realtek: fix RTL838x receive tag decoding

Commit dc9cc0d3e2a1 ("realtek: add QoS and rate control") replaced a
16 bit reserved field in the RTL83xx packet header with the initial
cpu_tag word, shifting the real cpu_tag fields by one.  Adjusting for
this new shift was partially forgotten in the new RX tag decoders.

This caused the switch to block IGMP, effectively blocking IPv4
multicast.

The bug was partially fixed by commit 9d847244d9fd ("realtek: fix
RTL839X receive tag decoding")

Fix on RTL838x too, including correct NIC_RX_REASON_SPECIAL_TRAP value.

Suggested-by: Jan Hoffmann <[email protected]>
Fixes: dc9cc0d3e2a1 ("realtek: add QoS and rate control")
Signed-off-by: Bjørn Mork <[email protected]>

target/linux/realtek/files-5.10/drivers/net/ethernet/rtl838x_eth.c

@@ -58,6 +58,7 @@ struct p_hdr {
 	uint16_t	size;		/* buffer size */
 	uint16_t	offset;
 	uint16_t	len;		/* pkt len */
+	/* cpu_tag[0] is a reserved uint16_t on RTL83xx */
 	uint16_t	cpu_tag[10];
 } __packed __aligned(1);
 
@@ -262,13 +263,14 @@ struct dsa_tag {
 
 bool rtl838x_decode_tag(struct p_hdr *h, struct dsa_tag *t)
 {
-	t->reason = h->cpu_tag[3] & 0xf;
-	t->queue = (h->cpu_tag[0] & 0xe0) >> 5;
+	/* cpu_tag[0] is reserved. Fields are off-by-one */
+	t->reason = h->cpu_tag[4] & 0xf;
+	t->queue = (h->cpu_tag[1] & 0xe0) >> 5;
 	t->port = h->cpu_tag[1] & 0x1f;
 	t->crc_error = t->reason == 13;
 
 	pr_debug("Reason: %d\n", t->reason);
-	if (t->reason != 4) // NIC_RX_REASON_SPECIAL_TRAP
+	if (t->reason != 6) // NIC_RX_REASON_SPECIAL_TRAP
 		t->l2_offloaded = 1;
 	else
 		t->l2_offloaded = 0;
@@ -278,6 +280,7 @@ bool rtl838x_decode_tag(struct p_hdr *h, struct dsa_tag *t)
 
 bool rtl839x_decode_tag(struct p_hdr *h, struct dsa_tag *t)
 {
+	/* cpu_tag[0] is reserved. Fields are off-by-one */
 	t->reason = h->cpu_tag[5] & 0x1f;
 	t->queue = (h->cpu_tag[3] & 0xe000) >> 13;
 	t->port = h->cpu_tag[1] & 0x3f;