| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/19 05:54 | flow | patch-triage |
1mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the mv88e6xxx DSA driver for Marvell switches to support embedded arrival time stamps for PTP. This is a hardware-specific driver that requires a physical Marvell switch connected via an MDIO bus. There is no software emulation for this hardware in QEMU, making the modified code paths impossible to reach in a virtualized fuzzing environment.",
"WorthFuzzing": false
} |
| 1/1 | 2026/07/19 05:54 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit c77defee4e380c79a103cf46c4d6ffa03a6a55d4\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Jul 19 05:54:50 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c\nindex 80b877c74513d6..624cdf6c80a672 100644\n--- a/drivers/net/dsa/mv88e6xxx/chip.c\n+++ b/drivers/net/dsa/mv88e6xxx/chip.c\n@@ -28,6 +28,7 @@\n #include \u003clinux/of_mdio.h\u003e\n #include \u003clinux/platform_data/mv88e6xxx.h\u003e\n #include \u003clinux/property.h\u003e\n+#include \u003clinux/ptp_classify.h\u003e\n #include \u003clinux/netdevice.h\u003e\n #include \u003clinux/gpio/consumer.h\u003e\n #include \u003clinux/phylink.h\u003e\n@@ -6370,6 +6371,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {\n \t\t.edsa_support = MV88E6XXX_EDSA_SUPPORTED,\n \t\t.ptp_support = true,\n \t\t.ops = \u0026mv88e6341_ops,\n+\t\t.arr_ts_mode = offsetof(struct ptp_header, reserved2),\n \t},\n \n \t[MV88E6350] = {\n@@ -6447,6 +6449,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {\n \t\t.edsa_support = MV88E6XXX_EDSA_SUPPORTED,\n \t\t.ptp_support = true,\n \t\t.ops = \u0026mv88e6352_ops,\n+\t\t.arr_ts_mode = offsetof(struct ptp_header, reserved2),\n \t},\n \t[MV88E6361] = {\n \t\t.prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6361,\n@@ -6635,6 +6638,7 @@ static struct mv88e6xxx_chip *mv88e6xxx_alloc_chip(struct device *dev)\n \tchip-\u003edev = dev;\n \n \tmutex_init(\u0026chip-\u003ereg_lock);\n+\tspin_lock_init(\u0026chip-\u003eptp_clock_lock);\n \tINIT_LIST_HEAD(\u0026chip-\u003emdios);\n \tidr_init(\u0026chip-\u003epolicies);\n \tINIT_LIST_HEAD(\u0026chip-\u003emsts);\ndiff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h\nindex e966e7c4cc5dea..dd52de71360b90 100644\n--- a/drivers/net/dsa/mv88e6xxx/chip.h\n+++ b/drivers/net/dsa/mv88e6xxx/chip.h\n@@ -180,6 +180,14 @@ struct mv88e6xxx_info {\n \t * port 0, 1 means internal PHYs range starts at port 1, etc\n \t */\n \tunsigned int internal_phys_offset;\n+\n+\t/* Arrival Time Stamp Mode (ArrTSMode); see the ArrTSMode encoding in\n+\t * hwtstamp.h. Zero (the default) leaves arrival time stamps in the\n+\t * switch registers; non-zero embeds them in the frame, either appended\n+\t * as a trailer or overwritten at that byte offset past the start of the\n+\t * PTP common header.\n+\t */\n+\tunsigned int arr_ts_mode;\n };\n \n struct mv88e6xxx_atu_entry {\n@@ -419,9 +427,12 @@ struct mv88e6xxx_chip {\n \t/* GPIO resources */\n \tu8 gpio_data[2];\n \n-\t/* This cyclecounter abstracts the switch PTP time.\n-\t * reg_lock must be held for any operation that read()s.\n+\t/* This cyclecounter abstracts the switch PTP time. ptp_clock_lock\n+\t * protects tstamp_cc and tstamp_tc. tstamp_cycles caches the\n+\t * result most recently returned by mv88e6xxx_ptp_read_cycles().\n \t */\n+\tspinlock_t\t\tptp_clock_lock;\n+\tu64\t\t\ttstamp_cycles;\n \tstruct cyclecounter\ttstamp_cc;\n \tstruct timecounter\ttstamp_tc;\n \tstruct delayed_work\toverflow_work;\ndiff --git a/drivers/net/dsa/mv88e6xxx/hwtstamp.c b/drivers/net/dsa/mv88e6xxx/hwtstamp.c\nindex 6e6472a3b75ad7..716cbc2a869220 100644\n--- a/drivers/net/dsa/mv88e6xxx/hwtstamp.c\n+++ b/drivers/net/dsa/mv88e6xxx/hwtstamp.c\n@@ -15,6 +15,7 @@\n #include \"hwtstamp.h\"\n #include \"ptp.h\"\n #include \u003clinux/ptp_classify.h\u003e\n+#include \u003clinux/unaligned.h\u003e\n \n #define SKB_PTP_TYPE(__skb) (*(unsigned int *)((__skb)-\u003ecb))\n \n@@ -245,6 +246,63 @@ static int seq_match(struct sk_buff *skb, u16 ts_seqid)\n \treturn ts_seqid == ntohs(hdr-\u003esequence_id);\n }\n \n+static bool parse_embedded_ts(unsigned int arr_ts_mode,\n+\t\t\t struct sk_buff *skb, u64 *ns)\n+{\n+\tstruct ptp_header *hdr;\n+\n+\t*ns = 0;\n+\n+\t/* APPEND means the switch appended the time stamp as a 4-byte trailer\n+\t * (not all switches support this). Any other non-zero value is the byte\n+\t * offset past the start of the PTP common header at which the switch\n+\t * overwrote the time stamp in place (e.g. the reserved header bytes).\n+\t */\n+\tif (arr_ts_mode == MV88E6XXX_PTP_ARR_TS_MODE_APPEND \u0026\u0026 skb-\u003elen \u003e= 4) {\n+\t\tif (skb_linearize(skb))\n+\t\t\treturn false;\n+\n+\t\t*ns = (u64)get_unaligned_be32(skb_tail_pointer(skb) - 4);\n+\t\tif (pskb_trim_rcsum(skb, skb-\u003elen - 4))\n+\t\t\treturn false;\n+\t} else if (arr_ts_mode + 4 \u003c= sizeof(*hdr)) {\n+\t\tif (skb_linearize(skb))\n+\t\t\treturn false;\n+\n+\t\thdr = ptp_parse_header(skb, SKB_PTP_TYPE(skb));\n+\t\tif (!hdr)\n+\t\t\treturn false;\n+\n+\t\t*ns = (u64)get_unaligned_be32((u8 *)hdr + arr_ts_mode);\n+\t\tmemset((u8 *)hdr + arr_ts_mode, 0, 4);\n+\t\tskb_checksum_complete_unset(skb);\n+\t} else {\n+\t\treturn false;\n+\t}\n+\n+\treturn true;\n+}\n+\n+/* Apply the arrival time the switch embedded in the frame. No register access\n+ * is needed, so this runs inline on the receive path rather than being handed\n+ * to the PTP worker.\n+ */\n+static void mv88e6xxx_ptp_rx_timestamp(struct mv88e6xxx_chip *chip,\n+\t\t\t\t struct sk_buff *skb)\n+{\n+\tstruct skb_shared_hwtstamps *shwt;\n+\tu64 ns;\n+\n+\tif (!parse_embedded_ts(chip-\u003einfo-\u003earr_ts_mode, skb, \u0026ns))\n+\t\treturn;\n+\n+\tns = mv88e6xxx_timecounter_cyc2time(chip, ns);\n+\n+\tshwt = skb_hwtstamps(skb);\n+\tmemset(shwt, 0, sizeof(*shwt));\n+\tshwt-\u003ehwtstamp = ns_to_ktime(ns);\n+}\n+\n static void mv88e6xxx_get_rxts(struct mv88e6xxx_chip *chip,\n \t\t\t struct mv88e6xxx_port_hwtstamp *ps,\n \t\t\t struct sk_buff *skb, u16 reg,\n@@ -289,9 +347,7 @@ static void mv88e6xxx_get_rxts(struct mv88e6xxx_chip *chip,\n \t\tif (mv88e6xxx_ts_valid(status) \u0026\u0026 seq_match(skb, seq_id)) {\n \t\t\tns = timehi \u003c\u003c 16 | timelo;\n \n-\t\t\tmv88e6xxx_reg_lock(chip);\n-\t\t\tns = timecounter_cyc2time(\u0026chip-\u003etstamp_tc, ns);\n-\t\t\tmv88e6xxx_reg_unlock(chip);\n+\t\t\tns = mv88e6xxx_timecounter_cyc2time(chip, ns);\n \t\t\tshwt = skb_hwtstamps(skb);\n \t\t\tmemset(shwt, 0, sizeof(*shwt));\n \t\t\tshwt-\u003ehwtstamp = ns_to_ktime(ns);\n@@ -308,7 +364,6 @@ static void mv88e6xxx_rxtstamp_work(struct mv88e6xxx_chip *chip,\n \tstruct sk_buff *skb;\n \n \tskb = skb_dequeue(\u0026ps-\u003erx_queue);\n-\n \tif (skb)\n \t\tmv88e6xxx_get_rxts(chip, ps, skb, ptp_ops-\u003earr0_sts_reg,\n \t\t\t\t \u0026ps-\u003erx_queue);\n@@ -319,9 +374,16 @@ static void mv88e6xxx_rxtstamp_work(struct mv88e6xxx_chip *chip,\n \t\t\t\t \u0026ps-\u003erx_queue2);\n }\n \n-static int is_pdelay_resp(const struct ptp_header *hdr)\n+static bool is_pdelay_msg(const struct ptp_header *hdr)\n {\n-\treturn (hdr-\u003etsmt \u0026 0xf) == 3;\n+\tswitch (ptp_get_msgtype(hdr, PTP_CLASS_V2)) {\n+\tcase PTP_MSGTYPE_PDELAY_REQ:\n+\t\tfallthrough;\n+\tcase PTP_MSGTYPE_PDELAY_RESP:\n+\t\treturn true;\n+\tdefault:\n+\t\treturn false;\n+\t}\n }\n \n bool mv88e6xxx_port_rxtstamp(struct dsa_switch *ds, int port,\n@@ -343,7 +405,13 @@ bool mv88e6xxx_port_rxtstamp(struct dsa_switch *ds, int port,\n \n \tSKB_PTP_TYPE(skb) = type;\n \n-\tif (is_pdelay_resp(hdr))\n+\t/* Embedded arrival times can be returned inline. */\n+\tif (chip-\u003einfo-\u003earr_ts_mode) {\n+\t\tmv88e6xxx_ptp_rx_timestamp(chip, skb);\n+\t\treturn false;\n+\t}\n+\n+\tif (is_pdelay_msg(hdr))\n \t\tskb_queue_tail(\u0026ps-\u003erx_queue2, skb);\n \telse\n \t\tskb_queue_tail(\u0026ps-\u003erx_queue, skb);\n@@ -409,9 +477,7 @@ static int mv88e6xxx_txtstamp_work(struct mv88e6xxx_chip *chip,\n \n \tmemset(\u0026shhwtstamps, 0, sizeof(shhwtstamps));\n \ttime_raw = ((u32)departure_block[2] \u003c\u003c 16) | departure_block[1];\n-\tmv88e6xxx_reg_lock(chip);\n-\tns = timecounter_cyc2time(\u0026chip-\u003etstamp_tc, time_raw);\n-\tmv88e6xxx_reg_unlock(chip);\n+\tns = mv88e6xxx_timecounter_cyc2time(chip, time_raw);\n \tshhwtstamps.hwtstamp = ns_to_ktime(ns);\n \n \tdev_dbg(chip-\u003edev,\n@@ -454,7 +520,9 @@ long mv88e6xxx_hwtstamp_work(struct ptp_clock_info *ptp)\n \t\tif (test_bit(MV88E6XXX_HWTSTAMP_TX_IN_PROGRESS, \u0026ps-\u003estate))\n \t\t\trestart |= mv88e6xxx_txtstamp_work(chip, ps);\n \n-\t\tmv88e6xxx_rxtstamp_work(chip, ps);\n+\t\t/* Embedded arrival times are applied on the receive path. */\n+\t\tif (!chip-\u003einfo-\u003earr_ts_mode)\n+\t\t\tmv88e6xxx_rxtstamp_work(chip, ps);\n \t}\n \n \treturn restart ? 1 : -1;\n@@ -523,14 +591,37 @@ int mv88e6165_global_enable(struct mv88e6xxx_chip *chip)\n \n int mv88e6352_hwtstamp_port_disable(struct mv88e6xxx_chip *chip, int port)\n {\n-\treturn mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,\n-\t\t\t\t\tMV88E6XXX_PORT_PTP_CFG0_DISABLE_PTP);\n+\tint err;\n+\n+\terr = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,\n+\t\t\t\t MV88E6XXX_PORT_PTP_CFG0_DISABLE_PTP);\n+\tif (err)\n+\t\treturn err;\n+\n+\terr = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG2, 0);\n+\tif (err)\n+\t\treturn err;\n+\n+\treturn 0;\n }\n \n int mv88e6352_hwtstamp_port_enable(struct mv88e6xxx_chip *chip, int port)\n {\n-\treturn mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,\n-\t\t\t\t\tMV88E6XXX_PORT_PTP_CFG0_DISABLE_TSPEC_MATCH);\n+\tint err;\n+\n+\tif (chip-\u003einfo-\u003earr_ts_mode) {\n+\t\terr = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG2,\n+\t\t\t\t\t chip-\u003einfo-\u003earr_ts_mode \u003c\u003c 8);\n+\t\tif (err)\n+\t\t\treturn err;\n+\t}\n+\n+\terr = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,\n+\t\t\t\t MV88E6XXX_PORT_PTP_CFG0_DISABLE_TSPEC_MATCH);\n+\tif (err)\n+\t\treturn err;\n+\n+\treturn 0;\n }\n \n static int mv88e6xxx_hwtstamp_port_setup(struct mv88e6xxx_chip *chip, int port)\n@@ -584,11 +675,14 @@ int mv88e6xxx_hwtstamp_setup(struct mv88e6xxx_chip *chip)\n \tif (err)\n \t\treturn err;\n \n-\t/* Use ARRIVAL1 for peer delay response messages. */\n-\terr = mv88e6xxx_ptp_write(chip, MV88E6XXX_PTP_TS_ARRIVAL_PTR,\n-\t\t\t\t MV88E6XXX_PTP_MSGTYPE_PDLAY_RES);\n-\tif (err)\n-\t\treturn err;\n+\tif (!chip-\u003einfo-\u003earr_ts_mode) {\n+\t\t/* Use ARRIVAL1 for peer delay messages. */\n+\t\terr = mv88e6xxx_ptp_write(chip, MV88E6XXX_PTP_TS_ARRIVAL_PTR,\n+\t\t\t\t\t MV88E6XXX_PTP_MSGTYPE_PDLAY_REQ |\n+\t\t\t\t\t MV88E6XXX_PTP_MSGTYPE_PDLAY_RES);\n+\t\tif (err)\n+\t\t\treturn err;\n+\t}\n \n \t/* 88E6341 devices default to timestamping at the PHY, but this has\n \t * a hardware issue that results in unreliable timestamps. Force\ndiff --git a/drivers/net/dsa/mv88e6xxx/hwtstamp.h b/drivers/net/dsa/mv88e6xxx/hwtstamp.h\nindex c359821d5a6eaa..c25f53923e7689 100644\n--- a/drivers/net/dsa/mv88e6xxx/hwtstamp.h\n+++ b/drivers/net/dsa/mv88e6xxx/hwtstamp.h\n@@ -68,6 +68,20 @@\n #define MV88E6XXX_PORT_PTP_CFG2_DEP_IRQ_EN\t\t0x0002\n #define MV88E6XXX_PORT_PTP_CFG2_ARR_IRQ_EN\t\t0x0001\n \n+/* Arrival Time Stamp Mode (ArrTSMode), CFG2 bits [15:8]: configures how the\n+ * switch embeds the arrival time stamp (PTPArr0Time) into enabled PTP event\n+ * frames.