The KS8995 100Mbit switch can do proper DSA per-port tagging with the proper set-up. This adds the code to handle ingress and egress KS8995 tags. The tagger is used by the KSZ8995XA support added later in this series. The tag is a modified 0x8100 ethertype tag where a bit in the last nibble is set for each target port. Always insert a distinct outer switch tag. User ports remove this field on egress, so reusing an existing 802.1Q header would consume the sender VLAN tag instead of preserving it. Push any hardware-accelerated VLAN tag into the packet first. This keeps the switch tag at offset 12 while retaining 802.1Q, 802.1ad and stacked VLAN headers as inner payload, and avoids relying on a valid SKB MAC header in direct transmit paths. Rate-limit receive untagging errors so repeated failures cannot flood the kernel log. Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260916-ks8995-to-ksz8-v15-2-8825ff5fd4be@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>