Re: [Intel-wired-lan] [PATCH iwl-net] iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

[Petr Oros <poros@redhat.com>]

On 3/20/26 15:29, Paul Menzel wrote:
> Dear Petr,
>
>
> Thank you for your patch.
>
> Am 20.03.26 um 14:53 schrieb Petr Oros:
>> The IAVF_RXD_LEGACY_L2TAG2_M mask was incorrectly defined as
>> GENMASK_ULL(63, 32), extracting 32 bits from qw2 instead of the
>> 16-bit VLAN tag. In the legacy Rx descriptor layout, the 2nd L2TAG2
>> (VLAN tag) occupies bits 63:48 of qw2, not 63:32.
>>
>> The oversized mask causes FIELD_GET to return a 32-bit value where the
>> actual VLAN tag sits in bits 31:16. When this value is passed to
>> iavf_receive_skb() as a u16 parameter, it gets truncated to the lower
>> 16 bits (which contain the 1st L2TAG2, typically zero). As a result,
>> __vlan_hwaccel_put_tag() is never called and software VLAN interfaces
>> on VFs receive no traffic.
>>
>> This affects VFs behind ice PF (VIRTCHNL VLAN v2) when the PF
>> advertises VLAN stripping into L2TAG2_2 and legacy descriptors are
>> used.
>>
>> The flex descriptor path already uses the correct mask
>> (IAVF_RXD_FLEX_L2TAG2_2_M = GENMASK_ULL(63, 48)).
>
> Do you have a reproducer to verify the fix?

Yes, i have

  1. Create 2 VFs on ice PF (echo 2 > sriov_numvfs)
  2. Disable spoofchk on both VFs
  3. Move each VF into a separate network namespace
  4. On each VF: create VLAN interface (e.g. vlan 198), assign IP, bring up
  5. Set rx-vlan-offload OFF on both VFs
  6. Ping between VLAN interfaces → expect PASS
      (VLAN tag stays in packet data, kernel matches in-band)
  7. Set rx-vlan-offload ON on both VFs
  8. Ping between VLAN interfaces → expect FAIL if bug present
      (HW strips VLAN tag into descriptor L2TAG2 field,
       wrong mask extracts bits 47:32 instead of 63:48,
       truncated to u16 → zero, __vlan_hwaccel_put_tag() never called,
       packet delivered to parent interface, not VLAN interface)

>
>> Fixes: 2dc8e7c36d80 ("iavf: refactor iavf_clean_rx_irq to support 
>> legacy and flex descriptors")
>
> (That first entered Linux v6.15-rc1, and Linux 6.12 and 6.18 are LTS 
> series.)
>
The reproducer works but requires legacy Rx descriptors to be in use.
On modern ice + iavf with full PTP support, flex descriptors are always
negotiated and the buggy legacy path is never reached.

Flex descriptors require all of the following:
   - CONFIG_PTP_1588_CLOCK enabled in kernel config
   - VIRTCHNL_VF_OFFLOAD_RX_FLEX_DESC granted by PF
   - PTP capabilities negotiated (VIRTCHNL_VF_CAP_PTP)
   - VIRTCHNL_1588_PTP_CAP_RX_TSTAMP supported
   - VIRTCHNL_RXDID_2_FLEX_SQ_NIC present in DDP profile

If any of these conditions is not met, iavf_select_rx_desc_format()
falls back to legacy descriptors (RXDID=1) and the wrong L2TAG2 mask is hit.

In our kernel we ended up in a state where the iavf Rx path refactor was
backported but the full PTP support chain was not. Without PTP,
iavf_ptp_cap_supported() returns false and flex descriptors
are never selected, exposing the bug.

Regards,

Petr


>> Signed-off-by: Petr Oros <poros@redhat.com>
>> ---
>>   drivers/net/ethernet/intel/iavf/iavf_type.h | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/intel/iavf/iavf_type.h 
>> b/drivers/net/ethernet/intel/iavf/iavf_type.h
>> index 1d8cf29cb65ac5..5bb1de1cfd33b1 100644
>> --- a/drivers/net/ethernet/intel/iavf/iavf_type.h
>> +++ b/drivers/net/ethernet/intel/iavf/iavf_type.h
>> @@ -277,7 +277,7 @@ struct iavf_rx_desc {
>>   /* L2 Tag 2 Presence */
>>   #define IAVF_RXD_LEGACY_L2TAG2P_M        BIT(0)
>>   /* Stripped S-TAG VLAN from the receive packet */
>> -#define IAVF_RXD_LEGACY_L2TAG2_M        GENMASK_ULL(63, 32)
>> +#define IAVF_RXD_LEGACY_L2TAG2_M        GENMASK_ULL(63, 48)
>>   /* Stripped S-TAG VLAN from the receive packet */
>>   #define IAVF_RXD_FLEX_L2TAG2_2_M        GENMASK_ULL(63, 48)
>>   /* The packet is a UDP tunneled packet */
>
> Nice find.
>
> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
>
>
> Kind regards,
>
> Paul
>