\n+ * 0x00 frame modification disabled (time stamp read from registers)\n+ * 0x01 append the 4-byte time stamp at the end of the frame,\n+ * growing the frame by four bytes\n+ * 0x04..0xEF overwrite the 4-byte time stamp in place, that many bytes past\n+ * the start of the PTP common header, without growing the frame\n+ * (offsetof(struct ptp_header, reserved2) targets the reserved\n+ * bytes of the header)\n+ * others reserved\n+ */\n+#define MV88E6XXX_PTP_ARR_TS_MODE_APPEND\t\t0x01\n+\n /* Offset 0x03: PTP LED Configuration */\n #define MV88E6XXX_PORT_PTP_LED_CFG\t0x03\n \ndiff --git a/drivers/net/dsa/mv88e6xxx/ptp.c b/drivers/net/dsa/mv88e6xxx/ptp.c\nindex f7603573d3a984..2a7f97625e3756 100644\n--- a/drivers/net/dsa/mv88e6xxx/ptp.c\n+++ b/drivers/net/dsa/mv88e6xxx/ptp.c\n@@ -231,15 +231,37 @@ static void mv88e6352_tai_event_work(struct work_struct *ugly)\n \n \t/* We only have one timestamping channel. */\n \tev.index = 0;\n-\tmv88e6xxx_reg_lock(chip);\n-\tev.timestamp = timecounter_cyc2time(\u0026chip-\u003etstamp_tc, raw_ts);\n-\tmv88e6xxx_reg_unlock(chip);\n+\tev.timestamp = mv88e6xxx_timecounter_cyc2time(chip, raw_ts);\n \n \tptp_clock_event(chip-\u003eptp_clock, \u0026ev);\n out:\n \tschedule_delayed_work(\u0026chip-\u003etai_event_work, TAI_EVENT_WORK_INTERVAL);\n }\n \n+/* Refresh the cached counter value that the read() callback returns. The\n+ * read cannot acquire the register lock whilst holding ptp_clock_lock\n+ * because MDIO reads can sleep. The caller must hold reg_lock, which\n+ * serializes against the other timecounter writers.\n+ */\n+static void mv88e6xxx_ptp_read_cycles(struct mv88e6xxx_chip *chip)\n+{\n+\tconst struct mv88e6xxx_ptp_ops *ptp_ops = chip-\u003einfo-\u003eops-\u003eptp_ops;\n+\n+\tif (ptp_ops-\u003eclock_read)\n+\t\tchip-\u003etstamp_cycles = ptp_ops-\u003eclock_read(\u0026chip-\u003etstamp_cc);\n+}\n+\n+u64 mv88e6xxx_timecounter_cyc2time(struct mv88e6xxx_chip *chip, u64 cycles)\n+{\n+\tu64 ns;\n+\n+\tspin_lock_bh(\u0026chip-\u003eptp_clock_lock);\n+\tns = timecounter_cyc2time(\u0026chip-\u003etstamp_tc, cycles);\n+\tspin_unlock_bh(\u0026chip-\u003eptp_clock_lock);\n+\n+\treturn ns;\n+}\n+\n static int mv88e6xxx_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)\n {\n \tstruct mv88e6xxx_chip *chip = ptp_to_chip(ptp);\n@@ -258,9 +280,12 @@ static int mv88e6xxx_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)\n \tdiff = div_u64(adj, chip-\u003ecc_coeffs-\u003ecc_mult_dem);\n \n \tmv88e6xxx_reg_lock(chip);\n+\tmv88e6xxx_ptp_read_cycles(chip);\n \n+\tspin_lock_bh(\u0026chip-\u003eptp_clock_lock);\n \ttimecounter_read(\u0026chip-\u003etstamp_tc);\n \tchip-\u003etstamp_cc.mult = neg_adj ? mult - diff : mult + diff;\n+\tspin_unlock_bh(\u0026chip-\u003eptp_clock_lock);\n \n \tmv88e6xxx_reg_unlock(chip);\n \n@@ -271,8 +296,16 @@ static int mv88e6xxx_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)\n {\n \tstruct mv88e6xxx_chip *chip = ptp_to_chip(ptp);\n \n+\t/* No register access is needed here, but reg_lock still serialises\n+\t * this against the other timecounter writers, which drop it only\n+\t * after their hardware read has completed.\n+\t */\n \tmv88e6xxx_reg_lock(chip);\n+\n+\tspin_lock_bh(\u0026chip-\u003eptp_clock_lock);\n \ttimecounter_adjtime(\u0026chip-\u003etstamp_tc, delta);\n+\tspin_unlock_bh(\u0026chip-\u003eptp_clock_lock);\n+\n \tmv88e6xxx_reg_unlock(chip);\n \n \treturn 0;\n@@ -285,7 +318,12 @@ static int mv88e6xxx_ptp_gettime(struct ptp_clock_info *ptp,\n \tu64 ns;\n \n \tmv88e6xxx_reg_lock(chip);\n+\tmv88e6xxx_ptp_read_cycles(chip);\n+\n+\tspin_lock_bh(\u0026chip-\u003eptp_clock_lock);\n \tns = timecounter_read(\u0026chip-\u003etstamp_tc);\n+\tspin_unlock_bh(\u0026chip-\u003eptp_clock_lock);\n+\n \tmv88e6xxx_reg_unlock(chip);\n \n \t*ts = ns_to_timespec64(ns);\n@@ -302,7 +340,12 @@ static int mv88e6xxx_ptp_settime(struct ptp_clock_info *ptp,\n \tns = timespec64_to_ns(ts);\n \n \tmv88e6xxx_reg_lock(chip);\n+\tmv88e6xxx_ptp_read_cycles(chip);\n+\n+\tspin_lock_bh(\u0026chip-\u003eptp_clock_lock);\n \ttimecounter_init(\u0026chip-\u003etstamp_tc, \u0026chip-\u003etstamp_cc, ns);\n+\tspin_unlock_bh(\u0026chip-\u003eptp_clock_lock);\n+\n \tmv88e6xxx_reg_unlock(chip);\n \n \treturn 0;\n@@ -444,14 +487,12 @@ const struct mv88e6xxx_ptp_ops mv88e6390_ptp_ops = {\n \t\t(1 \u003c\u003c HWTSTAMP_FILTER_PTP_V2_DELAY_REQ),\n };\n \n+/* Return the value most recently fetched by mv88e6xxx_ptp_read_cycles()\n+ * rather than reading the hardware over MDIO.\n+ */\n static u64 mv88e6xxx_ptp_clock_read(struct cyclecounter *cc)\n {\n-\tstruct mv88e6xxx_chip *chip = cc_to_chip(cc);\n-\n-\tif (chip-\u003einfo-\u003eops-\u003eptp_ops-\u003eclock_read)\n-\t\treturn chip-\u003einfo-\u003eops-\u003eptp_ops-\u003eclock_read(cc);\n-\n-\treturn 0;\n+\treturn cc_to_chip(cc)-\u003etstamp_cycles;\n }\n \n /* With a 250MHz input clock, the 32-bit timestamp counter overflows in ~17.2\n@@ -486,6 +527,12 @@ int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip)\n \tchip-\u003etstamp_cc.mult\t= chip-\u003ecc_coeffs-\u003ecc_mult;\n \tchip-\u003etstamp_cc.shift\t= chip-\u003ecc_coeffs-\u003ecc_shift;\n \n+\t/* Prime the cycle counter cache for the timecounter_init() below.\n+\t * The caller holds reg_lock, and nothing can reach the PTP clock\n+\t * until ptp_clock_register() below, so no locking is needed here.\n+\t */\n+\tmv88e6xxx_ptp_read_cycles(chip);\n+\n \ttimecounter_init(\u0026chip-\u003etstamp_tc, \u0026chip-\u003etstamp_cc,\n \t\t\t ktime_to_ns(ktime_get_real()));\n \ndiff --git a/drivers/net/dsa/mv88e6xxx/ptp.h b/drivers/net/dsa/mv88e6xxx/ptp.h\nindex 95bdddb0bf39f8..44718e120de20c 100644\n--- a/drivers/net/dsa/mv88e6xxx/ptp.h\n+++ b/drivers/net/dsa/mv88e6xxx/ptp.h\n@@ -68,6 +68,7 @@\n \n int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip);\n void mv88e6xxx_ptp_free(struct mv88e6xxx_chip *chip);\n+u64 mv88e6xxx_timecounter_cyc2time(struct mv88e6xxx_chip *chip, u64 cycles);\n \n #define ptp_to_chip(ptp) container_of(ptp, struct mv88e6xxx_chip,\t\\\n \t\t\t\t ptp_clock_info)\n"
} |
| 2/1 | 2026/07/19 05:54 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the mv88e6xxx DSA driver for Marvell switches to support embedded arrival time stamps for PTP. This is a hardware-specific driver that requires a physical Marvell switch connected via an MDIO bus. There is no software emulation for this hardware in QEMU, making the modified code paths impossible to reach in a virtualized fuzzing environment.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit c77defee4e380c79a103cf46c4d6ffa03a6a55d4
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Jul 19 05:54:50 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 80b877c74513d6..624cdf6c80a672 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -28,6 +28,7 @@
#include <linux/of_mdio.h>
#include <linux/platform_data/mv88e6xxx.h>
#include <linux/property.h>
+#include <linux/ptp_classify.h>
#include <linux/netdevice.h>
#include <linux/gpio/consumer.h>
#include <linux/phylink.h>
@@ -6370,6 +6371,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
.edsa_support = MV88E6XXX_EDSA_SUPPORTED,
.ptp_support = true,
.ops = &mv88e6341_ops,
+ .arr_ts_mode = offsetof(struct ptp_header, reserved2),
},
[MV88E6350] = {
@@ -6447,6 +6449,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
.edsa_support = MV88E6XXX_EDSA_SUPPORTED,
.ptp_support = true,
.ops = &mv88e6352_ops,
+ .arr_ts_mode = offsetof(struct ptp_header, reserved2),
},
[MV88E6361] = {
.prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6361,
@@ -6635,6 +6638,7 @@ static struct mv88e6xxx_chip *mv88e6xxx_alloc_chip(struct device *dev)
chip->dev = dev;
mutex_init(&chip->reg_lock);
+ spin_lock_init(&chip->ptp_clock_lock);
INIT_LIST_HEAD(&chip->mdios);
idr_init(&chip->policies);
INIT_LIST_HEAD(&chip->msts);
diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index e966e7c4cc5dea..dd52de71360b90 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h
@@ -180,6 +180,14 @@ struct mv88e6xxx_info {
* port 0, 1 means internal PHYs range starts at port 1, etc
*/
unsigned int internal_phys_offset;
+
+ /* Arrival Time Stamp Mode (ArrTSMode); see the ArrTSMode encoding in
+ * hwtstamp.h. Zero (the default) leaves arrival time stamps in the
+ * switch registers; non-zero embeds them in the frame, either appended
+ * as a trailer or overwritten at that byte offset past the start of the
+ * PTP common header.
+ */
+ unsigned int arr_ts_mode;
};
struct mv88e6xxx_atu_entry {
@@ -419,9 +427,12 @@ struct mv88e6xxx_chip {
/* GPIO resources */
u8 gpio_data[2];
- /* This cyclecounter abstracts the switch PTP time.
- * reg_lock must be held for any operation that read()s.
+ /* This cyclecounter abstracts the switch PTP time. ptp_clock_lock
+ * protects tstamp_cc and tstamp_tc. tstamp_cycles caches the
+ * result most recently returned by mv88e6xxx_ptp_read_cycles().
*/
+ spinlock_t ptp_clock_lock;
+ u64 tstamp_cycles;
struct cyclecounter tstamp_cc;
struct timecounter tstamp_tc;
struct delayed_work overflow_work;
diff --git a/drivers/net/dsa/mv88e6xxx/hwtstamp.c b/drivers/net/dsa/mv88e6xxx/hwtstamp.c
index 6e6472a3b75ad7..716cbc2a869220 100644
--- a/drivers/net/dsa/mv88e6xxx/hwtstamp.c
+++ b/drivers/net/dsa/mv88e6xxx/hwtstamp.c
@@ -15,6 +15,7 @@
#include "hwtstamp.h"
#include "ptp.h"
#include <linux/ptp_classify.h>
+#include <linux/unaligned.h>
#define SKB_PTP_TYPE(__skb) (*(unsigned int *)((__skb)->cb))
@@ -245,6 +246,63 @@ static int seq_match(struct sk_buff *skb, u16 ts_seqid)
return ts_seqid == ntohs(hdr->sequence_id);
}
+static bool parse_embedded_ts(unsigned int arr_ts_mode,
+ struct sk_buff *skb, u64 *ns)
+{
+ struct ptp_header *hdr;
+
+ *ns = 0;
+
+ /* APPEND means the switch appended the time stamp as a 4-byte trailer
+ * (not all switches support this). Any other non-zero value is the byte
+ * offset past the start of the PTP common header at which the switch
+ * overwrote the time stamp in place (e.g. the reserved header bytes).
