver can handle and use it to program its hardware table. This
0207 way, the software and the hardware database will both contain this static FDB
0208 entry.
0209 
0210 Note: for new switchdev drivers that offload the Linux bridge, implementing the
0211 ``ndo_fdb_add`` and ``ndo_fdb_del`` bridge bypass methods is strongly
0212 discouraged: all static FDB entries should be added on a bridge port using the
0213 "master" flag. The ``ndo_fdb_dump`` is an exception and can be implemented to
0214 visualize the hardware tables, if the device does not have an interrupt for
0215 notifying the operating system of newly learned/forgotten dynamic FDB
0216 addresses. In that case, the hardware FDB might end up having entries that the
0217 software FDB does not, and implementing ``ndo_fdb_dump`` is the only way to see
0218 them.
0219 
0220 Note: by default, the bridge does not filter on VLAN and only bridges untagged
0221 traffic.  To enable VLAN support, turn on VLAN filtering::
0222 
0223         echo 1 >/sys/class/net/<bridge>/bridge/vlan_filtering
0224 
0225 Notification of Learned/Forgotten Source MAC/VLANs
0226 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
0227 
0228 The switch device will learn/forget source MAC address/VLAN on ingress packets
0229 and notify the switch driver of the mac/vlan/port tuples.  The switch driver,
0230 in turn, will notify the bridge driver using the switchdev notifier call::
0231 
0232         err = call_switchdev_notifiers(val, dev, info, extack);
0233 
0234 Where val is SWITCHDEV_FDB_ADD when learning and SWITCHDEV_FDB_DEL when
0235 forgetting, and info points to a struct switchdev_notifier_fdb_info.  On
0236 SWITCHDEV_FDB_ADD, the bridge driver will install the FDB entry into the
0237 bridge's FDB and mark the entry as NTF_EXT_LEARNED.  The iproute2 bridge
0238 command will label these entries "offload"::
0239 
0240         $ bridge fdb
0241         52:54:00:12:35:01 dev sw1p1 master br0 permanent
0242         00:02:00:00:02:00 dev sw1p1 master br0 offload
0243         00:02:00:00:02:00 dev sw1p1 self
0244         52:54:00:12:35:02 dev sw1p2 master br0 permanent
0245         00:02:00:00:03:00 dev sw1p2 master br0 offload
0246         00:02:00:00:03:00 dev sw1p2 self
0247         33:33:00:00:00:01 dev eth0 self permanent
0248         01:00:5e:00:00:01 dev eth0 self permanent
0249         33:33:ff:00:00:00 dev eth0 self permanent
0250         01:80:c2:00:00:0e dev eth0 self permanent
0251         33:33:00:00:00:01 dev br0 self permanent
0252         01:00:5e:00:00:01 dev br0 self permanent
0253         33:33:ff:12:35:01 dev br0 self permanent
0254 
0255 Learning on the port should be disabled on the bridge using the bridge command::
0256 
0257         bridge link set dev DEV learning off
0258 
0259 Learning on the device port should be enabled, as well as learning_sync::
0260 
0261         bridge link set dev DEV learning on self
0262         bridge link set dev DEV learning_sync on self
0263 
0264 Learning_sync attribute enables syncing of the learned/forgotten FDB entry to
0265 the bridge's FDB.  It's possible, but not optimal, to enable learning on the
0266 device port and on the bridge port, and disable learning_sync.
0267 
0268 To support learning, the driver implements switchdev op
0269 switchdev_port_attr_set for SWITCHDEV_ATTR_PORT_ID_{PRE}_BRIDGE_FLAGS.
