AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch adds support for PHY_INTERFACE_MODE_PSGMII (Penta SGMII) to several switch statements in the phylink core. This is a hardware-specific PHY interface mode. A search of the kernel tree reveals that PHY_INTERFACE_MODE_PSGMII is only referenced by the qca807x physical PHY driver, and no MAC drivers explicitly support it. Furthermore, virtual network drivers and software-emulated USB ethernet adapters (which use phylink) hardcode their interface modes to standard ones like MII, RMII, or GMII. Since this interface mode cannot be configured from userspace and is not used by any emulated hardware, the newly added code paths are impossible to reach in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit cd7fc031275eb4cd6e90e4dfe469471da494610c\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Aug 9 16:04:51 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c\nindex 18d2ead97aa54..1ce9d2266774d 100644\n--- a/drivers/net/phy/phylink.c\n+++ b/drivers/net/phy/phylink.c\n@@ -1040,6 +1040,7 @@ static enum inband_type phylink_get_inband_type(phy_interface_t interface)\n {\n \tswitch (interface) {\n \tcase PHY_INTERFACE_MODE_SGMII:\n+\tcase PHY_INTERFACE_MODE_PSGMII:\n \tcase PHY_INTERFACE_MODE_QSGMII:\n \tcase PHY_INTERFACE_MODE_QUSGMII:\n \tcase PHY_INTERFACE_MODE_USXGMII:\n@@ -4183,6 +4184,7 @@ void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\n \t\tbreak;\n \n \tcase PHY_INTERFACE_MODE_SGMII:\n+\tcase PHY_INTERFACE_MODE_PSGMII:\n \tcase PHY_INTERFACE_MODE_QSGMII:\n \t\tif (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED)\n \t\t\tphylink_decode_sgmii_word(state, lpa);\n@@ -4263,6 +4265,7 @@ int phylink_mii_c22_pcs_encode_advertisement(phy_interface_t interface,\n \t\t\tadv |= ADVERTISE_1000XPSE_ASYM;\n \t\treturn adv;\n \tcase PHY_INTERFACE_MODE_SGMII:\n+\tcase PHY_INTERFACE_MODE_PSGMII:\n \tcase PHY_INTERFACE_MODE_QSGMII:\n \t\treturn 0x0001;\n \tdefault:\ndiff --git a/include/linux/phylink.h b/include/linux/phylink.h\nindex 2bc0db3d52ac8..1dda5c7ed5f14 100644\n--- a/include/linux/phylink.h\n+++ b/include/linux/phylink.h\n@@ -791,6 +791,7 @@ static inline int phylink_get_link_timer_ns(phy_interface_t interface)\n {\n \tswitch (interface) {\n \tcase PHY_INTERFACE_MODE_SGMII:\n+\tcase PHY_INTERFACE_MODE_PSGMII:\n \tcase PHY_INTERFACE_MODE_QSGMII:\n \tcase PHY_INTERFACE_MODE_USXGMII:\n \tcase PHY_INTERFACE_MODE_10G_QXGMII:\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds support for PHY_INTERFACE_MODE_PSGMII (Penta SGMII) to several switch statements in the phylink core. This is a hardware-specific PHY interface mode. A search of the kernel tree reveals that PHY_INTERFACE_MODE_PSGMII is only referenced by the qca807x physical PHY driver, and no MAC drivers explicitly support it. Furthermore, virtual network drivers and software-emulated USB ethernet adapters (which use phylink) hardcode their interface modes to standard ones like MII, RMII, or GMII. Since this interface mode cannot be configured from userspace and is not used by any emulated hardware, the newly added code paths are impossible to reach in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit cd7fc031275eb4cd6e90e4dfe469471da494610c
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Aug 9 16:04:51 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 18d2ead97aa54..1ce9d2266774d 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -1040,6 +1040,7 @@ static enum inband_type phylink_get_inband_type(phy_interface_t interface)
 {
 	switch (interface) {
 	case PHY_INTERFACE_MODE_SGMII:
+	case PHY_INTERFACE_MODE_PSGMII:
 	case PHY_INTERFACE_MODE_QSGMII:
 	case PHY_INTERFACE_MODE_QUSGMII:
 	case PHY_INTERFACE_MODE_USXGMII:
@@ -4183,6 +4184,7 @@ void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,
 		break;
 
 	case PHY_INTERFACE_MODE_SGMII:
+	case PHY_INTERFACE_MODE_PSGMII:
 	case PHY_INTERFACE_MODE_QSGMII:
 		if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED)
 			phylink_decode_sgmii_word(state, lpa);
@@ -4263,6 +4265,7 @@ int phylink_mii_c22_pcs_encode_advertisement(phy_interface_t interface,
 			adv |= ADVERTISE_1000XPSE_ASYM;
 		return adv;
 	case PHY_INTERFACE_MODE_SGMII:
+	case PHY_INTERFACE_MODE_PSGMII:
 	case PHY_INTERFACE_MODE_QSGMII:
 		return 0x0001;
 	default:
diff --git a/include/linux/phylink.h b/include/linux/phylink.h
index 2bc0db3d52ac8..1dda5c7ed5f14 100644
--- a/include/linux/phylink.h
+++ b/include/linux/phylink.h
@@ -791,6 +791,7 @@ static inline int phylink_get_link_timer_ns(phy_interface_t interface)
 {
 	switch (interface) {
 	case PHY_INTERFACE_MODE_SGMII:
+	case PHY_INTERFACE_MODE_PSGMII:
 	case PHY_INTERFACE_MODE_QSGMII:
 	case PHY_INTERFACE_MODE_USXGMII:
 	case PHY_INTERFACE_MODE_10G_QXGMII:

gemini-3.1-pro-preview

null

null

							input: 2442
							output: 28
							thoughts: 348
						

**Analyzing a PHY Interface Mode Patch**

Okay, so I've got this patch that tweaks `phylink.c` and `phylink.h`. Looks like they're adding `PHY_INTERFACE_MODE_PSGMII` to a few switch statements in functions related to the phylink framework. Specifically, I'm seeing changes in `phylink_get_inband_type`, `phylink_mii_c22_pcs_decode_state`, `phylink_mii_c22_pcs_encode_advertisement`, and `phylink_get_link_timer_ns`. The changes themselves are minimal – basically, routing the PSGMII case through the existing SGMII and QSGMII logic.

My initial thought is, is this even worth fuzzing? It's part of the phylink framework, which, as we know, is pretty core to network driver functionality. And, `phylink_mii_c22_pcs_decode_state` and `phylink_mii_c22_pcs_encode_advertisement` are exported symbols. That raises a flag. I need to figure out if `PHY_INTERFACE_MODE_PSGMII` is something that's only configured at the hardware level, via Device Tree or driver probe, or if it can be reached via userspace, maybe through ethtool or netlink. That's the key to whether fuzzing is even relevant here.

Given those exported symbols, `phylink_mii_c22_pcs_decode_state` and `phylink_mii_c22_pcs_encode_advertisement`, that feels like the best place to start. Let's see if this mode is something that can be set or altered by userspace.

{
  "Expression": "phylink_mii_c22_pcs_decode_state"
}

{
  "Output": "drivers/net/dsa/mxl862xx/mxl862xx-phylink.c=213=static void mxl862xx_pcs_get_state(struct phylink_pcs *pcs,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-phylink.c-257-\t\t       (state-\u003ean_complete ? BMSR_ANEGCOMPLETE : 0);\ndrivers/net/dsa/mxl862xx/mxl862xx-phylink.c:258:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr,\ndrivers/net/dsa/mxl862xx/mxl862xx-phylink.c-259-\t\t\t\t\t\t le16_to_cpu(st.lpa.cl37));\n--\ndrivers/net/ethernet/cadence/macb_main.c=573=static void macb_pcs_get_state(struct phylink_pcs *pcs, unsigned int neg_mode,\n--\ndrivers/net/ethernet/cadence/macb_main.c-580-\tlpa = gem_readl(bp, PCSANLPBASE);\ndrivers/net/ethernet/cadence/macb_main.c:581:\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lpa);\ndrivers/net/ethernet/cadence/macb_main.c-582-}\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c=287=void lan966x_port_status_get(struct lan966x_port *port, unsigned int neg_mode,\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c-316-\t\tlp_adv = DEV_PCS1G_ANEG_STATUS_LP_ADV_GET(val);\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c:317:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lp_adv);\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c-318-\t} else {\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c=66=static void dwmac_integrated_pcs_get_state(struct phylink_pcs *pcs,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c-83-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c:84:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, status, lpa);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c-85-\t} else {\n--\ndrivers/net/pcs/pcs-mtk-lynxi.c=108=static void mtk_pcs_lynxi_get_state(struct phylink_pcs *pcs,\n--\ndrivers/net/pcs/pcs-mtk-lynxi.c-118-\ndrivers/net/pcs/pcs-mtk-lynxi.c:119:\tphylink_mii_c22_pcs_decode_state(state, neg_mode,\ndrivers/net/pcs/pcs-mtk-lynxi.c-120-\t\t\t\t\t FIELD_GET(SGMII_BMSR, bm),\n--\ndrivers/net/pcs/pcs-xpcs.c=1103=static int xpcs_get_state_c37_1000basex(struct dw_xpcs *xpcs,\n--\ndrivers/net/pcs/pcs-xpcs.c-1132-\ndrivers/net/pcs/pcs-xpcs.c:1133:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lpa);\ndrivers/net/pcs/pcs-xpcs.c-1134-\t}\n--\ndrivers/net/phy/phylink.c=4116=static void phylink_decode_usgmii_word(struct phylink_link_state *state,\n--\ndrivers/net/phy/phylink.c-4140-/**\ndrivers/net/phy/phylink.c:4141: * phylink_mii_c22_pcs_decode_state() - Decode MAC PCS state from MII registers\ndrivers/net/phy/phylink.c-4142- * @state: a pointer to a \u0026struct phylink_link_state.\n--\ndrivers/net/phy/phylink.c-4154- */\ndrivers/net/phy/phylink.c:4155:void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\ndrivers/net/phy/phylink.c-4156-\t\t\t\t      unsigned int neg_mode, u16 bmsr, u16 lpa)\n--\ndrivers/net/phy/phylink.c-4202-}\ndrivers/net/phy/phylink.c:4203:EXPORT_SYMBOL_GPL(phylink_mii_c22_pcs_decode_state);\ndrivers/net/phy/phylink.c-4204-\n--\ndrivers/net/phy/phylink.c=4220=void phylink_mii_c22_pcs_get_state(struct mdio_device *pcs,\n--\ndrivers/net/phy/phylink.c-4232-\ndrivers/net/phy/phylink.c:4233:\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lpa);\ndrivers/net/phy/phylink.c-4234-}\n--\ninclude/linux/phylink.h=816=static inline bool phylink_mac_implements_lpi(const struct phylink_mac_ops *ops)\n--\ninclude/linux/phylink.h-820-\ninclude/linux/phylink.h:821:void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\ninclude/linux/phylink.h-822-\t\t\t\t      unsigned int neg_mode, u16 bmsr, u16 lpa);\n"
}

gemini-3.1-pro-preview

null

null

							input: 4812
							output: 23
							thoughts: 158
						

**Analyzing Recent Changes in the `phylink` Subsystem**

Okay, so I'm looking over these recent modifications. They seem to be focused on a few specific areas within the `phylink` subsystem: `phylink_get_inband_type`, `phylink_mii_c22_pcs_decode_state`, `phylink_mii_c22_pcs_encode_advertisement`, and `phylink_get_link_timer_ns`.  Not a vast amount of code, but clearly important pieces, given where they sit.

The `phylink` subsystem, as we know, is a core component and is leveraged extensively by a wide array of MAC drivers. I see that it is utilised within `macb`, `stmmac`, `lan966x`, `mtk_eth_soc` drivers, all of which are quite common.  This suggests that even minor tweaks here could potentially have broad implications, good to keep in mind for testing.

Now, a slightly different question arises in my mind. These changes may have implications in a very specific scenario, and I am curious whether `PHY_INTERFACE_MODE_PSGMII` is actually *reachable* in virtualized environments. I'm going to quickly check which drivers explicitly use this, just to get a lay of the land here.  It would be interesting to see if any of these changes touch that code path.

{
  "Expression": "PHY_INTERFACE_MODE_PSGMII"
}

{
  "Output": "Documentation/networking/phy.rst=238=Some of the interface modes are described below:\n--\nDocumentation/networking/phy.rst-325-\nDocumentation/networking/phy.rst:326:``PHY_INTERFACE_MODE_PSGMII``\nDocumentation/networking/phy.rst-327-    This is the Penta SGMII mode, it is similar to QSGMII but it combines 5\n--\ndrivers/net/phy/phy-core.c=159=int phy_interface_num_ports(phy_interface_t interface)\n--\ndrivers/net/phy/phy-core.c-201-\t\treturn 4;\ndrivers/net/phy/phy-core.c:202:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phy-core.c-203-\t\treturn 5;\n--\ndrivers/net/phy/phy_caps.c=294=unsigned long phy_caps_from_interface(phy_interface_t interface)\n--\ndrivers/net/phy/phy_caps.c-310-\tcase PHY_INTERFACE_MODE_RGMII:\ndrivers/net/phy/phy_caps.c:311:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phy_caps.c-312-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=238=static int phylink_interface_max_speed(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-259-\tcase PHY_INTERFACE_MODE_RGMII:\ndrivers/net/phy/phylink.c:260:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-261-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=774=static int phylink_parse_mode(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-808-\t\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:809:\t\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-810-\t\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=1039=static enum inband_type phylink_get_inband_type(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-1042-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:1043:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-1044-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=4155=void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\n--\ndrivers/net/phy/phylink.c-4186-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:4187:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-4188-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=4251=int phylink_mii_c22_pcs_encode_advertisement(phy_interface_t interface,\n--\ndrivers/net/phy/phylink.c-4267-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:4268:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-4269-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/qcom/qca807x.c=490=static int qca807x_phy_package_probe_once(struct phy_device *phydev)\n--\ndrivers/net/phy/qcom/qca807x.c-549-\t\tif (!strcasecmp(package_mode_name,\ndrivers/net/phy/qcom/qca807x.c:550:\t\t\t\tphy_modes(PHY_INTERFACE_MODE_PSGMII)))\ndrivers/net/phy/qcom/qca807x.c:551:\t\t\tpriv-\u003epackage_mode = PHY_INTERFACE_MODE_PSGMII;\ndrivers/net/phy/qcom/qca807x.c-552-\t\telse if (!strcasecmp(package_mode_name,\n--\ndrivers/net/phy/qcom/qca807x.c=562=static int qca807x_phy_package_config_init_once(struct phy_device *phydev)\n--\ndrivers/net/phy/qcom/qca807x.c-585-\t\tbreak;\ndrivers/net/phy/qcom/qca807x.c:586:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/qcom/qca807x.c-587-\tdefault:\n--\ninclude/linux/phy.h=53=extern const int phy_basic_ports_array[3];\n--\ninclude/linux/phy.h-89- * @PHY_INTERFACE_MODE_MOCA: Multimedia over Coax\ninclude/linux/phy.h:90: * @PHY_INTERFACE_MODE_PSGMII: Penta SGMII\ninclude/linux/phy.h-91- * @PHY_INTERFACE_MODE_QSGMII: Quad SGMII\n--\ninclude/linux/phy.h=114=typedef enum {\n--\ninclude/linux/phy.h-132-\tPHY_INTERFACE_MODE_MOCA,\ninclude/linux/phy.h:133:\tPHY_INTERFACE_MODE_PSGMII,\ninclude/linux/phy.h-134-\tPHY_INTERFACE_MODE_QSGMII,\n--\ninclude/linux/phy.h=210=static inline const char *phy_modes(phy_interface_t interface)\n--\ninclude/linux/phy.h-248-\t\treturn \"moca\";\ninclude/linux/phy.h:249:\tcase PHY_INTERFACE_MODE_PSGMII:\ninclude/linux/phy.h-250-\t\treturn \"psgmii\";\n--\ninclude/linux/phylink.h=790=static inline int phylink_get_link_timer_ns(phy_interface_t interface)\n--\ninclude/linux/phylink.h-793-\tcase PHY_INTERFACE_MODE_SGMII:\ninclude/linux/phylink.h:794:\tcase PHY_INTERFACE_MODE_PSGMII:\ninclude/linux/phylink.h-795-\tcase PHY_INTERFACE_MODE_QSGMII:\n"
}

gemini-3.1-pro-preview

null

null

							input: 6528
							output: 18
							thoughts: 501
						

**Analyzing the phylink Patch**

Okay, so this patch introduces `PHY_INTERFACE_MODE_PSGMII` into a few key areas of the `phylink` framework. It looks like it's treating it similarly to `SGMII` and `QSGMII`. This is definitely a functional change in the core phylink logic, meaning the underlying behavior will change. The question is, can this be reached in a virtualized environment? I know `phylink` is used by numerous network drivers. Some of those could be emulated or virtualized. At least, the phylink core might be reachable if we have a driver that uses it, right?

Aha, `PHY_INTERFACE_MODE_PSGMII` is a *specific* hardware interface for Penta SGMII. So, are there any drivers actually using it? Let's see... Grepping for it shows that the `qca807x` driver from Qualcomm does use this interface mode. That makes sense; they often utilize these interface types.

The functions being modified are critical: `phylink_get_inband_type`, `phylink_mii_c22_pcs_decode_state`, `phylink_mii_c22_pcs_encode_advertisement`, and `phylink_get_link_timer_ns`. These functions are either exported or used internally within `phylink`, the generic framework. It sounds like a core change, therefore it’s worth thinking about fuzzing this, right? It's a key piece of the network stack, so fuzzing would be a good idea. However, wait, `phylink` is mostly for physical ethernet drivers like MACs and PHYs. Can Syzkaller even fuzz `phylink` effectively? Syzkaller can fuzz netlink interfaces, and maybe some virtual ethernet drivers use `phylink`?

Let's check if any virtual driver utilizes `phylink`. I should look at whether `phylink_create` is called by any driver that can be instantiated by syzkaller. Like `netdevsim`, `veth`, or `tun` for example.

{
  "Expression": "phylink_create"
}

{
  "Output": "Documentation/networking/sfp-phylink.rst=74=this documentation.\n--\nDocumentation/networking/sfp-phylink.rst-363-\nDocumentation/networking/sfp-phylink.rst:364:\tphylink = phylink_create(\u0026priv-\u003ephylink_config, node, phy_mode, \u0026phylink_ops);\nDocumentation/networking/sfp-phylink.rst-365-\tif (IS_ERR(phylink)) {\n--\ndrivers/net/ethernet/altera/altera_tse_main.c=1128=static int altera_tse_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/altera/altera_tse_main.c-1415-\ndrivers/net/ethernet/altera/altera_tse_main.c:1416:\tpriv-\u003ephylink = phylink_create(\u0026priv-\u003ephylink_config,\ndrivers/net/ethernet/altera/altera_tse_main.c-1417-\t\t\t\t       of_fwnode_handle(priv-\u003edevice-\u003eof_node),\n--\ndrivers/net/ethernet/atheros/ag71xx.c=1074=static int ag71xx_phylink_setup(struct ag71xx *ag)\n--\ndrivers/net/ethernet/atheros/ag71xx.c-1108-\ndrivers/net/ethernet/atheros/ag71xx.c:1109:\tphylink = phylink_create(\u0026ag-\u003ephylink_config, ag-\u003epdev-\u003edev.fwnode,\ndrivers/net/ethernet/atheros/ag71xx.c-1110-\t\t\t\t ag-\u003ephy_if_mode, \u0026ag71xx_phylink_mac_ops);\n--\ndrivers/net/ethernet/cadence/macb_main.c=1023=static int macb_mii_probe(struct net_device *dev)\n--\ndrivers/net/ethernet/cadence/macb_main.c-1085-\ndrivers/net/ethernet/cadence/macb_main.c:1086:\tbp-\u003ephylink = phylink_create(\u0026bp-\u003ephylink_config, bp-\u003epdev-\u003edev.fwnode,\ndrivers/net/ethernet/cadence/macb_main.c-1087-\t\t\t\t     bp-\u003ephy_interface, \u0026macb_phylink_ops);\n--\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c=201=static int dpaa_netdev_init(struct net_device *net_dev,\n--\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c-274-\tmac_dev-\u003eupdate_speed = dpaa_eth_cgr_set_speed;\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c:275:\tmac_dev-\u003ephylink = phylink_create(\u0026mac_dev-\u003ephylink_config,\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c-276-\t\t\t\t\t  dev_fwnode(mac_dev-\u003edev),\n--\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c=560=int dpaa2_mac_connect(struct dpaa2_mac *mac)\n--\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c-624-\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c:625:\tphylink = phylink_create(\u0026mac-\u003ephylink_config,\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c-626-\t\t\t\t dpmac_node, mac-\u003eif_mode,\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c=971=static int enetc4_link_init(struct enetc_ndev_priv *priv,\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-989-\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:990:\terr = enetc_phylink_create(priv, node, \u0026enetc_pl_mac_ops);\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-991-\tif (err) {\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-992-\t\tdev_err(dev, \"Failed to create phylink\\n\");\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:993:\t\tgoto err_phylink_create;\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-994-\t}\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-997-\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:998:err_phylink_create:\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-999-\tenetc_mdiobus_destroy(pf);\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c=847=static int enetc_pf_probe(struct pci_dev *pdev,\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-929-\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:930:\terr = enetc_phylink_create(priv, node, \u0026enetc_mac_phylink_ops);\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-931-\tif (err)\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:932:\t\tgoto err_phylink_create;\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-933-\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-941-\tenetc_phylink_destroy(priv);\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:942:err_phylink_create:\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-943-\tenetc_mdiobus_destroy(pf);\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c=312=EXPORT_SYMBOL_GPL(enetc_mdiobus_destroy);\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-313-\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c:314:int enetc_phylink_create(struct enetc_ndev_priv *priv, struct device_node *node,\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-315-\t\t\t const struct phylink_mac_ops *ops)\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-337-\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c:338:\tphylink = phylink_create(\u0026pf-\u003ephylink_config, of_fwnode_handle(node),\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-339-\t\t\t\t pf-\u003eif_mode, ops);\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-348-}\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c:349:EXPORT_SYMBOL_GPL(enetc_phylink_create);\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-350-\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.h=12=void enetc_mdiobus_destroy(struct enetc_pf *pf);\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.h:13:int enetc_phylink_create(struct enetc_ndev_priv *priv, struct device_node *node,\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.h-14-\t\t\t const struct phylink_mac_ops *ops);\n--\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c=853=static int fs_enet_probe(struct platform_device *ofdev)\n--\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c-932-\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c:933:\tphylink = phylink_create(\u0026fep-\u003ephylink_config, dev_fwnode(fep-\u003edev),\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c-934-\t\t\t\t phy_mode, \u0026fs_enet_phylink_mac_ops);\n--\ndrivers/net/ethernet/freescale/ucc_geth.c=3419=static int ucc_geth_probe(struct platform_device* ofdev)\n--\ndrivers/net/ethernet/freescale/ucc_geth.c-3573-\ndrivers/net/ethernet/freescale/ucc_geth.c:3574:\tphylink = phylink_create(\u0026ugeth-\u003ephylink_config, dev_fwnode(\u0026dev-\u003edev),\ndrivers/net/ethernet/freescale/ucc_geth.c-3575-\t\t\t\t phy_interface, \u0026ugeth_mac_ops);\n--\ndrivers/net/ethernet/marvell/mvneta.c=5480=static int mvneta_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/marvell/mvneta.c-5598-\ndrivers/net/ethernet/marvell/mvneta.c:5599:\tphylink = phylink_create(\u0026pp-\u003ephylink_config, pdev-\u003edev.fwnode,\ndrivers/net/ethernet/marvell/mvneta.c-5600-\t\t\t\t phy_mode, \u0026mvneta_phylink_ops);\n--\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c=6840=static int mvpp2_port_probe(struct platform_device *pdev,\n--\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c-7147-\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c:7148:\t\tphylink = phylink_create(\u0026port-\u003ephylink_config, port_fwnode,\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c-7149-\t\t\t\t\t phy_mode, \u0026mvpp2_phylink_ops);\n--\ndrivers/net/ethernet/marvell/prestera/prestera_main.c=370=static int prestera_port_sfp_bind(struct prestera_port *port)\n--\ndrivers/net/ethernet/marvell/prestera/prestera_main.c-416-\ndrivers/net/ethernet/marvell/prestera/prestera_main.c:417:\t\tphy_link = phylink_create(\u0026port-\u003ephy_config, fwnode,\ndrivers/net/ethernet/marvell/prestera/prestera_main.c-418-\t\t\t\t\t  PHY_INTERFACE_MODE_INTERNAL,\n--\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c=4823=static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)\n--\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c-4967-\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c:4968:\tphylink = phylink_create(\u0026mac-\u003ephylink_config,\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c-4969-\t\t\t\t of_fwnode_handle(mac-\u003eof_node),\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c=746=struct net_device *fbnic_netdev_alloc(struct fbnic_dev *fbd)\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c-834-\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c:835:\tif (fbnic_phylink_create(netdev)) {\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c-836-\t\tfree_netdev(netdev);\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h=111=int fbnic_phylink_get_fecparam(struct net_device *netdev,\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h-112-\t\t\t       struct ethtool_fecparam *fecparam);\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h:113:int fbnic_phylink_create(struct net_device *netdev);\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h-114-void fbnic_phylink_destroy(struct net_device *netdev);\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c=177=static const struct phylink_mac_ops fbnic_phylink_mac_ops = {\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-186-/**\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c:187: * fbnic_phylink_create - Phylink device creation\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-188- * @netdev: Network Device struct to attach phylink device\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-196- **/\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c:197:int fbnic_phylink_create(struct net_device *netdev)\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-198-{\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-231-\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c:232:\tphylink = phylink_create(\u0026fbn-\u003ephylink_config, NULL,\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-233-\t\t\t\t fbnic_phylink_select_interface(fbn-\u003eaui),\n--\ndrivers/net/ethernet/microchip/lan743x_main.c=3142=static const struct phylink_mac_ops lan743x_phylink_mac_ops = {\n--\ndrivers/net/ethernet/microchip/lan743x_main.c-3149-\ndrivers/net/ethernet/microchip/lan743x_main.c:3150:static int lan743x_phylink_create(struct lan743x_adapter *adapter)\ndrivers/net/ethernet/microchip/lan743x_main.c-3151-{\n--\ndrivers/net/ethernet/microchip/lan743x_main.c-3192-\ndrivers/net/ethernet/microchip/lan743x_main.c:3193:\tpl = phylink_create(\u0026adapter-\u003ephylink_config, NULL,\ndrivers/net/ethernet/microchip/lan743x_main.c-3194-\t\t\t    adapter-\u003ephy_interface, \u0026lan743x_phylink_mac_ops);\n--\ndrivers/net/ethernet/microchip/lan743x_main.c=3664=static int lan743x_pcidev_probe(struct pci_dev *pdev,\n--\ndrivers/net/ethernet/microchip/lan743x_main.c-3723-\ndrivers/net/ethernet/microchip/lan743x_main.c:3724:\tret = lan743x_phylink_create(adapter);\ndrivers/net/ethernet/microchip/lan743x_main.c-3725-\tif (ret \u003c 0) {\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c=791=static int lan966x_probe_port(struct lan966x *lan966x, u32 p,\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c-855-\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c:856:\tphylink = phylink_create(\u0026port-\u003ephylink_config,\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c-857-\t\t\t\t portnp,\n--\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c=312=static int sparx5_create_port(struct sparx5 *sparx5,\n--\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c-388-\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c:389:\tphylink = phylink_create(\u0026spx5_port-\u003ephylink_config,\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c-390-\t\t\t\t of_fwnode_handle(config-\u003enode),\n--\ndrivers/net/ethernet/mscc/ocelot_net.c=1774=static const struct phylink_mac_ops ocelot_phylink_ops = {\n--\ndrivers/net/ethernet/mscc/ocelot_net.c-1779-\ndrivers/net/ethernet/mscc/ocelot_net.c:1780:static int ocelot_port_phylink_create(struct ocelot *ocelot, int port,\ndrivers/net/ethernet/mscc/ocelot_net.c-1781-\t\t\t\t      struct device_node *portnp)\n--\ndrivers/net/ethernet/mscc/ocelot_net.c-1820-\ndrivers/net/ethernet/mscc/ocelot_net.c:1821:\tphylink = phylink_create(\u0026priv-\u003ephylink_config,\ndrivers/net/ethernet/mscc/ocelot_net.c-1822-\t\t\t\t of_fwnode_handle(portnp),\n--\ndrivers/net/ethernet/mscc/ocelot_net.c=1843=int ocelot_probe_port(struct ocelot *ocelot, int port, struct regmap *target,\n--\ndrivers/net/ethernet/mscc/ocelot_net.c-1879-\ndrivers/net/ethernet/mscc/ocelot_net.c:1880:\terr = ocelot_port_phylink_create(ocelot, port, portnp);\ndrivers/net/ethernet/mscc/ocelot_net.c-1881-\tif (err)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c=1370=static int stmmac_phylink_setup(struct stmmac_priv *priv)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-1461-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1462:\tphylink = phylink_create(config, dev_fwnode(priv-\u003edevice),\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-1463-\t\t\t\t priv-\u003eplat-\u003ephy_interface,\n--\ndrivers/net/ethernet/tehuti/tn40_phy.c=45=int tn40_phy_register(struct tn40_priv *priv)\n--\ndrivers/net/ethernet/tehuti/tn40_phy.c-62-\ndrivers/net/ethernet/tehuti/tn40_phy.c:63:\tphylink = phylink_create(config, NULL, PHY_INTERFACE_MODE_XAUI,\ndrivers/net/ethernet/tehuti/tn40_phy.c-64-\t\t\t\t \u0026tn40_mac_ops);\n--\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c=2757=am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx)\n--\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c-2841-\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c:2842:\tphylink = phylink_create(\u0026port-\u003eslave.phylink_config,\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c-2843-\t\t\t\t of_fwnode_handle(port-\u003eslave.port_np),\n--\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c=130=static int ngbe_phylink_init(struct wx *wx)\n--\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c-149-\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c:150:\tphylink = phylink_create(config, NULL, phy_mode, \u0026ngbe_mac_ops);\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c-151-\tif (IS_ERR(phylink))\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c=482=int txgbe_phylink_init_aml(struct txgbe *txgbe)\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c-512-\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c:513:\tphylink = phylink_create(config, NULL, phy_mode, \u0026txgbe_mac_ops_aml);\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c-514-\tif (IS_ERR(phylink))\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c=268=static int txgbe_phylink_init(struct txgbe *txgbe)\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c-292-\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:293:\tphylink = phylink_create(config, fwnode, phy_mode, \u0026txgbe_mac_ops);\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c-294-\tif (IS_ERR(phylink))\n--\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c=2795=static int axienet_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3117-\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c:3118:\tlp-\u003ephylink = phylink_create(\u0026lp-\u003ephylink_config, pdev-\u003edev.fwnode,\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3119-\t\t\t\t     lp-\u003ephy_mode,\n--\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3122-\t\tret = PTR_ERR(lp-\u003ephylink);\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c:3123:\t\tdev_err(\u0026pdev-\u003edev, \"phylink_create error (%i)\\n\", ret);\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3124-\t\tgoto cleanup_mdio;\n--\ndrivers/net/phy/phylink.c=516=static int phylink_validate_mac_and_pcs(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-531-\tif (pcs) {\ndrivers/net/phy/phylink.c:532:\t\t/* The PCS, if present, must be setup before phylink_create()\ndrivers/net/phy/phylink.c-533-\t\t * has been called. If the ops is not initialised, print an\n--\ndrivers/net/phy/phylink.c=1039=static enum inband_type phylink_get_inband_type(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-1071- * phylink_pcs_neg_mode() - helper to determine PCS inband mode\ndrivers/net/phy/phylink.c:1072: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1073- * @pcs: a pointer to \u0026struct phylink_pcs\n--\ndrivers/net/phy/phylink.c=1769=static int phylink_register_sfp(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-1793- * phylink_set_fixed_link() - set the fixed link\ndrivers/net/phy/phylink.c:1794: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1795- * @state: a pointer to a struct phylink_link_state.\n--\ndrivers/net/phy/phylink.c=1831=EXPORT_SYMBOL_GPL(phylink_set_fixed_link);\n--\ndrivers/net/phy/phylink.c-1833-/**\ndrivers/net/phy/phylink.c:1834: * phylink_create() - create a phylink instance\ndrivers/net/phy/phylink.c-1835- * @config: a pointer to the target \u0026struct phylink_config\n--\ndrivers/net/phy/phylink.c-1848- */\ndrivers/net/phy/phylink.c:1849:struct phylink *phylink_create(struct phylink_config *config,\ndrivers/net/phy/phylink.c-1850-\t\t\t       const struct fwnode_handle *fwnode,\n--\ndrivers/net/phy/phylink.c-1936-}\ndrivers/net/phy/phylink.c:1937:EXPORT_SYMBOL_GPL(phylink_create);\ndrivers/net/phy/phylink.c-1938-\n--\ndrivers/net/phy/phylink.c-1940- * phylink_destroy() - cleanup and destroy the phylink instance\ndrivers/net/phy/phylink.c:1941: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1942- *\n--\ndrivers/net/phy/phylink.c=1957=EXPORT_SYMBOL_GPL(phylink_destroy);\n--\ndrivers/net/phy/phylink.c-1960- * phylink_expects_phy() - Determine if phylink expects a phy to be attached\ndrivers/net/phy/phylink.c:1961: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1962- *\n--\ndrivers/net/phy/phylink.c=2206=static int phylink_attach_phy(struct phylink *pl, struct phy_device *phy,\n--\ndrivers/net/phy/phylink.c-2226- * phylink_connect_phy() - connect a PHY to the phylink instance\ndrivers/net/phy/phylink.c:2227: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2228- * @phy: a pointer to a \u0026struct phy_device.\n--\ndrivers/net/phy/phylink.c=2260=EXPORT_SYMBOL_GPL(phylink_connect_phy);\n--\ndrivers/net/phy/phylink.c-2263- * phylink_of_phy_connect() - connect the PHY specified in the DT mode.\ndrivers/net/phy/phylink.c:2264: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2265- * @dn: a pointer to a \u0026struct device_node.\n--\ndrivers/net/phy/phylink.c=2279=EXPORT_SYMBOL_GPL(phylink_of_phy_connect);\n--\ndrivers/net/phy/phylink.c-2282- * phylink_fwnode_phy_connect() - connect the PHY specified in the fwnode.\ndrivers/net/phy/phylink.c:2283: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2284- * @fwnode: a pointer to a \u0026struct fwnode_handle.\n--\ndrivers/net/phy/phylink.c=2338=EXPORT_SYMBOL_GPL(phylink_fwnode_phy_connect);\n--\ndrivers/net/phy/phylink.c-2342- *   instance.\ndrivers/net/phy/phylink.c:2343: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2344- *\n--\ndrivers/net/phy/phylink.c=2373=static void phylink_link_changed(struct phylink *pl, bool up, const char *what)\n--\ndrivers/net/phy/phylink.c-2382- * phylink_mac_change() - notify phylink of a change in MAC state\ndrivers/net/phy/phylink.c:2383: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2384- * @up: indicates whether the link is currently up.\n--\ndrivers/net/phy/phylink.c=2415=static irqreturn_t phylink_link_handler(int irq, void *data)\n--\ndrivers/net/phy/phylink.c-2425- * phylink_start() - start a phylink instance\ndrivers/net/phy/phylink.c:2426: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2427- *\n--\ndrivers/net/phy/phylink.c=2488=EXPORT_SYMBOL_GPL(phylink_start);\n--\ndrivers/net/phy/phylink.c-2491- * phylink_stop() - stop a phylink instance\ndrivers/net/phy/phylink.c:2492: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2493- *\n--\ndrivers/net/phy/phylink.c=2522=EXPORT_SYMBOL_GPL(phylink_stop);\n--\ndrivers/net/phy/phylink.c-2525- * phylink_rx_clk_stop_block() - block PHY ability to stop receive clock in LPI\ndrivers/net/phy/phylink.c:2526: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2527- *\n--\ndrivers/net/phy/phylink.c=2551=EXPORT_SYMBOL_GPL(phylink_rx_clk_stop_block);\n--\ndrivers/net/phy/phylink.c-2554- * phylink_rx_clk_stop_unblock() - unblock PHY ability to stop receive clock\ndrivers/net/phy/phylink.c:2555: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2556- *\n--\ndrivers/net/phy/phylink.c=2593=static bool phylink_phy_pm_speed_ctrl(struct phylink *pl)\n--\ndrivers/net/phy/phylink.c-2600- * phylink_suspend() - handle a network device suspend event\ndrivers/net/phy/phylink.c:2601: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2602- * @mac_wol: true if the MAC needs to receive packets for Wake-on-Lan\n--\ndrivers/net/phy/phylink.c=2652=EXPORT_SYMBOL_GPL(phylink_suspend);\n--\ndrivers/net/phy/phylink.c-2655- * phylink_prepare_resume() - prepare to resume a network device\ndrivers/net/phy/phylink.c:2656: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2657- *\n--\ndrivers/net/phy/phylink.c=2677=EXPORT_SYMBOL_GPL(phylink_prepare_resume);\n--\ndrivers/net/phy/phylink.c-2680- * phylink_resume() - handle a network device resume event\ndrivers/net/phy/phylink.c:2681: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2682- *\n--\ndrivers/net/phy/phylink.c=2720=EXPORT_SYMBOL_GPL(phylink_resume);\n--\ndrivers/net/phy/phylink.c-2723- * phylink_ethtool_get_wol() - get the wake on lan parameters for the PHY\ndrivers/net/phy/phylink.c:2724: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2725- * @wol: a pointer to \u0026struct ethtool_wolinfo to hold the read parameters\n--\ndrivers/net/phy/phylink.c=2757=EXPORT_SYMBOL_GPL(phylink_ethtool_get_wol);\n--\ndrivers/net/phy/phylink.c-2760- * phylink_ethtool_set_wol() - set wake on lan parameters\ndrivers/net/phy/phylink.c:2761: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2762- * @wol: a pointer to \u0026struct ethtool_wolinfo for the desired parameters\n--\ndrivers/net/phy/phylink.c=2889=static void phylink_get_ksettings(const struct phylink_link_state *state,\n--\ndrivers/net/phy/phylink.c-2904- * phylink_ethtool_ksettings_get() - get the current link settings\ndrivers/net/phy/phylink.c:2905: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2906- * @kset: a pointer to a \u0026struct ethtool_link_ksettings to hold link settings\n--\ndrivers/net/phy/phylink.c=2957=static bool phylink_validate_pcs_inband_autoneg(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-2978- * phylink_ethtool_ksettings_set() - set the link settings\ndrivers/net/phy/phylink.c:2979: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2980- * @kset: a pointer to a \u0026struct ethtool_link_ksettings for the desired modes\n--\ndrivers/net/phy/phylink.c=3145=EXPORT_SYMBOL_GPL(phylink_ethtool_ksettings_set);\n--\ndrivers/net/phy/phylink.c-3148- * phylink_ethtool_nway_reset() - restart negotiation\ndrivers/net/phy/phylink.c:3149: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3150- *\n--\ndrivers/net/phy/phylink.c=3170=EXPORT_SYMBOL_GPL(phylink_ethtool_nway_reset);\n--\ndrivers/net/phy/phylink.c-3173- * phylink_ethtool_get_pauseparam() - get the current pause parameters\ndrivers/net/phy/phylink.c:3174: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3175- * @pause: a pointer to a \u0026struct ethtool_pauseparam\n--\ndrivers/net/phy/phylink.c=3186=EXPORT_SYMBOL_GPL(phylink_ethtool_get_pauseparam);\n--\ndrivers/net/phy/phylink.c-3189- * phylink_ethtool_set_pauseparam() - set the current pause parameters\ndrivers/net/phy/phylink.c:3190: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3191- * @pause: a pointer to a \u0026struct ethtool_pauseparam\n--\ndrivers/net/phy/phylink.c=3272=EXPORT_SYMBOL_GPL(phylink_ethtool_set_pauseparam);\n--\ndrivers/net/phy/phylink.c-3276- *   counter\ndrivers/net/phy/phylink.c:3277: * @pl: a pointer to a \u0026struct phylink returned from phylink_create().\ndrivers/net/phy/phylink.c-3278- *\n--\ndrivers/net/phy/phylink.c=3295=EXPORT_SYMBOL_GPL(phylink_get_eee_err);\n--\ndrivers/net/phy/phylink.c-3298- * phylink_ethtool_get_eee() - read the energy efficient ethernet parameters\ndrivers/net/phy/phylink.c:3299: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3300- * @eee: a pointer to a \u0026struct ethtool_keee for the read parameters\n--\ndrivers/net/phy/phylink.c=3321=EXPORT_SYMBOL_GPL(phylink_ethtool_get_eee);\n--\ndrivers/net/phy/phylink.c-3324- * phylink_ethtool_set_eee() - set the energy efficient ethernet parameters\ndrivers/net/phy/phylink.c:3325: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3326- * @eee: a pointer to a \u0026struct ethtool_keee for the desired parameters\n--\ndrivers/net/phy/phylink.c=3495=static int phylink_mii_write(struct phylink *pl, unsigned int phy_id,\n--\ndrivers/net/phy/phylink.c-3513- * phylink_mii_ioctl() - generic mii ioctl interface\ndrivers/net/phy/phylink.c:3514: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3515- * @ifr: a pointer to a \u0026struct ifreq for socket ioctls\n--\ndrivers/net/phy/phylink.c=3588=EXPORT_SYMBOL_GPL(phylink_mii_ioctl);\n--\ndrivers/net/phy/phylink.c-3592- *   link partners\ndrivers/net/phy/phylink.c:3593: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3594- * @sync: perform action synchronously\n--\ndrivers/net/phy/phylink.c=3613=EXPORT_SYMBOL_GPL(phylink_speed_down);\n--\ndrivers/net/phy/phylink.c-3617- *   phylink_speed_down()\ndrivers/net/phy/phylink.c:3618: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3619- *\n--\ndrivers/net/phy/phylink.c=4372=EXPORT_SYMBOL_GPL(phylink_mii_c45_pcs_get_state);\n--\ndrivers/net/phy/phylink.c-4376- *\t\t\t\t which loses state\ndrivers/net/phy/phylink.c:4377: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-4378- *\n--\ndrivers/net/phy/phylink.c=4393=EXPORT_SYMBOL_GPL(phylink_replay_link_begin);\n--\ndrivers/net/phy/phylink.c-4397- *\t\t\t       which lost state\ndrivers/net/phy/phylink.c:4398: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-4399- *\n--\ndrivers/net/usb/asix_devices.c=799=static int ax88772_phylink_setup(struct usbnet *dev)\n--\ndrivers/net/usb/asix_devices.c-819-\ndrivers/net/usb/asix_devices.c:820:\tphylink = phylink_create(\u0026priv-\u003ephylink_config, dev-\u003enet-\u003edev.fwnode,\ndrivers/net/usb/asix_devices.c-821-\t\t\t\t phy_if_mode, \u0026ax88772_phylink_mac_ops);\n--\ndrivers/net/usb/lan78xx.c=2799=static int lan78xx_phylink_setup(struct lan78xx_net *dev)\n--\ndrivers/net/usb/lan78xx.c-2838-\ndrivers/net/usb/lan78xx.c:2839:\tphylink = phylink_create(pc, dev-\u003enet-\u003edev.fwnode,\ndrivers/net/usb/lan78xx.c-2840-\t\t\t\t dev-\u003einterface, \u0026lan78xx_phylink_mac_ops);\n--\ninclude/linux/phylink.h=718=int pcs_pre_init(struct phylink_pcs *pcs);\n--\ninclude/linux/phylink.h-721-\ninclude/linux/phylink.h:722:struct phylink *phylink_create(struct phylink_config *,\ninclude/linux/phylink.h-723-\t\t\t       const struct fwnode_handle *,\n--\nnet/dsa/port.c=1611=static const struct phylink_mac_ops dsa_port_phylink_mac_ops = {\n--\nnet/dsa/port.c-1616-\nnet/dsa/port.c:1617:int dsa_port_phylink_create(struct dsa_port *dp)\nnet/dsa/port.c-1618-{\n--\nnet/dsa/port.c-1646-\nnet/dsa/port.c:1647:\tpl = phylink_create(\u0026dp-\u003epl_config, of_fwnode_handle(dp-\u003edn), mode,\nnet/dsa/port.c-1648-\t\t\t    mac_ops);\n--\nnet/dsa/port.c=1665=static int dsa_shared_port_phylink_register(struct dsa_port *dp)\n--\nnet/dsa/port.c-1673-\nnet/dsa/port.c:1674:\terr = dsa_port_phylink_create(dp);\nnet/dsa/port.c-1675-\tif (err)\n--\nnet/dsa/port.h=100=int dsa_port_mrp_del_ring_role(const struct dsa_port *dp,\nnet/dsa/port.h-101-\t\t\t       const struct switchdev_obj_ring_role_mrp *mrp);\nnet/dsa/port.h:102:int dsa_port_phylink_create(struct dsa_port *dp);\nnet/dsa/port.h-103-void dsa_port_phylink_destroy(struct dsa_port *dp);\n--\nnet/dsa/user.c=2654=static int dsa_user_phy_setup(struct net_device *user_dev)\n--\nnet/dsa/user.c-2673-\nnet/dsa/user.c:2674:\tret = dsa_port_phylink_create(dp);\nnet/dsa/user.c-2675-\tif (ret)\n"
}

gemini-3.1-pro-preview

null

null

							input: 19702
							output: 23
							thoughts: 714
						

**Worth Fuzzing? A Deep Dive into PHY_INTERFACE_MODE_PSGMII Reachability**

Okay, so I'm looking at this patch and my initial thought is, "Worth Fuzzing?" The prompt gives me a clear directive: if the code path is impossible to reach in virtualized environments like GCE or QEMU, even with emulated hardware, then it's a no-go. Let's break this down.

First, I see that this patch deals with `PHY_INTERFACE_MODE_PSGMII` within phylink. I know phylink, it's core networking stuff, so any change here piques my interest. The patch itself seems small, primarily adding this mode to a switch statement within core phylink functions: `phylink_get_inband_type`, `phylink_mii_c22_pcs_decode_state`, `phylink_mii_c22_pcs_encode_advertisement`, and `phylink_get_link_timer_ns`. These are all functions called by MAC and PCS drivers.

Now, the crucial question: can I trigger `PHY_INTERFACE_MODE_PSGMII` in a virtualized environment? I start thinking about the ways USB devices can be used in a virtual setting. I know `syzkaller` can emulate USB using `dummy_hcd` or `raw-gadget`, so USB devices *are* reachable. I quickly check a couple of USB drivers I know, `asix_devices.c` and `lan78xx.c`. Neither of these directly use `PHY_INTERFACE_MODE_PSGMII`, which makes me pause. Then I start thinking about PHY drivers more generally. I recall `qca807x.c`, and that PHY drivers typically use MDIO. I know MDIO buses can sometimes be emulated, but usually they are tied to real hardware. This specific mode is likely set by device tree, ACPI, or hardcoded in the driver.

The core of the issue: is this switch statement case, specifically for `PHY_INTERFACE_MODE_PSGMII`, actually *reachable*?  Even if I *could* emulate a MAC/PHY capable of using `PSGMII`, is there a mechanism to configure a virtual device to *use* that particular interface mode?  Likely not. I would need a way to instantiate a PHY or MAC with this mode via something like netlink, but that seems extremely unlikely given that `PHY_INTERFACE_MODE_PSGMII` is primarily a hardware property.

So, this mode, `PHY_INTERFACE_MODE_PSGMII`, is *probably* unreachable in my standard virtual setup. My conclusion is that unless there's a specific, uncommon, and emulated hardware scenario, this code path, at least the specific case for `PHY_INTERFACE_MODE_PSGMII` within those switch statements, is likely dead code in a virtualized environment. However, the functions modified, are core phylink functions and could be reached with other values.
The fact that this is just an enum value is key; it's the *usage* of that enum that matters.

I should probably confirm if there is a way to set `PHY_INTERFACE_MODE_PSGMII` from userspace, just to be absolutely sure.

