Commit 9160305d92 for qemu.org

commit 9160305d92d2750e6ca3ada8f048305c9290f03c
Author: linhuang <linhuang@ruijie.com.cn>
Date:   Fri Mar 27 15:39:35 2026 +0800

    net/ftgmac100: preserve full VLAN TCI in TX tag insertion

    The VLAN tag insertion helper took vlan_tci as an 8-bit value, while
    the descriptor provides a 16-bit VLAN TCI. This truncated egress tags
    and caused VLAN ID corruption (for example, 4088/0x0ff8 became
    248/0x00f8 at the receiver).

    Change vlan_tci to uint16_t in the TX VLAN insertion path so the full
    802.1Q TCI is preserved and transmitted correctly.

    Fixes: c2ab73fcbe79 ("ftgmac100: Fix integer overflow in ftgmac100_do_tx()")
    Signed-off-by: linhuang <linhuang@ruijie.com.cn>
    Link: https://lore.kernel.org/qemu-devel/1471e413d3589b6734819bda2b59b725b74f273a.d551129b.99fc.47f6.86dc.0759227268a2@feishu.cn
    Reviewed-by: Cédric Le Goater <clg@redhat.com>
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index 2f05bba11d..b3da48c343 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -498,7 +498,7 @@ static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
 }

 static int ftgmac100_insert_vlan(FTGMAC100State *s, int frame_size,
-                                  uint8_t vlan_tci)
+                                 uint16_t vlan_tci)
 {
     uint8_t *vlan_hdr = s->frame + (ETH_ALEN * 2);
     uint8_t *payload = vlan_hdr + sizeof(struct vlan_header);