0270 
0271 FDB Ageing
0272 ^^^^^^^^^^
0273 
0274 The bridge will skip ageing FDB entries marked with NTF_EXT_LEARNED and it is
0275 the responsibility of the port driver/device to age out these entries.  If the
0276 port device supports ageing, when the FDB entry expires, it will notify the
0277 driver which in turn will notify the bridge with SWITCHDEV_FDB_DEL.  If the
0278 device does not support ageing, the driver can simulate ageing using a
0279 garbage collection timer to monitor FDB entries.  Expired entries will be
0280 notified to the bridge using SWITCHDEV_FDB_DEL.  See rocker driver for
0281 example of driver running ageing timer.
0282 
0283 To keep an NTF_EXT_LEARNED entry "alive", the driver should refresh the FDB
0284 entry by calling call_switchdev_notifiers(SWITCHDEV_FDB_ADD, ...).  The
0285 notification will reset the FDB entry's last-used time to now.  The driver
0286 should rate limit refresh notifications, for example, no more than once a
0287 second.  (The last-used time is visible using the bridge -s fdb option).
0288 
0289 STP State Change on Port
0290 ^^^^^^^^^^^^^^^^^^^^^^^^
0291 
0292 Internally or with a third-party STP protocol implementation (e.g. mstpd), the
0293 bridge driver maintains the STP state for ports, and will notify the switch
0294 driver of STP state change on a port using the switchdev op
0295 switchdev_attr_port_set for SWITCHDEV_ATTR_PORT_ID_STP_UPDATE.
0296 
0297 State is one of BR_STATE_*.  The switch driver can use STP state updates to
0298 update ingress packet filter list for the port.  For example, if port is
0299 DISABLED, no packets should pass, but if port moves to BLOCKED, then STP BPDUs
0300 and other IEEE 01:80:c2:xx:xx:xx link-local multicast packets can pass.
0301 
0302 Note that STP BDPUs are untagged and STP state applies to all VLANs on the port
0303 so packet filters should be applied consistently across untagged and tagged
0304 VLANs on the port.
0305 
0306 Flooding L2 domain
0307 ^^^^^^^^^^^^^^^^^^
0308 
0309 For a given L2 VLAN domain, the switch device should flood multicast/broadcast
0310 and unknown unicast packets to all ports in domain, if allowed by port's
0311 current STP state.  The switch driver, knowing which ports are within which
0312 vlan L2 domain, can program the switch device for flooding.  The packet may
0313 be sent to the port netdev for processing by the bridge driver.  The
0314 bridge should not reflood the packet to the same ports the device flooded,
0315 otherwise there will be duplicate packets on the wire.
0316 
0317 To avoid duplicate packets, the switch driver should mark a packet as already
0318 forwarded by setting the skb->offload_fwd_mark bit. The bridge driver will mark
0319 the skb using the ingress bridge port's mark and prevent it from being forwarded
0320 through any bridge port with the same mark.
0321 
0322 It is possible for the switch device to not handle flooding and push the
0323 packets up to the bridge driver for flooding.  This is not ideal as the number
0324 of ports scale in the L2 domain as the device is much more efficient at
0325 flooding packets that software.
0326 
0327 If supported by the device, flood control can be offloaded to it, preventing
0328 certain netdevs from flooding unicast traffic for which there is no FDB entry.
0329 
0330 IGMP Snooping
0331 ^^^^^^^^^^^^^
0332 
0333 In order to support IGMP snooping, the port netdevs should trap to the bridge
0334 driver all IGMP join and leave messages.
0335 The bridge multicast module will notify port netdevs on every multicast group
0336 changed whether it is static configured or dynamically joined/leave.
0337 The hardware implementation should be forwarding all registered multicast
0338 traffic groups only to the configured ports.
0339 
0340 L3 Routing Offload
0341 ------------------
0342 
0343 Offloading L3 routing requires that device be programmed with FIB entries from
0344 the kernel, with the device doing the FIB lookup and forwarding.  The device
0345 does a longest prefix match (LPM) on FIB entries matching route prefix and
0346 forwards the packet to the matching FIB entry's nexthop(s) egress ports.