{
  "Expression": "PHY_INTERFACE_MODE_PSGMII"
}

{
  "Output": "Documentation/networking/phy.rst=238=Some of the interface modes are described below:\n--\nDocumentation/networking/phy.rst-325-\nDocumentation/networking/phy.rst:326:``PHY_INTERFACE_MODE_PSGMII``\nDocumentation/networking/phy.rst-327-    This is the Penta SGMII mode, it is similar to QSGMII but it combines 5\n--\ndrivers/net/phy/phy-core.c=159=int phy_interface_num_ports(phy_interface_t interface)\n--\ndrivers/net/phy/phy-core.c-201-\t\treturn 4;\ndrivers/net/phy/phy-core.c:202:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phy-core.c-203-\t\treturn 5;\n--\ndrivers/net/phy/phy_caps.c=294=unsigned long phy_caps_from_interface(phy_interface_t interface)\n--\ndrivers/net/phy/phy_caps.c-310-\tcase PHY_INTERFACE_MODE_RGMII:\ndrivers/net/phy/phy_caps.c:311:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phy_caps.c-312-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=238=static int phylink_interface_max_speed(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-259-\tcase PHY_INTERFACE_MODE_RGMII:\ndrivers/net/phy/phylink.c:260:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-261-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=774=static int phylink_parse_mode(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-808-\t\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:809:\t\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-810-\t\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=1039=static enum inband_type phylink_get_inband_type(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-1042-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:1043:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-1044-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=4155=void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\n--\ndrivers/net/phy/phylink.c-4186-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:4187:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-4188-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=4251=int phylink_mii_c22_pcs_encode_advertisement(phy_interface_t interface,\n--\ndrivers/net/phy/phylink.c-4267-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:4268:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-4269-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/qcom/qca807x.c=490=static int qca807x_phy_package_probe_once(struct phy_device *phydev)\n--\ndrivers/net/phy/qcom/qca807x.c-549-\t\tif (!strcasecmp(package_mode_name,\ndrivers/net/phy/qcom/qca807x.c:550:\t\t\t\tphy_modes(PHY_INTERFACE_MODE_PSGMII)))\ndrivers/net/phy/qcom/qca807x.c:551:\t\t\tpriv-\u003epackage_mode = PHY_INTERFACE_MODE_PSGMII;\ndrivers/net/phy/qcom/qca807x.c-552-\t\telse if (!strcasecmp(package_mode_name,\n--\ndrivers/net/phy/qcom/qca807x.c=562=static int qca807x_phy_package_config_init_once(struct phy_device *phydev)\n--\ndrivers/net/phy/qcom/qca807x.c-585-\t\tbreak;\ndrivers/net/phy/qcom/qca807x.c:586:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/qcom/qca807x.c-587-\tdefault:\n--\ninclude/linux/phy.h=53=extern const int phy_basic_ports_array[3];\n--\ninclude/linux/phy.h-89- * @PHY_INTERFACE_MODE_MOCA: Multimedia over Coax\ninclude/linux/phy.h:90: * @PHY_INTERFACE_MODE_PSGMII: Penta SGMII\ninclude/linux/phy.h-91- * @PHY_INTERFACE_MODE_QSGMII: Quad SGMII\n--\ninclude/linux/phy.h=114=typedef enum {\n--\ninclude/linux/phy.h-132-\tPHY_INTERFACE_MODE_MOCA,\ninclude/linux/phy.h:133:\tPHY_INTERFACE_MODE_PSGMII,\ninclude/linux/phy.h-134-\tPHY_INTERFACE_MODE_QSGMII,\n--\ninclude/linux/phy.h=210=static inline const char *phy_modes(phy_interface_t interface)\n--\ninclude/linux/phy.h-248-\t\treturn \"moca\";\ninclude/linux/phy.h:249:\tcase PHY_INTERFACE_MODE_PSGMII:\ninclude/linux/phy.h-250-\t\treturn \"psgmii\";\n--\ninclude/linux/phylink.h=790=static inline int phylink_get_link_timer_ns(phy_interface_t interface)\n--\ninclude/linux/phylink.h-793-\tcase PHY_INTERFACE_MODE_SGMII:\ninclude/linux/phylink.h:794:\tcase PHY_INTERFACE_MODE_PSGMII:\ninclude/linux/phylink.h-795-\tcase PHY_INTERFACE_MODE_QSGMII:\n"
}

gemini-3.1-pro-preview

null

null

							input: 22885
							output: 18
							thoughts: 197
						

**Analyzing the Reachability of `PHY_INTERFACE_MODE_PSGMII` in a Virtualized Context**

Okay, so I'm focusing on this `PHY_INTERFACE_MODE_PSGMII` constant, and I see it's only explicitly used within `qca807x.c`. My immediate question is whether this code path, specifically the newly added cases for this mode, can even be *reached* in a virtualized environment. It seems unlikely, right? If no virtual network driver makes use of `PHY_INTERFACE_MODE_PSGMII`, then those new case branches are effectively dead code, at least in a virtualized context.

The next thing I'm considering is whether `phy_interface_t` is even something that's configurable from userspace, either through netlink or ethtool. Typically, that type of interface configuration is a hardware property and is managed deeper down, often set during driver initialization. Device tree overlays might offer a workaround or specific debugfs/sysfs interfaces *could* potentially allow some control, but even that requires a driver to have implemented that kind of user-space interface.

Wait, looking at the common virtual network devices like `tun`, `veth`, and `netdevsim`, I'm realizing they don't even use `phylink`. And specifically, `netdevsim` isn't using `phylink` at all. This further reinforces my initial suspicion that we're dealing with code that's fundamentally hardware-dependent and therefore, potentially unreachable in a fully virtualized setting.

