88E6095芯片VLAN技术分析

1、88E6095芯片VLAN技术分析MARVEL出产的88E6095芯片是一款较高端的交换芯片,它带有8个FE口和3个GE口，其VLAN功能分析如下(本文档只讨论基于802.1Q的VLAN)：交换模式6095芯片对每个端口支持不同的交换模式，可以通过配置寄存器PortControl2(Reg0 x08)的Bit11：10来实现，提供的Dsdt接口为：GT_STATUSgvlnSetPortVlanDot1qMode(INGT_QD_DEV*dev,INGT_LPORTport,INGT_DOT1Q_MODEmode);包括4种模式：Secure模式：所带VLANtag必须存在于VTU表中，且入端

2、口必须是该VLAN成员，否则丢弃报文Check模式：所带VLANtag必须存在于VTU表中，否则丢弃报文Fallback模式：入端口报文不丢弃802.1QDisabled：802.1Q关闭，使用端口VLAN模式，所有报文透传前3种模式都遵循802.1Q规则，报文进入后按照VLAN表项进行转发，不同就在于进入的时候条件限制，有的未作限制(Fallback模式)，有的(Secure模式)要求严格。我们在实现基于802.1Q的VLAN时采用第1种，Secure模式。报文进来时先识别所带的VLANtag。若所带VLANtag未存在于VLAN表项中，或者进来的端口不属于该VLANtag的VLAN成员，报

3、文被丢弃，顺利进入的报文则指定VLANtag的VID进行转发；若报文中不带VLANtag,则判断该端口的缺省VLAN(PVID),当端口未加入缺省VLAN,报文被丢弃，当端口已经加入缺省VLAN时，则指定PVID进行转发。我们在实现基于端口的VLAN时釆用第4种，8021QDisabled。此时端口不识别报文所带的VLANtag，被认为是不带VLANtag的报文并被加上它的PVID，结合VLANTable(PortBaseVLANTable)的取值，查找MAC表进行转发。11/D0O2.lQModeR7/RIEEESD2JQModefarthispert.Thesebitsdeterminei

4、B02-1basedVLANssrsusedalongwithpartbasedVLANsf-orthisIngrossportItah-odetermineslheactiontobetakenifan802.1QVLANViolatianisdetGctadl.Thsssbitsweirkssfallows:00=8D2.1QDisabled.UsePartBasedVLANsonly.TheVLANlablebitssrdth巳DefaultVIDassignedtotheframeduringirgressdeterminewhichEgresspartsthisIngre号号perr

5、isaliawee1toswitchframestoforallframea4.01二Fallback.Enable802.1QfarthisIngressport.DonotdiscardIngresshfeEbe专hipviolationsandusetheVLANTablebitsbelowrftheiramssVIDisnotcaninedinthsVTU(bat卜errorsarelogged-Tsble84)Check.Enable802.1QforthisIngressportDonutdiscardIngressrifembershipviolationbuitdiscardt

6、heframeifitsVIDisrotGontainedintheVTU(botherrorsareloggedTableE4)_=Secure.ErableB02.1QforthsIngresspert.DiscardIngressMembershipviolationsanddiscardfranesrthoseVIDisnottaine自intheVTU(botherrorsarelogged一Table84).端口隔离端口隔离是比VLAN表更底层的隔离，它在802.1Q使能的情况也生效，也就是说配置了隔离的端口即使在同一VLAN中也不相通。通过端口隔离特性，用户可以对需要进行控制的端

7、口配置端口隔离功能，实现所有需要隔离端口之间业务数据的隔离，既增强了网络的安全性，也为用户提供了灵活的组网方案此功能可以通过配置VLANTable来实现，寄存器PortBasedVianMap(Reg0 x08)的BIT10：0。提供的Dsdt接口为GT_STATUSgvlnSetPortVlanPorts(INGT_QD_DEV*dev,INGT_LPORTport,INGT_LPORTmemPorts,INGT_U8memPortsLen);这是个单向表，例如，将Port0的Bit1写1表示数据可从Port0流向Port1，因此要实现Port0和Port1的隔离需要把Port0的Bit1写

