| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/07 01:52 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies MAINTAINERS, the MediaTek MT7628 SoC embedded switch driver (drivers/net/dsa/mt7628.c), and its associated DSA tag driver (net/dsa/tag_mt7628.c). MT7628 is a platform/SoC-specific Ethernet switch for MIPS-based MediaTek SoCs and is not emulated in standard QEMU/GCE virtualized environments on the target architecture (amd64). Because the underlying hardware device cannot probe and the tag protocol is only used by this switch, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/07 01:52 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 04b716b1a9fa61910cdd816322f2880058f43c99\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Sep 7 01:52:20 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/MAINTAINERS b/MAINTAINERS\nindex b23fb6f2f4ef4..95e361f5d0ede 100644\n--- a/MAINTAINERS\n+++ b/MAINTAINERS\n@@ -16781,6 +16781,15 @@ S:\tMaintained\n F:\tDocumentation/devicetree/bindings/i2c/mediatek,mt7621-i2c.yaml\n F:\tdrivers/i2c/busses/i2c-mt7621.c\n \n+MEDIATEK MT7628 SWITCH DRIVER\n+M:\tJoris Vaisvila \u003cjoey@tinyisr.com\u003e\n+L:\tnetdev@vger.kernel.org\n+S:\tMaintained\n+F:\tDocumentation/devicetree/bindings/net/dsa/mediatek,mt7628-esw.yaml\n+F:\tdrivers/net/dsa/mt7628.c\n+F:\tdrivers/net/phy/mediatek/mtk-fe-soc.c\n+F:\tnet/dsa/tag_mt7628.c\n+\n MEDIATEK MTMIPS CLOCK DRIVER\n M:\tSergio Paracuellos \u003csergio.paracuellos@gmail.com\u003e\n S:\tMaintained\ndiff --git a/drivers/net/dsa/mt7628.c b/drivers/net/dsa/mt7628.c\nindex fb63f6f644b9e..629dbf968a171 100644\n--- a/drivers/net/dsa/mt7628.c\n+++ b/drivers/net/dsa/mt7628.c\n@@ -34,6 +34,7 @@\n #define MT7628_ESW_REG_VUB(vlan) (0x100 + 4 * ((vlan) / 4))\n #define MT7628_ESW_REG_SOCPC 0x8c\n #define MT7628_ESW_REG_POC0 0x90\n+#define MT7628_ESW_REG_POC1 0x94\n #define MT7628_ESW_REG_POC2 0x98\n #define MT7628_ESW_REG_SGC 0x9c\n #define MT7628_ESW_REG_PCR0 0xc0\n@@ -92,6 +93,9 @@\n \n #define MT7628_ESW_POC0_PORT_DISABLE GENMASK(29, 23)\n \n+#define MT7628_ESW_POC1_PORT_BLOCKING_STATE GENMASK(22, 16)\n+#define MT7628_ESW_POC1_PORT_DIS_LEARNING GENMASK(14, 8)\n+\n #define MT7628_ESW_POC2_PER_VLAN_UNTAG_EN BIT(15)\n \n #define MT7628_ESW_SGC_AGING_INTERVAL GENMASK(3, 0)\n@@ -138,6 +142,7 @@\n #define MT7628_ESW_PORTS_CPU BIT(6)\n #define MT7628_ESW_PORTS_ALL GENMASK(6, 0)\n \n+#define MT7628_ESW_NUM_USER_PORTS 5\n #define MT7628_ESW_NUM_PORTS 7\n #define MT7628_NUM_VLANS 16\n \n@@ -151,8 +156,14 @@ static const struct regmap_config mt7628_esw_regmap_cfg = {\n \t.val_format_endian = REGMAP_ENDIAN_LITTLE,\n };\n \n+enum {\n+\tMT7628_VLAN_TYPE_AWARE,\n+\tMT7628_VLAN_TYPE_UNAWARE,\n+\tMT7628_VLAN_TYPE_NUM,\n+};\n+\n struct mt7628_vlan {\n-\tbool active;\n+\tunsigned int type;\n \tu8 members;\n \tu8 untag;\n \tu16 vid;\n@@ -163,9 +174,10 @@ struct mt7628_esw {\n \tstruct reset_control *rst_esw;\n \tstruct regmap *regmap;\n \tstruct dsa_switch *ds;\n-\tu16 tag_8021q_pvid[MT7628_ESW_NUM_PORTS];\n+\tu16 pvid[MT7628_VLAN_TYPE_NUM][MT7628_ESW_NUM_PORTS];\n \tstruct mt7628_vlan vlans[MT7628_NUM_VLANS];\n \tstruct device *dev;\n+\tu8 vlan_filtering;\n };\n \n static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)\n@@ -383,21 +395,127 @@ static void mt7628_esw_set_vub(struct mt7628_esw *esw, unsigned int vlan,\n \t\t\t MT7628_ESW_VUB_PREP(vlan, vub));\n }\n \n+static struct mt7628_vlan *mt7628_find_vlan_block(struct dsa_switch *ds,\n+\t\t\t\t\t\t u16 vid, unsigned int type)\n+{\n+\tstruct mt7628_esw *esw = ds-\u003epriv;\n+\tstruct mt7628_vlan *vlan;\n+\tint i;\n+\n+\tfor (i = 0; i \u003c MT7628_NUM_VLANS; i++) {\n+\t\tvlan = \u0026esw-\u003evlans[i];\n+\t\tif (vlan-\u003evid == vid \u0026\u0026 vlan-\u003etype == type)\n+\t\t\treturn vlan;\n+\t}\n+\treturn NULL;\n+}\n+\n+static struct mt7628_vlan *mt7628_alloc_vlan_block(struct dsa_switch *ds,\n+\t\t\t\t\t\t u16 vid, unsigned int type)\n+{\n+\tstruct mt7628_esw *esw = ds-\u003epriv;\n+\tstruct mt7628_vlan *vlan;\n+\tint i;\n+\n+\tfor (i = 0; i \u003c MT7628_NUM_VLANS; i++) {\n+\t\tvlan = \u0026esw-\u003evlans[i];\n+\t\tif (vlan-\u003evid)\n+\t\t\tcontinue;\n+\t\tif (vlan-\u003etype != type)\n+\t\t\tcontinue;\n+\t\tvlan-\u003evid = vid;\n+\t\treturn vlan;\n+\t}\n+\n+\treturn NULL;\n+}\n+\n+static int mt7628_port_join_vlan_block(struct dsa_switch *ds, int port, u16 vid,\n+\t\t\t\t unsigned int type, u16 flags)\n+{\n+\tstruct mt7628_vlan *vlan = mt7628_find_vlan_block(ds, vid, type);\n+\tstruct mt7628_esw *esw = ds-\u003epriv;\n+\n+\tif (!vlan)\n+\t\tvlan = mt7628_alloc_vlan_block(ds, vid, type);\n+\n+\tif (!vlan)\n+\t\treturn -ENOSPC;\n+\n+\tvlan-\u003emembers |= BIT(port);\n+\n+\tif (flags \u0026 BRIDGE_VLAN_INFO_PVID)\n+\t\tesw-\u003epvid[type][port] = vid;\n+\telse if (esw-\u003epvid[type][port] == vid)\n+\t\tesw-\u003epvid[type][port] = 0;\n+\n+\tif (flags \u0026 BRIDGE_VLAN_INFO_UNTAGGED)\n+\t\tvlan-\u003euntag |= BIT(port);\n+\telse\n+\t\tvlan-\u003euntag \u0026= ~BIT(port);\n+\treturn 0;\n+}\n+\n+static int mt7628_port_leave_vlan_block(struct dsa_switch *ds, int port,\n+\t\t\t\t\tu16 vid, unsigned int type)\n+{\n+\tstruct mt7628_vlan *vlan = mt7628_find_vlan_block(ds, vid, type);\n+\tstruct mt7628_esw *esw = ds-\u003epriv;\n+\n+\tif (!vlan)\n+\t\treturn -ENOENT;\n+\n+\tif (esw-\u003epvid[type][port] == vid)\n+\t\tesw-\u003epvid[type][port] = 0;\n+\tvlan-\u003emembers \u0026= ~BIT(port);\n+\tvlan-\u003euntag \u0026= ~BIT(port);\n+\t/*\n+\t * Free the vlan if we're the last member of it.\n+\t */\n+\tif (!vlan-\u003emembers)\n+\t\tvlan-\u003evid = 0;\n+\treturn 0;\n+}\n+\n static void mt7628_vlan_sync(struct dsa_switch *ds)\n {\n \tstruct mt7628_esw *esw = ds-\u003epriv;\n+\tstruct dsa_port *dp;\n \tint i;\n \n \tfor (i = 0; i \u003c MT7628_NUM_VLANS; i++) {\n \t\tstruct mt7628_vlan *vlan = \u0026esw-\u003evlans[i];\n+\t\tu8 member_mask;\n+\n+\t\tif (vlan-\u003etype == MT7628_VLAN_TYPE_AWARE)\n+\t\t\tmember_mask = esw-\u003evlan_filtering;\n+\t\telse\n+\t\t\tmember_mask = ~esw-\u003evlan_filtering;\n+\t\tmember_mask |= MT7628_ESW_PORTS_CPU;\n+\t\t/*\n+\t\t * Put VLAN filtering ports only into VLAN aware VLANs and\n+\t\t * non VLAN filtering ports into VLAN unaware VLANs.\n+\t\t *\n+\t\t * CPU may not be removed from any VLAN, as VLAN filtering\n+\t\t * applies only to user ports.\n+\t\t */\n \n-\t\tmt7628_esw_set_vmsc(esw, i, vlan-\u003emembers);\n \t\tmt7628_esw_set_vlan_id(esw, i, vlan-\u003evid);\n-\t\tmt7628_esw_set_vub(esw, i, vlan-\u003euntag);\n+\t\tmt7628_esw_set_vmsc(esw, i, vlan-\u003emembers \u0026 member_mask);\n+\t\tmt7628_esw_set_vub(esw, i, vlan-\u003euntag \u0026 member_mask);\n+\n \t}\n \n-\tfor (i = 0; i \u003c ds-\u003enum_ports; i++)\n-\t\tmt7628_esw_set_pvid(esw, i, esw-\u003etag_8021q_pvid[i]);\n+\tdsa_switch_for_each_user_port(dp, ds) {\n+\t\tunsigned int type = BIT(dp-\u003eindex) \u0026 esw-\u003evlan_filtering ?\n+\t\t MT7628_VLAN_TYPE_AWARE : MT7628_VLAN_TYPE_UNAWARE;\n+\t\tmt7628_esw_set_pvid(esw, dp-\u003eindex, esw-\u003epvid[type][dp-\u003eindex]);\n+\t}\n+\tregmap_update_bits(esw-\u003eregmap, MT7628_ESW_REG_SGC2,\n+\t\t\t MT7628_ESW_SGC2_DOUBLE_TAG_EN,\n+\t\t\t FIELD_PREP(MT7628_ESW_SGC2_DOUBLE_TAG_EN,\n+\t\t\t\t MT7628_ESW_PORTS_NOCPU \u0026\n+\t\t\t\t ~esw-\u003evlan_filtering));\n }\n \n static int mt7628_setup(struct dsa_switch *ds)\n@@ -425,6 +543,19 @@ static int mt7628_setup(struct dsa_switch *ds)\n \tif (ret)\n \t\treturn ret;\n \n+\t/*\n+\t * Dedicate the first num_user_ports + 1 VLAN slots for tag_8021q.\n+\t * Since bridges are only offloaded when they have at least one member\n+\t * port, the worst case entry requirement is 1 per port. The extra slot\n+\t * is needed because when changing the configuration, tag_8021q adds a\n+\t * new VLAN before removing the old one. The rest of the VLAN slots can\n+\t * be used for filtering.\n+\t */\n+\tfor (int i = 0; i \u003c MT7628_ESW_NUM_USER_PORTS + 1; i++)\n+\t\tesw-\u003evlans[i].type = MT7628_VLAN_TYPE_UNAWARE;\n+\n+\tds-\u003emax_num_bridges = DSA_TAG_8021Q_MAX_NUM_BRIDGES;\n+\n \trtnl_lock();\n \tret = dsa_tag_8021q_register(ds, htons(ETH_P_8021Q));\n \trtnl_unlock();\n@@ -479,71 +610,97 @@ static void mt7628_phylink_get_caps(struct dsa_switch *ds, int port,\n static int mt7628_dsa_8021q_vlan_add(struct dsa_switch *ds, int port,\n \t\t\t\t u16 vid, u16 flags)\n {\n-\tstruct mt7628_esw *esw = ds-\u003epriv;\n-\tstruct mt7628_vlan *vlan = NULL;\n-\tint i;\n-\n-\tfor (i = 0; i \u003c MT7628_NUM_VLANS; i++) {\n-\t\tstruct mt7628_vlan *check_vlan = \u0026esw-\u003evlans[i];\n-\n-\t\tif (!check_vlan-\u003eactive \u0026\u0026 !vlan)\n-\t\t\tvlan = check_vlan;\n-\n-\t\tif (check_vlan-\u003eactive \u0026\u0026 check_vlan-\u003evid == vid) {\n-\t\t\tvlan = check_vlan;\n-\t\t\tbreak;\n-\t\t}\n-\t}\n-\n-\tif (!vlan)\n-\t\treturn -ENOSPC;\n-\n-\tvlan-\u003evid = vid;\n-\tvlan-\u003eactive = true;\n-\tvlan-\u003emembers |= BIT(port);\n-\n-\tif (flags \u0026 BRIDGE_VLAN_INFO_PVID)\n-\t\tesw-\u003etag_8021q_pvid[port] = vid;\n-\n-\tif (flags \u0026 BRIDGE_VLAN_INFO_UNTAGGED)\n-\t\tvlan-\u003euntag |= BIT(port);\n-\n+\tint ret =\n+\t mt7628_port_join_vlan_block(ds, port, vid, MT7628_VLAN_TYPE_UNAWARE,\n+\t\t\t\t\tflags);\n+\tif (ret)\n+\t\treturn ret;\n \tmt7628_vlan_sync(ds);\n \treturn 0;\n }\n \n static int mt7628_dsa_8021q_vlan_del(struct dsa_switch *ds, int port, u16 vid)\n {\n-\tstruct mt7628_esw *esw = ds-\u003epriv;\n-\tstruct mt7628_vlan *vlan = NULL;\n-\tint i;\n+\tint ret = mt7628_port_leave_vlan_block(ds, port, vid,\n+\t\t\t\t\t MT7628_VLAN_TYPE_UNAWARE);\n+\tif (ret)\n+\t\treturn ret;\n+\tmt7628_vlan_sync(ds);\n+\treturn 0;\n+}\n \n-\tfor (i = 0; i \u003c MT7628_NUM_VLANS; i++) {\n-\t\tstruct mt7628_vlan *check_vlan = \u0026esw-\u003evlans[i];\n+static int mt7628_port_vlan_filtering(struct dsa_switch *ds, int port,\n+\t\t\t\t bool vlan_filtering,\n+\t\t\t\t struct netlink_ext_ack *extack)\n+{\n+\tstruct mt7628_esw *esw = ds-\u003epriv;\n \n-\t\tif (!check_vlan-\u003eactive || check_vlan-\u003evid != vid)\n-\t\t\tcontinue;\n-\t\tvlan = check_vlan;\n-\t\tbreak;\n-\t}\n-\tif (!vlan)\n-\t\treturn -ENOENT;\n+\tif (vlan_filtering)\n+\t\tesw-\u003evlan_filtering |= BIT(port);\n+\telse\n+\t\tesw-\u003evlan_filtering \u0026= ~BIT(port);\n+\tmt7628_vlan_sync(ds);\n+\treturn 0;\n+}\n \n-\tif (esw-\u003etag_8021q_pvid[port] == vid)\n-\t\tesw-\u003etag_8021q_pvid[port] = 0;\n+static int mt7628_port_vlan_add(struct dsa_switch *ds, int port,\n+\t\t\t\tconst struct switchdev_obj_port_vlan *vlan,\n+\t\t\t\tstruct netlink_ext_ack *extack)\n+{\n+\tstruct mt7628_vlan *vlan_block;\n+\tstruct dsa_port *other_dp;\n+\tstruct dsa_port *dp;\n+\tint ret;\n \n-\tvlan-\u003emembers \u0026= ~BIT(port);\n-\tvlan-\u003euntag \u0026= ~BIT(port);\n+\tif (vid_is_dsa_8021q(vlan-\u003evid)) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t \"Range 3072-4095 reserved for dsa_8021q operation\");\n+\t\treturn -EBUSY;\n+\t}\n \n-\tif (!vlan-\u003emembers) {\n-\t\tvlan-\u003eactive = false;\n-\t\tvlan-\u003evid = 0;\n+\tvlan_block =\n+\t mt7628_find_vlan_block(ds, vlan-\u003evid, MT7628_VLAN_TYPE_AWARE);\n+\tdp = dsa_to_port(ds, port);\n+\t/*\n+\t * CPU port can be added to any VLANs, but user ports need to ensure,\n+\t * that if the VLAN already exists it's not used by a bridge we're not\n+\t * a member of, because VLANs are the only form of forwarding control\n+\t * we have on this switch.\n+\t */\n+\tif (vlan_block \u0026\u0026 !dsa_port_is_cpu(dp)) {\n+\t\tdsa_switch_for_each_user_port(other_dp, ds) {\n+\t\t\tif (other_dp == dp)\n+\t\t\t\tcontinue;\n+\t\t\tif (other_dp-\u003ebridge == dp-\u003ebridge)\n+\t\t\t\tcontinue;\n+\t\t\tif (!(vlan_block-\u003emembers \u0026 BIT(other_dp-\u003eindex)))\n+\t\t\t\tcontinue;\n+\t\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t\t \"VLAN ID used on another bridge\");\n+\t\t\treturn -EBUSY;\n+\t\t}\n \t}\n+\tret =\n+\t mt7628_port_join_vlan_block(ds, port, vlan-\u003evid,\n+\t\t\t\t\tMT7628_VLAN_TYPE_AWARE, vlan-\u003eflags);\n+\tif (ret)\n+\t\treturn ret;\n \n \tmt7628_vlan_sync(ds);\n \treturn 0;\n }\n \n+static int mt7628_port_vlan_del(struct dsa_switch *ds, int port,\n+\t\t\t\tconst struct switchdev_obj_port_vlan *vlan)\n+{\n+\tint ret = mt7628_port_leave_vlan_block(ds, port, vlan-\u003evid,\n+\t\t\t\t\t MT7628_VLAN_TYPE_AWARE);\n+\tif (ret)\n+\t\treturn ret;\n+\tmt7628_vlan_sync(ds);\n+\treturn 0;\n+}\n+\n static void mt7628_teardown(struct dsa_switch *ds)\n {\n \trtnl_lock();\n@@ -551,6 +708,40 @@ static void mt7628_teardown(struct dsa_switch *ds)\n \trtnl_unlock();\n }\n \n+static void mt7628_stp_state_set(struct dsa_switch *ds, int port, u8 state)\n+{\n+\tstruct mt7628_esw *esw = ds-\u003epriv;\n+\tbool forward_disable;\n+\tbool learn_disable;\n+\n+\tswitch (state) {\n+\tcase BR_STATE_DISABLED:\n+\tcase BR_STATE_BLOCKING:\n+\tcase BR_STATE_LISTENING:\n+\t\tforward_disable = true;\n+\t\tlearn_disable = true;\n+\t\tbreak;\n+\tcase BR_STATE_LEARNING:\n+\t\tforward_disable = true;\n+\t\tlearn_disable = false;\n+\t\tbreak;\n+\tcase BR_STATE_FORWARDING:\n+\t\tforward_disable = false;\n+\t\tlearn_disable = false;\n+\t\tbreak;\n+\tdefault:\n+\t\tdev_err(ds-\u003edev, \"invalid STP state: %d\\n\", state);\n+\t\treturn;\n+\t}\n+\n+\tregmap_assign_bits(esw-\u003eregmap, MT7628_ESW_REG_POC1,\n+\t\t\t FIELD_PREP(MT7628_ESW_POC1_PORT_DIS_LEARNING,\n+\t\t\t\t BIT(port)), learn_disable);\n+\tregmap_assign_bits(esw-\u003eregmap, MT7628_ESW_REG_POC1,\n+\t\t\t FIELD_PREP(MT7628_ESW_POC1_PORT_BLOCKING_STATE,\n+\t\t\t\t BIT(port)), forward_disable);\n+}\n+\n static const struct dsa_switch_ops mt7628_switch_ops = {\n \t.get_tag_protocol = mt7628_get_tag_proto,\n \t.setup = mt7628_setup,\n@@ -560,6 +751,12 @@ static const struct dsa_switch_ops mt7628_switch_ops = {\n \t.phylink_get_caps = mt7628_phylink_get_caps,\n \t.tag_8021q_vlan_add = mt7628_dsa_8021q_vlan_add,\n \t.tag_8021q_vlan_del = mt7628_dsa_8021q_vlan_del,\n+\t.port_bridge_join = dsa_tag_8021q_bridge_join,\n+\t.port_bridge_leave = dsa_tag_8021q_bridge_leave,\n+\t.port_stp_state_set = mt7628_stp_state_set,\n+\t.port_vlan_filtering = mt7628_port_vlan_filtering,\n+\t.port_vlan_add = mt7628_port_vlan_add,\n+\t.port_vlan_del = mt7628_port_vlan_del,\n };\n \n static int mt7628_probe(struct platform_device *pdev)\ndiff --git a/net/dsa/tag_mt7628.c b/net/dsa/tag_mt7628.c\nindex 80b50ff08e53f..7c71e8b086481 100644\n--- a/net/dsa/tag_mt7628.c\n+++ b/net/dsa/tag_mt7628.c\n@@ -6,6 +6,7 @@\n \n #include \u003clinux/etherdevice.h\u003e\n #include \u003clinux/dsa/8021q.h\u003e\n+#include \u003clinux/if_vlan.h\u003e\n #include \u003cnet/dsa.h\u003e\n \n #include \"tag.h\"\n@@ -15,13 +16,16 @@\n * On TX the lower 6 bits encode the destination port bitmask.\n * On RX the lower 3 bits encode the source port number.\n *\n- * The switch hardware will not modify the TPID of an incoming packet if it is\n- * already VLAN tagged. To work around this the switch is configured to always\n- * append a tag_8021q standalone VLAN tag for each port. That means we can\n- * safely strip the outer VLAN tag after parsing it.\n+ * The switch can only use VLANs for forwarding control. VLAN-unaware bridges\n+ * are simulated using tag_8021q and double tagging, while VLAN-aware bridges\n+ * use the VLANs configured by the bridge directly.\n *\n- * A VLAN tag is constructed on egress to target the standalone VLAN and\n- * destination port.\n+ * On egress, the tagger either adds a new MT7628 tag that contains the\n+ * standalone or bridge tag_8021q VLAN and destination port mask, or modifies\n+ * an existing VLAN tag to contain the destination port mask.\n+ *\n+ * On ingress, the VLAN tag is restored after stripping the MT7628 tag, if it\n+ * is not a tag_8021q VLAN.\n */\n \n #define MT7628_TAG_NAME \"mt7628\"\n@@ -34,20 +38,35 @@ static struct sk_buff *mt7628_tag_xmit(struct sk_buff *skb,\n \t\t\t\t struct net_device *dev)\n {\n \tstruct dsa_port *dp;\n+\tu16 xmit_tpid;\n \tu16 xmit_vlan;\n \t__be16 *tag;\n \n+\txmit_tpid =\n+\t ETH_P_8021Q | FIELD_PREP(MT7628_TAG_TX_PORT,\n+\t\t\t\t dsa_xmit_port_mask(skb, dev));\n \tdp = dsa_user_to_port(dev);\n-\txmit_vlan = dsa_tag_8021q_standalone_vid(dp);\n+\tif (skb-\u003eoffload_fwd_mark \u0026\u0026\n+\t br_vlan_enabled(dsa_port_bridge_dev_get(dp))) {\n+\t\t/*\n+\t\t * On VLAN aware ports only modify the TPID to contain the\n+\t\t * MT7628 egress port metadata, instead of adding a new vlan tag\n+\t\t */\n+\t\ttag = dsa_etype_header_pos_tx(skb);\n+\t\ttag[0] = htons(xmit_tpid);\n+\t\treturn skb;\n+\t}\n+\n+\txmit_vlan = skb-\u003eoffload_fwd_mark ?\n+\t dsa_tag_8021q_bridge_vid(dsa_port_bridge_num_get(dp)) :\n+\t dsa_tag_8021q_standalone_vid(dp);\n \n \tskb_push(skb, MT7628_TAG_LEN);\n \tdsa_alloc_etype_header(skb, MT7628_TAG_LEN);\n \n \ttag = dsa_etype_header_pos_tx(skb);\n \n-\ttag[0] = htons(ETH_P_8021Q |\n-\t\t FIELD_PREP(MT7628_TAG_TX_PORT,\n-\t\t\t\t dsa_xmit_port_mask(skb, dev)));\n+\ttag[0] = htons(xmit_tpid);\n \ttag[1] = htons(xmit_vlan);\n \n \treturn skb;\n@@ -56,7 +75,10 @@ static struct sk_buff *mt7628_tag_xmit(struct sk_buff *skb,\n static struct sk_buff *mt7628_tag_rcv(struct sk_buff *skb,\n \t\t\t\t struct net_device *dev)\n {\n+\tunsigned int source_port;\n+\tbool is_dsa_8021q;\n \t__be16 *phdr;\n+\tu16 tci, vid;\n \n \tif (unlikely(!pskb_may_pull(skb, MT7628_TAG_LEN))) {\n \t\tkfree_skb(skb);\n@@ -64,9 +86,23 @@ static struct sk_buff *mt7628_tag_rcv(struct sk_buff *skb,\n \t}\n \n \tphdr = dsa_etype_header_pos_rx(skb);\n-\tskb-\u003edev =\n-\t dsa_conduit_find_user(dev, 0,\n-\t\t\t\t FIELD_GET(MT7628_TAG_RX_PORT, ntohs(*phdr)));\n+\tsource_port = FIELD_GET(MT7628_TAG_RX_PORT, ntohs(*phdr));\n+\ttci = ntohs(phdr[1]);\n+\tvid = tci \u0026 VLAN_VID_MASK;\n+\tis_dsa_8021q = vid_is_dsa_8021q(vid);\n+\n+\t/*\n+\t * The source port info is only encoded in the TPID field for packets\n+\t * where the VLAN tag is inserted by the PVID mechanism. With VLAN\n+\t * filtering enabled, VLAN-tagged ingress packets appear as if they're\n+\t * originating on port 0. Use the VID to identify the bridge port in\n+\t * this case.\n+\t */\n+\tif (source_port == 0 \u0026\u0026 !is_dsa_8021q)\n+\t\tskb-\u003edev = dsa_find_designated_bridge_port_by_vid(dev, vid);\n+\telse\n+\t\tskb-\u003edev = dsa_conduit_find_user(dev, 0, source_port);\n+\n \tif (!skb-\u003edev) {\n \t\tkfree_skb(skb);\n \t\treturn NULL;\n@@ -75,6 +111,10 @@ static struct sk_buff *mt7628_tag_rcv(struct sk_buff *skb,\n \tskb_pull_rcsum(skb, MT7628_TAG_LEN);\n \tdsa_strip_etype_header(skb, MT7628_TAG_LEN);\n \tdsa_default_offload_fwd_mark(skb);\n+\n+\tif (!is_dsa_8021q)\n+\t\t__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), tci);\n+\n \treturn skb;\n }\n \n"
} |
| 2/1 | 2026/09/07 01:52 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies MAINTAINERS, the MediaTek MT7628 SoC embedded switch driver (drivers/net/dsa/mt7628.c), and its associated DSA tag driver (net/dsa/tag_mt7628.c). MT7628 is a platform/SoC-specific Ethernet switch for MIPS-based MediaTek SoCs and is not emulated in standard QEMU/GCE virtualized environments on the target architecture (amd64). Because the underlying hardware device cannot probe and the tag protocol is only used by this switch, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 04b716b1a9fa61910cdd816322f2880058f43c99
