From db45c15c98134f5ebd13c4dc5b6be5d1cd3fc706 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 13 Oct 2026 13:44:34 -0700 Subject: [PATCH 1/6] net: bcmasp: fix mib counters struct alignment with ethtool stats When EDPKT stats were removed in commit e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0"), the corresponding entries were removed from bcmasp_gstrings_stats in bcmasp_ethtool.c, but the edpkt_* fields were left at the beginning of struct bcmasp_mib_counters in bcmasp.h. Because bcmasp_update_mib_counters() and bcmasp_get_ethtool_stats() index into struct bcmasp_mib_counters sequentially based on the order of bcmasp_gstrings_stats, this 16-byte offset caused ethtool to read from shifted offsets: the first four software counters read unused fields and reported 0, the next four software counters reported the values of alloc_rx_skb_failed, tx_dma_failed, mc_filters_full_cnt, and uc_filters_full_cnt, while filters_combine_cnt, promisc_filters_cnt, tx_realloc_offload_failed, and tx_timeout_cnt were never reported. Remove the obsolete edpkt_* fields from struct bcmasp_mib_counters so that it aligns with bcmasp_gstrings_stats. Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0") Reviewed-by: Nicolai Buchwitz Reviewed-by: Justin Chen Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20261013204439.3494046-2-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/asp2/bcmasp.h | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.h b/drivers/net/ethernet/broadcom/asp2/bcmasp.h index 8c8ffaeadc79..9c9721da1662 100644 --- a/drivers/net/ethernet/broadcom/asp2/bcmasp.h +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.h @@ -250,10 +250,6 @@ struct bcmasp_intf_stats64 { }; struct bcmasp_mib_counters { - u32 edpkt_ts; - u32 edpkt_rx_pkt_cnt; - u32 edpkt_hdr_ext_cnt; - u32 edpkt_hdr_out_cnt; u32 umac_frm_cnt; u32 fb_frm_cnt; u32 fb_rx_fifo_depth; From a3cf9877558ab2c51182af558815dde64fc17cb9 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 13 Oct 2026 13:44:35 -0700 Subject: [PATCH 2/6] net: bcmasp: unmap previous DMA mappings on TX map failure When mapping an skb with fragments for transmission in bcmasp_xmit(), if mapping fails on fragment i > 0, the error handler calls bcmasp_clean_txcb() for previous iterations j < i. However, bcmasp_clean_txcb() only zeroes the control block fields without unmapping the DMA buffers, leaking the DMA mappings allocated for the head and earlier fragments. Call dma_unmap_single() before calling bcmasp_clean_txcb() in the error cleanup loop. Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") Reviewed-by: Nicolai Buchwitz Reviewed-by: Justin Chen Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20261013204439.3494046-3-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c index f2176ef3a127..9ad5a982542f 100644 --- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c @@ -285,6 +285,11 @@ static netdev_tx_t bcmasp_xmit(struct sk_buff *skb, struct net_device *dev) intf->mib.tx_dma_failed++; spb_index = intf->tx_spb_index; for (j = 0; j < i; j++) { + txcb = &intf->tx_cbs[spb_index]; + dma_unmap_single(kdev, + dma_unmap_addr(txcb, dma_addr), + dma_unmap_len(txcb, dma_len), + DMA_TO_DEVICE); bcmasp_clean_txcb(intf, spb_index); spb_index = incr_ring(spb_index, DESC_RING_COUNT); From 07b624d2f5a4517d7d0022fbd4aef17e884b5686 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 13 Oct 2026 13:44:36 -0700 Subject: [PATCH 3/6] net: bcmasp: validate minimum RX packet size in bcmasp_rx_poll() In bcmasp_rx_poll(), the driver removes a 2-byte alignment pad and optionally strips the ETH_FCS_LEN CRC from received packets before passing them to eth_type_trans(). If the hardware reports a descriptor size smaller than the sum of the 2-byte pad, the Ethernet header (ETH_HLEN), and optional CRC (ETH_FCS_LEN), subtracting the pad and CRC lengths underflows u32 len. This adds ~4 GiB to rx_bytes statistics, while the undersized frame reaches eth_type_trans(), which reads past skb->len into stale buffer data. Check that desc->size is at least (2 + ETH_HLEN + (crc_fwd ? ETH_FCS_LEN : 0)) before proceeding to process the descriptor. Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") Reviewed-by: Justin Chen Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20261013204439.3494046-4-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c index 9ad5a982542f..d679c796c8c2 100644 --- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c @@ -523,6 +523,12 @@ static int bcmasp_rx_poll(struct napi_struct *napi, int budget) DMA_FROM_DEVICE); len = desc->size; + if (unlikely(len < 2 + ETH_HLEN + (intf->crc_fwd ? ETH_FCS_LEN : 0))) { + u64_stats_update_begin(&stats->syncp); + u64_stats_inc(&stats->rx_dropped); + u64_stats_update_end(&stats->syncp); + goto next; + } /* Allocate a page pool page as the SKB data area so the * kernel can recycle it efficiently after the packet is From a31623d91c6e48b08c74dc95567aeb62f1f35938 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 13 Oct 2026 13:44:37 -0700 Subject: [PATCH 4/6] net: bcmasp: fix OF node reference leak for phy_dn In bcmasp_interface_create(), intf->phy_dn is obtained via of_parse_phandle() or assigned ndev_dn. of_parse_phandle() returns a node reference with its refcount incremented, but of_node_put() was never called on intf->phy_dn in bcmasp_interface_destroy() or the error unwind path in bcmasp_interface_create(). Acquire a reference on ndev_dn for the fixed-link case as well so that intf->phy_dn consistently holds a reference, and release it with of_node_put() on teardown and error. Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") Reviewed-by: Nicolai Buchwitz Reviewed-by: Justin Chen Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20261013204439.3494046-5-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c index d679c796c8c2..693e8cdfe960 100644 --- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c @@ -1298,7 +1298,7 @@ struct bcmasp_intf *bcmasp_interface_create(struct bcmasp_priv *priv, ndev_dn->name); goto err_free_netdev; } - intf->phy_dn = ndev_dn; + intf->phy_dn = of_node_get(ndev_dn); } /* Map resource */ @@ -1338,6 +1338,7 @@ struct bcmasp_intf *bcmasp_interface_create(struct bcmasp_priv *priv, err_deregister_fixed_link: if (of_phy_is_fixed_link(ndev_dn)) of_phy_deregister_fixed_link(ndev_dn); + of_node_put(intf->phy_dn); err_free_netdev: free_netdev(ndev); err: @@ -1350,6 +1351,7 @@ void bcmasp_interface_destroy(struct bcmasp_intf *intf) unregister_netdev(intf->ndev); if (of_phy_is_fixed_link(intf->ndev_dn)) of_phy_deregister_fixed_link(intf->ndev_dn); + of_node_put(intf->phy_dn); free_netdev(intf->ndev); } From 74667a55122ad2fad88af4fd7672e4c8175c2558 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 13 Oct 2026 13:44:38 -0700 Subject: [PATCH 5/6] net: bcmasp: account for offload header in TX short packet padding When hardware checksum offload is enabled for an skb, bcmasp_csum_offload() prepends a struct bcmasp_pkt_offload header (20 bytes) to the skb via skb_push(). This increases skb->len and skb_headlen(skb) by sizeof(struct bcmasp_pkt_offload). Because the hardware descriptor processor strips this offload header before transmitting the packet on the wire, the wire packet length is smaller by sizeof(struct bcmasp_pkt_offload). The padding calculation must account for this extra header; otherwise, short frames are sent on the wire smaller than the minimum Ethernet frame size (ETH_ZLEN + ETH_FCS_LEN). Furthermore, small frames with payload in page fragments (such as small TCP segments with CHECKSUM_PARTIAL) have nr_frags > 0 and were skipping padding entirely because the padding check was restricted to nr_frags == 0. Perform the padding check on skb->len before the descriptor loop using skb_put_padto(), adding sizeof(struct bcmasp_pkt_offload) to min_size when checksum offload is enabled, and re-read nr_frags after padding in case the skb was linearized. Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") Reviewed-by: Justin Chen Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20261013204439.3494046-6-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- .../net/ethernet/broadcom/asp2/bcmasp_intf.