[PATCH net-next v2 0/4] net: dsa: mt7628 embedded switch initial support

[PATCH net-next v2 0/4] net: dsa: mt7628 embedded switch initial support

[Joris Vaisvila]

Hello,

This patch series adds initial support for the MediaTek MT7628 Embedded
Switch.

The driver implements the basic functionality required to operate the
switch using DSA. The hardware provides five internal Fast Ethernet user
ports and one Gigabit port connected internally to the CPU MAC.

Bridge offloading is not yet supported.

Tested on an MT7628NN-based board.

changes since v1:
	- changed port 6 phy-mode to internal
	- cleaned up tag_mt7628 rcv function and mask defines
	- fixed sorting error in drivers/net/dsa/ Kconfig and Makefile
	- fixed sorting error in net/dsa/ Kconfig and Makefile
	- fixed mt7628_mii_read/write return values on error
Link: https://lore.kernel.org/netdev/20260326204413.3317584-1-joey@tinyisr.com/t/#u

Thanks,
Joris


Joris Vaisvila (4):
  dt-bindings: net: dsa: add MT7628 ESW
  net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet
    PHYs
  net: dsa: initial MT7628 tagging driver
  net: dsa: initial support for MT7628 embedded switch

 .../bindings/net/dsa/mediatek,mt7628-esw.yaml | 101 +++
 drivers/net/dsa/Kconfig                       |   8 +
 drivers/net/dsa/Makefile                      |   1 +
 drivers/net/dsa/mt7628.c                      | 627 ++++++++++++++++++
 drivers/net/phy/mediatek/Kconfig              |  10 +-
 drivers/net/phy/mediatek/Makefile             |   1 +
 drivers/net/phy/mediatek/mtk-fe-soc.c         |  50 ++
 include/net/dsa.h                             |   2 +
 net/dsa/Kconfig                               |   6 +
 net/dsa/Makefile                              |   1 +
 net/dsa/tag_mt7628.c                          |  89 +++
 11 files changed, 895 insertions(+), 1 deletion(-)
 create mode 100644 Documentation/devicetree/bindings/net/dsa/mediatek,mt7628-esw.yaml
 create mode 100644 drivers/net/dsa/mt7628.c
 create mode 100644 drivers/net/phy/mediatek/mtk-fe-soc.c
 create mode 100644 net/dsa/tag_mt7628.c

-- 
2.53.0

[PATCH net-next v2 1/4] dt-bindings: net: dsa: add MT7628 ESW

[Joris Vaisvila]

Add bindings for MT7628 SoC's Embedded Switch.

Signed-off-by: Joris Vaisvila <joey@tinyisr.com>
---
 .../bindings/net/dsa/mediatek,mt7628-esw.yaml | 101 ++++++++++++++++++
 1 file changed, 101 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/net/dsa/mediatek,mt7628-esw.yaml

diff --git a/Documentation/devicetree/bindings/net/dsa/mediatek,mt7628-esw.yaml b/Documentation/devicetree/bindings/net/dsa/mediatek,mt7628-esw.yaml
new file mode 100644
index 000000000000..d6c66ab677d0
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/dsa/mediatek,mt7628-esw.yaml
@@ -0,0 +1,101 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/net/dsa/mediatek,mt7628-esw.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Mediatek MT7628 Embedded Ethernet Switch
+
+maintainers:
+  - Joris Vaisvila <joey@tinyisr.com>
+
+description:
+  The MT7628 SoC's built-in Ethernet Switch is a five port switch with
+  integrated 10/100 PHYs. The switch registers are directly mapped in the SoC's
+  memory. The switch has an internally connected 1G CPU port and 5 user ports
+  connected to the built-in Fast Ethernet PHYs.
+
+unevaluatedProperties: false
+
+allOf:
+  - $ref: dsa.yaml#/$defs/ethernet-ports
+
+properties:
+  compatible:
+    const: mediatek,mt7628-esw
+
+  reg:
+    maxItems: 1
+    description: MMIO address of the switch
+
+  resets:
+    items:
+      - description: Phandle of system reset controller with ESW reset index
+      - description: Phandle of system reset controller with EPHY reset index
+
+  reset-names:
+    items:
+      - const: esw
+      - const: ephy
+
+  mdio:
+    $ref: /schemas/net/mdio.yaml#
+    unevaluatedProperties: false
+
+required:
+  - compatible
+  - reg
+  - resets
+  - reset-names
+
+examples:
+  - |
+    switch0: switch@10110000 {
+        reg = <0x10110000 0x8000>;
+
+        resets = <&sysc 23>, <&sysc 24>;
+        reset-names = "esw", "ephy";
+
+        compatible = "mediatek,mt7628-esw";
+
+        ports {
+            #address-cells = <1>;
+            #size-cells = <0>;
+
+            port@0 {
+                reg = <0>;
+                phy-mode = "internal";
+            };
+
+            port@1 {
+                reg = <1>;
+                phy-mode = "internal";
+            };
+
+            port@2 {
+                reg = <2>;
+                phy-mode = "internal";
+            };
+
+            port@3 {
+                reg = <3>;
+                phy-mode = "internal";
+            };
+
+            port@4 {
+                reg = <4>;
+                phy-mode = "internal";
+            };
+
+            port@6 {
+                reg = <6>;
+                phy-mode = "internal";
+                ethernet = <&ethernet>;
+
+                fixed-link {
+                    speed = <1000>;
+                    full-duplex;
+                };
+            };
+        };
+    };
-- 
2.53.0

[PATCH net-next v2 2/4] net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs

[Joris Vaisvila]

The Fast Ethernet PHYs present in the MT7628 SoCs require an
undocumented bit to be set before they can establish 100mbps links.

This commit adds the Kconfig option MEDIATEK_FE_SOC_PHY and the
corresponding driver mtk-fe-soc.c.

Signed-off-by: Joris Vaisvila <joey@tinyisr.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
---
 drivers/net/phy/mediatek/Kconfig      | 10 +++++-
 drivers/net/phy/mediatek/Makefile     |  1 +
 drivers/net/phy/mediatek/mtk-fe-soc.c | 50 +++++++++++++++++++++++++++
 3 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 drivers/net/phy/mediatek/mtk-fe-soc.c

diff --git a/drivers/net/phy/mediatek/Kconfig b/drivers/net/phy/mediatek/Kconfig
index bb7dc876271e..b6a51f38c358 100644
--- a/drivers/net/phy/mediatek/Kconfig
+++ b/drivers/net/phy/mediatek/Kconfig
@@ -21,8 +21,16 @@ config MEDIATEK_GE_PHY
 	  common operations with MediaTek SoC built-in Gigabit
 	  Ethernet PHYs.
 
