AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/08/03 04:46	flow	patch-triage	2m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.", "WorthFuzzing": false }
1/1	2026/08/03 04:46	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 15bf5418d47d7d5e1b4a3bc26285fcb69c18c1b8\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Aug 3 04:46:56 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/networking/devlink/index.rst b/Documentation/networking/devlink/index.rst\nindex 4745148fecf4f..058999d0dc56f 100644\n--- a/Documentation/networking/devlink/index.rst\n+++ b/Documentation/networking/devlink/index.rst\n@@ -94,6 +94,7 @@ parameters, info versions, and other features it supports.\n mlx5\n mlxsw\n mv88e6xxx\n+ mxl862xx\n netdevsim\n nfp\n octeontx2\ndiff --git a/Documentation/networking/devlink/mxl862xx.rst b/Documentation/networking/devlink/mxl862xx.rst\nnew file mode 100644\nindex 0000000000000..7c2dc11f65856\n--- /dev/null\n+++ b/Documentation/networking/devlink/mxl862xx.rst\n@@ -0,0 +1,71 @@\n+.. SPDX-License-Identifier: GPL-2.0\n+\n+========================\n+mxl862xx devlink support\n+========================\n+\n+This document describes the devlink features implemented by the\n+``mxl862xx`` device driver.\n+\n+Info versions\n+=============\n+\n+The ``mxl862xx`` driver reports the following versions\n+\n+.. list-table:: devlink info versions implemented\n+ :widths: 5 5 5 85\n+\n+ * - Name\n+ - Type\n+ - Example\n+ - Description\n+ * - ``asic.id``\n+ - fixed\n+ - 8628\n+ - The chip part number read from the CHIP ID registers. Omitted\n+ when the part number reads as zero, which happens for a switch\n+ sitting in MCUboot rescue mode (the registers need a running\n+ firmware), for an unfused part, and after a failed flash.\n+ * - ``asic.rev``\n+ - fixed\n+ - 0\n+ - The chip version read from the same register word, so it is\n+ omitted whenever ``asic.id`` is.\n+ * - ``fw``\n+ - running, stored\n+ - 1.0.70\n+ - Version of the firmware running on the switch, reported as both\n+ running and stored since the switch boots it from its own flash.\n+ It is omitted while no firmware version is known: after a failed\n+ flash, and in MCUboot rescue mode while an interrupted download\n+ is still being recovered in the background. Once the loader is\n+ ready to accept a new image the version appears as \"0.0.0\",\n+ which no released firmware reports, so version-comparing tools\n+ offer any available release as an upgrade. Use ``devlink dev\n+ flash`` to tell a recovering switch from a ready one, see below;\n+ a missing version on its own does not say why.\n+\n+Flash update\n+============\n+\n+The ``mxl862xx`` driver implements support for ``devlink dev flash``.\n+The signed firmware image is transferred to the switch over the same\n+MDIO bus which is also used to manage the switch, then verified and\n+installed by the MCUboot bootloader running on the switch. All ports\n+of the switch are closed for the duration of the update and the driver\n+reprobes the switch after it has rebooted into the new firmware. A\n+complete flash and reprobe cycle takes about one minute.\n+\n+A switch stuck in MCUboot rescue mode, e.g. after an interrupted\n+update, is registered without user ports. If the previous download was\n+interrupted mid-transfer the loader is wedged; the driver drains it\n+back to a clean ready state in the background, one byte at a time,\n+which takes tens of minutes for a large image and is reported through\n+the kernel log as it progresses. During that recovery ``devlink dev\n+flash`` returns ``-EBUSY`` with an extack message saying so, and\n+``devlink dev info`` reports no firmware version. Once the loader is\n+ready the firmware version appears and flashing a firmware image\n+through the regular update flow recovers the switch.\n+\n+If the recovery fails, the loader needs a power cycle: ``devlink dev\n+flash`` then returns ``-EIO`` and says so in its extack message.\ndiff --git a/MAINTAINERS b/MAINTAINERS\nindex 932ea1db048e5..c27c449159c5a 100644\n--- a/MAINTAINERS\n+++ b/MAINTAINERS\n@@ -16107,6 +16107,7 @@ M:\tDaniel Golle \u003cdaniel@makrotopia.org\u003e\n L:\tnetdev@vger.kernel.org\n S:\tMaintained\n F:\tDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml\n+F:\tDocumentation/networking/devlink/mxl862xx.rst\n F:\tdrivers/net/dsa/mxl862xx/\n F:\tnet/dsa/tag_mxl862xx.c\n \ndiff --git a/drivers/net/dsa/mxl862xx/Makefile b/drivers/net/dsa/mxl862xx/Makefile\nindex a7be0e6669dfa..bccac0d0f703f 100644\n--- a/drivers/net/dsa/mxl862xx/Makefile\n+++ b/drivers/net/dsa/mxl862xx/Makefile\n@@ -1,3 +1,3 @@\n # SPDX-License-Identifier: GPL-2.0\n obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o\n-mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o\n+mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-api.h b/drivers/net/dsa/mxl862xx/mxl862xx-api.h\nindex a180a5decffc0..6f771895984cb 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-api.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-api.h\n@@ -1224,6 +1224,16 @@ struct mxl862xx_sys_fw_image_version {\n \t__le32 iv_build_num;\n } __packed;\n \n+/*\n+ struct mxl862xx_sys_reg_rw - System register read/write\n+ * @addr: 32-bit register address\n+ * @val: register value\n+ /\n+struct mxl862xx_sys_reg_rw {\n+\t__le32 addr;\n+\t__le32 val;\n+} __packed;\n+\n /\n enum mxl862xx_port_type - Port Type\n * @MXL862XX_LOGICAL_PORT: Logical Port\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h\nindex c87a955c13c48..a865425aa61e1 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h\n@@ -70,7 +70,9 @@\n #define INT_GPHY_READ\t\t\t(GPY_GPY2XX_MAGIC + 0x1)\n #define INT_GPHY_WRITE\t\t\t(GPY_GPY2XX_MAGIC + 0x2)\n \n+#define SYS_MISC_FW_UPDATE\t\t(SYS_MISC_MAGIC + 0x1)\n #define SYS_MISC_FW_VERSION\t\t(SYS_MISC_MAGIC + 0x2)\n+#define SYS_MISC_REG_RD\t\t\t(SYS_MISC_MAGIC + 0x8)\n \n #define MXL862XX_XPCS_PCS_CONFIG\t(MXL862XX_XPCS_MAGIC + 0x1)\n #define MXL862XX_XPCS_PCS_GET_STATE\t(MXL862XX_XPCS_MAGIC + 0x2)\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.c b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c\nnew file mode 100644\nindex 0000000000000..94aa658a62db9\n--- /dev/null\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c\n@@ -0,0 +1,1102 @@\n+// SPDX-License-Identifier: GPL-2.0-or-later\n+/\n+ Firmware flash and devlink support for MaxLinear MxL862xx\n+ \n+ Copyright (C) 2025 Daniel Golle \u003cdaniel@makrotopia.org\u003e\n+ \n+ SB PDI - firmware download interface over clause-22 SMDIO\n+ * =========================================================\n+ \n+ The MxL862xx MCUboot loader accepts a firmware image through four \"SB PDI\"\n+ * registers in the switch SMDIO register space. It runs whenever no WSP\n+ * firmware is active: the normal firmware update enters it deliberately - the\n+ * SYS_MISC_FW_UPDATE API command sets a sticky rescue bit and reboots into\n+ * MCUboot - and the loader also stays here when the stored WSP firmware fails\n+ * its boot-time integrity check. This driver drives the loader's 0xc55c\n+ * \"console\" download path.\n+ \n+ SMDIO register access (mxl862xx_smdio_read/write):\n+ * MII reg 0x1f := (\u003csb_pdi_reg\u003e \u0026 0xfff0) ; page latch\n+ * MII reg (\u003csb_pdi_reg\u003e \u0026 0x000f) := / =\u003e \u003cu16 data\u003e\n+ * so CTRL/ADDR/DATA/STAT (0xe100..0xe103) are MII regs 0/1/2/3 of page\n+ * 0xe100, not all reg 0x00.\n+ \n+ SB PDI registers (host name/addr -\u003e MCU mailbox):\n+ * CTRL 0xe100 -\u003e 0xc0938400 mode: RST=0x00 RD=0x01 WR=0x02\n+ * ADDR 0xe101 -\u003e 0xc0938404 SB target word address (SB1 bank = 0x7800)\n+ * DATA 0xe102 -\u003e 0xc0938408 16-bit data / reply word\n+ * STAT 0xe103 -\u003e 0xc093840c handshake: a magic (below) or a byte count\n+ \n+ STAT magics:\n+ * READY 0xc55c loader idle in the console loop (this driver)\n+ * DL_RDY 0xc33c loader idle in the flashless loop\n+ * START 0xf48f host -\u003e begin download session\n+ * ACK 0xf490 loader -\u003e START acknowledged (START + 1)\n+ * END 0x3cc3 host -\u003e finalise now (optional, see below)\n+ * RDREG 0xe2c0 host -\u003e register-read command (\| index), see below\n+ \n+ Console flash path (STAT=0xc55c) - mxl862xx_flash_firmware():\n+ \n+ host loader\n+ * ---- ------\n+ * reset (CTRL=ADDR=DATA=0)\n+ * read STAT ............................ 0xc55c (READY, idle)\n+ * STAT := START(0xf48f) --------------\u003e\n+ * \u003c-------------- STAT = 0xf490 (ACK)\n+ * CTRL := WR\n+ * DATA := hdr[0..9] (20-byte header: type,size1,crc1,size2,crc2)\n+ * reset; STAT := 20 (header len) -----\u003e parse hdr; r_remain=size1+size2;\n+ * ERASE target region(s)\n+ * \u003c-------------- STAT=21 (len+1), then STAT=0\n+ * (erased)\n+ * -- payload, streamed in slices: --\n+ * CTRL := WR\n+ * DATA := word x N ...\n+ * at word 16384: CTRL:=RST; ADDR:=0x7800; CTRL:=WR (half-bank -\u003e SB1)\n+ * at word 32760: flush slice:\n+ * reset; STAT := \u003cbytes_this_slice\u003e ---\u003e r_remain -= bytes; program\n+ * \u003c------------------- STAT=0 (ready for next slice)\n+ * ... repeat until the whole payload is sent ...\n+ * \u003c------------------- STAT=0 image verified\n+ * (STAT=1: image rejected)\n+ * STAT := END(0x3cc3) ---------------------\u003e finalise and boot\n+ \n+ The r_remain == 0 rule (critical):\n+ * Every host STAT write in the payload phase is a byte count; the loader\n+ * does r_remain -= count and stays in the receive loop while r_remain != 0.\n+ * It leaves the loop ONLY when r_remain hits EXACTLY 0, and a count larger\n+ * than r_remain underflows the 32-bit counter and wedges the loader until a\n+ * power cycle. Having left it, the loader verifies the image, publishes the\n+ * verdict in STAT (0 good, 1 rejected) and waits 2 s for END before\n+ * finalising regardless -- clearing its rescue-enable bit so boot_go boots\n+ * the new image -- so END only saves that wait. Hence:\n+ * - never send a slice/chunk count larger than what is outstanding;\n+ * - a STAT write is a command only once the loader has left the loop;\n+ * - the loader leaves the count in STAT while it programs the chunk, so\n+ * a lingering count does not distinguish \"busy\" from \"verdict\";\n+ * - interrupted-download recovery feeds 1 byte at a time (see below).\n+ \n+ Interrupted-flash recovery (mxl862xx_rescue_drain):\n+ * A host that dies mid-payload leaves the loader in the receive loop holding\n+ * STAT=0. Feed single 1-byte chunks (one DATA word + STAT=1) until r_remain\n+ * reaches 0; the loader then verifies the (now corrupt) image, publishes its\n+ * verdict and comes back to READY by itself. END is never sent here: while\n+ * r_remain is non-zero it would be consumed as a 15555-byte count, and a\n+ * lingering STAT=1 cannot be told from a chunk still being programmed.\n+ \n+ Register-read challenge (non-destructive liveness proof):\n+ * DATA := 0x7c23 (marker); STAT := 0xe2c0\|idx\n+ * -\u003e loader returns a runtime word in DATA and re-arms STAT=0xc55c.\n+ * The reply source is loader BSS, not a chip id; used only to prove a live\n+ * mailbox in mxl862xx_rescue_mode_detect().\n+ \n+ The other STAT ready magic, 0xc33c, marks the loader's flashless\n+ * chip-to-chip download mode (MxL86281S 16-port tier); this driver does not\n+ * use it.\n+ \n+ Rescue lifecycle (devlink): probe runs mxl862xx_rescue_mode_detect(); a\n+ * wedged loader is drained back to READY by a background self-heal\n+ * (rescue_heal_work), so the long recovery never holds the devlink lock.\n+ * devlink dev info exposes the fw version (the \"flashable\" signal) only once at\n+ * READY; flash_update returns -EBUSY until then, and reprobes to WSP firmware\n+ * on success.\n+ \n+ Notes:\n+ * - Chip id/revision (0xc0d28884/88) are NOT reachable on this channel; they\n+ * need the clause-45 MMD firmware mailbox, which is dead under MCUboot.\n+ * Rescue identity is by SB PDI behaviour only (mxl862xx_rescue_mode_detect).\n+ * - The SMDIO PHY address comes from the device tree; the 0xe1xx register\n+ * offsets are the OTP reset defaults and the only layout supported here.\n+ /\n+\n+#include \u003clinux/crc32.h\u003e\n+#include \u003clinux/delay.h\u003e\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/iopoll.h\u003e\n+#include \u003clinux/module.h\u003e\n+#include \u003clinux/netdevice.h\u003e\n+#include \u003clinux/overflow.h\u003e\n+#include \u003clinux/rtnetlink.h\u003e\n+#include \u003clinux/workqueue.h\u003e\n+#include \u003cnet/dsa.h\u003e\n+#include \u003cnet/switchdev.h\u003e\n+\n+#include \"mxl862xx.h\"\n+#include \"mxl862xx-api.h\"\n+#include \"mxl862xx-cmd.h\"\n+#include \"mxl862xx-fw.h\"\n+#include \"mxl862xx-host.h\"\n+\n+/ SB PDI registers (clause-22 SMDIO address space) /\n+#define MXL862XX_SB_PDI_CTRL\t\t0xe100\n+#define MXL862XX_SB_PDI_ADDR\t\t0xe101\n+#define MXL862XX_SB_PDI_DATA\t\t0xe102\n+#define MXL862XX_SB_PDI_STAT\t\t0xe103\n+\n+/ SB PDI CTRL modes /\n+#define MXL862XX_SB_PDI_CTRL_RST\t0x00\n+#define MXL862XX_SB_PDI_CTRL_WR\t\t0x02\n+\n+/ SB PDI handshake magic (published/consumed via STAT) /\n+#define MXL862XX_SB_PDI_READY\t\t0xc55c\t/ loader idle, console loop /\n+#define MXL862XX_SB_PDI_DL_READY\t0xc33c\t/ loader idle, flashless loop /\n+#define MXL862XX_SB_PDI_START\t\t0xf48f\n+#define MXL862XX_SB_PDI_END\t\t0x3cc3\n+#define MXL862XX_SB_PDI_RDREG\t\t0xe2c0\t/ register-read cmd (\| index) /\n+#define MXL862XX_SB_PDI_RDREG_MARK\t0x7c23\t/ marker placed in DATA for RDREG /\n+\n+/ Behavioural presence probe: two distinct 16-bit latches on ADDR/DATA. /\n+#define MXL862XX_SB_PDI_PROBE_A\t\t0x5a5a\n+#define MXL862XX_SB_PDI_PROBE_D\t\t0xa5a5\n+\n+/ Image verification verdict published in STAT once the receive loop ends /\n+#define MXL862XX_SB_PDI_VERIFY_OK\t0\n+#define MXL862XX_SB_PDI_VERIFY_BAD\t1\n+\n+/ Firmware transfer geometry /\n+#define MXL862XX_FW_HDR_SIZE\t\t20\n+#define MXL862XX_FW_BANK_HALF\t\t16384\t/ words per half-bank /\n+#define MXL862XX_FW_BANK_SLICE\t\t32760\t/ words per full slice /\n+#define MXL862XX_FW_SB1_ADDR\t\t0x7800\t/ SB1 word address /\n+\n+/ Timeouts (generous upper bounds) /\n+#define MXL862XX_FW_READY_TIMEOUT_MS\t3000\n+#define MXL862XX_FW_ACK_TIMEOUT_MS\t5000\n+#define MXL862XX_FW_ERASE_TIMEOUT_MS\t300000\n+#define MXL862XX_FW_WRITE_TIMEOUT_MS\t120000\n+#define MXL862XX_FW_REBOOT_DELAY_MS\t5000\n+#define MXL862XX_FW_REPROBE_DELAY_MS\t500\n+#define MXL862XX_RESCUE_READY_TIMEOUT_MS 1000\n+#define MXL862XX_DRAIN_POLL_MS\t\t2000\n+/ Covers the loader's END wait, verification and the reset into READY /\n+#define MXL862XX_DRAIN_DONE_MS\t\t15000\n+\n+static int mxl862xx_sb_pdi_reset(struct mxl862xx_priv priv)\n+{\n+\tint ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t MXL862XX_SB_PDI_CTRL_RST);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n+\t\t\t\t MXL862XX_SB_PDI_CTRL_RST);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\treturn mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n+\t\t\t\t MXL862XX_SB_PDI_CTRL_RST);\n+}\n+\n+static int mxl862xx_sb_pdi_poll_stat(struct mxl862xx_priv priv, u16 expected,\n+\t\t\t\t unsigned long timeout_ms)\n+{\n+\tint ret, val;\n+\n+\tret = read_poll_timeout(mxl862xx_smdio_read, val,\n+\t\t\t\tval \u003c 0 \|\| (u16)val == expected,\n+\t\t\t\t10000, timeout_ms 1000, false,\n+\t\t\t\tpriv, MXL862XX_SB_PDI_STAT);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\treturn ret;\n+}\n+\n+static int mxl862xx_sb_pdi_flush_slice(struct mxl862xx_priv priv,\n+\t\t\t\t u32 data_written)\n+{\n+\tint ret;\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\treturn mxl862xx_sb_pdi_poll_stat(priv, 0,\n+\t\t\t\t\t MXL862XX_FW_WRITE_TIMEOUT_MS);\n+}\n+\n+/ Flush the last slice, which ends the receive loop: the loader verifies the\n+ * image and replaces the count in STAT with its verdict, so wait for the count\n+ * to go rather than for a fixed value.\n+ /\n+static int mxl862xx_sb_pdi_flush_last(struct mxl862xx_priv priv,\n+\t\t\t\t u32 data_written)\n+{\n+\tint ret, val;\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = read_poll_timeout(mxl862xx_smdio_read, val,\n+\t\t\t\tval \u003c 0 \|\| (u16)val != (u16)data_written,\n+\t\t\t\t10000, MXL862XX_FW_WRITE_TIMEOUT_MS * 1000,\n+\t\t\t\tfalse, priv, MXL862XX_SB_PDI_STAT);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\n+\tif (!ret \u0026\u0026 (u16)val == MXL862XX_SB_PDI_VERIFY_OK)\n+\t\treturn 0;\n+\n+\t/* A final count of 1 is indistinguishable from the reject verdict, so\n+\t * a timeout still holding it lands here too.\n+\t /\n+\tif ((u16)val == MXL862XX_SB_PDI_VERIFY_BAD) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: loader rejected the image\\n\");\n+\t\treturn -EBADMSG;\n+\t}\n+\n+\treturn ret ? ret : -EPROTO;\n+}\n+\n+static void mxl862xx_flash_notify(struct devlink dl, const char status,\n+\t\t\t\t u32 done, u32 total)\n+{\n+\tdevlink_flash_update_status_notify(dl, status, NULL, done, total);\n+}\n+\n+/ Post-flash reprobe. device_reprobe() detaches the driver -- running\n+ * remove(), which frees priv -- then re-probes, so this work touches only its\n+ * own device and module references and frees itself. A re-probe failure leaves\n+ * the device unbound, exactly as a failed initial probe would, so it is only\n+ * logged. Running from a workqueue keeps device_reprobe() out of the devlink\n+ * caller's locking and signal context.\n+ /\n+struct mxl862xx_reprobe {\n+\tstruct delayed_work work;\n+\tstruct device dev;\n+};\n+\n+static void mxl862xx_reprobe_work_fn(struct work_struct work)\n+{\n+\tstruct mxl862xx_reprobe rp =\n+\t\tcontainer_of(work, struct mxl862xx_reprobe, work.work);\n+\tstruct device dev = rp-\u003edev;\n+\n+\tif (device_reprobe(dev))\n+\t\tdev_err(dev, \"reprobe failed; device left unbound\\n\");\n+\tput_device(dev);\n+\tkfree(rp);\n+\tmodule_put(THIS_MODULE);\n+}\n+\n+/ Allocate the reprobe up front, before the switch is disturbed, so an\n+ * allocation failure aborts cleanly. The caller holds a module and a device\n+ * reference; the work releases both once it runs. Returns NULL on -ENOMEM.\n+ /\n+static struct mxl862xx_reprobe mxl862xx_reprobe_alloc(struct device dev)\n+{\n+\tstruct mxl862xx_reprobe rp;\n+\n+\trp = kzalloc_obj(rp);\n+\tif (!rp)\n+\t\treturn NULL;\n+\trp-\u003edev = dev;\n+\tINIT_DELAYED_WORK(\u0026rp-\u003ework, mxl862xx_reprobe_work_fn);\n+\treturn rp;\n+}\n+\n+/ Byte-count of each chunk fed to the loader during drain. It MUST be 1: the\n+ * loader only lets us observe \"counter == 0\", never \"counter \u003c step\", so any\n+ * step \u003e 1 can subtract past zero, underflow the 32-bit counter and wedge the\n+ * loader for ~2^32 more bytes (a state only a power cycle clears). Stepping by\n+ * 1 walks the counter through every value and is guaranteed to land on zero\n+ * whatever its (possibly odd) start. A 1-byte chunk is a path the loader\n+ * already handles: the normal transfer ends with a single trailing byte for\n+ * odd-sized images (see Step 6).\n+ /\n+#define MXL862XX_DRAIN_CHUNK_BYTES\t1\n+\n+/ Log the drain's progress every so many bytes; it can run for a long time /\n+#define MXL862XX_DRAIN_LOG_BYTES\t(128 1024)\n+\n+/* Wait for the loader to ask for the next chunk (STAT 0) or to come back to its\n+ * command loop (STAT READY), and return the STAT value either way. On timeout\n+ * that is whatever STAT still holds, which carries no further information: the\n+ * loader keeps the count we wrote visible while it programs the chunk, and that\n+ * is the same value it publishes as the \"image rejected\" verdict once the\n+ * counter reaches zero.\n+ /\n+static int mxl862xx_sb_pdi_poll_drain(struct mxl862xx_priv priv,\n+\t\t\t\t unsigned long timeout_ms)\n+{\n+\tint val;\n+\n+\tread_poll_timeout(mxl862xx_smdio_read, val,\n+\t\t\t val \u003c 0 \|\| (u16)val == MXL862XX_SB_PDI_READY \|\|\n+\t\t\t (u16)val == 0,\n+\t\t\t 50, timeout_ms * 1000, false,\n+\t\t\t priv, MXL862XX_SB_PDI_STAT);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\treturn (u16)val;\n+}\n+\n+/* The loader is not asking for a chunk: it may still be programming the last\n+ * one, or the counter has reached zero and it is verifying the image and\n+ * resetting into READY. Wait that out -- STAT cannot tell the two apart, and\n+ * guessing would mean writing END into a live receive loop. Returns 0 once the\n+ * loader has left the loop, -EAGAIN if it asks for another chunk after all.\n+ /\n+static int mxl862xx_rescue_drain_finish(struct mxl862xx_priv priv, u32 chunk)\n+{\n+\tstruct device dev = \u0026priv-\u003emdiodev-\u003edev;\n+\tint stat;\n+\n+\tstat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_DONE_MS);\n+\tif (stat \u003c 0)\n+\t\treturn stat;\n+\tif (stat == MXL862XX_SB_PDI_READY)\n+\t\treturn 0;\n+\tif (stat == MXL862XX_SB_PDI_VERIFY_BAD) {\n+\t\tdev_err(dev,\n+\t\t\t\"flash: loader stuck after %u chunks, power cycle it\\n\",\n+\t\t\tchunk);\n+\t\treturn -EIO;\n+\t}\n+\tif (stat) {\n+\t\t/ A firmware is answering, not the loader: an image survived\n+\t\t * in flash and booted.\n+\t\t /\n+\t\tdev_info(dev, \"flash: firmware booted while draining\\n\");\n+\t\treturn 0;\n+\t}\n+\n+\treturn -EAGAIN;\n+}\n+\n+/ Recover a switch whose SB PDI download was interrupted mid-transfer - the\n+ * host died after MCUboot began erasing flash, whether it aborted mid erase or\n+ * mid image-write, both end up in the same place: the payload receive loop.