[PATCH net 00/12] net: systemport: Collection of fixes

[PATCH net 00/12] net: systemport: Collection of fixes

[Florian Fainelli]

This patch series contains a collection of fixes accumulated during a
LLM session.

Florian Fainelli (12):
  net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
  net: systemport: Fix invalid dev_id argument in
    bcm_sysport_poll_controller()
  net: systemport: Fix NULL pointer dereference in
    bcm_sysport_fini_rx_ring()
  net: systemport: Fix missing phy-handle parsing for non-fixed PHYs
  net: systemport: Fix Wake-on-LAN RXCHK filter enable loop
  net: systemport: Fix RUNT MIB counter register offset calculation
  net: systemport: Fix potential packet length underflow in
    bcm_sysport_desc_rx()
  net: systemport: Fix out-of-bounds array accesses in DSA queue mapping
  net: systemport: Fix inverted error messages in bcm_sysport_stop()
  net: systemport: Fix unbalanced Wake-on-LAN clock disable in resume
  net: systemport: Update TDMA queue mapping dynamically on changeupper
  net: systemport: Complete resource teardown even on DMA disable
    timeout

 drivers/net/ethernet/broadcom/bcmsysport.c | 89 ++++++++++++++--------
 1 file changed, 58 insertions(+), 31 deletions(-)

-- 
2.34.1

[PATCH net 01/12] net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

[Florian Fainelli]

When running on SYSTEMPORT Lite, certain statistics are unsupported and
skipped during bcm_sysport_get_stats(). The variable 'j' tracks the
compacted index into the destination data buffer, whereas 'i' iterates
over all elements in bcm_sysport_gstrings_stats.

Because the buffer allocated by ethtool is sized only according to
bcm_sysport_get_sset_count(), storing values at data[i] instead of
data[j] writes past the allocated array bounds, leading to memory
corruption.

Fix this by writing to data[j] instead of data[i].

Fixes: 10377ba7673d ("net: systemport: Support 64bit statistics")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 4d06c6ba6641..db627cd15fb7 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -482,10 +482,10 @@ static void bcm_sysport_get_stats(struct net_device *dev,
 		    s->type == BCM_SYSPORT_STAT_NETDEV64) {
 			do {
 				start = u64_stats_fetch_begin(syncp);
-				data[i] = *(u64 *)p;
+				data[j] = *(u64 *)p;
 			} while (u64_stats_fetch_retry(syncp, start));
 		} else
-			data[i] = *(u32 *)p;
+			data[j] = *(u32 *)p;
 		j++;
 	}
 
-- 
2.34.1

[PATCH net 02/12] net: systemport: Fix invalid dev_id argument in bcm_sysport_poll_controller()

[Florian Fainelli]

Both bcm_sysport_rx_isr() and bcm_sysport_tx_isr() expect their second
argument (dev_id) to be a 'struct net_device *dev', as they call
netdev_priv(dev) to retrieve the private data structure.

bcm_sysport_poll_controller() was passing 'priv' instead of 'dev',
causing netdev_priv() inside the ISRs to treat 'priv' as a net_device,
leading to out-of-bounds pointer calculations and crashes when netconsole
or netpoll is triggered.

Fix this by passing 'dev' instead of 'priv' to the ISRs.

Fixes: 6cec4f5e00a3 ("net: systemport: Add netconsole support")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index db627cd15fb7..8328fe824d15 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1198,12 +1198,12 @@ static void bcm_sysport_poll_controller(struct net_device *dev)
 	struct bcm_sysport_priv *priv = netdev_priv(dev);
 
 	disable_irq(priv->irq0);
-	bcm_sysport_rx_isr(priv->irq0, priv);
+	bcm_sysport_rx_isr(priv->irq0, dev);
 	enable_irq(priv->irq0);
 
 	if (!priv->is_lite) {
 		disable_irq(priv->irq1);
-		bcm_sysport_tx_isr(priv->irq1, priv);
+		bcm_sysport_tx_isr(priv->irq1, dev);
 		enable_irq(priv->irq1);
 	}
 }
-- 
2.34.1

[PATCH net 03/12] net: systemport: Fix NULL pointer dereference in bcm_sysport_fini_rx_ring()

[Florian Fainelli]

If allocation of priv->rx_cbs fails during bcm_sysport_init_rx_ring(),
error unwinding in bcm_sysport_open() calls bcm_sysport_fini_rx_ring().
Without checking if priv->rx_cbs is non-NULL, bcm_sysport_fini_rx_ring()
dereferences priv->rx_cbs, resulting in a NULL pointer dereference.

Add a check for !priv->rx_cbs at the beginning of
bcm_sysport_fini_rx_ring(), matching bcm_sysport_fini_tx_ring().

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 8328fe824d15..b91a57540f55 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1717,6 +1717,9 @@ static void bcm_sysport_fini_rx_ring(struct bcm_sysport_priv *priv)
 	if (!(reg & RDMA_DISABLED))
 		netdev_warn(priv->netdev, "RDMA not stopped!\n");
 
+	if (!priv->rx_cbs)
+		return;
+
 	for (i = 0; i < priv->num_rx_bds; i++) {
 		cb = &priv->rx_cbs[i];
 		if (dma_unmap_addr(cb, dma_addr))
-- 
2.34.1

[PATCH net 04/12] net: systemport: Fix missing phy-handle parsing for non-fixed PHYs

[Florian Fainelli]

In bcm_sysport_probe(), priv->phy_dn is only initialized if the device
tree node has a fixed-link configuration (of_phy_is_fixed_link). When
connecting to a discrete MDIO-attached PHY referenced via 'phy-handle',
priv->phy_dn remains NULL. This causes of_phy_connect() during
bcm_sysport_open() to fail with -ENODEV since of_phy_find_device(NULL)
returns NULL.

