Bridge Port Isolation not working on DSA

[mweinelt]

The current working theory is that this may be caused by offloading of the bridge port forwarding.

We would need someone to test this theory by disabling the relevant offloading features.

See #2600 (comment)

List of DSA drivers to test/implement:

• mt7530 (ramips-mt7621, mediatek) - linux: net: dsa: mt7530: add support for bridge port isolation #3286
• qca8k (ipq40xx, ipq806x)
• rtl83xx (realtek-rtl838x)
• lantiq-gswip (lantiq-xrx200)
• mv88e6085 (mvebu) - low priority, target is broken
• bcm53125 (sunxi-cortexa7: lamobo-r1) - low priority, device is broken
• Others?

[AiyionPrime]

Note: Bridge Port Isolation does not work on D-Link DGS-1210-10P either.

[AiyionPrime]

While this just simply does not work in Hanover, it randomly breaks mesh connections in Darmstadt.
We concluded, either we get this resolved before an upcoming release or this (as well as it's backport will be reverted, as much as that'd suck).

@NeoRaider intends to experiment on the isolation feature on a FB4040 in the next days/weeks.

[mweinelt]

The current thinking is that the DSA stack does not support bridge port isolation and fails to signal back its incapacity.

[neocturne]

The bridge core supports passing these flags to DSA since Linux 5.19, however very few DSA drivers implement port isolation so far. I've added list of relevant drivers to the issue description.

[olerem]

Hm.. there is still some work to do. I added isolation support for KSZ switches:
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/drivers/net/dsa/microchip?id=a7f08029e2e84ecafbfff50fcff976fafee72799

[neocturne]

@AiyionPrime Missing bridge port isolation should not break any mesh connections, unless you build a ring or similar topology of multiple nodes and STP does not work to prevent a forwarding loop. I would be good to know if that is the case, or something else is going wrong in your deployment.

[AiyionPrime]

I'm from Hanover, the finding was from FF Darmstadt, I think.
I only reported it here, in order not to lose the intel.