Laguna: bridge and management port fixes

[troglobit]

Description

Fixes and debug aids for the Laguna (LAN969x) boards, found while bringing the Tactical 1000 into the new test system.

Kernel, from the laguna-bug branch of the kernel tree, on top of kkit-linux-6.18.y:

• Bridge IP address unreachable (patches 0104–0106). Every bridge test on the Tactical rig failed on this. The driver stands in hardware VLAN 1 for a VLAN-unaware bridge, and confd creates bridges with vlan_default_pvid 0, which adds VLAN 1 at creation and removes it right after. That forgot the VID 1 broadcast entry, so ARP from the ports never reached the CPU, and the bridge MAC entry, so unicast to the bridge was flooded to the ports. A third fix stops the driver from forgetting a bridged port's MAC on link down, which cut the bridge off whenever its first port, whose MAC the bridge uses, was disabled. Traced with symreg on the EV23X71A.
• Bridges without VLANs forward nothing (patch 0118). confd creates bridges with vlan_default_pvid 0. In a VLAN-unaware bridge the switch classifies untagged traffic to hardware VID 1, but a port only joins that VLAN when the bridge adds VID 1 to it, which never happens without a default PVID, so the VLAN mask stays empty and every frame between the ports is dropped. Bridge forwarding, STP, IGMP, static multicast filters and LAG-in-bridge tests have failed on every Tactical run for this reason. Reproduced on tact3 with ip link add br0 type bridge vlan_filtering 0 vlan_default_pvid 0 and confirmed with symreg: adding the two ports to ANA_L3_VLAN_MASK_CFG[1] by hand made it forward. 0118 makes every port in a VLAN-unaware bridge a member of that VLAN.
• VLAN interfaces on bridged ports (patch 0119). A VLAN interface on top of a port in a VLAN filtering bridge, as in the VLAN Interface Termination test (e1.10 with the bridge carrying only VLAN 1), never received anything: sparx5 had no ndo_vlan_rx_add_vid, so nothing sent the port address or broadcast in VID 10 to the CPU. 0119 adds those entries when the VLAN interface is created, without making the port a member of the VLAN, so the VLAN stays local and is not bridged, as in software. The bridge's own per-VLAN broadcast entry now shares the same reference count. Proven on tact3 with the two MAC entries written by hand with symreg: ping over e5.10 went from 0/5 to 5/5, and the peer on the other bridge port saw no VLAN 10 traffic.
• Double tags on trunk ports (patch 0120). The IGMP VLAN test could not even ping the other unit's VLAN interface on the bridge over the trunk between them. Frames from the CPU carry their VLAN tag in the frame and VID 0 in the injection header, and on a port without an untagged VLAN the rewriter tagged every frame, VID 0 included, so they left as vlan 0, vlan 55. 0120 uses the "tag all except VID 0" mode on such ports; switched traffic in a VLAN filtering bridge never has VID 0. Proven on tact1 and tact3 e7 with symreg: ping across the trunk went from 0/4 to 4/4 with a single VID 55 tag on the wire.
• LAG offload (patch 0123), based on the LAG support by Daniel Machon, and an MDB fix by Horatiu Vultur, in Microchip's BSP kernel (bsp-6.12-2025), adapted to the mainline 6.18 driver; their sign-offs are kept and the original BSP commits are listed in the patch. Without it, a bond in a bridge did not forward at all: the bond was a software port in an offloaded bridge, unknown unicast from the other bridge ports never reached the CPU, and frames for the bridge arriving on the bond members were dropped. Reproduced between tact1 and tact2: LACP converged and tact1 answered ARP, but the reply never reached tact2. Link Aggregation Basic has failed on every Tactical run for this reason. The adaptation keeps the registers in the mainline regs->gaddr form, folds the LAG source and destination masks into sparx5_update_fwd(), applies the MDB fix to the MDB code in sparx5_switchdev.c, drops the HSR, MRP, XDP and QoS parts of those commits, and lets the bond's switchdev attributes through on its member ports. It includes the BSP's later "allow foreign devices in bridge" (c92187b2b2a5): without it the driver vetoed every non-switch device, veth, VLAN, VXLAN, GRE, WireGuard, from joining any bridge, which failed 22 tests on the first run with 0123. A second regression from the same rework: switchdev_handle_fdb_event_to_device() reaches the driver only through a bridge's member ports, so a bridge address set before any port joins, which is how confd builds bridges, never got its CPU entry and the bridge IP was unreachable. Reproduced on tact2: the MAC set before the port joined gave 0/3 pings, after gave 3/3. 0123 now installs the bridge's own addresses for the CPU directly, as the driver did before.