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c index 693e8cdfe960..a855e637b6f0 100644 --- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c @@ -236,7 +236,7 @@ static struct sk_buff *bcmasp_csum_offload(struct net_device *dev, static netdev_tx_t bcmasp_xmit(struct sk_buff *skb, struct net_device *dev) { struct bcmasp_intf *intf = netdev_priv(dev); - unsigned int total_bytes, size; + unsigned int total_bytes, size, min_size; int spb_index, nr_frags, i, j; struct bcmasp_tx_cb *txcb; dma_addr_t mapping, valid; @@ -262,16 +262,21 @@ static netdev_tx_t bcmasp_xmit(struct sk_buff *skb, struct net_device *dev) if (!skb) return NETDEV_TX_OK; + min_size = ETH_ZLEN + ETH_FCS_LEN; + if (csum_hw) + min_size += sizeof(struct bcmasp_pkt_offload); + + if (skb->len < min_size) { + if (skb_put_padto(skb, min_size)) + return NETDEV_TX_OK; + nr_frags = skb_shinfo(skb)->nr_frags; + } + spb_index = intf->tx_spb_index; valid = intf->tx_spb_dma_valid; for (i = 0; i <= nr_frags; i++) { if (!i) { size = skb_headlen(skb); - if (!nr_frags && size < (ETH_ZLEN + ETH_FCS_LEN)) { - if (skb_put_padto(skb, ETH_ZLEN + ETH_FCS_LEN)) - return NETDEV_TX_OK; - size = skb->len; - } mapping = dma_map_single(kdev, skb->data, size, DMA_TO_DEVICE); } else { From fa1459375794f14fb65039cd19c9398d759b491e Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 13 Oct 2026 13:44:39 -0700 Subject: [PATCH 6/6] net: bcmasp: fix network filter lookup and wake filter pair allocation In bcmasp_netfilt_get_init(), when looking up an existing filter (!init) for a specified location, if the filter at loc was not claimed, the previous loop continued searching higher indices and could return an arbitrary unrelated filter belonging to the port. This caused flow get or delete operations on an empty rule location to return or delete an unintended filter. Fix this by checking only the requested location on lookup and rejecting RX_CLS_LOC_ANY when !init. In addition, harden wake filter allocation and release by ensuring wake filter pair searches stay on even boundaries where both entries are free, checking that loc + 1 is free for positioned wake filters, and validating parity and bounds on release. Fixes: c5d511c49587 ("net: bcmasp: Add support for wake on net filters") Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20261013204439.3494046-7-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/asp2/bcmasp.c | 121 +++++++++++--------- 1 file changed, 70 insertions(+), 51 deletions(-) diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.c b/drivers/net/ethernet/broadcom/asp2/bcmasp.c index 972474893a6b..f41a79529f10 100644 --- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c @@ -511,6 +511,13 @@ static int bcmasp_netfilt_wr_to_hw(struct bcmasp_priv *priv, return 0; } +static bool bcmasp_netfilt_is_companion(struct bcmasp_priv *priv, int i) +{ + return i > 0 && (i % 2) && + priv->net_filters[i].wake_filter && + priv->net_filters[i - 1].wake_filter; +} + void bcmasp_netfilt_suspend(struct bcmasp_intf *intf) { struct bcmasp_priv *priv = intf->parent; @@ -524,9 +531,7 @@ void bcmasp_netfilt_suspend(struct bcmasp_intf *intf) priv->net_filters[i].port != intf->port) continue; - if (i > 0 && (i % 2) && - priv->net_filters[i].wake_filter && - priv->net_filters[i - 1].wake_filter) + if (bcmasp_netfilt_is_companion(priv, i)) continue; ret = bcmasp_netfilt_wr_to_hw(priv, &priv->net_filters[i]); @@ -556,9 +561,7 @@ int bcmasp_netfilt_get_all_active(struct bcmasp_intf *intf, u32 *rule_locs, priv->net_filters[i].port != intf->port) continue; - if (i > 0 && (i % 2) && - priv->net_filters[i].wake_filter && - priv->net_filters[i - 1].wake_filter) + if (bcmasp_netfilt_is_companion(priv, i)) continue; if (j == *rule_cnt) @@ -583,9 +586,7 @@ int bcmasp_netfilt_get_active(struct bcmasp_intf *intf) continue; /* Skip over a wake filter pair */ - if (i > 0 && (i % 2) && - priv->net_filters[i].wake_filter && - priv->net_filters[i - 1].wake_filter) + if (bcmasp_netfilt_is_companion(priv, i)) continue; cnt++; @@ -607,6 +608,9 @@ bool bcmasp_netfilt_check_dup(struct bcmasp_intf *intf, priv->net_filters[i].port != intf->port) continue; + if (bcmasp_netfilt_is_companion(priv, i)) + continue; + cur = &priv->net_filters[i].fs; if (cur->flow_type != fs->flow_type || @@ -659,7 +663,7 @@ bool bcmasp_netfilt_check_dup(struct bcmasp_intf *intf, } /* If no network filter found, return open