+config MEDIATEK_FE_SOC_PHY
+	tristate "MediaTek SoC Fast Ethernet PHYs"
+	help
+	  Support for MediaTek MT7628 built-in Fast Ethernet PHYs.
+	  This driver only sets an initialization bit required for the PHY
+	  to establish 100 Mbps links. All other PHY operations are handled
+	  by the kernel's generic PHY code.
+
 config MEDIATEK_GE_SOC_PHY
-	tristate "MediaTek SoC Ethernet PHYs"
+	tristate "MediaTek SoC Gigabit Ethernet PHYs"
 	depends on ARM64 || COMPILE_TEST
 	depends on ARCH_AIROHA || (ARCH_MEDIATEK && NVMEM_MTK_EFUSE) || \
 		   COMPILE_TEST
diff --git a/drivers/net/phy/mediatek/Makefile b/drivers/net/phy/mediatek/Makefile
index ac57ecc799fc..6f9cacf7f906 100644
--- a/drivers/net/phy/mediatek/Makefile
+++ b/drivers/net/phy/mediatek/Makefile
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_MEDIATEK_2P5GE_PHY)	+= mtk-2p5ge.o
+obj-$(CONFIG_MEDIATEK_FE_SOC_PHY)	+= mtk-fe-soc.o
 obj-$(CONFIG_MEDIATEK_GE_PHY)		+= mtk-ge.o
 obj-$(CONFIG_MEDIATEK_GE_SOC_PHY)	+= mtk-ge-soc.o
 obj-$(CONFIG_MTK_NET_PHYLIB)		+= mtk-phy-lib.o
diff --git a/drivers/net/phy/mediatek/mtk-fe-soc.c b/drivers/net/phy/mediatek/mtk-fe-soc.c
new file mode 100644
index 000000000000..317944411fbe
--- /dev/null
+++ b/drivers/net/phy/mediatek/mtk-fe-soc.c
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Driver for MT7628 Embedded Switch internal Fast Ethernet PHYs
+ */
+#include <linux/module.h>
+#include <linux/phy.h>
+
+#define MTK_FPHY_ID_MT7628	0x03a29410
+#define MTK_EXT_PAGE_ACCESS	0x1f
+
+static int mt7628_phy_read_page(struct phy_device *phydev)
+{
+	return __phy_read(phydev, MTK_EXT_PAGE_ACCESS);
+}
+
+static int mt7628_phy_write_page(struct phy_device *phydev, int page)
+{
+	return __phy_write(phydev, MTK_EXT_PAGE_ACCESS, page);
+}
+
+static int mt7628_phy_config_init(struct phy_device *phydev)
+{
+	/*
+	 * This undocumented bit is required for the PHYs to be able to
+	 * establish 100mbps links.
+	 */
+	return phy_write_paged(phydev, 0x8000, 30, BIT(13));
+}
+
+static struct phy_driver mtk_soc_fe_phy_driver[] = {
+	{
+		PHY_ID_MATCH_EXACT(MTK_FPHY_ID_MT7628),
+		.name = "MediaTek MT7628 PHY",
+		.config_init = mt7628_phy_config_init,
+		.read_page = mt7628_phy_read_page,
+		.write_page = mt7628_phy_write_page,
+	},
+};
+
+module_phy_driver(mtk_soc_fe_phy_driver);
+static const struct mdio_device_id __maybe_unused mtk_soc_fe_phy_tbl[] = {
+	{ PHY_ID_MATCH_EXACT(MTK_FPHY_ID_MT7628) },
+	{ }
+};
+
+MODULE_DESCRIPTION("MediaTek SoC Fast Ethernet PHY driver");
+MODULE_AUTHOR("Joris Vaisvila <joey@tinyisr.com>");
+MODULE_LICENSE("GPL");
+
+MODULE_DEVICE_TABLE(mdio, mtk_soc_fe_phy_tbl);
-- 
2.53.0

[PATCH net-next v2 3/4] net: dsa: initial MT7628 tagging driver

[Joris Vaisvila]

Add support for the MT7628 embedded switch's tag.

The MT7628 tag is merged with the VLAN TPID field when a VLAN is
appended by the switch hardware. It is not installed if the VLAN tag is
already there on ingress. Due to this hardware quirk the tag cannot be
trusted for port 0 if we don't know that the VLAN was added by the
hardware. As a workaround for this the switch is configured to always
append the port PVID tag even if the incoming packet is already tagged.
The tagging driver can then trust that the tag is always accurate and
the whole VLAN tag can be removed on ingress as it's only metadata for
the tagger.

On egress the MT7628 tag allows precise TX, but the correct VLAN tag
from tag_8021q is still appended or the switch will not forward the
packet.

Signed-off-by: Joris Vaisvila <joey@tinyisr.com>
---
 include/net/dsa.h    |  2 +
 net/dsa/Kconfig      |  6 +++
 net/dsa/Makefile     |  1 +
 net/dsa/tag_mt7628.c | 89 ++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 98 insertions(+)
 create mode 100644 net/dsa/tag_mt7628.c

diff --git a/include/net/dsa.h b/include/net/dsa.h
index 6c17446f3dcc..e93f9356b5c3 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -58,6 +58,7 @@ struct tc_action;
 #define DSA_TAG_PROTO_YT921X_VALUE		30
 #define DSA_TAG_PROTO_MXL_GSW1XX_VALUE		31
 #define DSA_TAG_PROTO_MXL862_VALUE		32
+#define DSA_TAG_PROTO_MT7628_VALUE		33
 
 enum dsa_tag_protocol {
 	DSA_TAG_PROTO_NONE		= DSA_TAG_PROTO_NONE_VALUE,
@@ -93,6 +94,7 @@ enum dsa_tag_protocol {
 	DSA_TAG_PROTO_YT921X		= DSA_TAG_PROTO_YT921X_VALUE,
 	DSA_TAG_PROTO_MXL_GSW1XX	= DSA_TAG_PROTO_MXL_GSW1XX_VALUE,
 	DSA_TAG_PROTO_MXL862		= DSA_TAG_PROTO_MXL862_VALUE,
+	DSA_TAG_PROTO_MT7628		= DSA_TAG_PROTO_MT7628_VALUE,
 };
 
 struct dsa_switch;
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index 5ed8c704636d..946f44f0b843 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -98,6 +98,12 @@ config NET_DSA_TAG_EDSA
 	  Say Y or M if you want to enable support for tagging frames for the
 	  Marvell switches which use EtherType DSA headers.
 
+config NET_DSA_TAG_MT7628
+	tristate "Tag driver for the MT7628 embedded switch"
+	help
+	  Say Y or M if you want to enable support for tagging frames for the
+	  switch embedded in the MT7628 SoC.
+
 config NET_DSA_TAG_MTK
 	tristate "Tag driver for Mediatek switches"
 	help
diff --git a/net/dsa/Makefile b/net/dsa/Makefile
index bf7247759a64..a84f33f0963d 100644
--- a/net/dsa/Makefile
+++ b/net/dsa/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_NET_DSA_TAG_GSWIP) += tag_gswip.o
 obj-$(CONFIG_NET_DSA_TAG_HELLCREEK) += tag_hellcreek.o
 obj-$(CONFIG_NET_DSA_TAG_KSZ) += tag_ksz.o
 obj-$(CONFIG_NET_DSA_TAG_LAN9303) += tag_lan9303.o
+obj-$(CONFIG_NET_DSA_TAG_MT7628) += tag_mt7628.o
 obj-$(CONFIG_NET_DSA_TAG_MTK) += tag_mtk.o
 obj-$(CONFIG_NET_DSA_TAG_MXL_862XX) += tag_mxl862xx.o
 obj-$(CONFIG_NET_DSA_TAG_MXL_GSW1XX) += tag_mxl-gsw1xx.o
diff --git a/net/dsa/tag_mt7628.c b/net/dsa/tag_mt7628.c
new file mode 100644
index 000000000000..f0e346595f30
--- /dev/null
+++ b/net/dsa/tag_mt7628.c
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026, Joris Vaisvila <joey@tinyisr.com>
+ * MT7628 switch tag support
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/dsa/8021q.h>
+#include <net/dsa.h>
+
+#include "tag.h"
+
+/*
+ * The MT7628 tag is encoded in the VLAN TPID field.
+ * On TX the lower 6 bits encode the destination port bitmask.
+ * On RX the lower 3 bits encode the source port number.
+ *
+ * The switch hardware will not modify the TPID of an incoming packet if it is
+ * already VLAN tagged. To work around this the switch is configured to always
+ * append a tag_8021q standalone VLAN tag for each port. That means we can
+ * safely strip the outer VLAN tag after parsing it.
+ *
+ * A VLAN tag is constructed on egress to target the standalone VLAN and
+ * destination port.
+ */
+
+#define MT7628_TAG_NAME "mt7628"
+
+#define MT7628_TAG_TX_PORT GENMASK(5, 0)
+#define MT7628_TAG_RX_PORT GENMASK(2, 0)
+#define MT7628_TAG_LEN 4
+
+static struct sk_buff *mt7628_tag_xmit(struct sk_buff *skb,
+				       struct net_device *dev)
+{
+	struct dsa_port *dp;
+	u16 xmit_vlan;
+	__be16 *tag;
+
+	dp = dsa_user_to_port(dev);
+	xmit_vlan = dsa_tag_8021q_standalone_vid(dp);
+
+	skb_push(skb, MT7628_TAG_LEN);
+	dsa_alloc_etype_header(skb, MT7628_TAG_LEN);
+
+	tag = dsa_etype_header_pos_tx(skb);
+
+	tag[0] = htons(ETH_P_8021Q |
+		       FIELD_PREP(MT7628_TAG_TX_PORT,
+				  dsa_xmit_port_mask(skb, dev)));
+	tag[1] = htons(xmit_vlan);
+
+	return skb;
+}
+
+static struct sk_buff *mt7628_tag_rcv(struct sk_buff *skb,
+				      struct net_device *dev)
+{
+	__be16 *phdr;
+
+	if (unlikely(!pskb_may_pull(skb, MT7628_TAG_LEN)))
+		return NULL;
+
+	phdr = dsa_etype_header_pos_rx(skb);
+	skb->dev =
+	    dsa_conduit_find_user(dev, 0,
+				  FIELD_GET(MT7628_TAG_RX_PORT, ntohs(*phdr)));
+	if (!skb->dev)
+		return NULL;
+
+	skb_pull_rcsum(skb, MT7628_TAG_LEN);
+	dsa_strip_etype_header(skb, MT7628_TAG_LEN);
+	dsa_default_offload_fwd_mark(skb);
+	return skb;
+}
+
+static const struct dsa_device_ops mt7628_tag_ops = {
+	.name = MT7628_TAG_NAME,
+	.proto = DSA_TAG_PROTO_MT7628,
+	.xmit = mt7628_tag_xmit,
+	.rcv = mt7628_tag_rcv,
+	.needed_headroom = MT7628_TAG_LEN,
+};
+
+module_dsa_tag_driver(mt7628_tag_ops);
+
+MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_MT7628, MT7628_TAG_NAME);
+MODULE_DESCRIPTION("DSA tag driver for MT7628 switch");
+MODULE_LICENSE("GPL");
-- 
2.53.0