Fix this by parsing 'phy-handle' via of_parse_phandle() and falling back
to of_phy_is_fixed_link(). Ensure proper of_node_get() and of_node_put()
refcounting lifecycle on both error unwinding and module remove paths.

Fixes: 186534a3f832 ("net: systemport: use the new fixed PHY helpers")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index b91a57540f55..78b96b192185 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2527,17 +2527,19 @@ static int bcm_sysport_probe(struct platform_device *pdev)
 	if (ret)
 		priv->phy_interface = PHY_INTERFACE_MODE_GMII;
 
+	priv->phy_dn = of_parse_phandle(dn, "phy-handle", 0);
+
 	/* In the case of a fixed PHY, the DT node associated
 	 * to the PHY is the Ethernet MAC DT node.
 	 */
-	if (of_phy_is_fixed_link(dn)) {
+	if (!priv->phy_dn && of_phy_is_fixed_link(dn)) {
 		ret = of_phy_register_fixed_link(dn);
 		if (ret) {
 			dev_err(&pdev->dev, "failed to register fixed PHY\n");
 			goto err_free_netdev;
 		}
 
-		priv->phy_dn = dn;
+		priv->phy_dn = of_node_get(dn);
 	}
 
 	/* Initialize netdevice members */
@@ -2622,6 +2624,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
 err_deregister_fixed_link:
 	if (of_phy_is_fixed_link(dn))
 		of_phy_deregister_fixed_link(dn);
+	of_node_put(priv->phy_dn);
 err_free_netdev:
 	free_netdev(dev);
 	return ret;
@@ -2640,6 +2643,7 @@ static void bcm_sysport_remove(struct platform_device *pdev)
 	unregister_netdev(dev);
 	if (of_phy_is_fixed_link(dn))
 		of_phy_deregister_fixed_link(dn);
+	of_node_put(priv->phy_dn);
 	free_netdev(dev);
 	dev_set_drvdata(&pdev->dev, NULL);
 }
-- 
2.34.1

[PATCH net 05/12] net: systemport: Fix Wake-on-LAN RXCHK filter enable loop

[Florian Fainelli]

In bcm_sysport_suspend_to_wol(), the loop enabling programmed RXCHK
filters in RXCHK_CONTROL used an auxiliary counter 'i' instead of the
actual set filter index 'index'.

When non-contiguous filters were configured (for example, if filter 0
was deleted and filter 1 remained), the code would enable bit
(RXCHK_BRCM_TAG_MATCH_SHIFT + 0) corresponding to filter 0 rather than
filter 1, causing Wake-on-LAN filter matching to fail.

Fix this by using the filter 'index' to set the appropriate match bit
in RXCHK_CONTROL.

Fixes: bb9051a2b230 ("net: systemport: Add support for WAKE_FILTER")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 78b96b192185..7f2e5e4efb8d 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2652,7 +2652,7 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv)
 {
 	struct net_device *ndev = priv->netdev;
 	unsigned int timeout = 1000;
-	unsigned int index, i = 0;
+	unsigned int index;
 	u32 reg;
 
 	reg = umac_readl(priv, UMAC_MPD_CTRL);
@@ -2682,10 +2682,8 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv)
 		reg = rxchk_readl(priv, RXCHK_CONTROL);
 		reg &= ~(RXCHK_BRCM_TAG_MATCH_MASK <<
 			 RXCHK_BRCM_TAG_MATCH_SHIFT);
-		for_each_set_bit(index, priv->filters, RXCHK_BRCM_TAG_MAX) {
-			reg |= BIT(RXCHK_BRCM_TAG_MATCH_SHIFT + i);
-			i++;
-		}
+		for_each_set_bit(index, priv->filters, RXCHK_BRCM_TAG_MAX)
+			reg |= BIT(RXCHK_BRCM_TAG_MATCH_SHIFT + index);
 		reg |= RXCHK_EN | RXCHK_BRCM_TAG_EN;
 		rxchk_writel(priv, reg, RXCHK_CONTROL);
 	}
-- 
2.34.1

[PATCH net 06/12] net: systemport: Fix RUNT MIB counter register offset calculation

[Florian Fainelli]

In UniMAC hardware, there is a 0xC byte gap between the RX MIB counters
and the TX MIB counters, and a second 0xC byte gap between the TX MIB
counters and the RX RUNT MIB counters.

In bcm_sysport_update_mib_counters(), 'offset' was only set to
UMAC_MIB_STAT_OFFSET (0xC) for all non-RX counters, omitting the second
0xC gap for BCM_SYSPORT_STAT_RUNT counters. As a result, all 4 RUNT MIB
counters were read from unmapped gap register space.

