kern/105054: vge driver sends VLAN IDs in wrong endian.

[Ian]

>Number:         105054
>Category:       kern
>Synopsis:       vge driver sends VLAN IDs in wrong endian.
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 02 00:40:21 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Ian
>Release:        6.2-PRERELEASE
>Organization:
none
>Environment:
FreeBSD pillbox 6.2-PRERELEASE FreeBSD 6.2-PRERELEASE #0: Wed Nov  1 15:48:21 CST 2006     root at abomination:/usr/obj/usr/src/sys/MINIMAL  i386
>Description:
The Via Gigabit Ethernet driver, vge(4), sends VLAN IDs (VID) in the incorrect endian.  This not only causes frames to be tagged with the wrong VID, but causes the VID field to bleed into the other fields in the 802.1Q header (Priority and CFI bits).  This does _not_ affect incoming VIDs, which are handled correctly.
>How-To-Repeat:
Ensure the vge driver is compiled into your kernel, and that you have a vge card.  Create a VLAN using ifconfig, and give it an IP address (e.g. `ifconfig vlan291 create inet 10.0.0.1/8 vlan 291 vlandev vge0`).  Connect the interface to another ethernet card via a crossover cable, and sniff traffic, making sure you capture the 802.1Q header (which should appear as 0x0123 in NBO [big endian], assuming you're using vlan 291 with frame with a priority of 0 and the CFI bit unset).  Attempt to ping another IP address on the VLAN's subnet (e.g. `ping 10.0.0.2`), which should generate ARP traffic on the interface.  The 802.1Q header should come through as 0x2301 (little endian, due to the bug).
>Fix:
Patch information for /usr/src/sys/dev/vge/if_vge.c version:
$FreeBSD: src/sys/dev/vge/if_vge.c,v 1.14.2.8 2006/09/05 07:06:15 mr Exp $


*** 1819,1825 ****
  	mtag = VLAN_OUTPUT_TAG(sc->vge_ifp, m_head);
  	if (mtag != NULL)
  		sc->vge_ldata.vge_tx_list[idx].vge_ctl |=
! 		    htole32(htons(VLAN_TAG_VALUE(mtag)) | VGE_TDCTL_VTAG);
  
  	sc->vge_ldata.vge_tx_list[idx].vge_sts |= htole32(VGE_TDSTS_OWN);
  
--- 1819,1825 ----
  	mtag = VLAN_OUTPUT_TAG(sc->vge_ifp, m_head);
  	if (mtag != NULL)
  		sc->vge_ldata.vge_tx_list[idx].vge_ctl |=
! 		    htole32(htole16(VLAN_TAG_VALUE(mtag)) | VGE_TDCTL_VTAG);
  
  	sc->vge_ldata.vge_tx_list[idx].vge_sts |= htole32(VGE_TDSTS_OWN);
  

>Release-Note:
>Audit-Trail:
>Unformatted: