net: dsa: flush learned FDB on user port bulk delete

Implement ndo_fdb_del_bulk for DSA so that a bulk RTM_DELNEIGH with
NTF_SELF can flush a switch's learned FDB. This is required by user
space applications implementing MRP (802.1Q).

The NTF_MASTER leg of the same request cannot serve this. Where learning
is offloaded the switch learns in hardware and the entries were never in
the bridge FDB, so the bridge has nothing to delete and nothing to notify
back down to the driver.

Fast ageing deletes the dynamically learned entries and nothing else,
which bounds what the handler can accept. ndm_state and ndm_flags select
entries by flag, so any bit set in them asks for entries that fast ageing
cannot delete; refuse the request rather than answer it by deleting the
entries the caller asked to keep. A mask is not the same thing, since
with the bit clear in the request it selects the entries which do not
carry that flag: a dynamically learned entry carries neither of the
ndm_state flags nor NTF_USE, NTF_EXT_LEARNED or NTF_STICKY, so a mask
naming those is satisfied by definition, while NTF_OFFLOADED describes
every entry in a switch and a mask naming it selects nothing that can be
deleted. The validation otherwise follows br_fdb_delete_bulk() and
vxlan_fdb_delete_bulk(), and reports -EOPNOTSUPP rather than -EINVAL
throughout: the request is well formed, it is just not one this port can
serve, and the NTF_MASTER leg may already have flushed the bridge by the
time it is refused.

NDA_IFINDEX scopes a bridge flush to one of its ports, so here it has to
name the port the request was sent to. A LAG or HSR member is refused
outright, because its bridge port is the aggregate device: the flush
could not be notified without also dropping the addresses its siblings
learned.

An unfiltered request asks for the static entries too. Deleting those
behind the bridge's back would leave it believing they are still
programmed, so they are left alone and only the dynamically learned
entries go. Since ds->ops->port_fast_age() returns void, a whole-port
flush which the driver declines or fails to carry out cannot be reported
either.

As on the other fast age paths, the switchdev flush notification also
drops the bridge's dynamic entries for the port, keeping the software FDB
in step with hardware, and the flush covers this port on this switch
only: addresses that other switches in the tree learned on their DSA
links are left alone.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Luke Howard <lukeh@padl.com>

Author: lhoward

net/dsa/port.c

@@ -81,6 +81,26 @@ static int dsa_port_vlan_fast_age(const struct dsa_port *dp, u16 vid)
 	return err;
 }
 
+/* Flush this port's dynamically learned FDB entries, scoped to a VLAN when
+ * one is given. Widening a VLAN-scoped request to the whole port would delete
+ * entries the caller asked to keep, so a switch without VLAN-scoped fast age
+ * refuses it instead.
+ */
+int dsa_port_flush_dynamic_fdb(const struct dsa_port *dp, u16 vid)
+{
+	struct dsa_switch *ds = dp->ds;
+
+	if (vid)
+		return dsa_port_vlan_fast_age(dp, vid);
+
+	if (!ds->ops->port_fast_age)
+		return -EOPNOTSUPP;
+
+	dsa_port_fast_age(dp);
+
+	return 0;
+}
+
 static int dsa_port_msti_fast_age(const struct dsa_port *dp, u16 msti)
 {
 	DECLARE_BITMAP(vids, VLAN_N_VID) = { 0 };

net/dsa/port.h

@@ -19,6 +19,7 @@ bool dsa_port_supports_hwtstamp(struct dsa_port *dp);
 void dsa_port_set_tag_protocol(struct dsa_port *cpu_dp,
 			       const struct dsa_device_ops *tag_ops);
 int dsa_port_set_state(struct dsa_port *dp, u8 state, bool do_fast_age);
+int dsa_port_flush_dynamic_fdb(const struct dsa_port *dp, u16 vid);
 int dsa_port_set_mst_state(struct dsa_port *dp,
 			   const struct switchdev_mst_state *state,
 			   struct netlink_ext_ack *extack);

net/dsa/user.c

@@ -575,6 +575,91 @@ dsa_user_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 	return err;
 }
 