Fix this by setting offset to 2 * UMAC_MIB_STAT_OFFSET (0x18) when
reading BCM_SYSPORT_STAT_RUNT counters.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 7f2e5e4efb8d..b69833d34bd5 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -391,8 +391,10 @@ static void bcm_sysport_update_mib_counters(struct bcm_sysport_priv *priv)
 			if (priv->is_lite)
 				continue;
 
-			if (s->type != BCM_SYSPORT_STAT_MIB_RX)
+			if (s->type == BCM_SYSPORT_STAT_MIB_TX)
 				offset = UMAC_MIB_STAT_OFFSET;
+			else if (s->type == BCM_SYSPORT_STAT_RUNT)
+				offset = 2 * UMAC_MIB_STAT_OFFSET;
 			val = umac_readl(priv, UMAC_MIB_START + j + offset);
 			break;
 		case BCM_SYSPORT_STAT_RXCHK:
-- 
2.34.1

[PATCH net 07/12] net: systemport: Fix potential packet length underflow in bcm_sysport_desc_rx()

[Florian Fainelli]

In bcm_sysport_desc_rx(), the packet length 'len' extracted from the RSB
is only validated against RX_BUF_LENGTH. If a malformed or corrupted
frame is received with 'len' smaller than the prepended Receive Status
Block (sizeof(*rsb)) plus 2 padding bytes (and optional FCS), calling
skb_pull() will trigger a BUG() in __skb_pull() when pulling beyond
skb->len. Furthermore, subtracting (sizeof(*rsb) + 2) from 'len' (u16)
will underflow, resulting in corrupted packet stats and potential
out-of-bounds operations.

Fix this by ensuring 'len' is at least sizeof(*rsb) + 2 (plus
ETH_FCS_LEN if CRC forward is enabled) before proceeding.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index b69833d34bd5..95cead1df160 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -781,8 +781,9 @@ static unsigned int bcm_sysport_desc_rx(struct bcm_sysport_priv *priv,
 			  p_index, priv->rx_c_index, priv->rx_read_ptr,
 			  len, status);
 
-		if (unlikely(len > RX_BUF_LENGTH)) {
-			netif_err(priv, rx_status, ndev, "oversized packet\n");
+		if (unlikely(len > RX_BUF_LENGTH ||
+			     len < sizeof(*rsb) + 2 + (priv->crc_fwd ? ETH_FCS_LEN : 0))) {
+			netif_err(priv, rx_status, ndev, "invalid packet size: %d\n", len);
 			ndev->stats.rx_length_errors++;
 			ndev->stats.rx_errors++;
 			dev_kfree_skb_any(skb);
-- 
2.34.1

[PATCH net 08/12] net: systemport: Fix out-of-bounds array accesses in DSA queue mapping

[Florian Fainelli]

The priv->ring_map array has a fixed size of (DSA_MAX_PORTS * 8). In
bcm_sysport_select_queue(), bcm_sysport_map_queues(), and
bcm_sysport_unmap_queues(), indices calculated as
(qp + port * num_tx_queues) were accessed without checking against
ARRAY_SIZE(priv->ring_map). If unusual port or queue configurations are
encountered, this could lead to out-of-bounds array accesses.

Additionally, on SYSTEMPORT Lite, netif_set_real_num_tx_queues() was
called with slave_dev->num_tx_queues / 2, which could evaluate to 0 if
slave_dev->num_tx_queues is 1, causing netif_set_real_num_tx_queues() to
fail with -EINVAL.

Fix these by clamping the real number of queues to at least 1 and adding
bounds checks on priv->ring_map.

Fixes: d156576362c0 ("net: systemport: Establish lower/upper queue mapping")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 95cead1df160..130545cce045 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2273,7 +2273,7 @@ static u16 bcm_sysport_select_queue(struct net_device *dev, struct sk_buff *skb,
 	struct bcm_sysport_priv *priv = netdev_priv(dev);
 	u16 queue = skb_get_queue_mapping(skb);
 	struct bcm_sysport_tx_ring *tx_ring;
-	unsigned int q, port;
+	unsigned int q, port, index;
 
 	if (!netdev_uses_dsa(dev))
 		return netdev_pick_tx(dev, skb, NULL);
@@ -2281,8 +2281,11 @@ static u16 bcm_sysport_select_queue(struct net_device *dev, struct sk_buff *skb,
 	/* DSA tagging layer will have configured the correct queue */
 	q = BRCM_TAG_GET_QUEUE(queue);
 	port = BRCM_TAG_GET_PORT(queue);
-	tx_ring = priv->ring_map[q + port * priv->per_port_num_tx_queues];
+	index = q + port * priv->per_port_num_tx_queues;
+	if (unlikely(index >= ARRAY_SIZE(priv->ring_map)))
+		return netdev_pick_tx(dev, skb, NULL);
 
+	tx_ring = priv->ring_map[index];
 	if (unlikely(!tx_ring))
 		return netdev_pick_tx(dev, skb, NULL);
 
@@ -2329,7 +2332,8 @@ static int bcm_sysport_map_queues(struct net_device *dev,
 	 */
 	if (priv->is_lite)
 		netif_set_real_num_tx_queues(slave_dev,
-					     slave_dev->num_tx_queues / 2);
+					     max_t(unsigned int, 1,
+						   slave_dev->num_tx_queues / 2));
 
 	num_tx_queues = slave_dev->real_num_tx_queues;
 
@@ -2352,7 +2356,8 @@ static int bcm_sysport_map_queues(struct net_device *dev,
 		ring->switch_queue = qp;
 		ring->switch_port = port;
 		ring->inspect = true;
-		priv->ring_map[qp + port * num_tx_queues] = ring;
+		if (qp + port * num_tx_queues < ARRAY_SIZE(priv->ring_map))
+			priv->ring_map[qp + port * num_tx_queues] = ring;
 		qp++;
 	}
 