filter. - * If no more open filters return NULL + * If no more open filters return error. */ struct bcmasp_net_filter *bcmasp_netfilt_get_init(struct bcmasp_intf *intf, u32 loc, bool wake_filter, @@ -669,45 +673,55 @@ struct bcmasp_net_filter *bcmasp_netfilt_get_init(struct bcmasp_intf *intf, struct bcmasp_priv *priv = intf->parent; int i, open_index = -1; - /* Check whether we exceed the filter table capacity */ + if (!init) { + if (loc == RX_CLS_LOC_ANY || loc >= priv->num_net_filters) + return ERR_PTR(-EINVAL); + + if (priv->net_filters[loc].claimed && + priv->net_filters[loc].port == intf->port && + !bcmasp_netfilt_is_companion(priv, loc)) + return &priv->net_filters[loc]; + + return ERR_PTR(-ENOENT); + } + if (loc != RX_CLS_LOC_ANY && loc >= priv->num_net_filters) return ERR_PTR(-EINVAL); /* If the filter location is busy (already claimed) and we are initializing * the filter (insertion), return a busy error code. */ - if (loc != RX_CLS_LOC_ANY && init && priv->net_filters[loc].claimed) - return ERR_PTR(-EBUSY); + if (loc != RX_CLS_LOC_ANY) { + if (priv->net_filters[loc].claimed) + return ERR_PTR(-EBUSY); - /* We need two filters for wake-up, so we cannot use an odd filter */ - if (wake_filter && loc != RX_CLS_LOC_ANY && (loc % 2)) - return ERR_PTR(-EINVAL); - - /* Initialize the loop index based on the desired location or from 0 */ - i = loc == RX_CLS_LOC_ANY ? 0 : loc; - - for ( ; i < priv->num_net_filters; i++) { - /* Found matching network filter */ - if (!init && - priv->net_filters[i].claimed && - priv->net_filters[i].hw_index == i && - priv->net_filters[i].port == intf->port) - return &priv->net_filters[i]; - - /* If we don't need a new filter or new filter already found */ - if (!init || open_index >= 0) - continue; - - /* Wake filter conslidates two filters to cover more bytes - * Wake filter is open if... - * 1. It is an even filter - * 2. The current and next filter is not claimed - */ - if (wake_filter && !(i % 2) && !priv->net_filters[i].claimed && - !priv->net_filters[i + 1].claimed) - open_index = i; - else if (!priv->net_filters[i].claimed) - open_index = i; + /* We need two filters for wake-up, so we cannot use an odd filter */ + if (wake_filter) { + if ((loc % 2) || loc + 1 >= priv->num_net_filters) + return ERR_PTR(-EINVAL); + if (priv->net_filters[loc + 1].claimed) + return ERR_PTR(-EBUSY); + } + open_index = loc; + } else { + for (i = 0; i < priv->num_net_filters; i++) { + /* Wake filter consolidates two filters to cover more bytes. + * Wake filter is open if: + * 1. It is an even filter + * 2. The current and next filter is not claimed + */ + if (wake_filter) { + if (!(i % 2) && (i + 1 < priv->num_net_filters) && + !priv->net_filters[i].claimed && + !priv->net_filters[i + 1].claimed) { + open_index = i; + break; + } + } else if (!priv->net_filters[i].claimed) { + open_index = i; + break; + } + } } if (open_index >= 0) { @@ -716,16 +730,20 @@ struct bcmasp_net_filter *bcmasp_netfilt_get_init(struct bcmasp_intf *intf, nfilter->port = intf->port; nfilter->ch = intf->channel + priv->tx_chan_offset; nfilter->hw_index = open_index; + + if (wake_filter) { + /* Claim next filter */ + priv->net_filters[open_index + 1].claimed = true; + priv->net_filters[open_index + 1].wake_filter = true; + priv->net_filters[open_index + 1].hw_index = open_index + 1; + priv->net_filters[open_index + 1].port = intf->port; + priv->net_filters[open_index + 1].ch = intf->channel + + priv->tx_chan_offset; + nfilter->wake_filter = true; + } } - if (wake_filter && open_index >= 0) { - /* Claim next filter */ - priv->net_filters[open_index + 1].claimed = true; - priv->net_filters[open_index + 1].wake_filter = true; - nfilter->wake_filter = true; - } - - return nfilter ? nfilter : ERR_PTR(-EINVAL); + return nfilter ? nfilter : ERR_PTR(-ENOSPC); } void bcmasp_netfilt_release(struct bcmasp_intf *intf, @@ -733,7 +751,8 @@ void bcmasp_netfilt_release(struct bcmasp_intf *intf, { struct bcmasp_priv *priv = intf->parent; - if (nfilt->wake_filter) { + if (nfilt->wake_filter && !(nfilt->hw_index % 2) && + nfilt->hw_index + 1 < priv->num_net_filters) { memset(&priv->net_filters[nfilt->hw_index + 1], 0, sizeof(struct bcmasp_net_filter)); }