Date: Wed, 6 Nov 2002 15:04:25 -0800 (PST) From: "Jacob S. Barrett" <jbarrett@amduat.net> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/45014: VLAN tag on frames received via em(4) are byte backwards. Message-ID: <200211062304.gA6N4POQ057399@www.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 45014
>Category: kern
>Synopsis: VLAN tag on frames received via em(4) are byte backwards.
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Nov 06 15:10:01 PST 2002
>Closed-Date:
>Last-Modified:
>Originator: Jacob S. Barrett
>Release: RELENG_4_7
>Organization:
>Environment:
FreeBSD pogo01.pogozone.com 4.7-RELEASE-p1 FreeBSD 4.7-RELEASE-p1 #5: Tue Nov 5 23:32:22 PST 2002 root@pogo01.pogozone.com:/usr/obj/usr/src/sys/HP-LPr-router i386
>Description:
VLAN IDs are byte backwards when received. For example, VLAN 5 is received as 1280, 2 as 512, and 18 as 512 as well. The reason 18 is 512 is that only 12 bits of the 16 field is used for the id so the top nibble is masked off.
0x0005 -> 0x0500
0x0002 -> 0x0200
0x0012 -> 0x0200
Intel Chipset: 82543 - Intel® PRO/1000 F Server Adapter
Driver Version: 1.3.14
>How-To-Repeat:
Switch configuration:
create vlan test
configure test tag 5
configure test add ports 1
configure test add ports 2 tagged
Network mapping:
Host A em0 <-> untaged port 1
Host B em0 <-> tagged port 2
Host A configuration:
ifconfig em0 inet 10.0.0.1
Host B configuration:
ifconfig em0 up
ifconfig vlan5 create inet 10.0.0.2 vlan 5 vlandev em0
Attach tcpdump on host B to em0. Ping host B from host A. You should see an arp request with vlan id 1280 come across the interface. Since this isn't vlan id 5 it will be dropped. Not arp reply will be generated. Try changing the vlan id around and you will see that the byte order is swapped and then the first nibble is masked off. You will only be able to get vlan ids that are the same backwards and forwards with the fist nibble of each byte being zero. So anything of the form 0x0y0y, where y is 0-F, will actually match the vlan id on the driver and generate an arp reply.
>Fix:
--- if_em.c Tue Nov 5 23:53:40 2002
+++ if_em.c Tue Nov 5 23:54:55 2002
@@ -2017,8 +2017,8 @@
em_receive_checksum(adapter, current_desc,
adapter->fmp);
if (current_desc->status & E1000_RXD_STAT_VP)
- VLAN_INPUT_TAG(eh, adapter->fmp,
- current_desc->special);
+ VLAN_INPUT_TAG(eh, adapter->fmp,
+ ntohs(current_desc->special));
else
ether_input(ifp, eh, adapter->fmp);
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200211062304.gA6N4POQ057399>