8、0,同时把Port1的Bit0写0。10;0VLANTablDRWStoallonesSKEDptfcirthiaportsbitPotbasedVLANTablesThebitsinthistabbarousstorestrictwhichutpulportsthisinpilpartcansendframesto.TheVLANTablebitsareusedforallframesevenif802.1Qiser日bledonthisportorifProtectedPortis已仃abledonthiaport.Theaebitsreatrictdierebpertcansendfra

9、meslo(unilessaVLANTunnelframeIsbeingreceived一Table66).TosendframestoPnrtD?bitOoftiisregistermustteaoneTosendTamestoPort1,bit1ofthisregistermustbeaone,etc.Afterreset,allportsareaccessiblesincealltheotherportnumberbitsaresettoane_ThisPortsbrtiszeroatsrnsset.ThispreventsfranesIsavingthspDrtonwhichtheya

10、rrived.ThisPortsbitcantobesettoaoneinthedevices,whichallotsxranstob&switchedbsckrorheportonwhichtheyarrived.Inviewofthisfact,cares卜口uldbetakeninwritingcodetomanipulatethesebitsThisregstarisresetta0 x7FEforPortD(SIMDeviceAddress0 x10)Banditresetsio0 x7FDfcrParti(AddrDx.11).to0 x7FBfarPort2(Addr3x12).

11、etc.Howey臥iftheSW_24Pconfiguration日仃(口仃P9_TXO3jissettoone(24PeriMode)Port8and9corie叩configuredAheretheycannotcammuncatewitheachotherthisrsgistGr二0 x4FF乞ibothPorts6&9).端口类型6095芯片从逻辑功能上可以实现如下三种的以下三种端口类型：Access类型，端口只能属于1个VLAN,只能接收和发送1个VLAN的报文(发送报文不带Tag)，一般用于与终端用户之间的连接；Trunk类型，端口可以属于多个VLAN,可以接收和发送多个VLAN

12、的报文(发送报文都带Tag)，一般用于与交换机之间的连接；Hybrid类型，端口可以属于多个VLAN，可以接收和发送多个VLAN的报文（Untagged的VLAN发送报文都不带Tag,tagged的VLAN发送的报文都带vlantag）,一般用于特殊场景的连接。在802.1Q模式下，端口对标签的处理需要在VTU表项中配置标签处理模式，配置VTUDataRegister（Reg0 x0709）。也就是说对每条VLAN,个端口的标签处理方式可以不同，这样的处理才能实现如上描述的Hybrid类型。不同连接类型的端口加入VLAN的Tagged或Untag成员，Access端口只能加入Untag成员；T

13、runk端口以Untag成员加入等于自身PVID的VLAN，其余以Tagged方式加入；Hybrid端口按需求加入Untag成员或者Tagged成员。Untag成员配置成“01”Taged成员配置成“10”，其他非成员端口默认为“11”。1:0MemberIbflPOFWRMemhershiparidEgressTaggingforPort0Thesebitsareusedtosupp-at802.1QmembershipEindEgressTaggliigasfollows.00=PertisamemberofthisVLA忖日ndfrBrnewaretoegressnmodlifiedl-

14、01=PortisamemberofthisVLAMsardframesarstosgrsssUnlaggsd.ID=PertisamemberofthisVLAMandframe呂aretosgrAssTagg&d.11sPortisrwtamemberofthisVLAN.AnyframeswiththisVID1arediscardedatIngressandarenotallowedtoegressthisport.由Access端口修改为Trunk端口（或Hybrid端口），只需修改端口类型为Trunk类型（或Hybrid类型）。由Trunk端口（或Hybrid端口）修改为Acces

15、s端口，将端口类型修改为Access类型，同时端口回到VLAN1。Trunk端口不能修改为Hybrid端口，反之也是。4端口PVID当以太网端口接收到不带VLANTag的报文时，端口将在缺省VLAN的范围内传输该报文。Access端口只能属于1个VLAN,所以它的缺省VLAN就是它所在的VLAN；Trunk端口和Hybrid端口可以属于多个VLAN,所以需要手工设置端口的缺省VLANID。端口PVID可以通过修改寄存器DefaultPortVLANID&Priority（Reg0 x07）的Bit11：0来实现。提供的Dsdt接口为GT_STATUSgvlnSetPortVid（INGT_QD