+ */
+ if (arr_ts_mode == MV88E6XXX_PTP_ARR_TS_MODE_APPEND && skb->len >= 4) {
+ if (skb_linearize(skb))
+ return false;
+
+ *ns = (u64)get_unaligned_be32(skb_tail_pointer(skb) - 4);
+ if (pskb_trim_rcsum(skb, skb->len - 4))
+ return false;
+ } else if (arr_ts_mode + 4 <= sizeof(*hdr)) {
+ if (skb_linearize(skb))
+ return false;
+
+ hdr = ptp_parse_header(skb, SKB_PTP_TYPE(skb));
+ if (!hdr)
+ return false;
+
+ *ns = (u64)get_unaligned_be32((u8 *)hdr + arr_ts_mode);
+ memset((u8 *)hdr + arr_ts_mode, 0, 4);
+ skb_checksum_complete_unset(skb);
+ } else {
+ return false;
+ }
+
+ return true;
+}
+
+/* Apply the arrival time the switch embedded in the frame. No register access
+ * is needed, so this runs inline on the receive path rather than being handed
+ * to the PTP worker.
+ */
+static void mv88e6xxx_ptp_rx_timestamp(struct mv88e6xxx_chip *chip,
+ struct sk_buff *skb)
+{
+ struct skb_shared_hwtstamps *shwt;
+ u64 ns;
+
+ if (!parse_embedded_ts(chip->info->arr_ts_mode, skb, &ns))
+ return;
+
+ ns = mv88e6xxx_timecounter_cyc2time(chip, ns);
+
+ shwt = skb_hwtstamps(skb);
+ memset(shwt, 0, sizeof(*shwt));
+ shwt->hwtstamp = ns_to_ktime(ns);
+}
+
static void mv88e6xxx_get_rxts(struct mv88e6xxx_chip *chip,
struct mv88e6xxx_port_hwtstamp *ps,
struct sk_buff *skb, u16 reg,
@@ -289,9 +347,7 @@ static void mv88e6xxx_get_rxts(struct mv88e6xxx_chip *chip,
if (mv88e6xxx_ts_valid(status) && seq_match(skb, seq_id)) {
ns = timehi << 16 | timelo;
- mv88e6xxx_reg_lock(chip);
- ns = timecounter_cyc2time(&chip->tstamp_tc, ns);
- mv88e6xxx_reg_unlock(chip);
+ ns = mv88e6xxx_timecounter_cyc2time(chip, ns);
shwt = skb_hwtstamps(skb);
memset(shwt, 0, sizeof(*shwt));
shwt->hwtstamp = ns_to_ktime(ns);
@@ -308,7 +364,6 @@ static void mv88e6xxx_rxtstamp_work(struct mv88e6xxx_chip *chip,
struct sk_buff *skb;
skb = skb_dequeue(&ps->rx_queue);
-
if (skb)
mv88e6xxx_get_rxts(chip, ps, skb, ptp_ops->arr0_sts_reg,
&ps->rx_queue);
@@ -319,9 +374,16 @@ static void mv88e6xxx_rxtstamp_work(struct mv88e6xxx_chip *chip,
&ps->rx_queue2);
}
-static int is_pdelay_resp(const struct ptp_header *hdr)
+static bool is_pdelay_msg(const struct ptp_header *hdr)
{
- return (hdr->tsmt & 0xf) == 3;
+ switch (ptp_get_msgtype(hdr, PTP_CLASS_V2)) {
+ case PTP_MSGTYPE_PDELAY_REQ:
+ fallthrough;
+ case PTP_MSGTYPE_PDELAY_RESP:
+ return true;
+ default:
+ return false;
+ }
}
bool mv88e6xxx_port_rxtstamp(struct dsa_switch *ds, int port,
@@ -343,7 +405,13 @@ bool mv88e6xxx_port_rxtstamp(struct dsa_switch *ds, int port,
SKB_PTP_TYPE(skb) = type;
- if (is_pdelay_resp(hdr))
+ /* Embedded arrival times can be returned inline. */
+ if (chip->info->arr_ts_mode) {
+ mv88e6xxx_ptp_rx_timestamp(chip, skb);
+ return false;
+ }
+
+ if (is_pdelay_msg(hdr))
skb_queue_tail(&ps->rx_queue2, skb);
else
skb_queue_tail(&ps->rx_queue, skb);
@@ -409,9 +477,7 @@ static int mv88e6xxx_txtstamp_work(struct mv88e6xxx_chip *chip,
memset(&shhwtstamps, 0, sizeof(shhwtstamps));
time_raw = ((u32)departure_block[2] << 16) | departure_block[1];
- mv88e6xxx_reg_lock(chip);
- ns = timecounter_cyc2time(&chip->tstamp_tc, time_raw);
- mv88e6xxx_reg_unlock(chip);
+ ns = mv88e6xxx_timecounter_cyc2time(chip, time_raw);
shhwtstamps.hwtstamp = ns_to_ktime(ns);
dev_dbg(chip->dev,
@@ -454,7 +520,9 @@ long mv88e6xxx_hwtstamp_work(struct ptp_clock_info *ptp)
if (test_bit(MV88E6XXX_HWTSTAMP_TX_IN_PROGRESS, &ps->state))
restart |= mv88e6xxx_txtstamp_work(chip, ps);
- mv88e6xxx_rxtstamp_work(chip, ps);
+ /* Embedded arrival times are applied on the receive path. */
+ if (!chip->info->arr_ts_mode)
+ mv88e6xxx_rxtstamp_work(chip, ps);
}
return restart ? 1 : -1;
@@ -523,14 +591,37 @@ int mv88e6165_global_enable(struct mv88e6xxx_chip *chip)
int mv88e6352_hwtstamp_port_disable(struct mv88e6xxx_chip *chip, int port)
{
- return mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,
- MV88E6XXX_PORT_PTP_CFG0_DISABLE_PTP);
+ int err;
+
+ err = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,
+ MV88E6XXX_PORT_PTP_CFG0_DISABLE_PTP);
+ if (err)
+ return err;
+
+ err = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG2, 0);
+ if (err)
+ return err;
+
+ return 0;
}
int mv88e6352_hwtstamp_port_enable(struct mv88e6xxx_chip *chip, int port)
{
- return mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,
- MV88E6XXX_PORT_PTP_CFG0_DISABLE_TSPEC_MATCH);
+ int err;
+
+ if (chip->info->arr_ts_mode) {
+ err = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG2,
+ chip->info->arr_ts_mode << 8);
+ if (err)
+ return err;
+ }
+
+ err = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,
+ MV88E6XXX_PORT_PTP_CFG0_DISABLE_TSPEC_MATCH);
+ if (err)
+ return err;
+
+ return 0;
}
static int mv88e6xxx_hwtstamp_port_setup(struct mv88e6xxx_chip *chip, int port)
@@ -584,11 +675,14 @@ int mv88e6xxx_hwtstamp_setup(struct mv88e6xxx_chip *chip)
if (err)
return err;
- /* Use ARRIVAL1 for peer delay response messages. */
- err = mv88e6xxx_ptp_write(chip, MV88E6XXX_PTP_TS_ARRIVAL_PTR,
- MV88E6XXX_PTP_MSGTYPE_PDLAY_RES);
- if (err)
- return err;
+ if (!chip->info->arr_ts_mode) {
+ /* Use ARRIVAL1 for peer delay messages. */
+ err = mv88e6xxx_ptp_write(chip, MV88E6XXX_PTP_TS_ARRIVAL_PTR,
+ MV88E6XXX_PTP_MSGTYPE_PDLAY_REQ |
+ MV88E6XXX_PTP_MSGTYPE_PDLAY_RES);
+ if (err)
+ return err;
+ }
/* 88E6341 devices default to timestamping at the PHY, but this has
* a hardware issue that results in unreliable timestamps. Force
diff --git a/drivers/net/dsa/mv88e6xxx/hwtstamp.h b/drivers/net/dsa/mv88e6xxx/hwtstamp.h
index c359821d5a6eaa..c25f53923e7689 100644
--- a/drivers/net/dsa/mv88e6xxx/hwtstamp.h
+++ b/drivers/net/dsa/mv88e6xxx/hwtstamp.h
@@ -68,6 +68,20 @@
#define MV88E6XXX_PORT_PTP_CFG2_DEP_IRQ_EN 0x0002
#define MV88E6XXX_PORT_PTP_CFG2_ARR_IRQ_EN 0x0001
+/* Arrival Time Stamp Mode (ArrTSMode), CFG2 bits [15:8]: configures how the
+ * switch embeds the arrival time stamp (PTPArr0Time) into enabled PTP event
+ * frames.
+ * 0x00 frame modification disabled (time stamp read from registers)
+ * 0x01 append the 4-byte time stamp at the end of the frame,
+ * growing the frame by four bytes
+ * 0x04..0xEF overwrite the 4-byte time stamp in place, that many bytes past
+ * the start of the PTP common header, without growing the frame
+ * (offsetof(struct ptp_header, reserved2) targets the reserved
+ * bytes of the header)
+ * others reserved
+ */
+#define MV88E6XXX_PTP_ARR_TS_MODE_APPEND 0x01
+
/* Offset 0x03: PTP LED Configuration */
#define MV88E6XXX_PORT_PTP_LED_CFG 0x03
diff --git a/drivers/net/dsa/mv88e6xxx/ptp.c b/drivers/net/dsa/mv88e6xxx/ptp.c
index f7603573d3a984..2a7f97625e3756 100644
--- a/drivers/net/dsa/mv88e6xxx/ptp.c
+++ b/drivers/net/dsa/mv88e6xxx/ptp.c
@@ -231,15 +231,37 @@ static void mv88e6352_tai_event_work(struct work_struct *ugly)
/* We only have one timestamping channel. */
ev.index = 0;
- mv88e6xxx_reg_lock(chip);
- ev.timestamp = timecounter_cyc2time(&chip->tstamp_tc, raw_ts);
- mv88e6xxx_reg_unlock(chip);
+ ev.timestamp = mv88e6xxx_timecounter_cyc2time(chip, raw_ts);
ptp_clock_event(chip->ptp_clock, &ev);
out:
schedule_delayed_work(&chip->tai_event_work, TAI_EVENT_WORK_INTERVAL);
}
+/* Refresh the cached counter value that the read() callback returns. The
+ * read cannot acquire the register lock whilst holding ptp_clock_lock
+ * because MDIO reads can sleep. The caller must hold reg_lock, which
+ * serializes against the other timecounter writers.
+ */
+static void mv88e6xxx_ptp_read_cycles(struct mv88e6xxx_chip *chip)
+{
+ const struct mv88e6xxx_ptp_ops *ptp_ops = chip->info->ops->ptp_ops;
+
+ if (ptp_ops->clock_read)
+ chip->tstamp_cycles = ptp_ops->clock_read(&chip->tstamp_cc);
+}
+
+u64 mv88e6xxx_timecounter_cyc2time(struct mv88e6xxx_chip *chip, u64 cycles)
+{
+ u64 ns;
+
+ spin_lock_bh(&chip->ptp_clock_lock);
+ ns = timecounter_cyc2time(&chip->tstamp_tc, cycles);
+ spin_unlock_bh(&chip->ptp_clock_lock);
+
+ return ns;
+}
+
static int mv88e6xxx_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
{
struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
@@ -258,9 +280,12 @@ static int mv88e6xxx_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
diff = div_u64(adj, chip->cc_coeffs->cc_mult_dem);
mv88e6xxx_reg_lock(chip);
+ mv88e6xxx_ptp_read_cycles(chip);
+ spin_lock_bh(&chip->ptp_clock_lock);
timecounter_read(&chip->tstamp_tc);
chip->tstamp_cc.mult = neg_adj ? mult - diff : mult + diff;
+ spin_unlock_bh(&chip->ptp_clock_lock);
mv88e6xxx_reg_unlock(chip);
@@ -271,8 +296,16 @@ static int mv88e6xxx_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
{
struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
+ /* No register access is needed here, but reg_lock still serialises
+ * this against the other timecounter writers, which drop it only
+ * after their hardware read has completed.
+ */
mv88e6xxx_reg_lock(chip);
+
+ spin_lock_bh(&chip->ptp_clock_lock);
timecounter_adjtime(&chip->tstamp_tc, delta);
+ spin_unlock_bh(&chip->ptp_clock_lock);
+
mv88e6xxx_reg_unlock(chip);
return 0;
@@ -285,7 +318,12 @@ static int mv88e6xxx_ptp_gettime(struct ptp_clock_info *ptp,
u64 ns;
mv88e6xxx_reg_lock(chip);
+ mv88e6xxx_ptp_read_cycles(chip);
+
+ spin_lock_bh(&chip->ptp_clock_lock);
ns = timecounter_read(&chip->tstamp_tc);
+ spin_unlock_bh(&chip->ptp_clock_lock);
+
mv88e6xxx_reg_unlock(chip);
*ts = ns_to_timespec64(ns);
@@ -302,7 +340,12 @@ static int mv88e6xxx_ptp_settime(struct ptp_clock_info *ptp,
ns = timespec64_to_ns(ts);
mv88e6xxx_reg_lock(chip);
+ mv88e6xxx_ptp_read_cycles(chip);
+
+ spin_lock_bh(&chip->ptp_clock_lock);
timecounter_init(&chip->tstamp_tc, &chip->tstamp_cc, ns);
+ spin_unlock_bh(&chip->ptp_clock_lock);
+
mv88e6xxx_reg_unlock(chip);
return 0;
@@ -444,14 +487,12 @@ const struct mv88e6xxx_ptp_ops mv88e6390_ptp_ops = {
(1 << HWTSTAMP_FILTER_PTP_V2_DELAY_REQ),
};
+/* Return the value most recently fetched by mv88e6xxx_ptp_read_cycles()
+ * rather than reading the hardware over MDIO.