Author: syz-cluster <triage@syzkaller.com>
Date: Mon Sep 7 01:52:20 2026 +0000
syz-cluster: applied patch under review
diff --git a/MAINTAINERS b/MAINTAINERS
index b23fb6f2f4ef4..95e361f5d0ede 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -16781,6 +16781,15 @@ S: Maintained
F: Documentation/devicetree/bindings/i2c/mediatek,mt7621-i2c.yaml
F: drivers/i2c/busses/i2c-mt7621.c
+MEDIATEK MT7628 SWITCH DRIVER
+M: Joris Vaisvila <joey@tinyisr.com>
+L: netdev@vger.kernel.org
+S: Maintained
+F: Documentation/devicetree/bindings/net/dsa/mediatek,mt7628-esw.yaml
+F: drivers/net/dsa/mt7628.c
+F: drivers/net/phy/mediatek/mtk-fe-soc.c
+F: net/dsa/tag_mt7628.c
+
MEDIATEK MTMIPS CLOCK DRIVER
M: Sergio Paracuellos <sergio.paracuellos@gmail.com>
S: Maintained
diff --git a/drivers/net/dsa/mt7628.c b/drivers/net/dsa/mt7628.c
index fb63f6f644b9e..629dbf968a171 100644
--- a/drivers/net/dsa/mt7628.c
+++ b/drivers/net/dsa/mt7628.c
@@ -34,6 +34,7 @@
#define MT7628_ESW_REG_VUB(vlan) (0x100 + 4 * ((vlan) / 4))
#define MT7628_ESW_REG_SOCPC 0x8c
#define MT7628_ESW_REG_POC0 0x90
+#define MT7628_ESW_REG_POC1 0x94
#define MT7628_ESW_REG_POC2 0x98
#define MT7628_ESW_REG_SGC 0x9c
#define MT7628_ESW_REG_PCR0 0xc0
@@ -92,6 +93,9 @@
#define MT7628_ESW_POC0_PORT_DISABLE GENMASK(29, 23)
+#define MT7628_ESW_POC1_PORT_BLOCKING_STATE GENMASK(22, 16)
+#define MT7628_ESW_POC1_PORT_DIS_LEARNING GENMASK(14, 8)
+
#define MT7628_ESW_POC2_PER_VLAN_UNTAG_EN BIT(15)
#define MT7628_ESW_SGC_AGING_INTERVAL GENMASK(3, 0)
@@ -138,6 +142,7 @@
#define MT7628_ESW_PORTS_CPU BIT(6)
#define MT7628_ESW_PORTS_ALL GENMASK(6, 0)
+#define MT7628_ESW_NUM_USER_PORTS 5
#define MT7628_ESW_NUM_PORTS 7
#define MT7628_NUM_VLANS 16
@@ -151,8 +156,14 @@ static const struct regmap_config mt7628_esw_regmap_cfg = {
.val_format_endian = REGMAP_ENDIAN_LITTLE,
};
+enum {
+ MT7628_VLAN_TYPE_AWARE,
+ MT7628_VLAN_TYPE_UNAWARE,
+ MT7628_VLAN_TYPE_NUM,
+};
+
struct mt7628_vlan {
- bool active;
+ unsigned int type;
u8 members;
u8 untag;
u16 vid;
@@ -163,9 +174,10 @@ struct mt7628_esw {
struct reset_control *rst_esw;
struct regmap *regmap;
struct dsa_switch *ds;
- u16 tag_8021q_pvid[MT7628_ESW_NUM_PORTS];
+ u16 pvid[MT7628_VLAN_TYPE_NUM][MT7628_ESW_NUM_PORTS];
struct mt7628_vlan vlans[MT7628_NUM_VLANS];
struct device *dev;
+ u8 vlan_filtering;
};
static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)
@@ -383,21 +395,127 @@ static void mt7628_esw_set_vub(struct mt7628_esw *esw, unsigned int vlan,
MT7628_ESW_VUB_PREP(vlan, vub));
}
+static struct mt7628_vlan *mt7628_find_vlan_block(struct dsa_switch *ds,
+ u16 vid, unsigned int type)
+{
+ struct mt7628_esw *esw = ds->priv;
+ struct mt7628_vlan *vlan;
+ int i;
+
+ for (i = 0; i < MT7628_NUM_VLANS; i++) {
+ vlan = &esw->vlans[i];
+ if (vlan->vid == vid && vlan->type == type)
+ return vlan;
+ }
+ return NULL;
+}
+
+static struct mt7628_vlan *mt7628_alloc_vlan_block(struct dsa_switch *ds,
+ u16 vid, unsigned int type)
+{
+ struct mt7628_esw *esw = ds->priv;
+ struct mt7628_vlan *vlan;
+ int i;
+
+ for (i = 0; i < MT7628_NUM_VLANS; i++) {
+ vlan = &esw->vlans[i];
+ if (vlan->vid)
+ continue;
+ if (vlan->type != type)
+ continue;
+ vlan->vid = vid;
+ return vlan;
+ }
+
+ return NULL;
+}
+
+static int mt7628_port_join_vlan_block(struct dsa_switch *ds, int port, u16 vid,
+ unsigned int type, u16 flags)
+{
+ struct mt7628_vlan *vlan = mt7628_find_vlan_block(ds, vid, type);
+ struct mt7628_esw *esw = ds->priv;
+
+ if (!vlan)
+ vlan = mt7628_alloc_vlan_block(ds, vid, type);
+
+ if (!vlan)
+ return -ENOSPC;
+
+ vlan->members |= BIT(port);
+
+ if (flags & BRIDGE_VLAN_INFO_PVID)
+ esw->pvid[type][port] = vid;
+ else if (esw->pvid[type][port] == vid)
+ esw->pvid[type][port] = 0;
+
+ if (flags & BRIDGE_VLAN_INFO_UNTAGGED)
+ vlan->untag |= BIT(port);
+ else
+ vlan->untag &= ~BIT(port);
+ return 0;
+}
+
+static int mt7628_port_leave_vlan_block(struct dsa_switch *ds, int port,
+ u16 vid, unsigned int type)
+{
+ struct mt7628_vlan *vlan = mt7628_find_vlan_block(ds, vid, type);
+ struct mt7628_esw *esw = ds->priv;
+
+ if (!vlan)
+ return -ENOENT;
+
+ if (esw->pvid[type][port] == vid)
+ esw->pvid[type][port] = 0;
+ vlan->members &= ~BIT(port);
+ vlan->untag &= ~BIT(port);
+ /*
+ * Free the vlan if we're the last member of it.
+ */
+ if (!vlan->members)
+ vlan->vid = 0;
+ return 0;
+}
+
static void mt7628_vlan_sync(struct dsa_switch *ds)
{
struct mt7628_esw *esw = ds->priv;
+ struct dsa_port *dp;
int i;
for (i = 0; i < MT7628_NUM_VLANS; i++) {
struct mt7628_vlan *vlan = &esw->vlans[i];
+ u8 member_mask;
+
+ if (vlan->type == MT7628_VLAN_TYPE_AWARE)
+ member_mask = esw->vlan_filtering;
+ else
+ member_mask = ~esw->vlan_filtering;
+ member_mask |= MT7628_ESW_PORTS_CPU;
+ /*
+ * Put VLAN filtering ports only into VLAN aware VLANs and
+ * non VLAN filtering ports into VLAN unaware VLANs.
+ *
+ * CPU may not be removed from any VLAN, as VLAN filtering
+ * applies only to user ports.
+ */
- mt7628_esw_set_vmsc(esw, i, vlan->members);
mt7628_esw_set_vlan_id(esw, i, vlan->vid);
- mt7628_esw_set_vub(esw, i, vlan->untag);
+ mt7628_esw_set_vmsc(esw, i, vlan->members & member_mask);
+ mt7628_esw_set_vub(esw, i, vlan->untag & member_mask);
+
}
- for (i = 0; i < ds->num_ports; i++)
- mt7628_esw_set_pvid(esw, i, esw->tag_8021q_pvid[i]);
+ dsa_switch_for_each_user_port(dp, ds) {
+ unsigned int type = BIT(dp->index) & esw->vlan_filtering ?
+ MT7628_VLAN_TYPE_AWARE : MT7628_VLAN_TYPE_UNAWARE;
+ mt7628_esw_set_pvid(esw, dp->index, esw->pvid[type][dp->index]);
+ }
+ regmap_update_bits(esw->regmap, MT7628_ESW_REG_SGC2,
+ MT7628_ESW_SGC2_DOUBLE_TAG_EN,
+ FIELD_PREP(MT7628_ESW_SGC2_DOUBLE_TAG_EN,
+ MT7628_ESW_PORTS_NOCPU &
+ ~esw->vlan_filtering));
}
static int mt7628_setup(struct dsa_switch *ds)
@@ -425,6 +543,19 @@ static int mt7628_setup(struct dsa_switch *ds)
if (ret)
return ret;
+ /*
+ * Dedicate the first num_user_ports + 1 VLAN slots for tag_8021q.
+ * Since bridges are only offloaded when they have at least one member
+ * port, the worst case entry requirement is 1 per port. The extra slot
+ * is needed because when changing the configuration, tag_8021q adds a
+ * new VLAN before removing the old one. The rest of the VLAN slots can
+ * be used for filtering.
+ */
+ for (int i = 0; i < MT7628_ESW_NUM_USER_PORTS + 1; i++)
+ esw->vlans[i].type = MT7628_VLAN_TYPE_UNAWARE;
+
+ ds->max_num_bridges = DSA_TAG_8021Q_MAX_NUM_BRIDGES;
+
rtnl_lock();
ret = dsa_tag_8021q_register(ds, htons(ETH_P_8021Q));
rtnl_unlock();
@@ -479,71 +610,97 @@ static void mt7628_phylink_get_caps(struct dsa_switch *ds, int port,
static int mt7628_dsa_8021q_vlan_add(struct dsa_switch *ds, int port,
u16 vid, u16 flags)
{
- struct mt7628_esw *esw = ds->priv;
- struct mt7628_vlan *vlan = NULL;
- int i;
-
- for (i = 0; i < MT7628_NUM_VLANS; i++) {
- struct mt7628_vlan *check_vlan = &esw->vlans[i];
-
- if (!check_vlan->active && !vlan)
- vlan = check_vlan;
-
- if (check_vlan->active && check_vlan->vid == vid) {
- vlan = check_vlan;
- break;
- }
- }
-
- if (!vlan)
- return -ENOSPC;
-
- vlan->vid = vid;
- vlan->active = true;
- vlan->members |= BIT(port);
-
- if (flags & BRIDGE_VLAN_INFO_PVID)
- esw->tag_8021q_pvid[port] = vid;
-
- if (flags & BRIDGE_VLAN_INFO_UNTAGGED)
- vlan->untag |= BIT(port);
-
+ int ret =
+ mt7628_port_join_vlan_block(ds, port, vid, MT7628_VLAN_TYPE_UNAWARE,
+ flags);
+ if (ret)
+ return ret;
mt7628_vlan_sync(ds);
return 0;
}
static int mt7628_dsa_8021q_vlan_del(struct dsa_switch *ds, int port, u16 vid)
{
- struct mt7628_esw *esw = ds->priv;
- struct mt7628_vlan *vlan = NULL;
- int i;
+ int ret = mt7628_port_leave_vlan_block(ds, port, vid,
+ MT7628_VLAN_TYPE_UNAWARE);
+ if (ret)
+ return ret;
+ mt7628_vlan_sync(ds);
+ return 0;
+}
- for (i = 0; i < MT7628_NUM_VLANS; i++) {
- struct mt7628_vlan *check_vlan = &esw->vlans[i];
+static int mt7628_port_vlan_filtering(struct dsa_switch *ds, int port,
+ bool vlan_filtering,
+ struct netlink_ext_ack *extack)
+{
+ struct mt7628_esw *esw = ds->priv;
- if (!check_vlan->active || check_vlan->vid != vid)
- continue;
- vlan = check_vlan;
- break;
- }
- if (!vlan)
- return -ENOENT;
+ if (vlan_filtering)
+ esw->vlan_filtering |= BIT(port);
+ else
+ esw->vlan_filtering &= ~BIT(port);
+ mt7628_vlan_sync(ds);
+ return 0;
+}
- if (esw->tag_8021q_pvid[port] == vid)
- esw->tag_8021q_pvid[port] = 0;
+static int mt7628_port_vlan_add(struct dsa_switch *ds, int port,
+ const struct switchdev_obj_port_vlan *vlan,
+ struct netlink_ext_ack *extack)
+{
+ struct mt7628_vlan *vlan_block;
+ struct dsa_port *other_dp;
+ struct dsa_port *dp;
+ int ret;
- vlan->members &= ~BIT(port);
- vlan->untag &= ~BIT(port);
+ if (vid_is_dsa_8021q(vlan->vid)) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Range 3072-4095 reserved for dsa_8021q operation");
+ return -EBUSY;
+ }
- if (!vlan->members) {
- vlan->active = false;
- vlan->vid = 0;
+ vlan_block =
+ mt7628_find_vlan_block(ds, vlan->vid, MT7628_VLAN_TYPE_AWARE);
+ dp = dsa_to_port(ds, port);
+ /*
+ * CPU port can be added to any VLANs, but user ports need to ensure,
+ * that if the VLAN already exists it's not used by a bridge we're not
+ * a member of, because VLANs are the only form of forwarding control
+ * we have on this switch.
