[PATCH iwl-net v2] iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

[PATCH iwl-net v2] iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

[Petr Oros]

The IAVF_RXD_LEGACY_L2TAG2_M mask was incorrectly defined as
GENMASK_ULL(63, 32), extracting 32 bits from qw2 instead of the
16-bit VLAN tag. In the legacy Rx descriptor layout, the 2nd L2TAG2
(VLAN tag) occupies bits 63:48 of qw2, not 63:32.

The oversized mask causes FIELD_GET to return a 32-bit value where the
actual VLAN tag sits in bits 31:16. When this value is passed to
iavf_receive_skb() as a u16 parameter, it gets truncated to the lower
16 bits (which contain the 1st L2TAG2, typically zero). As a result,
__vlan_hwaccel_put_tag() is never called and software VLAN interfaces
on VFs receive no traffic.

This affects VFs behind ice PF (VIRTCHNL VLAN v2) when the PF
advertises VLAN stripping into L2TAG2_2 and legacy descriptors are
used.

The flex descriptor path already uses the correct mask
(IAVF_RXD_FLEX_L2TAG2_2_M = GENMASK_ULL(63, 48)).

Reproducer:
 1. Create 2 VFs on ice PF (echo 2 > sriov_numvfs)
 2. Disable spoofchk on both VFs
 3. Move each VF into a separate network namespace
 4. On each VF: create VLAN interface (e.g. vlan 198), assign IP,
    bring up
 5. Set rx-vlan-offload OFF on both VFs
 6. Ping between VLAN interfaces -> expect PASS
    (VLAN tag stays in packet data, kernel matches in-band)
 7. Set rx-vlan-offload ON on both VFs
 8. Ping between VLAN interfaces -> expect FAIL if bug present
    (HW strips VLAN tag into descriptor L2TAG2 field, wrong mask
    extracts bits 47:32 instead of 63:48, truncated to u16 -> zero,
    __vlan_hwaccel_put_tag() never called, packet delivered to parent
    interface, not VLAN interface)

The reproducer requires legacy Rx descriptors. On modern ice + iavf
with full PTP support, flex descriptors are always negotiated and the
buggy legacy path is never reached. Flex descriptors require all of:
 - CONFIG_PTP_1588_CLOCK enabled
 - VIRTCHNL_VF_OFFLOAD_RX_FLEX_DESC granted by PF
 - PTP capabilities negotiated (VIRTCHNL_VF_CAP_PTP)
 - VIRTCHNL_1588_PTP_CAP_RX_TSTAMP supported
 - VIRTCHNL_RXDID_2_FLEX_SQ_NIC present in DDP profile

If any condition is not met, iavf_select_rx_desc_format() falls back
to legacy descriptors (RXDID=1) and the wrong L2TAG2 mask is hit.

Fixes: 2dc8e7c36d80 ("iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors")
Signed-off-by: Petr Oros <poros@redhat.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
---
v2: added reproducer steps and flex descriptor requirements to commit
    message (Paul)
---
 drivers/net/ethernet/intel/iavf/iavf_type.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/iavf/iavf_type.h b/drivers/net/ethernet/intel/iavf/iavf_type.h
index 1d8cf29cb65ac5..5bb1de1cfd33b1 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_type.h
+++ b/drivers/net/ethernet/intel/iavf/iavf_type.h
@@ -277,7 +277,7 @@ struct iavf_rx_desc {
 /* L2 Tag 2 Presence */
 #define IAVF_RXD_LEGACY_L2TAG2P_M		BIT(0)
 /* Stripped S-TAG VLAN from the receive packet */
-#define IAVF_RXD_LEGACY_L2TAG2_M		GENMASK_ULL(63, 32)
+#define IAVF_RXD_LEGACY_L2TAG2_M		GENMASK_ULL(63, 48)
 /* Stripped S-TAG VLAN from the receive packet */
 #define IAVF_RXD_FLEX_L2TAG2_2_M		GENMASK_ULL(63, 48)
 /* The packet is a UDP tunneled packet */
-- 
2.52.0