@@ -2383,7 +2388,8 @@ static int bcm_sysport_unmap_queues(struct net_device *dev,
 
 		ring->inspect = false;
 		qp = ring->switch_queue;
-		priv->ring_map[qp + port * num_tx_queues] = NULL;
+		if (qp + port * num_tx_queues < ARRAY_SIZE(priv->ring_map))
+			priv->ring_map[qp + port * num_tx_queues] = NULL;
 	}
 
 	return 0;
-- 
2.34.1

[PATCH net 09/12] net: systemport: Fix inverted error messages in bcm_sysport_stop()

[Florian Fainelli]

In bcm_sysport_stop(), the error messages printed when tdma_enable_set()
and rdma_enable_set() time out were inverted: the failure of
tdma_enable_set() logged 'timeout disabling RDMA' and the failure of
rdma_enable_set() logged 'timeout disabling TDMA'.

Swap the error messages so they correctly describe the failing engine.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 130545cce045..384423b312ca 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2089,7 +2089,7 @@ static int bcm_sysport_stop(struct net_device *dev)
 
 	ret = tdma_enable_set(priv, 0);
 	if (ret) {
-		netdev_err(dev, "timeout disabling RDMA\n");
+		netdev_err(dev, "timeout disabling TDMA\n");
 		return ret;
 	}
 
@@ -2098,7 +2098,7 @@ static int bcm_sysport_stop(struct net_device *dev)
 
 	ret = rdma_enable_set(priv, 0);
 	if (ret) {
-		netdev_err(dev, "timeout disabling TDMA\n");
+		netdev_err(dev, "timeout disabling RDMA\n");
 		return ret;
 	}
 
-- 
2.34.1

[PATCH net 10/12] net: systemport: Fix unbalanced Wake-on-LAN clock disable in resume

[Florian Fainelli]

In bcm_sysport_suspend(), the Wake-on-LAN clock (priv->wol_clk) is only
prepared and enabled if both device_may_wakeup(d) and priv->wolopts are
true.

In bcm_sysport_resume(), however, clk_disable_unprepare(priv->wol_clk)
was called whenever priv->wolopts was non-zero, regardless of
device_may_wakeup(d). If the system entered suspend with Wake-on-LAN
disabled at the device level (e.g., via sysfs wakeup control), this
resulted in an unbalanced clk_disable_unprepare() call on resume.

Fix this by mirroring the suspend check in bcm_sysport_resume().

Fixes: 6328a126896e ("net: systemport: Manage Wake-on-LAN clock")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 384423b312ca..dd5a7c9dd90f 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2803,7 +2803,7 @@ static int __maybe_unused bcm_sysport_resume(struct device *d)
 		return ret;
 	}
 
-	if (priv->wolopts)
+	if (device_may_wakeup(d) && priv->wolopts)
 		clk_disable_unprepare(priv->wol_clk);
 
 	umac_reset(priv);
-- 
2.34.1

[PATCH net 11/12] net: systemport: Update TDMA queue mapping dynamically on changeupper

[Florian Fainelli]

When DSA upper devices are dynamically attached or detached while the
master SYSTEMPORT interface is already up and running (netif_running()),
bcm_sysport_map_queues() and bcm_sysport_unmap_queues() updated the
internal software mappings but did not update the TDMA_DESC_RING_MAPPING
hardware registers, because programming was previously deferred until
bcm_sysport_init_tx_ring().

Update TDMA_DESC_RING_MAPPING registers immediately if netif_running()
is true during map_queues and unmap_queues.

Fixes: 1593cd40d785 ("net: systemport: use standard netdevice notifier to detect DSA presence")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 23 +++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index dd5a7c9dd90f..e5bb7fa84fda 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2315,6 +2315,7 @@ static int bcm_sysport_map_queues(struct net_device *dev,
 	struct bcm_sysport_tx_ring *ring;
 	unsigned int num_tx_queues;
 	unsigned int q, qp, port;
+	u32 reg;
 
 	/* We can't be setting up queue inspection for non directly attached
 	 * switches
@@ -2350,14 +2351,21 @@ static int bcm_sysport_map_queues(struct net_device *dev,
 		if (ring->inspect)
 			continue;
 
-		/* Just remember the mapping actual programming done
-		 * during bcm_sysport_init_tx_ring
-		 */
 		ring->switch_queue = qp;
 		ring->switch_port = port;
 		ring->inspect = true;
 		if (qp + port * num_tx_queues < ARRAY_SIZE(priv->ring_map))
 			priv->ring_map[qp + port * num_tx_queues] = ring;
+
+		if (netif_running(dev)) {
+			reg = tdma_readl(priv, TDMA_DESC_RING_MAPPING(q));
+			reg &= ~(RING_QID_MASK |
+				 RING_PORT_ID_MASK << RING_PORT_ID_SHIFT |
+				 RING_IGNORE_STATUS);
+			reg |= (qp & RING_QID_MASK);
+			reg |= (port << RING_PORT_ID_SHIFT);
+			tdma_writel(priv, reg, TDMA_DESC_RING_MAPPING(q));
+		}
 		qp++;
 	}
 
@@ -2372,6 +2380,7 @@ static int bcm_sysport_unmap_queues(struct net_device *dev,
 	struct bcm_sysport_tx_ring *ring;
 	unsigned int num_tx_queues;
 	unsigned int q, qp, port;
+	u32 reg;
 
 	port = dp->index;
 