+ */
+ if (vlan_block && !dsa_port_is_cpu(dp)) {
+ dsa_switch_for_each_user_port(other_dp, ds) {
+ if (other_dp == dp)
+ continue;
+ if (other_dp->bridge == dp->bridge)
+ continue;
+ if (!(vlan_block->members & BIT(other_dp->index)))
+ continue;
+ NL_SET_ERR_MSG_MOD(extack,
+ "VLAN ID used on another bridge");
+ return -EBUSY;
+ }
}
+ ret =
+ mt7628_port_join_vlan_block(ds, port, vlan->vid,
+ MT7628_VLAN_TYPE_AWARE, vlan->flags);
+ if (ret)
+ return ret;
mt7628_vlan_sync(ds);
return 0;
}
+static int mt7628_port_vlan_del(struct dsa_switch *ds, int port,
+ const struct switchdev_obj_port_vlan *vlan)
+{
+ int ret = mt7628_port_leave_vlan_block(ds, port, vlan->vid,
+ MT7628_VLAN_TYPE_AWARE);
+ if (ret)
+ return ret;
+ mt7628_vlan_sync(ds);
+ return 0;
+}
+
static void mt7628_teardown(struct dsa_switch *ds)
{
rtnl_lock();
@@ -551,6 +708,40 @@ static void mt7628_teardown(struct dsa_switch *ds)
rtnl_unlock();
}
+static void mt7628_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+{
+ struct mt7628_esw *esw = ds->priv;
+ bool forward_disable;
+ bool learn_disable;
+
+ switch (state) {
+ case BR_STATE_DISABLED:
+ case BR_STATE_BLOCKING:
+ case BR_STATE_LISTENING:
+ forward_disable = true;
+ learn_disable = true;
+ break;
+ case BR_STATE_LEARNING:
+ forward_disable = true;
+ learn_disable = false;
+ break;
+ case BR_STATE_FORWARDING:
+ forward_disable = false;
+ learn_disable = false;
+ break;
+ default:
+ dev_err(ds->dev, "invalid STP state: %d\n", state);
+ return;
+ }
+
+ regmap_assign_bits(esw->regmap, MT7628_ESW_REG_POC1,
+ FIELD_PREP(MT7628_ESW_POC1_PORT_DIS_LEARNING,
+ BIT(port)), learn_disable);
+ regmap_assign_bits(esw->regmap, MT7628_ESW_REG_POC1,
+ FIELD_PREP(MT7628_ESW_POC1_PORT_BLOCKING_STATE,
+ BIT(port)), forward_disable);
+}
+
static const struct dsa_switch_ops mt7628_switch_ops = {
.get_tag_protocol = mt7628_get_tag_proto,
.setup = mt7628_setup,
@@ -560,6 +751,12 @@ static const struct dsa_switch_ops mt7628_switch_ops = {
.phylink_get_caps = mt7628_phylink_get_caps,
.tag_8021q_vlan_add = mt7628_dsa_8021q_vlan_add,
.tag_8021q_vlan_del = mt7628_dsa_8021q_vlan_del,
+ .port_bridge_join = dsa_tag_8021q_bridge_join,
+ .port_bridge_leave = dsa_tag_8021q_bridge_leave,
+ .port_stp_state_set = mt7628_stp_state_set,
+ .port_vlan_filtering = mt7628_port_vlan_filtering,
+ .port_vlan_add = mt7628_port_vlan_add,
+ .port_vlan_del = mt7628_port_vlan_del,
};
static int mt7628_probe(struct platform_device *pdev)
diff --git a/net/dsa/tag_mt7628.c b/net/dsa/tag_mt7628.c
index 80b50ff08e53f..7c71e8b086481 100644
--- a/net/dsa/tag_mt7628.c
+++ b/net/dsa/tag_mt7628.c
@@ -6,6 +6,7 @@
#include <linux/etherdevice.h>
#include <linux/dsa/8021q.h>
+#include <linux/if_vlan.h>
#include <net/dsa.h>
#include "tag.h"
@@ -15,13 +16,16 @@
* On TX the lower 6 bits encode the destination port bitmask.
* On RX the lower 3 bits encode the source port number.
*
- * The switch hardware will not modify the TPID of an incoming packet if it is
- * already VLAN tagged. To work around this the switch is configured to always
- * append a tag_8021q standalone VLAN tag for each port. That means we can
- * safely strip the outer VLAN tag after parsing it.
+ * The switch can only use VLANs for forwarding control. VLAN-unaware bridges
+ * are simulated using tag_8021q and double tagging, while VLAN-aware bridges
+ * use the VLANs configured by the bridge directly.
*
- * A VLAN tag is constructed on egress to target the standalone VLAN and
- * destination port.
+ * On egress, the tagger either adds a new MT7628 tag that contains the
+ * standalone or bridge tag_8021q VLAN and destination port mask, or modifies
+ * an existing VLAN tag to contain the destination port mask.
+ *
+ * On ingress, the VLAN tag is restored after stripping the MT7628 tag, if it
+ * is not a tag_8021q VLAN.
*/
#define MT7628_TAG_NAME "mt7628"
@@ -34,20 +38,35 @@ static struct sk_buff *mt7628_tag_xmit(struct sk_buff *skb,
struct net_device *dev)
{
struct dsa_port *dp;
+ u16 xmit_tpid;
u16 xmit_vlan;
__be16 *tag;
+ xmit_tpid =
+ ETH_P_8021Q | FIELD_PREP(MT7628_TAG_TX_PORT,
+ dsa_xmit_port_mask(skb, dev));
dp = dsa_user_to_port(dev);
- xmit_vlan = dsa_tag_8021q_standalone_vid(dp);
+ if (skb->offload_fwd_mark &&
+ br_vlan_enabled(dsa_port_bridge_dev_get(dp))) {
+ /*
+ * On VLAN aware ports only modify the TPID to contain the
+ * MT7628 egress port metadata, instead of adding a new vlan tag
+ */
+ tag = dsa_etype_header_pos_tx(skb);
+ tag[0] = htons(xmit_tpid);
+ return skb;
+ }
+
+ xmit_vlan = skb->offload_fwd_mark ?
+ dsa_tag_8021q_bridge_vid(dsa_port_bridge_num_get(dp)) :
+ dsa_tag_8021q_standalone_vid(dp);
skb_push(skb, MT7628_TAG_LEN);
dsa_alloc_etype_header(skb, MT7628_TAG_LEN);
tag = dsa_etype_header_pos_tx(skb);
- tag[0] = htons(ETH_P_8021Q |
- FIELD_PREP(MT7628_TAG_TX_PORT,
- dsa_xmit_port_mask(skb, dev)));
+ tag[0] = htons(xmit_tpid);
tag[1] = htons(xmit_vlan);
return skb;
@@ -56,7 +75,10 @@ static struct sk_buff *mt7628_tag_xmit(struct sk_buff *skb,
static struct sk_buff *mt7628_tag_rcv(struct sk_buff *skb,
struct net_device *dev)
{
+ unsigned int source_port;
+ bool is_dsa_8021q;
__be16 *phdr;
+ u16 tci, vid;
if (unlikely(!pskb_may_pull(skb, MT7628_TAG_LEN))) {
kfree_skb(skb);
@@ -64,9 +86,23 @@ static struct sk_buff *mt7628_tag_rcv(struct sk_buff *skb,
}
phdr = dsa_etype_header_pos_rx(skb);
- skb->dev =
- dsa_conduit_find_user(dev, 0,
- FIELD_GET(MT7628_TAG_RX_PORT, ntohs(*phdr)));
+ source_port = FIELD_GET(MT7628_TAG_RX_PORT, ntohs(*phdr));
+ tci = ntohs(phdr[1]);
+ vid = tci & VLAN_VID_MASK;
+ is_dsa_8021q = vid_is_dsa_8021q(vid);
+
+ /*
+ * The source port info is only encoded in the TPID field for packets
+ * where the VLAN tag is inserted by the PVID mechanism. With VLAN
+ * filtering enabled, VLAN-tagged ingress packets appear as if they're
+ * originating on port 0. Use the VID to identify the bridge port in
+ * this case.
+ */
+ if (source_port == 0 && !is_dsa_8021q)
+ skb->dev = dsa_find_designated_bridge_port_by_vid(dev, vid);
+ else
+ skb->dev = dsa_conduit_find_user(dev, 0, source_port);
+
if (!skb->dev) {
kfree_skb(skb);
return NULL;
@@ -75,6 +111,10 @@ static struct sk_buff *mt7628_tag_rcv(struct sk_buff *skb,
skb_pull_rcsum(skb, MT7628_TAG_LEN);
dsa_strip_etype_header(skb, MT7628_TAG_LEN);
dsa_default_offload_fwd_mark(skb);
+
+ if (!is_dsa_8021q)
+ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), tci);
+
return skb;
}
|
| 3/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10373 output: 25 thoughts: 126 Thoughts: **Evaluating this Patch Series** Okay, so the user wants me to take a look at this patch series. My first step is always to get a lay of the land – what's actually being modified? I see three files were touched: `MAINTAINERS`, `drivers/net/dsa/mt7628.c`, and `net/dsa/tag_mt7628.c`. Right, so we're dealing with the `mt7628` DSA switch driver. I need to quickly assess the hardware reachability and the driver's type – what kind of tags are we talking about in `net/dsa/tag_mt7628.c`? That's critical for understanding the scope of the change. Then, I need to dive into `drivers/net/dsa/mt7628.c` itself. I'll be looking closely at the Kconfig options and platform bindings. That'll tell me how this driver is configured, its dependencies, and what hardware it's meant to support. Time to dig in and see if this all checks out. |
| 4/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "CONFIG_NET_DSA_MT7628"
}Results: {
"Output": "drivers/net/dsa/Makefile=8=obj-$(CONFIG_NET_DSA_MT7530_MMIO) += mt7530-mmio.o\ndrivers/net/dsa/Makefile:9:obj-$(CONFIG_NET_DSA_MT7628) += mt7628.o\ndrivers/net/dsa/Makefile-10-obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o\n"
} |
| 5/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10895 output: 35 thoughts: 51 Thoughts: Okay, let's see, I need to jog my memory on the MT7628 support within the DSA driver framework. My initial thought is to dive right into the `Kconfig` files – a good starting point. I'll need to confirm the definitions. First, I need to check `drivers/net/dsa/Kconfig` for the `NET_DSA_MT7628` symbol. That's likely where the core support for the hardware is defined. Then, just to be thorough and because it's always a good practice to cross-reference related configurations, I should also immediately look in `net/dsa/Kconfig`. I'll be searching there for `NET_DSA_TAG_MT7628`. This tag might be specific to the MT7628's particular tagging scheme, so I should see if it exists. This should give me a solid overview of how it's enabled and configured within the overall DSA system. I'll get a clear picture by checking these files. |
| 6/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "NET_DSA_MT7628",
"PathPrefix": "drivers/net/dsa"
}Results: {
"Output": "drivers/net/dsa/Kconfig=54=config NET_DSA_MT7530_MMIO\n--\ndrivers/net/dsa/Kconfig-65-\ndrivers/net/dsa/Kconfig:66:config NET_DSA_MT7628\ndrivers/net/dsa/Kconfig-67-\ttristate \"MediaTek MT7628 Embedded Ethernet switch support\"\n--\ndrivers/net/dsa/Makefile=8=obj-$(CONFIG_NET_DSA_MT7530_MMIO) += mt7530-mmio.o\ndrivers/net/dsa/Makefile:9:obj-$(CONFIG_NET_DSA_MT7628) += mt7628.o\ndrivers/net/dsa/Makefile-10-obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o\n"
} |
| 7/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 11430 output: 36 thoughts: 30 Thoughts: Here's my summary, as though I'm thinking through this process: **Diving into DSA Kconfig for Configuration Insights** Okay, time to get my hands dirty. I need to understand the configuration options related to DSA (Distributed Switch Architecture) in the kernel. My first step is to zero in on the relevant Kconfig files. I'm going to start by taking a close look at `drivers/net/dsa/Kconfig`, specifically around line 66. That area's usually a good place to start for core DSA functionality. I'll also double-check the `net/dsa/Kconfig` file in the root net directory because there might be some broader DSA settings there, or some includes that will direct me to the correct place. I'm hoping to get a clear picture of the configurable modules, dependencies, and any potentially interesting options that are available. From here, I can get a better handle on the architecture. |
| 8/2 | 2026/09/07 01:52 | tool | read-file |
0mArgs:{
"File": "drivers/net/dsa/Kconfig",
"FirstLine": 60,
"LineCount": 30
}Results: {
