[pve-devel] [PATCH-SERIE ifupdown2/common] disable rx-vlan-filter on iface in vlan-aware-bridge

[pve-devel] [PATCH-SERIE ifupdown2/common] disable rx-vlan-filter on iface in vlan-aware-bridge

[Alexandre Derumier]

Hi,

Some nics like mellanox connect-x  or intel i40e don't work with vlan-aware-bridge
when too many vlans are defined.
Depend of the model, connectx-3 is limited to 64 vlans, connect-x4 to 128vlans
https://forum.proxmox.com/threads/proxmox-7-and-mellanox-connectx4-and-vlan-aware-bridge.104926/#post-555269

i40e seem to throw errors like
Jan 18 14:44:27 jupiter kernel: [ 145.060365] i40e 0000:3d:00.0: Error I40E_AQ_RC_ENOSPC, forcing overflow promiscuous on PF
https://forum.proxmox.com/threads/error-i40e_aq_rc_enospc-forcing-overflow-promiscuous-on-pf.62875/
https://forum.proxmox.com/threads/proxmox-8-and-i40e-driver-kernel-6-2.129364/

rx-vlan-filter is only a protection to drop packets with unknown vlan at nic level.
(not related to vlan offloading, where nic can support any number of vlan)

When vlan-aware is enabled, bridge is already doing the vlan filtering, so it's pretty safe to disable it.
(AFAIK, it was not enabled on proxmox 5, as I didn't have mellanox problem at this time)

This patch serie add support to ifupdown2 to "rx-vlan-filter" and add ethtool as depend
and rx-vlan-filter is added to /etc/network/interfaces on phys nic if the nic is port of vlan aware bridge.
(or slave of bond port of vlan-aware-bridge)

fix:
https://bugzilla.proxmox.com/show_bug.cgi?id=2329
https://bugzilla.proxmox.com/show_bug.cgi?id=3893

(maybe they are other related bug reports)


ifupdown2:

Alexandre Derumier (2):
  add ethtool as depend
  patch: ethtool: add rx-vlan-filter support

 debian/control                                |  4 +-
 debian/patches/series                         |  1 +
 ...01-addons-ethtool-add-rx-vlan-filter.patch | 43 +++++++++++++++++++
 ifupdown2                                     |  2 +-
 4 files changed, 47 insertions(+), 3 deletions(-)
 create mode 100644 debian/patches/upstream/0001-addons-ethtool-add-rx-vlan-filter.patch

pve-common:

Alexandre Derumier (1):
  network_interfaces: disable rx-vlan-filter for physical interfaces
    ports of a vlan-aware bridge

 src/PVE/INotify.pm | 2 ++
 1 file changed, 2 insertions(+)


-- 
2.39.2

[pve-devel] [PATCH ifupdown2 1/2] add ethtool as depend

[Alexandre Derumier]

some users need to disable some buggy features for their nic,
install ethtool by default

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 debian/control | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/debian/control b/debian/control
index 4eea122..29eef2e 100644
--- a/debian/control
+++ b/debian/control
@@ -17,8 +17,8 @@ Architecture: all
 Provides: ifupdown
 Conflicts: ifupdown
 Replaces: ifupdown
-Depends: ${python3:Depends}, ${misc:Depends}, iproute2, python3-six, python3-setuptools, python3-systemd
-Suggests: isc-dhcp-client, bridge-utils, ethtool, python3-gvgen, python3-mako
+Depends: ${python3:Depends}, ${misc:Depends}, iproute2, python3-six, python3-setuptools, python3-systemd, ethtool
+Suggests: isc-dhcp-client, bridge-utils, python3-gvgen, python3-mako
 Description: Network Interface Management tool similar to ifupdown
  ifupdown2 is ifupdown re-written in Python. It replaces ifupdown and provides
  the same user interface as ifupdown for network interface configuration.
-- 
2.39.2

[pve-devel] applied: [PATCH ifupdown2 1/2] add ethtool as depend

[Thomas Lamprecht]

Am 23/06/2023 um 11:02 schrieb Alexandre Derumier:
> some users need to disable some buggy features for their nic,
> install ethtool by default
> 
> Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
> ---
>  debian/control | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
>

applied, thanks!