RE: [Intel-wired-lan] [PATCH iwl-net v2] iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Petr Oros
> Sent: Monday, March 23, 2026 11:16 AM
> To: netdev@vger.kernel.org
> Cc: Paul Menzel <pmenzel@molgen.mpg.de>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@intel.com>; Eric Dumazet <edumazet@google.com>;
> linux-kernel@vger.kernel.org; Loktionov, Aleksandr
> <aleksandr.loktionov@intel.com>; Andrew Lunn <andrew+netdev@lunn.ch>;
> Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Mateusz Polchlopek
> <mateusz.polchlopek@intel.com>; Keller, Jacob E
> <jacob.e.keller@intel.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> Abeni <pabeni@redhat.com>; David S. Miller <davem@davemloft.net>;
> intel-wired-lan@lists.osuosl.org
> Subject: [Intel-wired-lan] [PATCH iwl-net v2] iavf: fix wrong VLAN
> mask for legacy Rx descriptors L2TAG2
> 
> The IAVF_RXD_LEGACY_L2TAG2_M mask was incorrectly defined as
> GENMASK_ULL(63, 32), extracting 32 bits from qw2 instead of the 16-bit
> VLAN tag. In the legacy Rx descriptor layout, the 2nd L2TAG2 (VLAN
> tag) occupies bits 63:48 of qw2, not 63:32.
> 
> The oversized mask causes FIELD_GET to return a 32-bit value where the
> actual VLAN tag sits in bits 31:16. When this value is passed to
> iavf_receive_skb() as a u16 parameter, it gets truncated to the lower
> 16 bits (which contain the 1st L2TAG2, typically zero). As a result,
> __vlan_hwaccel_put_tag() is never called and software VLAN interfaces
> on VFs receive no traffic.
> 
> This affects VFs behind ice PF (VIRTCHNL VLAN v2) when the PF
> advertises VLAN stripping into L2TAG2_2 and legacy descriptors are
> used.
> 
> The flex descriptor path already uses the correct mask
> (IAVF_RXD_FLEX_L2TAG2_2_M = GENMASK_ULL(63, 48)).
> 
> Reproducer:
>  1. Create 2 VFs on ice PF (echo 2 > sriov_numvfs)  2. Disable
> spoofchk on both VFs  3. Move each VF into a separate network
> namespace  4. On each VF: create VLAN interface (e.g. vlan 198),
> assign IP,
>     bring up
>  5. Set rx-vlan-offload OFF on both VFs
>  6. Ping between VLAN interfaces -> expect PASS
>     (VLAN tag stays in packet data, kernel matches in-band)  7. Set
> rx-vlan-offload ON on both VFs  8. Ping between VLAN interfaces ->
> expect FAIL if bug present
>     (HW strips VLAN tag into descriptor L2TAG2 field, wrong mask
>     extracts bits 47:32 instead of 63:48, truncated to u16 -> zero,
>     __vlan_hwaccel_put_tag() never called, packet delivered to parent
>     interface, not VLAN interface)
> 
> The reproducer requires legacy Rx descriptors. On modern ice + iavf
> with full PTP support, flex descriptors are always negotiated and the
> buggy legacy path is never reached. Flex descriptors require all of:
>  - CONFIG_PTP_1588_CLOCK enabled
>  - VIRTCHNL_VF_OFFLOAD_RX_FLEX_DESC granted by PF
>  - PTP capabilities negotiated (VIRTCHNL_VF_CAP_PTP)
>  - VIRTCHNL_1588_PTP_CAP_RX_TSTAMP supported
>  - VIRTCHNL_RXDID_2_FLEX_SQ_NIC present in DDP profile
> 
> If any condition is not met, iavf_select_rx_desc_format() falls back
> to legacy descriptors (RXDID=1) and the wrong L2TAG2 mask is hit.
> 
> Fixes: 2dc8e7c36d80 ("iavf: refactor iavf_clean_rx_irq to support
> legacy and flex descriptors")
> Signed-off-by: Petr Oros <poros@redhat.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
> ---
> v2: added reproducer steps and flex descriptor requirements to commit
>     message (Paul)
> ---
>  drivers/net/ethernet/intel/iavf/iavf_type.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/iavf/iavf_type.h
> b/drivers/net/ethernet/intel/iavf/iavf_type.h
> index 1d8cf29cb65ac5..5bb1de1cfd33b1 100644
> --- a/drivers/net/ethernet/intel/iavf/iavf_type.h
> +++ b/drivers/net/ethernet/intel/iavf/iavf_type.h
> @@ -277,7 +277,7 @@ struct iavf_rx_desc {
>  /* L2 Tag 2 Presence */
>  #define IAVF_RXD_LEGACY_L2TAG2P_M		BIT(0)
>  /* Stripped S-TAG VLAN from the receive packet */
> -#define IAVF_RXD_LEGACY_L2TAG2_M		GENMASK_ULL(63, 32)
> +#define IAVF_RXD_LEGACY_L2TAG2_M		GENMASK_ULL(63, 48)
>  /* Stripped S-TAG VLAN from the receive packet */
>  #define IAVF_RXD_FLEX_L2TAG2_2_M		GENMASK_ULL(63, 48)
>  /* The packet is a UDP tunneled packet */
> --
> 2.52.0

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

Re: [Intel-wired-lan] [PATCH iwl-net v2] iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

[Jacob Keller]

On 3/23/2026 3:15 AM, Petr Oros wrote:
> The reproducer requires legacy Rx descriptors. On modern ice + iavf
> with full PTP support, flex descriptors are always negotiated and the
> buggy legacy path is never reached. Flex descriptors require all of:
>  - CONFIG_PTP_1588_CLOCK enabled
>  - VIRTCHNL_VF_OFFLOAD_RX_FLEX_DESC granted by PF
>  - PTP capabilities negotiated (VIRTCHNL_VF_CAP_PTP)
>  - VIRTCHNL_1588_PTP_CAP_RX_TSTAMP supported
>  - VIRTCHNL_RXDID_2_FLEX_SQ_NIC present in DDP profile
> 
> If any condition is not met, iavf_select_rx_desc_format() falls back
> to legacy descriptors (RXDID=1) and the wrong L2TAG2 mask is hit.
> 

> Fixes: 2dc8e7c36d80 ("iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors")

Sure enough, this commit changed the legacy version to:
+/* Stripped S-TAG VLAN from the receive packet */
+#define IAVF_RXD_LEGACY_L2TAG2_M               GENMASK_ULL(63, 32)

I guess since we basically always negotiated flexible descriptors after
this that we never caught it.

Thanks for the fix.

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

Regards,
Jake