{
  "Expression": "phylink_create"
}

{
  "Output": "Documentation/networking/sfp-phylink.rst=74=this documentation.\n--\nDocumentation/networking/sfp-phylink.rst-363-\nDocumentation/networking/sfp-phylink.rst:364:\tphylink = phylink_create(\u0026priv-\u003ephylink_config, node, phy_mode, \u0026phylink_ops);\nDocumentation/networking/sfp-phylink.rst-365-\tif (IS_ERR(phylink)) {\n--\ndrivers/net/ethernet/altera/altera_tse_main.c=1128=static int altera_tse_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/altera/altera_tse_main.c-1415-\ndrivers/net/ethernet/altera/altera_tse_main.c:1416:\tpriv-\u003ephylink = phylink_create(\u0026priv-\u003ephylink_config,\ndrivers/net/ethernet/altera/altera_tse_main.c-1417-\t\t\t\t       of_fwnode_handle(priv-\u003edevice-\u003eof_node),\n--\ndrivers/net/ethernet/atheros/ag71xx.c=1074=static int ag71xx_phylink_setup(struct ag71xx *ag)\n--\ndrivers/net/ethernet/atheros/ag71xx.c-1108-\ndrivers/net/ethernet/atheros/ag71xx.c:1109:\tphylink = phylink_create(\u0026ag-\u003ephylink_config, ag-\u003epdev-\u003edev.fwnode,\ndrivers/net/ethernet/atheros/ag71xx.c-1110-\t\t\t\t ag-\u003ephy_if_mode, \u0026ag71xx_phylink_mac_ops);\n--\ndrivers/net/ethernet/cadence/macb_main.c=1023=static int macb_mii_probe(struct net_device *dev)\n--\ndrivers/net/ethernet/cadence/macb_main.c-1085-\ndrivers/net/ethernet/cadence/macb_main.c:1086:\tbp-\u003ephylink = phylink_create(\u0026bp-\u003ephylink_config, bp-\u003epdev-\u003edev.fwnode,\ndrivers/net/ethernet/cadence/macb_main.c-1087-\t\t\t\t     bp-\u003ephy_interface, \u0026macb_phylink_ops);\n--\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c=201=static int dpaa_netdev_init(struct net_device *net_dev,\n--\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c-274-\tmac_dev-\u003eupdate_speed = dpaa_eth_cgr_set_speed;\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c:275:\tmac_dev-\u003ephylink = phylink_create(\u0026mac_dev-\u003ephylink_config,\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c-276-\t\t\t\t\t  dev_fwnode(mac_dev-\u003edev),\n--\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c=560=int dpaa2_mac_connect(struct dpaa2_mac *mac)\n--\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c-624-\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c:625:\tphylink = phylink_create(\u0026mac-\u003ephylink_config,\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c-626-\t\t\t\t dpmac_node, mac-\u003eif_mode,\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c=971=static int enetc4_link_init(struct enetc_ndev_priv *priv,\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-989-\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:990:\terr = enetc_phylink_create(priv, node, \u0026enetc_pl_mac_ops);\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-991-\tif (err) {\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-992-\t\tdev_err(dev, \"Failed to create phylink\\n\");\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:993:\t\tgoto err_phylink_create;\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-994-\t}\n--\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-997-\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c:998:err_phylink_create:\ndrivers/net/ethernet/freescale/enetc/enetc4_pf.c-999-\tenetc_mdiobus_destroy(pf);\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c=847=static int enetc_pf_probe(struct pci_dev *pdev,\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-929-\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:930:\terr = enetc_phylink_create(priv, node, \u0026enetc_mac_phylink_ops);\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-931-\tif (err)\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:932:\t\tgoto err_phylink_create;\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-933-\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-941-\tenetc_phylink_destroy(priv);\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c:942:err_phylink_create:\ndrivers/net/ethernet/freescale/enetc/enetc_pf.c-943-\tenetc_mdiobus_destroy(pf);\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c=312=EXPORT_SYMBOL_GPL(enetc_mdiobus_destroy);\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-313-\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c:314:int enetc_phylink_create(struct enetc_ndev_priv *priv, struct device_node *node,\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-315-\t\t\t const struct phylink_mac_ops *ops)\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-337-\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c:338:\tphylink = phylink_create(\u0026pf-\u003ephylink_config, of_fwnode_handle(node),\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-339-\t\t\t\t pf-\u003eif_mode, ops);\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-348-}\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c:349:EXPORT_SYMBOL_GPL(enetc_phylink_create);\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c-350-\n--\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.h=12=void enetc_mdiobus_destroy(struct enetc_pf *pf);\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.h:13:int enetc_phylink_create(struct enetc_ndev_priv *priv, struct device_node *node,\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.h-14-\t\t\t const struct phylink_mac_ops *ops);\n--\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c=853=static int fs_enet_probe(struct platform_device *ofdev)\n--\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c-932-\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c:933:\tphylink = phylink_create(\u0026fep-\u003ephylink_config, dev_fwnode(fep-\u003edev),\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c-934-\t\t\t\t phy_mode, \u0026fs_enet_phylink_mac_ops);\n--\ndrivers/net/ethernet/freescale/ucc_geth.c=3419=static int ucc_geth_probe(struct platform_device* ofdev)\n--\ndrivers/net/ethernet/freescale/ucc_geth.c-3573-\ndrivers/net/ethernet/freescale/ucc_geth.c:3574:\tphylink = phylink_create(\u0026ugeth-\u003ephylink_config, dev_fwnode(\u0026dev-\u003edev),\ndrivers/net/ethernet/freescale/ucc_geth.c-3575-\t\t\t\t phy_interface, \u0026ugeth_mac_ops);\n--\ndrivers/net/ethernet/marvell/mvneta.c=5480=static int mvneta_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/marvell/mvneta.c-5598-\ndrivers/net/ethernet/marvell/mvneta.c:5599:\tphylink = phylink_create(\u0026pp-\u003ephylink_config, pdev-\u003edev.fwnode,\ndrivers/net/ethernet/marvell/mvneta.c-5600-\t\t\t\t phy_mode, \u0026mvneta_phylink_ops);\n--\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c=6840=static int mvpp2_port_probe(struct platform_device *pdev,\n--\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c-7147-\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c:7148:\t\tphylink = phylink_create(\u0026port-\u003ephylink_config, port_fwnode,\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c-7149-\t\t\t\t\t phy_mode, \u0026mvpp2_phylink_ops);\n--\ndrivers/net/ethernet/marvell/prestera/prestera_main.c=370=static int prestera_port_sfp_bind(struct prestera_port *port)\n--\ndrivers/net/ethernet/marvell/prestera/prestera_main.c-416-\ndrivers/net/ethernet/marvell/prestera/prestera_main.c:417:\t\tphy_link = phylink_create(\u0026port-\u003ephy_config, fwnode,\ndrivers/net/ethernet/marvell/prestera/prestera_main.c-418-\t\t\t\t\t  PHY_INTERFACE_MODE_INTERNAL,\n--\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c=4823=static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)\n--\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c-4967-\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c:4968:\tphylink = phylink_create(\u0026mac-\u003ephylink_config,\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c-4969-\t\t\t\t of_fwnode_handle(mac-\u003eof_node),\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c=746=struct net_device *fbnic_netdev_alloc(struct fbnic_dev *fbd)\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c-834-\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c:835:\tif (fbnic_phylink_create(netdev)) {\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.c-836-\t\tfree_netdev(netdev);\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h=111=int fbnic_phylink_get_fecparam(struct net_device *netdev,\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h-112-\t\t\t       struct ethtool_fecparam *fecparam);\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h:113:int fbnic_phylink_create(struct net_device *netdev);\ndrivers/net/ethernet/meta/fbnic/fbnic_netdev.h-114-void fbnic_phylink_destroy(struct net_device *netdev);\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c=177=static const struct phylink_mac_ops fbnic_phylink_mac_ops = {\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-186-/**\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c:187: * fbnic_phylink_create - Phylink device creation\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-188- * @netdev: Network Device struct to attach phylink device\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-196- **/\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c:197:int fbnic_phylink_create(struct net_device *netdev)\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-198-{\n--\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-231-\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c:232:\tphylink = phylink_create(\u0026fbn-\u003ephylink_config, NULL,\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c-233-\t\t\t\t fbnic_phylink_select_interface(fbn-\u003eaui),\n--\ndrivers/net/ethernet/microchip/lan743x_main.c=3142=static const struct phylink_mac_ops lan743x_phylink_mac_ops = {\n--\ndrivers/net/ethernet/microchip/lan743x_main.c-3149-\ndrivers/net/ethernet/microchip/lan743x_main.c:3150:static int lan743x_phylink_create(struct lan743x_adapter *adapter)\ndrivers/net/ethernet/microchip/lan743x_main.c-3151-{\n--\ndrivers/net/ethernet/microchip/lan743x_main.c-3192-\ndrivers/net/ethernet/microchip/lan743x_main.c:3193:\tpl = phylink_create(\u0026adapter-\u003ephylink_config, NULL,\ndrivers/net/ethernet/microchip/lan743x_main.c-3194-\t\t\t    adapter-\u003ephy_interface, \u0026lan743x_phylink_mac_ops);\n--\ndrivers/net/ethernet/microchip/lan743x_main.c=3664=static int lan743x_pcidev_probe(struct pci_dev *pdev,\n--\ndrivers/net/ethernet/microchip/lan743x_main.c-3723-\ndrivers/net/ethernet/microchip/lan743x_main.c:3724:\tret = lan743x_phylink_create(adapter);\ndrivers/net/ethernet/microchip/lan743x_main.c-3725-\tif (ret \u003c 0) {\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c=791=static int lan966x_probe_port(struct lan966x *lan966x, u32 p,\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c-855-\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c:856:\tphylink = phylink_create(\u0026port-\u003ephylink_config,\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c-857-\t\t\t\t portnp,\n--\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c=312=static int sparx5_create_port(struct sparx5 *sparx5,\n--\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c-388-\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c:389:\tphylink = phylink_create(\u0026spx5_port-\u003ephylink_config,\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c-390-\t\t\t\t of_fwnode_handle(config-\u003enode),\n--\ndrivers/net/ethernet/mscc/ocelot_net.c=1774=static const struct phylink_mac_ops ocelot_phylink_ops = {\n--\ndrivers/net/ethernet/mscc/ocelot_net.c-1779-\ndrivers/net/ethernet/mscc/ocelot_net.c:1780:static int ocelot_port_phylink_create(struct ocelot *ocelot, int port,\ndrivers/net/ethernet/mscc/ocelot_net.c-1781-\t\t\t\t      struct device_node *portnp)\n--\ndrivers/net/ethernet/mscc/ocelot_net.c-1820-\ndrivers/net/ethernet/mscc/ocelot_net.c:1821:\tphylink = phylink_create(\u0026priv-\u003ephylink_config,\ndrivers/net/ethernet/mscc/ocelot_net.c-1822-\t\t\t\t of_fwnode_handle(portnp),\n--\ndrivers/net/ethernet/mscc/ocelot_net.c=1843=int ocelot_probe_port(struct ocelot *ocelot, int port, struct regmap *target,\n--\ndrivers/net/ethernet/mscc/ocelot_net.c-1879-\ndrivers/net/ethernet/mscc/ocelot_net.c:1880:\terr = ocelot_port_phylink_create(ocelot, port, portnp);\ndrivers/net/ethernet/mscc/ocelot_net.c-1881-\tif (err)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c=1370=static int stmmac_phylink_setup(struct stmmac_priv *priv)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-1461-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1462:\tphylink = phylink_create(config, dev_fwnode(priv-\u003edevice),\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-1463-\t\t\t\t priv-\u003eplat-\u003ephy_interface,\n--\ndrivers/net/ethernet/tehuti/tn40_phy.c=45=int tn40_phy_register(struct tn40_priv *priv)\n--\ndrivers/net/ethernet/tehuti/tn40_phy.c-62-\ndrivers/net/ethernet/tehuti/tn40_phy.c:63:\tphylink = phylink_create(config, NULL, PHY_INTERFACE_MODE_XAUI,\ndrivers/net/ethernet/tehuti/tn40_phy.c-64-\t\t\t\t \u0026tn40_mac_ops);\n--\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c=2757=am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx)\n--\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c-2841-\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c:2842:\tphylink = phylink_create(\u0026port-\u003eslave.phylink_config,\ndrivers/net/ethernet/ti/am65-cpsw-nuss.c-2843-\t\t\t\t of_fwnode_handle(port-\u003eslave.port_np),\n--\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c=130=static int ngbe_phylink_init(struct wx *wx)\n--\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c-149-\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c:150:\tphylink = phylink_create(config, NULL, phy_mode, \u0026ngbe_mac_ops);\ndrivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c-151-\tif (IS_ERR(phylink))\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c=482=int txgbe_phylink_init_aml(struct txgbe *txgbe)\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c-512-\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c:513:\tphylink = phylink_create(config, NULL, phy_mode, \u0026txgbe_mac_ops_aml);\ndrivers/net/ethernet/wangxun/txgbe/txgbe_aml.c-514-\tif (IS_ERR(phylink))\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c=268=static int txgbe_phylink_init(struct txgbe *txgbe)\n--\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c-292-\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:293:\tphylink = phylink_create(config, fwnode, phy_mode, \u0026txgbe_mac_ops);\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c-294-\tif (IS_ERR(phylink))\n--\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c=2795=static int axienet_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3117-\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c:3118:\tlp-\u003ephylink = phylink_create(\u0026lp-\u003ephylink_config, pdev-\u003edev.fwnode,\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3119-\t\t\t\t     lp-\u003ephy_mode,\n--\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3122-\t\tret = PTR_ERR(lp-\u003ephylink);\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c:3123:\t\tdev_err(\u0026pdev-\u003edev, \"phylink_create error (%i)\\n\", ret);\ndrivers/net/ethernet/xilinx/xilinx_axienet_main.c-3124-\t\tgoto cleanup_mdio;\n--\ndrivers/net/phy/phylink.c=516=static int phylink_validate_mac_and_pcs(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-531-\tif (pcs) {\ndrivers/net/phy/phylink.c:532:\t\t/* The PCS, if present, must be setup before phylink_create()\ndrivers/net/phy/phylink.c-533-\t\t * has been called. If the ops is not initialised, print an\n--\ndrivers/net/phy/phylink.c=1039=static enum inband_type phylink_get_inband_type(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-1071- * phylink_pcs_neg_mode() - helper to determine PCS inband mode\ndrivers/net/phy/phylink.c:1072: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1073- * @pcs: a pointer to \u0026struct phylink_pcs\n--\ndrivers/net/phy/phylink.c=1769=static int phylink_register_sfp(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-1793- * phylink_set_fixed_link() - set the fixed link\ndrivers/net/phy/phylink.c:1794: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1795- * @state: a pointer to a struct phylink_link_state.\n--\ndrivers/net/phy/phylink.c=1831=EXPORT_SYMBOL_GPL(phylink_set_fixed_link);\n--\ndrivers/net/phy/phylink.c-1833-/**\ndrivers/net/phy/phylink.c:1834: * phylink_create() - create a phylink instance\ndrivers/net/phy/phylink.c-1835- * @config: a pointer to the target \u0026struct phylink_config\n--\ndrivers/net/phy/phylink.c-1848- */\ndrivers/net/phy/phylink.c:1849:struct phylink *phylink_create(struct phylink_config *config,\ndrivers/net/phy/phylink.c-1850-\t\t\t       const struct fwnode_handle *fwnode,\n--\ndrivers/net/phy/phylink.c-1936-}\ndrivers/net/phy/phylink.c:1937:EXPORT_SYMBOL_GPL(phylink_create);\ndrivers/net/phy/phylink.c-1938-\n--\ndrivers/net/phy/phylink.c-1940- * phylink_destroy() - cleanup and destroy the phylink instance\ndrivers/net/phy/phylink.c:1941: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1942- *\n--\ndrivers/net/phy/phylink.c=1957=EXPORT_SYMBOL_GPL(phylink_destroy);\n--\ndrivers/net/phy/phylink.c-1960- * phylink_expects_phy() - Determine if phylink expects a phy to be attached\ndrivers/net/phy/phylink.c:1961: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-1962- *\n--\ndrivers/net/phy/phylink.c=2206=static int phylink_attach_phy(struct phylink *pl, struct phy_device *phy,\n--\ndrivers/net/phy/phylink.c-2226- * phylink_connect_phy() - connect a PHY to the phylink instance\ndrivers/net/phy/phylink.c:2227: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2228- * @phy: a pointer to a \u0026struct phy_device.\n--\ndrivers/net/phy/phylink.c=2260=EXPORT_SYMBOL_GPL(phylink_connect_phy);\n--\ndrivers/net/phy/phylink.c-2263- * phylink_of_phy_connect() - connect the PHY specified in the DT mode.\ndrivers/net/phy/phylink.c:2264: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2265- * @dn: a pointer to a \u0026struct device_node.\n--\ndrivers/net/phy/phylink.c=2279=EXPORT_SYMBOL_GPL(phylink_of_phy_connect);\n--\ndrivers/net/phy/phylink.c-2282- * phylink_fwnode_phy_connect() - connect the PHY specified in the fwnode.\ndrivers/net/phy/phylink.c:2283: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2284- * @fwnode: a pointer to a \u0026struct fwnode_handle.\n--\ndrivers/net/phy/phylink.c=2338=EXPORT_SYMBOL_GPL(phylink_fwnode_phy_connect);\n--\ndrivers/net/phy/phylink.c-2342- *   instance.\ndrivers/net/phy/phylink.c:2343: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2344- *\n--\ndrivers/net/phy/phylink.c=2373=static void phylink_link_changed(struct phylink *pl, bool up, const char *what)\n--\ndrivers/net/phy/phylink.c-2382- * phylink_mac_change() - notify phylink of a change in MAC state\ndrivers/net/phy/phylink.c:2383: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2384- * @up: indicates whether the link is currently up.\n--\ndrivers/net/phy/phylink.c=2415=static irqreturn_t phylink_link_handler(int irq, void *data)\n--\ndrivers/net/phy/phylink.c-2425- * phylink_start() - start a phylink instance\ndrivers/net/phy/phylink.c:2426: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2427- *\n--\ndrivers/net/phy/phylink.c=2488=EXPORT_SYMBOL_GPL(phylink_start);\n--\ndrivers/net/phy/phylink.c-2491- * phylink_stop() - stop a phylink instance\ndrivers/net/phy/phylink.c:2492: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2493- *\n--\ndrivers/net/phy/phylink.c=2522=EXPORT_SYMBOL_GPL(phylink_stop);\n--\ndrivers/net/phy/phylink.c-2525- * phylink_rx_clk_stop_block() - block PHY ability to stop receive clock in LPI\ndrivers/net/phy/phylink.c:2526: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2527- *\n--\ndrivers/net/phy/phylink.c=2551=EXPORT_SYMBOL_GPL(phylink_rx_clk_stop_block);\n--\ndrivers/net/phy/phylink.c-2554- * phylink_rx_clk_stop_unblock() - unblock PHY ability to stop receive clock\ndrivers/net/phy/phylink.c:2555: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2556- *\n--\ndrivers/net/phy/phylink.c=2593=static bool phylink_phy_pm_speed_ctrl(struct phylink *pl)\n--\ndrivers/net/phy/phylink.c-2600- * phylink_suspend() - handle a network device suspend event\ndrivers/net/phy/phylink.c:2601: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2602- * @mac_wol: true if the MAC needs to receive packets for Wake-on-Lan\n--\ndrivers/net/phy/phylink.c=2652=EXPORT_SYMBOL_GPL(phylink_suspend);\n--\ndrivers/net/phy/phylink.c-2655- * phylink_prepare_resume() - prepare to resume a network device\ndrivers/net/phy/phylink.c:2656: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2657- *\n--\ndrivers/net/phy/phylink.c=2677=EXPORT_SYMBOL_GPL(phylink_prepare_resume);\n--\ndrivers/net/phy/phylink.c-2680- * phylink_resume() - handle a network device resume event\ndrivers/net/phy/phylink.c:2681: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2682- *\n--\ndrivers/net/phy/phylink.c=2720=EXPORT_SYMBOL_GPL(phylink_resume);\n--\ndrivers/net/phy/phylink.c-2723- * phylink_ethtool_get_wol() - get the wake on lan parameters for the PHY\ndrivers/net/phy/phylink.c:2724: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2725- * @wol: a pointer to \u0026struct ethtool_wolinfo to hold the read parameters\n--\ndrivers/net/phy/phylink.c=2757=EXPORT_SYMBOL_GPL(phylink_ethtool_get_wol);\n--\ndrivers/net/phy/phylink.c-2760- * phylink_ethtool_set_wol() - set wake on lan parameters\ndrivers/net/phy/phylink.c:2761: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2762- * @wol: a pointer to \u0026struct ethtool_wolinfo for the desired parameters\n--\ndrivers/net/phy/phylink.c=2889=static void phylink_get_ksettings(const struct phylink_link_state *state,\n--\ndrivers/net/phy/phylink.c-2904- * phylink_ethtool_ksettings_get() - get the current link settings\ndrivers/net/phy/phylink.c:2905: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2906- * @kset: a pointer to a \u0026struct ethtool_link_ksettings to hold link settings\n--\ndrivers/net/phy/phylink.c=2957=static bool phylink_validate_pcs_inband_autoneg(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-2978- * phylink_ethtool_ksettings_set() - set the link settings\ndrivers/net/phy/phylink.c:2979: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-2980- * @kset: a pointer to a \u0026struct ethtool_link_ksettings for the desired modes\n--\ndrivers/net/phy/phylink.c=3145=EXPORT_SYMBOL_GPL(phylink_ethtool_ksettings_set);\n--\ndrivers/net/phy/phylink.c-3148- * phylink_ethtool_nway_reset() - restart negotiation\ndrivers/net/phy/phylink.c:3149: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3150- *\n--\ndrivers/net/phy/phylink.c=3170=EXPORT_SYMBOL_GPL(phylink_ethtool_nway_reset);\n--\ndrivers/net/phy/phylink.c-3173- * phylink_ethtool_get_pauseparam() - get the current pause parameters\ndrivers/net/phy/phylink.c:3174: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3175- * @pause: a pointer to a \u0026struct ethtool_pauseparam\n--\ndrivers/net/phy/phylink.c=3186=EXPORT_SYMBOL_GPL(phylink_ethtool_get_pauseparam);\n--\ndrivers/net/phy/phylink.c-3189- * phylink_ethtool_set_pauseparam() - set the current pause parameters\ndrivers/net/phy/phylink.c:3190: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3191- * @pause: a pointer to a \u0026struct ethtool_pauseparam\n--\ndrivers/net/phy/phylink.c=3272=EXPORT_SYMBOL_GPL(phylink_ethtool_set_pauseparam);\n--\ndrivers/net/phy/phylink.c-3276- *   counter\ndrivers/net/phy/phylink.c:3277: * @pl: a pointer to a \u0026struct phylink returned from phylink_create().\ndrivers/net/phy/phylink.c-3278- *\n--\ndrivers/net/phy/phylink.c=3295=EXPORT_SYMBOL_GPL(phylink_get_eee_err);\n--\ndrivers/net/phy/phylink.c-3298- * phylink_ethtool_get_eee() - read the energy efficient ethernet parameters\ndrivers/net/phy/phylink.c:3299: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3300- * @eee: a pointer to a \u0026struct ethtool_keee for the read parameters\n--\ndrivers/net/phy/phylink.c=3321=EXPORT_SYMBOL_GPL(phylink_ethtool_get_eee);\n--\ndrivers/net/phy/phylink.c-3324- * phylink_ethtool_set_eee() - set the energy efficient ethernet parameters\ndrivers/net/phy/phylink.c:3325: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3326- * @eee: a pointer to a \u0026struct ethtool_keee for the desired parameters\n--\ndrivers/net/phy/phylink.c=3495=static int phylink_mii_write(struct phylink *pl, unsigned int phy_id,\n--\ndrivers/net/phy/phylink.c-3513- * phylink_mii_ioctl() - generic mii ioctl interface\ndrivers/net/phy/phylink.c:3514: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3515- * @ifr: a pointer to a \u0026struct ifreq for socket ioctls\n--\ndrivers/net/phy/phylink.c=3588=EXPORT_SYMBOL_GPL(phylink_mii_ioctl);\n--\ndrivers/net/phy/phylink.c-3592- *   link partners\ndrivers/net/phy/phylink.c:3593: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3594- * @sync: perform action synchronously\n--\ndrivers/net/phy/phylink.c=3613=EXPORT_SYMBOL_GPL(phylink_speed_down);\n--\ndrivers/net/phy/phylink.c-3617- *   phylink_speed_down()\ndrivers/net/phy/phylink.c:3618: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-3619- *\n--\ndrivers/net/phy/phylink.c=4372=EXPORT_SYMBOL_GPL(phylink_mii_c45_pcs_get_state);\n--\ndrivers/net/phy/phylink.c-4376- *\t\t\t\t which loses state\ndrivers/net/phy/phylink.c:4377: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-4378- *\n--\ndrivers/net/phy/phylink.c=4393=EXPORT_SYMBOL_GPL(phylink_replay_link_begin);\n--\ndrivers/net/phy/phylink.c-4397- *\t\t\t       which lost state\ndrivers/net/phy/phylink.c:4398: * @pl: a pointer to a \u0026struct phylink returned from phylink_create()\ndrivers/net/phy/phylink.c-4399- *\n--\ndrivers/net/usb/asix_devices.c=799=static int ax88772_phylink_setup(struct usbnet *dev)\n--\ndrivers/net/usb/asix_devices.c-819-\ndrivers/net/usb/asix_devices.c:820:\tphylink = phylink_create(\u0026priv-\u003ephylink_config, dev-\u003enet-\u003edev.fwnode,\ndrivers/net/usb/asix_devices.c-821-\t\t\t\t phy_if_mode, \u0026ax88772_phylink_mac_ops);\n--\ndrivers/net/usb/lan78xx.c=2799=static int lan78xx_phylink_setup(struct lan78xx_net *dev)\n--\ndrivers/net/usb/lan78xx.c-2838-\ndrivers/net/usb/lan78xx.c:2839:\tphylink = phylink_create(pc, dev-\u003enet-\u003edev.fwnode,\ndrivers/net/usb/lan78xx.c-2840-\t\t\t\t dev-\u003einterface, \u0026lan78xx_phylink_mac_ops);\n--\ninclude/linux/phylink.h=718=int pcs_pre_init(struct phylink_pcs *pcs);\n--\ninclude/linux/phylink.h-721-\ninclude/linux/phylink.h:722:struct phylink *phylink_create(struct phylink_config *,\ninclude/linux/phylink.h-723-\t\t\t       const struct fwnode_handle *,\n--\nnet/dsa/port.c=1611=static const struct phylink_mac_ops dsa_port_phylink_mac_ops = {\n--\nnet/dsa/port.c-1616-\nnet/dsa/port.c:1617:int dsa_port_phylink_create(struct dsa_port *dp)\nnet/dsa/port.c-1618-{\n--\nnet/dsa/port.c-1646-\nnet/dsa/port.c:1647:\tpl = phylink_create(\u0026dp-\u003epl_config, of_fwnode_handle(dp-\u003edn), mode,\nnet/dsa/port.c-1648-\t\t\t    mac_ops);\n--\nnet/dsa/port.c=1665=static int dsa_shared_port_phylink_register(struct dsa_port *dp)\n--\nnet/dsa/port.c-1673-\nnet/dsa/port.c:1674:\terr = dsa_port_phylink_create(dp);\nnet/dsa/port.c-1675-\tif (err)\n--\nnet/dsa/port.h=100=int dsa_port_mrp_del_ring_role(const struct dsa_port *dp,\nnet/dsa/port.h-101-\t\t\t       const struct switchdev_obj_ring_role_mrp *mrp);\nnet/dsa/port.h:102:int dsa_port_phylink_create(struct dsa_port *dp);\nnet/dsa/port.h-103-void dsa_port_phylink_destroy(struct dsa_port *dp);\n--\nnet/dsa/user.c=2654=static int dsa_user_phy_setup(struct net_device *user_dev)\n--\nnet/dsa/user.c-2673-\nnet/dsa/user.c:2674:\tret = dsa_port_phylink_create(dp);\nnet/dsa/user.c-2675-\tif (ret)\n"
}