\n+ * There the loader publishes STAT=0, waits for the host to write a byte-count\n+ * to STAT, DMAs that many bytes and subtracts the count from a remaining-bytes\n+ * counter, leaving the loop only when the counter reaches exactly zero. The\n+ * image size died with the host, so we feed single-byte chunks (see\n+ * MXL862XX_DRAIN_CHUNK_BYTES) to walk the counter to zero without underflow.\n+ * The loader then verifies the (now corrupt) image and returns to READY by\n+ * itself, or boots a valid image that happened to survive in flash; either way\n+ * the caller's reprobe classifies the result. Every byte costs about a dozen\n+ * MDIO frames, so a multi-MiB outstanding count takes tens of minutes.\n+ * Returns 0 once the loader has left the receive loop, \u003c0 on error. Does NOT\n+ * recover a counter already underflowed by an earlier oversized-chunk attempt\n+ * - that needs a power cycle.\n+ /\n+static int mxl862xx_rescue_drain(struct mxl862xx_priv priv)\n+{\n+\tstruct device dev = \u0026priv-\u003emdiodev-\u003edev;\n+\t/ Bound: twice the loader's 16 MiB image cap, one byte per chunk. /\n+\tu32 max_chunks = 2u (16u \u003c\u003c 20) / MXL862XX_DRAIN_CHUNK_BYTES;\n+\tu32 chunk = 0;\n+\tint ret, stat;\n+\n+\twhile (chunk \u003c max_chunks) {\n+\t\t/* Teardown can interrupt this long drain. /\n+\t\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n+\t\t\treturn -ECANCELED;\n+\n+\t\tstat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_POLL_MS);\n+\t\tif (stat \u003c 0)\n+\t\t\treturn stat;\n+\t\tif (stat == MXL862XX_SB_PDI_READY)\n+\t\t\treturn 0;\n+\n+\t\tif (stat) {\n+\t\t\tret = mxl862xx_rescue_drain_finish(priv, chunk);\n+\t\t\tif (ret != -EAGAIN)\n+\t\t\t\treturn ret;\n+\t\t}\n+\n+\t\t/ Feed one zero byte; reset cleared the write latch. /\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t MXL862XX_SB_PDI_CTRL_WR);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_sb_pdi_reset(priv);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t\t MXL862XX_DRAIN_CHUNK_BYTES);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tchunk++;\n+\t\tif (!(chunk % MXL862XX_DRAIN_LOG_BYTES))\n+\t\t\tdev_info(dev, \"flash: drained %u KiB so far\\n\",\n+\t\t\t\t chunk / 1024);\n+\t\tcond_resched();\n+\t}\n+\n+\tdev_err(dev,\n+\t\t\"flash: interrupted download did not drain after %u chunks\\n\",\n+\t\tchunk);\n+\n+\treturn -ETIMEDOUT;\n+}\n+\n+/ Background self-heal: drain a wedged download off the devlink flash path, so\n+ * the long recovery never holds the devlink lock. Scheduled from probe;\n+ * reprobes on success so the probe-time detection re-classifies the switch.\n+ /\n+void mxl862xx_rescue_heal_work_fn(struct work_struct work)\n+{\n+\tstruct mxl862xx_priv priv =\n+\t\tcontainer_of(work, struct mxl862xx_priv, rescue_heal_work);\n+\tstruct device dev = \u0026priv-\u003emdiodev-\u003edev;\n+\tstruct mxl862xx_reprobe ko;\n+\tint ret;\n+\n+\tret = mxl862xx_rescue_drain(priv);\n+\tif (ret == -ECANCELED)\n+\t\treturn;\n+\tif (ret) {\n+\t\t/ Nothing retries this, so say so: rescue_ready stays clear\n+\t\t * and devlink dev flash reports why it refuses.\n+\t\t /\n+\t\tdev_err(dev, \"flash: download recovery failed: %pe\\n\",\n+\t\t\tERR_PTR(ret));\n+\t\tWRITE_ONCE(priv-\u003erescue_failed, true);\n+\t\treturn;\n+\t}\n+\n+\t/ The interrupted transfer is finalised; reprobe so the probe-time\n+\t * detection brings the driver up -- flashable in rescue mode if the\n+\t * loader is at READY, or normally if a valid image booted. The refs\n+\t * are released by the reprobe once it completes. heal_lock makes the\n+\t * flag test and the queueing atomic against teardown, which cannot\n+\t * cancel a work item this one has already queued.\n+\t /\n+\tmutex_lock(\u0026priv-\u003eheal_lock);\n+\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n+\t\tgoto out;\n+\tif (!try_module_get(THIS_MODULE))\n+\t\tgoto out;\n+\tget_device(dev);\n+\tko = mxl862xx_reprobe_alloc(dev);\n+\tif (!ko) {\n+\t\tput_device(dev);\n+\t\tmodule_put(THIS_MODULE);\n+\t\tgoto out;\n+\t}\n+\tqueue_delayed_work(system_long_wq, \u0026ko-\u003ework,\n+\t\t\t msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));\n+out:\n+\tmutex_unlock(\u0026priv-\u003eheal_lock);\n+}\n+\n+/ Detect MCUboot rescue mode over clause-22 SMDIO alone, so the caller can rule\n+ * the loader out before any C45 API request (which spews CRC errors when no WSP\n+ * firmware answers). A scratch write to ADDR/DATA must latch or the chip is\n+ * absent (-ENODEV); the mailbox is reset first, or a transfer interrupted with\n+ * CTRL=WR would take that write as a payload word instead of latching it. STAT\n+ * then classifies the state, poked destructively only when 0, the one value a\n+ * running firmware never holds:\n+ \n+ - 0xc33c: flashless loop; recognised but not supported here.\n+ * - 0xc55c: console loop, if the register-read challenge is serviced.\n+ * - other non-zero: running firmware, left unpoked.\n+ * - 0: wedged receive loop; the 1-byte slice-advance then says whether it\n+ * still needs draining or has just finished.\n+ \n+ Return: MXL862XX_IN_RESCUE, MXL862XX_NOT_RESCUE, -ENODEV when nothing\n+ * answers, -EOPNOTSUPP for the flashless loop, -ENXIO for a READY loader whose\n+ * mailbox fails the challenge, or an SMDIO bus error.\n+ /\n+int mxl862xx_rescue_mode_detect(struct mxl862xx_priv priv)\n+{\n+\tint stat, dat, ret, rb, a, d;\n+\n+\t/* rescue_ready gates flashing; a wedged loader needs the drain first. /\n+\tWRITE_ONCE(priv-\u003erescue_ready, false);\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\t/ Presence: a live chip latches the scratch write, an absent one floats. /\n+\ta = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n+\t\t\t\t MXL862XX_SB_PDI_PROBE_A);\n+\tif (a \u003c 0)\n+\t\treturn a;\n+\td = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n+\t\t\t\t MXL862XX_SB_PDI_PROBE_D);\n+\tif (d \u003c 0)\n+\t\treturn d;\n+\ta = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_ADDR);\n+\tif (a \u003c 0)\n+\t\treturn a;\n+\td = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n+\tif (d \u003c 0)\n+\t\treturn d;\n+\tif ((u16)a != MXL862XX_SB_PDI_PROBE_A \|\|\n+\t (u16)d != MXL862XX_SB_PDI_PROBE_D)\n+\t\treturn -ENODEV;\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tstat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);\n+\tif (stat \u003c 0)\n+\t\treturn stat;\n+\n+\t/ Flashless-download loop (MxL86281S tier): this driver does not\n+\t * support it -- the console flash path expects READY. Treat it as an\n+\t * unusable configuration, like any other unsupported state.\n+\t /\n+\tif ((u16)stat == MXL862XX_SB_PDI_DL_READY)\n+\t\treturn -EOPNOTSUPP;\n+\n+\t/ Console loop at READY: confirm the live mailbox with the register-read\n+\t * challenge (consumes the marker from DATA and re-arms READY).\n+\t /\n+\tif ((u16)stat == MXL862XX_SB_PDI_READY) {\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n+\t\t\t\t\t MXL862XX_SB_PDI_RDREG_MARK);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t\t MXL862XX_SB_PDI_RDREG);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\trb = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,\n+\t\t\t\t\t MXL862XX_RESCUE_READY_TIMEOUT_MS);\n+\t\tdat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n+\t\tret = mxl862xx_sb_pdi_reset(priv);\n+\t\tif (rb \u003c 0)\n+\t\t\treturn rb;\n+\t\tif (dat \u003c 0)\n+\t\t\treturn dat;\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tif (!rb \u0026\u0026 (u16)dat != MXL862XX_SB_PDI_RDREG_MARK) {\n+\t\t\tWRITE_ONCE(priv-\u003erescue_ready, true);\n+\t\t\treturn MXL862XX_IN_RESCUE;\n+\t\t}\n+\t\treturn -ENXIO;\n+\t}\n+\n+\t/ Any other non-zero value is a running firmware, not a loader. /\n+\tif (stat)\n+\t\treturn MXL862XX_NOT_RESCUE;\n+\n+\t/ STAT == 0: a wedged receive loop takes a 1-byte slice-advance (feed\n+\t * one DATA word first, like a drain chunk) and asks for the next chunk\n+\t * by publishing 0 again. Had that byte been the last one outstanding,\n+\t * the loader leaves the loop instead and returns to READY, having\n+\t * consumed the advance -- proof enough of a live mailbox to skip the\n+\t * challenge. Anything else means it is still working on it. All three\n+\t * are rescue, so this never fails probe; only the drain does.\n+\t /\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t MXL862XX_SB_PDI_CTRL_WR);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t MXL862XX_DRAIN_CHUNK_BYTES);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\trb = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_RESCUE_READY_TIMEOUT_MS);\n+\tif (rb \u003c 0)\n+\t\treturn rb;\n+\tif (rb == MXL862XX_SB_PDI_READY)\n+\t\tWRITE_ONCE(priv-\u003erescue_ready, true);\n+\n+\treturn MXL862XX_IN_RESCUE;\n+}\n+\n+/ MCUboot firmware image header /\n+struct mxl862xx_fw_hdr {\n+\t__le32 image_type;\n+\t__le32 image_size_1;\n+\t__le32 image_checksum_1;\n+\t__le32 image_size_2;\n+\t__le32 image_checksum_2;\n+} __packed;\n+\n+static int mxl862xx_flash_validate(struct mxl862xx_priv priv,\n+\t\t\t\t const struct firmware fw,\n+\t\t\t\t u32 payload_size)\n+{\n+\tconst struct mxl862xx_fw_hdr hdr;\n+\tu32 size1, size2, total;\n+\tconst u8 payload;\n+\tu32 crc;\n+\n+\tif (fw-\u003esize \u003c MXL862XX_FW_HDR_SIZE)\n+\t\treturn -EINVAL;\n+\n+\thdr = (const struct mxl862xx_fw_hdr )fw-\u003edata;\n+\tpayload = fw-\u003edata + MXL862XX_FW_HDR_SIZE;\n+\tsize1 = le32_to_cpu(hdr-\u003eimage_size_1);\n+\tsize2 = le32_to_cpu(hdr-\u003eimage_size_2);\n+\n+\tif (check_add_overflow(size1, size2, \u0026total) \|\|\n+\t total \u003e fw-\u003esize - MXL862XX_FW_HDR_SIZE) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: firmware file too small for declared size\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (!total) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: firmware file with empty payload\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (size1) {\n+\t\tcrc = ~crc32_le(~0U, payload, size1);\n+\t\tif (crc != le32_to_cpu(hdr-\u003eimage_checksum_1)) {\n+\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\"flash: image 1 CRC mismatch (got %08x, expected %08x)\\n\",\n+\t\t\t\tcrc, le32_to_cpu(hdr-\u003eimage_checksum_1));\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\t}\n+\n+\tif (size2) {\n+\t\tcrc = ~crc32_le(~0U, payload + size1, size2);\n+\t\tif (crc != le32_to_cpu(hdr-\u003eimage_checksum_2)) {\n+\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\"flash: image 2 CRC mismatch (got %08x, expected %08x)\\n\",\n+\t\t\t\tcrc, le32_to_cpu(hdr-\u003eimage_checksum_2));\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\t}\n+\n+\tpayload_size = total;\n+\n+\treturn 0;\n+}\n+\n+static int mxl862xx_flash_firmware(struct mxl862xx_priv priv,\n+\t\t\t\t const struct firmware fw,\n+\t\t\t\t u32 payload_size, struct devlink dl)\n+{\n+\tconst u8 payload = fw-\u003edata + MXL862XX_FW_HDR_SIZE;\n+\tu32 word_idx = 0, data_written = 0, idx = 0;\n+\tunsigned long next_notify = jiffies - 1;\n+\tu16 word, fdata;\n+\tint ret, i;\n+\n+\t/* Step 1: reboot the firmware into MCUboot rescue mode /\n+\tif (!priv-\u003erescue_mode) {\n+\t\tret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,\n+\t\t\t\t\tfalse, false);\n+\t\tif (ret) {\n+\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\"flash: FW_UPDATE command failed: %pe\\n\",\n+\t\t\t\tERR_PTR(ret));\n+\t\t\treturn ret;\n+\t\t}\n+\t}\n+\n+\t/ Step 2: wait for bootloader ready /\n+\tmxl862xx_flash_notify(dl, \"Waiting for bootloader\", 0, 0);\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\t/ Failures from here on end up at no_end, which returns the error\n+\t * without signalling END -- see there.\n+\t /\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,\n+\t\t\t\t\tMXL862XX_FW_READY_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: bootloader not ready: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/ Step 3: start handshake /\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t MXL862XX_SB_PDI_START);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_START + 1,\n+\t\t\t\t\tMXL862XX_FW_ACK_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: start handshake failed: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/ Step 4: transfer image header /\n+\tmxl862xx_flash_notify(dl, \"Erasing flash\", 0, 0);\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t MXL862XX_SB_PDI_CTRL_WR);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\tfor (i = 0; i \u003c MXL862XX_FW_HDR_SIZE / 2; i++) {\n+\t\tword = fw-\u003edata[i 2] \|\n+\t\t ((u16)fw-\u003edata[i * 2 + 1] \u003c\u003c 8);\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, word);\n+\t\tif (ret \u003c 0)\n+\t\t\tgoto write_err;\n+\t}\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\t/* the byte count in STAT triggers the erase /\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t MXL862XX_FW_HDR_SIZE);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\t/ ACK is byte count + 1 /\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_FW_HDR_SIZE + 1,\n+\t\t\t\t\tMXL862XX_FW_ACK_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: header ACK failed: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/ Step 5: wait for erase to complete /\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, 0,\n+\t\t\t\t\tMXL862XX_FW_ERASE_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: erase timeout: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/ Step 6: transfer payload /\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t MXL862XX_SB_PDI_CTRL_WR);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\twhile (idx \u003c payload_size) {\n+\t\tcond_resched();\n+\t\tif (idx + 1 \u003c payload_size) {\n+\t\t\tfdata = payload[idx] \|\n+\t\t\t\t((u16)payload[idx + 1] \u003c\u003c 8);\n+\t\t\tidx += 2;\n+\t\t\tdata_written += 2;\n+\t\t} else {\n+\t\t\tfdata = payload[idx];\n+\t\t\tidx++;\n+\t\t\tdata_written++;\n+\t\t}\n+\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, fdata);\n+\t\tif (ret \u003c 0)\n+\t\t\tgoto write_err;\n+\t\tword_idx++;\n+\n+\t\tif (idx \u003e= payload_size) {\n+\t\t\tret = mxl862xx_sb_pdi_flush_last(priv, data_written);\n+\t\t\tbreak;\n+\t\t}\n+\n+\t\t/ Half-bank boundary: switch to SB1 address /\n+\t\tif (word_idx == MXL862XX_FW_BANK_HALF) {\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t\t MXL862XX_SB_PDI_CTRL_RST);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n+\t\t\t\t\t\t MXL862XX_FW_SB1_ADDR);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t\t MXL862XX_SB_PDI_CTRL_WR);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\t\t} else if (word_idx \u003e= MXL862XX_FW_BANK_SLICE) {\n+\t\t\tret = mxl862xx_sb_pdi_flush_slice(priv, data_written);\n+\t\t\tif (ret) {\n+\t\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\t\"flash: write timeout at %u/%u: %pe\\n\",\n+\t\t\t\t\tidx, payload_size, ERR_PTR(ret));\n+\t\t\t\tgoto no_end;\n+\t\t\t}\n+\t\t\tword_idx = 0;\n+\t\t\tdata_written = 0;\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t\t MXL862XX_SB_PDI_CTRL_WR);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\n+\t\t\tif (time_after(jiffies, next_notify)) {\n+\t\t\t\tmxl862xx_flash_notify(dl, \"Flashing\", idx,\n+\t\t\t\t\t\t payload_size);\n+\t\t\t\tnext_notify = jiffies + msecs_to_jiffies(500);\n+\t\t\t}\n+\t\t}\n+\t}\n+\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: final slice failed: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\tmxl862xx_flash_notify(dl, \"Flashing\", payload_size, payload_size);\n+\n+\t/ Success: the loader has left the receive loop at r_remain == 0 and\n+\t * verified the image, so END(0x3cc3) is a finalise/boot request rather\n+\t * than a byte count. Signal it here -- and only here -- to boot the new\n+\t * image without waiting out the loader's 2 s END timeout.\n+\t /\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t MXL862XX_SB_PDI_END);\n+\tmsleep(MXL862XX_FW_REBOOT_DELAY_MS);\n+\treturn ret;\n+\n+write_err:\n+\tdev_err(\u0026priv-\u003emdiodev-\u003edev, \"flash: SMDIO write failed: %pe\\n\",\n+\t\tERR_PTR(ret));\n+no_end:\n+\t/ A failure leaves the loader mid transfer; do not signal END (a STAT\n+\t * write is a byte count then, and END would be misread as one, risking\n+\t * a receive-counter underflow). Return the error; the caller reprobes.\n+\t /\n+\treturn ret;\n+}\n+\n+int mxl862xx_devlink_info_get(struct dsa_switch ds,\n+\t\t\t struct devlink_info_req req,\n+\t\t\t struct netlink_ext_ack extack)\n+{\n+\tstruct mxl862xx_priv priv = ds-\u003epriv;\n+\tchar buf[16];\n+\tint ret;\n+\n+\t/ No chip-id/revision in MCUboot (needs the firmware MMD mailbox). The\n+\t * fw version doubles as the \"ready to flash\" signal: report it only\n+\t * once the loader is at a clean READY, nothing while still draining.\n+\t /\n+\tif (priv-\u003erescue_mode) {\n+\t\tif (!READ_ONCE(priv-\u003erescue_ready))\n+\t\t\treturn 0;\n+\n+\t\tsnprintf(buf, sizeof(buf), \"%u.%u.%u\",\n+\t\t\t priv-\u003efw_version.major, priv-\u003efw_version.minor,\n+\t\t\t priv-\u003efw_version.revision);\n+\t\tret = devlink_info_version_running_put(req,\n+\t\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t\treturn devlink_info_version_stored_put(req,\n+\t\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+\t}\n+\n+\t/ A 0 part number means the CHIP ID read failed or the part is\n+\t * unfused; omit it rather than publish a bogus \"0000\" that fwupd\n+\t * would match firmware against -- it then falls back to the driver\n+\t * name.\n+\t /\n+\tif (priv-\u003easic_id) {\n+\t\tsnprintf(buf, sizeof(buf), \"%04X\", priv-\u003easic_id);\n+\t\tret = devlink_info_version_fixed_put(req,\n+\t\t\t\t\t\t DEVLINK_INFO_VERSION_GENERIC_ASIC_ID,\n+\t\t\t\t\t\t buf);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tsnprintf(buf, sizeof(buf), \"%u\", priv-\u003easic_rev);\n+\t\tret = devlink_info_version_fixed_put(req,\n+\t\t\t\t\t\t DEVLINK_INFO_VERSION_GENERIC_ASIC_REV,\n+\t\t\t\t\t\t buf);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t}\n+\n+\t/ An all-zero version is the cache a failed flash left behind, not a\n+\t * released firmware; omit it like the part number above.\n+\t /\n+\tif (!priv-\u003efw_version.major \u0026\u0026 !priv-\u003efw_version.minor \u0026\u0026\n+\t !priv-\u003efw_version.revision)\n+\t\treturn 0;\n+\n+\tsnprintf(buf, sizeof(buf), \"%u.%u.%u\",\n+\t\t priv-\u003efw_version.major, priv-\u003efw_version.minor,\n+\t\t priv-\u003efw_version.revision);\n+\n+\tret = devlink_info_version_running_put(req,\n+\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\t/ boots this image from its own flash: stored == running /\n+\treturn devlink_info_version_stored_put(req,\n+\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+}\n+\n+int mxl862xx_devlink_flash_update(struct dsa_switch ds,\n+\t\t\t\t struct devlink_flash_update_params params,\n+\t\t\t\t struct netlink_ext_ack extack)\n+{\n+\tstruct mxl862xx_reprobe ko;\n+\tstruct mxl862xx_priv priv = ds-\u003epriv;\n+\tstruct dsa_port dp;\n+\tu32 payload_size;\n+\tint ret, i;\n+\n+\tif (params-\u003ecomponent) {\n+\t\tNL_SET_ERR_MSG_MOD(extack, \"component is not supported\");\n+\t\treturn -EOPNOTSUPP;\n+\t}\n+\n+\t/ A previous flash is still waiting for its reprobe: the firmware API\n+\t * is short-circuited, so the raw SB PDI writes below would run against\n+\t * a switch this driver no longer tracks.\n+\t /\n+\tif (priv-\u003eskip_teardown) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t \"device is reinitializing, retry later\");\n+\t\treturn -EBUSY;\n+\t}\n+\n+\tret = mxl862xx_flash_validate(priv, params-\u003efw, \u0026payload_size);\n+\tif (ret) {\n+\t\tNL_SET_ERR_MSG_MOD(extack, \"firmware image validation failed\");\n+\t\treturn ret;\n+\t}\n+\n+\t/ Refuse to flash while the background self-heal is still draining, and\n+\t * for good once it has given up on the loader.\n+\t /\n+\tif (READ_ONCE(priv-\u003erescue_failed)) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t \"download recovery failed, power cycle the switch\");\n+\t\treturn -EIO;\n+\t}\n+\n+\tif (priv-\u003erescue_mode \u0026\u0026 !READ_ONCE(priv-\u003erescue_ready)) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t \"switch is recovering an interrupted download, retry shortly\");\n+\t\treturn -EBUSY;\n+\t}\n+\n+\t/ The references the reprobe work needs to restore normal operation\n+\t * must be held before the switch is disturbed; the work itself is\n+\t * scheduled only once the flash is done (see below).\n+\t /\n+\tif (!try_module_get(THIS_MODULE))\n+\t\treturn -ENODEV;\n+\n+\tget_device(ds-\u003edev);\n+\n+\t/ Allocate the reprobe work before disturbing the switch, so an\n+\t * -ENOMEM here cannot strand it flashed but never reprobed.\n+\t /\n+\tko = mxl862xx_reprobe_alloc(ds-\u003edev);\n+\tif (!ko) {\n+\t\tput_device(ds-\u003edev);\n+\t\tmodule_put(THIS_MODULE);\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\tif (priv-\u003erescue_mode)\n+\t\tdev_info(ds-\u003edev,\n+\t\t\t \"flash: flashing switch via MCUboot rescue mode\\n\");\n+\telse\n+\t\tdev_info(ds-\u003edev, \"flash: running firmware %u.%u.%u\\n\",\n+\t\t\t priv-\u003efw_version.major, priv-\u003efw_version.minor,\n+\t\t\t priv-\u003efw_version.revision);\n+\n+\t/ Close ports while the firmware is still alive so the DSA core's\n+\t * MDB/FDB tracking is drained, and detach user ports so userspace\n+\t * cannot reopen them during the flash. The conduit is only closed,\n+\t * not detached: it belongs to the MAC driver. This driver binds a\n+\t * single switch with a direct host link and no cascade ports, so the\n+\t * conduit serves only this switch, and flashing it reboots the switch,\n+\t * which takes the tree down regardless.