@@ -2390,6 +2399,14 @@ static int bcm_sysport_unmap_queues(struct net_device *dev,
 		qp = ring->switch_queue;
 		if (qp + port * num_tx_queues < ARRAY_SIZE(priv->ring_map))
 			priv->ring_map[qp + port * num_tx_queues] = NULL;
+
+		if (netif_running(dev)) {
+			reg = tdma_readl(priv, TDMA_DESC_RING_MAPPING(q));
+			reg &= ~(RING_QID_MASK |
+				 RING_PORT_ID_MASK << RING_PORT_ID_SHIFT);
+			reg |= RING_IGNORE_STATUS;
+			tdma_writel(priv, reg, TDMA_DESC_RING_MAPPING(q));
+		}
 	}
 
 	return 0;
-- 
2.34.1

[PATCH net 12/12] net: systemport: Complete resource teardown even on DMA disable timeout

[Florian Fainelli]

In bcm_sysport_stop(), if tdma_enable_set() or rdma_enable_set() timed
out, the function returned early with an error code. However, ndo_stop()
callers in the networking core ignore error returns, leaving the
software ring structures allocated, interrupts registered, PHY
connected, and clock enabled. If the interface was subsequently brought
up again, request_irq() and PHY connection would fail or leak.

Ensure all software ring teardown, interrupt freeing, PHY
disconnection, and clock disabling steps are executed regardless of DMA
disable timeouts.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Assisted-by: LLM
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index e5bb7fa84fda..2b064da4eb7c 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2088,19 +2088,15 @@ static int bcm_sysport_stop(struct net_device *dev)
 	umac_enable_set(priv, CMD_RX_EN, 0);
 
 	ret = tdma_enable_set(priv, 0);
-	if (ret) {
+	if (ret)
 		netdev_err(dev, "timeout disabling TDMA\n");
-		return ret;
-	}
 
 	/* Wait for a maximum packet size to be drained */
 	usleep_range(2000, 3000);
 
 	ret = rdma_enable_set(priv, 0);
-	if (ret) {
+	if (ret)
 		netdev_err(dev, "timeout disabling RDMA\n");
-		return ret;
-	}
 
 	/* Disable UniMAC TX */
 	umac_enable_set(priv, CMD_TX_EN, 0);
-- 
2.34.1

Re: [PATCH net 01/12] net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

[Nicolai Buchwitz]

On 22.9.2026 01:12, Florian Fainelli wrote:
> When running on SYSTEMPORT Lite, certain statistics are unsupported and
> skipped during bcm_sysport_get_stats(). The variable 'j' tracks the
> compacted index into the destination data buffer, whereas 'i' iterates
> over all elements in bcm_sysport_gstrings_stats.
> 
> Because the buffer allocated by ethtool is sized only according to
> bcm_sysport_get_sset_count(), storing values at data[i] instead of
> data[j] writes past the allocated array bounds, leading to memory
> corruption.
> 
> Fix this by writing to data[j] instead of data[i].
> 
> Fixes: 10377ba7673d ("net: systemport: Support 64bit statistics")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 4d06c6ba6641..db627cd15fb7 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -482,10 +482,10 @@ static void bcm_sysport_get_stats(struct 
> net_device *dev,
>  		    s->type == BCM_SYSPORT_STAT_NETDEV64) {
>  			do {
>  				start = u64_stats_fetch_begin(syncp);
> -				data[i] = *(u64 *)p;
> +				data[j] = *(u64 *)p;
>  			} while (u64_stats_fetch_retry(syncp, start));
>  		} else
> -			data[i] = *(u32 *)p;
> +			data[j] = *(u32 *)p;
>  		j++;
>  	}

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai

Re: [PATCH net 02/12] net: systemport: Fix invalid dev_id argument in bcm_sysport_poll_controller()

[Nicolai Buchwitz]

On 22.9.2026 01:12, Florian Fainelli wrote:
> Both bcm_sysport_rx_isr() and bcm_sysport_tx_isr() expect their second
> argument (dev_id) to be a 'struct net_device *dev', as they call
> netdev_priv(dev) to retrieve the private data structure.
> 
> bcm_sysport_poll_controller() was passing 'priv' instead of 'dev',
> causing netdev_priv() inside the ISRs to treat 'priv' as a net_device,
> leading to out-of-bounds pointer calculations and crashes when 
> netconsole
> or netpoll is triggered.
> 
> Fix this by passing 'dev' instead of 'priv' to the ISRs.
> 
> Fixes: 6cec4f5e00a3 ("net: systemport: Add netconsole support")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index db627cd15fb7..8328fe824d15 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -1198,12 +1198,12 @@ static void bcm_sysport_poll_controller(struct 
> net_device *dev)
>  	struct bcm_sysport_priv *priv = netdev_priv(dev);
> 
>  	disable_irq(priv->irq0);
> -	bcm_sysport_rx_isr(priv->irq0, priv);
> +	bcm_sysport_rx_isr(priv->irq0, dev);
>  	enable_irq(priv->irq0);
> 
>  	if (!priv->is_lite) {
>  		disable_irq(priv->irq1);
> -		bcm_sysport_tx_isr(priv->irq1, priv);
> +		bcm_sysport_tx_isr(priv->irq1, dev);
>  		enable_irq(priv->irq1);
>  	}
>  }

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai

Re: [PATCH net 03/12] net: systemport: Fix NULL pointer dereference in bcm_sysport_fini_rx_ring()