0347 
0348 To program the device, the driver has to register a FIB notifier handler
0349 using register_fib_notifier. The following events are available:
0350 
0351 ===================  ===================================================
0352 FIB_EVENT_ENTRY_ADD  used for both adding a new FIB entry to the device,
0353                      or modifying an existing entry on the device.
0354 FIB_EVENT_ENTRY_DEL  used for removing a FIB entry
0355 FIB_EVENT_RULE_ADD,
0356 FIB_EVENT_RULE_DEL   used to propagate FIB rule changes
0357 ===================  ===================================================
0358 
0359 FIB_EVENT_ENTRY_ADD and FIB_EVENT_ENTRY_DEL events pass::
0360 
0361         struct fib_entry_notifier_info {
0362                 struct fib_notifier_info info; /* must be first */
0363                 u32 dst;
0364                 int dst_len;
0365                 struct fib_info *fi;
0366                 u8 tos;
0367                 u8 type;
0368                 u32 tb_id;
0369                 u32 nlflags;
0370         };
0371 
0372 to add/modify/delete IPv4 dst/dest_len prefix on table tb_id.  The ``*fi``
0373 structure holds details on the route and route's nexthops.  ``*dev`` is one
0374 of the port netdevs mentioned in the route's next hop list.
0375 
0376 Routes offloaded to the device are labeled with "offload" in the ip route
0377 listing::
0378 
0379         $ ip route show
0380         default via 192.168.0.2 dev eth0
0381         11.0.0.0/30 dev sw1p1  proto kernel  scope link  src 11.0.0.2 offload
0382         11.0.0.4/30 via 11.0.0.1 dev sw1p1  proto zebra  metric 20 offload
0383         11.0.0.8/30 dev sw1p2  proto kernel  scope link  src 11.0.0.10 offload
0384         11.0.0.12/30 via 11.0.0.9 dev sw1p2  proto zebra  metric 20 offload
0385         12.0.0.2  proto zebra  metric 30 offload
0386                 nexthop via 11.0.0.1  dev sw1p1 weight 1
0387                 nexthop via 11.0.0.9  dev sw1p2 weight 1
0388         12.0.0.3 via 11.0.0.1 dev sw1p1  proto zebra  metric 20 offload
0389         12.0.0.4 via 11.0.0.9 dev sw1p2  proto zebra  metric 20 offload
0390         192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.15
0391 
0392 The "offload" flag is set in case at least one device offloads the FIB entry.
0393 
0394 XXX: add/mod/del IPv6 FIB API
0395 
0396 Nexthop Resolution
0397 ^^^^^^^^^^^^^^^^^^
0398 
0399 The FIB entry's nexthop list contains the nexthop tuple (gateway, dev), but for
0400 the switch device to forward the packet with the correct dst mac address, the
0401 nexthop gateways must be resolved to the neighbor's mac address.  Neighbor mac
0402 address discovery comes via the ARP (or ND) process and is available via the
0403 arp_tbl neighbor table.  To resolve the routes nexthop gateways, the driver
0404 should trigger the kernel's neighbor resolution process.  See the rocker
0405 driver's rocker_port_ipv4_resolve() for an example.
0406 
0407 The driver can monitor for updates to arp_tbl using the netevent notifier
0408 NETEVENT_NEIGH_UPDATE.  The device can be programmed with resolved nexthops
0409 for the routes as arp_tbl updates.  The driver implements ndo_neigh_destroy
0410 to know when arp_tbl neighbor entries are purged from the port.
0411 
0412 Device driver expected behavior
0413 -------------------------------
0414 
0415 Below is a set of defined behavior that switchdev enabled network devices must
0416 adhere to.