[PATCH net-next v2 4/4] net: dsa: initial support for MT7628 embedded switch

[Joris Vaisvila]

Add support for the MT7628 embedded switch.

The switch has 5 built-in 100Mbps user ports (ports 0-4) and one 1Gbps
port that is internally attached to the SoCs CPU MAC and serves as the
CPU port.

The switch hardware has a very limited 16 entry VLAN table. Configuring
VLANs is the only way to control switch forwarding. Currently 6 entries
are used by tag_8021q to isolate the ports. Double tag feature is
enabled to force the switch to append the VLAN tag even if the incoming
packet is already tagged, this simulates VLAN-unaware functionality and
simplifies the tagger implementation.

Signed-off-by: Joris Vaisvila <joey@tinyisr.com>
---
 drivers/net/dsa/Kconfig  |   8 +
 drivers/net/dsa/Makefile |   1 +
 drivers/net/dsa/mt7628.c | 627 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 636 insertions(+)
 create mode 100644 drivers/net/dsa/mt7628.c

diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
index 39fb8ead16b5..defe74625cef 100644
--- a/drivers/net/dsa/Kconfig
+++ b/drivers/net/dsa/Kconfig
@@ -28,6 +28,14 @@ source "drivers/net/dsa/hirschmann/Kconfig"
 
 source "drivers/net/dsa/lantiq/Kconfig"
 
