Re: [BUG] mlx5: VLAN-aware bridge drops all traffic in legacy eswitch mode without promiscuous

Dragos Tatulea
2026-04-28T11:32:23Z

On Mon, Apr 27, 2026 at 04:10:28PM -0500, bryan wrote:
> Here would be one example config (sanitized). The promisc on link is
> what allows traffic to pass - I disable promisc, and traffic stops.
> These are single-port CX4Lx cards. nic0 is the physical interface, no
> VFs configured, SrIOV has been disabled as part of testing and
> troubleshooting, Kernel 6.17 currently:
>
Is this a distro kernel or a self-compiled .deb?

> auto lo
> iface lo inet loopback
>
> auto nic0
> iface nic0 inet manual
> up ip link set nic0 promisc on
> auto vmbr0
> iface vmbr0 inet manual
> bridge-ports nic0
> bridge-stp off
> bridge-fd 0
> bridge-vlan-aware yes
> bridge-vids 2-10 555
>
> auto vmbr0.555
> iface vmbr0.555 inet static
> address 192.168.1.123/24
> gateway 192.168.1.1
>
>
> iface nic3 inet manual
>
> iface nic1 inet manual
>
> iface nic2 inet manual
>
>
> This was ported over to use the new nic# bindings, before this it was
> the standard enps0np0 naming. No difference in behvaiour.
>

I don't have a machine with ifupdown available but I did a similar setup
with iproute2 (note that promisc mode is explicitly set to off):

# Bring PF up
ip link set dev $DEV up
ip link set dev $DEV promisc off

# Create bridge
ip link add name $BR type bridge
ip link set dev $BR type bridge stp_state 0 forward_delay 0

# Make bridge VLAN-aware
ip link set dev $BR type bridge vlan_filtering 1

# Add PF to bridge
ip link set dev $DEV master $BR

# Bring bridge up
ip link set dev $BR up

# Allow VLANs 2-10 and 555 on $DEV bridge port
bridge vlan del dev $DEV vid 1
bridge vlan add dev $DEV vid 2-10
bridge vlan add dev $DEV vid 555

# Also allow VLANs on bridge self port
bridge vlan add dev $BR vid 2-10 self
bridge vlan add dev $BR vid 555 self

# Create VLAN subinterface $BR.555
ip link add link $BR name $BR.555 type vlan id 555

# Assign IP
ip addr add 192.168.1.123/24 dev $BR.555

# Bring VLAN interface up
ip link set dev $BR.555 up

On the peer where $DEV is connected to I have created a vlan interface
for vlan id 555 and I can ping it without issues...

> >Is this even with one vlan? I ran a flow on a CX4LX pair with one vlan
> >and vlan_filtering set and traffic seems to be flowing normally.
>
> I have not checked with literally only one VLAN, as that is not at all
> the use case. I can absolutely test that if it would help! Would you
> like me to remove every VLAN but 555 from the interface, and leave the
> rest of the config as-is?
>
No need.
>
>
> [...]
>
> >eth2 is a PF in legacy switchdev mode.
>
> It was my understanding that Legacy mode and Switchdev mode were two
> independent modes, with Legacy done in-software and Switchdev using the
> eSwitch on the NIC itself. Please excuse my ignorance if that is not
> the case. Would you be able to specify if you used Switchdev mode or
> Legacy mode? because Switchdev mode DOES function as a workaround and
> passes traffic (but in my case results in system instability after a
> time).
>
My bad, sorry. I wanted to say legacy mode.

It would be useful if you could provide a reproduction using only plain
iproute2 commands (ip and bridge) like above.

Also, do you see anyting relevant info in dmesg regarding the interface?

Could you also provide the following:
- ip link
- ip addr
- bridge link
- bridge vlan
- bridge fdb
- ethtool -S nic0

Maybe we can get some info from there.

Thanks,
Dragos