"Contents": " 60:\t\t This enables support for the built-in Ethernet switch found\n 61:\t\t in the MediaTek MT7988 SoC.\n 62:\t\t The switch is a similar design as MT7531, but the switch registers\n 63:\t\t are directly mapped into the SoCs register space rather than being\n 64:\t\t accessible via MDIO.\n 65:\t\n 66:\tconfig NET_DSA_MT7628\n 67:\t\ttristate \"MediaTek MT7628 Embedded Ethernet switch support\"\n 68:\t\tdepends on HAS_IOMEM \u0026\u0026 (SOC_MT7620 || COMPILE_TEST)\n 69:\t\tselect NET_DSA_TAG_MT7628\n 70:\t\tselect MEDIATEK_FE_SOC_PHY\n 71:\t\tselect REGMAP_MMIO\n 72:\t\thelp\n 73:\t\t This enables support for the built-in Ethernet switch found\n 74:\t\t in the MT7628 SoC.\n 75:\t\n 76:\tconfig NET_DSA_MV88E6060\n 77:\t\ttristate \"Marvell 88E6060 ethernet switch chip support\"\n 78:\t\tselect NET_DSA_TAG_TRAILER\n 79:\t\thelp\n 80:\t\t This enables support for the Marvell 88E6060 ethernet switch\n 81:\t\t chip.\n 82:\t\n 83:\tsource \"drivers/net/dsa/microchip/Kconfig\"\n 84:\t\n 85:\tsource \"drivers/net/dsa/motorcomm/Kconfig\"\n 86:\t\n 87:\tsource \"drivers/net/dsa/mv88e6xxx/Kconfig\"\n 88:\t\n 89:\tsource \"drivers/net/dsa/mxl862xx/Kconfig\"\n"
} |
| 9/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12182 output: 31 thoughts: 34 Thoughts: Okay, let's dive into this. Here's how I'd approach this task, as if these were my internal thoughts: **Investigating the MT7628 DSA Tagger** Alright, time to get my hands dirty. I need to understand the specifics of how the MT7628 is handled within the DSA framework. My immediate action is to head straight to the `net/dsa/Kconfig` file. That's the logical starting point – the Kconfig likely defines the configurations and dependencies related to this specific tagger, `NET_DSA_TAG_MT7628`. I'm going to look for how it's enabled, what other options or dependencies it has, and perhaps even some brief documentation snippets if I'm lucky. From there, I'll be able to better understand its overall role in the broader DSA architecture. This initial Kconfig inspection will quickly inform me about the visibility and potential complexity surrounding the MT7628's integration. After this, I'll know what to look for next. I'm keen to grasp the underlying DSA tagger functionality at play here. |
| 10/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "TAG_MT7628",
"PathPrefix": "net/dsa"
}Results: {
"Output": "net/dsa/Kconfig=94=config NET_DSA_TAG_EDSA\n--\nnet/dsa/Kconfig-100-\nnet/dsa/Kconfig:101:config NET_DSA_TAG_MT7628\nnet/dsa/Kconfig-102-\ttristate \"Tag driver for the MT7628 embedded switch\"\n--\nnet/dsa/Makefile=29=obj-$(CONFIG_NET_DSA_TAG_LAN9303) += tag_lan9303.o\nnet/dsa/Makefile:30:obj-$(CONFIG_NET_DSA_TAG_MT7628) += tag_mt7628.o\nnet/dsa/Makefile-31-obj-$(CONFIG_NET_DSA_TAG_MTK) += tag_mtk.o\n"
} |
| 11/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12700 output: 34 thoughts: 20 Thoughts: Here's my take on the thought process, as requested: **Navigating the Kconfig Labyrinth** Okay, so I'm diving into this DSA configuration, and the first place my brain naturally goes is the `net/dsa/Kconfig` file. I'm specifically zeroing in around line 101 – that's often a good starting point for a reason, if I recall. Probably some related configuration option is defined there. It's time to dig in and see what's what. Let's get to it. |
| 12/2 | 2026/09/07 01:52 | tool | read-file |
0mArgs:{
"File": "net/dsa/Kconfig",
"FirstLine": 95,
"LineCount": 20
}Results: {
"Contents": " 95:\t\ttristate \"Tag driver for Marvell switches using EtherType DSA headers\"\n 96:\t\tselect NET_DSA_TAG_DSA_COMMON\n 97:\t\thelp\n 98:\t\t Say Y or M if you want to enable support for tagging frames for the\n 99:\t\t Marvell switches which use EtherType DSA headers.\n 100:\t\n 101:\tconfig NET_DSA_TAG_MT7628\n 102:\t\ttristate \"Tag driver for the MT7628 embedded switch\"\n 103:\t\thelp\n 104:\t\t Say Y or M if you want to enable support for tagging frames for the\n 105:\t\t switch embedded in the MT7628 SoC.\n 106:\t\n 107:\tconfig NET_DSA_TAG_MTK\n 108:\t\ttristate \"Tag driver for Mediatek switches\"\n 109:\t\thelp\n 110:\t\t Say Y or M if you want to enable support for tagging frames for\n 111:\t\t Mediatek switches.\n 112:\t\n 113:\tconfig NET_DSA_TAG_MXL_862XX\n 114:\t\ttristate \"Tag driver for MaxLinear MxL862xx switches\"\n"
} |
| 13/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13205 output: 37 thoughts: 97 Thoughts: **Investigating MT7628 and Virtualization** Okay, let's take a look at this `drivers/net/dsa/mt7628.c` file. Right, it's a platform driver specifically for the MT7628 SoC's embedded switch. My immediate question is: can I realistically leverage DSA switches or taggers, like the one this driver likely manages, in a standard virtualized environment? I'm thinking QEMU or a typical amd64 setup. That's the real challenge here. Before I jump too far down that rabbit hole, hold on... is this truly a platform driver? Best to double-check against the contents of `mt7628.c` directly to be sure. It's easy to assume, but making that assumption would lead me astray. Let's make sure. |
| 14/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "platform_driver",
"PathPrefix": "drivers/net/dsa/mt7628.c"
}Results: {
"Output": "drivers/net/dsa/mt7628.c=833=MODULE_DEVICE_TABLE(of, mt7628_of_match);\ndrivers/net/dsa/mt7628.c-834-\ndrivers/net/dsa/mt7628.c:835:static struct platform_driver mt7628_driver = {\ndrivers/net/dsa/mt7628.c-836-\t.driver = {\n--\ndrivers/net/dsa/mt7628.c-844-\ndrivers/net/dsa/mt7628.c:845:module_platform_driver(mt7628_driver);\ndrivers/net/dsa/mt7628.c-846-\n"
} |
| 15/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13726 output: 42 thoughts: 42 Thoughts: Here's my summary, as if I were thinking it: **Digging into the MT7628 DSA Driver** Okay, time to get my hands dirty. I need to refresh my memory on how the MT7628 is handled within the DSA framework. My immediate target is the `drivers/net/dsa/mt7628.c` file. I'll need to zero in on the `mt7628_probe` function - that's where the initial device setup happens, right? And I should probably review `mt7628_of_match` as well, just to be certain I understand the device tree binding and how the system identifies the MT7628 hardware in the first place. This'll probably give me a good handle on any power-on issues and initial hardware setup and how this driver is being called by the system. Let's see what we can find. |
| 16/2 | 2026/09/07 01:52 | tool | read-file |
0mArgs:{
"File": "drivers/net/dsa/mt7628.c",
"FirstLine": 815,
"LineCount": 40
}Results: {
"Contents": " 815:\t}\n 816:\t\n 817:\tstatic void mt7628_shutdown(struct platform_device *pdev)\n 818:\t{\n 819:\t\tstruct mt7628_esw *esw = platform_get_drvdata(pdev);\n 820:\t\n 821:\t\tif (!esw)\n 822:\t\t\treturn;\n 823:\t\n 824:\t\tdsa_switch_shutdown(esw-\u003eds);\n 825:\t\tdev_set_drvdata(\u0026pdev-\u003edev, NULL);\n 826:\t}\n 827:\t\n 828:\tstatic const struct of_device_id mt7628_of_match[] = {\n 829:\t\t{ .compatible = \"mediatek,mt7628-esw\" },\n 830:\t\t{}\n 831:\t};\n 832:\t\n 833:\tMODULE_DEVICE_TABLE(of, mt7628_of_match);\n 834:\t\n 835:\tstatic struct platform_driver mt7628_driver = {\n 836:\t\t.driver = {\n 837:\t\t\t .name = \"mt7628-esw\",\n 838:\t\t\t .of_match_table = mt7628_of_match,\n 839:\t\t\t },\n 840:\t\t.probe = mt7628_probe,\n 841:\t\t.remove = mt7628_remove,\n 842:\t\t.shutdown = mt7628_shutdown,\n 843:\t};\n 844:\t\n 845:\tmodule_platform_driver(mt7628_driver);\n 846:\t\n 847:\tMODULE_AUTHOR(\"Joris Vaisvila \u003cjoey@tinyisr.com\u003e\");\n 848:\tMODULE_DESCRIPTION(\"Driver for Mediatek MT7628 embedded switch\");\n 849:\tMODULE_LICENSE(\"GPL\");\n"
} |
| 17/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 14544 output: 25 thoughts: 101 Thoughts: **Investigating the `mt7628` Platform Driver and DSA Tagging** Okay, so I'm digging into this `mt7628` thing. From what I see, it's using the `"mediatek,mt7628-esw"` of_device_id. My first thought is, is this DSA stuff, specifically in `tag_mt7628.c`, something that can be tweaked from user space? Could someone manipulate it via a mock DSA setup, Netlink, or even something like syzkaller? That's the real question. I need to understand if the DSA tagger itself is loadable, if there's a selection mechanism at play here. This makes me consider how DSA tagging *actually* works within the Linux kernel. Time to delve into the DSA tagging protocols themselves, I suppose. Gotta get a solid handle on how this all fits together. |
| 18/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "DSA_TAG_PROTO_MT7628"
}Results: {
"Output": "drivers/net/dsa/mt7628.c=588=mt7628_get_tag_proto(struct dsa_switch *ds, int port, enum dsa_tag_protocol mp)\ndrivers/net/dsa/mt7628.c-589-{\ndrivers/net/dsa/mt7628.c:590:\treturn DSA_TAG_PROTO_MT7628;\ndrivers/net/dsa/mt7628.c-591-}\n--\ninclude/net/dsa.h=26=struct tc_action;\n--\ninclude/net/dsa.h-62-#define DSA_TAG_PROTO_KSZ8463_VALUE\t\t34\ninclude/net/dsa.h:63:#define DSA_TAG_PROTO_MT7628_VALUE\t\t35\ninclude/net/dsa.h-64-\ninclude/net/dsa.h=65=enum dsa_tag_protocol {\n--\ninclude/net/dsa.h-100-\tDSA_TAG_PROTO_KSZ8463\t\t= DSA_TAG_PROTO_KSZ8463_VALUE,\ninclude/net/dsa.h:101:\tDSA_TAG_PROTO_MT7628\t\t= DSA_TAG_PROTO_MT7628_VALUE,\ninclude/net/dsa.h-102-};\n--\nnet/dsa/tag_mt7628.c=121=static const struct dsa_device_ops mt7628_tag_ops = {\nnet/dsa/tag_mt7628.c-122-\t.name = MT7628_TAG_NAME,\nnet/dsa/tag_mt7628.c:123:\t.proto = DSA_TAG_PROTO_MT7628,\nnet/dsa/tag_mt7628.c-124-\t.xmit = mt7628_tag_xmit,\n--\nnet/dsa/tag_mt7628.c=129=module_dsa_tag_driver(mt7628_tag_ops);\nnet/dsa/tag_mt7628.c-130-\nnet/dsa/tag_mt7628.c:131:MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_MT7628, MT7628_TAG_NAME);\nnet/dsa/tag_mt7628.c-132-MODULE_DESCRIPTION(\"DSA tag driver for MT7628 switch\");\n"
} |
| 19/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 15518 output: 29 thoughts: 49 Thoughts: **Investigating DSA Tagging Protocol Modification** Okay, so I'm digging into DSA (Distributed Switch Architecture) and I'm wondering: can I *dynamically* manipulate the DSA tagging protocol? Can I do this through the usual suspects – sysfs, netlink, ethtool, or even at the netdev level? I'm thinking about scenarios where I might need a DSA mock interface, a dummy setup, a loopback, or even something like netkit for testing. The core question is, how *exactly* does the system decide which DSA tag protocol to use, and, crucially, can I *influence* that selection or even force a change at runtime? Time to fire up the search engine and delve into how DSA tag protocols are chosen and if that choice is modifiable on the fly. Let's see what the documentation and community discussions have to say. |
| 20/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "change_tag_protocol",
"PathPrefix": "net/dsa"
}Results: {