[Nicolai Buchwitz]

On 22.9.2026 01:12, Florian Fainelli wrote:
> If allocation of priv->rx_cbs fails during bcm_sysport_init_rx_ring(),
> error unwinding in bcm_sysport_open() calls bcm_sysport_fini_rx_ring().
> Without checking if priv->rx_cbs is non-NULL, 
> bcm_sysport_fini_rx_ring()
> dereferences priv->rx_cbs, resulting in a NULL pointer dereference.
> 
> Add a check for !priv->rx_cbs at the beginning of
> bcm_sysport_fini_rx_ring(), matching bcm_sysport_fini_tx_ring().
> 
> Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet 
> MAC driver")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 8328fe824d15..b91a57540f55 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -1717,6 +1717,9 @@ static void bcm_sysport_fini_rx_ring(struct 
> bcm_sysport_priv *priv)
>  	if (!(reg & RDMA_DISABLED))
>  		netdev_warn(priv->netdev, "RDMA not stopped!\n");
> 
> +	if (!priv->rx_cbs)
> +		return;
> +
>  	for (i = 0; i < priv->num_rx_bds; i++) {
>  		cb = &priv->rx_cbs[i];
>  		if (dma_unmap_addr(cb, dma_addr))

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai

Re: [PATCH net 05/12] net: systemport: Fix Wake-on-LAN RXCHK filter enable loop

[Nicolai Buchwitz]

On 22.9.2026 01:12, Florian Fainelli wrote:
> In bcm_sysport_suspend_to_wol(), the loop enabling programmed RXCHK
> filters in RXCHK_CONTROL used an auxiliary counter 'i' instead of the
> actual set filter index 'index'.
> 
> When non-contiguous filters were configured (for example, if filter 0
> was deleted and filter 1 remained), the code would enable bit
> (RXCHK_BRCM_TAG_MATCH_SHIFT + 0) corresponding to filter 0 rather than
> filter 1, causing Wake-on-LAN filter matching to fail.
> 
> Fix this by using the filter 'index' to set the appropriate match bit
> in RXCHK_CONTROL.
> 
> Fixes: bb9051a2b230 ("net: systemport: Add support for WAKE_FILTER")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 78b96b192185..7f2e5e4efb8d 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -2652,7 +2652,7 @@ static int bcm_sysport_suspend_to_wol(struct 
> bcm_sysport_priv *priv)
>  {
>  	struct net_device *ndev = priv->netdev;
>  	unsigned int timeout = 1000;
> -	unsigned int index, i = 0;
> +	unsigned int index;
>  	u32 reg;
> 
>  	reg = umac_readl(priv, UMAC_MPD_CTRL);
> @@ -2682,10 +2682,8 @@ static int bcm_sysport_suspend_to_wol(struct 
> bcm_sysport_priv *priv)
>  		reg = rxchk_readl(priv, RXCHK_CONTROL);
>  		reg &= ~(RXCHK_BRCM_TAG_MATCH_MASK <<
>  			 RXCHK_BRCM_TAG_MATCH_SHIFT);
> -		for_each_set_bit(index, priv->filters, RXCHK_BRCM_TAG_MAX) {
> -			reg |= BIT(RXCHK_BRCM_TAG_MATCH_SHIFT + i);
> -			i++;
> -		}
> +		for_each_set_bit(index, priv->filters, RXCHK_BRCM_TAG_MAX)
> +			reg |= BIT(RXCHK_BRCM_TAG_MATCH_SHIFT + index);
>  		reg |= RXCHK_EN | RXCHK_BRCM_TAG_EN;
>  		rxchk_writel(priv, reg, RXCHK_CONTROL);
>  	}

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai

Re: [PATCH net 06/12] net: systemport: Fix RUNT MIB counter register offset calculation

[Nicolai Buchwitz]

On 22.9.2026 01:12, Florian Fainelli wrote:
> In UniMAC hardware, there is a 0xC byte gap between the RX MIB counters
> and the TX MIB counters, and a second 0xC byte gap between the TX MIB
> counters and the RX RUNT MIB counters.
> 
> In bcm_sysport_update_mib_counters(), 'offset' was only set to
> UMAC_MIB_STAT_OFFSET (0xC) for all non-RX counters, omitting the second
> 0xC gap for BCM_SYSPORT_STAT_RUNT counters. As a result, all 4 RUNT MIB
> counters were read from unmapped gap register space.
> 
> Fix this by setting offset to 2 * UMAC_MIB_STAT_OFFSET (0x18) when
> reading BCM_SYSPORT_STAT_RUNT counters.
> 
> Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet 
> MAC driver")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 7f2e5e4efb8d..b69833d34bd5 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -391,8 +391,10 @@ static void bcm_sysport_update_mib_counters(struct 
> bcm_sysport_priv *priv)
>  			if (priv->is_lite)
>  				continue;
> 
> -			if (s->type != BCM_SYSPORT_STAT_MIB_RX)
> +			if (s->type == BCM_SYSPORT_STAT_MIB_TX)
>  				offset = UMAC_MIB_STAT_OFFSET;
> +			else if (s->type == BCM_SYSPORT_STAT_RUNT)
> +				offset = 2 * UMAC_MIB_STAT_OFFSET;
>  			val = umac_readl(priv, UMAC_MIB_START + j + offset);
>  			break;
>  		case BCM_SYSPORT_STAT_RXCHK