\n+\t /\n+\trtnl_lock();\n+\tdsa_switch_for_each_user_port(dp, ds) {\n+\t\tif (dp-\u003euser) {\n+\t\t\tdev_close(dp-\u003euser);\n+\t\t\tnetif_device_detach(dp-\u003euser);\n+\t\t}\n+\t}\n+\tdsa_switch_for_each_cpu_port(dp, ds)\n+\t\tdev_close(dp-\u003econduit);\n+\t/ The bridge defers the STP state changes triggered by closing\n+\t * the ports; let them reach the firmware while it is still alive.\n+\t /\n+\tswitchdev_deferred_process();\n+\trtnl_unlock();\n+\n+\tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock, MDIO_MUTEX_NESTED);\n+\tpriv-\u003eblock_host = true;\n+\tmutex_unlock(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock);\n+\n+\tmxl862xx_stop_work(priv);\n+\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n+\tcancel_work_sync(\u0026priv-\u003ecrc_err_work);\n+\tfor (i = 0; i \u003c ds-\u003enum_ports; i++)\n+\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n+\n+\tret = mxl862xx_flash_firmware(priv, params-\u003efw, payload_size,\n+\t\t\t\t ds-\u003edevlink);\n+\tif (ret)\n+\t\tNL_SET_ERR_MSG_MOD(extack, \"firmware transfer failed\");\n+\n+\tif (!ret) {\n+\t\tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock,\n+\t\t\t\t MDIO_MUTEX_NESTED);\n+\t\tpriv-\u003eblock_host = false;\n+\t\tpriv-\u003erescue_mode = false;\n+\t\tmutex_unlock(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock);\n+\n+\t\t/ Refresh the cached versions so the flash update only\n+\t\t * completes once the new firmware is confirmed running and\n+\t\t * devlink dev info reports it. Must happen before setting\n+\t\t * skip_teardown, which discards all firmware API reads.\n+\t\t /\n+\t\tret = mxl862xx_wait_ready(ds);\n+\t\tif (ret)\n+\t\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t\t \"new firmware did not become ready\");\n+\t}\n+\n+\tif (ret) {\n+\t\t/ The switch is in MCUboot with erased or partly written flash;\n+\t\t * drop the cached identity so devlink dev info stops reporting\n+\t\t * the pre-flash version until the reprobe re-reads the truth.\n+\t\t /\n+\t\tmemset(\u0026priv-\u003efw_version, 0, sizeof(priv-\u003efw_version));\n+\t\tpriv-\u003easic_id = 0;\n+\t\tpriv-\u003easic_rev = 0;\n+\t}\n+\n+\tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock, MDIO_MUTEX_NESTED);\n+\tpriv-\u003eskip_teardown = true;\n+\tmutex_unlock(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock);\n+\n+\t/ Queue the reprobe last; the work was allocated up front and its\n+\t * module and device references are already held.\n+\t /\n+\tqueue_delayed_work(system_long_wq, \u0026ko-\u003ework,\n+\t\t\t msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));\n+\n+\treturn ret;\n+}\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.h b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h\nnew file mode 100644\nindex 0000000000000..7cd87c7ad8716\n--- /dev/null\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h\n@@ -0,0 +1,20 @@\n+/ SPDX-License-Identifier: GPL-2.0-or-later /\n+\n+#ifndef __MXL862XX_FW_H\n+#define __MXL862XX_FW_H\n+\n+#include \u003cnet/dsa.h\u003e\n+\n+struct mxl862xx_priv;\n+struct work_struct;\n+\n+int mxl862xx_rescue_mode_detect(struct mxl862xx_priv priv);\n+void mxl862xx_rescue_heal_work_fn(struct work_struct work);\n+int mxl862xx_devlink_info_get(struct dsa_switch ds,\n+\t\t\t struct devlink_info_req req,\n+\t\t\t struct netlink_ext_ack extack);\n+int mxl862xx_devlink_flash_update(struct dsa_switch ds,\n+\t\t\t\t struct devlink_flash_update_params params,\n+\t\t\t\t struct netlink_ext_ack extack);\n+\n+#endif / __MXL862XX_FW_H /\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.c b/drivers/net/dsa/mxl862xx/mxl862xx-host.c\nindex 4acd216f7cc00..469ba1b2a2e18 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.c\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.c\n@@ -15,6 +15,8 @@\n #include \u003clinux/unaligned.h\u003e\n #include \u003cnet/dsa.h\u003e\n #include \"mxl862xx.h\"\n+#include \"mxl862xx-cmd.h\"\n+#include \"mxl862xx-fw.h\"\n #include \"mxl862xx-host.h\"\n \n #define CTRL_BUSY_MASK\t\t\tBIT(15)\n@@ -340,6 +342,21 @@ int mxl862xx_api_wrap(struct mxl862xx_priv priv, u16 cmd, void _data,\n \n \tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock, MDIO_MUTEX_NESTED);\n \n+\tif (priv-\u003eskip_teardown) {\n+\t\tret = read ? -ENODEV : 0;\n+\t\tgoto out;\n+\t}\n+\n+\tif (priv-\u003erescue_mode) {\n+\t\tret = -ENODEV;\n+\t\tgoto out;\n+\t}\n+\n+\tif (priv-\u003eblock_host \u0026\u0026 cmd != SYS_MISC_FW_UPDATE) {\n+\t\tret = -EBUSY;\n+\t\tgoto out;\n+\t}\n+\n \tmax = (size + 1) / 2;\n \n \tret = mxl862xx_busy_wait(priv);\n@@ -495,12 +512,55 @@ int mxl862xx_reset(struct mxl862xx_priv priv)\n \treturn ret;\n }\n \n+#define MXL862XX_SMDIO_ADDR_REG\t\t0x1f\n+#define MXL862XX_SMDIO_PAGE_MASK\t0xfff0\n+#define MXL862XX_SMDIO_OFF_MASK\t\t0x000f\n+\n+/* Paged clause-22 window: the page goes into MII register 0x1f, the low nibble\n+ * of addr selects one of the 16 registers within it. Both helpers take the MDIO\n+ * bus lock per transaction, so callers must not already hold it -- unlike\n+ * mxl862xx_api_wrap(), which holds it across a whole firmware command.\n+ /\n+int mxl862xx_smdio_read(struct mxl862xx_priv priv, u32 addr)\n+{\n+\tstruct mii_bus bus = priv-\u003emdiodev-\u003ebus;\n+\tint phy = priv-\u003emdiodev-\u003eaddr;\n+\tint ret;\n+\n+\tmutex_lock(\u0026bus-\u003emdio_lock);\n+\tret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,\n+\t\t\t addr \u0026 MXL862XX_SMDIO_PAGE_MASK);\n+\tif (ret \u003e= 0)\n+\t\tret = __mdiobus_read(bus, phy, addr \u0026 MXL862XX_SMDIO_OFF_MASK);\n+\tmutex_unlock(\u0026bus-\u003emdio_lock);\n+\treturn ret;\n+}\n+\n+int mxl862xx_smdio_write(struct mxl862xx_priv priv, u32 addr, u16 val)\n+{\n+\tstruct mii_bus bus = priv-\u003emdiodev-\u003ebus;\n+\tint phy = priv-\u003emdiodev-\u003eaddr;\n+\tint ret;\n+\n+\tmutex_lock(\u0026bus-\u003emdio_lock);\n+\tret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,\n+\t\t\t addr \u0026 MXL862XX_SMDIO_PAGE_MASK);\n+\tif (ret \u003e= 0)\n+\t\tret = __mdiobus_write(bus, phy, addr \u0026 MXL862XX_SMDIO_OFF_MASK,\n+\t\t\t\t val);\n+\tmutex_unlock(\u0026bus-\u003emdio_lock);\n+\treturn ret;\n+}\n+\n void mxl862xx_host_init(struct mxl862xx_priv priv)\n {\n+\tmutex_init(\u0026priv-\u003eheal_lock);\n \tINIT_WORK(\u0026priv-\u003ecrc_err_work, mxl862xx_crc_err_work_fn);\n+\tINIT_WORK(\u0026priv-\u003erescue_heal_work, mxl862xx_rescue_heal_work_fn);\n }\n \n void mxl862xx_host_shutdown(struct mxl862xx_priv priv)\n {\n \tcancel_work_sync(\u0026priv-\u003ecrc_err_work);\n+\tcancel_work_sync(\u0026priv-\u003erescue_heal_work);\n }\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.h b/drivers/net/dsa/mxl862xx/mxl862xx-host.h\nindex 66d6ae198aff4..4e054c6e4c0e4 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.h\n@@ -18,5 +18,7 @@ int mxl862xx_api_wrap(struct mxl862xx_priv priv, u16 cmd, void data, u16 size,\n \tmxl862xx_api_wrap(dev, cmd, \u0026(data), sizeof((data)), true, true)\n \n int mxl862xx_reset(struct mxl862xx_priv priv);\n+int mxl862xx_smdio_read(struct mxl862xx_priv priv, u32 addr);\n+int mxl862xx_smdio_write(struct mxl862xx_priv priv, u32 addr, u16 val);\n \n #endif /* __MXL862XX_HOST_H /\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c\nindex b689652aa9b92..a5b6940b552e9 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c\n@@ -406,6 +406,8 @@ mxl862xx_phylink_mac_select_pcs(struct phylink_config config,\n \n \tswitch (port) {\n \tcase 9 ... 16:\n+\t\tif (priv-\u003erescue_mode)\n+\t\t\treturn NULL;\n \t\tif (!MXL862XX_FW_VER_MIN(priv, 1, 0, 84)) {\n \t\t\tdev_warn_once(dp-\u003eds-\u003edev,\n \t\t\t\t \"SerDes PCS unsupported on old firmware.\\n\");\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c\nindex 45d237b3a40f1..300eb19a344e5 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx.c\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c\n@@ -21,6 +21,7 @@\n #include \"mxl862xx.h\"\n #include \"mxl862xx-api.h\"\n #include \"mxl862xx-cmd.h\"\n+#include \"mxl862xx-fw.h\"\n #include \"mxl862xx-host.h\"\n #include \"mxl862xx-phylink.h\"\n \n@@ -71,6 +72,13 @@ static const struct ethtool_rmon_hist_range mxl862xx_rmon_ranges[] = {\n #define MXL862XX_READY_TIMEOUT_MS\t10000\n #define MXL862XX_READY_POLL_MS\t\t100\n \n+/* Chip ID registers, read via SYS_MISC_REG_RD /\n+#define MXL862XX_CHIPID_L\t\t0xc0d28884\n+#define MXL862XX_CHIPID_M\t\t0xc0d28888\n+#define MXL862XX_CHIPID_L_PNUML\t\tGENMASK(15, 12)\n+#define MXL862XX_CHIPID_M_PNUMM\t\tGENMASK(11, 0)\n+#define MXL862XX_CHIPID_M_VERSION\tGENMASK(14, 12)\n+\n #define MXL862XX_TCM_INST_SEL\t\t0xe00\n #define MXL862XX_TCM_CBS\t\t0xe12\n #define MXL862XX_TCM_EBS\t\t0xe13\n@@ -222,7 +230,46 @@ static int mxl862xx_phy_write_c45_mii_bus(struct mii_bus bus, int addr,\n \treturn mxl862xx_phy_write_mmd(bus-\u003epriv, addr, devadd, regnum, val);\n }\n \n-static int mxl862xx_wait_ready(struct dsa_switch ds)\n+/ Read the static chip part number and version from the CHIP ID\n+ * registers. Only possible with a running firmware, so the values are\n+ * cached at setup and left zero when the switch is in rescue mode.\n+ /\n+static int mxl862xx_read_chip_id(struct mxl862xx_priv priv)\n+{\n+\tstruct mxl862xx_sys_reg_rw reg = {};\n+\tu16 chipid_l, chipid_m;\n+\tint ret;\n+\n+\treg.addr = cpu_to_le32(MXL862XX_CHIPID_L);\n+\tret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg);\n+\tif (ret)\n+\t\treturn ret;\n+\tchipid_l = le32_to_cpu(reg.val);\n+\n+\treg.addr = cpu_to_le32(MXL862XX_CHIPID_M);\n+\tret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg);\n+\tif (ret)\n+\t\treturn ret;\n+\tchipid_m = le32_to_cpu(reg.val);\n+\n+\tpriv-\u003easic_id = FIELD_GET(MXL862XX_CHIPID_L_PNUML, chipid_l) \|\n+\t\t\tFIELD_GET(MXL862XX_CHIPID_M_PNUMM, chipid_m) \u003c\u003c 4;\n+\tpriv-\u003easic_rev = FIELD_GET(MXL862XX_CHIPID_M_VERSION, chipid_m);\n+\n+\treturn 0;\n+}\n+\n+/*\n+ mxl862xx_wait_ready - wait for the switch firmware to become operational\n+ * @ds: DSA switch instance\n+ \n+ Poll the firmware until it reports its version and accepts\n+ * configuration commands, then cache the firmware version and chip ID.\n+ * Takes at least two seconds.\n+ \n+ Return: 0 on success or a negative error code.\n+ /\n+int mxl862xx_wait_ready(struct dsa_switch ds)\n {\n \tstruct mxl862xx_sys_fw_image_version ver = {};\n \tunsigned long start = jiffies, timeout;\n@@ -254,6 +301,11 @@ static int mxl862xx_wait_ready(struct dsa_switch ds)\n \t\tpriv-\u003efw_version.major = ver.iv_major;\n \t\tpriv-\u003efw_version.minor = ver.iv_minor;\n \t\tpriv-\u003efw_version.revision = le16_to_cpu(ver.iv_revision);\n+\n+\t\tret = mxl862xx_read_chip_id(priv);\n+\t\tif (ret)\n+\t\t\tdev_warn(ds-\u003edev, \"failed to read chip ID: %pe\\n\",\n+\t\t\t\t ERR_PTR(ret));\n \t\treturn 0;\n \n not_ready_yet:\n@@ -622,21 +674,66 @@ static int mxl862xx_setup(struct dsa_switch ds)\n \tint n_user_ports = 0, max_vlans;\n \tint ingress_finals, vid_rules;\n \tstruct dsa_port dp;\n-\tint ret, i;\n-\n-\tret = mxl862xx_reset(priv);\n-\tif (ret)\n-\t\treturn ret;\n-\n-\tret = mxl862xx_wait_ready(ds);\n-\tif (ret)\n-\t\treturn ret;\n+\tint ret, i, rescue;\n \n+\t/ The SerDes state is software-only and must exist before anything can\n+\t * reach phylink, including a rescue-mode flash clearing rescue_mode\n+\t * ahead of the reprobe.\n+\t /\n \tmutex_init(\u0026priv-\u003eserdes_lock);\n \tfor (i = 0; i \u003c ARRAY_SIZE(priv-\u003eserdes_ports); i++)\n \t\tmxl862xx_setup_pcs(priv, \u0026priv-\u003eserdes_ports[i],\n \t\t\t\t i + MXL862XX_FIRST_SERDES_PORT);\n \n+\t/ Detect the loader over SB PDI first: it needs no firmware, unlike the\n+\t * C45 API (mxl862xx_reset/wait_ready) which spews CRC errors when none\n+\t * answers. Touch C45 only once rescue is ruled out.\n+\t /\n+\trescue = mxl862xx_rescue_mode_detect(priv);\n+\tif (rescue \u003c 0) {\n+\t\tdev_err(ds-\u003edev, \"switch state detection failed: %pe\\n\",\n+\t\t\tERR_PTR(rescue));\n+\t\treturn rescue;\n+\t}\n+\n+\tif (rescue == MXL862XX_NOT_RESCUE) {\n+\t\tret = mxl862xx_reset(priv);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tret = mxl862xx_wait_ready(ds);\n+\t\tif (ret) {\n+\t\t\t/ the reset may only now have triggered rescue mode /\n+\t\t\trescue = mxl862xx_rescue_mode_detect(priv);\n+\t\t\tif (rescue \u003c 0) {\n+\t\t\t\tdev_err(ds-\u003edev,\n+\t\t\t\t\t\"switch not responding after reset: %pe\\n\",\n+\t\t\t\t\tERR_PTR(rescue));\n+\t\t\t\treturn rescue;\n+\t\t\t}\n+\t\t\tif (rescue == MXL862XX_NOT_RESCUE)\n+\t\t\t\treturn ret;\n+\t\t}\n+\t}\n+\n+\tpriv-\u003erescue_mode = rescue;\n+\n+\tif (priv-\u003erescue_mode) {\n+\t\tif (priv-\u003erescue_ready) {\n+\t\t\tdev_warn(ds-\u003edev,\n+\t\t\t\t \"switch in MCUboot rescue mode, use devlink to flash new firmware\\n\");\n+\t\t} else {\n+\t\t\t/ Drain the wedged download in the background so it\n+\t\t\t * never holds the devlink lock; info and flash become\n+\t\t\t * available once ready.\n+\t\t\t /\n+\t\t\tdev_warn(ds-\u003edev,\n+\t\t\t\t \"switch in MCUboot with an interrupted download, recovering in background\\n\");\n+\t\t\tqueue_work(system_long_wq, \u0026priv-\u003erescue_heal_work);\n+\t\t}\n+\t\treturn 0;\n+\t}\n+\n \t/ Calculate Extended VLAN block sizes.\n \t * With VLAN Filter handling VID membership checks:\n \t * Ingress: only final catchall rules (PVID insertion, 802.1Q\n@@ -715,11 +812,21 @@ static int mxl862xx_port_state(struct dsa_switch ds, int port, bool enable)\n static int mxl862xx_port_enable(struct dsa_switch ds, int port,\n \t\t\t\tstruct phy_device phydev)\n {\n+\tstruct mxl862xx_priv priv = ds-\u003epriv;\n+\n+\tif (priv-\u003erescue_mode)\n+\t\treturn 0;\n+\n \treturn mxl862xx_port_state(ds, port, true);\n }\n \n static void mxl862xx_port_disable(struct dsa_switch ds, int port)\n {\n+\tstruct mxl862xx_priv priv = ds-\u003epriv;\n+\n+\tif (priv-\u003erescue_mode)\n+\t\treturn;\n+\n \tif (mxl862xx_port_state(ds, port, false))\n \t\tdev_err(ds-\u003edev, \"failed to disable port %d\\n\", port);\n }\n@@ -1337,6 +1444,17 @@ static int mxl862xx_port_setup(struct dsa_switch ds, int port)\n \tbool is_cpu_port = dsa_port_is_cpu(dp);\n \tint ret;\n \n+\tif (dsa_port_is_dsa(dp)) {\n+\t\tdev_err(ds-\u003edev, \"port %d: DSA links not supported\\n\", port);\n+\t\treturn -EOPNOTSUPP;\n+\t}\n+\n+\t/ DSA reinits failed user ports as unused; shared ports must\n+\t * succeed for the tree to register.\n+\t /\n+\tif (priv-\u003erescue_mode)\n+\t\treturn dsa_port_is_user(dp) ? -ENODEV : 0;\n+\n \tret = mxl862xx_port_state(ds, port, false);\n \tif (ret)\n \t\treturn ret;\n@@ -1346,11 +1464,6 @@ static int mxl862xx_port_setup(struct dsa_switch ds, int port)\n \tif (dsa_port_is_unused(dp))\n \t\treturn 0;\n \n-\tif (dsa_port_is_dsa(dp)) {\n-\t\tdev_err(ds-\u003edev, \"port %d: DSA links not supported\\n\", port);\n-\t\treturn -EOPNOTSUPP;\n-\t}\n-\n \tret = mxl862xx_configure_sp_tag_proto(ds, port, is_cpu_port);\n \tif (ret)\n \t\treturn ret;\n@@ -1572,6 +1685,12 @@ static int mxl862xx_port_mdb_del(struct dsa_switch ds, int port,\n \tether_addr_copy(qparam.mac, mdb-\u003eaddr);\n \n \tret = MXL862XX_API_READ(priv, MXL862XX_MAC_TABLEENTRYQUERY, qparam);\n+\t/ Post-flash teardown or MCUboot: the firmware and its MAC table are\n+\t * gone, so there is nothing left to delete. Outside those, -ENODEV is a\n+\t * bus error and must be reported.\n+\t /\n+\tif (ret == -ENODEV \u0026\u0026 (priv-\u003eskip_teardown \|\| priv-\u003erescue_mode))\n+\t\treturn 0;\n \tif (ret)\n \t\treturn ret;\n \n@@ -1628,6 +1747,9 @@ static void mxl862xx_port_stp_state_set(struct dsa_switch ds, int port,\n \tstruct mxl862xx_priv priv = ds-\u003epriv;\n \tint ret;\n \n+\tif (priv-\u003erescue_mode)\n+\t\treturn;\n+\n \tswitch (state) {\n \tcase BR_STATE_DISABLED:\n \t\tparam.port_state = cpu_to_le32(MXL862XX_STP_PORT_STATE_DISABLE);\n@@ -2015,6 +2137,12 @@ static void mxl862xx_stats_work_fn(struct work_struct work)\n \tstruct dsa_switch ds = priv-\u003eds;\n \tstruct dsa_port dp;\n \n+\t/* A get_stats64() re-arm can race the flash teardown's WORK_STOPPED\n+\t * set and cancel; bail here so a stray poll never runs during a flash.\n+\t /\n+\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n+\t\treturn;\n+\n \tdsa_switch_for_each_available_port(dp, ds)\n \t\tmxl862xx_stats_poll(ds, dp-\u003eindex);\n \n@@ -2086,6 +2214,8 @@ static const struct dsa_switch_ops mxl862xx_switch_ops = {\n \t.get_pause_stats = mxl862xx_get_pause_stats,\n \t.get_rmon_stats = mxl862xx_get_rmon_stats,\n \t.get_stats64 = mxl862xx_get_stats64,\n+\t.devlink_info_get = mxl862xx_devlink_info_get,\n+\t.devlink_flash_update = mxl862xx_devlink_flash_update,\n };\n \n static int mxl862xx_probe(struct mdio_device mdiodev)\n@@ -2129,7 +2259,7 @@ static int mxl862xx_probe(struct mdio_device mdiodev)\n \n \terr = dsa_register_switch(ds);\n \tif (err) {\n-\t\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\t\tmxl862xx_stop_work(priv);\n \t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n \t\tmxl862xx_host_shutdown(priv);\n \t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n@@ -2150,7 +2280,7 @@ static void mxl862xx_remove(struct mdio_device mdiodev)\n \n \tpriv = ds-\u003epriv;\n \n-\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\tmxl862xx_stop_work(priv);\n \tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n \n \tdsa_unregister_switch(ds);\n@@ -2179,7 +2309,7 @@ static void mxl862xx_shutdown(struct mdio_device mdiodev)\n \n \tdsa_switch_shutdown(ds);\n \n-\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\tmxl862xx_stop_work(priv);\n \tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n \n \tmxl862xx_host_shutdown(priv);\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx.h b/drivers/net/dsa/mxl862xx/mxl862xx.h\nindex 432a5f3f2e08e..da45d24de7cf9 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx.h\n@@ -4,7 +4,9 @@\n #define __MXL862XX_H\n \n #include \u003casm/byteorder.h\u003e\n+#include \u003clinux/bitops.h\u003e\n #include \u003clinux/mdio.h\u003e\n+#include \u003clinux/mutex.h\u003e\n #include \u003clinux/workqueue.h\u003e\n #include \u003cnet/dsa.h\u003e\n \n@@ -14,6 +16,10 @@ struct mxl862xx_priv;\n #define MXL862XX_FIRST_SERDES_PORT\t9\n #define MXL862XX_SERDES_SLOTS\t\t4\n \n+/ mxl862xx_rescue_mode_detect() return codes (negative values are errors) /\n+#define MXL862XX_NOT_RESCUE\t\t0\n+#define MXL862XX_IN_RESCUE\t\t1\n+\n #define MXL862XX_DEFAULT_BRIDGE\t\t0\n #define MXL862XX_MAX_BRIDGES\t\t48\n #define MXL862XX_MAX_BRIDGE_PORTS\t128\n@@ -303,6 +309,10 @@ struct mxl862xx_fw_version {\n flooding)\n * @fw_version: cached firmware version, populated at probe and\n * compared with MXL862XX_FW_VER_MIN()\n+ * @asic_id: chip part number read from the CHIP ID registers,\n+ * reported as the devlink \"asic.id\" fixed version\n+ * @asic_rev: chip version read from the CHIP ID registers,\n+ * reported as the devlink \"asic.rev\" fixed version\n * @serdes_ports: SerDes interfaces incl. sub-interfaces in case of\n * 10G_QXGMII or QSGMII\n * @serdes_refcount: per-XPCS count of sub-ports enabled by phylink;\n@@ -319,6 +329,22 @@ struct mxl862xx_fw_version {\n * @evlan_ingress_size: per-port ingress Extended VLAN block size\n * @evlan_egress_size: per-port egress Extended VLAN block size\n * @vf_block_size: per-port VLAN Filter block size\n+ * @block_host: reject firmware API commands (except FW_UPDATE)\n+ * during a firmware flash\n+ * @skip_teardown: discard firmware API commands during the teardown\n+ * triggered by the post-flash reprobe\n+ * @rescue_mode: switch is in MCUboot; firmware API commands fail fast,\n+ * only clause-22 SMDIO works. Set from setup() before the\n+ * switch is registered and cleared under the MDIO bus lock\n+ * for the benefit of mxl862xx_api_wrap(); other readers\n+ * only need it to be a stable single flag.\n+ * @rescue_ready: (rescue_mode) loader is at a clean READY and will accept\n+ * a flash; false while rescue_heal_work is draining\n+ * @rescue_failed: (rescue_mode) the self-heal gave up; the loader needs a\n+ * power cycle and no flash can be accepted\n+ * @rescue_heal_work: background self-heal draining a wedged download to READY\n+ * @heal_lock: serialises the self-heal's reprobe hand-off against\n+ * teardown setting %MXL862XX_FLAG_WORK_STOPPED\n * @stats_work: periodic work item that polls RMON hardware counters\n * and accumulates them into 64-bit per-port stats\n /\n@@ -326,9 +352,12 @@ struct mxl862xx_priv {\n \tstruct dsa_switch ds;\n \tstruct mdio_device mdiodev;\n \tstruct work_struct crc_err_work;\n+\tstruct work_struct rescue_heal_work;\n \tunsigned long flags;\n \tu16 drop_meter;\n \tstruct mxl862xx_fw_version fw_version;\n+\tu16 asic_id;\n+\tu8 asic_rev;\n \tstruct mxl862xx_pcs serdes_ports[8];\n \tint serdes_refcount[2];\n \tstruct mutex serdes_lock;\n@@ -337,7 +366,26 @@ struct mxl862xx_priv {\n \tu16 evlan_ingress_size;\n \tu16 evlan_egress_size;\n \tu16 vf_block_size;\n+\tbool block_host;\n+\tbool skip_teardown;\n+\tbool rescue_mode;\n+\tbool rescue_ready;\n+\tbool rescue_failed;\n+\tstruct mutex heal_lock;\n \tstruct delayed_work stats_work;\n };\n \n+/ Stop the background workers. The flag is set under heal_lock, which the\n+ * rescue self-heal also holds across its own flag test and the queueing of its\n+ * reprobe, so no reprobe can slip past a teardown that has begun.\n+ /\n+static inline void mxl862xx_stop_work(struct mxl862xx_priv priv)\n+{\n+\tmutex_lock(\u0026priv-\u003eheal_lock);\n+\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\tmutex_unlock(\u0026priv-\u003eheal_lock);\n+}\n+\n+int mxl862xx_wait_ready(struct dsa_switch ds);\n+\n #endif / __MXL862XX_H /\ndiff --git a/include/net/dsa.h b/include/net/dsa.h\nindex 6f7f5c17b5320..58597b14e592a 100644\n--- a/include/net/dsa.h\n+++ b/include/net/dsa.h\n@@ -1172,6 +1172,9 @@ struct dsa_switch_ops {\n \tint\t(devlink_info_get)(struct dsa_switch ds,\n \t\t\t\t struct devlink_info_req req,\n \t\t\t\t struct netlink_ext_ack extack);\n+\tint\t(devlink_flash_update)(struct dsa_switch ds,\n+\t\t\t\t\tstruct devlink_flash_update_params params,\n+\t\t\t\t\tstruct netlink_ext_ack extack);\n \tint\t(devlink_sb_pool_get)(struct dsa_switch ds,\n \t\t\t\t unsigned int sb_index, u16 pool_index,\n \t\t\t\t struct devlink_sb_pool_info pool_info);\ndiff --git a/net/dsa/devlink.c b/net/dsa/devlink.c\nindex ed342f345692b..25311a87cbc56 100644\n--- a/net/dsa/devlink.c\n+++ b/net/dsa/devlink.c\n@@ -20,6 +20,18 @@ static int dsa_devlink_info_get(struct devlink dl,\n \treturn -EOPNOTSUPP;\n }\n \n+static int dsa_devlink_flash_update(struct devlink dl,\n+\t\t\t\t struct devlink_flash_update_params params,\n+\t\t\t\t struct netlink_ext_ack extack)\n+{\n+\tstruct dsa_switch ds = dsa_devlink_to_ds(dl);\n+\n+\tif (!ds-\u003eops-\u003edevlink_flash_update)\n+\t\treturn -EOPNOTSUPP;\n+\n+\treturn ds-\u003eops-\u003edevlink_flash_update(ds, params, extack);\n+}\n+\n static int dsa_devlink_sb_pool_get(struct devlink dl,\n \t\t\t\t unsigned int sb_index, u16 pool_index,\n \t\t\t\t struct devlink_sb_pool_info pool_info)\n@@ -169,6 +181,7 @@ dsa_devlink_sb_occ_tc_port_bind_get(struct devlink_port dlp,\n \n static const struct devlink_ops dsa_devlink_ops = {\n \t.info_get\t\t\t= dsa_devlink_info_get,\n+\t.flash_update\t\t\t= dsa_devlink_flash_update,\n \t.sb_pool_get\t\t\t= dsa_devlink_sb_pool_get,\n \t.sb_pool_set\t\t\t= dsa_devlink_sb_pool_set,\n \t.sb_port_pool_get\t\t= dsa_devlink_sb_port_pool_get,\n" }