+ */
static u64 mv88e6xxx_ptp_clock_read(struct cyclecounter *cc)
{
- struct mv88e6xxx_chip *chip = cc_to_chip(cc);
-
- if (chip->info->ops->ptp_ops->clock_read)
- return chip->info->ops->ptp_ops->clock_read(cc);
-
- return 0;
+ return cc_to_chip(cc)->tstamp_cycles;
}
/* With a 250MHz input clock, the 32-bit timestamp counter overflows in ~17.2
@@ -486,6 +527,12 @@ int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip)
chip->tstamp_cc.mult = chip->cc_coeffs->cc_mult;
chip->tstamp_cc.shift = chip->cc_coeffs->cc_shift;
+ /* Prime the cycle counter cache for the timecounter_init() below.
+ * The caller holds reg_lock, and nothing can reach the PTP clock
+ * until ptp_clock_register() below, so no locking is needed here.
+ */
+ mv88e6xxx_ptp_read_cycles(chip);
+
timecounter_init(&chip->tstamp_tc, &chip->tstamp_cc,
ktime_to_ns(ktime_get_real()));
diff --git a/drivers/net/dsa/mv88e6xxx/ptp.h b/drivers/net/dsa/mv88e6xxx/ptp.h
index 95bdddb0bf39f8..44718e120de20c 100644
--- a/drivers/net/dsa/mv88e6xxx/ptp.h
+++ b/drivers/net/dsa/mv88e6xxx/ptp.h
@@ -68,6 +68,7 @@
int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip);
void mv88e6xxx_ptp_free(struct mv88e6xxx_chip *chip);
+u64 mv88e6xxx_timecounter_cyc2time(struct mv88e6xxx_chip *chip, u64 cycles);
#define ptp_to_chip(ptp) container_of(ptp, struct mv88e6xxx_chip, \
ptp_clock_info)
|
| 3/2 | 2026/07/19 05:54 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8584 output: 26 thoughts: 1509 Thoughts: **Fuzzing Analysis: mv88e6xxx PTP Timestamping Patch**
Okay, so I'm looking at this patch for the `mv88e6xxx` DSA driver, specifically dealing with Precision Time Protocol (PTP) and hardware timestamping. The patch introduces support for embedded arrival timestamps (`arr_ts_mode`), which sounds promising from a performance perspective. It looks like they are reading timestamps directly from the packet payload/trailer to bypass switch register reads, which should be faster, avoiding those slow MDIO accesses, which is good. I see the code touches several core files: `chip.c`, `chip.h`, `hwtstamp.c`, `hwtstamp.h`, and `ptp.c`, `ptp.h`. They've also implemented a `ptp_clock_lock` spinlock for protecting timestamping data, which is appropriate. This is changing fundamental parsing and timestamping logic within the driver; definitely a potential area for bugs.
The core of this is in `mv88e6xxx_ptp_rx_timestamp` and `parse_embedded_ts`. The latter, in particular, looks interesting, as it's handling packet data. I see they have a block of code there that modifies the `skb` which looks like:
```c
if (arr_ts_mode == MV88E6XXX_PTP_ARR_TS_MODE_APPEND && skb->len >= 4) {
if (skb_linearize(skb))
return false;
*ns = (u64)get_unaligned_be32(skb_tail_pointer(skb) - 4);
if (pskb_trim_rcsum(skb, skb->len - 4))
return false;
} else if (arr_ts_mode + 4 <= sizeof(*hdr)) {
if (skb_linearize(skb))
return false;
hdr = ptp_parse_header(skb, SKB_PTP_TYPE(skb));
if (!hdr)
return false;
*ns = (u64)get_unaligned_be32((u8 *)hdr + arr_ts_mode);
memset((u8 *)hdr + arr_ts_mode, 0, 4);
skb_checksum_complete_unset(skb);
}
```
This is definitely packet parsing logic. It modifies the `skb`. If this can be triggered and injected with crafted packets, this is prime fuzzer territory! My concern is that, as a DSA driver for a Marvell 88E6xxx switch, it's typically tied to real hardware and an MDIO bus. Can this be reached in a virtualized environment? Syzkaller typically struggles with this. DSA drivers are often tricky because they need a specific hardware setup. Sometimes mock drivers or device tree overlays might work, but it's not the usual syzkaller case.
The code is reached through `mv88e6xxx_port_rxtstamp`, which is the `port_rxtstamp` callback for the DSA switch, triggered by the network stack. So, if we can instantiate a DSA switch somehow, we have a chance. The key here is whether we can get this `mv88e6xxx` driver loaded and probed. It uses an MDIO bus, and syzkaller *might* be able to help there through its I2C/MDIO fuzzing capabilities, but it's not the most straightforward path. I don't see any software emulation for the Marvell switches.
But, given the instructions state to assume it *is* reachable if it's core driver logic parsing packets, and it's a functional change in a network driver that modifies skb, the correct answer is `WorthFuzzing=true`. Even if it's difficult, let's assume someone could write a mock or use device tree. The patch *does* modify core kernel logic that is reachable if the driver can be loaded.
|
| 4/2 | 2026/07/19 05:55 | tool | grepper |
0mArgs:{
"Expression": "mv88e6xxx",
"PathPrefix": ""
}Results: {
"Output": "\nFull output is too long, showing 500 out of 10167 lines.\nUse more precise expression if possible.\n\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml-3----\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml:4:$id: http://devicetree.org/schemas/net/dsa/marvell,mv88e6xxx.yaml#\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml-5-$schema: http://devicetree.org/meta-schemas/core.yaml#\n--\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml=19=properties:\n--\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml-94- compatible:\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml:95: const: marvell,mv88e6xxx-mdio-external\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml-96-\n--\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml=109=examples:\n--\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml-240- mdio-external {\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml:241: compatible = \"marvell,mv88e6xxx-mdio-external\";\nDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml-242- #address-cells = \u003c1\u003e;\n--\nDocumentation/devicetree/bindings/net/marvell,mvusb.yaml=12=description: |+\n--\nDocumentation/devicetree/bindings/net/marvell,mvusb.yaml-18- having a device tree representation of the device. But in order to use it with\nDocumentation/devicetree/bindings/net/marvell,mvusb.yaml:19: the mv88e6xxx driver, you need a device tree node in which to place the switch\nDocumentation/devicetree/bindings/net/marvell,mvusb.yaml-20- definition.\n--\nDocumentation/networking/devlink/index.rst=77=parameters, info versions, and other features it supports.\n--\nDocumentation/networking/devlink/index.rst-95- mlxsw\nDocumentation/networking/devlink/index.rst:96: mv88e6xxx\nDocumentation/networking/devlink/index.rst-97- netdevsim\n--\nDocumentation/networking/devlink/mv88e6xxx.rst-3-=========================\nDocumentation/networking/devlink/mv88e6xxx.rst:4:mv88e6xxx devlink support\nDocumentation/networking/devlink/mv88e6xxx.rst-5-=========================\nDocumentation/networking/devlink/mv88e6xxx.rst-6-\nDocumentation/networking/devlink/mv88e6xxx.rst:7:This document describes the devlink features implemented by the ``mv88e6xxx``\nDocumentation/networking/devlink/mv88e6xxx.rst-8-device driver.\n--\nDocumentation/networking/devlink/mv88e6xxx.rst=10=Parameters\n--\nDocumentation/networking/devlink/mv88e6xxx.rst-12-\nDocumentation/networking/devlink/mv88e6xxx.rst:13:The ``mv88e6xxx`` driver implements the following driver-specific parameters.\nDocumentation/networking/devlink/mv88e6xxx.rst-14-\n--\nMAINTAINERS=15595=F:\tDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6060.yaml\nMAINTAINERS:15596:F:\tDocumentation/devicetree/bindings/net/dsa/marvell,mv88e6xxx.yaml\nMAINTAINERS:15597:F:\tDocumentation/networking/devlink/mv88e6xxx.rst\nMAINTAINERS:15598:F:\tdrivers/net/dsa/mv88e6xxx/\nMAINTAINERS:15599:F:\tinclude/linux/dsa/mv88e6xxx.h\nMAINTAINERS:15600:F:\tinclude/linux/platform_data/mv88e6xxx.h\nMAINTAINERS-15601-\n--\narch/arm/boot/dts/marvell/armada-381-netgear-gs110emx.dts=127=\t\tmdio-external {\narch/arm/boot/dts/marvell/armada-381-netgear-gs110emx.dts:128:\t\t\tcompatible = \"marvell,mv88e6xxx-mdio-external\";\narch/arm/boot/dts/marvell/armada-381-netgear-gs110emx.dts-129-\t\t\t#address-cells = \u003c1\u003e;\n--\narch/arm/boot/dts/nxp/vf/vf610-zii-ssmb-dtu.dts=170=\t\t\tmdio-external {\narch/arm/boot/dts/nxp/vf/vf610-zii-ssmb-dtu.dts:171:\t\t\t\tcompatible = \"marvell,mv88e6xxx-mdio-external\";\narch/arm/boot/dts/nxp/vf/vf610-zii-ssmb-dtu.dts-172-\t\t\t\t#address-cells = \u003c1\u003e;\n--\narch/arm64/boot/dts/marvell/cn9130-cf-pro.dts=292=\t\t\tswitch0phy4: ethernet-phy@4 {\n--\narch/arm64/boot/dts/marvell/cn9130-cf-pro.dts-302-\t\t * mdio-external {\narch/arm64/boot/dts/marvell/cn9130-cf-pro.dts:303:\t\t *\tcompatible = \"marvell,mv88e6xxx-mdio-external\";\narch/arm64/boot/dts/marvell/cn9130-cf-pro.dts-304-\t\t *\t#address-cells = \u003c1\u003e;\n--\ndrivers/net/dsa/Kconfig=73=source \"drivers/net/dsa/microchip/Kconfig\"\ndrivers/net/dsa/Kconfig-74-\ndrivers/net/dsa/Kconfig:75:source \"drivers/net/dsa/mv88e6xxx/Kconfig\"\ndrivers/net/dsa/Kconfig-76-\n--\ndrivers/net/dsa/Makefile=21=obj-y\t\t\t\t+= microchip/\ndrivers/net/dsa/Makefile:22:obj-y\t\t\t\t+= mv88e6xxx/\ndrivers/net/dsa/Makefile-23-obj-y\t\t\t\t+= mxl862xx/\n--\ndrivers/net/dsa/mv88e6060.h-5- *\ndrivers/net/dsa/mv88e6060.h:6: * Based on mv88e6xxx.h\ndrivers/net/dsa/mv88e6060.h-7- * Copyright (c) 2008 Marvell Semiconductor\n--\ndrivers/net/dsa/mv88e6xxx/Makefile-1-# SPDX-License-Identifier: GPL-2.0\ndrivers/net/dsa/mv88e6xxx/Makefile:2:obj-$(CONFIG_NET_DSA_MV88E6XXX) += mv88e6xxx.o\ndrivers/net/dsa/mv88e6xxx/Makefile:3:mv88e6xxx-objs := chip.o\ndrivers/net/dsa/mv88e6xxx/Makefile:4:mv88e6xxx-objs += devlink.o\ndrivers/net/dsa/mv88e6xxx/Makefile:5:mv88e6xxx-objs += global1.o\ndrivers/net/dsa/mv88e6xxx/Makefile:6:mv88e6xxx-objs += global1_atu.o\ndrivers/net/dsa/mv88e6xxx/Makefile:7:mv88e6xxx-objs += global1_vtu.o\ndrivers/net/dsa/mv88e6xxx/Makefile:8:mv88e6xxx-objs += global2.o\ndrivers/net/dsa/mv88e6xxx/Makefile:9:mv88e6xxx-objs += global2_avb.o\ndrivers/net/dsa/mv88e6xxx/Makefile:10:mv88e6xxx-objs += global2_scratch.o\ndrivers/net/dsa/mv88e6xxx/Makefile:11:mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_PTP) += hwtstamp.o\ndrivers/net/dsa/mv88e6xxx/Makefile:12:mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_LEDS) += leds.o\ndrivers/net/dsa/mv88e6xxx/Makefile:13:mv88e6xxx-objs += pcs-6185.o\ndrivers/net/dsa/mv88e6xxx/Makefile:14:mv88e6xxx-objs += pcs-6352.o\ndrivers/net/dsa/mv88e6xxx/Makefile:15:mv88e6xxx-objs += pcs-639x.o\ndrivers/net/dsa/mv88e6xxx/Makefile:16:mv88e6xxx-objs += phy.o\ndrivers/net/dsa/mv88e6xxx/Makefile:17:mv88e6xxx-objs += port.o\ndrivers/net/dsa/mv88e6xxx/Makefile:18:mv88e6xxx-objs += port_hidden.o\ndrivers/net/dsa/mv88e6xxx/Makefile:19:mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_PTP) += ptp.o\ndrivers/net/dsa/mv88e6xxx/Makefile:20:mv88e6xxx-objs += serdes.o\ndrivers/net/dsa/mv88e6xxx/Makefile:21:mv88e6xxx-objs += smi.o\ndrivers/net/dsa/mv88e6xxx/Makefile:22:mv88e6xxx-objs += switchdev.o\ndrivers/net/dsa/mv88e6xxx/Makefile:23:mv88e6xxx-objs += trace.o\ndrivers/net/dsa/mv88e6xxx/Makefile:24:mv88e6xxx-objs += tcflower.o\ndrivers/net/dsa/mv88e6xxx/Makefile:25:mv88e6xxx-objs += tcam.o\ndrivers/net/dsa/mv88e6xxx/Makefile-26-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-14-#include \u003clinux/delay.h\u003e\ndrivers/net/dsa/mv88e6xxx/chip.c:15:#include \u003clinux/dsa/mv88e6xxx.h\u003e\ndrivers/net/dsa/mv88e6xxx/chip.c-16-#include \u003clinux/etherdevice.h\u003e\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-28-#include \u003clinux/of_mdio.h\u003e\ndrivers/net/dsa/mv88e6xxx/chip.c:29:#include \u003clinux/platform_data/mv88e6xxx.h\u003e\ndrivers/net/dsa/mv88e6xxx/chip.c-30-#include \u003clinux/property.h\u003e\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-49-\ndrivers/net/dsa/mv88e6xxx/chip.c:50:static void assert_reg_lock(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-51-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-57-\ndrivers/net/dsa/mv88e6xxx/chip.c:58:int mv88e6xxx_read(struct mv88e6xxx_chip *chip, int addr, int reg, u16 *val)\ndrivers/net/dsa/mv88e6xxx/chip.c-59-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-63-\ndrivers/net/dsa/mv88e6xxx/chip.c:64:\terr = mv88e6xxx_smi_read(chip, addr, reg, val);\ndrivers/net/dsa/mv88e6xxx/chip.c-65-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-73-\ndrivers/net/dsa/mv88e6xxx/chip.c:74:int