[pve-devel] [PATCH pve-common 1/1] network_interfaces: disable rx-vlan-filter for physical interfaces ports of a vlan-aware bridge

[Alexandre Derumier]

some nic like mellanox connectx or intel i40e don't work well vlan-aware bridge
because they are limited in number of vlan filtering in hardware

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 src/PVE/INotify.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/PVE/INotify.pm b/src/PVE/INotify.pm
index c86c2de..c4dd85d 100644
--- a/src/PVE/INotify.pm
+++ b/src/PVE/INotify.pm
@@ -1668,6 +1668,8 @@ sub __write_etc_network_interfaces {
 	$iface = $bondslaves->{$iface} if $bondslaves->{$iface};
 	if ($bridgeports->{$iface} && $bridges->{$bridgeports->{$iface}}->{bridge_vlan_aware}) {
 	    $ifaces->{$phys_iface}->{'rx-vlan-filter'} = 'off' if !defined($ifaces->{$phys_iface}->{'rx-vlan-filter'});
+	} else {
+	    delete $ifaces->{$phys_iface}->{'rx-vlan-filter'};
 	}
     }
 
-- 
2.39.2

Re: [pve-devel] [PATCH pve-common 1/1] network_interfaces: disable rx-vlan-filter for physical interfaces ports of a vlan-aware bridge

[Thomas Lamprecht]

Am 23/06/2023 um 11:02 schrieb Alexandre Derumier:
> some nic like mellanox connectx or intel i40e don't work well vlan-aware bridge
> because they are limited in number of vlan filtering in hardware
> 
> Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
> ---
>  src/PVE/INotify.pm | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/src/PVE/INotify.pm b/src/PVE/INotify.pm
> index c86c2de..c4dd85d 100644
> --- a/src/PVE/INotify.pm
> +++ b/src/PVE/INotify.pm
> @@ -1668,6 +1668,8 @@ sub __write_etc_network_interfaces {
>  	$iface = $bondslaves->{$iface} if $bondslaves->{$iface};
>  	if ($bridgeports->{$iface} && $bridges->{$bridgeports->{$iface}}->{bridge_vlan_aware}) {
>  	    $ifaces->{$phys_iface}->{'rx-vlan-filter'} = 'off' if !defined($ifaces->{$phys_iface}->{'rx-vlan-filter'});
> +	} else {
> +	    delete $ifaces->{$phys_iface}->{'rx-vlan-filter'};

this doesn't apply, the diff context make it seems like you got more lines
on top - extra patches/commits?

>  	}
>      }
>  

[pve-devel] [PATCH ifupdown2 2/2] patch: ethtool: add rx-vlan-filter support

[Alexandre Derumier]

to fix nic like mellanox && vlan-aware-bridge

upstream pull request:
https://github.com/CumulusNetworks/ifupdown2/pull/266

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
 debian/patches/series                         |  1 +
 ...01-addons-ethtool-add-rx-vlan-filter.patch | 43 +++++++++++++++++++
 ifupdown2                                     |  2 +-
 3 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 debian/patches/upstream/0001-addons-ethtool-add-rx-vlan-filter.patch

