[PATCH iproute2-next v2] ip: iplink_bridge: Support fdb_local_vlan_0

[PATCH iproute2-next v2] ip: iplink_bridge: Support fdb_local_vlan_0

[Petr Machata]

Add support for the new bridge option BR_BOOLOPT_FDB_LOCAL_VLAN_0.

Signed-off-by: Petr Machata <petrm@nvidia.com>
---

Notes:
    v2:
    - Maintain RXT in bridge_print_opt()
    - Mention what the default is in the man page.

 ip/iplink_bridge.c    | 19 +++++++++++++++++++
 man/man8/ip-link.8.in | 15 +++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/ip/iplink_bridge.c b/ip/iplink_bridge.c
index 76e69086..af2fc93a 100644
--- a/ip/iplink_bridge.c
+++ b/ip/iplink_bridge.c
@@ -36,6 +36,7 @@ static void print_explain(FILE *f)
 		"		  [ group_fwd_mask MASK ]\n"
 		"		  [ group_address ADDRESS ]\n"
 		"		  [ no_linklocal_learn NO_LINKLOCAL_LEARN ]\n"
+		"		  [ fdb_local_vlan_0 FDB_LOCAL_VLAN_0 ]\n"
 		"		  [ fdb_max_learned FDB_MAX_LEARNED ]\n"
 		"		  [ vlan_filtering VLAN_FILTERING ]\n"
 		"		  [ vlan_protocol VLAN_PROTOCOL ]\n"
@@ -427,6 +428,18 @@ static int bridge_parse_opt(struct link_util *lu, int argc, char **argv,
 				bm.optval |= mofn_bit;
 			else
 				bm.optval &= ~mofn_bit;
+		} else if (strcmp(*argv, "fdb_local_vlan_0") == 0) {
+			__u32 bit = 1 << BR_BOOLOPT_FDB_LOCAL_VLAN_0;
+			__u8 value;
+
+			NEXT_ARG();
+			if (get_u8(&value, *argv, 0))
+				invarg("invalid fdb_local_vlan_0", *argv);
+			bm.optmask |= bit;
+			if (value)
+				bm.optval |= bit;
+			else
+				bm.optval &= ~bit;
 		} else if (matches(*argv, "help") == 0) {
 			explain();
 			return -1;
@@ -635,6 +648,7 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
 
 	if (tb[IFLA_BR_MULTI_BOOLOPT]) {
 		__u32 mofn_bit = 1 << BR_BOOLOPT_MDB_OFFLOAD_FAIL_NOTIFICATION;
+		__u32 fdb_vlan_0_bit = 1 << BR_BOOLOPT_FDB_LOCAL_VLAN_0;
 		__u32 mcvl_bit = 1 << BR_BOOLOPT_MCAST_VLAN_SNOOPING;
 		__u32 no_ll_learn_bit = 1 << BR_BOOLOPT_NO_LL_LEARN;
 		__u32 mst_bit = 1 << BR_BOOLOPT_MST_ENABLE;
@@ -661,6 +675,11 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
 				   "mdb_offload_fail_notification",
 				   "mdb_offload_fail_notification %u ",
 				   !!(bm->optval & mofn_bit));
+		if (bm->optval & fdb_vlan_0_bit)
+			print_uint(PRINT_ANY,
+				   "fdb_local_vlan_0",
+				   "fdb_local_vlan_0 %u ",
+				   !!(bm->optval & fdb_vlan_0_bit));
 	}
 
 	if (tb[IFLA_BR_MCAST_ROUTER])
diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
index e3297c57..9bdb5563 100644
--- a/man/man8/ip-link.8.in
+++ b/man/man8/ip-link.8.in
@@ -1725,6 +1725,8 @@ the following additional arguments are supported:
 ] [
 .BI no_linklocal_learn " NO_LINKLOCAL_LEARN "
 ] [
+.BI fdb_local_vlan_0 " FDB_LOCAL_VLAN_0 "
+] [
 .BI fdb_max_learned " FDB_MAX_LEARNED "
 ] [
 .BI vlan_filtering " VLAN_FILTERING "
@@ -1852,6 +1854,19 @@ or off
 When disabled, the bridge will not learn from link-local frames (default:
 enabled).
 