• STP and LACP frames flooded by the switch (patch 0122). ANA_CL_CAPTURE_BPDU_CFG only discarded pause frames, so every other address in 01-80-C2-00-00-0X was forwarded like ordinary multicast. On a bridged port BPDUs and LACPDUs were flooded to the other ports, so in the STP test's ring each bridge saw BPDUs relayed from bridges that are not its neighbours; Bridge STP Basic and Link Aggregation Basic have failed on every Tactical run. Reproduced on tact3: tact2's BPDUs crossed tact3's bridge to tact4 even with STP enabled on tact3, and stopped once the block was redirected to the CPU with symreg. 0122 redirects the whole block to the CPU on every port and keeps discarding pause frames. The storm from the unbroken loop is also the likely source of the Flush timeout port 5. SRC-MEM queue not empty seen when the STP test tore its bridge down.
• Bridge settings of a VLAN interface applied to the port below (patch 0121). Bridging e5.10 made the switchdev helper pass the bridge port's STP state, flood flags, VLAN filtering and ageing down to e5, which is in no bridge, and the console filled with Controlling non-bridged port 7?. 0121 only takes an attribute for the port itself or for the bridge the port is offloaded to.
• Link aggregates lose their MAC entry (patch 0107). The bond gives both members the first member's address, and the driver keeps one CPU entry per address, so taking one member down, or deleting the aggregate, forgot the entry the other member still used. On the rig this failed the LAG test and then every test over those ports until reboot: tunnels, NTP, PTP, static routing, DHCP. Same fix as 0103, the port addresses now share the reference counted list. Reproduced and traced with symreg on tact1 in the rig.
• Management port "lockups" (patch 0103). All standalone ports share pvid 0, so they share the MAC table entry that delivers a multicast group to the CPU, but the driver forgot it on behalf of a single port. Taking any other standalone port down, or adding it to a bridge, removed the all-nodes and mDNS entries the management port relies on. Frames were received but never forwarded to the CPU, so the unit dropped out of ixll and the test rig until the port was cycled. Fixed by reference counting the shared entries.
• Scheduling while atomic in the same path (patch 0079): ndo_set_rx_mode runs under netif_addr_lock_bh, and the MAC table access took a mutex. Now a spinlock with an atomic poll, as lan966x does. Upstream fixed it via the new ndo_set_rx_mode_async, which 6.18 does not have.
• symreg debugfs driver from Microchip's BSP (patch 0080), for register access by name.
• LAN8814/LAN8804 errata settings (patches 0109, 0110). The copper PHYs on the Tactical 1000 and the EV23X71A run with power-on defaults for registers that Microchip's silicon errata, their PHY API (MEPA) and their BSP kernel all change on every port: power management for center-tapped magnetics (module 4), the EEE wake timer (module 9), and the PLL trim. Mainline applies the first two to the LAN8842 only and the PLL trim to neither. The Tactical PHYs are silicon revision C1. 0109 only moves the LAN8842 tables up so 0110 can reuse them.
• Copper ports with one direction dead (patch 0111). Now and then a Tactical copper port comes up at 1000 Mbps with nothing it sends reaching the far end, while the switch counts every frame out. It hit three ports on three units, all unit-to-unit links. A QSGMII soft reset of the PHY package followed by a down/up of the port brings it back. MEPA runs the same sequence on every port: a QSGMII reset once the MAC has set up its end, then one more aneg after the first 1G link, as a workaround for CRC errors. The kernel resets the QSGMII only at PHY attach, before phylink configures the MAC. 0111 resets the package QSGMII once from config_aneg and restarts aneg once per port on its first 1G link. Not yet verified on the rig: the fault is rare and needs a full run to judge.
• EEE off on the LAN8814/LAN8804 (patch 0112). The PHYs advertise EEE out of reset, so every unit-to-unit link negotiated it, although the switch has no LPI support and phylink only clears PHY EEE for MACs with LPI ops. Errata module 24 has the PHY enter 100BASE-TX LPI by mistake after an unplug. MEPA keeps EEE off by default; so does this.
• Stuck autonegotiation (patch 0113). Errata module 20: the aneg state machine can loop on valid pages from the partner, and the link never comes up. While the link is down, a per-port delayed work checks for signal once a second and restarts aneg once after three seconds of signal without a link, as MEPA does. Without a signal it checks every five seconds. The PHY raises no interrupt in this state, and phylib only polls PHYs without one.
• 10BASE-T, half duplex and forced 100M (patches 0114–0116). Errata module 13: MEPA's two analog settings for the 10BASE-T transmitter. Module 11: late collisions in half duplex; MEPA lowers the rate adaptation FIFO thresholds on 10/100 half-duplex links and resets the FIFOs on link down. The errata lists 11 as fixed in rev C1, which is likely what the Tactical PHYs are, but MEPA applies it on every revision. Module 22: a forced 100BASE-TX link can fail to train; the watchdog from 0113 now also soft-resets the DSP every three seconds while a partner is detected without a link, which keeps the register settings.

