Re: [PATCH net-next v4 1/5] dt-bindings: net: realtek,rtl9301-mdio: restrict MDIO buses by family

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider:

Critical: 0 · High: 0 · Medium: 1 · Low: 0

- [Medium] Incomplete constraint: the new per-family `allOf`/`if-then`
  blocks in…

--

dt-bindings: net: realtek,rtl9301-mdio: restrict MDIO buses by family

This adds two per-family conditional blocks to the Realtek Otto MDIO
controller binding so that mdio-bus child node names are limited to the
number of buses each family has: one for RTL838x, two for RTL839x and
four for RTL930x/RTL931x.

[Severity: Medium]
These two conditionals only reject child node names, but the bus index the
driver consumes is the child's reg value.  Should the same conditionals also
bound reg?

The mdio-bus subschema keeps reg unconstrained apart from the item count,
for every compatible:

  patternProperties:
    '^mdio-bus@[0-3]$':
      $ref: mdio.yaml#

      properties:
        reg:
          maxItems: 1

      required:
        - reg

So this still validates cleanly against the RTL838x branch:

  mdio-controller@ca00 {
    compatible = "realtek,rtl8380-mdio";
    ...
    mdio-bus@0 {
      reg = <3>;
      ...
    };
  };

otto_emdio_probe_one() in drivers/net/mdio/mdio-realtek-rtl9300.c takes the
index from reg and never looks at the unit address:

  err = fwnode_property_read_u32(node, "reg", &mdio_bus);
  if (err)
          return dev_err_probe(dev, err, "undefined smi bus number\n");

  if (mdio_bus >= priv->info->num_buses)
          return dev_err_probe(dev, -EINVAL,
                               "illegal (dangling) smi bus number %d\n", mdio_bus);

and otto_emdio_map_ports() repeats the same check.

dtc does not close the gap either.  check_unit_address_vs_reg() in
scripts/dtc/checks.c only checks that a unit address exists when reg is
present:

  if (prop) {
          if (!unitname[0])
                  FAIL(c, dti, node, "node has a reg or ranges property, but no unit name");
  } else {
          if (unitname[0])
                  FAIL(c, dti, node, "node has a unit name, but no reg or ranges property");
  }

Numeric unit-address-vs-reg equality is only enforced for simple-bus, i2c,
spi and pci children, and an mdio-controller node is none of those.

The commit message says the current binding is "allowing non-existent buses
to be described for RTL838x and RTL839x devices".  With only the node names
restricted, a non-existent bus can still be described through reg and is
caught only at probe time.  Would adding a per-family maximum on the child
reg inside these conditionals match what the message describes?
Documentation/devicetree/bindings/net/marvell,pp2.yaml has the same shape
with properties: reg: maximum: inside a per-compatible conditional.

Note this is still the case at the end of the series (7c4e9351a929), where
the mdio-bus subschema declares only reg: maxItems: 1.

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260912130451.3757276-1-markus.stockhausen%40gmx.de