+config NET_DSA_MT7628
+	tristate "MediaTek MT7628 Embedded Ethernet switch support"
+	select NET_DSA_TAG_MT7628
+	select MEDIATEK_FE_SOC_PHY
+	help
+	  This enables support for the built-in Ethernet switch found
+	  in the MT7628 SoC.
+
 config NET_DSA_MT7530
 	tristate "MediaTek MT7530 and MT7531 Ethernet switch support"
 	select NET_DSA_TAG_MTK
diff --git a/drivers/net/dsa/Makefile b/drivers/net/dsa/Makefile
index f5a463b87ec2..8d4461f2d437 100644
--- a/drivers/net/dsa/Makefile
+++ b/drivers/net/dsa/Makefile
@@ -6,6 +6,7 @@ obj-$(CONFIG_NET_DSA_KS8995) 	+= ks8995.o
 obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
 obj-$(CONFIG_NET_DSA_MT7530_MDIO) += mt7530-mdio.o
 obj-$(CONFIG_NET_DSA_MT7530_MMIO) += mt7530-mmio.o
+obj-$(CONFIG_NET_DSA_MT7628) += mt7628.o
 obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
 obj-$(CONFIG_NET_DSA_RZN1_A5PSW) += rzn1_a5psw.o
 obj-$(CONFIG_NET_DSA_SMSC_LAN9303) += lan9303-core.o
diff --git a/drivers/net/dsa/mt7628.c b/drivers/net/dsa/mt7628.c
new file mode 100644
index 000000000000..36461b39ea4a
--- /dev/null
+++ b/drivers/net/dsa/mt7628.c
@@ -0,0 +1,627 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Mediatek MT7628 Embedded Switch (ESW) DSA driver
+ * Copyright (C) 2026 Joris Vaisvila <joey@tinyisr.com>
+ *
+ * Portions derived from OpenWRT esw_rt3050 driver:
+ * Copyright (C) 2009-2015 John Crispin <blogic@openwrt.org>
+ * Copyright (C) 2009-2015 Felix Fietkau <nbd@nbd.name>
+ * Copyright (C) 2013-2015 Michael Lee <igvtee@gmail.com>
+ * Copyright (C) 2016 Vittorio Gambaletta <openwrt@vittgam.net>
+ */
+
+#include <linux/platform_device.h>
+#include <linux/etherdevice.h>
+#include <linux/netdevice.h>
+#include <linux/dsa/8021q.h>
+#include <linux/if_bridge.h>
+#include <linux/module.h>
+#include <linux/mdio.h>
+#include <linux/of.h>
+#include <linux/of_mdio.h>
+#include <linux/of_net.h>
+#include <linux/kernel.h>
+#include <linux/regmap.h>
+#include <linux/reset.h>
+#include <net/dsa.h>
+
+#define MT7628_ESW_REG_IMR 0x04
+#define MT7628_ESW_REG_FCT0 0x08
+#define MT7628_ESW_REG_PFC1 0x14
+#define MT7628_ESW_REG_PVIDC(port) (0x40 + 4 * ((port) / 2))
+#define MT7628_ESW_REG_VLANI(vlan) (0x50 + 4 * ((vlan) / 2))
+#define MT7628_ESW_REG_VMSC(vlan) (0x70 + 4 * ((vlan) / 4))
+#define MT7628_ESW_REG_VUB(vlan) (0x100 + 4 * ((vlan) / 4))
+#define MT7628_ESW_REG_SOCPC 0x8c
+#define MT7628_ESW_REG_POC0 0x90
+#define MT7628_ESW_REG_POC2 0x98
+#define MT7628_ESW_REG_SGC 0x9c
+#define MT7628_ESW_REG_PCR0 0xc0
+#define MT7628_ESW_REG_PCR1 0xc4
+#define MT7628_ESW_REG_FPA2 0xc8
+#define MT7628_ESW_REG_FCT2 0xcc
+#define MT7628_ESW_REG_SGC2 0xe4
+
+#define MT7628_ESW_FCT0_DROP_SET_TH GENMASK(7, 0)
+#define MT7628_ESW_FCT0_DROP_RLS_TH GENMASK(15, 8)
+#define MT7628_ESW_FCT0_FC_SET_TH GENMASK(23, 16)
+#define MT7628_ESW_FCT0_FC_RLS_TH GENMASK(31, 24)
+
+#define MT7628_ESW_PFC1_EN_VLAN GENMASK(22, 16)
+
+#define MT7628_ESW_PVID_S 12
+#define MT7628_ESW_PVID_M GENMASK(11, 0)
+#define MT7628_ESW_PVID_SHIFT(port) \
+	(MT7628_ESW_PVID_S * ((port) % 2))
+#define MT7628_ESW_PVID_MASK(port) \
+	(MT7628_ESW_PVID_M << MT7628_ESW_PVID_SHIFT(port))
+#define MT7628_ESW_PVID_PREP(port, pvid) \
+	(((pvid) & MT7628_ESW_PVID_M) << MT7628_ESW_PVID_SHIFT(port))
+
+#define MT7628_ESW_VID_S 12
+#define MT7628_ESW_VID_M GENMASK(11, 0)
+#define MT7628_ESW_VID_SHIFT(vlan) \
+	(MT7628_ESW_VID_S * ((vlan) % 2))
+#define MT7628_ESW_VID_MASK(vlan) \
+	(MT7628_ESW_VID_M << MT7628_ESW_VID_SHIFT(vlan))
+#define MT7628_ESW_VID_PREP(vlan, vid) \
+	(((vid) & MT7628_ESW_VID_M) << MT7628_ESW_VID_SHIFT(vlan))
+
+#define MT7628_ESW_VMSC_S 8
+#define MT7628_ESW_VMSC_M GENMASK(7, 0)
+#define MT7628_ESW_VMSC_SHIFT(vlan) \
+	(MT7628_ESW_VMSC_S * ((vlan) % 4))
+#define MT7628_ESW_VMSC_MASK(vlan) \
+	(MT7628_ESW_VMSC_M << MT7628_ESW_VMSC_SHIFT(vlan))
+#define MT7628_ESW_VMSC_PREP(vlan, vmsc) \
+	(((vmsc) & MT7628_ESW_VMSC_M) << MT7628_ESW_VMSC_SHIFT(vlan))
+
+#define MT7628_ESW_VUB_S 7
+#define MT7628_ESW_VUB_M GENMASK(6, 0)
+#define MT7628_ESW_VUB_SHIFT(vlan) \
+	(MT7628_ESW_VUB_S * ((vlan) % 4))
+#define MT7628_ESW_VUB_MASK(vlan) \
+	(MT7628_ESW_VUB_M << MT7628_ESW_VUB_SHIFT(vlan))
+#define MT7628_ESW_VUB_PREP(vlan, vub) \
+	(((vub) & MT7628_ESW_VUB_M) << MT7628_ESW_VUB_SHIFT(vlan))
+
+#define MT7628_ESW_SOCPC_CRC_PADDING BIT(25)
+#define MT7628_ESW_SOCPC_DISBC2CPU GENMASK(22, 16)
+#define MT7628_ESW_SOCPC_DISMC2CPU GENMASK(14, 8)
+#define MT7628_ESW_SOCPC_DISUN2CPU GENMASK(6, 0)
+
+#define MT7628_ESW_POC0_PORT_DISABLE GENMASK(29, 23)
+
+#define MT7628_ESW_POC2_PER_VLAN_UNTAG_EN BIT(15)
+
+#define MT7628_ESW_SGC_AGING_INTERVAL GENMASK(3, 0)
+#define MT7628_ESW_BC_STORM_PROT GENMASK(5, 4)
+#define MT7628_ESW_PKT_MAX_LEN GENMASK(7, 6)
+#define MT7628_ESW_DIS_PKT_ABORT BIT(8)
+#define MT7628_ESW_ADDRESS_HASH_ALG GENMASK(10, 9)
+#define MT7628_ESW_DISABLE_TX_BACKOFF BIT(11)
+#define MT7628_ESW_BP_JAM_CNT GENMASK(15, 12)
+#define MT7628_ESW_DISMIIPORT_WASTX GENMASK(17, 16)
+#define MT7628_ESW_BP_MODE GENMASK(19, 18)
+#define MT7628_ESW_BISH_DIS BIT(20)
+#define MT7628_ESW_BISH_TH GENMASK(22, 21)
+#define MT7628_ESW_LED_FLASH_TIME GENMASK(24, 23)
+#define MT7628_ESW_RMC_RULE GENMASK(26, 25)
+#define MT7628_ESW_IP_MULT_RULE GENMASK(28, 27)
+#define MT7628_ESW_LEN_ERR_CHK BIT(29)
+#define MT7628_ESW_BKOFF_ALG BIT(30)
+
+#define MT7628_ESW_PCR0_WT_NWAY_DATA GENMASK(31, 16)
+#define MT7628_ESW_PCR0_RD_PHY_CMD BIT(14)
+#define MT7628_ESW_PCR0_WT_PHY_CMD BIT(13)
+#define MT7628_ESW_PCR0_CPU_PHY_REG GENMASK(12, 8)
+#define MT7628_ESW_PCR0_CPU_PHY_ADDR GENMASK(4, 0)
+
+#define MT7628_ESW_PCR1_RD_DATA GENMASK(31, 16)
+#define MT7628_ESW_PCR1_RD_DONE BIT(1)
+#define MT7628_ESW_PCR1_WT_DONE BIT(0)
+
+#define MT7628_ESW_FPA2_AP_EN BIT(29)
+#define MT7628_ESW_FPA2_EXT_PHY_ADDR_BASE GENMASK(28, 24)
+#define MT7628_ESW_FPA2_FORCE_RGMII_LINK1 BIT(13)
+#define MT7628_ESW_FPA2_FORCE_RGMII_EN1 BIT(11)
+
+#define MT7628_ESW_FCT2_MUST_DROP_RLS_TH GENMASK(17, 13)
+#define MT7628_ESW_FCT2_MUST_DROP_SET_TH GENMASK(12, 8)
+#define MT7628_ESW_FCT2_MC_PER_PORT_TH GENMASK(5, 0)
+
+#define MT7628_ESW_SGC2_SPECIAL_TAG_EN BIT(23)
+#define MT7628_ESW_SGC2_TX_CPU_TPID_BIT_MAP GENMASK(22, 16)
+#define MT7628_ESW_SGC2_DOUBLE_TAG_EN GENMASK(6, 0)
+
+#define MT7628_ESW_PORTS_NOCPU GENMASK(5, 0)
+#define MT7628_ESW_PORTS_CPU BIT(6)
+#define MT7628_ESW_PORTS_ALL GENMASK(6, 0)
+
+#define MT7628_ESW_NUM_PORTS 7
+#define MT7628_NUM_VLANS 16
+
+static const struct regmap_config mt7628_esw_regmap_cfg = {
+	.name = "mt7628-esw",