"Output": "net/dsa/dsa.c=570=static int dsa_switch_setup_tag_protocol(struct dsa_switch *ds)\n--\nnet/dsa/dsa.c-579-\trtnl_lock();\nnet/dsa/dsa.c:580:\terr = ds-\u003eops-\u003echange_tag_protocol(ds, tag_ops-\u003eproto);\nnet/dsa/dsa.c-581-\trtnl_unlock();\n--\nnet/dsa/dsa.c=1155=static int dsa_port_parse_cpu(struct dsa_port *dp, struct net_device *conduit,\n--\nnet/dsa/dsa.c-1176-\tif (user_protocol) {\nnet/dsa/dsa.c:1177:\t\tif (!ds-\u003eops-\u003echange_tag_protocol) {\nnet/dsa/dsa.c-1178-\t\t\tdev_err(ds-\u003edev, \"Tag protocol cannot be modified\\n\");\n--\nnet/dsa/dsa.c-1230-\t * dsa_switch_setup_tag_protocol once .setup has run and the\nnet/dsa/dsa.c:1231:\t * driver is ready to accept calls to .change_tag_protocol. If\nnet/dsa/dsa.c-1232-\t * the driver does not support the custom protocol at that\n--\nnet/dsa/switch.c=873=static int dsa_switch_change_tag_proto(struct dsa_switch *ds,\n--\nnet/dsa/switch.c-879-\nnet/dsa/switch.c:880:\tif (!ds-\u003eops-\u003echange_tag_protocol)\nnet/dsa/switch.c-881-\t\treturn -EOPNOTSUPP;\n--\nnet/dsa/switch.c-884-\nnet/dsa/switch.c:885:\terr = ds-\u003eops-\u003echange_tag_protocol(ds, tag_ops-\u003eproto);\nnet/dsa/switch.c-886-\tif (err)\n"
} |
| 21/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 16313 output: 34 thoughts: 47 Thoughts: Here's my take on those thoughts: **Analyzing the `dsa_switch_change_tag_proto` Callers** Okay, so I'm looking at `dsa_switch_change_tag_proto`. The key question is, *where* is this function being invoked? Is this something triggered by a user space interaction, like a sysfs entry, a netlink message, or maybe even something more dev-oriented like debugfs? Time to dig into the call graph. Need to find out all the functions that directly or indirectly call `dsa_switch_change_tag_proto`. This'll give me a good handle on its typical usage scenario and potentially expose some interesting edge cases or subtle dependencies in the DSA subsystem. Hopefully, the call stack will be easy to trace! |
| 22/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "dsa_switch_change_tag_proto",
"PathPrefix": "net/dsa"
}Results: {
"Output": "net/dsa/switch.c=853=static int dsa_switch_host_vlan_del(struct dsa_switch *ds,\n--\nnet/dsa/switch.c-872-\nnet/dsa/switch.c:873:static int dsa_switch_change_tag_proto(struct dsa_switch *ds,\nnet/dsa/switch.c-874-\t\t\t\t struct dsa_notifier_tag_proto_info *info)\n--\nnet/dsa/switch.c=974=static int dsa_switch_event(struct notifier_block *nb,\n--\nnet/dsa/switch.c-1044-\tcase DSA_NOTIFIER_TAG_PROTO:\nnet/dsa/switch.c:1045:\t\terr = dsa_switch_change_tag_proto(ds, info);\nnet/dsa/switch.c-1046-\t\tbreak;\n"
} |
| 23/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 16802 output: 32 thoughts: 58 Thoughts: Here's my summary, as if I were thinking these thoughts: **Analyzing the DSA Tag Protocol Notifier** Okay, so I need to get a handle on this `DSA_NOTIFIER_TAG_PROTO` event. It seems like it's triggered by a few different sources – specifically, `dsa_port_change_tag_proto`, `dsa_conduit_setup`, or potentially, something happening through sysfs. My next step is clear: I need to dig directly into the `DSA_NOTIFIER_TAG_PROTO` definition itself. That's where the answers are going to lie. I need to understand the conditions that cause that notifier to fire and what data it's passing along. Time to dive into the code. |
| 24/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "DSA_NOTIFIER_TAG_PROTO",
"PathPrefix": "net/dsa"
}Results: {
"Output": "net/dsa/dsa.c=948=static int dsa_tree_bind_tag_proto(struct dsa_switch_tree *dst,\n--\nnet/dsa/dsa.c-960-\tinfo.tag_ops = tag_ops;\nnet/dsa/dsa.c:961:\terr = dsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO_CONNECT, \u0026info);\nnet/dsa/dsa.c-962-\tif (err \u0026\u0026 err != -EOPNOTSUPP)\n--\nnet/dsa/dsa.c-966-\tinfo.tag_ops = old_tag_ops;\nnet/dsa/dsa.c:967:\tdsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO_DISCONNECT, \u0026info);\nnet/dsa/dsa.c-968-\n--\nnet/dsa/dsa.c-972-\tinfo.tag_ops = tag_ops;\nnet/dsa/dsa.c:973:\tdsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO_DISCONNECT, \u0026info);\nnet/dsa/dsa.c-974-\tdst-\u003etag_ops = old_tag_ops;\n--\nnet/dsa/dsa.c=983=int dsa_tree_change_tag_proto(struct dsa_switch_tree *dst,\n--\nnet/dsa/dsa.c-1008-\tinfo.tag_ops = tag_ops;\nnet/dsa/dsa.c:1009:\terr = dsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO, \u0026info);\nnet/dsa/dsa.c-1010-\tif (err)\n--\nnet/dsa/dsa.c-1022-\tinfo.tag_ops = old_tag_ops;\nnet/dsa/dsa.c:1023:\tdsa_tree_notify(dst, DSA_NOTIFIER_TAG_PROTO, \u0026info);\nnet/dsa/dsa.c-1024-out_unlock:\n--\nnet/dsa/switch.c=974=static int dsa_switch_event(struct notifier_block *nb,\n--\nnet/dsa/switch.c-1043-\t\tbreak;\nnet/dsa/switch.c:1044:\tcase DSA_NOTIFIER_TAG_PROTO:\nnet/dsa/switch.c-1045-\t\terr = dsa_switch_change_tag_proto(ds, info);\nnet/dsa/switch.c-1046-\t\tbreak;\nnet/dsa/switch.c:1047:\tcase DSA_NOTIFIER_TAG_PROTO_CONNECT:\nnet/dsa/switch.c-1048-\t\terr = dsa_switch_connect_tag_proto(ds, info);\nnet/dsa/switch.c-1049-\t\tbreak;\nnet/dsa/switch.c:1050:\tcase DSA_NOTIFIER_TAG_PROTO_DISCONNECT:\nnet/dsa/switch.c-1051-\t\terr = dsa_switch_disconnect_tag_proto(ds, info);\n--\nnet/dsa/switch.h=10=enum {\n--\nnet/dsa/switch.h-31-\tDSA_NOTIFIER_MTU,\nnet/dsa/switch.h:32:\tDSA_NOTIFIER_TAG_PROTO,\nnet/dsa/switch.h:33:\tDSA_NOTIFIER_TAG_PROTO_CONNECT,\nnet/dsa/switch.h:34:\tDSA_NOTIFIER_TAG_PROTO_DISCONNECT,\nnet/dsa/switch.h-35-\tDSA_NOTIFIER_TAG_8021Q_VLAN_ADD,\n--\nnet/dsa/switch.h=92=struct dsa_notifier_mtu_info {\n--\nnet/dsa/switch.h-96-\nnet/dsa/switch.h:97:/* DSA_NOTIFIER_TAG_PROTO_* */\nnet/dsa/switch.h-98-struct dsa_notifier_tag_proto_info {\n"
} |
| 25/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18105 output: 34 thoughts: 21 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Tracing the Call Sites of `dsa_tree_change_tag_proto`** Okay, so I need to understand the impact of `dsa_tree_change_tag_proto`. The best way to do that, of course, is to figure out *where* it's actually being used. I need to trace its call sites. What modules or functions are calling into this particular function? Is it a core library call, a user-space utility, something in the middle? This will give me immediate insight into what depends on it and how changing it might break things. I need to find the calling context to understand its purpose and, potentially, its limitations. Let's start digging. |
| 26/2 | 2026/09/07 01:52 | tool | grepper |
0mArgs:{
"Expression": "dsa_tree_change_tag_proto",
"PathPrefix": "net/dsa"
}Results: {
"Output": "net/dsa/conduit.c=350=static ssize_t tagging_store(struct device *d, struct device_attribute *attr,\n--\nnet/dsa/conduit.c-380-\nnet/dsa/conduit.c:381:\terr = dsa_tree_change_tag_proto(cpu_dp-\u003eds-\u003edst, new_tag_ops,\nnet/dsa/conduit.c-382-\t\t\t\t\told_tag_ops);\n--\nnet/dsa/dsa.c=948=static int dsa_tree_bind_tag_proto(struct dsa_switch_tree *dst,\n--\nnet/dsa/dsa.c-982- */\nnet/dsa/dsa.c:983:int dsa_tree_change_tag_proto(struct dsa_switch_tree *dst,\nnet/dsa/dsa.c-984-\t\t\t const struct dsa_device_ops *tag_ops,\n--\nnet/dsa/dsa.h=24=struct net_device *dsa_tree_find_first_conduit(struct dsa_switch_tree *dst);\nnet/dsa/dsa.h:25:int dsa_tree_change_tag_proto(struct dsa_switch_tree *dst,\nnet/dsa/dsa.h-26-\t\t\t const struct dsa_device_ops *tag_ops,\n--\nnet/dsa/switch.c=873=static int dsa_switch_change_tag_proto(struct dsa_switch *ds,\n--\nnet/dsa/switch.c-900-\nnet/dsa/switch.c:901:\t\t/* rtnl_mutex is held in dsa_tree_change_tag_proto */\nnet/dsa/switch.c-902-\t\tdsa_user_change_mtu(user, user-\u003emtu);\n"
} |
| 27/2 | 2026/09/07 01:52 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18807 output: 24 thoughts: 45 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: **Kernel DSA Inquiry** Hmm, wait a minute. Before I dive too deep into anything involving DSA, I need to take a step back and make sure I'm grounded in the essentials. My immediate thought is, "Do we even have a virtual or mock DSA switch representation within the Linux kernel itself?" I need to verify what the kernel offers as a foundation. It's too easy to assume, and I've been caught out by assumptions before. So, let's head straight to the source. The obvious place to look for DSA driver implementations is under `drivers/net/dsa`. That directory is the logical location for all things DSA. I’ll start there, and hope I can quickly find any sign of virtual or mock switch drivers. This initial search should quickly clear the ground for further investigation. It's a fundamental check before considering any kind of specific implementation strategy. |
| 28/2 | 2026/09/07 01:53 | tool | codesearch-dir-index |
0mArgs:{
"Dir": "drivers/net/dsa"
}Results: {
"Files": [
"bcm_sf2.c",
"bcm_sf2.h",
"bcm_sf2_cfp.c",
"bcm_sf2_regs.h",
"dsa_loop.c",
"ks8995.c",
"lan9303-core.c",
"lan9303.h",
"lan9303_i2c.c",
"lan9303_mdio.c",
"mt7530-mdio.c",
"mt7530-mmio.c",
"mt7530.c",
"mt7530.h",
"mt7628.c",
"mv88e6060.c",
"mv88e6060.h",
"rzn1_a5psw.c",
"rzn1_a5psw.h",
"vitesse-vsc73xx-core.c",
"vitesse-vsc73xx-platform.c",
"vitesse-vsc73xx-spi.c",
"vitesse-vsc73xx.h"
],
"Subdirs": [
"b53",
"hirschmann",
"lantiq",
"microchip",
"motorcomm",
"mv88e6xxx",
"mxl862xx",
"netc",
"ocelot",
"qca",
"realtek",
"sja1105",
"xrs700x"
]
} |
| 29/2 | 2026/09/07 01:53 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 19458 output: 30 thoughts: 23 Thoughts: Here's my take on the thought process, as requested: **Diving into `dsa_loop.c`** Okay, let's zero in on `dsa_loop.c`. That file is where I need to focus my attention. It's the key to understanding this particular area, so I need to get a firm grasp of its logic and implementation. Right now, *that* is the code I need to analyze. |
| 30/2 | 2026/09/07 01:53 | tool | grepper |
0mArgs:{
"Expression": "dsa_loop",
"PathPrefix": "drivers/net/dsa"
}Results: {