Infix side:

• PTP never worked on the Tactical copper ports (patch 0108). Their PHYs read SKU 0x8804, the LAN8804: a LAN8814 without the 1588 unit and with the same chip ID. 6.18 takes them for full LAN8814s, creates PHY clocks and advertises PHY timestamping that never produces a timestamp, so every PTP port faulted on the first Sync. Backport of mainline 61b7ade9ba8c, which checks the SKU register and creates no PTP device on these parts; the kernel then uses the switch core timestamper for them on its own. Boards with real LAN8814s, the EV23X71A, keep stamping at the PHY. On the EV23X71A those PHY timestamps arrive over MDIO later than the 10 ms ptp4l allows, so confd now allows 100 ms with hardware timestamps.
• 802.1AS ports never left LISTENING, every gPTP test on the rig: the measured link delay on the rig exceeded the 800 ns neighbour delay threshold confd hard-coded, so neither end became asCapable. The threshold now defaults to 10 µs with hardware timestamps and mean-link-delay-thresh from the gPTP port data set is honored per port. The default matters on the Tactical, where the switch core stamps behind the PHY and the measured link delay is 1.5 µs; on the EV23X71A the PHY stamps at the wire and the delay is a few hundred ns.
• Permanent port addresses from the VPD (patch 0117). None of the Laguna units have a base MAC in OTP, so every boot gave random port addresses and new link-local addresses, which the test rig finds the units by. Same scheme as the BPI-R3 on main: U-Boot loads /vpd.bin from the aux partition into reserved memory, now also on Laguna, and the device tree describes it as an nvmem-rmem node with an ONIE layout. The switch and every port take their address from it with an offset. sparx5 only numbered ports from the switch base, base + port + 1, so 0117 lets a port's own device tree address override that; the Tactical copper ports run backwards within each quad, and the ports keep the front panel order the rig already uses, e1 at base + 1 and mgmt at base + 29. The addresses are permanent, so confd restores them when a custom MAC is removed, which fixes the custom MAC test. provision-tactical offers to write the file. This needs the Infix FIP from this branch on each unit.
• symreg package, selected by the Laguna boards, with the device tree node in each board's Infix overlay. Usage notes, including how to chase a port fault, in board/aarch64/microchip-lan969x/README.md.
• aarch64_minimal_defconfig lacked the Tactical 1000, EV23X71A and Vero W6m board packages, so PR CI images had no DTB for them and hung after Starting kernel ....
• provision-tactical did not seed uboot.env, so RAUC could not read any boot state on provisioned units.
• kernel-refresh.sh deleted the patch directory it had just regenerated when run for the current kernel version.
• log and follow moved to /etc/profile.d/, so they work in BusyBox ash on minimal builds too.