+	.reg_bits = 32,
+	.val_bits = 32,
+	.reg_stride = 4,
+	.fast_io = true,
+	.reg_format_endian = REGMAP_ENDIAN_LITTLE,
+	.val_format_endian = REGMAP_ENDIAN_LITTLE,
+};
+
+struct mt7628_vlan {
+	bool active;
+	u8 members;
+	u8 untag;
+	u16 vid;
+};
+
+struct mt7628_esw {
+	void __iomem *base;
+	struct reset_control *rst_ephy;
+	struct reset_control *rst_esw;
+	struct regmap *regmap;
+	struct dsa_switch *ds;
+	u16 tag_8021q_pvid[MT7628_ESW_NUM_PORTS];
+	struct mt7628_vlan vlans[MT7628_NUM_VLANS];
+	struct device *dev;
+};
+
+static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)
+{
+	struct mt7628_esw *esw = bus->priv;
+	int ret;
+	u32 val;
+
+	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
+				       !(val & MT7628_ESW_PCR1_RD_DONE), 10,
+				       5000);
+	if (ret)
+		goto out;
+
+	ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
+			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
+				      regnum) |
+			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
+				      port) | MT7628_ESW_PCR0_RD_PHY_CMD);
+	if (ret)
+		goto out;
+
+	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
+				       (val & MT7628_ESW_PCR1_RD_DONE), 10,
+				       5000);
+out:
+	if (ret) {
+		dev_err(&bus->dev, "read failed. MDIO timeout?\n");
+		return ret;
+	}
+	return FIELD_GET(MT7628_ESW_PCR1_RD_DATA, val);
+}
+
+static int mt7628_mii_write(struct mii_bus *bus, int port, int regnum, u16 dat)
+{
+	struct mt7628_esw *esw = bus->priv;
+	u32 val;
+	int ret;
+
+	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
+				       !(val & MT7628_ESW_PCR1_WT_DONE), 10,
+				       5000);
+	if (ret)
+		goto out;
+
+	ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
+			   FIELD_PREP(MT7628_ESW_PCR0_WT_NWAY_DATA, dat) |
+			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
+				      regnum) |
+			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
+				      port) | MT7628_ESW_PCR0_WT_PHY_CMD);
+	if (ret)
+		goto out;
+
+	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
+				       (val & MT7628_ESW_PCR1_WT_DONE), 10,
+				       5000);
+out:
+	if (ret) {
+		dev_err(&bus->dev, "write failed. MDIO timeout?\n");
+		return ret;
+	}
+	return 0;
+}
+
+static int mt7628_setup_internal_mdio(struct dsa_switch *ds)
+{
+	struct mt7628_esw *esw = ds->priv;
+	struct device_node *mdio;
+	struct mii_bus *bus;
+	int ret = 0;
+
+	mdio = of_get_available_child_by_name(ds->dev->of_node, "mdio");
+
+	bus = devm_mdiobus_alloc(esw->dev);
+	if (!bus) {
+		ret = -ENOMEM;
+		goto out_put_node;
+	}
+
+	bus->name = "MT7628 internal MDIO bus";
+	snprintf(bus->id, MII_BUS_ID_SIZE, "%s-mii", dev_name(ds->dev));
+	bus->priv = esw;
+	bus->read = mt7628_mii_read;
+	bus->write = mt7628_mii_write;
+	bus->parent = esw->dev;
+	if (!mdio) {
+		ds->user_mii_bus = bus;
+		bus->phy_mask = ~ds->phys_mii_mask;
+	}
+
+	ret = devm_of_mdiobus_register(esw->dev, bus, mdio);
+
+out_put_node:
+	of_node_put(mdio);
+	return ret;
+}
+
+static void mt7628_switch_init(struct dsa_switch *ds)
+{
+	struct mt7628_esw *esw = ds->priv;
+
+	regmap_write(esw->regmap, MT7628_ESW_REG_FCT0,
+		     FIELD_PREP(MT7628_ESW_FCT0_DROP_SET_TH, 0x50) |
+		     FIELD_PREP(MT7628_ESW_FCT0_DROP_RLS_TH, 0x78) |
+		     FIELD_PREP(MT7628_ESW_FCT0_FC_SET_TH, 0xa0) |
+		     FIELD_PREP(MT7628_ESW_FCT0_FC_RLS_TH, 0xc8));
+
+	regmap_write(esw->regmap, MT7628_ESW_REG_FCT2,
+		     FIELD_PREP(MT7628_ESW_FCT2_MC_PER_PORT_TH, 0xc) |
+		     FIELD_PREP(MT7628_ESW_FCT2_MUST_DROP_SET_TH, 0x10) |
+		     FIELD_PREP(MT7628_ESW_FCT2_MUST_DROP_RLS_TH, 0x12));
+
+	/*
+	 * general switch configuration:
+	 * 300s aging interval
+	 * broadcast storm prevention disabled
+	 * max packet length 1536 bytes
+	 * disable collision 16 packet abort and late collision abort
+	 * use xor48 for address hashing
+	 * disable tx backoff
+	 * 10 packet back pressure jam
+	 * disable was_transmit
+	 * jam until BP condition released
+	 * 30ms LED flash
+	 * rmc tb fault to all ports
+	 * unmatched IGMP as broadcast
+	 */
+	regmap_write(esw->regmap, MT7628_ESW_REG_SGC,
+		     FIELD_PREP(MT7628_ESW_SGC_AGING_INTERVAL, 1) |
+		     FIELD_PREP(MT7628_ESW_BC_STORM_PROT, 0) |
+		     FIELD_PREP(MT7628_ESW_PKT_MAX_LEN, 0) |
+		     MT7628_ESW_DIS_PKT_ABORT |
+		     FIELD_PREP(MT7628_ESW_ADDRESS_HASH_ALG, 1) |
+		     MT7628_ESW_DISABLE_TX_BACKOFF |
+		     FIELD_PREP(MT7628_ESW_BP_JAM_CNT, 10) |
+		     FIELD_PREP(MT7628_ESW_DISMIIPORT_WASTX, 0) |
+		     FIELD_PREP(MT7628_ESW_BP_MODE, 0b10) |
+		     FIELD_PREP(MT7628_ESW_LED_FLASH_TIME, 0) |
+		     FIELD_PREP(MT7628_ESW_RMC_RULE, 0) |
+		     FIELD_PREP(MT7628_ESW_IP_MULT_RULE, 0));
+
+	regmap_write(esw->regmap, MT7628_ESW_REG_SOCPC,
+		     MT7628_ESW_SOCPC_CRC_PADDING |
+		     FIELD_PREP(MT7628_ESW_SOCPC_DISUN2CPU,
+				MT7628_ESW_PORTS_CPU) |
+		     FIELD_PREP(MT7628_ESW_SOCPC_DISMC2CPU,
+				MT7628_ESW_PORTS_CPU) |
+		     FIELD_PREP(MT7628_ESW_SOCPC_DISBC2CPU,
+				MT7628_ESW_PORTS_CPU));
+
+	regmap_set_bits(esw->regmap, MT7628_ESW_REG_FPA2,
+			MT7628_ESW_FPA2_FORCE_RGMII_EN1 |
+			MT7628_ESW_FPA2_FORCE_RGMII_LINK1 |
+			MT7628_ESW_FPA2_AP_EN);
+
+	regmap_update_bits(esw->regmap, MT7628_ESW_REG_FPA2,
+			   MT7628_ESW_FPA2_EXT_PHY_ADDR_BASE,
+			   FIELD_PREP(MT7628_ESW_FPA2_EXT_PHY_ADDR_BASE, 31));
+
+	/* disable all interrupts */
+	regmap_write(esw->regmap, MT7628_ESW_REG_IMR, 0);
+
+	/* enable MT7628 DSA tag on CPU port */
+	regmap_write(esw->regmap, MT7628_ESW_REG_SGC2,
+		     MT7628_ESW_SGC2_SPECIAL_TAG_EN |
+		     FIELD_PREP(MT7628_ESW_SGC2_TX_CPU_TPID_BIT_MAP,
+				MT7628_ESW_PORTS_CPU));
+
+	/*
+	 * Double tag feature allows switch to always append the port PVID VLAN tag
+	 * regardless of if the incoming packet already has a VLAN tag.
+	 * This is enabled to simulate VLAN unawareness.
+	 */
+	regmap_set_bits(esw->regmap, MT7628_ESW_REG_SGC2,
+			FIELD_PREP(MT7628_ESW_SGC2_DOUBLE_TAG_EN,
+				   MT7628_ESW_PORTS_NOCPU));
+
+	regmap_set_bits(esw->regmap, MT7628_ESW_REG_POC2,
+			MT7628_ESW_POC2_PER_VLAN_UNTAG_EN);
+
+	regmap_update_bits(esw->regmap, MT7628_ESW_REG_PFC1,
+			   MT7628_ESW_PFC1_EN_VLAN,
+			   FIELD_PREP(MT7628_ESW_PFC1_EN_VLAN,
+				      MT7628_ESW_PORTS_ALL));
+}
+
+static void mt7628_esw_set_pvid(struct mt7628_esw *esw, unsigned int port,
+				unsigned int pvid)
+{
+	regmap_update_bits(esw->regmap, MT7628_ESW_REG_PVIDC(port),
+			   MT7628_ESW_PVID_MASK(port),
+			   MT7628_ESW_PVID_PREP(port, pvid));
+}
+
+static void mt7628_esw_set_vlan_id(struct mt7628_esw *esw, unsigned int vlan,
+				   unsigned int vid)