gemini-3.1-pro-preview

null

null

							input: 35129
							output: 28
							thoughts: 531
						

**Analyzing the Reachability of `PHY_INTERFACE_MODE_PSGMII` Code Path**

Okay, so I'm looking at this `PHY_INTERFACE_MODE_PSGMII` case and it's flagged as a concern. It seems this mode is *only* used within the `qca807x.c` PHY driver. The interesting part is that `phylink_mii_c22_pcs_decode_state` and `phylink_mii_c22_pcs_encode_advertisement` are exported functions, and I need to determine if there's any way a user, or a virtualized environment, can actually trigger this.

My initial thought is, could a virtual driver potentially call these? But, no, no virtual driver *directly* calls these functions. Could a user somehow trigger this code path? Perhaps if a user were to construct a dummy MDIO bus, register a `qca807x` PHY on it, and then connect this to a MAC driver that utilizes `phylink`, like the `lan78xx` USB driver? But then, hang on, the `lan78xx` driver *hardcodes* `PHY_INTERFACE_MODE_GMII`. And the `ax88772` driver, too, just hardcodes either `PHY_INTERFACE_MODE_MII` or `PHY_INTERFACE_MODE_RMII`. This is a dead end. In other words, these drivers will never allow the `PHY_INTERFACE_MODE_PSGMII` case to be hit.

Okay, so what about *other* drivers? Is there even *any* driver that allows setting `phy_interface_t` from userspace? No, not typically. This interface setting is usually determined by firmware (DT/ACPI) or it's hardcoded within the driver itself.

In a virtualized setting like QEMU or GCE, it gets even trickier. We generally don't have Device Tree (DT) nodes for arbitrary MACs, unless we're using device tree overlays, which syzkaller (which I'm assuming is the test framework being used) doesn't typically employ by default, right? Or *does* syzkaller use those overlays? (It's configurable, but I don't think it's the standard practice.)

Wait, I need to consider `netlink`. Syzkaller *can* use `netlink` to create virtual links. But, I know `phylink` isn't used by the usual suspects like `veth`, `macvlan`, `ipvlan`, or `tun`. That means the *only* plausible way to reach `phylink` is through USB drivers like `lan78xx` or `asix`. And, again, those drivers *hardcode* the interface mode.

So, the conclusion I'm leaning toward is that this `PHY_INTERFACE_MODE_PSGMII` case in the switch statements is virtually impossible to reach in the virtualized testing environments.

Let me just double-check one thing: Does the `interface` parameter, is it even passed to the `phylink_mii_c22_pcs_decode_state` function? Hmm. No, the `interface` is *not* passed. Okay, time to re-examine that patch again.

{
  "Expression": "phylink_mii_c22_pcs_decode_state"
}

{
  "Output": "drivers/net/dsa/mxl862xx/mxl862xx-phylink.c=213=static void mxl862xx_pcs_get_state(struct phylink_pcs *pcs,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-phylink.c-257-\t\t       (state-\u003ean_complete ? BMSR_ANEGCOMPLETE : 0);\ndrivers/net/dsa/mxl862xx/mxl862xx-phylink.c:258:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr,\ndrivers/net/dsa/mxl862xx/mxl862xx-phylink.c-259-\t\t\t\t\t\t le16_to_cpu(st.lpa.cl37));\n--\ndrivers/net/ethernet/cadence/macb_main.c=573=static void macb_pcs_get_state(struct phylink_pcs *pcs, unsigned int neg_mode,\n--\ndrivers/net/ethernet/cadence/macb_main.c-580-\tlpa = gem_readl(bp, PCSANLPBASE);\ndrivers/net/ethernet/cadence/macb_main.c:581:\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lpa);\ndrivers/net/ethernet/cadence/macb_main.c-582-}\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c=287=void lan966x_port_status_get(struct lan966x_port *port, unsigned int neg_mode,\n--\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c-316-\t\tlp_adv = DEV_PCS1G_ANEG_STATUS_LP_ADV_GET(val);\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c:317:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lp_adv);\ndrivers/net/ethernet/microchip/lan966x/lan966x_port.c-318-\t} else {\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c=66=static void dwmac_integrated_pcs_get_state(struct phylink_pcs *pcs,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c-83-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c:84:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, status, lpa);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pcs.c-85-\t} else {\n--\ndrivers/net/pcs/pcs-mtk-lynxi.c=108=static void mtk_pcs_lynxi_get_state(struct phylink_pcs *pcs,\n--\ndrivers/net/pcs/pcs-mtk-lynxi.c-118-\ndrivers/net/pcs/pcs-mtk-lynxi.c:119:\tphylink_mii_c22_pcs_decode_state(state, neg_mode,\ndrivers/net/pcs/pcs-mtk-lynxi.c-120-\t\t\t\t\t FIELD_GET(SGMII_BMSR, bm),\n--\ndrivers/net/pcs/pcs-xpcs.c=1103=static int xpcs_get_state_c37_1000basex(struct dw_xpcs *xpcs,\n--\ndrivers/net/pcs/pcs-xpcs.c-1132-\ndrivers/net/pcs/pcs-xpcs.c:1133:\t\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lpa);\ndrivers/net/pcs/pcs-xpcs.c-1134-\t}\n--\ndrivers/net/phy/phylink.c=4116=static void phylink_decode_usgmii_word(struct phylink_link_state *state,\n--\ndrivers/net/phy/phylink.c-4140-/**\ndrivers/net/phy/phylink.c:4141: * phylink_mii_c22_pcs_decode_state() - Decode MAC PCS state from MII registers\ndrivers/net/phy/phylink.c-4142- * @state: a pointer to a \u0026struct phylink_link_state.\n--\ndrivers/net/phy/phylink.c-4154- */\ndrivers/net/phy/phylink.c:4155:void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\ndrivers/net/phy/phylink.c-4156-\t\t\t\t      unsigned int neg_mode, u16 bmsr, u16 lpa)\n--\ndrivers/net/phy/phylink.c-4202-}\ndrivers/net/phy/phylink.c:4203:EXPORT_SYMBOL_GPL(phylink_mii_c22_pcs_decode_state);\ndrivers/net/phy/phylink.c-4204-\n--\ndrivers/net/phy/phylink.c=4220=void phylink_mii_c22_pcs_get_state(struct mdio_device *pcs,\n--\ndrivers/net/phy/phylink.c-4232-\ndrivers/net/phy/phylink.c:4233:\tphylink_mii_c22_pcs_decode_state(state, neg_mode, bmsr, lpa);\ndrivers/net/phy/phylink.c-4234-}\n--\ninclude/linux/phylink.h=816=static inline bool phylink_mac_implements_lpi(const struct phylink_mac_ops *ops)\n--\ninclude/linux/phylink.h-820-\ninclude/linux/phylink.h:821:void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\ninclude/linux/phylink.h-822-\t\t\t\t      unsigned int neg_mode, u16 bmsr, u16 lpa);\n"
}

gemini-3.1-pro-preview

null

null

							input: 38016
							output: 23
							thoughts: 163
						

**Decoding the PSGMII Puzzle**

Okay, so I'm looking at this `phylink_mii_c22_pcs_decode_state` function, and it's taking a `struct phylink_link_state *state`. Right, makes sense. Now, diving in, there's a `switch` statement based on `state->interface`. That's the key. So, the code path we're concerned with is triggered when `state->interface` is equal to `PHY_INTERFACE_MODE_PSGMII`. Got it.