diff --git a/debian/patches/series b/debian/patches/series
index 628fed1..9f2936f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,4 @@ pve/0007-allow-vlan-tag-inside-vxlan-tunnel.patch
 pve/0008-lacp-bond-remove-bond-min-links-0-warning.patch
 pve/0009-gvgeb-fix-python-interpreter-shebang.patch
 upstream/0001-add-ipv6-slaac-support-inet6-auto-accept_ra.patch
+upstream/0001-addons-ethtool-add-rx-vlan-filter.patch
diff --git a/debian/patches/upstream/0001-addons-ethtool-add-rx-vlan-filter.patch b/debian/patches/upstream/0001-addons-ethtool-add-rx-vlan-filter.patch
new file mode 100644
index 0000000..aad6c24
--- /dev/null
+++ b/debian/patches/upstream/0001-addons-ethtool-add-rx-vlan-filter.patch
@@ -0,0 +1,43 @@
+From a087295ba496680b81ecafe72f999d4e9076e737 Mon Sep 17 00:00:00 2001
+From: Alexandre Derumier <aderumier@odiso.com>
+Date: Fri, 23 Jun 2023 09:13:39 +0200
+Subject: [PATCH] addons: ethtool: add rx-vlan-filter
+
+some nic like mellanox connectx don't work well with
+vlan aware bridge && rx-vlan-filter.
+(They are limited in number of vlans in hardware filtering,
+and break with big number of vlans like bridge-vids 2-4096)
+
+Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
+---
+ ifupdown2/addons/ethtool.py | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/ifupdown2/addons/ethtool.py b/ifupdown2/addons/ethtool.py
+index 2134329..8a79472 100644
+--- a/ifupdown2/addons/ethtool.py
++++ b/ifupdown2/addons/ethtool.py
+@@ -117,6 +117,12 @@ class ethtool(Addon, moduleBase):
+                 'validvals': ['on', 'off'],
+                 'default': 'varies by interface'
+             },
++            'rx-vlan-filter': {
++                'help': 'RX Vlan Filter',
++                'example': ['rx-vlan-filter off'],
++                'validvals': ['on', 'off'],
++                'default': 'varies by interface'
++            },
+             'ring-rx': {
+                 'help': 'Ring RX Parameter',
+                 'example': ['ring-rx 512'],
+@@ -384,6 +390,7 @@ class ethtool(Addon, moduleBase):
+         self.do_offload_settings(ifaceobj, 'ufo-offload', 'ufo')
+         self.do_offload_settings(ifaceobj, 'tx-offload', 'tx')
+         self.do_offload_settings(ifaceobj, 'rx-offload', 'rx')
++        self.do_offload_settings(ifaceobj, 'rx-vlan-filter', 'rx-vlan-filter')
+ 
+     def _pre_down(self, ifaceobj):
+         pass #self._post_up(ifaceobj,operation="_pre_down")
+-- 
+2.39.2
+
diff --git a/ifupdown2 b/ifupdown2
index a052254..a087295 160000
--- a/ifupdown2
+++ b/ifupdown2
@@ -1 +1 @@
-Subproject commit a0522546b848435115a20eb647f87ade01761a33
+Subproject commit a087295ba496680b81ecafe72f999d4e9076e737
-- 
2.39.2

Re: [pve-devel] [PATCH ifupdown2 2/2] patch: ethtool: add rx-vlan-filter support

[Thomas Lamprecht]

Am 23/06/2023 um 11:02 schrieb Alexandre Derumier:
> to fix nic like mellanox && vlan-aware-bridge
> 
> upstream pull request:
> https://github.com/CumulusNetworks/ifupdown2/pull/266
> 
> Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
> ---
>  debian/patches/series                         |  1 +
>  ...01-addons-ethtool-add-rx-vlan-filter.patch | 43 +++++++++++++++++++
>  ifupdown2                                     |  2 +-
>  3 files changed, 45 insertions(+), 1 deletion(-)
>  create mode 100644 debian/patches/upstream/0001-addons-ethtool-add-rx-vlan-filter.patch
> 

applied, thanks - but..

> diff --git a/ifupdown2 b/ifupdown2
> index a052254..a087295 160000
> --- a/ifupdown2
> +++ b/ifupdown2
> @@ -1 +1 @@
> -Subproject commit a0522546b848435115a20eb647f87ade01761a33
> +Subproject commit a087295ba496680b81ecafe72f999d4e9076e737

..the submodule commit change seems wrong though, you change it here to some
non-upstream commit and in the "import traceback" patch you change it back
again.

I dropped this here and ammend your patch.