lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Thu, 18 Jun 2020 11:17:54 +0800
From:   DENG Qingfang <>
To:     Linus Walleij <>
Cc:     Vladimir Oltean <>, Andrew Lunn <>,
        Vivien Didelot <>,
        Florian Fainelli <>,
        netdev <>,
        Mauri Sandberg <>
Subject: Re: [net-next PATCH 1/5] net: dsa: tag_rtl4_a: Implement Realtek 4
 byte A tag


On Wed, Jun 17, 2020 at 4:06 PM Linus Walleij <> wrote:
> On Thu, Jun 4, 2020 at 1:23 PM Vladimir Oltean <> wrote:
> > In the code you pointed to, there is a potentially relevant comment:
> >
> > 1532//CPU tag: Realtek Ethertype==0x8899(2 bytes)+protocol==0x9(4
> > MSB)+priority(2 bits)+reserved(4 bits)+portmask(6 LSB)
> >
> >
> >
> >
> > This strongly indicates to me that the insertion tag is the same as
> > the extraction tag.
> This code is a problem because it is Realtek-development style.
> This style seems to be that the hardware people write the drivers
> using copy/paste from the previous ASIC and ship is as soon as
> possible. Keep this in mind.
> The above tag is using protocol 9 and is actually even documented
> in a PDF I have for RTL8306. The problem is that the RTL8366RB
> (I suspect also RTL8366S) uses protocol "a" (as in hex 10).
> Which is of course necessarily different.
> I have *really* tried to figure out how the bits in protocol a works
> when transmissing from the CPU port to any switch port.
> When nothing else worked, I just tried all bit combinations with
> 0xannp where a is protocol and p is port. I looped through all
> values several times trying to get a response from ping.

Have you looped through the whole 32-bit field?

> So this is really how far I can get right now, even with brute
> force.
> > It is completely opaque to me why in patch "[net-next PATCH 2/5] net:
> > dsa: rtl8366rb: Support the CPU DSA tag" you are _disabling_ the
> > injection of these tags via RTL8368RB_CPU_INSTAG. I think it's natural
> > that the switch drops these packets when CPU tag insertion is
> > disabled.
> This is another Realtek-ism where they managed to invert the
> meaning of a bit.
> Bit 15 in register 0x0061 (RTL8368RB_CPU_CTRL_REG) can
> be set to 1 and then the special (custom) CPU tag 0x8899
> protocol a will be DISABLED. This value Realtek calls
> "RTL8368RB_CPU_INSTAG" which makes you think that
> the tag will be inserted, it is named "instag" right? But that
> is not how it works.
> That bit needs to be set to 0 to insert the tag and 1 to disable
> insertion of the tag.
> For this reason the patch also renames this bit to
> RTL8368RB_CPU_NO_TAG which is more to the point.
> Yours,
> Linus Walleij

Powered by blists - more mailing lists