+.BI fdb_local_vlan_0 " FDB_LOCAL_VLAN_0 "
+When disabled, local FDB entries (i.e. those for member port addresses and
+address of the bridge itself) are kept at VLAN 0 as well as any member VLANs.
+When the option is enabled, they are only kept at VLAN 0. By default the
+option is disabled.
+
+When this option is enabled, when making a forwarding decision, the bridge looks
+at VLAN 0 for a matching entry that is permanent, but not added by user. However
+in all other ways the entry only exists on VLAN 0. This affects dumping, where
+the entries are not shown on non-0 VLANs, and FDB get and flush do not find the
+entry on non-0 VLANs. When the entry is deleted, it affects forwarding on all
+VLANs.
+
 .BI fdb_max_learned " FDB_MAX_LEARNED "
 - set the maximum number of learned FDB entries. If
 .RI ( FDB_MAX_LEARNED " == 0) "
-- 
2.49.0

Re: [PATCH iproute2-next v2] ip: iplink_bridge: Support fdb_local_vlan_0

[Ido Schimmel]

On Tue, Sep 16, 2025 at 06:25:46PM +0200, Petr Machata wrote:
> @@ -635,6 +648,7 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
>  
>  	if (tb[IFLA_BR_MULTI_BOOLOPT]) {
>  		__u32 mofn_bit = 1 << BR_BOOLOPT_MDB_OFFLOAD_FAIL_NOTIFICATION;
> +		__u32 fdb_vlan_0_bit = 1 << BR_BOOLOPT_FDB_LOCAL_VLAN_0;
>  		__u32 mcvl_bit = 1 << BR_BOOLOPT_MCAST_VLAN_SNOOPING;
>  		__u32 no_ll_learn_bit = 1 << BR_BOOLOPT_NO_LL_LEARN;
>  		__u32 mst_bit = 1 << BR_BOOLOPT_MST_ENABLE;
> @@ -661,6 +675,11 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
>  				   "mdb_offload_fail_notification",
>  				   "mdb_offload_fail_notification %u ",
>  				   !!(bm->optval & mofn_bit));
> +		if (bm->optval & fdb_vlan_0_bit)

Shouldn't this be 'bm->optmask' ?

> +			print_uint(PRINT_ANY,
> +				   "fdb_local_vlan_0",
> +				   "fdb_local_vlan_0 %u ",
> +				   !!(bm->optval & fdb_vlan_0_bit));
>  	}
>  
>  	if (tb[IFLA_BR_MCAST_ROUTER])

Re: [PATCH iproute2-next v2] ip: iplink_bridge: Support fdb_local_vlan_0

[Petr Machata]

Ido Schimmel <idosch@nvidia.com> writes:

> On Tue, Sep 16, 2025 at 06:25:46PM +0200, Petr Machata wrote:
>> @@ -635,6 +648,7 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
>>  
>>  	if (tb[IFLA_BR_MULTI_BOOLOPT]) {
>>  		__u32 mofn_bit = 1 << BR_BOOLOPT_MDB_OFFLOAD_FAIL_NOTIFICATION;
>> +		__u32 fdb_vlan_0_bit = 1 << BR_BOOLOPT_FDB_LOCAL_VLAN_0;
>>  		__u32 mcvl_bit = 1 << BR_BOOLOPT_MCAST_VLAN_SNOOPING;
>>  		__u32 no_ll_learn_bit = 1 << BR_BOOLOPT_NO_LL_LEARN;
>>  		__u32 mst_bit = 1 << BR_BOOLOPT_MST_ENABLE;
>> @@ -661,6 +675,11 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
>>  				   "mdb_offload_fail_notification",
>>  				   "mdb_offload_fail_notification %u ",
>>  				   !!(bm->optval & mofn_bit));
>> +		if (bm->optval & fdb_vlan_0_bit)
>
> Shouldn't this be 'bm->optmask' ?

It should.