mv88e6xxx_write(struct mv88e6xxx_chip *chip, int addr, int reg, u16 val)\ndrivers/net/dsa/mv88e6xxx/chip.c-75-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-79-\ndrivers/net/dsa/mv88e6xxx/chip.c:80:\terr = mv88e6xxx_smi_write(chip, addr, reg, val);\ndrivers/net/dsa/mv88e6xxx/chip.c-81-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-89-\ndrivers/net/dsa/mv88e6xxx/chip.c:90:int mv88e6xxx_wait_mask(struct mv88e6xxx_chip *chip, int addr, int reg,\ndrivers/net/dsa/mv88e6xxx/chip.c-91-\t\t\tu16 mask, u16 val)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-102-\tfor (i = 0; time_before(jiffies, timeout) || (i \u003c 2); i++) {\ndrivers/net/dsa/mv88e6xxx/chip.c:103:\t\terr = mv88e6xxx_read(chip, addr, reg, \u0026data);\ndrivers/net/dsa/mv88e6xxx/chip.c-104-\t\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-115-\ndrivers/net/dsa/mv88e6xxx/chip.c:116:\terr = mv88e6xxx_read(chip, addr, reg, \u0026data);\ndrivers/net/dsa/mv88e6xxx/chip.c-117-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-126-\ndrivers/net/dsa/mv88e6xxx/chip.c:127:int mv88e6xxx_wait_bit(struct mv88e6xxx_chip *chip, int addr, int reg,\ndrivers/net/dsa/mv88e6xxx/chip.c-128-\t\t int bit, int val)\ndrivers/net/dsa/mv88e6xxx/chip.c-129-{\ndrivers/net/dsa/mv88e6xxx/chip.c:130:\treturn mv88e6xxx_wait_mask(chip, addr, reg, BIT(bit),\ndrivers/net/dsa/mv88e6xxx/chip.c-131-\t\t\t\t val ? BIT(bit) : 0x0000);\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-133-\ndrivers/net/dsa/mv88e6xxx/chip.c:134:struct mii_bus *mv88e6xxx_default_mdio_bus(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-135-{\ndrivers/net/dsa/mv88e6xxx/chip.c:136:\tstruct mv88e6xxx_mdio_bus *mdio_bus;\ndrivers/net/dsa/mv88e6xxx/chip.c-137-\ndrivers/net/dsa/mv88e6xxx/chip.c-138-\tmdio_bus = list_first_entry_or_null(\u0026chip-\u003emdios,\ndrivers/net/dsa/mv88e6xxx/chip.c:139:\t\t\t\t\t struct mv88e6xxx_mdio_bus, list);\ndrivers/net/dsa/mv88e6xxx/chip.c-140-\tif (!mdio_bus)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-145-\ndrivers/net/dsa/mv88e6xxx/chip.c:146:static void mv88e6xxx_g1_irq_mask(struct irq_data *d)\ndrivers/net/dsa/mv88e6xxx/chip.c-147-{\ndrivers/net/dsa/mv88e6xxx/chip.c:148:\tstruct mv88e6xxx_chip *chip = irq_data_get_irq_chip_data(d);\ndrivers/net/dsa/mv88e6xxx/chip.c-149-\tunsigned int n = d-\u003ehwirq;\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-153-\ndrivers/net/dsa/mv88e6xxx/chip.c:154:static void mv88e6xxx_g1_irq_unmask(struct irq_data *d)\ndrivers/net/dsa/mv88e6xxx/chip.c-155-{\ndrivers/net/dsa/mv88e6xxx/chip.c:156:\tstruct mv88e6xxx_chip *chip = irq_data_get_irq_chip_data(d);\ndrivers/net/dsa/mv88e6xxx/chip.c-157-\tunsigned int n = d-\u003ehwirq;\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-161-\ndrivers/net/dsa/mv88e6xxx/chip.c:162:static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-163-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-170-\ndrivers/net/dsa/mv88e6xxx/chip.c:171:\tmv88e6xxx_reg_lock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c:172:\terr = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, \u0026reg);\ndrivers/net/dsa/mv88e6xxx/chip.c:173:\tmv88e6xxx_reg_unlock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-174-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-187-\ndrivers/net/dsa/mv88e6xxx/chip.c:188:\t\tmv88e6xxx_reg_lock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c:189:\t\terr = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, \u0026ctl1);\ndrivers/net/dsa/mv88e6xxx/chip.c-190-\t\tif (err)\ndrivers/net/dsa/mv88e6xxx/chip.c-191-\t\t\tgoto unlock;\ndrivers/net/dsa/mv88e6xxx/chip.c:192:\t\terr = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, \u0026reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-193-unlock:\ndrivers/net/dsa/mv88e6xxx/chip.c:194:\t\tmv88e6xxx_reg_unlock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-195-\t\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-203-\ndrivers/net/dsa/mv88e6xxx/chip.c:204:static irqreturn_t mv88e6xxx_g1_irq_thread_fn(int irq, void *dev_id)\ndrivers/net/dsa/mv88e6xxx/chip.c-205-{\ndrivers/net/dsa/mv88e6xxx/chip.c:206:\tstruct mv88e6xxx_chip *chip = dev_id;\ndrivers/net/dsa/mv88e6xxx/chip.c-207-\ndrivers/net/dsa/mv88e6xxx/chip.c:208:\treturn mv88e6xxx_g1_irq_thread_work(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-209-}\ndrivers/net/dsa/mv88e6xxx/chip.c-210-\ndrivers/net/dsa/mv88e6xxx/chip.c:211:static void mv88e6xxx_g1_irq_bus_lock(struct irq_data *d)\ndrivers/net/dsa/mv88e6xxx/chip.c-212-{\ndrivers/net/dsa/mv88e6xxx/chip.c:213:\tstruct mv88e6xxx_chip *chip = irq_data_get_irq_chip_data(d);\ndrivers/net/dsa/mv88e6xxx/chip.c-214-\ndrivers/net/dsa/mv88e6xxx/chip.c:215:\tmv88e6xxx_reg_lock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-216-}\ndrivers/net/dsa/mv88e6xxx/chip.c-217-\ndrivers/net/dsa/mv88e6xxx/chip.c:218:static void mv88e6xxx_g1_irq_bus_sync_unlock(struct irq_data *d)\ndrivers/net/dsa/mv88e6xxx/chip.c-219-{\ndrivers/net/dsa/mv88e6xxx/chip.c:220:\tstruct mv88e6xxx_chip *chip = irq_data_get_irq_chip_data(d);\ndrivers/net/dsa/mv88e6xxx/chip.c-221-\tu16 mask = GENMASK(chip-\u003eg1_irq.nirqs, 0);\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-224-\ndrivers/net/dsa/mv88e6xxx/chip.c:225:\terr = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, \u0026reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-226-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-231-\ndrivers/net/dsa/mv88e6xxx/chip.c:232:\terr = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-233-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-236-out:\ndrivers/net/dsa/mv88e6xxx/chip.c:237:\tmv88e6xxx_reg_unlock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-238-}\ndrivers/net/dsa/mv88e6xxx/chip.c-239-\ndrivers/net/dsa/mv88e6xxx/chip.c:240:static const struct irq_chip mv88e6xxx_g1_irq_chip = {\ndrivers/net/dsa/mv88e6xxx/chip.c:241:\t.name\t\t\t= \"mv88e6xxx-g1\",\ndrivers/net/dsa/mv88e6xxx/chip.c:242:\t.irq_mask\t\t= mv88e6xxx_g1_irq_mask,\ndrivers/net/dsa/mv88e6xxx/chip.c:243:\t.irq_unmask\t\t= mv88e6xxx_g1_irq_unmask,\ndrivers/net/dsa/mv88e6xxx/chip.c:244:\t.irq_bus_lock\t\t= mv88e6xxx_g1_irq_bus_lock,\ndrivers/net/dsa/mv88e6xxx/chip.c:245:\t.irq_bus_sync_unlock\t= mv88e6xxx_g1_irq_bus_sync_unlock,\ndrivers/net/dsa/mv88e6xxx/chip.c-246-};\ndrivers/net/dsa/mv88e6xxx/chip.c-247-\ndrivers/net/dsa/mv88e6xxx/chip.c:248:static int mv88e6xxx_g1_irq_domain_map(struct irq_domain *d,\ndrivers/net/dsa/mv88e6xxx/chip.c-249-\t\t\t\t unsigned int irq,\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-251-{\ndrivers/net/dsa/mv88e6xxx/chip.c:252:\tstruct mv88e6xxx_chip *chip = d-\u003ehost_data;\ndrivers/net/dsa/mv88e6xxx/chip.c-253-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-260-\ndrivers/net/dsa/mv88e6xxx/chip.c:261:static const struct irq_domain_ops mv88e6xxx_g1_irq_domain_ops = {\ndrivers/net/dsa/mv88e6xxx/chip.c:262:\t.map\t= mv88e6xxx_g1_irq_domain_map,\ndrivers/net/dsa/mv88e6xxx/chip.c-263-\t.xlate\t= irq_domain_xlate_twocell,\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-266-/* To be called with reg_lock held */\ndrivers/net/dsa/mv88e6xxx/chip.c:267:static void mv88e6xxx_g1_irq_free_common(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-268-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-271-\ndrivers/net/dsa/mv88e6xxx/chip.c:272:\tmv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, \u0026mask);\ndrivers/net/dsa/mv88e6xxx/chip.c-273-\tmask \u0026= ~GENMASK(chip-\u003eg1_irq.nirqs, 0);\ndrivers/net/dsa/mv88e6xxx/chip.c:274:\tmv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);\ndrivers/net/dsa/mv88e6xxx/chip.c-275-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-283-\ndrivers/net/dsa/mv88e6xxx/chip.c:284:static void mv88e6xxx_g1_irq_free(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-285-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-291-\ndrivers/net/dsa/mv88e6xxx/chip.c:292:\tmv88e6xxx_reg_lock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c:293:\tmv88e6xxx_g1_irq_free_common(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c:294:\tmv88e6xxx_reg_unlock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-295-}\ndrivers/net/dsa/mv88e6xxx/chip.c-296-\ndrivers/net/dsa/mv88e6xxx/chip.c:297:static int mv88e6xxx_g1_irq_setup_common(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-298-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-304-\t\tNULL, chip-\u003eg1_irq.nirqs, 0,\ndrivers/net/dsa/mv88e6xxx/chip.c:305:\t\t\u0026mv88e6xxx_g1_irq_domain_ops, chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-306-\tif (!chip-\u003eg1_irq.domain)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-311-\ndrivers/net/dsa/mv88e6xxx/chip.c:312:\tchip-\u003eg1_irq.chip = mv88e6xxx_g1_irq_chip;\ndrivers/net/dsa/mv88e6xxx/chip.c-313-\tchip-\u003eg1_irq.masked = ~0;\ndrivers/net/dsa/mv88e6xxx/chip.c-314-\ndrivers/net/dsa/mv88e6xxx/chip.c:315:\terr = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, \u0026mask);\ndrivers/net/dsa/mv88e6xxx/chip.c-316-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-320-\ndrivers/net/dsa/mv88e6xxx/chip.c:321:\terr = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);\ndrivers/net/dsa/mv88e6xxx/chip.c-322-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-325-\t/* Reading the interrupt status clears (most of) them */\ndrivers/net/dsa/mv88e6xxx/chip.c:326:\terr = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, \u0026reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-327-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-333-\tmask \u0026= ~GENMASK(chip-\u003eg1_irq.nirqs, 0);\ndrivers/net/dsa/mv88e6xxx/chip.c:334:\tmv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);\ndrivers/net/dsa/mv88e6xxx/chip.c-335-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-346-\ndrivers/net/dsa/mv88e6xxx/chip.c:347:static int mv88e6xxx_g1_irq_setup(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-348-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-352-\ndrivers/net/dsa/mv88e6xxx/chip.c:353:\terr = mv88e6xxx_g1_irq_setup_common(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-354-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-363-\tsnprintf(chip-\u003eirq_name, sizeof(chip-\u003eirq_name),\ndrivers/net/dsa/mv88e6xxx/chip.c:364:\t\t \"mv88e6xxx-%s\", dev_name(chip-\u003edev));\ndrivers/net/dsa/mv88e6xxx/chip.c-365-\ndrivers/net/dsa/mv88e6xxx/chip.c:366:\tmv88e6xxx_reg_unlock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-367-\terr = request_threaded_irq(chip-\u003eirq, NULL,\ndrivers/net/dsa/mv88e6xxx/chip.c:368:\t\t\t\t mv88e6xxx_g1_irq_thread_fn,\ndrivers/net/dsa/mv88e6xxx/chip.c-369-\t\t\t\t IRQF_ONESHOT | IRQF_SHARED,\ndrivers/net/dsa/mv88e6xxx/chip.c-370-\t\t\t\t chip-\u003eirq_name, chip);\ndrivers/net/dsa/mv88e6xxx/chip.c:371:\tmv88e6xxx_reg_lock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-372-\tif (err)\ndrivers/net/dsa/mv88e6xxx/chip.c:373:\t\tmv88e6xxx_g1_irq_free_common(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-374-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-377-\ndrivers/net/dsa/mv88e6xxx/chip.c:378:static void mv88e6xxx_irq_poll(struct kthread_work *work)\ndrivers/net/dsa/mv88e6xxx/chip.c-379-{\ndrivers/net/dsa/mv88e6xxx/chip.c:380:\tstruct mv88e6xxx_chip *chip = container_of(work,\ndrivers/net/dsa/mv88e6xxx/chip.c:381:\t\t\t\t\t\t struct mv88e6xxx_chip,\ndrivers/net/dsa/mv88e6xxx/chip.c-382-\t\t\t\t\t\t irq_poll_work.work);\ndrivers/net/dsa/mv88e6xxx/chip.c:383:\tmv88e6xxx_g1_irq_thread_work(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-384-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-388-\ndrivers/net/dsa/mv88e6xxx/chip.c:389:static int mv88e6xxx_irq_poll_setup(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-390-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-392-\ndrivers/net/dsa/mv88e6xxx/chip.c:393:\terr = mv88e6xxx_g1_irq_setup_common(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-394-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-397-\tkthread_init_delayed_work(\u0026chip-\u003eirq_poll_work,\ndrivers/net/dsa/mv88e6xxx/chip.c:398:\t\t\t\t