+{
+	regmap_update_bits(esw->regmap, MT7628_ESW_REG_VLANI(vlan),
+			   MT7628_ESW_VID_MASK(vlan),
+			   MT7628_ESW_VID_PREP(vlan, vid));
+}
+
+static void mt7628_esw_set_vmsc(struct mt7628_esw *esw, unsigned int vlan,
+				unsigned int msc)
+{
+	regmap_update_bits(esw->regmap, MT7628_ESW_REG_VMSC(vlan),
+			   MT7628_ESW_VMSC_MASK(vlan),
+			   MT7628_ESW_VMSC_PREP(vlan, msc));
+}
+
+static void mt7628_esw_set_vub(struct mt7628_esw *esw, unsigned int vlan,
+			       unsigned int vub)
+{
+	regmap_update_bits(esw->regmap, MT7628_ESW_REG_VUB(vlan),
+			   MT7628_ESW_VUB_MASK(vlan),
+			   MT7628_ESW_VUB_PREP(vlan, vub));
+}
+
+static void mt7628_vlan_sync(struct dsa_switch *ds)
+{
+	struct mt7628_esw *esw = ds->priv;
+	int i;
+
+	for (i = 0; i < MT7628_NUM_VLANS; i++) {
+		struct mt7628_vlan *vlan = &esw->vlans[i];
+
+		mt7628_esw_set_vmsc(esw, i, vlan->members);
+		mt7628_esw_set_vlan_id(esw, i, vlan->vid);
+		mt7628_esw_set_vub(esw, i, vlan->untag);
+	}
+
+	for (i = 0; i < ds->num_ports; i++)
+		mt7628_esw_set_pvid(esw, i, esw->tag_8021q_pvid[i]);
+}
+
+static int mt7628_setup(struct dsa_switch *ds)
+{
+	struct mt7628_esw *esw = ds->priv;
+	int ret;
+
+	reset_control_reset(esw->rst_esw);
+	usleep_range(1000, 2000);
+	reset_control_reset(esw->rst_ephy);
+	usleep_range(1000, 2000);
+	/*
+	 * all MMIO reads hang if esw is not out of reset
+	 * ephy needs extra time to get out of reset or it ends up misconfigured
+	 */
+	mt7628_switch_init(ds);
+	rtnl_lock();
+	dsa_tag_8021q_register(ds, htons(ETH_P_8021Q));
+	rtnl_unlock();
+
+	ret = mt7628_setup_internal_mdio(ds);
+	return ret;
+}
+
+static int mt7628_port_enable(struct dsa_switch *ds, int port,
+			      struct phy_device *phy)
+{
+	struct mt7628_esw *esw = ds->priv;
+
+	regmap_clear_bits(esw->regmap, MT7628_ESW_REG_POC0,
+			  FIELD_PREP(MT7628_ESW_POC0_PORT_DISABLE, BIT(port)));
+	return 0;
+}
+
+static void mt7628_port_disable(struct dsa_switch *ds, int port)
+{
+	struct mt7628_esw *esw = ds->priv;
+
+	regmap_set_bits(esw->regmap, MT7628_ESW_REG_POC0,
+			FIELD_PREP(MT7628_ESW_POC0_PORT_DISABLE, BIT(port)));
+}
+
+static enum dsa_tag_protocol
+mt7628_get_tag_proto(struct dsa_switch *ds, int port, enum dsa_tag_protocol mp)
+{
+	return DSA_TAG_PROTO_MT7628;
+}
+
+static void mt7628_phylink_get_caps(struct dsa_switch *ds, int port,
+				    struct phylink_config *config)
+{
+	switch (port) {
+	case 6:
+		config->mac_capabilities |= MAC_1000;
+		fallthrough;
+	case 0 ... 4:
+		config->mac_capabilities |= MAC_100 | MAC_10;
+		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
+			  config->supported_interfaces);
+		break;
+	default:
+		break;		/* port 5 does not exist on MT7628 */
+	}
+}
+
+static int mt7628_dsa_8021q_vlan_add(struct dsa_switch *ds, int port,
+				     u16 vid, u16 flags)
+{
+	struct mt7628_esw *esw = ds->priv;
+	struct mt7628_vlan *vlan = NULL;
+	int i;
+
+	for (i = 0; i < MT7628_NUM_VLANS; i++) {
+		struct mt7628_vlan *check_vlan = &esw->vlans[i];
+
+		if (!check_vlan->active && !vlan) {
+			vlan = check_vlan;
+		} else if (check_vlan->vid == vid) {
+			vlan = check_vlan;
+			break;
+		}
+	}
+
+	if (!vlan)
+		return -ENOSPC;
+
+	vlan->vid = vid;
+	vlan->active = true;
+	vlan->members |= BIT(port);
+
+	if (flags & BRIDGE_VLAN_INFO_PVID)
+		esw->tag_8021q_pvid[port] = vid;
+
+	if (flags & BRIDGE_VLAN_INFO_UNTAGGED)
+		vlan->untag |= BIT(port);
+
+	mt7628_vlan_sync(ds);
+	return 0;
+}
+
+static int mt7628_dsa_8021q_vlan_del(struct dsa_switch *ds, int port, u16 vid)
+{
+	struct mt7628_esw *esw = ds->priv;
+	struct mt7628_vlan *vlan = NULL;
+	int i;
+
+	for (i = 0; i < MT7628_NUM_VLANS; i++) {
+		struct mt7628_vlan *check_vlan = &esw->vlans[i];
+
+		if (!check_vlan->active || check_vlan->vid != vid)
+			continue;
+		vlan = check_vlan;
+		break;
+	}
+	if (!vlan)
+		return -ENOENT;
+
+	vlan->members &= ~BIT(port);
+	vlan->untag &= ~BIT(port);
+
+	if (!vlan->members)
+		vlan->active = false;
+
+	mt7628_vlan_sync(ds);
+	return 0;
+}
+
+static struct dsa_switch_ops mt7628_switch_ops = {
+	.get_tag_protocol = mt7628_get_tag_proto,
+	.setup = mt7628_setup,
+	.port_enable = mt7628_port_enable,
+	.port_disable = mt7628_port_disable,
+	.phylink_get_caps = mt7628_phylink_get_caps,
+	.tag_8021q_vlan_add = mt7628_dsa_8021q_vlan_add,
+	.tag_8021q_vlan_del = mt7628_dsa_8021q_vlan_del,
+};
+
+static int mt7628_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct mt7628_esw *esw;
+	struct dsa_switch *ds;
+
+	ds = devm_kzalloc(&pdev->dev, sizeof(*ds), GFP_KERNEL);
+	if (!ds)
+		return -ENOMEM;
+
+	esw = devm_kzalloc(&pdev->dev, sizeof(*esw), GFP_KERNEL);
+	if (!esw)
+		return -ENOMEM;
+
+	esw->base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(esw->base))
+		return PTR_ERR(esw->base);
+
+	esw->regmap = devm_regmap_init_mmio(&pdev->dev, esw->base,
+					    &mt7628_esw_regmap_cfg);
+	if (IS_ERR(esw->regmap))
+		return PTR_ERR(esw->regmap);
+
+	esw->rst_ephy = devm_reset_control_get_exclusive(&pdev->dev, "ephy");
+	if (IS_ERR(esw->rst_ephy))
+		return dev_err_probe(dev, PTR_ERR(esw->rst_ephy),
+				     "failed to get EPHY reset\n");
+
+	esw->rst_esw = devm_reset_control_get_exclusive(&pdev->dev, "esw");
+	if (IS_ERR(esw->rst_esw))
+		return dev_err_probe(dev, PTR_ERR(esw->rst_esw),
+				     "failed to get ESW reset\n");
+
+	ds->dev = dev;
+	ds->num_ports = MT7628_ESW_NUM_PORTS;
+	ds->ops = &mt7628_switch_ops;
+	ds->priv = esw;
+	esw->ds = ds;
+	esw->dev = dev;
+	dev_set_drvdata(dev, esw);
+
+	return dsa_register_switch(ds);
+}
+
+static void mt7628_remove(struct platform_device *pdev)
+{
+	struct mt7628_esw *esw = platform_get_drvdata(pdev);
+
+	if (!esw)
+		return;
+
+	dsa_unregister_switch(esw->ds);
+}
+
+static void mt7628_shutdown(struct platform_device *pdev)
+{
+	struct mt7628_esw *esw = platform_get_drvdata(pdev);
+
+	if (!esw)
+		return;
+
+	dsa_switch_shutdown(esw->ds);
+	dev_set_drvdata(&pdev->dev, NULL);
+}
+
+static const struct of_device_id mt7628_of_match[] = {
+	{ .compatible = "mediatek,mt7628-esw" },
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, mt7628_of_match);
+
+static struct platform_driver mt7628_driver = {
+	.driver = {
+		   .name = "mt7628-esw",
+		   .of_match_table = mt7628_of_match,
+		    },
+	.probe = mt7628_probe,
+	.remove = mt7628_remove,
+	.shutdown = mt7628_shutdown,
+};
+
+module_platform_driver(mt7628_driver);
+
+MODULE_AUTHOR("Joris Vaisvila <joey@tinyisr.com>");
+MODULE_DESCRIPTION("Driver for Mediatek MT7628 embedded switch");
+MODULE_LICENSE("GPL");
-- 
2.53.0