+static const struct nla_policy dsa_user_fdb_del_bulk_policy[NDA_MAX + 1] = {
+	[NDA_VLAN]		= NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
+	[NDA_IFINDEX]		= NLA_POLICY_MIN(NLA_S32, 1),
+	[NDA_NDM_STATE_MASK]	= { .type = NLA_U16 },
+	[NDA_NDM_FLAGS_MASK]	= { .type = NLA_U8 },
+};
+
+#define DSA_FDB_FLUSH_IGNORED_NDM_FLAGS (NTF_MASTER | NTF_SELF)
+
+/* Fast ageing deletes the dynamically learned entries and nothing else, so no
+ * ndm_state or ndm_flags bit selects anything it can delete. A mask is not the
+ * same thing: with the bit clear in the request it selects the entries which
+ * do not carry that flag, and a dynamically learned entry carries none of the
+ * ones below, so such a mask is satisfied by definition. NTF_OFFLOADED is not
+ * among them, as every entry in a switch is offloaded, so a mask naming it
+ * selects nothing that can be deleted.
+ */
+#define DSA_FDB_FLUSH_ALLOWED_NDM_STATES 0
+#define DSA_FDB_FLUSH_ALLOWED_NDM_FLAGS 0
+#define DSA_FDB_FLUSH_ALLOWED_NDM_FLAGS_MASK \
+	(NTF_USE | NTF_EXT_LEARNED | NTF_STICKY)
+
+static int dsa_user_fdb_del_bulk(struct nlmsghdr *nlh, struct net_device *dev,
+				 struct netlink_ext_ack *extack)
+{
+	const struct dsa_port *dp = dsa_user_to_port(dev);
+	struct ndmsg *ndm = nlmsg_data(nlh);
+	struct nlattr *tb[NDA_MAX + 1];
+	u8 ndm_flags;
+	u16 vid = 0;
+	int err;
+
+	ndm_flags = ndm->ndm_flags & ~DSA_FDB_FLUSH_IGNORED_NDM_FLAGS;
+
+	err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX,
+			  dsa_user_fdb_del_bulk_policy, extack);
+	if (err)
+		return err;
+
+	/* Refuse a request which selects entries that cannot be deleted, rather
+	 * than answer it by deleting the entries it asked to keep.
+	 */
+	if (ndm_flags & ~DSA_FDB_FLUSH_ALLOWED_NDM_FLAGS) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Unsupported fdb flush ndm flag bits set");
+		return -EOPNOTSUPP;
+	}
+	if (ndm->ndm_state & ~DSA_FDB_FLUSH_ALLOWED_NDM_STATES) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Unsupported fdb flush ndm state bits set");
+		return -EOPNOTSUPP;
+	}
+	if (tb[NDA_NDM_FLAGS_MASK] &&
+	    (nla_get_u8(tb[NDA_NDM_FLAGS_MASK]) &
+	     ~DSA_FDB_FLUSH_ALLOWED_NDM_FLAGS_MASK)) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Unsupported fdb flush ndm flag mask bits set");
+		return -EOPNOTSUPP;
+	}
+
+	/* The bridge port of a LAG or HSR member is the aggregate device, so a
+	 * flush of one member cannot be told to the bridge without dropping the
+	 * addresses its siblings learned as well.
+	 */
+	if (dp->lag || dp->hsr_dev) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Cannot flush a LAG or HSR member on its own");
+		return -EOPNOTSUPP;
+	}
+
+	/* The bridge uses NDA_IFINDEX to scope a flush to one of its ports.
+	 * Here the port is the device the request was sent to.
+	 */
+	if (tb[NDA_IFINDEX] && nla_get_s32(tb[NDA_IFINDEX]) != dev->ifindex) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Flush device does not match target port");
+		return -EOPNOTSUPP;
+	}
+
+	if (tb[NDA_VLAN])
+		vid = nla_get_u16(tb[NDA_VLAN]);
+
+	return dsa_port_flush_dynamic_fdb(dp, vid);
+}
+
 static int dsa_user_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
 	struct dsa_user_priv *p = netdev_priv(dev);
@@ -2704,6 +2789,7 @@ static const struct net_device_ops dsa_user_netdev_ops = {
 	.ndo_set_rx_mode	= dsa_user_set_rx_mode,
 	.ndo_set_mac_address	= dsa_user_set_mac_address,
 	.ndo_fdb_dump		= dsa_user_fdb_dump,
+	.ndo_fdb_del_bulk	= dsa_user_fdb_del_bulk,
 	.ndo_eth_ioctl		= dsa_user_ioctl,
 	.ndo_get_iflink		= dsa_user_get_iflink,
 #ifdef CONFIG_NET_POLL_CONTROLLER