2/1	2026/08/03 04:46	agent	patch-evaluator	2m Model: best-expensive Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 15bf5418d47d7d5e1b4a3bc26285fcb69c18c1b8 Author: syz-cluster <triage@syzkaller.com> Date: Mon Aug 3 04:46:56 2026 +0000 syz-cluster: applied patch under review diff --git a/Documentation/networking/devlink/index.rst b/Documentation/networking/devlink/index.rst index 4745148fecf4f..058999d0dc56f 100644 --- a/Documentation/networking/devlink/index.rst +++ b/Documentation/networking/devlink/index.rst @@ -94,6 +94,7 @@ parameters, info versions, and other features it supports. mlx5 mlxsw mv88e6xxx + mxl862xx netdevsim nfp octeontx2 diff --git a/Documentation/networking/devlink/mxl862xx.rst b/Documentation/networking/devlink/mxl862xx.rst new file mode 100644 index 0000000000000..7c2dc11f65856 --- /dev/null +++ b/Documentation/networking/devlink/mxl862xx.rst @@ -0,0 +1,71 @@ +.. SPDX-License-Identifier: GPL-2.0 + +======================== +mxl862xx devlink support +======================== + +This document describes the devlink features implemented by the +``mxl862xx`` device driver. + +Info versions +============= + +The ``mxl862xx`` driver reports the following versions + +.. list-table:: devlink info versions implemented + :widths: 5 5 5 85 + + * - Name + - Type + - Example + - Description + * - ``asic.id`` + - fixed + - 8628 + - The chip part number read from the CHIP ID registers. Omitted + when the part number reads as zero, which happens for a switch + sitting in MCUboot rescue mode (the registers need a running + firmware), for an unfused part, and after a failed flash. + * - ``asic.rev`` + - fixed + - 0 + - The chip version read from the same register word, so it is + omitted whenever ``asic.id`` is. + * - ``fw`` + - running, stored + - 1.0.70 + - Version of the firmware running on the switch, reported as both + running and stored since the switch boots it from its own flash. + It is omitted while no firmware version is known: after a failed + flash, and in MCUboot rescue mode while an interrupted download + is still being recovered in the background. Once the loader is + ready to accept a new image the version appears as "0.0.0", + which no released firmware reports, so version-comparing tools + offer any available release as an upgrade. Use ``devlink dev + flash`` to tell a recovering switch from a ready one, see below; + a missing version on its own does not say why. + +Flash update +============ + +The ``mxl862xx`` driver implements support for ``devlink dev flash``. +The signed firmware image is transferred to the switch over the same +MDIO bus which is also used to manage the switch, then verified and +installed by the MCUboot bootloader running on the switch. All ports +of the switch are closed for the duration of the update and the driver +reprobes the switch after it has rebooted into the new firmware. A +complete flash and reprobe cycle takes about one minute. + +A switch stuck in MCUboot rescue mode, e.g. after an interrupted +update, is registered without user ports. If the previous download was +interrupted mid-transfer the loader is wedged; the driver drains it +back to a clean ready state in the background, one byte at a time, +which takes tens of minutes for a large image and is reported through +the kernel log as it progresses. During that recovery ``devlink dev +flash`` returns ``-EBUSY`` with an extack message saying so, and +``devlink dev info`` reports no firmware version. Once the loader is +ready the firmware version appears and flashing a firmware image +through the regular update flow recovers the switch. + +If the recovery fails, the loader needs a power cycle: ``devlink dev +flash`` then returns ``-EIO`` and says so in its extack message. diff --git a/MAINTAINERS b/MAINTAINERS index 932ea1db048e5..c27c449159c5a 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -16107,6 +16107,7 @@ M: Daniel Golle <daniel@makrotopia.org> L: netdev@vger.kernel.org S: Maintained F: Documentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml +F: Documentation/networking/devlink/mxl862xx.rst F: drivers/net/dsa/mxl862xx/ F: net/dsa/tag_mxl862xx.c diff --git a/drivers/net/dsa/mxl862xx/Makefile b/drivers/net/dsa/mxl862xx/Makefile index a7be0e6669dfa..bccac0d0f703f 100644 --- a/drivers/net/dsa/mxl862xx/Makefile +++ b/drivers/net/dsa/mxl862xx/Makefile @@ -1,3 +1,3 @@ # SPDX-License-Identifier: GPL-2.0 obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o -mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o +mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-api.h b/drivers/net/dsa/mxl862xx/mxl862xx-api.h index a180a5decffc0..6f771895984cb 100644 --- a/drivers/net/dsa/mxl862xx/mxl862xx-api.h +++ b/drivers/net/dsa/mxl862xx/mxl862xx-api.h @@ -1224,6 +1224,16 @@ struct mxl862xx_sys_fw_image_version { __le32 iv_build_num; } __packed; +/** + * struct mxl862xx_sys_reg_rw - System register read/write + * @addr: 32-bit register address + * @val: register value + / +struct mxl862xx_sys_reg_rw { + __le32 addr; + __le32 val; +} __packed; + /* * enum mxl862xx_port_type - Port Type * @MXL862XX_LOGICAL_PORT: Logical Port diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h index c87a955c13c48..a865425aa61e1 100644 --- a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h +++ b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h @@ -70,7 +70,9 @@ #define INT_GPHY_READ (GPY_GPY2XX_MAGIC + 0x1) #define INT_GPHY_WRITE (GPY_GPY2XX_MAGIC + 0x2) +#define SYS_MISC_FW_UPDATE (SYS_MISC_MAGIC + 0x1) #define SYS_MISC_FW_VERSION (SYS_MISC_MAGIC + 0x2) +#define SYS_MISC_REG_RD (SYS_MISC_MAGIC + 0x8) #define MXL862XX_XPCS_PCS_CONFIG (MXL862XX_XPCS_MAGIC + 0x1) #define MXL862XX_XPCS_PCS_GET_STATE (MXL862XX_XPCS_MAGIC + 0x2) diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.c b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c new file mode 100644 index 0000000000000..94aa658a62db9 --- /dev/null +++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c @@ -0,0 +1,1102 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Firmware flash and devlink support for MaxLinear MxL862xx + * + * Copyright (C) 2025 Daniel Golle <daniel@makrotopia.org> + * + * SB PDI - firmware download interface over clause-22 SMDIO + * ========================================================= + * + * The MxL862xx MCUboot loader accepts a firmware image through four "SB PDI" + * registers in the switch SMDIO register space. It runs whenever no WSP + * firmware is active: the normal firmware update enters it deliberately - the + * SYS_MISC_FW_UPDATE API command sets a sticky rescue bit and reboots into + * MCUboot - and the loader also stays here when the stored WSP firmware fails + * its boot-time integrity check. This driver drives the loader's 0xc55c + * "console" download path. + * + * SMDIO register access (mxl862xx_smdio_read/write): + * MII reg 0x1f := (<sb_pdi_reg> & 0xfff0) ; page latch + * MII reg (<sb_pdi_reg> & 0x000f) := / => <u16 data> + * so CTRL/ADDR/DATA/STAT (0xe100..0xe103) are MII regs 0/1/2/3 of page + * 0xe100, not all reg 0x00. + * + * SB PDI registers (host name/addr -> MCU mailbox): + * CTRL 0xe100 -> 0xc0938400 mode: RST=0x00 RD=0x01 WR=0x02 + * ADDR 0xe101 -> 0xc0938404 SB target word address (SB1 bank = 0x7800) + * DATA 0xe102 -> 0xc0938408 16-bit data / reply word + * STAT 0xe103 -> 0xc093840c handshake: a magic (below) or a byte count + * + * STAT magics: + * READY 0xc55c loader idle in the console loop (this driver) + * DL_RDY 0xc33c loader idle in the flashless loop + * START 0xf48f host -> begin download session + * ACK 0xf490 loader -> START acknowledged (START + 1) + * END 0x3cc3 host -> finalise now (optional, see below) + * RDREG 0xe2c0 host -> register-read command (\| index), see below + * + * Console flash path (STAT=0xc55c) - mxl862xx_flash_firmware(): + * + * host loader + * ---- ------ + * reset (CTRL=ADDR=DATA=0) + * read STAT ............................ 0xc55c (READY, idle) + * STAT := START(0xf48f) --------------> + * <-------------- STAT = 0xf490 (ACK) + * CTRL := WR + * DATA := hdr[0..9] (20-byte header: type,size1,crc1,size2,crc2) + * reset; STAT := 20 (header len) -----> parse hdr; r_remain=size1+size2; + * ERASE target region(s) + * <-------------- STAT=21 (len+1), then STAT=0 + * (erased) + * -- payload, streamed in slices: -- + * CTRL := WR + * DATA := word x N ... + * at word 16384: CTRL:=RST; ADDR:=0x7800; CTRL:=WR (half-bank -> SB1) + * at word 32760: flush slice: + * reset; STAT := <bytes_this_slice> ---> r_remain -= bytes; program + * <------------------- STAT=0 (ready for next slice) + * ... repeat until the whole payload is sent ... + * <------------------- STAT=0 image verified + * (STAT=1: image rejected) + * STAT := END(0x3cc3) ---------------------> finalise and boot + * + * The r_remain == 0 rule (critical): + * Every host STAT write in the payload phase is a byte count; the loader + * does r_remain -= count and stays in the receive loop while r_remain != 0. + * It leaves the loop ONLY when r_remain hits EXACTLY 0, and a count larger + * than r_remain underflows the 32-bit counter and wedges the loader until a + * power cycle. Having left it, the loader verifies the image, publishes the + * verdict in STAT (0 good, 1 rejected) and waits 2 s for END before + * finalising regardless -- clearing its rescue-enable bit so boot_go boots + * the new image -- so END only saves that wait. Hence: + * - never send a slice/chunk count larger than what is outstanding; + * - a STAT write is a command only once the loader has left the loop; + * - the loader leaves the count in STAT while it programs the chunk, so + * a lingering count does not distinguish "busy" from "verdict"; + * - interrupted-download recovery feeds 1 byte at a time (see below). + * + * Interrupted-flash recovery (mxl862xx_rescue_drain): + * A host that dies mid-payload leaves the loader in the receive loop holding + * STAT=0. Feed single 1-byte chunks (one DATA word + STAT=1) until r_remain + * reaches 0; the loader then verifies the (now corrupt) image, publishes its + * verdict and comes back to READY by itself. END is never sent here: while + * r_remain is non-zero it would be consumed as a 15555-byte count, and a + * lingering STAT=1 cannot be told from a chunk still being programmed. + * + * Register-read challenge (non-destructive liveness proof): + * DATA := 0x7c23 (marker); STAT := 0xe2c0\|idx + * -> loader returns a runtime word in DATA and re-arms STAT=0xc55c. + * The reply source is loader BSS, not a chip id; used only to prove a live + * mailbox in mxl862xx_rescue_mode_detect(). + * + * The other STAT ready magic, 0xc33c, marks the loader's flashless + * chip-to-chip download mode (MxL86281S 16-port tier); this driver does not + * use it. + * + * Rescue lifecycle (devlink): probe runs mxl862xx_rescue_mode_detect(); a + * wedged loader is drained back to READY by a background self-heal + * (rescue_heal_work), so the long recovery never holds the devlink lock. + * devlink dev info exposes the fw version (the "flashable" signal) only once at + * READY; flash_update returns -EBUSY until then, and reprobes to WSP firmware + * on success. + * + * Notes: + * - Chip id/revision (0xc0d28884/88) are NOT reachable on this channel; they + * need the clause-45 MMD firmware mailbox, which is dead under MCUboot. + * Rescue identity is by SB PDI behaviour only (mxl862xx_rescue_mode_detect). + * - The SMDIO PHY address comes from the device tree; the 0xe1xx register + * offsets are the OTP reset defaults and the only layout supported here. + / + +#include <linux/crc32.h> +#include <linux/delay.h> +#include <linux/device.h> +#include <linux/iopoll.h> +#include <linux/module.h> +#include <linux/netdevice.h> +#include <linux/overflow.h> +#include <linux/rtnetlink.h> +#include <linux/workqueue.h> +#include <net/dsa.h> +#include <net/switchdev.h> + +#include "mxl862xx.h" +#include "mxl862xx-api.h" +#include "mxl862xx-cmd.h" +#include "mxl862xx-fw.h" +#include "mxl862xx-host.h" + +/ SB PDI registers (clause-22 SMDIO address space) / +#define MXL862XX_SB_PDI_CTRL 0xe100 +#define MXL862XX_SB_PDI_ADDR 0xe101 +#define MXL862XX_SB_PDI_DATA 0xe102 +#define MXL862XX_SB_PDI_STAT 0xe103 + +/ SB PDI CTRL modes / +#define MXL862XX_SB_PDI_CTRL_RST 0x00 +#define MXL862XX_SB_PDI_CTRL_WR 0x02 + +/ SB PDI handshake magic (published/consumed via STAT) / +#define MXL862XX_SB_PDI_READY 0xc55c / loader idle, console loop / +#define MXL862XX_SB_PDI_DL_READY 0xc33c / loader idle, flashless loop / +#define MXL862XX_SB_PDI_START 0xf48f +#define MXL862XX_SB_PDI_END 0x3cc3 +#define MXL862XX_SB_PDI_RDREG 0xe2c0 / register-read cmd (\| index) / +#define MXL862XX_SB_PDI_RDREG_MARK 0x7c23 / marker placed in DATA for RDREG / + +/ Behavioural presence probe: two distinct 16-bit latches on ADDR/DATA. / +#define MXL862XX_SB_PDI_PROBE_A 0x5a5a +#define MXL862XX_SB_PDI_PROBE_D 0xa5a5 + +/ Image verification verdict published in STAT once the receive loop ends / +#define MXL862XX_SB_PDI_VERIFY_OK 0 +#define MXL862XX_SB_PDI_VERIFY_BAD 1 + +/ Firmware transfer geometry / +#define MXL862XX_FW_HDR_SIZE 20 +#define MXL862XX_FW_BANK_HALF 16384 / words per half-bank / +#define MXL862XX_FW_BANK_SLICE 32760 / words per full slice / +#define MXL862XX_FW_SB1_ADDR 0x7800 / SB1 word address / + +/ Timeouts (generous upper bounds) / +#define MXL862XX_FW_READY_TIMEOUT_MS 3000 +#define MXL862XX_FW_ACK_TIMEOUT_MS 5000 +#define MXL862XX_FW_ERASE_TIMEOUT_MS 300000 +#define MXL862XX_FW_WRITE_TIMEOUT_MS 120000 +#define MXL862XX_FW_REBOOT_DELAY_MS 5000 +#define MXL862XX_FW_REPROBE_DELAY_MS 500 +#define MXL862XX_RESCUE_READY_TIMEOUT_MS 1000 +#define MXL862XX_DRAIN_POLL_MS 2000 +/ Covers the loader's END wait, verification and the reset into READY / +#define MXL862XX_DRAIN_DONE_MS 15000 + +static int mxl862xx_sb_pdi_reset(struct mxl862xx_priv priv) +{ + int ret; + + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_RST); + if (ret < 0) + return ret; + + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR, + MXL862XX_SB_PDI_CTRL_RST); + if (ret < 0) + return ret; + + return mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, + MXL862XX_SB_PDI_CTRL_RST); +} + +static int mxl862xx_sb_pdi_poll_stat(struct mxl862xx_priv priv, u16 expected, + unsigned long timeout_ms) +{ + int ret, val; + + ret = read_poll_timeout(mxl862xx_smdio_read, val, + val < 0 \|\| (u16)val == expected, + 10000, timeout_ms 1000, false, + priv, MXL862XX_SB_PDI_STAT); + if (val < 0) + return val; + return ret; +} + +static int mxl862xx_sb_pdi_flush_slice(struct mxl862xx_priv priv, + u32 data_written) +{ + int ret; + + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + return ret; + + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written); + if (ret < 0) + return ret; + + return mxl862xx_sb_pdi_poll_stat(priv, 0, + MXL862XX_FW_WRITE_TIMEOUT_MS); +} + +/ Flush the last slice, which ends the receive loop: the loader verifies the + * image and replaces the count in STAT with its verdict, so wait for the count + * to go rather than for a fixed value. + / +static int mxl862xx_sb_pdi_flush_last(struct mxl862xx_priv priv, + u32 data_written) +{ + int ret, val; + + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + return ret; + + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written); + if (ret < 0) + return ret; + + ret = read_poll_timeout(mxl862xx_smdio_read, val, + val < 0 \|\| (u16)val != (u16)data_written, + 10000, MXL862XX_FW_WRITE_TIMEOUT_MS * 1000, + false, priv, MXL862XX_SB_PDI_STAT); + if (val < 0) + return val; + + if (!ret && (u16)val == MXL862XX_SB_PDI_VERIFY_OK) + return 0; + + /* A final count of 1 is indistinguishable from the reject verdict, so + * a timeout still holding it lands here too. + / + if ((u16)val == MXL862XX_SB_PDI_VERIFY_BAD) { + dev_err(&priv->mdiodev->dev, + "flash: loader rejected the image\n"); + return -EBADMSG; + } + + return ret ? ret : -EPROTO; +} + +static void mxl862xx_flash_notify(struct devlink dl, const char status, + u32 done, u32 total) +{ + devlink_flash_update_status_notify(dl, status, NULL, done, total); +} + +/ Post-flash reprobe. device_reprobe() detaches the driver -- running + * remove(), which frees priv -- then re-probes, so this work touches only its + * own device and module references and frees itself. A re-probe failure leaves + * the device unbound, exactly as a failed initial probe would, so it is only + * logged. Running from a workqueue keeps device_reprobe() out of the devlink + * caller's locking and signal context. + / +struct mxl862xx_reprobe { + struct delayed_work work; + struct device dev; +}; + +static void mxl862xx_reprobe_work_fn(struct work_struct work) +{ + struct mxl862xx_reprobe rp = + container_of(work, struct mxl862xx_reprobe, work.work); + struct device dev = rp->dev; + + if (device_reprobe(dev)) + dev_err(dev, "reprobe failed; device left unbound\n"); + put_device(dev); + kfree(rp); + module_put(THIS_MODULE); +} + +/ Allocate the reprobe up front, before the switch is disturbed, so an + * allocation failure aborts cleanly. The caller holds a module and a device + * reference; the work releases both once it runs. Returns NULL on -ENOMEM. + / +static struct mxl862xx_reprobe mxl862xx_reprobe_alloc(struct device dev) +{ + struct mxl862xx_reprobe rp; + + rp = kzalloc_obj(rp); + if (!rp) + return NULL; + rp->dev = dev; + INIT_DELAYED_WORK(&rp->work, mxl862xx_reprobe_work_fn); + return rp; +} + +/ Byte-count of each chunk fed to the loader during drain. It MUST be 1: the + * loader only lets us observe "counter == 0", never "counter < step", so any + * step > 1 can subtract past zero, underflow the 32-bit counter and wedge the + * loader for ~2^32 more bytes (a state only a power cycle clears). Stepping by + * 1 walks the counter through every value and is guaranteed to land on zero + * whatever its (possibly odd) start. A 1-byte chunk is a path the loader + * already handles: the normal transfer ends with a single trailing byte for + * odd-sized images (see Step 6). + / +#define MXL862XX_DRAIN_CHUNK_BYTES 1 + +/ Log the drain's progress every so many bytes; it can run for a long time / +#define MXL862XX_DRAIN_LOG_BYTES (128 1024) + +/* Wait for the loader to ask for the next chunk (STAT 0) or to come back to its + * command loop (STAT READY), and return the STAT value either way. On timeout + * that is whatever STAT still holds, which carries no further information: the + * loader keeps the count we wrote visible while it programs the chunk, and that + * is the same value it publishes as the "image rejected" verdict once the + * counter reaches zero. + / +static int mxl862xx_sb_pdi_poll_drain(struct mxl862xx_priv priv, + unsigned long timeout_ms) +{ + int val; + + read_poll_timeout(mxl862xx_smdio_read, val, + val < 0 \|\| (u16)val == MXL862XX_SB_PDI_READY \|\| + (u16)val == 0, + 50, timeout_ms * 1000, false, + priv, MXL862XX_SB_PDI_STAT); + if (val < 0) + return val; + return (u16)val; +} + +/* The loader is not asking for a chunk: it may still be programming the last + * one, or the counter has reached zero and it is verifying the image and + * resetting into READY. Wait that out -- STAT cannot tell the two apart, and + * guessing would mean writing END into a live receive loop. Returns 0 once the + * loader has left the loop, -EAGAIN if it asks for another chunk after all. + / +static int mxl862xx_rescue_drain_finish(struct mxl862xx_priv priv, u32 chunk) +{ + struct device dev = &priv->mdiodev->dev; + int stat; + + stat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_DONE_MS); + if (stat < 0) + return stat; + if (stat == MXL862XX_SB_PDI_READY) + return 0; + if (stat == MXL862XX_SB_PDI_VERIFY_BAD) { + dev_err(dev, + "flash: loader stuck after %u chunks, power cycle it\n", + chunk); + return -EIO; + } + if (stat) { + / A firmware is answering, not the loader: an image survived + * in flash and booted. + / + dev_info(dev, "flash: firmware booted while draining\n"); + return 0; + } + + return -EAGAIN; +} + +/ Recover a switch whose SB PDI download was interrupted mid-transfer - the + * host died after MCUboot began erasing flash, whether it aborted mid erase or + * mid image-write, both end up in the same place: the payload receive loop. + * There the loader publishes STAT=0, waits for the host to write a byte-count + * to STAT, DMAs that many bytes and subtracts the count from a remaining-bytes + * counter, leaving the loop only when the counter reaches exactly zero. The + * image size died with the host, so we feed single-byte chunks (see + * MXL862XX_DRAIN_CHUNK_BYTES) to walk the counter to zero without underflow. + * The loader then verifies the (now corrupt) image and returns to READY by + * itself, or boots a valid image that happened to survive in flash; either way + * the caller's reprobe classifies the result. Every byte costs about a dozen + * MDIO frames, so a multi-MiB outstanding count takes tens of minutes. + * Returns 0 once the loader has left the receive loop, <0 on error. Does NOT + * recover a counter already underflowed by an earlier oversized-chunk attempt + * - that needs a power cycle. + / +static int mxl862xx_rescue_drain(struct mxl862xx_priv priv) +{ + struct device dev = &priv->mdiodev->dev; + / Bound: twice the loader's 16 MiB image cap, one byte per chunk. / + u32 max_chunks = 2u (16u << 20) / MXL862XX_DRAIN_CHUNK_BYTES; + u32 chunk = 0; + int ret, stat; + + while (chunk < max_chunks) { + /* Teardown can interrupt this long drain. / + if (test_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags)) + return -ECANCELED; + + stat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_POLL_MS); + if (stat < 0) + return stat; + if (stat == MXL862XX_SB_PDI_READY) + return 0; + + if (stat) { + ret = mxl862xx_rescue_drain_finish(priv, chunk); + if (ret != -EAGAIN) + return ret; + } + + / Feed one zero byte; reset cleared the write latch. / + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_WR); + if (ret < 0) + return ret; + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000); + if (ret < 0) + return ret; + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + return ret; + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, + MXL862XX_DRAIN_CHUNK_BYTES); + if (ret < 0) + return ret; + chunk++; + if (!