16、_DEV*dev,INGT_LPORTport,INGT_U16vid）;11:0DefaultVIDRASto(MCIDefaultVLANIdentrfler.When802.1QisenabledonthisporttheDsfaultVIDHeldIsusedlastheIEEETaggedlVIDaddedLolhlaggedorpriufitylaggedframesdLnringegressLhatingressedfromthisport,litisalsousedasaLaggedframesVIDiftheframesVIDwas0 x000itisaprioritytag

17、gedfram&；oriftheportsForceDefaultVIDbit(sabov时issettoaone.When802.10isdiEablsdl-onthispert,theDefaultVIDfieldis品“尹丸tosllframeserrtBringtheport(ifthey酎色taggedctuntagg&d).ThisassignmAntisl兮2dintssrnaltotheswitch,soonlythatCrossChipPortBasedVLANscanbesupp-wted.5VLAN表项用户可以将端口加入到指定的VLAN中。执行该配置以后，以太网端口就可以

18、转发指定VLAN的报文，从而实现本交换机上的VLAN与对端交换机上相同VLAN的互通。Access端口只能加入到1个VLAN中,Trunk端口和Hybrid端口可以加入到多个VLAN中，端口加入VLAN时的处理，参见3端口类型。Dsdt提供的接口为GT_STATUSgvtuAddEntry(INGT_QD_DEV*dev,INGT_VTU_ENTRY*vtuEntry);和GT_STATUSgvtuDelEntry(INGT_QD_DEV*dev,INGT_VTU_ENTRY*vtuEntry);我们可以根据需求填写正确的vtuEntry的信息来下发VLAN表项。每一条VTU表项的配置，包含以

19、下内容：Table84;VTUOpersticnRegisterOffset:0k05orDecimal5BitsFieldTypeDesCFiptioil15VTLBusySCVLANTableUnitBusy.ThisbitmustbesettoaonetostartaVTUperation(seeXTUOpbelcvn).OnlycineVTUoperationcanbeexecutingatsnetimssothisbitmustbezerobeorsssttingitto日one.WhentharsqLastedVTUoperationcomiJetes,thisbitwillaut

20、cmaticallybocharodtoazero.Thstransitionorthisbitfromaonetoazeroinu&edtogenerateaninterrupt(TableS3j-14：12VTL.OpRWRTableunitTableOpcodsThedevicessupportthefollowirgVTUoperations(alloftheseoperallonscanbeexecutedwhileframesaretransitingthroughtlieswitch).000=NdCperatioi001=FlushAllEntries010=NoOperati

21、on”011LeadorPurgeanErtrylGetNextJ=RsserYsd=Resarvod=GetClearViolaiior.Data11-8RWRvTuMACAddressDatabaseNumberbits7:4OnalVTUOpsexceptforGetViolationData,ihlsfieldisDBNlhti7:4andIIisisedltoseparaleMACaddressdatabasesbyaframesVID,Ifmultipleaddressdalsbasesarenetbeingused,thesebitsmustremainzero.Ifmultip

22、leadkisidatabasesarebeingL&edl.theseblsareusedtosslthe-desireddaiebassnumberthatisassociatedwithVlDvalueonLoadloperations(nrused!toreadlthecurrentlysssignsdDBNumonGetNextoperatinns).ThslowerfourbitserftheVTUDBMumareinbits3:Dorthisregister.-TReserved!RESReG&rve-dlforfutureuse6MemberViolationROSourceM

23、emberViolation-OnGeUCIearViolationDataVTUOps,thisbitIsreturnedsettoaonelheViolationDelrvgservlcediIsduetoan602.1QMemberVidation.AMemberViolalionoccurswhenan802.1QenabledIngresspertaccessestheVTUwithaVlDthatiscontainedintheVTUbutwtwseMembershipliatdoesnrotincluKilethisIngressport.OnlythefirstMamberVi

24、olationorMissViolation(belov/l“dllbesaveduntilcleared.5MissViolationROVTUP/lssViclatidr.OrGs卄亡I曲NidationDataVFJOpsthistitisretumedseiIoaoneiftheNidationbeingslicedwasduetoan3021aPlissVifllatior.AP/l.ssViclatioroccurBwhenan0021QenabledIngressporlaccessesrheVTLwithaVIDthatisnotcontainedInlheVTL.Onlyth