"Output": "drivers/net/dsa/Makefile=3=bcm-sf2-objs\t\t\t:= bcm_sf2.o bcm_sf2_cfp.o\ndrivers/net/dsa/Makefile:4:obj-$(CONFIG_NET_DSA_LOOP)\t+= dsa_loop.o\ndrivers/net/dsa/Makefile-5-obj-$(CONFIG_NET_DSA_KS8995) \t+= ks8995.o\n--\ndrivers/net/dsa/dsa_loop.c-24-\ndrivers/net/dsa/dsa_loop.c:25:struct dsa_loop_vlan {\ndrivers/net/dsa/dsa_loop.c-26-\tu16 members;\n--\ndrivers/net/dsa/dsa_loop.c-29-\ndrivers/net/dsa/dsa_loop.c:30:struct dsa_loop_mib_entry {\ndrivers/net/dsa/dsa_loop.c-31-\tchar name[ETH_GSTRING_LEN];\n--\ndrivers/net/dsa/dsa_loop.c-34-\ndrivers/net/dsa/dsa_loop.c:35:enum dsa_loop_mib_counters {\ndrivers/net/dsa/dsa_loop.c-36-\tDSA_LOOP_PHY_READ_OK,\n--\ndrivers/net/dsa/dsa_loop.c-42-\ndrivers/net/dsa/dsa_loop.c:43:struct dsa_loop_port {\ndrivers/net/dsa/dsa_loop.c:44:\tstruct dsa_loop_mib_entry mib[__DSA_LOOP_CNT_MAX];\ndrivers/net/dsa/dsa_loop.c-45-\tu16 pvid;\n--\ndrivers/net/dsa/dsa_loop.c-48-\ndrivers/net/dsa/dsa_loop.c:49:struct dsa_loop_priv {\ndrivers/net/dsa/dsa_loop.c-50-\tstruct mii_bus\t*bus;\ndrivers/net/dsa/dsa_loop.c-51-\tunsigned int\tport_base;\ndrivers/net/dsa/dsa_loop.c:52:\tstruct dsa_loop_vlan vlans[VLAN_N_VID];\ndrivers/net/dsa/dsa_loop.c-53-\tstruct net_device *netdev;\ndrivers/net/dsa/dsa_loop.c:54:\tstruct dsa_loop_port ports[DSA_MAX_PORTS];\ndrivers/net/dsa/dsa_loop.c-55-};\ndrivers/net/dsa/dsa_loop.c-56-\ndrivers/net/dsa/dsa_loop.c:57:struct dsa_loop_pdata {\ndrivers/net/dsa/dsa_loop.c-58-\t/* Must be first, such that dsa_register_switch() can access this\n--\ndrivers/net/dsa/dsa_loop.c-66-\ndrivers/net/dsa/dsa_loop.c:67:static struct dsa_loop_mib_entry dsa_loop_mibs[] = {\ndrivers/net/dsa/dsa_loop.c-68-\t[DSA_LOOP_PHY_READ_OK]\t= { \"phy_read_ok\", },\n--\ndrivers/net/dsa/dsa_loop.c=75=static struct mdio_device *switch_mdiodev;\ndrivers/net/dsa/dsa_loop.c-76-\ndrivers/net/dsa/dsa_loop.c:77:enum dsa_loop_devlink_resource_id {\ndrivers/net/dsa/dsa_loop.c-78-\tDSA_LOOP_DEVLINK_PARAM_ID_NONE, /* DEVLINK_RESOURCE_ID_PARENT_TOP */\n--\ndrivers/net/dsa/dsa_loop.c-81-\ndrivers/net/dsa/dsa_loop.c:82:static u64 dsa_loop_devlink_vtu_get(void *priv)\ndrivers/net/dsa/dsa_loop.c-83-{\ndrivers/net/dsa/dsa_loop.c:84:\tstruct dsa_loop_priv *ps = priv;\ndrivers/net/dsa/dsa_loop.c-85-\tunsigned int i, count = 0;\ndrivers/net/dsa/dsa_loop.c:86:\tstruct dsa_loop_vlan *vl;\ndrivers/net/dsa/dsa_loop.c-87-\n--\ndrivers/net/dsa/dsa_loop.c-96-\ndrivers/net/dsa/dsa_loop.c:97:static int dsa_loop_setup_devlink_resources(struct dsa_switch *ds)\ndrivers/net/dsa/dsa_loop.c-98-{\ndrivers/net/dsa/dsa_loop.c-99-\tstruct devlink_resource_size_params size_params;\ndrivers/net/dsa/dsa_loop.c:100:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-101-\tint err;\n--\ndrivers/net/dsa/dsa_loop.c-115-\t\t\t\t\t DSA_LOOP_DEVLINK_PARAM_ID_VTU,\ndrivers/net/dsa/dsa_loop.c:116:\t\t\t\t\t dsa_loop_devlink_vtu_get, ps);\ndrivers/net/dsa/dsa_loop.c-117-\n--\ndrivers/net/dsa/dsa_loop.c-124-\ndrivers/net/dsa/dsa_loop.c:125:static enum dsa_tag_protocol dsa_loop_get_protocol(struct dsa_switch *ds,\ndrivers/net/dsa/dsa_loop.c-126-\t\t\t\t\t\t int port,\n--\ndrivers/net/dsa/dsa_loop.c-133-\ndrivers/net/dsa/dsa_loop.c:134:static int dsa_loop_setup(struct dsa_switch *ds)\ndrivers/net/dsa/dsa_loop.c-135-{\ndrivers/net/dsa/dsa_loop.c:136:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-137-\tunsigned int i;\n--\ndrivers/net/dsa/dsa_loop.c-139-\tfor (i = 0; i \u003c ds-\u003enum_ports; i++)\ndrivers/net/dsa/dsa_loop.c:140:\t\tmemcpy(ps-\u003eports[i].mib, dsa_loop_mibs,\ndrivers/net/dsa/dsa_loop.c:141:\t\t sizeof(dsa_loop_mibs));\ndrivers/net/dsa/dsa_loop.c-142-\n--\ndrivers/net/dsa/dsa_loop.c-144-\ndrivers/net/dsa/dsa_loop.c:145:\treturn dsa_loop_setup_devlink_resources(ds);\ndrivers/net/dsa/dsa_loop.c-146-}\ndrivers/net/dsa/dsa_loop.c-147-\ndrivers/net/dsa/dsa_loop.c:148:static void dsa_loop_teardown(struct dsa_switch *ds)\ndrivers/net/dsa/dsa_loop.c-149-{\n--\ndrivers/net/dsa/dsa_loop.c-152-\ndrivers/net/dsa/dsa_loop.c:153:static int dsa_loop_get_sset_count(struct dsa_switch *ds, int port, int sset)\ndrivers/net/dsa/dsa_loop.c-154-{\n--\ndrivers/net/dsa/dsa_loop.c-160-\ndrivers/net/dsa/dsa_loop.c:161:static void dsa_loop_get_strings(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-162-\t\t\t\t u32 stringset, uint8_t *data)\ndrivers/net/dsa/dsa_loop.c-163-{\ndrivers/net/dsa/dsa_loop.c:164:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-165-\tunsigned int i;\n--\ndrivers/net/dsa/dsa_loop.c-173-\ndrivers/net/dsa/dsa_loop.c:174:static void dsa_loop_get_ethtool_stats(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-175-\t\t\t\t uint64_t *data)\ndrivers/net/dsa/dsa_loop.c-176-{\ndrivers/net/dsa/dsa_loop.c:177:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-178-\tunsigned int i;\n--\ndrivers/net/dsa/dsa_loop.c-183-\ndrivers/net/dsa/dsa_loop.c:184:static int dsa_loop_phy_read(struct dsa_switch *ds, int port, int regnum)\ndrivers/net/dsa/dsa_loop.c-185-{\ndrivers/net/dsa/dsa_loop.c:186:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-187-\tstruct mii_bus *bus = ps-\u003ebus;\n--\ndrivers/net/dsa/dsa_loop.c-198-\ndrivers/net/dsa/dsa_loop.c:199:static int dsa_loop_phy_write(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-200-\t\t\t int regnum, u16 value)\ndrivers/net/dsa/dsa_loop.c-201-{\ndrivers/net/dsa/dsa_loop.c:202:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-203-\tstruct mii_bus *bus = ps-\u003ebus;\n--\ndrivers/net/dsa/dsa_loop.c-214-\ndrivers/net/dsa/dsa_loop.c:215:static int dsa_loop_port_bridge_join(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-216-\t\t\t\t struct dsa_bridge bridge,\n--\ndrivers/net/dsa/dsa_loop.c-225-\ndrivers/net/dsa/dsa_loop.c:226:static void dsa_loop_port_bridge_leave(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-227-\t\t\t\t struct dsa_bridge bridge)\n--\ndrivers/net/dsa/dsa_loop.c-232-\ndrivers/net/dsa/dsa_loop.c:233:static void dsa_loop_port_stp_state_set(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-234-\t\t\t\t\tu8 state)\n--\ndrivers/net/dsa/dsa_loop.c-239-\ndrivers/net/dsa/dsa_loop.c:240:static int dsa_loop_port_vlan_filtering(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-241-\t\t\t\t\tbool vlan_filtering,\n--\ndrivers/net/dsa/dsa_loop.c-249-\ndrivers/net/dsa/dsa_loop.c:250:static int dsa_loop_port_vlan_add(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-251-\t\t\t\t const struct switchdev_obj_port_vlan *vlan,\n--\ndrivers/net/dsa/dsa_loop.c-255-\tbool pvid = vlan-\u003eflags \u0026 BRIDGE_VLAN_INFO_PVID;\ndrivers/net/dsa/dsa_loop.c:256:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-257-\tstruct mii_bus *bus = ps-\u003ebus;\ndrivers/net/dsa/dsa_loop.c:258:\tstruct dsa_loop_vlan *vl;\ndrivers/net/dsa/dsa_loop.c-259-\n--\ndrivers/net/dsa/dsa_loop.c-282-\ndrivers/net/dsa/dsa_loop.c:283:static int dsa_loop_port_vlan_del(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-284-\t\t\t\t const struct switchdev_obj_port_vlan *vlan)\n--\ndrivers/net/dsa/dsa_loop.c-286-\tbool untagged = vlan-\u003eflags \u0026 BRIDGE_VLAN_INFO_UNTAGGED;\ndrivers/net/dsa/dsa_loop.c:287:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-288-\tu16 pvid = ps-\u003eports[port].pvid;\ndrivers/net/dsa/dsa_loop.c-289-\tstruct mii_bus *bus = ps-\u003ebus;\ndrivers/net/dsa/dsa_loop.c:290:\tstruct dsa_loop_vlan *vl;\ndrivers/net/dsa/dsa_loop.c-291-\n--\ndrivers/net/dsa/dsa_loop.c-310-\ndrivers/net/dsa/dsa_loop.c:311:static int dsa_loop_port_change_mtu(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-312-\t\t\t\t int new_mtu)\ndrivers/net/dsa/dsa_loop.c-313-{\ndrivers/net/dsa/dsa_loop.c:314:\tstruct dsa_loop_priv *priv = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-315-\n--\ndrivers/net/dsa/dsa_loop.c-320-\ndrivers/net/dsa/dsa_loop.c:321:static int dsa_loop_port_max_mtu(struct dsa_switch *ds, int port)\ndrivers/net/dsa/dsa_loop.c-322-{\n--\ndrivers/net/dsa/dsa_loop.c-325-\ndrivers/net/dsa/dsa_loop.c:326:static void dsa_loop_phylink_get_caps(struct dsa_switch *dsa, int port,\ndrivers/net/dsa/dsa_loop.c-327-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/dsa_loop.c-333-\ndrivers/net/dsa/dsa_loop.c:334:static const struct dsa_switch_ops dsa_loop_driver = {\ndrivers/net/dsa/dsa_loop.c:335:\t.get_tag_protocol\t= dsa_loop_get_protocol,\ndrivers/net/dsa/dsa_loop.c:336:\t.setup\t\t\t= dsa_loop_setup,\ndrivers/net/dsa/dsa_loop.c:337:\t.teardown\t\t= dsa_loop_teardown,\ndrivers/net/dsa/dsa_loop.c:338:\t.get_strings\t\t= dsa_loop_get_strings,\ndrivers/net/dsa/dsa_loop.c:339:\t.get_ethtool_stats\t= dsa_loop_get_ethtool_stats,\ndrivers/net/dsa/dsa_loop.c:340:\t.get_sset_count\t\t= dsa_loop_get_sset_count,\ndrivers/net/dsa/dsa_loop.c:341:\t.get_ethtool_phy_stats\t= dsa_loop_get_ethtool_stats,\ndrivers/net/dsa/dsa_loop.c:342:\t.phy_read\t\t= dsa_loop_phy_read,\ndrivers/net/dsa/dsa_loop.c:343:\t.phy_write\t\t= dsa_loop_phy_write,\ndrivers/net/dsa/dsa_loop.c:344:\t.port_bridge_join\t= dsa_loop_port_bridge_join,\ndrivers/net/dsa/dsa_loop.c:345:\t.port_bridge_leave\t= dsa_loop_port_bridge_leave,\ndrivers/net/dsa/dsa_loop.c:346:\t.port_stp_state_set\t= dsa_loop_port_stp_state_set,\ndrivers/net/dsa/dsa_loop.c:347:\t.port_vlan_filtering\t= dsa_loop_port_vlan_filtering,\ndrivers/net/dsa/dsa_loop.c:348:\t.port_vlan_add\t\t= dsa_loop_port_vlan_add,\ndrivers/net/dsa/dsa_loop.c:349:\t.port_vlan_del\t\t= dsa_loop_port_vlan_del,\ndrivers/net/dsa/dsa_loop.c:350:\t.port_change_mtu\t= dsa_loop_port_change_mtu,\ndrivers/net/dsa/dsa_loop.c:351:\t.port_max_mtu\t\t= dsa_loop_port_max_mtu,\ndrivers/net/dsa/dsa_loop.c:352:\t.phylink_get_caps\t= dsa_loop_phylink_get_caps,\ndrivers/net/dsa/dsa_loop.c-353-};\ndrivers/net/dsa/dsa_loop.c-354-\ndrivers/net/dsa/dsa_loop.c:355:static int dsa_loop_drv_probe(struct mdio_device *mdiodev)\ndrivers/net/dsa/dsa_loop.c-356-{\ndrivers/net/dsa/dsa_loop.c:357:\tstruct dsa_loop_pdata *pdata = mdiodev-\u003edev.platform_data;\ndrivers/net/dsa/dsa_loop.c:358:\tstruct dsa_loop_priv *ps;\ndrivers/net/dsa/dsa_loop.c-359-\tstruct dsa_switch *ds;\n--\ndrivers/net/dsa/dsa_loop.c-382-\tds-\u003edev = \u0026mdiodev-\u003edev;\ndrivers/net/dsa/dsa_loop.c:383:\tds-\u003eops = \u0026dsa_loop_driver;\ndrivers/net/dsa/dsa_loop.c-384-\tds-\u003epriv = ps;\n--\ndrivers/net/dsa/dsa_loop.c-396-\ndrivers/net/dsa/dsa_loop.c:397:static void dsa_loop_drv_remove(struct mdio_device *mdiodev)\ndrivers/net/dsa/dsa_loop.c-398-{\ndrivers/net/dsa/dsa_loop.c-399-\tstruct dsa_switch *ds = dev_get_drvdata(\u0026mdiodev-\u003edev);\ndrivers/net/dsa/dsa_loop.c:400:\tstruct dsa_loop_priv *ps;\ndrivers/net/dsa/dsa_loop.c-401-\n--\ndrivers/net/dsa/dsa_loop.c-410-\ndrivers/net/dsa/dsa_loop.c:411:static void dsa_loop_drv_shutdown(struct mdio_device *mdiodev)\ndrivers/net/dsa/dsa_loop.c-412-{\n--\ndrivers/net/dsa/dsa_loop.c-422-\ndrivers/net/dsa/dsa_loop.c:423:static struct mdio_driver dsa_loop_drv = {\ndrivers/net/dsa/dsa_loop.c-424-\t.mdiodrv.driver\t= {\n--\ndrivers/net/dsa/dsa_loop.c-426-\t},\ndrivers/net/dsa/dsa_loop.c:427:\t.probe\t= dsa_loop_drv_probe,\ndrivers/net/dsa/dsa_loop.c:428:\t.remove\t= dsa_loop_drv_remove,\ndrivers/net/dsa/dsa_loop.c:429:\t.shutdown = dsa_loop_drv_shutdown,\ndrivers/net/dsa/dsa_loop.c-430-};\ndrivers/net/dsa/dsa_loop.c-431-\ndrivers/net/dsa/dsa_loop.c:432:static int dsa_loop_bus_match(struct device *dev,\ndrivers/net/dsa/dsa_loop.c-433-\t\t\t const struct device_driver *drv)\ndrivers/net/dsa/dsa_loop.c-434-{\ndrivers/net/dsa/dsa_loop.c:435:\treturn drv == \u0026dsa_loop_drv.mdiodrv.driver;\ndrivers/net/dsa/dsa_loop.c-436-}\ndrivers/net/dsa/dsa_loop.c-437-\ndrivers/net/dsa/dsa_loop.c:438:static void dsa_loop_phydevs_unregister(void)\ndrivers/net/dsa/dsa_loop.c-439-{\n--\ndrivers/net/dsa/dsa_loop.c-445-\ndrivers/net/dsa/dsa_loop.c:446:static