(chunk % MXL862XX_DRAIN_LOG_BYTES)) + dev_info(dev, "flash: drained %u KiB so far\n", + chunk / 1024); + cond_resched(); + } + + dev_err(dev, + "flash: interrupted download did not drain after %u chunks\n", + chunk); + + return -ETIMEDOUT; +} + +/ Background self-heal: drain a wedged download off the devlink flash path, so + * the long recovery never holds the devlink lock. Scheduled from probe; + * reprobes on success so the probe-time detection re-classifies the switch. + / +void mxl862xx_rescue_heal_work_fn(struct work_struct work) +{ + struct mxl862xx_priv priv = + container_of(work, struct mxl862xx_priv, rescue_heal_work); + struct device dev = &priv->mdiodev->dev; + struct mxl862xx_reprobe ko; + int ret; + + ret = mxl862xx_rescue_drain(priv); + if (ret == -ECANCELED) + return; + if (ret) { + / Nothing retries this, so say so: rescue_ready stays clear + * and devlink dev flash reports why it refuses. + / + dev_err(dev, "flash: download recovery failed: %pe\n", + ERR_PTR(ret)); + WRITE_ONCE(priv->rescue_failed, true); + return; + } + + / The interrupted transfer is finalised; reprobe so the probe-time + * detection brings the driver up -- flashable in rescue mode if the + * loader is at READY, or normally if a valid image booted. The refs + * are released by the reprobe once it completes. heal_lock makes the + * flag test and the queueing atomic against teardown, which cannot + * cancel a work item this one has already queued. + / + mutex_lock(&priv->heal_lock); + if (test_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags)) + goto out; + if (!try_module_get(THIS_MODULE)) + goto out; + get_device(dev); + ko = mxl862xx_reprobe_alloc(dev); + if (!ko) { + put_device(dev); + module_put(THIS_MODULE); + goto out; + } + queue_delayed_work(system_long_wq, &ko->work, + msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS)); +out: + mutex_unlock(&priv->heal_lock); +} + +/ Detect MCUboot rescue mode over clause-22 SMDIO alone, so the caller can rule + * the loader out before any C45 API request (which spews CRC errors when no WSP + * firmware answers). A scratch write to ADDR/DATA must latch or the chip is + * absent (-ENODEV); the mailbox is reset first, or a transfer interrupted with + * CTRL=WR would take that write as a payload word instead of latching it. STAT + * then classifies the state, poked destructively only when 0, the one value a + * running firmware never holds: + * + * - 0xc33c: flashless loop; recognised but not supported here. + * - 0xc55c: console loop, if the register-read challenge is serviced. + * - other non-zero: running firmware, left unpoked. + * - 0: wedged receive loop; the 1-byte slice-advance then says whether it + * still needs draining or has just finished. + * + * Return: MXL862XX_IN_RESCUE, MXL862XX_NOT_RESCUE, -ENODEV when nothing + * answers, -EOPNOTSUPP for the flashless loop, -ENXIO for a READY loader whose + * mailbox fails the challenge, or an SMDIO bus error. + / +int mxl862xx_rescue_mode_detect(struct mxl862xx_priv priv) +{ + int stat, dat, ret, rb, a, d; + + /* rescue_ready gates flashing; a wedged loader needs the drain first. / + WRITE_ONCE(priv->rescue_ready, false); + + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + return ret; + + / Presence: a live chip latches the scratch write, an absent one floats. / + a = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR, + MXL862XX_SB_PDI_PROBE_A); + if (a < 0) + return a; + d = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, + MXL862XX_SB_PDI_PROBE_D); + if (d < 0) + return d; + a = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_ADDR); + if (a < 0) + return a; + d = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA); + if (d < 0) + return d; + if ((u16)a != MXL862XX_SB_PDI_PROBE_A \|\| + (u16)d != MXL862XX_SB_PDI_PROBE_D) + return -ENODEV; + + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + return ret; + + stat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT); + if (stat < 0) + return stat; + + / Flashless-download loop (MxL86281S tier): this driver does not + * support it -- the console flash path expects READY. Treat it as an + * unusable configuration, like any other unsupported state. + / + if ((u16)stat == MXL862XX_SB_PDI_DL_READY) + return -EOPNOTSUPP; + + / Console loop at READY: confirm the live mailbox with the register-read + * challenge (consumes the marker from DATA and re-arms READY). + / + if ((u16)stat == MXL862XX_SB_PDI_READY) { + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, + MXL862XX_SB_PDI_RDREG_MARK); + if (ret < 0) + return ret; + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, + MXL862XX_SB_PDI_RDREG); + if (ret < 0) + return ret; + rb = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY, + MXL862XX_RESCUE_READY_TIMEOUT_MS); + dat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA); + ret = mxl862xx_sb_pdi_reset(priv); + if (rb < 0) + return rb; + if (dat < 0) + return dat; + if (ret < 0) + return ret; + if (!rb && (u16)dat != MXL862XX_SB_PDI_RDREG_MARK) { + WRITE_ONCE(priv->rescue_ready, true); + return MXL862XX_IN_RESCUE; + } + return -ENXIO; + } + + / Any other non-zero value is a running firmware, not a loader. / + if (stat) + return MXL862XX_NOT_RESCUE; + + / STAT == 0: a wedged receive loop takes a 1-byte slice-advance (feed + * one DATA word first, like a drain chunk) and asks for the next chunk + * by publishing 0 again. Had that byte been the last one outstanding, + * the loader leaves the loop instead and returns to READY, having + * consumed the advance -- proof enough of a live mailbox to skip the + * challenge. Anything else means it is still working on it. All three + * are rescue, so this never fails probe; only the drain does. + / + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_WR); + if (ret < 0) + return ret; + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000); + if (ret < 0) + return ret; + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + return ret; + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, + MXL862XX_DRAIN_CHUNK_BYTES); + if (ret < 0) + return ret; + + rb = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_RESCUE_READY_TIMEOUT_MS); + if (rb < 0) + return rb; + if (rb == MXL862XX_SB_PDI_READY) + WRITE_ONCE(priv->rescue_ready, true); + + return MXL862XX_IN_RESCUE; +} + +/ MCUboot firmware image header / +struct mxl862xx_fw_hdr { + __le32 image_type; + __le32 image_size_1; + __le32 image_checksum_1; + __le32 image_size_2; + __le32 image_checksum_2; +} __packed; + +static int mxl862xx_flash_validate(struct mxl862xx_priv priv, + const struct firmware fw, + u32 payload_size) +{ + const struct mxl862xx_fw_hdr hdr; + u32 size1, size2, total; + const u8 payload; + u32 crc; + + if (fw->size < MXL862XX_FW_HDR_SIZE) + return -EINVAL; + + hdr = (const struct mxl862xx_fw_hdr )fw->data; + payload = fw->data + MXL862XX_FW_HDR_SIZE; + size1 = le32_to_cpu(hdr->image_size_1); + size2 = le32_to_cpu(hdr->image_size_2); + + if (check_add_overflow(size1, size2, &total) \|\| + total > fw->size - MXL862XX_FW_HDR_SIZE) { + dev_err(&priv->mdiodev->dev, + "flash: firmware file too small for declared size\n"); + return -EINVAL; + } + + if (!total) { + dev_err(&priv->mdiodev->dev, + "flash: firmware file with empty payload\n"); + return -EINVAL; + } + + if (size1) { + crc = ~crc32_le(~0U, payload, size1); + if (crc != le32_to_cpu(hdr->image_checksum_1)) { + dev_err(&priv->mdiodev->dev, + "flash: image 1 CRC mismatch (got %08x, expected %08x)\n", + crc, le32_to_cpu(hdr->image_checksum_1)); + return -EINVAL; + } + } + + if (size2) { + crc = ~crc32_le(~0U, payload + size1, size2); + if (crc != le32_to_cpu(hdr->image_checksum_2)) { + dev_err(&priv->mdiodev->dev, + "flash: image 2 CRC mismatch (got %08x, expected %08x)\n", + crc, le32_to_cpu(hdr->image_checksum_2)); + return -EINVAL; + } + } + + payload_size = total; + + return 0; +} + +static int mxl862xx_flash_firmware(struct mxl862xx_priv priv, + const struct firmware fw, + u32 payload_size, struct devlink dl) +{ + const u8 payload = fw->data + MXL862XX_FW_HDR_SIZE; + u32 word_idx = 0, data_written = 0, idx = 0; + unsigned long next_notify = jiffies - 1; + u16 word, fdata; + int ret, i; + + /* Step 1: reboot the firmware into MCUboot rescue mode / + if (!priv->rescue_mode) { + ret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0, + false, false); + if (ret) { + dev_err(&priv->mdiodev->dev, + "flash: FW_UPDATE command failed: %pe\n", + ERR_PTR(ret)); + return ret; + } + } + + / Step 2: wait for bootloader ready / + mxl862xx_flash_notify(dl, "Waiting for bootloader", 0, 0); + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + goto write_err; + + / Failures from here on end up at no_end, which returns the error + * without signalling END -- see there. + / + ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY, + MXL862XX_FW_READY_TIMEOUT_MS); + if (ret) { + dev_err(&priv->mdiodev->dev, + "flash: bootloader not ready: %pe\n", ERR_PTR(ret)); + goto no_end; + } + + / Step 3: start handshake / + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, + MXL862XX_SB_PDI_START); + if (ret < 0) + goto write_err; + + ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_START + 1, + MXL862XX_FW_ACK_TIMEOUT_MS); + if (ret) { + dev_err(&priv->mdiodev->dev, + "flash: start handshake failed: %pe\n", ERR_PTR(ret)); + goto no_end; + } + + / Step 4: transfer image header / + mxl862xx_flash_notify(dl, "Erasing flash", 0, 0); + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_WR); + if (ret < 0) + goto write_err; + + for (i = 0; i < MXL862XX_FW_HDR_SIZE / 2; i++) { + word = fw->data[i 2] \| + ((u16)fw->data[i * 2 + 1] << 8); + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, word); + if (ret < 0) + goto write_err; + } + + ret = mxl862xx_sb_pdi_reset(priv); + if (ret < 0) + goto write_err; + + /* the byte count in STAT triggers the erase / + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, + MXL862XX_FW_HDR_SIZE); + if (ret < 0) + goto write_err; + + / ACK is byte count + 1 / + ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_FW_HDR_SIZE + 1, + MXL862XX_FW_ACK_TIMEOUT_MS); + if (ret) { + dev_err(&priv->mdiodev->dev, + "flash: header ACK failed: %pe\n", ERR_PTR(ret)); + goto no_end; + } + + / Step 5: wait for erase to complete / + ret = mxl862xx_sb_pdi_poll_stat(priv, 0, + MXL862XX_FW_ERASE_TIMEOUT_MS); + if (ret) { + dev_err(&priv->mdiodev->dev, + "flash: erase timeout: %pe\n", ERR_PTR(ret)); + goto no_end; + } + + / Step 6: transfer payload / + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_WR); + if (ret < 0) + goto write_err; + + while (idx < payload_size) { + cond_resched(); + if (idx + 1 < payload_size) { + fdata = payload[idx] \| + ((u16)payload[idx + 1] << 8); + idx += 2; + data_written += 2; + } else { + fdata = payload[idx]; + idx++; + data_written++; + } + + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, fdata); + if (ret < 0) + goto write_err; + word_idx++; + + if (idx >= payload_size) { + ret = mxl862xx_sb_pdi_flush_last(priv, data_written); + break; + } + + / Half-bank boundary: switch to SB1 address / + if (word_idx == MXL862XX_FW_BANK_HALF) { + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_RST); + if (ret < 0) + goto write_err; + + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR, + MXL862XX_FW_SB1_ADDR); + if (ret < 0) + goto write_err; + + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_WR); + if (ret < 0) + goto write_err; + } else if (word_idx >= MXL862XX_FW_BANK_SLICE) { + ret = mxl862xx_sb_pdi_flush_slice(priv, data_written); + if (ret) { + dev_err(&priv->mdiodev->dev, + "flash: write timeout at %u/%u: %pe\n", + idx, payload_size, ERR_PTR(ret)); + goto no_end; + } + word_idx = 0; + data_written = 0; + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL, + MXL862XX_SB_PDI_CTRL_WR); + if (ret < 0) + goto write_err; + + if (time_after(jiffies, next_notify)) { + mxl862xx_flash_notify(dl, "Flashing", idx, + payload_size); + next_notify = jiffies + msecs_to_jiffies(500); + } + } + } + + if (ret) { + dev_err(&priv->mdiodev->dev, + "flash: final slice failed: %pe\n", ERR_PTR(ret)); + goto no_end; + } + + mxl862xx_flash_notify(dl, "Flashing", payload_size, payload_size); + + / Success: the loader has left the receive loop at r_remain == 0 and + * verified the image, so END(0x3cc3) is a finalise/boot request rather + * than a byte count. Signal it here -- and only here -- to boot the new + * image without waiting out the loader's 2 s END timeout. + / + ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, + MXL862XX_SB_PDI_END); + msleep(MXL862XX_FW_REBOOT_DELAY_MS); + return ret; + +write_err: + dev_err(&priv->mdiodev->dev, "flash: SMDIO write failed: %pe\n", + ERR_PTR(ret)); +no_end: + / A failure leaves the loader mid transfer; do not signal END (a STAT + * write is a byte count then, and END would be misread as one, risking + * a receive-counter underflow). Return the error; the caller reprobes. + / + return ret; +} + +int mxl862xx_devlink_info_get(struct dsa_switch ds, + struct devlink_info_req req, + struct netlink_ext_ack extack) +{ + struct mxl862xx_priv priv = ds->priv; + char buf[16]; + int ret; + + / No chip-id/revision in MCUboot (needs the firmware MMD mailbox). The + * fw version doubles as the "ready to flash" signal: report it only + * once the loader is at a clean READY, nothing while still draining. + / + if (priv->rescue_mode) { + if (!READ_ONCE(priv->rescue_ready)) + return 0; + + snprintf(buf, sizeof(buf), "%u.%u.%u", + priv->fw_version.major, priv->fw_version.minor, + priv->fw_version.revision); + ret = devlink_info_version_running_put(req, + DEVLINK_INFO_VERSION_GENERIC_FW, buf); + if (ret) + return ret; + return devlink_info_version_stored_put(req, + DEVLINK_INFO_VERSION_GENERIC_FW, buf); + } + + / A 0 part number means the CHIP ID read failed or the part is + * unfused; omit it rather than publish a bogus "0000" that fwupd + * would match firmware against -- it then falls back to the driver + * name. + / + if (priv->asic_id) { + snprintf(buf, sizeof(buf), "%04X", priv->asic_id); + ret = devlink_info_version_fixed_put(req, + DEVLINK_INFO_VERSION_GENERIC_ASIC_ID, + buf); + if (ret) + return ret; + + snprintf(buf, sizeof(buf), "%u", priv->asic_rev); + ret = devlink_info_version_fixed_put(req, + DEVLINK_INFO_VERSION_GENERIC_ASIC_REV, + buf); + if (ret) + return ret; + } + + / An all-zero version is the cache a failed flash left behind, not a + * released firmware; omit it like the part number above. + / + if (!priv->fw_version.major && !priv->fw_version.minor && + !priv->fw_version.revision) + return 0; + + snprintf(buf, sizeof(buf), "%u.%u.%u", + priv->fw_version.major, priv->fw_version.minor, + priv->fw_version.revision); + + ret = devlink_info_version_running_put(req, + DEVLINK_INFO_VERSION_GENERIC_FW, buf); + if (ret) + return ret; + + / boots this image from its own flash: stored == running / + return devlink_info_version_stored_put(req, + DEVLINK_INFO_VERSION_GENERIC_FW, buf); +} + +int mxl862xx_devlink_flash_update(struct dsa_switch ds, + struct devlink_flash_update_params params, + struct netlink_ext_ack extack) +{ + struct mxl862xx_reprobe ko; + struct mxl862xx_priv priv = ds->priv; + struct dsa_port dp; + u32 payload_size; + int ret, i; + + if (params->component) { + NL_SET_ERR_MSG_MOD(extack, "component is not supported"); + return -EOPNOTSUPP; + } + + / A previous flash is still waiting for its reprobe: the firmware API + * is short-circuited, so the raw SB PDI writes below would run against + * a switch this driver no longer tracks. + / + if (priv->skip_teardown) { + NL_SET_ERR_MSG_MOD(extack, + "device is reinitializing, retry later"); + return -EBUSY; + } + + ret = mxl862xx_flash_validate(priv, params->fw, &payload_size); + if (ret) { + NL_SET_ERR_MSG_MOD(extack, "firmware image validation failed"); + return ret; + } + + / Refuse to flash while the background self-heal is still draining, and + * for good once it has given up on the loader. + / + if (READ_ONCE(priv->rescue_failed)) { + NL_SET_ERR_MSG_MOD(extack, + "download recovery failed, power cycle the switch"); + return -EIO; + } + + if (priv->rescue_mode && !READ_ONCE(priv->rescue_ready)) { + NL_SET_ERR_MSG_MOD(extack, + "switch is recovering an interrupted download, retry shortly"); + return -EBUSY; + } + + / The references the reprobe work needs to restore normal operation + * must be held before the switch is disturbed; the work itself is + * scheduled only once the flash is done (see below). + / + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + get_device(ds->dev); + + / Allocate the reprobe work before disturbing the switch, so an + * -ENOMEM here cannot strand it flashed but never reprobed. + / + ko = mxl862xx_reprobe_alloc(ds->dev); + if (!ko) { + put_device(ds->dev); + module_put(THIS_MODULE); + return -ENOMEM; + } + + if (priv->rescue_mode) + dev_info(ds->dev, + "flash: flashing switch via MCUboot rescue mode\n"); + else + dev_info(ds->dev, "flash: running firmware %u.%u.