Re: [PATCH net-next v2 3/4] net: dsa: initial MT7628 tagging driver

[Andrew Lunn]

On Mon, Mar 30, 2026 at 09:40:16PM +0300, Joris Vaisvila wrote:
> Add support for the MT7628 embedded switch's tag.
> 
> The MT7628 tag is merged with the VLAN TPID field when a VLAN is
> appended by the switch hardware. It is not installed if the VLAN tag is
> already there on ingress. Due to this hardware quirk the tag cannot be
> trusted for port 0 if we don't know that the VLAN was added by the
> hardware. As a workaround for this the switch is configured to always
> append the port PVID tag even if the incoming packet is already tagged.
> The tagging driver can then trust that the tag is always accurate and
> the whole VLAN tag can be removed on ingress as it's only metadata for
> the tagger.
> 
> On egress the MT7628 tag allows precise TX, but the correct VLAN tag
> from tag_8021q is still appended or the switch will not forward the
> packet.
> 
> Signed-off-by: Joris Vaisvila <joey@tinyisr.com>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH net-next v2 4/4] net: dsa: initial support for MT7628 embedded switch

[Andrew Lunn]

On Mon, Mar 30, 2026 at 09:40:17PM +0300, Joris Vaisvila wrote:
> Add support for the MT7628 embedded switch.
> 
> The switch has 5 built-in 100Mbps user ports (ports 0-4) and one 1Gbps
> port that is internally attached to the SoCs CPU MAC and serves as the
> CPU port.
> 
> The switch hardware has a very limited 16 entry VLAN table. Configuring
> VLANs is the only way to control switch forwarding. Currently 6 entries
> are used by tag_8021q to isolate the ports. Double tag feature is
> enabled to force the switch to append the VLAN tag even if the incoming
> packet is already tagged, this simulates VLAN-unaware functionality and
> simplifies the tagger implementation.
> 
> Signed-off-by: Joris Vaisvila <joey@tinyisr.com>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH net-next v2 4/4] net: dsa: initial support for MT7628 embedded switch

[Jakub Kicinski]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net: dsa: initial support for MT7628 embedded switch

Add support for the MT7628 embedded switch.
The switch has 5 built-in 100Mbps user ports (ports 0-4) and one 1Gbps
port that is internally attached to the SoCs CPU MAC and serves as the
CPU port.

> diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
> --- a/drivers/net/dsa/Kconfig
> +++ b/drivers/net/dsa/Kconfig
> @@ -28,6 +28,14 @@ source "drivers/net/dsa/hirschmann/Kconfig"
>  
>  source "drivers/net/dsa/lantiq/Kconfig"
>  
> +config NET_DSA_MT7628
> +	tristate "MediaTek MT7628 Embedded Ethernet switch support"
> +	select NET_DSA_TAG_MT7628
> +	select MEDIATEK_FE_SOC_PHY

Does this configuration need to select NET_DSA_TAG_8021Q?

The driver relies on the tag_8021q mechanism for switch port isolation. If
the kernel is configured without NET_DSA_TAG_8021Q, dsa_tag_8021q_register()
will return -EOPNOTSUPP, causing the switch to boot with broken port
isolation.

> +	help
> +	  This enables support for the built-in Ethernet switch found
> +	  in the MT7628 SoC.
> +
[ ... ]
> diff --git a/drivers/net/dsa/mt7628.c b/drivers/net/dsa/mt7628.c
> --- /dev/null
> +++ b/drivers/net/dsa/mt7628.c
[ ... ]
> +static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)
> +{
> +	struct mt7628_esw *esw = bus->priv;
> +	int ret;
> +	u32 val;
> +
> +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> +				       !(val & MT7628_ESW_PCR1_RD_DONE), 10,
> +				       5000);

Will this polling logic cause an MDIO timeout?

If RD_DONE is a completion status bit that remains 1 after a successful
operation, this first poll will wait indefinitely for the bit to become 0.

If RD_DONE is an active-low busy bit, the second poll below waits for the
controller to become busy instead of waiting for it to be idle.

> +	if (ret)
> +		goto out;
> +
> +	ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> +				      regnum) |
> +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> +				      port) | MT7628_ESW_PCR0_RD_PHY_CMD);
> +	if (ret)
> +		goto out;
> +
> +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> +				       (val & MT7628_ESW_PCR1_RD_DONE), 10,
> +				       5000);
> +out:
> +	if (ret) {
> +		dev_err(&bus->dev, "read failed. MDIO timeout?\n");
> +		return ret;
> +	}
> +	return FIELD_GET(MT7628_ESW_PCR1_RD_DATA, val);
> +}
> +
> +static int mt7628_mii_write(struct mii_bus *bus, int port, int regnum, u16 dat)
> +{
> +	struct mt7628_esw *esw = bus->priv;
> +	u32 val;
> +	int ret;
> +
> +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> +				       !(val & MT7628_ESW_PCR1_WT_DONE), 10,
> +				       5000);
> +	if (ret)
> +		goto out;
> +
> +	ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> +			   FIELD_PREP(MT7628_ESW_PCR0_WT_NWAY_DATA, dat) |
> +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> +				      regnum) |
> +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> +				      port) | MT7628_ESW_PCR0_WT_PHY_CMD);
> +	if (ret)
> +		goto out;
> +
> +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> +				       (val & MT7628_ESW_PCR1_WT_DONE), 10,
> +				       5000);

Is this second poll waiting for the controller to become busy instead of
idle, similar to the read function?

> +out:
> +	if (ret) {
> +		dev_err(&bus->dev, "write failed. MDIO timeout?\n");
> +		return ret;
> +	}
> +	return 0;
> +}
> +
> +static int mt7628_setup_internal_mdio(struct dsa_switch *ds)
> +{
> +	struct mt7628_esw *esw = ds->priv;
> +	struct device_node *mdio;
> +	struct mii_bus *bus;
> +	int ret = 0;
> +
> +	mdio = of_get_available_child_by_name(ds->dev->of_node, "mdio");
> +
> +	bus = devm_mdiobus_alloc(esw->dev);

Can allocating devm_ resources in the DSA .setup callback cause a sysfs name
collision?

The .setup callback is executed whenever the DSA tree binds. Since devm_
resources are tied to the platform device (esw->dev) rather than the DSA
tree lifecycle, they are not released when the DSA tree unbinds. On a
subsequent re-bind, allocating a new MDIO bus with the same ID will fail
because the original bus was never unregistered.

> +	if (!bus) {
> +		ret = -ENOMEM;
> +		goto out_put_node;
> +	}
> +
> +	bus->name = "MT7628 internal MDIO bus";
> +	snprintf(bus->id, MII_BUS_ID_SIZE, "%s-mii", dev_name(ds->dev));
> +	bus->priv = esw;
> +	bus->read = mt7628_mii_read;
> +	bus->write = mt7628_mii_write;
> +	bus->parent = esw->dev;
> +	if (!mdio) {
> +		ds->user_mii_bus = bus;
> +		bus->phy_mask = ~ds->phys_mii_mask;
> +	}
> +
> +	ret = devm_of_mdiobus_register(esw->dev, bus, mdio);
> +
> +out_put_node:
> +	of_node_put(mdio);
> +	return ret;
> +}
[ ... ]
> +static int mt7628_setup(struct dsa_switch *ds)
> +{
> +	struct mt7628_esw *esw = ds->priv;
> +	int ret;
> +
> +	reset_control_reset(esw->rst_esw);
> +	usleep_range(1000, 2000);
> +	reset_control_reset(esw->rst_ephy);
> +	usleep_range(1000, 2000);
> +	/*
> +	 * all MMIO reads hang if esw is not out of reset
> +	 * ephy needs extra time to get out of reset or it ends up misconfigured
> +	 */
> +	mt7628_switch_init(ds);
> +	rtnl_lock();
> +	dsa_tag_8021q_register(ds, htons(ETH_P_8021Q));

Is it safe to ignore the return value of dsa_tag_8021q_register()?

If the registration fails, the core function frees the allocated context but
does not clear ds->tag_8021q_ctx. The setup will continue, and the DSA core
will later dereference the non-NULL ds->tag_8021q_ctx, leading to a
use-after-free crash.