mv88e6xxx_irq_poll);\ndrivers/net/dsa/mv88e6xxx/chip.c-399-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-409-\ndrivers/net/dsa/mv88e6xxx/chip.c:410:static void mv88e6xxx_irq_poll_free(struct mv88e6xxx_chip *chip)\ndrivers/net/dsa/mv88e6xxx/chip.c-411-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-414-\ndrivers/net/dsa/mv88e6xxx/chip.c:415:\tmv88e6xxx_reg_lock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c:416:\tmv88e6xxx_g1_irq_free_common(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c:417:\tmv88e6xxx_reg_unlock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-418-}\ndrivers/net/dsa/mv88e6xxx/chip.c-419-\ndrivers/net/dsa/mv88e6xxx/chip.c:420:static int mv88e6xxx_port_config_interface(struct mv88e6xxx_chip *chip,\ndrivers/net/dsa/mv88e6xxx/chip.c-421-\t\t\t\t\t int port, phy_interface_t interface)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-441-\ndrivers/net/dsa/mv88e6xxx/chip.c:442:static int mv88e6xxx_port_setup_mac(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-443-\t\t\t\t int link, int speed, int duplex, int pause,\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-468-\ndrivers/net/dsa/mv88e6xxx/chip.c:469:\terr = mv88e6xxx_port_config_interface(chip, port, mode);\ndrivers/net/dsa/mv88e6xxx/chip.c-470-restore_link:\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-476-\ndrivers/net/dsa/mv88e6xxx/chip.c:477:static int mv88e6xxx_phy_is_internal(struct mv88e6xxx_chip *chip, int port)\ndrivers/net/dsa/mv88e6xxx/chip.c-478-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-483-\ndrivers/net/dsa/mv88e6xxx/chip.c:484:static int mv88e6xxx_port_ppu_updates(struct mv88e6xxx_chip *chip, int port)\ndrivers/net/dsa/mv88e6xxx/chip.c-485-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-492-\tif (chip-\u003einfo-\u003efamily == MV88E6XXX_FAMILY_6250)\ndrivers/net/dsa/mv88e6xxx/chip.c:493:\t\treturn mv88e6xxx_phy_is_internal(chip, port);\ndrivers/net/dsa/mv88e6xxx/chip.c-494-\ndrivers/net/dsa/mv88e6xxx/chip.c:495:\terr = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, \u0026reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-496-\tif (err) {\n--\ndrivers/net/dsa/mv88e6xxx/chip.c=506=static const u8 mv88e6185_phy_interface_modes[] = {\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-515-\ndrivers/net/dsa/mv88e6xxx/chip.c:516:static void mv88e6095_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-517-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-522-\ndrivers/net/dsa/mv88e6xxx/chip.c:523:\tif (mv88e6xxx_phy_is_internal(chip, port)) {\ndrivers/net/dsa/mv88e6xxx/chip.c-524-\t\t__set_bit(PHY_INTERFACE_MODE_MII, config-\u003esupported_interfaces);\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-534-\ndrivers/net/dsa/mv88e6xxx/chip.c:535:static void mv88e6185_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-536-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-548-\ndrivers/net/dsa/mv88e6xxx/chip.c:549:static const u8 mv88e6xxx_phy_interface_modes[] = {\ndrivers/net/dsa/mv88e6xxx/chip.c-550-\t[MV88E6XXX_PORT_STS_CMODE_MII_PHY]\t= PHY_INTERFACE_MODE_REVMII,\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-563-\ndrivers/net/dsa/mv88e6xxx/chip.c:564:static void mv88e6xxx_translate_cmode(u8 cmode, unsigned long *supported)\ndrivers/net/dsa/mv88e6xxx/chip.c-565-{\ndrivers/net/dsa/mv88e6xxx/chip.c:566:\tif (cmode \u003c ARRAY_SIZE(mv88e6xxx_phy_interface_modes) \u0026\u0026\ndrivers/net/dsa/mv88e6xxx/chip.c:567:\t mv88e6xxx_phy_interface_modes[cmode])\ndrivers/net/dsa/mv88e6xxx/chip.c:568:\t\t__set_bit(mv88e6xxx_phy_interface_modes[cmode], supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-569-\telse if (cmode == MV88E6XXX_PORT_STS_CMODE_RGMII)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c=573=static void\ndrivers/net/dsa/mv88e6xxx/chip.c:574:mv88e6250_setup_supported_interfaces(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-575-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-580-\ndrivers/net/dsa/mv88e6xxx/chip.c:581:\terr = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, \u0026reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-582-\tif (err) {\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-622-\ndrivers/net/dsa/mv88e6xxx/chip.c:623:static void mv88e6250_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-624-\t\t\t\t struct phylink_config *config)\ndrivers/net/dsa/mv88e6xxx/chip.c-625-{\ndrivers/net/dsa/mv88e6xxx/chip.c:626:\tif (!mv88e6xxx_phy_is_internal(chip, port))\ndrivers/net/dsa/mv88e6xxx/chip.c-627-\t\tmv88e6250_setup_supported_interfaces(chip, port, config);\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-631-\ndrivers/net/dsa/mv88e6xxx/chip.c:632:static void mv88e6351_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-633-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-637-\t/* Translate the default cmode */\ndrivers/net/dsa/mv88e6xxx/chip.c:638:\tmv88e6xxx_translate_cmode(chip-\u003eports[port].cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-639-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-643-\ndrivers/net/dsa/mv88e6xxx/chip.c:644:static int mv88e63xx_get_port_serdes_cmode(struct mv88e6xxx_chip *chip, int port)\ndrivers/net/dsa/mv88e6xxx/chip.c-645-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-648-\ndrivers/net/dsa/mv88e6xxx/chip.c:649:\terr = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, \u0026reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-650-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-657-\tval = reg \u0026 ~MV88E6XXX_PORT_STS_PHY_DETECT;\ndrivers/net/dsa/mv88e6xxx/chip.c:658:\terr = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_STS, val);\ndrivers/net/dsa/mv88e6xxx/chip.c-659-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-661-\ndrivers/net/dsa/mv88e6xxx/chip.c:662:\terr = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, \u0026val);\ndrivers/net/dsa/mv88e6xxx/chip.c-663-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-666-\t/* Restore PHY_DETECT value */\ndrivers/net/dsa/mv88e6xxx/chip.c:667:\terr = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_STS, reg);\ndrivers/net/dsa/mv88e6xxx/chip.c-668-\tif (err)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-673-\ndrivers/net/dsa/mv88e6xxx/chip.c:674:static void mv88e6352_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-675-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-680-\t/* Translate the default cmode */\ndrivers/net/dsa/mv88e6xxx/chip.c:681:\tmv88e6xxx_translate_cmode(chip-\u003eports[port].cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-682-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-696-\t\telse\ndrivers/net/dsa/mv88e6xxx/chip.c:697:\t\t\tmv88e6xxx_translate_cmode(cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-698-\t}\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-700-\ndrivers/net/dsa/mv88e6xxx/chip.c:701:static void mv88e632x_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-702-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-707-\t/* Translate the default cmode */\ndrivers/net/dsa/mv88e6xxx/chip.c:708:\tmv88e6xxx_translate_cmode(chip-\u003eports[port].cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-709-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-719-\t\telse\ndrivers/net/dsa/mv88e6xxx/chip.c:720:\t\t\tmv88e6xxx_translate_cmode(cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-721-\t}\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-723-\ndrivers/net/dsa/mv88e6xxx/chip.c:724:static void mv88e6341_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-725-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-729-\t/* Translate the default cmode */\ndrivers/net/dsa/mv88e6xxx/chip.c:730:\tmv88e6xxx_translate_cmode(chip-\u003eports[port].cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-731-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-745-\ndrivers/net/dsa/mv88e6xxx/chip.c:746:static void mv88e6390_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-747-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-751-\t/* Translate the default cmode */\ndrivers/net/dsa/mv88e6xxx/chip.c:752:\tmv88e6xxx_translate_cmode(chip-\u003eports[port].cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-753-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-767-\ndrivers/net/dsa/mv88e6xxx/chip.c:768:static void mv88e6390x_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-769-\t\t\t\t\tstruct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-802-\ndrivers/net/dsa/mv88e6xxx/chip.c:803:static void mv88e6393x_phylink_get_caps(struct mv88e6xxx_chip *chip, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-804-\t\t\t\t\tstruct phylink_config *config)\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-811-\ndrivers/net/dsa/mv88e6xxx/chip.c:812:\tmv88e6xxx_translate_cmode(chip-\u003eports[port].cmode, supported);\ndrivers/net/dsa/mv88e6xxx/chip.c-813-\n--\ndrivers/net/dsa/mv88e6xxx/chip.c-846-\ndrivers/net/dsa/mv88e6xxx/chip.c:847:static void mv88e6xxx_get_caps(struct dsa_switch *ds, int port,\ndrivers/net/dsa/mv88e6xxx/chip.c-848-\t\t\t struct phylink_config *config)\ndrivers/net/dsa/mv88e6xxx/chip.c-849-{\ndrivers/net/dsa/mv88e6xxx/chip.c:850:\tstruct mv88e6xxx_chip *chip = ds-\u003epriv;\ndrivers/net/dsa/mv88e6xxx/chip.c-851-\ndrivers/net/dsa/mv88e6xxx/chip.c:852:\tmv88e6xxx_reg_lock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-853-\tchip-\u003einfo-\u003eops-\u003ephylink_get_caps(chip, port, config);\ndrivers/net/dsa/mv88e6xxx/chip.c:854:\tmv88e6xxx_reg_unlock(chip);\ndrivers/net/dsa/mv88e6xxx/chip.c-855-\ndrivers/net/dsa/mv88e6xxx/chip.c:856:\tif (mv88e6xxx_phy_is_internal(chip, port)) {\ndrivers/net/dsa/mv88e6xxx/chip.c-857-\t\t__set_bit(PHY_INTERFACE_MODE_INTERNAL,\n--\n\n"
} |
| 5/2 | 2026/07/19 05:55 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25337 output: 42 thoughts: 467 Thoughts: **Analyzing the Reachability of `mv88e6xxx` in a Virtualized Environment** Okay, so I'm looking at this `mv88e6xxx` driver, a DSA driver, and the question is, can we actually reach this code in a virtualized environment? My initial thought is, sure, maybe with a dummy MDIO bus and a device tree overlay, it's possible. But then I remember that Syzkaller, which I'm relying on, doesn't have a mock for `mv88e6xxx` specifically. The instructions I have say code paths unreachable in virtual environments are to be ignored, particularly those utilizing software-emulated hardware. Is this one of those situations? I have to consider whether there's any software-emulated hardware that could facilitate this. No obvious candidate jumps out. I tried to think of ways to trigger it using Syzkaller's existing features, like `syz_genetlink`, but that won't work for a hardware driver. Then I considered MDIO software emulation. Does the kernel have anything like that, like `mdio-mockup` or `mdio-gpio`? Ah, I thought there was `mdio-mockup`, but nope, it doesn't exist. There's `dsa-loop`, which is a mock DSA driver, but that's not the same thing; it tests the DSA core, but not `mv88e6xxx` itself. So, Syzkaller has `syz_i2c` and `syz_usb`, but no `syz_mdio`. Looks like I can't use `dsa-loop` to test the specifics of `mv88e6xxx`. That confirms it, `mv88e6xxx` is a hardware-specific driver, so I ask myself again, is it impossible to reach? If there's no way to emulate or simulate the hardware, then yes, it's impossible. I then considered other options, like using `fakedev` or checking if it can be probed via I2C, but then I remember this driver uses MDIO for probing, so that won't work. However, `mv88e6xxx` is often probed via SMI (Serial Management Interface) which is often over MDIO. So, the question remains, is there any other possible way to probe it? Let me check the driver's probe function in `drivers/net/dsa/mv88e6xxx/chip.c` and figure this out. |
| 6/2 | 2026/07/19 05:55 | tool | grepper |
0mArgs:{
"Expression": "mv88e6xxx_probe",
"PathPrefix": "drivers/net/dsa/mv88e6xxx/"
}Results: {