%u\n", + priv->fw_version.major, priv->fw_version.minor, + priv->fw_version.revision); + + / Close ports while the firmware is still alive so the DSA core's + * MDB/FDB tracking is drained, and detach user ports so userspace + * cannot reopen them during the flash. The conduit is only closed, + * not detached: it belongs to the MAC driver. This driver binds a + * single switch with a direct host link and no cascade ports, so the + * conduit serves only this switch, and flashing it reboots the switch, + * which takes the tree down regardless. + / + rtnl_lock(); + dsa_switch_for_each_user_port(dp, ds) { + if (dp->user) { + dev_close(dp->user); + netif_device_detach(dp->user); + } + } + dsa_switch_for_each_cpu_port(dp, ds) + dev_close(dp->conduit); + / The bridge defers the STP state changes triggered by closing + * the ports; let them reach the firmware while it is still alive. + / + switchdev_deferred_process(); + rtnl_unlock(); + + mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED); + priv->block_host = true; + mutex_unlock(&priv->mdiodev->bus->mdio_lock); + + mxl862xx_stop_work(priv); + cancel_delayed_work_sync(&priv->stats_work); + cancel_work_sync(&priv->crc_err_work); + for (i = 0; i < ds->num_ports; i++) + cancel_work_sync(&priv->ports[i].host_flood_work); + + ret = mxl862xx_flash_firmware(priv, params->fw, payload_size, + ds->devlink); + if (ret) + NL_SET_ERR_MSG_MOD(extack, "firmware transfer failed"); + + if (!ret) { + mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, + MDIO_MUTEX_NESTED); + priv->block_host = false; + priv->rescue_mode = false; + mutex_unlock(&priv->mdiodev->bus->mdio_lock); + + / Refresh the cached versions so the flash update only + * completes once the new firmware is confirmed running and + * devlink dev info reports it. Must happen before setting + * skip_teardown, which discards all firmware API reads. + / + ret = mxl862xx_wait_ready(ds); + if (ret) + NL_SET_ERR_MSG_MOD(extack, + "new firmware did not become ready"); + } + + if (ret) { + / The switch is in MCUboot with erased or partly written flash; + * drop the cached identity so devlink dev info stops reporting + * the pre-flash version until the reprobe re-reads the truth. + / + memset(&priv->fw_version, 0, sizeof(priv->fw_version)); + priv->asic_id = 0; + priv->asic_rev = 0; + } + + mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED); + priv->skip_teardown = true; + mutex_unlock(&priv->mdiodev->bus->mdio_lock); + + / Queue the reprobe last; the work was allocated up front and its + * module and device references are already held. + / + queue_delayed_work(system_long_wq, &ko->work, + msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS)); + + return ret; +} diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.h b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h new file mode 100644 index 0000000000000..7cd87c7ad8716 --- /dev/null +++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h @@ -0,0 +1,20 @@ +/ SPDX-License-Identifier: GPL-2.0-or-later / + +#ifndef __MXL862XX_FW_H +#define __MXL862XX_FW_H + +#include <net/dsa.h> + +struct mxl862xx_priv; +struct work_struct; + +int mxl862xx_rescue_mode_detect(struct mxl862xx_priv priv); +void mxl862xx_rescue_heal_work_fn(struct work_struct work); +int mxl862xx_devlink_info_get(struct dsa_switch ds, + struct devlink_info_req req, + struct netlink_ext_ack extack); +int mxl862xx_devlink_flash_update(struct dsa_switch ds, + struct devlink_flash_update_params params, + struct netlink_ext_ack extack); + +#endif / __MXL862XX_FW_H / diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.c b/drivers/net/dsa/mxl862xx/mxl862xx-host.c index 4acd216f7cc00..469ba1b2a2e18 100644 --- a/drivers/net/dsa/mxl862xx/mxl862xx-host.c +++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.c @@ -15,6 +15,8 @@ #include <linux/unaligned.h> #include <net/dsa.h> #include "mxl862xx.h" +#include "mxl862xx-cmd.h" +#include "mxl862xx-fw.h" #include "mxl862xx-host.h" #define CTRL_BUSY_MASK BIT(15) @@ -340,6 +342,21 @@ int mxl862xx_api_wrap(struct mxl862xx_priv priv, u16 cmd, void _data, mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED); + if (priv->skip_teardown) { + ret = read ? -ENODEV : 0; + goto out; + } + + if (priv->rescue_mode) { + ret = -ENODEV; + goto out; + } + + if (priv->block_host && cmd != SYS_MISC_FW_UPDATE) { + ret = -EBUSY; + goto out; + } + max = (size + 1) / 2; ret = mxl862xx_busy_wait(priv); @@ -495,12 +512,55 @@ int mxl862xx_reset(struct mxl862xx_priv priv) return ret; } +#define MXL862XX_SMDIO_ADDR_REG 0x1f +#define MXL862XX_SMDIO_PAGE_MASK 0xfff0 +#define MXL862XX_SMDIO_OFF_MASK 0x000f + +/* Paged clause-22 window: the page goes into MII register 0x1f, the low nibble + * of addr selects one of the 16 registers within it. Both helpers take the MDIO + * bus lock per transaction, so callers must not already hold it -- unlike + * mxl862xx_api_wrap(), which holds it across a whole firmware command. + / +int mxl862xx_smdio_read(struct mxl862xx_priv priv, u32 addr) +{ + struct mii_bus bus = priv->mdiodev->bus; + int phy = priv->mdiodev->addr; + int ret; + + mutex_lock(&bus->mdio_lock); + ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG, + addr & MXL862XX_SMDIO_PAGE_MASK); + if (ret >= 0) + ret = __mdiobus_read(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK); + mutex_unlock(&bus->mdio_lock); + return ret; +} + +int mxl862xx_smdio_write(struct mxl862xx_priv priv, u32 addr, u16 val) +{ + struct mii_bus bus = priv->mdiodev->bus; + int phy = priv->mdiodev->addr; + int ret; + + mutex_lock(&bus->mdio_lock); + ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG, + addr & MXL862XX_SMDIO_PAGE_MASK); + if (ret >= 0) + ret = __mdiobus_write(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK, + val); + mutex_unlock(&bus->mdio_lock); + return ret; +} + void mxl862xx_host_init(struct mxl862xx_priv priv) { + mutex_init(&priv->heal_lock); INIT_WORK(&priv->crc_err_work, mxl862xx_crc_err_work_fn); + INIT_WORK(&priv->rescue_heal_work, mxl862xx_rescue_heal_work_fn); } void mxl862xx_host_shutdown(struct mxl862xx_priv priv) { cancel_work_sync(&priv->crc_err_work); + cancel_work_sync(&priv->rescue_heal_work); } diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.h b/drivers/net/dsa/mxl862xx/mxl862xx-host.h index 66d6ae198aff4..4e054c6e4c0e4 100644 --- a/drivers/net/dsa/mxl862xx/mxl862xx-host.h +++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.h @@ -18,5 +18,7 @@ int mxl862xx_api_wrap(struct mxl862xx_priv priv, u16 cmd, void data, u16 size, mxl862xx_api_wrap(dev, cmd, &(data), sizeof((data)), true, true) int mxl862xx_reset(struct mxl862xx_priv priv); +int mxl862xx_smdio_read(struct mxl862xx_priv priv, u32 addr); +int mxl862xx_smdio_write(struct mxl862xx_priv priv, u32 addr, u16 val); #endif /* __MXL862XX_HOST_H / diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c index b689652aa9b92..a5b6940b552e9 100644 --- a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c +++ b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c @@ -406,6 +406,8 @@ mxl862xx_phylink_mac_select_pcs(struct phylink_config config, switch (port) { case 9 ... 16: + if (priv->rescue_mode) + return NULL; if (!MXL862XX_FW_VER_MIN(priv, 1, 0, 84)) { dev_warn_once(dp->ds->dev, "SerDes PCS unsupported on old firmware.\n"); diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c index 45d237b3a40f1..300eb19a344e5 100644 --- a/drivers/net/dsa/mxl862xx/mxl862xx.c +++ b/drivers/net/dsa/mxl862xx/mxl862xx.c @@ -21,6 +21,7 @@ #include "mxl862xx.h" #include "mxl862xx-api.h" #include "mxl862xx-cmd.h" +#include "mxl862xx-fw.h" #include "mxl862xx-host.h" #include "mxl862xx-phylink.h" @@ -71,6 +72,13 @@ static const struct ethtool_rmon_hist_range mxl862xx_rmon_ranges[] = { #define MXL862XX_READY_TIMEOUT_MS 10000 #define MXL862XX_READY_POLL_MS 100 +/* Chip ID registers, read via SYS_MISC_REG_RD / +#define MXL862XX_CHIPID_L 0xc0d28884 +#define MXL862XX_CHIPID_M 0xc0d28888 +#define MXL862XX_CHIPID_L_PNUML GENMASK(15, 12) +#define MXL862XX_CHIPID_M_PNUMM GENMASK(11, 0) +#define MXL862XX_CHIPID_M_VERSION GENMASK(14, 12) + #define MXL862XX_TCM_INST_SEL 0xe00 #define MXL862XX_TCM_CBS 0xe12 #define MXL862XX_TCM_EBS 0xe13 @@ -222,7 +230,46 @@ static int mxl862xx_phy_write_c45_mii_bus(struct mii_bus bus, int addr, return mxl862xx_phy_write_mmd(bus->priv, addr, devadd, regnum, val); } -static int mxl862xx_wait_ready(struct dsa_switch ds) +/ Read the static chip part number and version from the CHIP ID + * registers. Only possible with a running firmware, so the values are + * cached at setup and left zero when the switch is in rescue mode. + / +static int mxl862xx_read_chip_id(struct mxl862xx_priv priv) +{ + struct mxl862xx_sys_reg_rw reg = {}; + u16 chipid_l, chipid_m; + int ret; + + reg.addr = cpu_to_le32(MXL862XX_CHIPID_L); + ret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg); + if (ret) + return ret; + chipid_l = le32_to_cpu(reg.val); + + reg.addr = cpu_to_le32(MXL862XX_CHIPID_M); + ret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg); + if (ret) + return ret; + chipid_m = le32_to_cpu(reg.val); + + priv->asic_id = FIELD_GET(MXL862XX_CHIPID_L_PNUML, chipid_l) \| + FIELD_GET(MXL862XX_CHIPID_M_PNUMM, chipid_m) << 4; + priv->asic_rev = FIELD_GET(MXL862XX_CHIPID_M_VERSION, chipid_m); + + return 0; +} + +/** + * mxl862xx_wait_ready - wait for the switch firmware to become operational + * @ds: DSA switch instance + * + * Poll the firmware until it reports its version and accepts + * configuration commands, then cache the firmware version and chip ID. + * Takes at least two seconds. + * + * Return: 0 on success or a negative error code. + / +int mxl862xx_wait_ready(struct dsa_switch ds) { struct mxl862xx_sys_fw_image_version ver = {}; unsigned long start = jiffies, timeout; @@ -254,6 +301,11 @@ static int mxl862xx_wait_ready(struct dsa_switch ds) priv->fw_version.major = ver.iv_major; priv->fw_version.minor = ver.iv_minor; priv->fw_version.revision = le16_to_cpu(ver.iv_revision); + + ret = mxl862xx_read_chip_id(priv); + if (ret) + dev_warn(ds->dev, "failed to read chip ID: %pe\n", + ERR_PTR(ret)); return 0; not_ready_yet: @@ -622,21 +674,66 @@ static int mxl862xx_setup(struct dsa_switch ds) int n_user_ports = 0, max_vlans; int ingress_finals, vid_rules; struct dsa_port dp; - int ret, i; - - ret = mxl862xx_reset(priv); - if (ret) - return ret; - - ret = mxl862xx_wait_ready(ds); - if (ret) - return ret; + int ret, i, rescue; + / The SerDes state is software-only and must exist before anything can + * reach phylink, including a rescue-mode flash clearing rescue_mode + * ahead of the reprobe. + / mutex_init(&priv->serdes_lock); for (i = 0; i < ARRAY_SIZE(priv->serdes_ports); i++) mxl862xx_setup_pcs(priv, &priv->serdes_ports[i], i + MXL862XX_FIRST_SERDES_PORT); + / Detect the loader over SB PDI first: it needs no firmware, unlike the + * C45 API (mxl862xx_reset/wait_ready) which spews CRC errors when none + * answers. Touch C45 only once rescue is ruled out. + / + rescue = mxl862xx_rescue_mode_detect(priv); + if (rescue < 0) { + dev_err(ds->dev, "switch state detection failed: %pe\n", + ERR_PTR(rescue)); + return rescue; + } + + if (rescue == MXL862XX_NOT_RESCUE) { + ret = mxl862xx_reset(priv); + if (ret) + return ret; + + ret = mxl862xx_wait_ready(ds); + if (ret) { + / the reset may only now have triggered rescue mode / + rescue = mxl862xx_rescue_mode_detect(priv); + if (rescue < 0) { + dev_err(ds->dev, + "switch not responding after reset: %pe\n", + ERR_PTR(rescue)); + return rescue; + } + if (rescue == MXL862XX_NOT_RESCUE) + return ret; + } + } + + priv->rescue_mode = rescue; + + if (priv->rescue_mode) { + if (priv->rescue_ready) { + dev_warn(ds->dev, + "switch in MCUboot rescue mode, use devlink to flash new firmware\n"); + } else { + / Drain the wedged download in the background so it + * never holds the devlink lock; info and flash become + * available once ready. + / + dev_warn(ds->dev, + "switch in MCUboot with an interrupted download, recovering in background\n"); + queue_work(system_long_wq, &priv->rescue_heal_work); + } + return 0; + } + / Calculate Extended VLAN block sizes. * With VLAN Filter handling VID membership checks: * Ingress: only final catchall rules (PVID insertion, 802.1Q @@ -715,11 +812,21 @@ static int mxl862xx_port_state(struct dsa_switch ds, int port, bool enable) static int mxl862xx_port_enable(struct dsa_switch ds, int port, struct phy_device phydev) { + struct mxl862xx_priv priv = ds->priv; + + if (priv->rescue_mode) + return 0; + return mxl862xx_port_state(ds, port, true); } static void mxl862xx_port_disable(struct dsa_switch ds, int port) { + struct mxl862xx_priv priv = ds->priv; + + if (priv->rescue_mode) + return; + if (mxl862xx_port_state(ds, port, false)) dev_err(ds->dev, "failed to disable port %d\n", port); } @@ -1337,6 +1444,17 @@ static int mxl862xx_port_setup(struct dsa_switch ds, int port) bool is_cpu_port = dsa_port_is_cpu(dp); int ret; + if (dsa_port_is_dsa(dp)) { + dev_err(ds->dev, "port %d: DSA links not supported\n", port); + return -EOPNOTSUPP; + } + + / DSA reinits failed user ports as unused; shared ports must + * succeed for the tree to register. + / + if (priv->rescue_mode) + return dsa_port_is_user(dp) ? -ENODEV : 0; + ret = mxl862xx_port_state(ds, port, false); if (ret) return ret; @@ -1346,11 +1464,6 @@ static int mxl862xx_port_setup(struct dsa_switch ds, int port) if (dsa_port_is_unused(dp)) return 0; - if (dsa_port_is_dsa(dp)) { - dev_err(ds->dev, "port %d: DSA links not supported\n", port); - return -EOPNOTSUPP; - } - ret = mxl862xx_configure_sp_tag_proto(ds, port, is_cpu_port); if (ret) return ret; @@ -1572,6 +1685,12 @@ static int mxl862xx_port_mdb_del(struct dsa_switch ds, int port, ether_addr_copy(qparam.mac, mdb->addr); ret = MXL862XX_API_READ(priv, MXL862XX_MAC_TABLEENTRYQUERY, qparam); + / Post-flash teardown or MCUboot: the firmware and its MAC table are + * gone, so there is nothing left to delete. Outside those, -ENODEV is a + * bus error and must be reported. + / + if (ret == -ENODEV && (priv->skip_teardown \|\| priv->rescue_mode)) + return 0; if (ret) return ret; @@ -1628,6 +1747,9 @@ static void mxl862xx_port_stp_state_set(struct dsa_switch ds, int port, struct mxl862xx_priv priv = ds->priv; int ret; + if (priv->rescue_mode) + return; + switch (state) { case BR_STATE_DISABLED: param.port_state = cpu_to_le32(MXL862XX_STP_PORT_STATE_DISABLE); @@ -2015,6 +2137,12 @@ static void mxl862xx_stats_work_fn(struct work_struct work) struct dsa_switch ds = priv->ds; struct dsa_port dp; + /* A get_stats64() re-arm can race the flash teardown's WORK_STOPPED + * set and cancel; bail here so a stray poll never runs during a flash. + / + if (test_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags)) + return; + dsa_switch_for_each_available_port(dp, ds) mxl862xx_stats_poll(ds, dp->index); @@ -2086,6 +2214,8 @@ static const struct dsa_switch_ops mxl862xx_switch_ops = { .get_pause_stats = mxl862xx_get_pause_stats, .get_rmon_stats = mxl862xx_get_rmon_stats, .get_stats64 = mxl862xx_get_stats64, + .devlink_info_get = mxl862xx_devlink_info_get, + .devlink_flash_update = mxl862xx_devlink_flash_update, }; static int mxl862xx_probe(struct mdio_device mdiodev) @@ -2129,7 +2259,7 @@ static int mxl862xx_probe(struct mdio_device mdiodev) err = dsa_register_switch(ds); if (err) { - set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags); + mxl862xx_stop_work(priv); cancel_delayed_work_sync(&priv->stats_work); mxl862xx_host_shutdown(priv); for (i = 0; i < MXL862XX_MAX_PORTS; i++) @@ -2150,7 +2280,7 @@ static void mxl862xx_remove(struct mdio_device mdiodev) priv = ds->priv; - set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags); + mxl862xx_stop_work(priv); cancel_delayed_work_sync(&priv->stats_work); dsa_unregister_switch(ds); @@ -2179,7 +2309,7 @@ static void mxl862xx_shutdown(struct mdio_device mdiodev) dsa_switch_shutdown(ds); - set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags); + mxl862xx_stop_work(priv); cancel_delayed_work_sync(&priv->stats_work); mxl862xx_host_shutdown(priv); diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.h b/drivers/net/dsa/mxl862xx/mxl862xx.h index 432a5f3f2e08e..da45d24de7cf9 100644 --- a/drivers/net/dsa/mxl862xx/mxl862xx.h +++ b/drivers/net/dsa/mxl862xx/mxl862xx.h @@ -4,7 +4,9 @@ #define __MXL862XX_H #include <asm/byteorder.h> +#include <linux/bitops.h> #include <linux/mdio.h> +#include <linux/mutex.h> #include <linux/workqueue.h> #include <net/dsa.h> @@ -14,6 +16,10 @@ struct mxl862xx_priv; #define MXL862XX_FIRST_SERDES_PORT 9 #define MXL862XX_SERDES_SLOTS 4 +/ mxl862xx_rescue_mode_detect() return codes (negative values are errors) / +#define MXL862XX_NOT_RESCUE 0 +#define MXL862XX_IN_RESCUE 1 + #define MXL862XX_DEFAULT_BRIDGE 0 #define MXL862XX_MAX_BRIDGES 48 #define MXL862XX_MAX_BRIDGE_PORTS 128 @@ -303,6 +309,10 @@ struct mxl862xx_fw_version { flooding) * @fw_version: cached firmware version, populated at probe and * compared with MXL862XX_FW_VER_MIN() + * @asic_id: chip part number read from the CHIP ID registers, + * reported as the devlink "asic.id" fixed version + * @asic_rev: chip version read from the CHIP ID registers, + * reported as the devlink "asic.rev" fixed version * @serdes_ports: SerDes interfaces incl. sub-interfaces in case of * 10G_QXGMII or QSGMII * @serdes_refcount: per-XPCS count of sub-ports enabled by phylink; @@ -319,6 +329,22 @@ struct mxl862xx_fw_version { * @evlan_ingress_size: per-port ingress Extended VLAN block size * @evlan_egress_size: per-port egress Extended VLAN block size * @vf_block_size: per-port VLAN Filter block size + * @block_host: reject firmware API commands (except FW_UPDATE) + * during a firmware flash + * @skip_teardown: discard firmware API commands during the teardown + * triggered by the post-flash reprobe + * @rescue_mode: switch is in MCUboot; firmware API commands fail fast, + * only clause-22 SMDIO works. Set from setup() before the + * switch is registered and cleared under the MDIO bus lock + * for the benefit of mxl862xx_api_wrap(); other readers + * only need it to be a stable single flag. + * @rescue_ready: (rescue_mode) loader is at a clean READY and will accept + * a flash; false while rescue_heal_work is draining + * @rescue_failed: (rescue_mode) the self-heal gave up; the loader needs a + * power cycle and no flash can be accepted + * @rescue_heal_work: background self-heal draining a wedged download to READY + * @heal_lock: serialises the self-heal's reprobe hand-off against + * teardown setting %MXL862XX_FLAG_WORK_STOPPED * @stats_work: periodic work item that polls RMON hardware counters * and accumulates them into 64-bit per-port stats / @@ -326,9 +352,12 @@ struct mxl862xx_priv { struct dsa_switch ds; struct mdio_device mdiodev; struct work_struct crc_err_work; + struct work_struct rescue_heal_work; unsigned long flags; u16 drop_meter; struct mxl862xx_fw_version fw_version; + u16 asic_id; + u8 asic_rev; struct mxl862xx_pcs serdes_ports[8]; int serdes_refcount[2]; struct mutex serdes_lock; @@ -337,7 +366,26 @@ struct mxl862xx_priv { u16 evlan_ingress_size; u16 evlan_egress_size; u16 vf_block_size; + bool block_host; + bool skip_teardown; + bool rescue_mode; + bool rescue_ready; + bool rescue_failed; + struct mutex heal_lock; struct delayed_work stats_work; }; +/ Stop the background workers. The flag is set under heal_lock, which the + * rescue self-heal also holds across its own flag test and the queueing of its + * reprobe, so no reprobe can slip past a teardown that has begun. + / +static inline void mxl862xx_stop_work(struct mxl862xx_priv priv) +{ + mutex_lock(&priv->heal_lock); + set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags); + mutex_unlock(&priv->heal_lock); +} + +int mxl862xx_wait_ready(struct dsa_switch ds); + #endif / __MXL862XX_H / diff --git a/include/net/dsa.h b/include/net/dsa.h index 6f7f5c17b5320..58597b14e592a 100644 --- a/include/net/dsa.h +++ b/include/net/dsa.h @@ -1172,6 +1172,9 @@ struct dsa_switch_ops { int (devlink_info_get)(struct dsa_switch ds, struct devlink_info_req req, struct netlink_ext_ack extack); + int (devlink_flash_update)(struct dsa_switch ds, + struct devlink_flash_update_params params, + struct netlink_ext_ack extack); int (devlink_sb_pool_get)(struct dsa_switch ds, unsigned int sb_index, u16 pool_index, struct devlink_sb_pool_info pool_info); diff --git a/net/dsa/devlink.c b/net/dsa/devlink.c index ed342f345692b..25311a87cbc56 100644 --- a/net/dsa/devlink.c +++ b/net/dsa/devlink.c @@ -20,6 +20,18 @@ static int dsa_devlink_info_get(struct devlink dl, return -EOPNOTSUPP; } +static int dsa_devlink_flash_update(struct devlink dl, + struct devlink_flash_update_params params, + struct netlink_ext_ack extack) +{ + struct dsa_switch ds = dsa_devlink_to_ds(dl); + + if (!ds->ops->devlink_flash_update) + return -EOPNOTSUPP; + + return ds->ops->devlink_flash_update(ds, params, extack); +} + static int dsa_devlink_sb_pool_get(struct devlink dl, unsigned int sb_index, u16 pool_index, struct devlink_sb_pool_info pool_info) @@ -169,6 +181,7 @@ dsa_devlink_sb_occ_tc_port_bind_get(struct devlink_port dlp, static const struct devlink_ops dsa_devlink_ops = { .info_get = dsa_devlink_info_get, + .flash_update = dsa_devlink_flash_update, .sb_pool_get = dsa_devlink_sb_pool_get, .sb_pool_set = dsa_devlink_sb_pool_set, .sb_port_pool_get = dsa_devlink_sb_port_pool_get,
3/2	2026/08/03 04:46	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27986 output: 20 thoughts: 439 Thoughts: Analyzing the MxL862xx Driver Patch Series Okay, so I'm looking at this patch series adding firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. My initial reaction is, this seems straightforward enough. It introduces `mxl862xx-fw.c` which handles the firmware flashing and devlink information retrieval, and then modifies the main driver file, `mxl862xx.c`, to integrate these new functions into the switch operations. Plus, a small modification to `net/dsa/devlink.c` to enable `devlink_flash_update` within the DSA devlink ops. Standard stuff for this kind of feature addition. Now, my immediate concern is, can I test this easily? I need to think about how this would be reachable in a virtualized setup. The driver is for a DSA switch connected via MDIO, which isn't the most common thing to emulate. I need to figure out if I can even probe this in QEMU. MDIO devices usually require some kind of device tree entry or a scanning MDIO bus to discover them. But is there an emulated MxL862xx switch in QEMU? Almost certainly not. And can syzkaller handle MDIO? I know it can be creative but I don't think it emulates MDIO directly. It might be able to inject some device tree stuff, but that's a long shot. Wait, let me double-check something. The prompt... ah, there it is! The note about "vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU". That's useful context. This is an MDIO switch driver, not a PCIe one, so it doesn't quite fit the same criteria. Let me make sure it's vendor-specific, which is a good bet for something like this. Yep, MaxLinear MxL862xx. So, the next question is, can this be tested without specialized hardware? I need to start searching for `mxl862xx` within the kernel to try and find examples of how it's used and what it's dependent on.