Also, if mt7628_setup_internal_mdio() below fails, the setup returns an
error without unregistering the tagger, which leaks the tag_8021q context.

> +	rtnl_unlock();
> +
> +	ret = mt7628_setup_internal_mdio(ds);
> +	return ret;
> +}
[ ... ]
> +static struct dsa_switch_ops mt7628_switch_ops = {
> +	.get_tag_protocol = mt7628_get_tag_proto,
> +	.setup = mt7628_setup,

Does this switch ops structure need a .teardown callback?

Without calling dsa_tag_8021q_unregister() in a .teardown callback, the
tag_8021q context memory allocated during .setup will be permanently leaked
whenever the DSA switch is unbound or the module is removed.

> +	.port_enable = mt7628_port_enable,
> +	.port_disable = mt7628_port_disable,
> +	.phylink_get_caps = mt7628_phylink_get_caps,
> +	.tag_8021q_vlan_add = mt7628_dsa_8021q_vlan_add,
> +	.tag_8021q_vlan_del = mt7628_dsa_8021q_vlan_del,
> +};
-- 
pw-bot: cr

Re: [PATCH net-next v2 4/4] net: dsa: initial support for MT7628 embedded switch

[Joris Vaisvila]

Hi Jakub, thank you for the review.

On Wed, Apr 01, 2026 at 08:31:03PM -0700, Jakub Kicinski wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> net: dsa: initial support for MT7628 embedded switch
> 
> Add support for the MT7628 embedded switch.
> The switch has 5 built-in 100Mbps user ports (ports 0-4) and one 1Gbps
> port that is internally attached to the SoCs CPU MAC and serves as the
> CPU port.
> 
> > diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
> > --- a/drivers/net/dsa/Kconfig
> > +++ b/drivers/net/dsa/Kconfig
> > @@ -28,6 +28,14 @@ source "drivers/net/dsa/hirschmann/Kconfig"
> >  
> >  source "drivers/net/dsa/lantiq/Kconfig"
> >  
> > +config NET_DSA_MT7628
> > +	tristate "MediaTek MT7628 Embedded Ethernet switch support"
> > +	select NET_DSA_TAG_MT7628
> > +	select MEDIATEK_FE_SOC_PHY
> 
> Does this configuration need to select NET_DSA_TAG_8021Q?
> 
> The driver relies on the tag_8021q mechanism for switch port isolation. If
> the kernel is configured without NET_DSA_TAG_8021Q, dsa_tag_8021q_register()
> will return -EOPNOTSUPP, causing the switch to boot with broken port
> isolation.
> 

tag_8021q.o is in DSA core, there's no option to enable or disable it.

> [ ... ]
> > +static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)
> > +{
> > +	struct mt7628_esw *esw = bus->priv;
> > +	int ret;
> > +	u32 val;
> > +
> > +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > +				       !(val & MT7628_ESW_PCR1_RD_DONE), 10,
> > +				       5000);
> 
> Will this polling logic cause an MDIO timeout?
> 
> If RD_DONE is a completion status bit that remains 1 after a successful
> operation, this first poll will wait indefinitely for the bit to become 0.
> 
> If RD_DONE is an active-low busy bit, the second poll below waits for the
> controller to become busy instead of waiting for it to be idle.
> 

RD_DONE gets set when the read operations completes and is reset on
register read, so this will not cause a timeout.

> > +	if (ret)
> > +		goto out;
> > +
> > +	ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> > +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> > +				      regnum) |
> > +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> > +				      port) | MT7628_ESW_PCR0_RD_PHY_CMD);
> > +	if (ret)
> > +		goto out;
> > +
> > +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > +				       (val & MT7628_ESW_PCR1_RD_DONE), 10,
> > +				       5000);
> > +out:
> > +	if (ret) {
> > +		dev_err(&bus->dev, "read failed. MDIO timeout?\n");
> > +		return ret;
> > +	}
> > +	return FIELD_GET(MT7628_ESW_PCR1_RD_DATA, val);
> > +}
> > +
> > +static int mt7628_mii_write(struct mii_bus *bus, int port, int regnum, u16 dat)
> > +{
> > +	struct mt7628_esw *esw = bus->priv;
> > +	u32 val;
> > +	int ret;
> > +
> > +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > +				       !(val & MT7628_ESW_PCR1_WT_DONE), 10,
> > +				       5000);
> > +	if (ret)
> > +		goto out;
> > +
> > +	ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> > +			   FIELD_PREP(MT7628_ESW_PCR0_WT_NWAY_DATA, dat) |
> > +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> > +				      regnum) |
> > +			   FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> > +				      port) | MT7628_ESW_PCR0_WT_PHY_CMD);
> > +	if (ret)
> > +		goto out;
> > +
> > +	ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > +				       (val & MT7628_ESW_PCR1_WT_DONE), 10,
> > +				       5000);
> 
> Is this second poll waiting for the controller to become busy instead of
> idle, similar to the read function?
> 
WT_DONE is set when the data is ready and reset on read, same as
RD_DONE.

> > +out:
> > +	if (ret) {
> > +		dev_err(&bus->dev, "write failed. MDIO timeout?\n");
> > +		return ret;
> > +	}
> > +	return 0;
> > +}
> > +
> > +static int mt7628_setup_internal_mdio(struct dsa_switch *ds)
> > +{
> > +	struct mt7628_esw *esw = ds->priv;
> > +	struct device_node *mdio;
> > +	struct mii_bus *bus;
> > +	int ret = 0;
> > +
> > +	mdio = of_get_available_child_by_name(ds->dev->of_node, "mdio");
> > +
> > +	bus = devm_mdiobus_alloc(esw->dev);
> 
> Can allocating devm_ resources in the DSA .setup callback cause a sysfs name
> collision?
> 
> The .setup callback is executed whenever the DSA tree binds. Since devm_
> resources are tied to the platform device (esw->dev) rather than the DSA
> tree lifecycle, they are not released when the DSA tree unbinds. On a
> subsequent re-bind, allocating a new MDIO bus with the same ID will fail
> because the original bus was never unregistered.
> 

I'm not sure how this would work. Other switches appear to be doing the
same. For example mt7530-mmio.c does `priv->dev = &pdev->dev` and later
uses priv->dev to register the mdio bus. Is this a real issue?

> [ ... ]
> > +static int mt7628_setup(struct dsa_switch *ds)
> > +{
> > +	struct mt7628_esw *esw = ds->priv;
> > +	int ret;
> > +
> > +	reset_control_reset(esw->rst_esw);
> > +	usleep_range(1000, 2000);
> > +	reset_control_reset(esw->rst_ephy);
> > +	usleep_range(1000, 2000);
> > +	/*
> > +	 * all MMIO reads hang if esw is not out of reset
> > +	 * ephy needs extra time to get out of reset or it ends up misconfigured
> > +	 */
> > +	mt7628_switch_init(ds);
> > +	rtnl_lock();
> > +	dsa_tag_8021q_register(ds, htons(ETH_P_8021Q));
> 
> Is it safe to ignore the return value of dsa_tag_8021q_register()?
> 
> If the registration fails, the core function frees the allocated context but
> does not clear ds->tag_8021q_ctx. The setup will continue, and the DSA core
> will later dereference the non-NULL ds->tag_8021q_ctx, leading to a
> use-after-free crash.
> 
> Also, if mt7628_setup_internal_mdio() below fails, the setup returns an
> error without unregistering the tagger, which leaks the tag_8021q context.
> 

No, will fix in v3. 

> > +	rtnl_unlock();
> > +
> > +	ret = mt7628_setup_internal_mdio(ds);
> > +	return ret;
> > +}
> [ ... ]
> > +static struct dsa_switch_ops mt7628_switch_ops = {
> > +	.get_tag_protocol = mt7628_get_tag_proto,
> > +	.setup = mt7628_setup,
> 
> Does this switch ops structure need a .teardown callback?
> 
> Without calling dsa_tag_8021q_unregister() in a .teardown callback, the
> tag_8021q context memory allocated during .setup will be permanently leaked
> whenever the DSA switch is unbound or the module is removed.
> 
Yes, will fix in V3. 

Thanks,
Joris