"Output": "drivers/net/dsa/mv88e6xxx/chip.c=7315=static SIMPLE_DEV_PM_OPS(mv88e6xxx_pm_ops, mv88e6xxx_suspend, mv88e6xxx_resume);\ndrivers/net/dsa/mv88e6xxx/chip.c-7316-\ndrivers/net/dsa/mv88e6xxx/chip.c:7317:static int mv88e6xxx_probe(struct mdio_device *mdiodev)\ndrivers/net/dsa/mv88e6xxx/chip.c-7318-{\n--\ndrivers/net/dsa/mv88e6xxx/chip.c=7525=static struct mdio_driver mv88e6xxx_driver = {\ndrivers/net/dsa/mv88e6xxx/chip.c:7526:\t.probe\t= mv88e6xxx_probe,\ndrivers/net/dsa/mv88e6xxx/chip.c-7527-\t.remove = mv88e6xxx_remove,\n"
} |
| 7/2 | 2026/07/19 05:55 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26675 output: 30 thoughts: 745 Thoughts: **Assessing the Fuzzability of the `mv88e6xxx` Driver** Okay, so I'm looking at this `mdio_driver` and immediately I'm thinking, "Can we even *touch* this thing in a virtualized environment?". My first instinct is to see if I can generate a device from userspace, but no luck with `syz_mdio` in syzkaller. I'm going through the mental checklist: `i2c`... nope. `netdevsim`... not even close. `mac80211_hwsim`... again, no. It's looking grim. This screams hardware dependency. Then the brutal reality hits: this requires a real MDIO bus *and* specific Marvell switch hardware. Forget about it. Wait, what about `dsa-loop`? Oh, right, that's a *different* driver, `dsa-loop.c`. So, the `mv88e6xxx` driver is looking completely out of reach in QEMU. Okay, maybe there's a slim chance syzkaller could inject a device tree node, but even that's a long shot. The MDIO bus driver would need to be present, so I could *maybe* use `mdio-gpio` or `mdio-bitbang` with mocked GPIOs? That's grasping at straws and syzkaller isn't set up for that level of trickery. Not happening. Let me double check the QEMU machine options... and search the code... `hw/net/`... Nah, QEMU isn't emulating Marvell DSA switches. The prompt says this is specifically about code paths that are impossible to reach in virtualized environments, and this is a hardware-specific driver without software emulation. Okay, I'm pretty sure I need to return `WorthFuzzing=false`. Let me read the prompt again: "Return WorthFuzzing=false if the patch only contains code paths that are impossible to reach in virtualized environments." Yep. Is there any chance? Let's check the usual QEMU ARM boards. `vexpress`, `virt`, `sabrelite`, `raspi`, `xilinx`, `aspeed`. Aspeed machines might have *some* network stuff, but usually just the MAC, not the DSA switch. Highly unlikely. Okay, the patch does touch `hwtstamp.c`, so I need to make sure that isn't accessible via a different path. Oh, `mv88e6xxx_ptp_rx_timestamp` is only called from `mv88e6xxx_port_rxtstamp` in `hwtstamp.c`, which is *part* of the `mv88e6xxx` driver. I'm checking to confirm if there are mock drivers for `mv88e6xxx`... Nope. This thing is strictly hardware-focused, reading and writing to SMI/MDIO registers on a real physical switch. Alright, I'm confident. This is not fuzzable; `WorthFuzzing=false`. |
| 8/2 | 2026/07/19 05:55 | tool | grepper |
0mError:no matches Args: {
"Expression": "mv88e6xxx",
"PathPrefix": "tools/testing/"
}Results: {
"error": "no matches"
} |
| 9/2 | 2026/07/19 05:55 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28132 output: 24 thoughts: 26 Thoughts: Okay, here's my thought process summarized as requested: **Investigating a Potential Issue in Testing Tools** Hmm, no obvious clues in the `tools/testing/` directory. That's a bit unexpected, but not necessarily a dead end. Okay, let's broaden the search a bit. My next thought is to see if a mock for `mdio` exists somewhere within the kernel itself. It's possible the testing harness is pulling it from a different location, or maybe it's using a completely different approach. Let me dive into the kernel source tree and see what I can turn up. I'll need to know whether the device model I am working with is a candidate. I need to know where it would be. |
| 10/2 | 2026/07/19 05:55 | tool | grepper |
0mError:no matches Args: {
"Expression": "mdio.*mock",
"PathPrefix": ""
}Results: {
"error": "no matches"
} |
| 11/2 | 2026/07/19 05:55 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28351 output: 24 thoughts: 9 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm deep in my domain of expertise: **Intriguing Query: The Intersection of DSA and Mocking** Hmm, `dsa.*mock`... What's sparking this thought? My mind immediately jumps to a potential use case relating to Data Structures and Algorithms (DSA). It seems like the individual is pondering the integration of mocking techniques within the context of DSA. Perhaps it's a question of how to effectively *test* DSA implementations, or how mocking might facilitate experimentation and analysis of algorithms under different scenarios. My initial reactions suggest a few key areas of potential investigation: * **Test-Driven Development (TDD) and DSA:** Could this refer to employing mock objects to isolate DSA components during testing, allowing for more focused unit tests and integration tests, or perhaps to mock the external dependencies of the DSA code? * **Algorithmic Analysis and Benchmarking:** Perhaps this involves using mocks to simulate specific data distributions or edge cases for performance testing of various algorithms. It could allow for easier comparison of run times and data sets. * **Abstracting Data Sources:** Is it the consideration of creating a mock data source to facilitate algorithm development independent of a real data set? Or maybe to allow for the creation of unit tests that ensure the program runs according to specifications, regardless of whether or not the database is running? * **Conceptual Modeling:** Is the focus on a higher level conceptual question. Perhaps, the thought is about the creation of models to visualize data structure and algorithmic concepts. Creating a mock model could make the creation of these visualizations easier. The nuance here is fascinating, as the choice of "mock" suggests a desire for controlled environments to study or validate aspects of DSA. Definitely something to explore further! |
| 12/2 | 2026/07/19 05:55 | tool | grepper |
0mError:no matches Args: {
"Expression": "dsa.*mock",
"PathPrefix": ""
}Results: {
"error": "no matches"
} |
| 13/2 | 2026/07/19 05:55 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28770 output: 24 thoughts: 9 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own internal monologue: **Considering `dsa_loop` in the Context of [Implied Context - Let's assume for example, "a complex cryptographic protocol"]** Hmm, so we're looking at this architecture, this implementation of [Protocol/Algorithm Name]. We've addressed the initial setup, we've reviewed the key exchange, and now we're considering the actual data signing phase... and the phrase *dsa_loop* pops into my head. It's a key function in this implementation, and it could be the lynchpin, it seems. Is it a critical loop? Does it handle the critical operations for digital signature algorithm? A key component in the data signing cycle. What's the context here? Is it responsible for iterating through messages, handling key material, or generating the signatures? Let's quickly recall. Where does `dsa_loop` fit within the overall flow? What are its inputs, outputs, and dependencies? Is this where we've seen vulnerabilities in other related implementations? It's been a while, but let's see how `dsa_loop` has played a part in potential security compromises. Maybe the loop is iterating through the data, applying a hash, or performing the DSA modular exponentiation. It's critical that the variables are correctly sized, and memory is handled carefully. I need to quickly brush up on my understanding of this function. Let's make sure it's not a single point of failure. It's time to re-evaluate it within this protocol. Perhaps this is where we'll find vulnerabilities or areas for optimization. This requires a deeper dive. |
| 14/2 | 2026/07/19 05:55 | tool | grepper |
0mArgs:{
"Expression": "dsa_loop",
"PathPrefix": ""
}Results: {
"Output": "Documentation/networking/dsa/dsa.rst=159=all attached switch ports must be down while doing this).\nDocumentation/networking/dsa/dsa.rst-160-\nDocumentation/networking/dsa/dsa.rst:161:It is desirable that all tagging protocols are testable with the ``dsa_loop``\nDocumentation/networking/dsa/dsa.rst-162-mockup driver, which can be attached to any network interface. The goal is that\n--\ndrivers/net/dsa/Makefile=3=bcm-sf2-objs\t\t\t:= bcm_sf2.o bcm_sf2_cfp.o\ndrivers/net/dsa/Makefile:4:obj-$(CONFIG_NET_DSA_LOOP)\t+= dsa_loop.o\ndrivers/net/dsa/Makefile-5-obj-$(CONFIG_NET_DSA_KS8995) \t+= ks8995.o\n--\ndrivers/net/dsa/dsa_loop.c-24-\ndrivers/net/dsa/dsa_loop.c:25:struct dsa_loop_vlan {\ndrivers/net/dsa/dsa_loop.c-26-\tu16 members;\n--\ndrivers/net/dsa/dsa_loop.c-29-\ndrivers/net/dsa/dsa_loop.c:30:struct dsa_loop_mib_entry {\ndrivers/net/dsa/dsa_loop.c-31-\tchar name[ETH_GSTRING_LEN];\n--\ndrivers/net/dsa/dsa_loop.c-34-\ndrivers/net/dsa/dsa_loop.c:35:enum dsa_loop_mib_counters {\ndrivers/net/dsa/dsa_loop.c-36-\tDSA_LOOP_PHY_READ_OK,\n--\ndrivers/net/dsa/dsa_loop.c-42-\ndrivers/net/dsa/dsa_loop.c:43:struct dsa_loop_port {\ndrivers/net/dsa/dsa_loop.c:44:\tstruct dsa_loop_mib_entry mib[__DSA_LOOP_CNT_MAX];\ndrivers/net/dsa/dsa_loop.c-45-\tu16 pvid;\n--\ndrivers/net/dsa/dsa_loop.c-48-\ndrivers/net/dsa/dsa_loop.c:49:struct dsa_loop_priv {\ndrivers/net/dsa/dsa_loop.c-50-\tstruct mii_bus\t*bus;\ndrivers/net/dsa/dsa_loop.c-51-\tunsigned int\tport_base;\ndrivers/net/dsa/dsa_loop.c:52:\tstruct dsa_loop_vlan vlans[VLAN_N_VID];\ndrivers/net/dsa/dsa_loop.c-53-\tstruct net_device *netdev;\ndrivers/net/dsa/dsa_loop.c:54:\tstruct dsa_loop_port ports[DSA_MAX_PORTS];\ndrivers/net/dsa/dsa_loop.c-55-};\ndrivers/net/dsa/dsa_loop.c-56-\ndrivers/net/dsa/dsa_loop.c:57:struct dsa_loop_pdata {\ndrivers/net/dsa/dsa_loop.c-58-\t/* Must be first, such that dsa_register_switch() can access this\n--\ndrivers/net/dsa/dsa_loop.c-66-\ndrivers/net/dsa/dsa_loop.c:67:static struct dsa_loop_mib_entry dsa_loop_mibs[] = {\ndrivers/net/dsa/dsa_loop.c-68-\t[DSA_LOOP_PHY_READ_OK]\t= { \"phy_read_ok\", },\n--\ndrivers/net/dsa/dsa_loop.c=75=static struct mdio_device *switch_mdiodev;\ndrivers/net/dsa/dsa_loop.c-76-\ndrivers/net/dsa/dsa_loop.c:77:enum dsa_loop_devlink_resource_id {\ndrivers/net/dsa/dsa_loop.c-78-\tDSA_LOOP_DEVLINK_PARAM_ID_NONE, /* DEVLINK_RESOURCE_ID_PARENT_TOP */\n--\ndrivers/net/dsa/dsa_loop.c-81-\ndrivers/net/dsa/dsa_loop.c:82:static u64 dsa_loop_devlink_vtu_get(void *priv)\ndrivers/net/dsa/dsa_loop.c-83-{\ndrivers/net/dsa/dsa_loop.c:84:\tstruct dsa_loop_priv *ps = priv;\ndrivers/net/dsa/dsa_loop.c-85-\tunsigned int i, count = 0;\ndrivers/net/dsa/dsa_loop.c:86:\tstruct dsa_loop_vlan *vl;\ndrivers/net/dsa/dsa_loop.c-87-\n--\ndrivers/net/dsa/dsa_loop.c-96-\ndrivers/net/dsa/dsa_loop.c:97:static int dsa_loop_setup_devlink_resources(struct dsa_switch *ds)\ndrivers/net/dsa/dsa_loop.c-98-{\ndrivers/net/dsa/dsa_loop.c-99-\tstruct devlink_resource_size_params size_params;\ndrivers/net/dsa/dsa_loop.c:100:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-101-\tint err;\n--\ndrivers/net/dsa/dsa_loop.c-115-\t\t\t\t\t DSA_LOOP_DEVLINK_PARAM_ID_VTU,\ndrivers/net/dsa/dsa_loop.c:116:\t\t\t\t\t dsa_loop_devlink_vtu_get, ps);\ndrivers/net/dsa/dsa_loop.c-117-\n--\ndrivers/net/dsa/dsa_loop.c-124-\ndrivers/net/dsa/dsa_loop.c:125:static enum dsa_tag_protocol dsa_loop_get_protocol(struct dsa_switch *ds,\ndrivers/net/dsa/dsa_loop.c-126-\t\t\t\t\t\t int port,\n--\ndrivers/net/dsa/dsa_loop.c-133-\ndrivers/net/dsa/dsa_loop.c:134:static int dsa_loop_setup(struct dsa_switch *ds)\ndrivers/net/dsa/dsa_loop.c-135-{\ndrivers/net/dsa/dsa_loop.c:136:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-137-\tunsigned int i;\n--\ndrivers/net/dsa/dsa_loop.c-139-\tfor (i = 0; i \u003c ds-\u003enum_ports; i++)\ndrivers/net/dsa/dsa_loop.c:140:\t\tmemcpy(ps-\u003eports[i].mib, dsa_loop_mibs,\ndrivers/net/dsa/dsa_loop.c:141:\t\t sizeof(dsa_loop_mibs));\ndrivers/net/dsa/dsa_loop.c-142-\n--\ndrivers/net/dsa/dsa_loop.c-144-\ndrivers/net/dsa/dsa_loop.c:145:\treturn dsa_loop_setup_devlink_resources(ds);\ndrivers/net/dsa/dsa_loop.c-146-}\ndrivers/net/dsa/dsa_loop.c-147-\ndrivers/net/dsa/dsa_loop.c:148:static