Re: [PATCH net-next v7 5/5] net: dsa: ks8995: Delete surplus driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Inverted MTU configuration for KSZ8895 and KSZ8995XA causes packets to be dropped incorrectly.
--

commit e5eb5e8f2ecf7312467a03e8f5d784c6d14f6fbd
Author: Linus Walleij <linusw@kernel.org>

net: dsa: ks8995: Delete surplus driver

The Microchip ksz driver now handles all switches that the
old driver was handling, but better.

Delete the old driver, but leave a stub behind in Kconfig
so new users will be automatically phased over to the new
symbol when migrating their configs.

> diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
> index e704ab702c189..360bacc52c3a9 100644
> --- a/drivers/net/dsa/Kconfig
> +++ b/drivers/net/dsa/Kconfig
> @@ -100,11 +100,13 @@ config NET_DSA_RZN1_A5PSW
>  config NET_DSA_KS8995
>  	tristate "Micrel KS8995 family 5-ports 10/100 Ethernet switches"
>  	depends on SPI
> -	depends on !NET_DSA_MICROCHIP_KSZ_SPI
> -	select NET_DSA_TAG_NONE
> +	select NET_DSA_MICROCHIP_KSZ_COMMON
> +	select NET_DSA_MICROCHIP_KSZ_SPI

[Severity: High]
This is a pre-existing issue, but does migrating KS8995 users to the new KSZ
driver expose them to an inverted MTU configuration?

Looking at drivers/net/dsa/microchip/ksz8.c:ksz8863_change_mtu(), the logic
calculates MTU settings based on KSZ8863 bit definitions:

	if (frame_size <= legalsz)
		ctrl2 |= KSZ8863_LEGAL_PACKET_ENABLE;
	else if (frame_size > KSZ8863_NORMAL_PACKET_SIZE)
		ctrl2 |= KSZ8863_HUGE_PACKET_ENABLE;

	return ksz_rmw8(dev, REG_SW_CTRL_2, KSZ8863_LEGAL_PACKET_ENABLE |
			KSZ8863_HUGE_PACKET_ENABLE, ctrl2);

For KSZ8863, BIT(1) enables the check. However, this function is also called
for KSZ8895 and KSZ8995XA, where BIT(1) disables the check.

If a user configures an MTU between 1523 and 1536 bytes, frame_size > legalsz
but not > KSZ8863_NORMAL_PACKET_SIZE. This leaves ctrl2 = 0 and clears BIT(1).

For these specific switches, clearing BIT(1) enables the legal packet size
check, which would incorrectly drop packets > 1522 bytes.

Conversely, if frame_size <= 1522, BIT(1) is set, which disables the check on
these switches, incorrectly accepting huge packets.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260704-ks8995-to-ksz8-v7-0-2af0eaa545a8@kernel.org?part=5