25、efrstMissViolationorMemberViolation(abevE/Issaveduntilclearsd.4Reserved!RESReservedforfiitLreuseaoDBNum3:0/FPAiRVTUMACAddr&sDatab&aNumberbiteS:DarSourcePertIDOnSPIDLoadandGetNextVTUOps,thisIsDBNum3:0and11IsusedloseparateMACaddressdaIbbasesby己framesVJD.Ifmultipleedtfr已55databasesersnotbeingused：these

26、bitsmustremainzero,tfmultipleadklrssd!atab：&sareb&ingussd!,thesebitsusedtotherequired!adl-dr&ssdlatabasanumberthati兮associatedwithaVJDvaluecnLoadloperations(orusedtoreadthecurrenUyassignediDBNumonGetNestoperations)lTheupperfourbitsoftheVTU!sDBNumarainbits11:7ofthisregisterOntheGetVialaticnDaisVTUOp,

27、thiafisldlreturnstheSourcePortIIDtfthepartthatcausedtheviolation.IfSPIDDxFthesourcecrthejiolatimsw日兮the亡PUrMisterinterface(i.e.,theVTUwasfullduririgaCPULoadoperali-on)Table85:V7UVIDRcgifitorOffset:3x06orDecimal6BiUFialdTypoDgscription5:13ReservedHESReservedfarfutureuse12ValidRWREntrysValidbit.Atthee

28、ndofGetNext-operatiorEi.ifthisbitissetto日cnsitindicatestheVIDvalueb&lawisvalid.Ifthisbitisclearedtoa2raandtheVIDisallqr&e,itindicatethervdoftheVIDlistwsas；reachedwithnonewvalidentriesfound.OnLoadorPurgeoperations,thisbtIrKilcatesthecesirsdopsratlonicfsjLoad(whensetto且one)oraPurge(whenclearedtoazero)

29、.1:0VIDRWRVLANIdentifier.ThisVIDisu&edinallthVTUOpcommands(exceptGet/ClearViolalionData)anditis1heVIDthat忑associatedwithttveVTUdatabelow(Table&6)crtheVIDthatcauseditheVTUViolation.Reg0 x0709为成员列表，只列Reg0 x09图table8B:VTUDataRsgistorPortBto10Offset:0 x09orDecimal9BitsFieldTypeDedcriptianii15VIDPRIO/err

30、ideBBEBD95arnd63E60&5Fdevicesonly)RA/RVIDPriorityOverride-Whenthisbitisg&ttoaonethsVIDPRIbits(b&low)areused!tooverridetheprrcrilyonanyframeasscciat&dwiththisVIDaslongtheportsVTUPriQveniuebitisset(Table69)14:12VIDPRIRW代VIDPrioritybite.Thes巴bitsareusedtooverridethepriorityonianyframesaggDciatodIiththi

31、sVIDvaluo.ftheVlDPRlO/0mdsbit(above)issttoaone.11:10HortStatePWRWHHerVLANPortStalesforPort10.Thesebitsareusedtosupporl8C2.is(psrVLANSpanningTree)andshouldbeclearedtozaroi1602.15isnotused.SeePortStatePBbeto.氐aMemberTajP!0RWRMemb&rshiparrlCgreEETaggingforPort10.Thesebitsareu占edto&uppartS02.1Qmemb&rshi

32、pandEgr-egsTagging.S&eMemberTagP8belouL716Pon3tateP9RW总PerVLANPortScalesforPort9.Thesebllsareusedtosupport8C2.1s(perVLANSpanningTe巳)aridlsteuldbe：匚leaiedtozeroif0C2.1sisnrotLsedl.SeePortStatePSbelov.5:4MmberTagiPBRWRMembershipandEgressTaggingforPertBThE5bitsnn&u呂旦dtosupport802.1QmembarshiipandEgress

33、Tagging.SeeMemberTagPSbelow3:2PortState户3RWRPerVLANPortStatesforPortS.Thesebiteareusedtosupport6C2.1s(perVLANSpanningTree)antdlshouldbeclearedtozsrdif8C2.1sisnotused.ThePerVLANPartStatesare:DC=&02-1eDisabledl.Uenorv-VLAMPortStatGE；forthispertforframeEwiththisVID.01=BlDckout/List&nirjgPortStat&forthisporlforframeswiththisVID.=LearningP