Risk analysis

Bridge fixes (0104–0106): the VID 1 broadcast entry is now permanent, like the VID 0 one for standalone ports. Standalone ports never classify to VID 1 and PGID_BCAST holds only bridged ports, so it is inert without a bridge. The shared-entry count only covers entries the driver installed itself (locked); auto-learned entries behave as before. Skipping learn and forget on up/down for bridged ports leaves those entries to the bridge FDB notifications the driver already handles; join still forgets the standalone entry and leave still restores it. Upstream has the same three bugs, hidden by the default vlan_default_pvid 1.

Lock conversion (0079): nothing sleeps or takes another lock under sparx5->lock, it nests inside the mutexes and never the reverse, and every caller is process context; the atomic switchdev notifier defers FDB work and never touches the MAC table. A softirq caller would already have been taking a mutex from softirq, so the spinlock tolerates exactly the contexts the mutex had to. Same fix lan966x took in 77bdaf39f3c8. Only behaviour change: a wedged MAC table command busy-waits up to 100 ms instead of sleeping.

Shared CPU entries (0103, 0107): list touched only on group join and leave, port up and down, bridge join and leave, and address change, held across the hardware learn/forget so two ports cannot race on the same entry. Lock order is always mc_cpu_lock then sparx5->lock.

PHY errata (0109–0111): register values are identical to MEPA's after-reset sequence and Microchip's BSP kernel, and mainline already writes the same tables on the LAN8842. 0111 runs once per boot: the package QSGMII reset at the first config_aneg in the package, and one extra aneg round per port at its first 1G link, so each copper port's first link-up after boot takes about three seconds longer. Later ifups are unchanged. At boot the quad's first port, which owns the switch serdes, attaches before its three siblings.

EEE off (0112): no behaviour change for traffic, since the switch never used LPI. Ports stop advertising EEE, so partners that relied on it to save power no longer can.

Aneg watchdog (0113, 0116): runs only while a port is started, link down and autoneg on. An uncabled port costs one MDIO read every five seconds. One restart per link-down period, re-armed on the next link change. Forced 100 Mbps ports are watched too, and get a DSP reset every three seconds while a partner is detected without a link. The work checks the PHY state under phydev->lock and is cancelled on remove.

10BASE-T and half duplex (0114, 0115): values from MEPA's after-reset and link-state code. The half-duplex thresholds only apply to 10/100 half-duplex links, and the FIFO reset on link down restores the defaults. Full-duplex links at any speed are unaffected apart from that reset.

symreg: debugfs only, root only; the driver never probes without its device tree node, so it is inert on non-Laguna boards. The tool bypasses the driver when writing, documented in the README.

Checklist

Tick relevant boxes, this PR is-a or has-a:

• Bugfix
  • Regression tests
  • ChangeLog updates (for next release)
• Feature
  • YANG model change => revision updated?
  • Regression tests added?
  • ChangeLog updates (for next release)
  • Documentation added?
• Test changes
  • Checked in changed Readme.adoc (make test-spec)
  • Added new test to group Readme.adoc and yaml file
• Code style update (formatting, renaming)
• Refactoring (please detail in commit messages)
• Build related changes
• Documentation content changes
  • ChangeLog updated (for major changes)
• Other (please describe): debug tooling (symreg)

🤖 Generated with Claude Code