4/2	2026/08/03 04:47	tool	grepper	0m Args: { "Expression": "mxl862xx" } Results: { "Output": "\nFull output is too long, showing 500 out of 2637 lines.\nUse more precise expression if possible.\n\nDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml-3----\nDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml:4:$id: http://devicetree.org/schemas/net/dsa/maxlinear,mxl862xx.yaml#\nDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml-5-$schema: http://devicetree.org/meta-schemas/core.yaml#\n--\nDocumentation/networking/devlink/index.rst=77=parameters, info versions, and other features it supports.\n--\nDocumentation/networking/devlink/index.rst-96- mv88e6xxx\nDocumentation/networking/devlink/index.rst:97: mxl862xx\nDocumentation/networking/devlink/index.rst-98- netdevsim\n--\nDocumentation/networking/devlink/mxl862xx.rst-3-========================\nDocumentation/networking/devlink/mxl862xx.rst:4:mxl862xx devlink support\nDocumentation/networking/devlink/mxl862xx.rst-5-========================\n--\nDocumentation/networking/devlink/mxl862xx.rst=7=This document describes the devlink features implemented by the\nDocumentation/networking/devlink/mxl862xx.rst:8:``mxl862xx`` device driver.\nDocumentation/networking/devlink/mxl862xx.rst-9-\nDocumentation/networking/devlink/mxl862xx.rst=10=Info versions\n--\nDocumentation/networking/devlink/mxl862xx.rst-12-\nDocumentation/networking/devlink/mxl862xx.rst:13:The ``mxl862xx`` driver reports the following versions\nDocumentation/networking/devlink/mxl862xx.rst-14-\n--\nDocumentation/networking/devlink/mxl862xx.rst=48=Flash update\n--\nDocumentation/networking/devlink/mxl862xx.rst-50-\nDocumentation/networking/devlink/mxl862xx.rst:51:The ``mxl862xx`` driver implements support for ``devlink dev flash``.\nDocumentation/networking/devlink/mxl862xx.rst-52-The signed firmware image is transferred to the switch over the same\n--\nMAINTAINERS=16108=S:\tMaintained\nMAINTAINERS:16109:F:\tDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml\nMAINTAINERS:16110:F:\tDocumentation/networking/devlink/mxl862xx.rst\nMAINTAINERS:16111:F:\tdrivers/net/dsa/mxl862xx/\nMAINTAINERS:16112:F:\tnet/dsa/tag_mxl862xx.c\nMAINTAINERS-16113-\n--\ndrivers/net/dsa/Kconfig=75=source \"drivers/net/dsa/mv88e6xxx/Kconfig\"\ndrivers/net/dsa/Kconfig-76-\ndrivers/net/dsa/Kconfig:77:source \"drivers/net/dsa/mxl862xx/Kconfig\"\ndrivers/net/dsa/Kconfig-78-\n--\ndrivers/net/dsa/Makefile=22=obj-y\t\t\t\t+= mv88e6xxx/\ndrivers/net/dsa/Makefile:23:obj-y\t\t\t\t+= mxl862xx/\ndrivers/net/dsa/Makefile-24-obj-y\t\t\t\t+= netc/\n--\ndrivers/net/dsa/mxl862xx/Makefile-1-# SPDX-License-Identifier: GPL-2.0\ndrivers/net/dsa/mxl862xx/Makefile:2:obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o\ndrivers/net/dsa/mxl862xx/Makefile:3:mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h=16=struct mdio_relay_data {\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-23-/*\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:24: struct mxl862xx_register_mod - Register access parameter to directly\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-25- * modify internal registers\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-31- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:32:struct mxl862xx_register_mod {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-33-\t__le16 addr;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-38-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:39: enum mxl862xx_mac_table_filter - Source/Destination MAC address filtering\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-40- \n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-45- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:46:enum mxl862xx_mac_table_filter {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-47-\tMXL862XX_MAC_FILTER_NONE = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-64-/*\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:65: struct mxl862xx_mac_table_add - MAC Table Entry to be added\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-66- * @fid: Filtering Identifier (FID) (not supported by all switches)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-74- * @mac: MAC Address to add to the table\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:75: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-76- * @igmp_controlled: Packet is marked as IGMP controlled if destination MAC\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-83- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:84:struct mxl862xx_mac_table_add {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-85-\t__le16 fid;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-100-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:101: struct mxl862xx_mac_table_remove - MAC Table Entry to be removed\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-102- * @fid: Filtering Identifier (FID)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-103- * @mac: MAC Address to be removed from the table.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:104: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-105- * @tci: TCI for B-Step\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-109- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:110:struct mxl862xx_mac_table_remove {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-111-\t__le16 fid;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-117-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:118: struct mxl862xx_mac_table_read - MAC Table Entry to be read\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-119- * @initial: Restart the get operation from the beginning of the table\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-128- * @mac: MAC Address. Filled out by the switch API implementation.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:129: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-130- * @igmp_controlled: Packet is marked as IGMP controlled if destination MAC\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-141- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:142:struct mxl862xx_mac_table_read {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-143-\tu8 initial;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-162-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:163: struct mxl862xx_mac_table_query - MAC Table Entry key-based lookup\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-164- * @mac: MAC Address to search for (input)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-172- * @static_entry: Indicates if this is a Static Entry\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:173: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter (input+output)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-174- * @igmp_controlled: IGMP controlled flag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-180- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:181:struct mxl862xx_mac_table_query {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-182-\tu8 mac[ETH_ALEN];\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-200-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:201: enum mxl862xx_mac_clear_type - MAC table clear type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-202- * @MXL862XX_MAC_CLEAR_PHY_PORT: clear dynamic entries based on port_id\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-204- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:205:enum mxl862xx_mac_clear_type {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-206-\tMXL862XX_MAC_CLEAR_PHY_PORT = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-210-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:211: struct mxl862xx_mac_table_clear - MAC table clear\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:212: * @type: see \u0026enum mxl862xx_mac_clear_type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-213- * @port_id: physical port id\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-214- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:215:struct mxl862xx_mac_table_clear {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-216-\tu8 type;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-220-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:221: enum mxl862xx_age_timer - Aging Timer Value.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-222- * @MXL862XX_AGETIMER_1_SEC: 1 second aging time\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-228- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:229:enum mxl862xx_age_timer {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-230-\tMXL862XX_AGETIMER_1_SEC = 1,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-238-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:239: struct mxl862xx_bridge_alloc - Bridge Allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-240- * @bridge_id: If the bridge allocation is successful, a valid ID will be\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-247- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:248:struct mxl862xx_bridge_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-249-\t__le16 bridge_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-252-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:253: enum mxl862xx_bridge_config_mask - Bridge configuration mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-254- * @MXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNING_LIMIT:\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-267- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:268:enum mxl862xx_bridge_config_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-269-\tMXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNING_LIMIT = BIT(0),\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-278-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:279: enum mxl862xx_bridge_port_egress_meter - Meters for egress traffic type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-280- * @MXL862XX_BRIDGE_PORT_EGRESS_METER_BROADCAST:\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-293- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:294:enum mxl862xx_bridge_port_egress_meter {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-295-\tMXL862XX_BRIDGE_PORT_EGRESS_METER_BROADCAST = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-304-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:305: struct mxl862xx_qos_meter_cfg - Rate meter configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-306- * @enable: Enable/disable meter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-320- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:321:struct mxl862xx_qos_meter_cfg {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-322-\tu8 enable;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-338-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:339: enum mxl862xx_bridge_forward_mode - Bridge forwarding type of packet\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-340- * @MXL862XX_BRIDGE_FORWARD_FLOOD: Packet is flooded to port members of\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-343- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:344:enum mxl862xx_bridge_forward_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-345-\tMXL862XX_BRIDGE_FORWARD_FLOOD = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-349-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:350: struct mxl862xx_bridge_config - Bridge Configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-351- * @bridge_id: Bridge ID (FID)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:352: * @mask: See \u0026enum mxl862xx_bridge_config_mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-353- * @mac_learning_limit_enable: Enable MAC learning limitation\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-363- * @forward_broadcast: Forwarding mode of broadcast traffic. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:364: * \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-365- * @forward_unknown_multicast_ip: Forwarding mode of unknown multicast IP\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-366- * traffic.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:367: * See \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-368- * @forward_unknown_multicast_non_ip: Forwarding mode of unknown multicast\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-369- * non-IP traffic.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:370: * See \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-371- * @forward_unknown_unicast: Forwarding mode of unknown unicast traffic. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:372: * \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-373- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:374:struct mxl862xx_bridge_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-375-\t__le16 bridge_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:376:\t__le32 mask; / enum mxl862xx_bridge_config_mask /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-377-\tu8 mac_learning_limit_enable;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-382-\t__le16 traffic_sub_meter_id[MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX];\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:383:\t__le32 forward_broadcast; / enum mxl862xx_bridge_forward_mode /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:384:\t__le32 forward_unknown_multicast_ip; / enum mxl862xx_bridge_forward_mode /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:385:\t__le32 forward_unknown_multicast_non_ip; / enum mxl862xx_bridge_forward_mode /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:386:\t__le32 forward_unknown_unicast; / enum mxl862xx_bridge_forward_mode /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-387-} __packed;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-389-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:390: struct mxl862xx_bridge_port_alloc - Bridge Port Allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-391- * @bridge_port_id: If the bridge port allocation is successful, a valid ID\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-397- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:398:struct mxl862xx_bridge_port_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-399-\t__le16 bridge_port_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-402-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:403: enum mxl862xx_bridge_port_config_mask - Bridge Port configuration mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-404- * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_ID:\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-462- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:463:enum mxl862xx_bridge_port_config_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-464-\tMXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_ID = BIT(0),\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-491-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:492: enum mxl862xx_color_marking_mode - Color Marking Mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-493- * @MXL862XX_MARKING_ALL_GREEN: mark packets (except critical) to green\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-501- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:502:enum mxl862xx_color_marking_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-503-\tMXL862XX_MARKING_ALL_GREEN = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-513-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:514: enum mxl862xx_color_remarking_mode - Color Remarking Mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-515- * @MXL862XX_REMARKING_NONE: values from last process stage\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-522- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:523:enum mxl862xx_color_remarking_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-524-\tMXL862XX_REMARKING_NONE = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-533-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:534: enum mxl862xx_pmapper_mapping_mode - P-mapper Mapping Mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-535- * @MXL862XX_PMAPPER_MAPPING_PCP: Use PCP for VLAN tagged packets to derive\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-541- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:542:enum mxl862xx_pmapper_mapping_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-543-\tMXL862XX_PMAPPER_MAPPING_PCP = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-548-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:549: struct mxl862xx_pmapper - P-mapper Configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-550- * @pmapper_id: Index of P-mapper (0-31)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-560- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:561:struct mxl862xx_pmapper {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-562-\t__le16 pmapper_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-566-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:567: struct mxl862xx_bridge_port_config - Bridge Port Configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-568- * @bridge_port_id: Bridge Port ID allocated by bridge port allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:569: * @mask: See \u0026enum mxl862xx_bridge_port_config_mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-570- * @bridge_id: Bridge ID (FID) to which this bridge port is associated\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-583- * @ingress_marking_mode: Ingress color marking mode. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:584: * \u0026enum mxl862xx_color_marking_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-585- * @egress_remarking_mode: Color remarking for egress traffic. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:586: * \u0026enum mxl862xx_color_remarking_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-587- * @ingress_metering_enable: Traffic metering on ingress traffic applies\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-597- * @pmapper_mapping_mode: P-mapper mapping mode. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:598: * \u0026enum mxl862xx_pmapper_mapping_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-599- * @pmapper_id_valid: When true, P-mapper is re-used; when false,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-653- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:654:struct mxl862xx_bridge_port_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-655-\t__le16 bridge_port_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:656:\t__le32 mask; / enum mxl862xx_bridge_port_config_mask /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-657-\t__le16 bridge_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-663-\t__le16 egress_extended_vlan_block_size;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:664:\t__le32 ingress_marking_mode; / enum mxl862xx_color_marking_mode /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:665:\t__le32 egress_remarking_mode; / enum mxl862xx_color_remarking_mode /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-666-\tu8 ingress_metering_enable;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-672-\t__le16 dest_sub_if_id_group;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:673:\t__le32 pmapper_mapping_mode; / enum mxl862xx_pmapper_mapping_mode /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-674-\tu8 pmapper_id_valid;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:675:\tstruct mxl862xx_pmapper pmapper;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-676-\t__le16 bridge_port_map[8];\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-709-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:710: struct mxl862xx_cfg - Global Switch configuration Attributes\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:711: * @mac_table_age_timer: See \u0026enum mxl862xx_age_timer\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-712- * @age_timer: Custom MAC table aging timer in seconds\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-722- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:723:struct mxl862xx_cfg {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:724:\t__le32 mac_table_age_timer; / enum mxl862xx_age_timer /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-725-\t__le32 age_timer;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-734-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:735: enum mxl862xx_extended_vlan_filter_type - Extended VLAN filter tag type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-736- * @MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NORMAL: Normal tagged\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-740- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:741:enum mxl862xx_extended_vlan_filter_type {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-742-\tMXL862XX_EXTENDEDVLAN_FILTER_TYPE_NORMAL = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-748-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:749: enum mxl862xx_extended_vlan_filter_tpid - Extended VLAN filter TPID\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-750- * @MXL862XX_EXTENDEDVLAN_FILTER_TPID_NO_FILTER: No TPID filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-753- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:754:enum mxl862xx_extended_vlan_filter_tpid {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-755-\tMXL862XX_EXTENDEDVLAN_FILTER_TPID_NO_FILTER = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-760-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:761: enum mxl862xx_extended_vlan_filter_dei - Extended VLAN filter DEI\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-762- * @MXL862XX_EXTENDEDVLAN_FILTER_DEI_NO_FILTER: No DEI filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-765- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:766:enum mxl862xx_extended_vlan_filter_dei {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-767-\tMXL862XX_EXTENDEDVLAN_FILTER_DEI_NO_FILTER = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-772-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:773: enum mxl862xx_extended_vlan_treatment_remove_tag - Tag removal action\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-774- * @MXL862XX_EXTENDEDVLAN_TREATMENT_NOT_REMOVE_TAG: Do not remove tag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-778- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:779:enum mxl862xx_extended_vlan_treatment_remove_tag {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-780-\tMXL862XX_EXTENDEDVLAN_TREATMENT_NOT_REMOVE_TAG = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-786-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:787: enum mxl862xx_extended_vlan_treatment_priority - Treatment priority mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-788- * @MXL862XX_EXTENDEDVLAN_TREATMENT_PRIORITY_VAL: Use explicit value\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-792- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:793:enum mxl862xx_extended_vlan_treatment_priority {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-794-\tMXL862XX_EXTENDEDVLAN_TREATMENT_PRIORITY_VAL = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-800-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:801: enum mxl862xx_extended_vlan_treatment_vid - Treatment VID mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-802- * @MXL862XX_EXTENDEDVLAN_TREATMENT_VID_VAL: Use explicit VID value\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-805- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:806:enum mxl862xx_extended_vlan_treatment_vid {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-807-\tMXL862XX_EXTENDEDVLAN_TREATMENT_VID_VAL = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-812-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:813: enum mxl862xx_extended_vlan_treatment_tpid - Treatment TPID mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-814- * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_TPID: Copy from inner tag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-818- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:819:enum mxl862xx_extended_vlan_treatment_tpid {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-820-\tMXL862XX_EXTENDEDVLAN_TREATMENT_INNER_TPID = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-826-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:827: enum mxl862xx_extended_vlan_treatment_dei - Treatment DEI mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-828- * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_DEI: Copy from inner tag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-832- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:833:enum mxl862xx_extended_vlan_treatment_dei {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-834-\tMXL862XX_EXTENDEDVLAN_TREATMENT_INNER_DEI = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-840-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:841: enum mxl862xx_extended_vlan_4_tpid_mode - 4-TPID mode selector\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-842- * @MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_1: VLAN TPID type 1\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-846- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:847:enum mxl862xx_extended_vlan_4_tpid_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-848-\tMXL862XX_EXTENDEDVLAN_TPID_VTETYPE_1 = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-854-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:855: enum mxl862xx_extended_vlan_filter_ethertype - Filter EtherType match\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-856- * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_NO_FILTER: No filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-864- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:865:enum mxl862xx_extended_vlan_filter_ethertype {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-866-\tMXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_NO_FILTER = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-876-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:877: struct mxl862xx_extendedvlan_filter_vlan - Per-tag filter in Extended VLAN\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:878: * @type: Tag presence/type match (see \u0026enum mxl862xx_extended_vlan_filter_type)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-879- * @priority_enable: Enable PCP value matching\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-882- * @vid_val: VID value to match\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:883: * @tpid: TPID match mode (see \u0026enum mxl862xx_extended_vlan_filter_tpid)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:884: * @dei: DEI match mode (see \u0026enum mxl862xx_extended_vlan_filter_dei)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-885- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:886:struct mxl862xx_extendedvlan_filter_vlan {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-887-\t__le32 type;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-896-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:897: struct mxl862xx_extendedvlan_filter - Extended VLAN filter configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-898- * @original_packet_filter_mode: If true, filter on original (pre-treatment)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-899- * packet\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:900: * @filter_4_tpid_mode: 4-TPID mode (see \u0026enum mxl862xx_extended_vlan_4_tpid_mode)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-901- * @outer_vlan: Outer VLAN tag filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-903- * @ether_type: EtherType filter (see\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:904: * \u0026enum mxl862xx_extended_vlan_filter_ethertype)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-905- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:906:struct mxl862xx_extendedvlan_filter {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-907-\tu8 original_packet_filter_mode;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-908-\t__le32 filter_4_tpid_mode;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:909:\tstruct mxl862xx_extendedvlan_filter_vlan outer_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:910:\tstruct mxl862xx_extendedvlan_filter_vlan inner_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-911-\t__le32 ether_type;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-914-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:915: struct mxl862xx_extendedvlan_treatment_vlan - Per-tag treatment in\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-916- * Extended VLAN\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-917- * @priority_mode: Priority assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:918: * (see \u0026enum mxl862xx_extended_vlan_treatment_priority)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-919- * @priority_val: Priority value (when mode is VAL)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-920- * @vid_mode: VID assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:921: * (see \u0026enum mxl862xx_extended_vlan_treatment_vid)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-922- * @vid_val: VID value (when mode is VAL)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-923- * @tpid: TPID assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:924: * (see \u0026enum mxl862xx_extended_vlan_treatment_tpid)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-925- * @dei: DEI assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:926: * (see \u0026enum mxl862xx_extended_vlan_treatment_dei)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-927- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:928:struct mxl862xx_extendedvlan_treatment_vlan {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-929-\t__le32 priority_mode;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-937-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:938: struct mxl862xx_extendedvlan_treatment - Extended VLAN treatment\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-939- * @remove_tag: Tag removal action\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:940: * (see \u0026enum mxl862xx_extended_vlan_treatment_remove_tag)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-941- * @treatment_4_tpid_mode: 4-TPID treatment mode\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-958- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:959:struct mxl862xx_extendedvlan_treatment {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-960-\t__le32 remove_tag;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-962-\tu8 add_outer_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:963:\tstruct mxl862xx_extendedvlan_treatment_vlan outer_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-964-\tu8 add_inner_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:965:\tstruct mxl862xx_extendedvlan_treatment_vlan inner_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-966-\tu8 reassign_bridge_port;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-980-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:981: struct mxl862xx_extendedvlan_alloc - Extended VLAN block allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-982- * @number_of_entries: Number of entries to allocate (input) / allocated\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-988- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:989:struct mxl862xx_extendedvlan_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-990-\t__le16 number_of_entries;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-994-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:995: struct mxl862xx_extendedvlan_config - Extended VLAN entry configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-996- * @extended_vlan_block_id: Block ID from allocation\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1002- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1003:struct mxl862xx_extendedvlan_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1004-\t__le16 extended_vlan_block_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1005-\t__le16 entry_index;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1006:\tstruct mxl862xx_extendedvlan_filter filter;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1007:\tstruct mxl862xx_extendedvlan_treatment treatment;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1008-} __packed;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1010-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1011: enum mxl862xx_vlan_filter_tci_mask - VLAN Filter TCI mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1012- * @MXL862XX_VLAN_FILTER_TCI_MASK_VID: TCI mask for VLAN ID\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1015- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1016:enum mxl862xx_vlan_filter_tci_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1017-\tMXL862XX_VLAN_FILTER_TCI_MASK_VID = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1022-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1023: struct mxl862xx_vlanfilter_alloc - VLAN Filter block allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1024- * @number_of_entries: Number of entries to allocate (input) / allocated\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1034- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1035:struct mxl862xx_vlanfilter_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1036-\t__le16 number_of_entries;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1043-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1044: struct mxl862xx_vlanfilter_config - VLAN Filter entry configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1045- * @vlan_filter_block_id: Block ID from allocation\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1047- * @vlan_filter_mask: TCI field(s) to match (see\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1048: * \u0026enum mxl862xx_vlan_filter_tci_mask)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1049- * @val: TCI value(s) to match (VID, PCP, or full TCI depending on mask)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1054- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1055:struct mxl862xx_vlanfilter_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1056-\t__le16 vlan_filter_block_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1057-\t__le16 entry_index;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1058:\t__le32 vlan_filter_mask; / enum mxl862xx_vlan_filter_tci_mask /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1059-\t__le32 val;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1063-/\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1064: enum mxl862xx_ss_sp_tag_mask - Special tag valid field indicator bits\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1065- * @MXL862XX_SS_SP_TAG_MASK_RX: valid RX special tag mode\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1069- /\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1070:enum mxl862xx_ss_sp_tag_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1071-\tMXL862XX_SS_SP_TAG_MASK_RX = BIT(0),\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1077-/*\n\n" }
5/2	2026/08/03 04:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 45699 output: 20 thoughts: 286 Thoughts: Analyzing the mxl862xx Driver for Syzkaller Testing Okay, so I'm looking at `drivers/net/dsa/mxl862xx/mxl862xx.c`. The immediate question is, can I get this thing to probe in QEMU and, crucially, can Syzkaller test it? It's an MDIO device, which means it's likely to be probed via the device tree or ACPI. I seem to recall some potential for MDIO device injection with `syz_genetlink`... no, wait, that's not quite right. Syzkaller doesn't have a generic MDIO injector, I was thinking of something else. But, hold on... if the device is registered on a virtual MDIO bus, Syzkaller can test it, right? Thinking further, and remembering this is `mxl862xx`, it's a DSA switch. DSA switches, like MDIO devices, are often brought up via the device tree. Hmm, does Syzkaller have any existing tests for DSA switches? Let me check quickly. I know about `syz_genetlink` and `syz_init_net_socket` but I don't remember any device tree injection directly. So, Syzkaller can test a driver if it is instantiated. So the key is, is there a virtual MDIO bus in the kernel that Syzkaller could use to instantiate this `mxl862xx`? I need to go back to `drivers/net/dsa/mxl862xx/mxl862xx.c` and check how it's actually probed to see if a virtual MDIO bus could be utilized.