Now, the important question is: where does `state->interface` get set? I know the phylink core is responsible for that. It determines the interface mode based on the hardware capabilities and the system configuration. Therefore `state->interface` is going to be set to `PHY_INTERFACE_MODE_PSGMII` *only* if the underlying hardware actually *supports* PSGMII and it's explicitly configured to use it.

Right, now, I seem to remember that the `qca807x.c` driver is the only one I've seen that *explicitly* uses `PHY_INTERFACE_MODE_PSGMII`. But let's be thorough, you can never be too careful. I should probably just quickly double-check that, just to make sure my assumption is correct. It's always a good idea to verify.

{
  "Expression": "PHY_INTERFACE_MODE_PSGMII"
}

{
  "Output": "Documentation/networking/phy.rst=238=Some of the interface modes are described below:\n--\nDocumentation/networking/phy.rst-325-\nDocumentation/networking/phy.rst:326:``PHY_INTERFACE_MODE_PSGMII``\nDocumentation/networking/phy.rst-327-    This is the Penta SGMII mode, it is similar to QSGMII but it combines 5\n--\ndrivers/net/phy/phy-core.c=159=int phy_interface_num_ports(phy_interface_t interface)\n--\ndrivers/net/phy/phy-core.c-201-\t\treturn 4;\ndrivers/net/phy/phy-core.c:202:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phy-core.c-203-\t\treturn 5;\n--\ndrivers/net/phy/phy_caps.c=294=unsigned long phy_caps_from_interface(phy_interface_t interface)\n--\ndrivers/net/phy/phy_caps.c-310-\tcase PHY_INTERFACE_MODE_RGMII:\ndrivers/net/phy/phy_caps.c:311:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phy_caps.c-312-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=238=static int phylink_interface_max_speed(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-259-\tcase PHY_INTERFACE_MODE_RGMII:\ndrivers/net/phy/phylink.c:260:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-261-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=774=static int phylink_parse_mode(struct phylink *pl,\n--\ndrivers/net/phy/phylink.c-808-\t\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:809:\t\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-810-\t\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=1039=static enum inband_type phylink_get_inband_type(phy_interface_t interface)\n--\ndrivers/net/phy/phylink.c-1042-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:1043:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-1044-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=4155=void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,\n--\ndrivers/net/phy/phylink.c-4186-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:4187:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-4188-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/phylink.c=4251=int phylink_mii_c22_pcs_encode_advertisement(phy_interface_t interface,\n--\ndrivers/net/phy/phylink.c-4267-\tcase PHY_INTERFACE_MODE_SGMII:\ndrivers/net/phy/phylink.c:4268:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/phylink.c-4269-\tcase PHY_INTERFACE_MODE_QSGMII:\n--\ndrivers/net/phy/qcom/qca807x.c=490=static int qca807x_phy_package_probe_once(struct phy_device *phydev)\n--\ndrivers/net/phy/qcom/qca807x.c-549-\t\tif (!strcasecmp(package_mode_name,\ndrivers/net/phy/qcom/qca807x.c:550:\t\t\t\tphy_modes(PHY_INTERFACE_MODE_PSGMII)))\ndrivers/net/phy/qcom/qca807x.c:551:\t\t\tpriv-\u003epackage_mode = PHY_INTERFACE_MODE_PSGMII;\ndrivers/net/phy/qcom/qca807x.c-552-\t\telse if (!strcasecmp(package_mode_name,\n--\ndrivers/net/phy/qcom/qca807x.c=562=static int qca807x_phy_package_config_init_once(struct phy_device *phydev)\n--\ndrivers/net/phy/qcom/qca807x.c-585-\t\tbreak;\ndrivers/net/phy/qcom/qca807x.c:586:\tcase PHY_INTERFACE_MODE_PSGMII:\ndrivers/net/phy/qcom/qca807x.c-587-\tdefault:\n--\ninclude/linux/phy.h=53=extern const int phy_basic_ports_array[3];\n--\ninclude/linux/phy.h-89- * @PHY_INTERFACE_MODE_MOCA: Multimedia over Coax\ninclude/linux/phy.h:90: * @PHY_INTERFACE_MODE_PSGMII: Penta SGMII\ninclude/linux/phy.h-91- * @PHY_INTERFACE_MODE_QSGMII: Quad SGMII\n--\ninclude/linux/phy.h=114=typedef enum {\n--\ninclude/linux/phy.h-132-\tPHY_INTERFACE_MODE_MOCA,\ninclude/linux/phy.h:133:\tPHY_INTERFACE_MODE_PSGMII,\ninclude/linux/phy.h-134-\tPHY_INTERFACE_MODE_QSGMII,\n--\ninclude/linux/phy.h=210=static inline const char *phy_modes(phy_interface_t interface)\n--\ninclude/linux/phy.h-248-\t\treturn \"moca\";\ninclude/linux/phy.h:249:\tcase PHY_INTERFACE_MODE_PSGMII:\ninclude/linux/phy.h-250-\t\treturn \"psgmii\";\n--\ninclude/linux/phylink.h=790=static inline int phylink_get_link_timer_ns(phy_interface_t interface)\n--\ninclude/linux/phylink.h-793-\tcase PHY_INTERFACE_MODE_SGMII:\ninclude/linux/phylink.h:794:\tcase PHY_INTERFACE_MODE_PSGMII:\ninclude/linux/phylink.h-795-\tcase PHY_INTERFACE_MODE_QSGMII:\n"
}

gemini-3.1-pro-preview

null

null

							input: 40245
							output: 23
							thoughts: 310
						

**Analyzing the `PHY_INTERFACE_MODE_PSGMII` Usage**

Okay, so I'm looking at this `qca807x.c` code, and it seems to be the *only* place where `PHY_INTERFACE_MODE_PSGMII` is being used. That's a starting point. Now, the next question is how this value can even be set, can it be manipulated?

Hmm, can `PHY_INTERFACE_MODE_PSGMII` be set through netlink? I don't think so, and I should really verify if `phy_modes` are parseable from userspace. Let's see... the code utilizes `phylink_parse_mode`, but that's driven by the device tree, right? It's not a run-time configuration, so can I create a virtual network device and somehow force its PHY mode to `PSGMII`? I don't think that's possible. There isn't any netlink API to directly set the `phy_interface_t` for a `net_device`. That's usually hardcoded or coming from the device tree.

Alright, but what about `ethtool`? Can it manipulate any of these link parameters? Not directly, it seems like `ethtool` can't set the PHY interface mode, like the difference between SGMII, RGMII, or PSGMII.

So, the only way this code using `PHY_INTERFACE_MODE_PSGMII` is even going to be reached, is if a device is probed with that specific mode set. Since `qca807x` is a *physical* PHY chip, it's not going to show up in a virtual environment unless I craft a dummy MDIO bus and register this PHY on it. Now, that's possible, but even if that worked, remember `qca807x` is just a PHY *driver*. The MAC driver, which utilizes `phylink`, *also* has to be set to use `PHY_INTERFACE_MODE_PSGMII`. That's the real challenge. Is there even a MAC driver that supports `PHY_INTERFACE_MODE_PSGMII`? That's what I need to determine. I need to dig into the MAC drivers and see if any even *support* this specific interface mode.

You are repeating the same tool call with the exact same arguments.
You already have the result of this exact tool call in your conversation history.
Do NOT request it again. You MUST synthesize the information you already have,
try a completely different tool, or proceed to the next step.

{
  "Expression": "PHY_INTERFACE_MODE_PSGMII"
}

{
  "error": "You are repeating the same tool call with the exact same arguments.\nYou already have the result of this exact tool call in your conversation history.\nDo NOT request it again. You MUST synthesize the information you already have,\ntry a completely different tool, or proceed to the next step."
}

gemini-3.1-pro-preview

null

null

							input: 41213
							output: 191
							thoughts: 766
						

**My Assessment: WorthFuzzing = False**

Okay, so I've just been looking into whether or not a patch related to `PHY_INTERFACE_MODE_PSGMII` is worth fuzzing. My initial scan using `grep` quickly showed that this particular interface mode is only mentioned in documentation, phy core files, and a few PHY driver files, namely the `qca807x` driver, but it doesn't appear in any MAC driver implementations. That's a key observation.

My immediate thought was, could some MAC drivers *indirectly* support it, perhaps by passing interface mode information through Device Tree (DT)? And, perhaps a MAC driver could utilize phylink. However, given that this interface is not explicitly mentioned by any MAC driver, and especially given the context of virtualized environments where DT isn't generally available for MACs, I've concluded this code path is unreachable in QEMU or GCE.

I double-checked to see if virtual drivers like `netdevsim`, `dummy`, or `veth` might leverage `phylink`, but none of them do. Even the virtual-ish USB drivers, like `asix` and `lan78xx`, which *do* use `phylink`, explicitly hardcode their interface modes to more standard types like MII, RMII, or GMII. This confirms that `PHY_INTERFACE_MODE_PSGMII` won't ever be seen by `phylink_mii_c22_pcs_decode_state`, `phylink_get_inband_type`, `phylink_mii_c22_pcs_encode_advertisement`, or `phylink_get_link_timer_ns` within a virtualized setting.

Essentially, `PHY_INTERFACE_MODE_PSGMII` is tied to a specific physical PHY (the `qca807x`), and nothing emulated or virtual touches it. Since the prompt states I should return "WorthFuzzing=false" if the patch only adds unreachable code paths in virtualized environments, I'm confident in saying that the new code paths introduced by this patch are, in fact, unreachable.

My reasoning is straightforward: The patch introduces support for `PHY_INTERFACE_MODE_PSGMII` within `phylink`. However, this interface mode is specific to the QCA807x PHY, with no MAC drivers explicitly supporting it (or passing it from DT). Furthermore, virtual network drivers and software-emulated USB ethernet adapters hardcode standard interface modes. Therefore, this code path is impossible to reach in virtualized environments like QEMU or GCE.

I'll proceed to set the results to `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch adds support for PHY_INTERFACE_MODE_PSGMII (Penta SGMII) to several switch statements in the phylink core. This is a hardware-specific PHY interface mode. A search of the kernel tree reveals that PHY_INTERFACE_MODE_PSGMII is only referenced by the qca807x physical PHY driver, and no MAC drivers explicitly support it. Furthermore, virtual network drivers and software-emulated USB ethernet adapters (which use phylink) hardcode their interface modes to standard ones like MII, RMII, or GMII. Since this interface mode cannot be configured from userspace and is not used by any emulated hardware, the newly added code paths are impossible to reach in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds support for PHY_INTERFACE_MODE_PSGMII (Penta SGMII) to several switch statements in the phylink core. This is a hardware-specific PHY interface mode. A search of the kernel tree reveals that PHY_INTERFACE_MODE_PSGMII is only referenced by the qca807x physical PHY driver, and no MAC drivers explicitly support it. Furthermore, virtual network drivers and software-emulated USB ethernet adapters (which use phylink) hardcode their interface modes to standard ones like MII, RMII, or GMII. Since this interface mode cannot be configured from userspace and is not used by any emulated hardware, the newly added code paths are impossible to reach in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null