The VLAN tag insertion helper took vlan_tci as an 8-bit value, while
the descriptor provides a 16-bit VLAN TCI. This truncated egress tags
and caused VLAN ID corruption (for example, 4088/0x0ff8 became
248/0x00f8 at the receiver).

Change vlan_tci to uint16_t in the TX VLAN insertion path so the full
802.1Q TCI is preserved and transmitted correctly.

Signed-off-by: linhuang <linhuang@ruijie.com.cn>
---
 hw/net/ftgmac100.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index 2f05bba11d..b3da48c343 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -498,7 +498,7 @@ static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
 }

 static int ftgmac100_insert_vlan(FTGMAC100State *s, int frame_size,
-                                  uint8_t vlan_tci)
+                                 uint16_t vlan_tci)
 {
     uint8_t *vlan_hdr = s->frame + (ETH_ALEN * 2);
     uint8_t *payload = vlan_hdr + sizeof(struct vlan_header);
--
2.34.1

On 3/27/26 08:39, linhuang wrote:
> 
> The VLAN tag insertion helper took vlan_tci as an 8-bit value, while
> the descriptor provides a 16-bit VLAN TCI. This truncated egress tags
> and caused VLAN ID corruption (for example, 4088/0x0ff8 became
> 248/0x00f8 at the receiver).
> 
> Change vlan_tci to uint16_t in the TX VLAN insertion path so the full
> 802.1Q TCI is preserved and transmitted correctly.
> 
> Signed-off-by: linhuang <linhuang@ruijie.com.cn <mailto:linhuang@ruijie.com.cn>>
> ---
>   hw/net/ftgmac100.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
> index 2f05bba11d..b3da48c343 100644
> --- a/hw/net/ftgmac100.c
> +++ b/hw/net/ftgmac100.c
> @@ -498,7 +498,7 @@ static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
>   }
> 
>   static int ftgmac100_insert_vlan(FTGMAC100State *s, int frame_size,
> -                                  uint8_t vlan_tci)
> +                                 uint16_t vlan_tci)
>   {
>       uint8_t *vlan_hdr = s->frame + (ETH_ALEN * 2);
>       uint8_t *payload = vlan_hdr + sizeof(struct vlan_header);
> --
> 2.34.1

Applied to aspeed-next.

Thanks,

C.

On 3/27/26 08:39, linhuang wrote:
> 
> The VLAN tag insertion helper took vlan_tci as an 8-bit value, while
> the descriptor provides a 16-bit VLAN TCI. This truncated egress tags
> and caused VLAN ID corruption (for example, 4088/0x0ff8 became
> 248/0x00f8 at the receiver).
> 
> Change vlan_tci to uint16_t in the TX VLAN insertion path so the full
> 802.1Q TCI is preserved and transmitted correctly.
> 
> Signed-off-by: linhuang <linhuang@ruijie.com.cn <mailto:linhuang@ruijie.com.cn>>
> ---
>   hw/net/ftgmac100.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
> index 2f05bba11d..b3da48c343 100644
> --- a/hw/net/ftgmac100.c
> +++ b/hw/net/ftgmac100.c
> @@ -498,7 +498,7 @@ static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
>   }
> 
>   static int ftgmac100_insert_vlan(FTGMAC100State *s, int frame_size,
> -                                  uint8_t vlan_tci)
> +                                 uint16_t vlan_tci)
>   {
>       uint8_t *vlan_hdr = s->frame + (ETH_ALEN * 2);
>       uint8_t *payload = vlan_hdr + sizeof(struct vlan_header);
> --
> 2.34.1

Please run ./scripts/get_maintainer.pl to get the list of maintainers.
The email has formatting issues too. Anyhow,

Fixes: c2ab73fcbe79 ("ftgmac100: Fix integer overflow in ftgmac100_do_tx()")
Reviewed-by: Cédric Le Goater <clg@redhat.com>

Thanks,

C.