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai

Re: [PATCH net 09/12] net: systemport: Fix inverted error messages in bcm_sysport_stop()

[Nicolai Buchwitz]

On 22.9.2026 01:13, Florian Fainelli wrote:
> In bcm_sysport_stop(), the error messages printed when 
> tdma_enable_set()
> and rdma_enable_set() time out were inverted: the failure of
> tdma_enable_set() logged 'timeout disabling RDMA' and the failure of
> rdma_enable_set() logged 'timeout disabling TDMA'.
> 
> Swap the error messages so they correctly describe the failing engine.
> 
> Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet 
> MAC driver")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 130545cce045..384423b312ca 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -2089,7 +2089,7 @@ static int bcm_sysport_stop(struct net_device 
> *dev)
> 
>  	ret = tdma_enable_set(priv, 0);
>  	if (ret) {
> -		netdev_err(dev, "timeout disabling RDMA\n");
> +		netdev_err(dev, "timeout disabling TDMA\n");
>  		return ret;
>  	}
> 
> @@ -2098,7 +2098,7 @@ static int bcm_sysport_stop(struct net_device 
> *dev)
> 
>  	ret = rdma_enable_set(priv, 0);
>  	if (ret) {
> -		netdev_err(dev, "timeout disabling TDMA\n");
> +		netdev_err(dev, "timeout disabling RDMA\n");
>  		return ret;
>  	}

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai

Re: [PATCH net 10/12] net: systemport: Fix unbalanced Wake-on-LAN clock disable in resume

[Nicolai Buchwitz]

On 22.9.2026 01:13, Florian Fainelli wrote:
> In bcm_sysport_suspend(), the Wake-on-LAN clock (priv->wol_clk) is only
> prepared and enabled if both device_may_wakeup(d) and priv->wolopts are
> true.
> 
> In bcm_sysport_resume(), however, clk_disable_unprepare(priv->wol_clk)
> was called whenever priv->wolopts was non-zero, regardless of
> device_may_wakeup(d). If the system entered suspend with Wake-on-LAN
> disabled at the device level (e.g., via sysfs wakeup control), this
> resulted in an unbalanced clk_disable_unprepare() call on resume.
> 
> Fix this by mirroring the suspend check in bcm_sysport_resume().
> 
> Fixes: 6328a126896e ("net: systemport: Manage Wake-on-LAN clock")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 384423b312ca..dd5a7c9dd90f 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -2803,7 +2803,7 @@ static int __maybe_unused 
> bcm_sysport_resume(struct device *d)
>  		return ret;
>  	}
> 
> -	if (priv->wolopts)
> +	if (device_may_wakeup(d) && priv->wolopts)
>  		clk_disable_unprepare(priv->wol_clk);
> 
>  	umac_reset(priv);

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai

Re: [PATCH net 04/12] net: systemport: Fix missing phy-handle parsing for non-fixed PHYs

[Nicolai Buchwitz]

Hi Florian

On 22.9.2026 01:12, Florian Fainelli wrote:
> In bcm_sysport_probe(), priv->phy_dn is only initialized if the device
> tree node has a fixed-link configuration (of_phy_is_fixed_link). When
> connecting to a discrete MDIO-attached PHY referenced via 'phy-handle',
> priv->phy_dn remains NULL. This causes of_phy_connect() during
> bcm_sysport_open() to fail with -ENODEV since of_phy_find_device(NULL)
> returns NULL.
> 
> Fix this by parsing 'phy-handle' via of_parse_phandle() and falling 
> back
> to of_phy_is_fixed_link(). Ensure proper of_node_get() and 
> of_node_put()
> refcounting lifecycle on both error unwinding and module remove paths.
> 
> Fixes: 186534a3f832 ("net: systemport: use the new fixed PHY helpers")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---

> [...]

Not sure this qualifies as a fix, the driver never parsed phy-handle. 
Maybe net-next material?

Regards
Nicolai

Re: [PATCH net 07/12] net: systemport: Fix potential packet length underflow in bcm_sysport_desc_rx()

[Nicolai Buchwitz]

Hi Florian

On 22.9.2026 01:13, Florian Fainelli wrote:
> In bcm_sysport_desc_rx(), the packet length 'len' extracted from the 
> RSB
> is only validated against RX_BUF_LENGTH. If a malformed or corrupted
> frame is received with 'len' smaller than the prepended Receive Status
> Block (sizeof(*rsb)) plus 2 padding bytes (and optional FCS), calling
> skb_pull() will trigger a BUG() in __skb_pull() when pulling beyond
> skb->len. Furthermore, subtracting (sizeof(*rsb) + 2) from 'len' (u16)
> will underflow, resulting in corrupted packet stats and potential
> out-of-bounds operations.

AFAIU skb_pull() returns NULL for len > skb->len and never reaches
__skb_pull(), so it doesn't reach BUG()?

I agree on the underflow and the wrong rx_bytes issue though.

> [...]