0417 
0418 Configuration-less state
0419 ^^^^^^^^^^^^^^^^^^^^^^^^
0420 
0421 Upon driver bring up, the network devices must be fully operational, and the
0422 backing driver must configure the network device such that it is possible to
0423 send and receive traffic to this network device and it is properly separated
0424 from other network devices/ports (e.g.: as is frequent with a switch ASIC). How
0425 this is achieved is heavily hardware dependent, but a simple solution can be to
0426 use per-port VLAN identifiers unless a better mechanism is available
0427 (proprietary metadata for each network port for instance).
0428 
0429 The network device must be capable of running a full IP protocol stack
0430 including multicast, DHCP, IPv4/6, etc. If necessary, it should program the
0431 appropriate filters for VLAN, multicast, unicast etc. The underlying device
0432 driver must effectively be configured in a similar fashion to what it would do
0433 when IGMP snooping is enabled for IP multicast over these switchdev network
0434 devices and unsolicited multicast must be filtered as early as possible in
0435 the hardware.
0436 
0437 When configuring VLANs on top of the network device, all VLANs must be working,
0438 irrespective of the state of other network devices (e.g.: other ports being part
0439 of a VLAN-aware bridge doing ingress VID checking). See below for details.
0440 
0441 If the device implements e.g.: VLAN filtering, putting the interface in
0442 promiscuous mode should allow the reception of all VLAN tags (including those
0443 not present in the filter(s)).
0444 
0445 Bridged switch ports
0446 ^^^^^^^^^^^^^^^^^^^^
0447 
0448 When a switchdev enabled network device is added as a bridge member, it should
0449 not disrupt any functionality of non-bridged network devices and they
0450 should continue to behave as normal network devices. Depending on the bridge
0451 configuration knobs below, the expected behavior is documented.
0452 
0453 Bridge VLAN filtering
0454 ^^^^^^^^^^^^^^^^^^^^^
0455 
0456 The Linux bridge allows the configuration of a VLAN filtering mode (statically,
0457 at device creation time, and dynamically, during run time) which must be
0458 observed by the underlying switchdev network device/hardware:
0459 
0460 - with VLAN filtering turned off: the bridge is strictly VLAN unaware and its
0461   data path will process all Ethernet frames as if they are VLAN-untagged.
0462   The bridge VLAN database can still be modified, but the modifications should
0463   have no effect while VLAN filtering is turned off. Frames ingressing the
0464   device with a VID that is not programmed into the bridge/switch's VLAN table
0465   must be forwarded and may be processed using a VLAN device (see below).
0466 
0467 - with VLAN filtering turned on: the bridge is VLAN-aware and frames ingressing
0468   the device with a VID that is not programmed into the bridges/switch's VLAN
0469   table must be dropped (strict VID checking).
0470 
0471 When there is a VLAN device (e.g: sw0p1.100) configured on top of a switchdev
0472 network device which is a bridge port member, the behavior of the software
0473 network stack must be preserved, or the configuration must be refused if that
0474 is not possible.
0475 
0476 - with VLAN filtering turned off, the bridge will process all ingress traffic
0477   for the port, except for the traffic tagged with a VLAN ID destined for a
0478   VLAN upper. The VLAN upper interface (which consumes the VLAN tag) can even
0479   be added to a second bridge, which includes other switch ports or software
0480   interfaces. Some approaches to ensure that the forwarding domain for traffic
0481   belonging to the VLAN upper interfaces are managed properly:
0482 
0483     * If forwarding destinations can be managed per VLAN, the hardware could be
0484       configured to map all traffic, except the packets tagged with a VID
0485       belonging to a VLAN upper interface, to an internal VID corresponding to
0486       untagged packets. This internal VID spans all ports of the VLAN-unaware
0487       bridge. The VID corresponding to the VLAN upper interface spans the
0488       physical port of that VLAN interface, as well as the other ports that
0489       might be bridged with it.
0490     * Treat bridge ports with VLAN upper interfaces as standalone, and let
0491       forwarding be handled in the software data path.