void dsa_loop_teardown(struct dsa_switch *ds)\ndrivers/net/dsa/dsa_loop.c-149-{\n--\ndrivers/net/dsa/dsa_loop.c-152-\ndrivers/net/dsa/dsa_loop.c:153:static int dsa_loop_get_sset_count(struct dsa_switch *ds, int port, int sset)\ndrivers/net/dsa/dsa_loop.c-154-{\n--\ndrivers/net/dsa/dsa_loop.c-160-\ndrivers/net/dsa/dsa_loop.c:161:static void dsa_loop_get_strings(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-162-\t\t\t\t u32 stringset, uint8_t *data)\ndrivers/net/dsa/dsa_loop.c-163-{\ndrivers/net/dsa/dsa_loop.c:164:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-165-\tunsigned int i;\n--\ndrivers/net/dsa/dsa_loop.c-173-\ndrivers/net/dsa/dsa_loop.c:174:static void dsa_loop_get_ethtool_stats(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-175-\t\t\t\t uint64_t *data)\ndrivers/net/dsa/dsa_loop.c-176-{\ndrivers/net/dsa/dsa_loop.c:177:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-178-\tunsigned int i;\n--\ndrivers/net/dsa/dsa_loop.c-183-\ndrivers/net/dsa/dsa_loop.c:184:static int dsa_loop_phy_read(struct dsa_switch *ds, int port, int regnum)\ndrivers/net/dsa/dsa_loop.c-185-{\ndrivers/net/dsa/dsa_loop.c:186:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-187-\tstruct mii_bus *bus = ps-\u003ebus;\n--\ndrivers/net/dsa/dsa_loop.c-198-\ndrivers/net/dsa/dsa_loop.c:199:static int dsa_loop_phy_write(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-200-\t\t\t int regnum, u16 value)\ndrivers/net/dsa/dsa_loop.c-201-{\ndrivers/net/dsa/dsa_loop.c:202:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-203-\tstruct mii_bus *bus = ps-\u003ebus;\n--\ndrivers/net/dsa/dsa_loop.c-214-\ndrivers/net/dsa/dsa_loop.c:215:static int dsa_loop_port_bridge_join(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-216-\t\t\t\t struct dsa_bridge bridge,\n--\ndrivers/net/dsa/dsa_loop.c-225-\ndrivers/net/dsa/dsa_loop.c:226:static void dsa_loop_port_bridge_leave(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-227-\t\t\t\t struct dsa_bridge bridge)\n--\ndrivers/net/dsa/dsa_loop.c-232-\ndrivers/net/dsa/dsa_loop.c:233:static void dsa_loop_port_stp_state_set(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-234-\t\t\t\t\tu8 state)\n--\ndrivers/net/dsa/dsa_loop.c-239-\ndrivers/net/dsa/dsa_loop.c:240:static int dsa_loop_port_vlan_filtering(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-241-\t\t\t\t\tbool vlan_filtering,\n--\ndrivers/net/dsa/dsa_loop.c-249-\ndrivers/net/dsa/dsa_loop.c:250:static int dsa_loop_port_vlan_add(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-251-\t\t\t\t const struct switchdev_obj_port_vlan *vlan,\n--\ndrivers/net/dsa/dsa_loop.c-255-\tbool pvid = vlan-\u003eflags \u0026 BRIDGE_VLAN_INFO_PVID;\ndrivers/net/dsa/dsa_loop.c:256:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-257-\tstruct mii_bus *bus = ps-\u003ebus;\ndrivers/net/dsa/dsa_loop.c:258:\tstruct dsa_loop_vlan *vl;\ndrivers/net/dsa/dsa_loop.c-259-\n--\ndrivers/net/dsa/dsa_loop.c-282-\ndrivers/net/dsa/dsa_loop.c:283:static int dsa_loop_port_vlan_del(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-284-\t\t\t\t const struct switchdev_obj_port_vlan *vlan)\n--\ndrivers/net/dsa/dsa_loop.c-286-\tbool untagged = vlan-\u003eflags \u0026 BRIDGE_VLAN_INFO_UNTAGGED;\ndrivers/net/dsa/dsa_loop.c:287:\tstruct dsa_loop_priv *ps = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-288-\tu16 pvid = ps-\u003eports[port].pvid;\ndrivers/net/dsa/dsa_loop.c-289-\tstruct mii_bus *bus = ps-\u003ebus;\ndrivers/net/dsa/dsa_loop.c:290:\tstruct dsa_loop_vlan *vl;\ndrivers/net/dsa/dsa_loop.c-291-\n--\ndrivers/net/dsa/dsa_loop.c-310-\ndrivers/net/dsa/dsa_loop.c:311:static int dsa_loop_port_change_mtu(struct dsa_switch *ds, int port,\ndrivers/net/dsa/dsa_loop.c-312-\t\t\t\t int new_mtu)\ndrivers/net/dsa/dsa_loop.c-313-{\ndrivers/net/dsa/dsa_loop.c:314:\tstruct dsa_loop_priv *priv = ds-\u003epriv;\ndrivers/net/dsa/dsa_loop.c-315-\n--\ndrivers/net/dsa/dsa_loop.c-320-\ndrivers/net/dsa/dsa_loop.c:321:static int dsa_loop_port_max_mtu(struct dsa_switch *ds, int port)\ndrivers/net/dsa/dsa_loop.c-322-{\n--\ndrivers/net/dsa/dsa_loop.c-325-\ndrivers/net/dsa/dsa_loop.c:326:static void dsa_loop_phylink_get_caps(struct dsa_switch *dsa, int port,\ndrivers/net/dsa/dsa_loop.c-327-\t\t\t\t struct phylink_config *config)\n--\ndrivers/net/dsa/dsa_loop.c-333-\ndrivers/net/dsa/dsa_loop.c:334:static const struct dsa_switch_ops dsa_loop_driver = {\ndrivers/net/dsa/dsa_loop.c:335:\t.get_tag_protocol\t= dsa_loop_get_protocol,\ndrivers/net/dsa/dsa_loop.c:336:\t.setup\t\t\t= dsa_loop_setup,\ndrivers/net/dsa/dsa_loop.c:337:\t.teardown\t\t= dsa_loop_teardown,\ndrivers/net/dsa/dsa_loop.c:338:\t.get_strings\t\t= dsa_loop_get_strings,\ndrivers/net/dsa/dsa_loop.c:339:\t.get_ethtool_stats\t= dsa_loop_get_ethtool_stats,\ndrivers/net/dsa/dsa_loop.c:340:\t.get_sset_count\t\t= dsa_loop_get_sset_count,\ndrivers/net/dsa/dsa_loop.c:341:\t.get_ethtool_phy_stats\t= dsa_loop_get_ethtool_stats,\ndrivers/net/dsa/dsa_loop.c:342:\t.phy_read\t\t= dsa_loop_phy_read,\ndrivers/net/dsa/dsa_loop.c:343:\t.phy_write\t\t= dsa_loop_phy_write,\ndrivers/net/dsa/dsa_loop.c:344:\t.port_bridge_join\t= dsa_loop_port_bridge_join,\ndrivers/net/dsa/dsa_loop.c:345:\t.port_bridge_leave\t= dsa_loop_port_bridge_leave,\ndrivers/net/dsa/dsa_loop.c:346:\t.port_stp_state_set\t= dsa_loop_port_stp_state_set,\ndrivers/net/dsa/dsa_loop.c:347:\t.port_vlan_filtering\t= dsa_loop_port_vlan_filtering,\ndrivers/net/dsa/dsa_loop.c:348:\t.port_vlan_add\t\t= dsa_loop_port_vlan_add,\ndrivers/net/dsa/dsa_loop.c:349:\t.port_vlan_del\t\t= dsa_loop_port_vlan_del,\ndrivers/net/dsa/dsa_loop.c:350:\t.port_change_mtu\t= dsa_loop_port_change_mtu,\ndrivers/net/dsa/dsa_loop.c:351:\t.port_max_mtu\t\t= dsa_loop_port_max_mtu,\ndrivers/net/dsa/dsa_loop.c:352:\t.phylink_get_caps\t= dsa_loop_phylink_get_caps,\ndrivers/net/dsa/dsa_loop.c-353-};\ndrivers/net/dsa/dsa_loop.c-354-\ndrivers/net/dsa/dsa_loop.c:355:static int dsa_loop_drv_probe(struct mdio_device *mdiodev)\ndrivers/net/dsa/dsa_loop.c-356-{\ndrivers/net/dsa/dsa_loop.c:357:\tstruct dsa_loop_pdata *pdata = mdiodev-\u003edev.platform_data;\ndrivers/net/dsa/dsa_loop.c:358:\tstruct dsa_loop_priv *ps;\ndrivers/net/dsa/dsa_loop.c-359-\tstruct dsa_switch *ds;\n--\ndrivers/net/dsa/dsa_loop.c-382-\tds-\u003edev = \u0026mdiodev-\u003edev;\ndrivers/net/dsa/dsa_loop.c:383:\tds-\u003eops = \u0026dsa_loop_driver;\ndrivers/net/dsa/dsa_loop.c-384-\tds-\u003epriv = ps;\n--\ndrivers/net/dsa/dsa_loop.c-396-\ndrivers/net/dsa/dsa_loop.c:397:static void dsa_loop_drv_remove(struct mdio_device *mdiodev)\ndrivers/net/dsa/dsa_loop.c-398-{\ndrivers/net/dsa/dsa_loop.c-399-\tstruct dsa_switch *ds = dev_get_drvdata(\u0026mdiodev-\u003edev);\ndrivers/net/dsa/dsa_loop.c:400:\tstruct dsa_loop_priv *ps;\ndrivers/net/dsa/dsa_loop.c-401-\n--\ndrivers/net/dsa/dsa_loop.c-410-\ndrivers/net/dsa/dsa_loop.c:411:static void dsa_loop_drv_shutdown(struct mdio_device *mdiodev)\ndrivers/net/dsa/dsa_loop.c-412-{\n--\ndrivers/net/dsa/dsa_loop.c-422-\ndrivers/net/dsa/dsa_loop.c:423:static struct mdio_driver dsa_loop_drv = {\ndrivers/net/dsa/dsa_loop.c-424-\t.mdiodrv.driver\t= {\n--\ndrivers/net/dsa/dsa_loop.c-426-\t},\ndrivers/net/dsa/dsa_loop.c:427:\t.probe\t= dsa_loop_drv_probe,\ndrivers/net/dsa/dsa_loop.c:428:\t.remove\t= dsa_loop_drv_remove,\ndrivers/net/dsa/dsa_loop.c:429:\t.shutdown = dsa_loop_drv_shutdown,\ndrivers/net/dsa/dsa_loop.c-430-};\ndrivers/net/dsa/dsa_loop.c-431-\ndrivers/net/dsa/dsa_loop.c:432:static int dsa_loop_bus_match(struct device *dev,\ndrivers/net/dsa/dsa_loop.c-433-\t\t\t const struct device_driver *drv)\ndrivers/net/dsa/dsa_loop.c-434-{\ndrivers/net/dsa/dsa_loop.c:435:\treturn drv == \u0026dsa_loop_drv.mdiodrv.driver;\ndrivers/net/dsa/dsa_loop.c-436-}\ndrivers/net/dsa/dsa_loop.c-437-\ndrivers/net/dsa/dsa_loop.c:438:static void dsa_loop_phydevs_unregister(void)\ndrivers/net/dsa/dsa_loop.c-439-{\n--\ndrivers/net/dsa/dsa_loop.c-445-\ndrivers/net/dsa/dsa_loop.c:446:static int __init dsa_loop_create_switch_mdiodev(void)\ndrivers/net/dsa/dsa_loop.c-447-{\ndrivers/net/dsa/dsa_loop.c:448:\tstatic struct dsa_loop_pdata dsa_loop_pdata = {\ndrivers/net/dsa/dsa_loop.c-449-\t\t.cd = {\n--\ndrivers/net/dsa/dsa_loop.c-470-\ndrivers/net/dsa/dsa_loop.c:471:\tswitch_mdiodev-\u003ebus_match = dsa_loop_bus_match;\ndrivers/net/dsa/dsa_loop.c:472:\tswitch_mdiodev-\u003edev.platform_data = \u0026dsa_loop_pdata;\ndrivers/net/dsa/dsa_loop.c-473-\n--\ndrivers/net/dsa/dsa_loop.c-481-\ndrivers/net/dsa/dsa_loop.c:482:static int __init dsa_loop_init(void)\ndrivers/net/dsa/dsa_loop.c-483-{\n--\ndrivers/net/dsa/dsa_loop.c-486-\ndrivers/net/dsa/dsa_loop.c:487:\tret = dsa_loop_create_switch_mdiodev();\ndrivers/net/dsa/dsa_loop.c-488-\tif (ret)\n--\ndrivers/net/dsa/dsa_loop.c-493-\ndrivers/net/dsa/dsa_loop.c:494:\tret = mdio_driver_register(\u0026dsa_loop_drv);\ndrivers/net/dsa/dsa_loop.c-495-\tif (ret) {\ndrivers/net/dsa/dsa_loop.c:496:\t\tdsa_loop_phydevs_unregister();\ndrivers/net/dsa/dsa_loop.c-497-\t\tmdio_device_remove(switch_mdiodev);\n--\ndrivers/net/dsa/dsa_loop.c-502-}\ndrivers/net/dsa/dsa_loop.c:503:module_init(dsa_loop_init);\ndrivers/net/dsa/dsa_loop.c-504-\ndrivers/net/dsa/dsa_loop.c:505:static void __exit dsa_loop_exit(void)\ndrivers/net/dsa/dsa_loop.c-506-{\ndrivers/net/dsa/dsa_loop.c:507:\tmdio_driver_unregister(\u0026dsa_loop_drv);\ndrivers/net/dsa/dsa_loop.c:508:\tdsa_loop_phydevs_unregister();\ndrivers/net/dsa/dsa_loop.c-509-\tmdio_device_remove(switch_mdiodev);\n--\ndrivers/net/dsa/dsa_loop.c-511-}\ndrivers/net/dsa/dsa_loop.c:512:module_exit(dsa_loop_exit);\ndrivers/net/dsa/dsa_loop.c-513-\n"
} |
| 15/2 | 2026/07/19 05:55 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 35831 output: 107 thoughts: 319 Thoughts: **WorthFuzzing=false: Analyzing the Marvell Switch Driver Patch** Okay, so I'm looking at this patch and it's modifying `mv88e6xxx`. The key here is that `mv88e6xxx` is a *hardware* driver, specifically for Marvell switches. The `dsa_loop` driver is involved, but it's just a mock driver and it doesn't utilize `mv88e6xxx`. The modifications are *strictly* within the `mv88e6xxx` code itself. The problem, as I see it, is that there's no software emulation of Marvell switches in QEMU. Syzkaller, in its current implementation, doesn't have a mechanism to mock the MDIO bus or the specific switch hardware this driver relies on. I can't think of any way to make this reachable in a virtualized fuzzing environment. I'm double-checking the prompt requirements just to be absolutely sure... Yes, it specifically mentions returning `WorthFuzzing=false` if the patch affects code paths that are unreachable in environments like GCE or QEMU, even with software-emulated hardware. And that's precisely what we're dealing with here: it's a hardware-specific driver without software emulation. The lack of emulation is the critical element. This patch, in particular, implements support for embedded arrival time stamps for PTP within the Marvell switch DSA driver. This is something that absolutely requires the presence of a *physical* Marvell switch connected via an MDIO bus. So given this limitation, I'm confident I have to return `WorthFuzzing=false`. I'll proceed to call `set-results` with `WorthFuzzing=false` now. |
| 16/2 | 2026/07/19 05:55 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the mv88e6xxx DSA driver for Marvell switches to support embedded arrival time stamps for PTP. This is a hardware-specific driver that requires a physical Marvell switch connected via an MDIO bus. There is no software emulation for this hardware in QEMU, making the modified code paths impossible to reach in a virtualized fuzzing environment.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the mv88e6xxx DSA driver for Marvell switches to support embedded arrival time stamps for PTP. This is a hardware-specific driver that requires a physical Marvell switch connected via an MDIO bus. There is no software emulation for this hardware in QEMU, making the modified code paths impossible to reach in a virtualized fuzzing environment.",
"WorthFuzzing": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|