Patch "net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload" has been added to the 5.16-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload

to the 5.16-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-mscc-ocelot-fix-backwards-compatibility-with-sin.patch
and it can be found in the queue-5.16 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1f78fa2ea30749aeac192326a4c1d5c099d4fab2
Author: Vladimir Oltean <vladimir.oltean@xxxxxxx>
Date:   Wed Mar 16 21:21:17 2022 +0200

    net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload
    
    [ Upstream commit 8e0341aefcc9133f3f48683873284b169581315b ]
    
    ACL rules can be offloaded to VCAP IS2 either through chain 0, or, since
    the blamed commit, through a chain index whose number encodes a specific
    PAG (Policy Action Group) and lookup number.
    
    The chain number is translated through ocelot_chain_to_pag() into a PAG,
    and through ocelot_chain_to_lookup() into a lookup number.
    
    The problem with the blamed commit is that the above 2 functions don't
    have special treatment for chain 0. So ocelot_chain_to_pag(0) returns
    filter->pag = 224, which is in fact -32, but the "pag" field is an u8.
    
    So we end up programming the hardware with VCAP IS2 entries having a PAG
    of 224. But the way in which the PAG works is that it defines a subset
    of VCAP IS2 filters which should match on a packet. The default PAG is
    0, and previous VCAP IS1 rules (which we offload using 'goto') can
    modify it. So basically, we are installing filters with a PAG on which
    no packet will ever match. This is the hardware equivalent of adding
    filters to a chain which has no 'goto' to it.
    
    Restore the previous functionality by making ACL filters offloaded to
    chain 0 go to PAG 0 and lookup number 0. The choice of PAG is clearly
    correct, but the choice of lookup number isn't "as before" (which was to
    leave the lookup a "don't care"). However, lookup 0 should be fine,
    since even though there are ACL actions (policers) which have a
    requirement to be used in a specific lookup, that lookup is 0.
    
    Fixes: 226e9cd82a96 ("net: mscc: ocelot: only install TCAM entries into a specific lookup and PAG")
    Signed-off-by: Vladimir Oltean <vladimir.oltean@xxxxxxx>
    Link: https://lore.kernel.org/r/20220316192117.2568261-1-vladimir.oltean@xxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c b/drivers/net/ethernet/mscc/ocelot_flower.c
index 738dd2be79dc..a3f1f1fbaf7d 100644
--- a/drivers/net/ethernet/mscc/ocelot_flower.c
+++ b/drivers/net/ethernet/mscc/ocelot_flower.c
@@ -54,6 +54,12 @@ static int ocelot_chain_to_block(int chain, bool ingress)
  */
 static int ocelot_chain_to_lookup(int chain)
 {
+	/* Backwards compatibility with older, single-chain tc-flower
+	 * offload support in Ocelot
+	 */
+	if (chain == 0)
+		return 0;
+
 	return (chain / VCAP_LOOKUP) % 10;
 }
 
@@ -62,7 +68,15 @@ static int ocelot_chain_to_lookup(int chain)
  */
 static int ocelot_chain_to_pag(int chain)
 {
-	int lookup = ocelot_chain_to_lookup(chain);
+	int lookup;
+
+	/* Backwards compatibility with older, single-chain tc-flower
+	 * offload support in Ocelot
+	 */
+	if (chain == 0)
+		return 0;
+
+	lookup = ocelot_chain_to_lookup(chain);
 
 	/* calculate PAG value as chain index relative to the first PAG */
 	return chain - VCAP_IS2_CHAIN(lookup, 0);