Thanks
Nicolai

Re: [PATCH net 08/12] net: systemport: Fix out-of-bounds array accesses in DSA queue mapping

[Nicolai Buchwitz]

Hi Florian

On 22.9.2026 01:13, Florian Fainelli wrote:
> The priv->ring_map array has a fixed size of (DSA_MAX_PORTS * 8). In
> bcm_sysport_select_queue(), bcm_sysport_map_queues(), and
> bcm_sysport_unmap_queues(), indices calculated as
> (qp + port * num_tx_queues) were accessed without checking against
> ARRAY_SIZE(priv->ring_map). If unusual port or queue configurations are
> encountered, this could lead to out-of-bounds array accesses.
> 
> Additionally, on SYSTEMPORT Lite, netif_set_real_num_tx_queues() was
> called with slave_dev->num_tx_queues / 2, which could evaluate to 0 if
> slave_dev->num_tx_queues is 1, causing netif_set_real_num_tx_queues() 
> to
> fail with -EINVAL.
> 
> Fix these by clamping the real number of queues to at least 1 and 
> adding
> bounds checks on priv->ring_map.
> 
> Fixes: d156576362c0 ("net: systemport: Establish lower/upper queue 
> mapping")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 95cead1df160..130545cce045 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c

> [...]

> @@ -2352,7 +2356,8 @@ static int bcm_sysport_map_queues(struct 
> net_device *dev,
>  		ring->switch_queue = qp;
>  		ring->switch_port = port;
>  		ring->inspect = true;
> -		priv->ring_map[qp + port * num_tx_queues] = ring;
> +		if (qp + port * num_tx_queues < ARRAY_SIZE(priv->ring_map))
> +			priv->ring_map[qp + port * num_tx_queues] = ring;

Out of range rings would still have inspect = true but no ring_map
entry, so select_queue() can never pick them.

Bail out before marking the ring?

> [...]

Thanks,
Nicolai

Re: [PATCH net 11/12] net: systemport: Update TDMA queue mapping dynamically on changeupper

[Nicolai Buchwitz]

Hi Florian

On 22.9.2026 01:13, Florian Fainelli wrote:
> When DSA upper devices are dynamically attached or detached while the
> master SYSTEMPORT interface is already up and running 
> (netif_running()),
> bcm_sysport_map_queues() and bcm_sysport_unmap_queues() updated the
> internal software mappings but did not update the 
> TDMA_DESC_RING_MAPPING
> hardware registers, because programming was previously deferred until
> bcm_sysport_init_tx_ring().
> 
> Update TDMA_DESC_RING_MAPPING registers immediately if netif_running()
> is true during map_queues and unmap_queues.
> 
> Fixes: 1593cd40d785 ("net: systemport: use standard netdevice notifier 
> to detect DSA presence")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 23 +++++++++++++++++++---
>  1 file changed, 20 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index dd5a7c9dd90f..e5bb7fa84fda 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c

> [...]

> @@ -2390,6 +2399,14 @@ static int bcm_sysport_unmap_queues(struct 
> net_device *dev,
>  		qp = ring->switch_queue;
>  		if (qp + port * num_tx_queues < ARRAY_SIZE(priv->ring_map))
>  			priv->ring_map[qp + port * num_tx_queues] = NULL;
> +
> +		if (netif_running(dev)) {
> +			reg = tdma_readl(priv, TDMA_DESC_RING_MAPPING(q));
> +			reg &= ~(RING_QID_MASK |
> +				 RING_PORT_ID_MASK << RING_PORT_ID_SHIFT);
> +			reg |= RING_IGNORE_STATUS;
> +			tdma_writel(priv, reg, TDMA_DESC_RING_MAPPING(q));
> +		}

RING_IGNORE_STATUS is never cleared in init_tx_rings(), so

     echo <sf2-node> > /sys/bus/platform/drivers/brcm-sf2/unbind
     ip link set eth0 down
     echo <sf2-node> > /sys/bus/platform/drivers/brcm-sf2/bind
     ip link set eth0 up

keeps the bit set from unmap. Clear it in init_tx_ring() too?

> [...]

Thanks,
Nicolai

Re: [PATCH net 12/12] net: systemport: Complete resource teardown even on DMA disable timeout

[Nicolai Buchwitz]

Hi Florian

On 22.9.2026 01:13, Florian Fainelli wrote:
> In bcm_sysport_stop(), if tdma_enable_set() or rdma_enable_set() timed
> out, the function returned early with an error code. However, 
> ndo_stop()
> callers in the networking core ignore error returns, leaving the
> software ring structures allocated, interrupts registered, PHY
> connected, and clock enabled. If the interface was subsequently brought
> up again, request_irq() and PHY connection would fail or leak.
> 
> Ensure all software ring teardown, interrupt freeing, PHY
> disconnection, and clock disabling steps are executed regardless of DMA
> disable timeouts.
> 
> Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet 
> MAC driver")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 8 ++------
>  1 file changed, 2 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index e5bb7fa84fda..2b064da4eb7c 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -2088,19 +2088,15 @@ static int bcm_sysport_stop(struct net_device 
> *dev)
>  	umac_enable_set(priv, CMD_RX_EN, 0);
> 
>  	ret = tdma_enable_set(priv, 0);
> -	if (ret) {
> +	if (ret)
>  		netdev_err(dev, "timeout disabling TDMA\n");
> -		return ret;
> -	}
> 
>  	/* Wait for a maximum packet size to be drained */
>  	usleep_range(2000, 3000);
> 
>  	ret = rdma_enable_set(priv, 0);
> -	if (ret) {
> +	if (ret)
>  		netdev_err(dev, "timeout disabling RDMA\n");
> -		return ret;
> -	}

If TDMA or RDMA don't stop, the rings get freed while the hardware may
still use them. Maybe topctrl_flush() before freeing?

The same pattern would probably apply to bcm_sysport_suspend().

> [...]

Thanks,
Nicolai