0492 
0493 - with VLAN filtering turned on, these VLAN devices can be created as long as
0494   the bridge does not have an existing VLAN entry with the same VID on any
0495   bridge port. These VLAN devices cannot be enslaved into the bridge since they
0496   duplicate functionality/use case with the bridge's VLAN data path processing.
0497 
0498 Non-bridged network ports of the same switch fabric must not be disturbed in any
0499 way by the enabling of VLAN filtering on the bridge device(s). If the VLAN
0500 filtering setting is global to the entire chip, then the standalone ports
0501 should indicate to the network stack that VLAN filtering is required by setting
0502 'rx-vlan-filter: on [fixed]' in the ethtool features.
0503 
0504 Because VLAN filtering can be turned on/off at runtime, the switchdev driver
0505 must be able to reconfigure the underlying hardware on the fly to honor the
0506 toggling of that option and behave appropriately. If that is not possible, the
0507 switchdev driver can also refuse to support dynamic toggling of the VLAN
0508 filtering knob at runtime and require a destruction of the bridge device(s) and
0509 creation of new bridge device(s) with a different VLAN filtering value to
0510 ensure VLAN awareness is pushed down to the hardware.
0511 
0512 Even when VLAN filtering in the bridge is turned off, the underlying switch
0513 hardware and driver may still configure itself in a VLAN-aware mode provided
0514 that the behavior described above is observed.
0515 
0516 The VLAN protocol of the bridge plays a role in deciding whether a packet is
0517 treated as tagged or not: a bridge using the 802.1ad protocol must treat both
0518 VLAN-untagged packets, as well as packets tagged with 802.1Q headers, as
0519 untagged.
0520 
0521 The 802.1p (VID 0) tagged packets must be treated in the same way by the device
0522 as untagged packets, since the bridge device does not allow the manipulation of
0523 VID 0 in its database.
0524 
0525 When the bridge has VLAN filtering enabled and a PVID is not configured on the
0526 ingress port, untagged and 802.1p tagged packets must be dropped. When the bridge
0527 has VLAN filtering enabled and a PVID exists on the ingress port, untagged and
0528 priority-tagged packets must be accepted and forwarded according to the
0529 bridge's port membership of the PVID VLAN. When the bridge has VLAN filtering
0530 disabled, the presence/lack of a PVID should not influence the packet
0531 forwarding decision.
0532 
0533 Bridge IGMP snooping
0534 ^^^^^^^^^^^^^^^^^^^^
0535 
0536 The Linux bridge allows the configuration of IGMP snooping (statically, at
0537 interface creation time, or dynamically, during runtime) which must be observed
0538 by the underlying switchdev network device/hardware in the following way:
0539 
0540 - when IGMP snooping is turned off, multicast traffic must be flooded to all
0541   ports within the same bridge that have mcast_flood=true. The CPU/management
0542   port should ideally not be flooded (unless the ingress interface has
0543   IFF_ALLMULTI or IFF_PROMISC) and continue to learn multicast traffic through
0544   the network stack notifications. If the hardware is not capable of doing that
0545   then the CPU/management port must also be flooded and multicast filtering
0546   happens in software.
0547 
0548 - when IGMP snooping is turned on, multicast traffic must selectively flow
0549   to the appropriate network ports (including CPU/management port). Flooding of
0550   unknown multicast should be only towards the ports connected to a multicast
0551   router (the local device may also act as a multicast router).
0552 
0553 The switch must adhere to RFC 4541 and flood multicast traffic accordingly
0554 since that is what the Linux bridge implementation does.
0555 
0556 Because IGMP snooping can be turned on/off at runtime, the switchdev driver
0557 must be able to reconfigure the underlying hardware on the fly to honor the
0558 toggling of that option and behave appropriately.
0559 
0560 A switchdev driver can also refuse to support dynamic toggling of the multicast
0561 snooping knob at runtime and require the destruction of the bridge device(s)
0562 and creation of a new bridge device(s) with a different multicast snooping
0563 value.