int __init dsa_loop_create_switch_mdiodev(void)\ndrivers/net/dsa/dsa_loop.c-447-{\ndrivers/net/dsa/dsa_loop.c:448:\tstatic struct dsa_loop_pdata dsa_loop_pdata = {\ndrivers/net/dsa/dsa_loop.c-449-\t\t.cd = {\n--\ndrivers/net/dsa/dsa_loop.c-470-\ndrivers/net/dsa/dsa_loop.c:471:\tswitch_mdiodev-\u003ebus_match = dsa_loop_bus_match;\ndrivers/net/dsa/dsa_loop.c:472:\tswitch_mdiodev-\u003edev.platform_data = \u0026dsa_loop_pdata;\ndrivers/net/dsa/dsa_loop.c-473-\n--\ndrivers/net/dsa/dsa_loop.c-481-\ndrivers/net/dsa/dsa_loop.c:482:static int __init dsa_loop_init(void)\ndrivers/net/dsa/dsa_loop.c-483-{\n--\ndrivers/net/dsa/dsa_loop.c-486-\ndrivers/net/dsa/dsa_loop.c:487:\tret = dsa_loop_create_switch_mdiodev();\ndrivers/net/dsa/dsa_loop.c-488-\tif (ret)\n--\ndrivers/net/dsa/dsa_loop.c-493-\ndrivers/net/dsa/dsa_loop.c:494:\tret = mdio_driver_register(\u0026dsa_loop_drv);\ndrivers/net/dsa/dsa_loop.c-495-\tif (ret) {\ndrivers/net/dsa/dsa_loop.c:496:\t\tdsa_loop_phydevs_unregister();\ndrivers/net/dsa/dsa_loop.c-497-\t\tmdio_device_remove(switch_mdiodev);\n--\ndrivers/net/dsa/dsa_loop.c-502-}\ndrivers/net/dsa/dsa_loop.c:503:module_init(dsa_loop_init);\ndrivers/net/dsa/dsa_loop.c-504-\ndrivers/net/dsa/dsa_loop.c:505:static void __exit dsa_loop_exit(void)\ndrivers/net/dsa/dsa_loop.c-506-{\ndrivers/net/dsa/dsa_loop.c:507:\tmdio_driver_unregister(\u0026dsa_loop_drv);\ndrivers/net/dsa/dsa_loop.c:508:\tdsa_loop_phydevs_unregister();\ndrivers/net/dsa/dsa_loop.c-509-\tmdio_device_remove(switch_mdiodev);\n--\ndrivers/net/dsa/dsa_loop.c-511-}\ndrivers/net/dsa/dsa_loop.c:512:module_exit(dsa_loop_exit);\ndrivers/net/dsa/dsa_loop.c-513-\n"
} |
| 31/2 | 2026/09/07 01:53 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 26148 output: 32 thoughts: 136 Thoughts: **Investigating DSA Tag Protocol Changes** Okay, let's break this down. I'm looking at `dsa_loop.c` and specifically focusing on how it handles tag protocols. The code uses `dsa_loop_get_protocol`, which, as I recall, returns something like `DSA_TAG_PROTO_LOOP`. My immediate thought is, does `dsa_loop` implement a `change_tag_protocol` function? That's the crucial question here, because I need to know if this module can dynamically adjust its tagging method. So, I dive back into `dsa_loop.c` to examine the `dsa_loop_driver` structure. I'm checking specifically for the presence of `.change_tag_protocol`. Ah, right, no, it's not there! It seems `dsa_loop` doesn't provide its own function to change the tag protocol. Now, my next move is to broaden the scope. I need to understand which other DSA switch drivers *do* implement `change_tag_protocol`. Time to consult the broader codebase and see where this capability actually resides. |
| 32/2 | 2026/09/07 01:53 | tool | grepper |
0mArgs:{
"Expression": "\\.change_tag_protocol",
"PathPrefix": "drivers/net/dsa"
}Results: {
"Output": "drivers/net/dsa/mv88e6xxx/chip.c=7187=static const struct dsa_switch_ops mv88e6xxx_switch_ops = {\ndrivers/net/dsa/mv88e6xxx/chip.c-7188-\t.get_tag_protocol\t= mv88e6xxx_get_tag_protocol,\ndrivers/net/dsa/mv88e6xxx/chip.c:7189:\t.change_tag_protocol\t= mv88e6xxx_change_tag_protocol,\ndrivers/net/dsa/mv88e6xxx/chip.c-7190-\t.setup\t\t\t= mv88e6xxx_setup,\n--\ndrivers/net/dsa/ocelot/felix.c=2306=static const struct dsa_switch_ops felix_switch_ops = {\ndrivers/net/dsa/ocelot/felix.c-2307-\t.get_tag_protocol\t\t= felix_get_tag_protocol,\ndrivers/net/dsa/ocelot/felix.c:2308:\t.change_tag_protocol\t\t= felix_change_tag_protocol,\ndrivers/net/dsa/ocelot/felix.c-2309-\t.connect_tag_protocol\t\t= felix_connect_tag_protocol,\n--\ndrivers/net/dsa/realtek/rtl8365mb_main.c=3285=static const struct dsa_switch_ops rtl8365mb_switch_ops = {\ndrivers/net/dsa/realtek/rtl8365mb_main.c-3286-\t.get_tag_protocol = rtl8365mb_get_tag_protocol,\ndrivers/net/dsa/realtek/rtl8365mb_main.c:3287:\t.change_tag_protocol = rtl8365mb_change_tag_protocol,\ndrivers/net/dsa/realtek/rtl8365mb_main.c-3288-\t.setup = rtl8365mb_setup,\n"
} |
| 33/2 | 2026/09/07 01:53 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 27092 output: 35 thoughts: 438 Thoughts: **Analyzing DSA Tag Protocols and the MT7628 Ethernet Switch** Okay, let's dive into these DSA tag protocols. First, I need to understand the landscape: `mv88e6xxx_change_tag_protocol`, `felix_change_tag_protocol`, and `rtl8365mb_change_tag_protocol`. I'm checking their supported protocols. `mv88e6xxx` looks pretty straightforward, sticking with EDSA/DSA. Then `felix` offers ocelot variants. `rtl8365mb`... that's RTL-specific. Now, let's switch gears and investigate `drivers/net/dsa/mt7628.c`. My focus is on understanding what the `mt7628` device is all about. Ah, it's the built-in Ethernet switch within the MediaTek MT7628 SoC, a MIPS SoC. The Kconfig dependencies are what I'd expect: `HAS_IOMEM` and either `SOC_MT7620` or `COMPILE_TEST`. It's a Device Tree platform driver, specifically on the MT7628 SoC. I'm zeroing in on the `mt7628_driver`, particularly the probe function `mt7628_probe`. The driver uses the `"mediatek,mt7628-esw"` compatible string. Okay, and `net/dsa/tag_mt7628.c` is the tag driver for `DSA_TAG_PROTO_MT7628`. The protocol is used exclusively by `mt7628.c` via the `mt7628_get_tag_proto()` function. Now, I'm getting suspicious. Is `DSA_TAG_PROTO_MT7628` only used *here*? I need a much broader view. I'm going to search the entire kernel codebase. Time to `grep` for `DSA_TAG_PROTO_MT7628` and `tag_mt7628`. I need to ensure this isn't referenced elsewhere, or that I am missing something. I want to see this within the larger framework! |
| 34/2 | 2026/09/07 01:53 | tool | grepper |
0mArgs:{
"Expression": "(DSA_TAG_PROTO_MT7628|tag_mt7628)"
}Results: {
"Output": "MAINTAINERS=16790=F:\tdrivers/net/phy/mediatek/mtk-fe-soc.c\nMAINTAINERS:16791:F:\tnet/dsa/tag_mt7628.c\nMAINTAINERS-16792-\n--\ndrivers/net/dsa/mt7628.c=588=mt7628_get_tag_proto(struct dsa_switch *ds, int port, enum dsa_tag_protocol mp)\ndrivers/net/dsa/mt7628.c-589-{\ndrivers/net/dsa/mt7628.c:590:\treturn DSA_TAG_PROTO_MT7628;\ndrivers/net/dsa/mt7628.c-591-}\n--\ninclude/net/dsa.h=26=struct tc_action;\n--\ninclude/net/dsa.h-62-#define DSA_TAG_PROTO_KSZ8463_VALUE\t\t34\ninclude/net/dsa.h:63:#define DSA_TAG_PROTO_MT7628_VALUE\t\t35\ninclude/net/dsa.h-64-\ninclude/net/dsa.h=65=enum dsa_tag_protocol {\n--\ninclude/net/dsa.h-100-\tDSA_TAG_PROTO_KSZ8463\t\t= DSA_TAG_PROTO_KSZ8463_VALUE,\ninclude/net/dsa.h:101:\tDSA_TAG_PROTO_MT7628\t\t= DSA_TAG_PROTO_MT7628_VALUE,\ninclude/net/dsa.h-102-};\n--\nnet/dsa/Makefile=29=obj-$(CONFIG_NET_DSA_TAG_LAN9303) += tag_lan9303.o\nnet/dsa/Makefile:30:obj-$(CONFIG_NET_DSA_TAG_MT7628) += tag_mt7628.o\nnet/dsa/Makefile-31-obj-$(CONFIG_NET_DSA_TAG_MTK) += tag_mtk.o\n--\nnet/dsa/tag_mt7628.c=121=static const struct dsa_device_ops mt7628_tag_ops = {\nnet/dsa/tag_mt7628.c-122-\t.name = MT7628_TAG_NAME,\nnet/dsa/tag_mt7628.c:123:\t.proto = DSA_TAG_PROTO_MT7628,\nnet/dsa/tag_mt7628.c-124-\t.xmit = mt7628_tag_xmit,\n--\nnet/dsa/tag_mt7628.c=129=module_dsa_tag_driver(mt7628_tag_ops);\nnet/dsa/tag_mt7628.c-130-\nnet/dsa/tag_mt7628.c:131:MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_MT7628, MT7628_TAG_NAME);\nnet/dsa/tag_mt7628.c-132-MODULE_DESCRIPTION(\"DSA tag driver for MT7628 switch\");\n"
} |
| 35/2 | 2026/09/07 01:53 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 28885 output: 165 thoughts: 871 Thoughts: **My Assessment: Not Worth Fuzzing** Okay, let's break this down systematically. First, I need to understand the changes. The diff shows modifications to `MAINTAINERS`, a driver (`drivers/net/dsa/mt7628.c`) for the MediaTek MT7628 SoC embedded Ethernet switch, and its associated tag driver (`net/dsa/tag_mt7628.c`). The target architecture is amd64. Now, I'm checking against the negative criteria. The prompt clearly defines situations where fuzzing isn't valuable. Specifically, I'm looking for: non-kernel/non-executable changes, structurally unreachable hardware, or unreachable execution paths. Considering the MT7628 SoC, my initial thoughts are that it's likely a case of unreachable hardware. Let me confirm: the driver's dependencies, based on `mt7628.c`, include `HAS_IOMEM` and either `SOC_MT7620` or `COMPILE_TEST`. It is an `of_device` (Device Tree) matching `mediatek,mt7628-esw`. However, based on my understanding of standard amd64 QEMU/GCE setups, there's no Device Tree node for the MediaTek MT7628 embedded switch hardware. The MT7620/MT7628 is a MIPS architecture SoC. Even with `COMPILE_TEST` enabled on x86_64, the driver *requires* physical SoC memory-mapped registers and the device tree node to probe. No virtual device or QEMU emulation exists for it. Furthermore, `net/dsa/tag_mt7628.c` is exclusively linked to the `DSA_TAG_PROTO_MT7628` protocol, which is *only* used when `mt7628.c` probes and attaches its DSA switch. Since the switch driver can't probe on amd64 in QEMU, the `mt7628_tag_ops` functions are fundamentally unreachable. They will never be instantiated or executed. Therefore, *all* the modified code falls into the "structurally unreachable hardware" category and the non-executable documentation file `MAINTAINERS`. It's either a non-executable metadata file or code that relies on hardware that is not emulated in the target QEMU environment. Hence, I can confidently conclude: `WorthFuzzing=false`. No configuration changes or specific symbols need to be focused on. I'll summarize it as a concise explanation of the verdict, and then proceed. Let's call `set-results`. |
| 36/2 | 2026/09/07 01:53 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies MAINTAINERS, the MediaTek MT7628 SoC embedded switch driver (drivers/net/dsa/mt7628.c), and its associated DSA tag driver (net/dsa/tag_mt7628.c). MT7628 is a platform/SoC-specific Ethernet switch for MIPS-based MediaTek SoCs and is not emulated in standard QEMU/GCE virtualized environments on the target architecture (amd64). Because the underlying hardware device cannot probe and the tag protocol is only used by this switch, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies MAINTAINERS, the MediaTek MT7628 SoC embedded switch driver (drivers/net/dsa/mt7628.c), and its associated DSA tag driver (net/dsa/tag_mt7628.c). MT7628 is a platform/SoC-specific Ethernet switch for MIPS-based MediaTek SoCs and is not emulated in standard QEMU/GCE virtualized environments on the target architecture (amd64). Because the underlying hardware device cannot probe and the tag protocol is only used by this switch, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 37/1 | 2026/09/07 01:53 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|