Re: [PATCH net] net: lan78xx: Disable hardware vlan filtering in promiscuous mode

[Florian Fainelli <f.fainelli@gmail.com>]

On 11/11/2020 7:43 AM, Jakub Kicinski wrote:
> On Tue, 10 Nov 2020 16:39:58 +0100 Markus Blöchl wrote:
>> The rx-vlan-filter feature flag prevents unexpected tagged frames on
>> the wire from reaching the kernel in promiscuous mode.
>> Disable this offloading feature in the lan7800 controller whenever
>> IFF_PROMISC is set and make sure that the hardware features
>> are updated when IFF_PROMISC changes.
>>
>> Signed-off-by: Markus Blöchl <markus.bloechl@ipetronik.com>
>> ---
>>
>> Notes:
>>     When sniffing ethernet using a LAN7800 ethernet controller, vlan-tagged
>>     frames are silently dropped by the controller due to the
>>     RFE_CTL_VLAN_FILTER flag being set by default since commit
>>     4a27327b156e("net: lan78xx: Add support for VLAN filtering.").
>>
>>     In order to receive those tagged frames it is necessary to manually disable
>>     rx vlan filtering using ethtool ( `ethtool -K ethX rx-vlan-filter off` or
>>     corresponding ioctls ). Setting all bits in the vlan filter table to 1 is
>>     an even worse approach, imho.
>>
>>     As a user I would probably expect that setting IFF_PROMISC should be enough
>>     in all cases to receive all valid traffic.
>>     Therefore I think this behaviour is a bug in the driver, since other
>>     drivers (notably ixgbe) automatically disable rx-vlan-filter when
>>     IFF_PROMISC is set. Please correct me if I am wrong here.
> 
> I've been mulling over this, I'm not 100% sure that disabling VLAN
> filters on promisc is indeed the right thing to do. The ixgbe doing
> this is somewhat convincing. OTOH users would not expect flow filters
> to get disabled when promisc is on, so why disable vlan filters?
> 
> Either way we should either document this as an expected behavior or
> make the core clear the features automatically rather than force
> drivers to worry about it.
> 
> Does anyone else have an opinion, please?

The semantics of promiscuous are pretty clear though, and if you have a
NIC with VLAN filtering capability which could prevent the stack from
seeing *all* packets, that would be considered a bug. I suppose that you
could not disable VLAN filtering but instead install all 4096 - N VLANs
(N being currently used) into the filter to guarantee receiving those
VLAN tagged frames?

As far as flow filters, this is actually a good question, it sounds like
there are some possibly interesting problems to solve there. For
instance with an Ethernet switch, if you had a rule that diverted
packets to be switched directly to a particular port, what should happen
when either of these ports is in promiscuous mode? Should the switch be
instructed to replace all of the rules to forward + copy to the CPU?
-- 
Florian