The switchdev VLAN object carries no protocol, so a VLAN added on a
bridge with vlan_protocol 802.1ad is programmed as an 802.1Q VLAN
without an error. The switch then matches it against the 802.1Q tag of
a frame, which such a bridge does not treat as its VLAN tag, while the
bridge believes the VLAN is offloaded.
Ask the bridge for its protocol and refuse anything but 802.1Q with an
error and an extack message. -EOPNOTSUPP would not do: the bridge takes
it as "keep this VLAN in software" and carries on silently. A host VLAN
arrives on the CPU port, which is in no bridge, so take the bridge from
the VLAN object there.
A port can then only join an 802.1ad bridge that has no default PVID
and no host VLAN, as the bridge adds those VLANs while the port joins.
Changing the protocol of a bridge that already holds ports is not seen
by the driver, as DSA does not forward that attribute.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Quinn O'Shea <qoshea@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25835
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>