6/2	2026/08/03 04:47	tool	grepper	0m Error: no matches Args: { "Expression": "module_mdio_driver" } Results: { "error": "no matches" }
7/2	2026/08/03 04:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 46394 output: 22 thoughts: 8 Thoughts: Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and written in the first person: Analyzing the Probe Function Right, let's get down to brass tacks. I need to make sure this probe function is behaving as expected. There are numerous factors to consider and any deviation from these factors could severely impact the integrity of this entire operation. Is it correctly interpreting the incoming data streams? Is its response time within acceptable parameters for the system's overall latency requirements? I need to verify its sensitivity and selectivity; is it picking up the signal properly and, critically, not triggering on spurious noise or irrelevant inputs? A thorough examination of its internal logic, perhaps tracing a few critical data paths, seems like the most efficient approach to start. Ultimately, I need absolute confidence in its reliability. A weak spot here could compromise everything.
8/2	2026/08/03 04:47	tool	grepper	0m Args: { "Expression": "mxl862xx_probe" } Results: { "Output": "drivers/net/dsa/mxl862xx/mxl862xx.c=2185=static const struct dsa_switch_ops mxl862xx_switch_ops = {\n--\ndrivers/net/dsa/mxl862xx/mxl862xx.c-2220-\ndrivers/net/dsa/mxl862xx/mxl862xx.c:2221:static int mxl862xx_probe(struct mdio_device *mdiodev)\ndrivers/net/dsa/mxl862xx/mxl862xx.c-2222-{\n--\ndrivers/net/dsa/mxl862xx/mxl862xx.c=2330=static struct mdio_driver mxl862xx_driver = {\ndrivers/net/dsa/mxl862xx/mxl862xx.c:2331:\t.probe = mxl862xx_probe,\ndrivers/net/dsa/mxl862xx/mxl862xx.c-2332-\t.remove = mxl862xx_remove,\n" }
9/2	2026/08/03 04:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 46907 output: 52 thoughts: 454 Thoughts: Analyzing the Potential for Fuzzing an MDIO Driver in a Virtualized Environment Okay, so I'm looking at an `mdio_driver` – specifically, I'm thinking about the `mxl862xx` driver, which is intriguing because it's a physical switch. The initial question is whether or not this driver can even be probed within QEMU. My immediate gut feeling is, no, not unless there's a virtual MDIO bus already set up that would instantiate it. I vaguely recall something like `mdio-mockup`, but that's a fleeting thought, and not likely the key here. My next line of thinking is about Syzkaller. Can Syzkaller reach this driver? The answer, I suspect, is also no. Syzkaller doesn't easily create arbitrary MDIO devices unless they are part of a virtual driver like `mac80211_hwsim` or `netdevsim`. That's where it could work. Then I get to the crux of the matter: `mxl862xx` is a physical switch. The prompt, as I read it, makes it clear that we should rule out patches that involve code paths that are impossible to reach in virtualized environments, like QEMU. That's even when using software-emulated hardware. It calls out specific examples like vendor-specific PCIe switches, and that makes me wonder…is `mxl862xx` a vendor-specific switch that requires physical hardware? The answer, after some reflection, is a resounding yes. It's a MaxLinear MxL862xx switch. It's an MDIO device, which means it's a physical chip connected to an MDIO bus. Crucially, there's no QEMU emulation for this particular chip. Therefore, the code paths in `mxl862xx-fw.c` are simply inaccessible in a virtualized environment. That's the key to this question. Just to be sure, I briefly consider a workaround: can I instantiate the MDIO device using `sysfs`? Could I potentially override the driver like `echo "mxl862xx" > /sys/bus/mdio_bus/devices/.../driver_override`? Even if that were possible, the probe function, `mxl862xx_probe`, will read and write to the MDIO bus to communicate with the chip. So even with this method, it's impossible.
10/2	2026/08/03 04:47	tool	read-file	0m Args: { "File": "drivers/net/dsa/mxl862xx/mxl862xx.c", "FirstLine": 2221, "LineCount": 100 } Results: { "Contents": "2221:\tstatic int mxl862xx_probe(struct mdio_device mdiodev)\n2222:\t{\n2223:\t\tstruct device dev = \u0026mdiodev-\u003edev;\n2224:\t\tstruct mxl862xx_priv priv;\n2225:\t\tstruct dsa_switch ds;\n2226:\t\tint err, i;\n2227:\t\n2228:\t\tpriv = devm_kzalloc(dev, sizeof(priv), GFP_KERNEL);\n2229:\t\tif (!priv)\n2230:\t\t\treturn -ENOMEM;\n2231:\t\n2232:\t\tpriv-\u003emdiodev = mdiodev;\n2233:\t\n2234:\t\tds = devm_kzalloc(dev, sizeof(ds), GFP_KERNEL);\n2235:\t\tif (!ds)\n2236:\t\t\treturn -ENOMEM;\n2237:\t\n2238:\t\tpriv-\u003eds = ds;\n2239:\t\tds-\u003edev = dev;\n2240:\t\tds-\u003epriv = priv;\n2241:\t\tds-\u003eops = \u0026mxl862xx_switch_ops;\n2242:\t\tds-\u003ephylink_mac_ops = \u0026mxl862xx_phylink_mac_ops;\n2243:\t\tds-\u003enum_ports = MXL862XX_MAX_PORTS;\n2244:\t\tds-\u003efdb_isolation = true;\n2245:\t\tds-\u003emax_num_bridges = MXL862XX_MAX_BRIDGES;\n2246:\t\n2247:\t\tmxl862xx_host_init(priv);\n2248:\t\n2249:\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++) {\n2250:\t\t\tpriv-\u003eports[i].priv = priv;\n2251:\t\t\tINIT_WORK(\u0026priv-\u003eports[i].host_flood_work,\n2252:\t\t\t\t mxl862xx_host_flood_work_fn);\n2253:\t\t\tspin_lock_init(\u0026priv-\u003eports[i].stats_lock);\n2254:\t\t}\n2255:\t\n2256:\t\tINIT_DELAYED_WORK(\u0026priv-\u003estats_work, mxl862xx_stats_work_fn);\n2257:\t\n2258:\t\tdev_set_drvdata(dev, ds);\n2259:\t\n2260:\t\terr = dsa_register_switch(ds);\n2261:\t\tif (err) {\n2262:\t\t\tmxl862xx_stop_work(priv);\n2263:\t\t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n2264:\t\t\tmxl862xx_host_shutdown(priv);\n2265:\t\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n2266:\t\t\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n2267:\t\t}\n2268:\t\n2269:\t\treturn err;\n2270:\t}\n2271:\t\n2272:\tstatic void mxl862xx_remove(struct mdio_device mdiodev)\n2273:\t{\n2274:\t\tstruct dsa_switch ds = dev_get_drvdata(\u0026mdiodev-\u003edev);\n2275:\t\tstruct mxl862xx_priv priv;\n2276:\t\tint i;\n2277:\t\n2278:\t\tif (!ds)\n2279:\t\t\treturn;\n2280:\t\n2281:\t\tpriv = ds-\u003epriv;\n2282:\t\n2283:\t\tmxl862xx_stop_work(priv);\n2284:\t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n2285:\t\n2286:\t\tdsa_unregister_switch(ds);\n2287:\t\n2288:\t\tmxl862xx_host_shutdown(priv);\n2289:\t\n2290:\t\t/ Cancel any pending host flood work. dsa_unregister_switch()\n2291:\t\t * has already called port_teardown (which sets setup_done=false),\n2292:\t\t * but a worker could still be blocked on rtnl_lock(). Since we\n2293:\t\t * are now outside RTNL, cancel_work_sync() will not deadlock.\n2294:\t\t /\n2295:\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n2296:\t\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n2297:\t}\n2298:\t\n2299:\tstatic void mxl862xx_shutdown(struct mdio_device mdiodev)\n2300:\t{\n2301:\t\tstruct dsa_switch ds = dev_get_drvdata(\u0026mdiodev-\u003edev);\n2302:\t\tstruct mxl862xx_priv priv;\n2303:\t\tint i;\n2304:\t\n2305:\t\tif (!ds)\n2306:\t\t\treturn;\n2307:\t\n2308:\t\tpriv = ds-\u003epriv;\n2309:\t\n2310:\t\tdsa_switch_shutdown(ds);\n2311:\t\n2312:\t\tmxl862xx_stop_work(priv);\n2313:\t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n2314:\t\n2315:\t\tmxl862xx_host_shutdown(priv);\n2316:\t\n2317:\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n2318:\t\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n2319:\t\n2320:\t\tdev_set_drvdata(\u0026mdiodev-\u003edev, NULL);\n" }
11/2	2026/08/03 04:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 49524 output: 51 thoughts: 53 Thoughts: Analyzing the Data Switch Registration Process Okay, so the `probe` function is kicking things off with a call to `dsa_register_switch(ds)`. That's where the magic begins, presumably setting up this DSA switch. My immediate thought is to trace the execution path from there. I know `dsa_register_switch` will, at some point, trigger the `setup` callback associated with the switch operations. Now, let's see which `setup` method is being used in this context. I need to understand how the hardware is being initialized and configured. Time to dive into `mxl862xx_setup` and see what's going on. That should give me a good handle on how this specific switch is being brought online.
12/2	2026/08/03 04:47	tool	read-file	0m Args: { "File": "drivers/net/dsa/mxl862xx/mxl862xx.c", "FirstLine": 670, "LineCount": 100 } Results: { "Contents": " 670:\t\n 671:\tstatic int mxl862xx_setup(struct dsa_switch ds)\n 672:\t{\n 673:\t\tstruct mxl862xx_priv priv = ds-\u003epriv;\n 674:\t\tint n_user_ports = 0, max_vlans;\n 675:\t\tint ingress_finals, vid_rules;\n 676:\t\tstruct dsa_port dp;\n 677:\t\tint ret, i, rescue;\n 678:\t\n 679:\t\t/ The SerDes state is software-only and must exist before anything can\n 680:\t\t * reach phylink, including a rescue-mode flash clearing rescue_mode\n 681:\t\t * ahead of the reprobe.\n 682:\t\t /\n 683:\t\tmutex_init(\u0026priv-\u003eserdes_lock);\n 684:\t\tfor (i = 0; i \u003c ARRAY_SIZE(priv-\u003eserdes_ports); i++)\n 685:\t\t\tmxl862xx_setup_pcs(priv, \u0026priv-\u003eserdes_ports[i],\n 686:\t\t\t\t\t i + MXL862XX_FIRST_SERDES_PORT);\n 687:\t\n 688:\t\t/ Detect the loader over SB PDI first: it needs no firmware, unlike the\n 689:\t\t * C45 API (mxl862xx_reset/wait_ready) which spews CRC errors when none\n 690:\t\t * answers. Touch C45 only once rescue is ruled out.\n 691:\t\t /\n 692:\t\trescue = mxl862xx_rescue_mode_detect(priv);\n 693:\t\tif (rescue \u003c 0) {\n 694:\t\t\tdev_err(ds-\u003edev, \"switch state detection failed: %pe\\n\",\n 695:\t\t\t\tERR_PTR(rescue));\n 696:\t\t\treturn rescue;\n 697:\t\t}\n 698:\t\n 699:\t\tif (rescue == MXL862XX_NOT_RESCUE) {\n 700:\t\t\tret = mxl862xx_reset(priv);\n 701:\t\t\tif (ret)\n 702:\t\t\t\treturn ret;\n 703:\t\n 704:\t\t\tret = mxl862xx_wait_ready(ds);\n 705:\t\t\tif (ret) {\n 706:\t\t\t\t/ the reset may only now have triggered rescue mode /\n 707:\t\t\t\trescue = mxl862xx_rescue_mode_detect(priv);\n 708:\t\t\t\tif (rescue \u003c 0) {\n 709:\t\t\t\t\tdev_err(ds-\u003edev,\n 710:\t\t\t\t\t\t\"switch not responding after reset: %pe\\n\",\n 711:\t\t\t\t\t\tERR_PTR(rescue));\n 712:\t\t\t\t\treturn rescue;\n 713:\t\t\t\t}\n 714:\t\t\t\tif (rescue == MXL862XX_NOT_RESCUE)\n 715:\t\t\t\t\treturn ret;\n 716:\t\t\t}\n 717:\t\t}\n 718:\t\n 719:\t\tpriv-\u003erescue_mode = rescue;\n 720:\t\n 721:\t\tif (priv-\u003erescue_mode) {\n 722:\t\t\tif (priv-\u003erescue_ready) {\n 723:\t\t\t\tdev_warn(ds-\u003edev,\n 724:\t\t\t\t\t \"switch in MCUboot rescue mode, use devlink to flash new firmware\\n\");\n 725:\t\t\t} else {\n 726:\t\t\t\t/ Drain the wedged download in the background so it\n 727:\t\t\t\t * never holds the devlink lock; info and flash become\n 728:\t\t\t\t * available once ready.\n 729:\t\t\t\t /\n 730:\t\t\t\tdev_warn(ds-\u003edev,\n 731:\t\t\t\t\t \"switch in MCUboot with an interrupted download, recovering in background\\n\");\n 732:\t\t\t\tqueue_work(system_long_wq, \u0026priv-\u003erescue_heal_work);\n 733:\t\t\t}\n 734:\t\t\treturn 0;\n 735:\t\t}\n 736:\t\n 737:\t\t/ Calculate Extended VLAN block sizes.\n 738:\t\t * With VLAN Filter handling VID membership checks:\n 739:\t\t * Ingress: only final catchall rules (PVID insertion, 802.1Q\n 740:\t\t * accept, non-8021Q TPID handling, discard).\n 741:\t\t * Block sized to exactly fit the finals -- no per-VID\n 742:\t\t * ingress EVLAN rules are needed. (7 entries.)\n 743:\t\t * Egress: 2 rules per VID that needs tag stripping (untagged VIDs).\n 744:\t\t * No egress final catchalls -- VLAN Filter does the discard.\n 745:\t\t * CPU: EVLAN is left disabled on CPU ports -- frames pass\n 746:\t\t * through without EVLAN processing.\n 747:\t\t \n 748:\t\t Total EVLAN budget:\n 749:\t\t * n_user_ports * (ingress + egress) \u003c= 1024.\n 750:\t\t * Ingress blocks are small (7 entries), so almost all capacity\n 751:\t\t * goes to egress VID rules.\n 752:\t\t /\n 753:\t\tdsa_switch_for_each_user_port(dp, ds)\n 754:\t\t\tn_user_ports++;\n 755:\t\n 756:\t\tif (n_user_ports) {\n 757:\t\t\tingress_finals = ARRAY_SIZE(ingress_aware_final);\n 758:\t\t\tvid_rules = ARRAY_SIZE(vid_accept_standard);\n 759:\t\n 760:\t\t\t/ Ingress block: fixed at finals count (7 entries) /\n 761:\t\t\tpriv-\u003eevlan_ingress_size = ingress_finals;\n 762:\t\n 763:\t\t\t/ Egress block: remaining budget divided equally among\n 764:\t\t\t * user ports. Each untagged VID needs vid_rules (2)\n 765:\t\t\t * EVLAN entries for tag stripping. Tagged-only VIDs\n 766:\t\t\t * need no EVLAN rules at all.\n 767:\t\t\t /\n 768:\t\t\tmax_vlans = (MXL862XX_TOTAL_EVLAN_ENTRIES -\n 769:\t\t\t\t n_user_ports ingress_finals) /\n" }
13/2	2026/08/03 04:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 51440 output: 53 thoughts: 54 Thoughts: MDIO Driver Inquiry Okay, so I'm looking at this code and it's dealing with a driver, specifically an MDIO driver. My immediate thought is, "Right, MDIO, got it." The next part is interesting. It's using `mxl862xx_rescue_mode_detect`. My expertise kicks in – if there's no actual physical hardware present, that function is going to fail, which is logical. Now, let me just quickly double-check that `mxl862xx_rescue_mode_detect` function to confirm my initial assessment and see what it's really doing. I need to understand exactly what that function is about.
14/2	2026/08/03 04:47	tool	read-file	0m Args: { "File": "drivers/net/dsa/mxl862xx/mxl862xx-fw.c", "FirstLine": 400, "LineCount": 100 } Results: { "Contents": " 400:\t\tint ret, stat;\n 401:\t\n 402:\t\twhile (chunk \u003c max_chunks) {\n 403:\t\t\t/* Teardown can interrupt this long drain. /\n 404:\t\t\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n 405:\t\t\t\treturn -ECANCELED;\n 406:\t\n 407:\t\t\tstat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_POLL_MS);\n 408:\t\t\tif (stat \u003c 0)\n 409:\t\t\t\treturn stat;\n 410:\t\t\tif (stat == MXL862XX_SB_PDI_READY)\n 411:\t\t\t\treturn 0;\n 412:\t\n 413:\t\t\tif (stat) {\n 414:\t\t\t\tret = mxl862xx_rescue_drain_finish(priv, chunk);\n 415:\t\t\t\tif (ret != -EAGAIN)\n 416:\t\t\t\t\treturn ret;\n 417:\t\t\t}\n 418:\t\n 419:\t\t\t/ Feed one zero byte; reset cleared the write latch. /\n 420:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n 421:\t\t\t\t\t\t MXL862XX_SB_PDI_CTRL_WR);\n 422:\t\t\tif (ret \u003c 0)\n 423:\t\t\t\treturn ret;\n 424:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);\n 425:\t\t\tif (ret \u003c 0)\n 426:\t\t\t\treturn ret;\n 427:\t\t\tret = mxl862xx_sb_pdi_reset(priv);\n 428:\t\t\tif (ret \u003c 0)\n 429:\t\t\t\treturn ret;\n 430:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n 431:\t\t\t\t\t\t MXL862XX_DRAIN_CHUNK_BYTES);\n 432:\t\t\tif (ret \u003c 0)\n 433:\t\t\t\treturn ret;\n 434:\t\t\tchunk++;\n 435:\t\t\tif (!(chunk % MXL862XX_DRAIN_LOG_BYTES))\n 436:\t\t\t\tdev_info(dev, \"flash: drained %u KiB so far\\n\",\n 437:\t\t\t\t\t chunk / 1024);\n 438:\t\t\tcond_resched();\n 439:\t\t}\n 440:\t\n 441:\t\tdev_err(dev,\n 442:\t\t\t\"flash: interrupted download did not drain after %u chunks\\n\",\n 443:\t\t\tchunk);\n 444:\t\n 445:\t\treturn -ETIMEDOUT;\n 446:\t}\n 447:\t\n 448:\t/ Background self-heal: drain a wedged download off the devlink flash path, so\n 449:\t * the long recovery never holds the devlink lock. Scheduled from probe;\n 450:\t * reprobes on success so the probe-time detection re-classifies the switch.\n 451:\t /\n 452:\tvoid mxl862xx_rescue_heal_work_fn(struct work_struct work)\n 453:\t{\n 454:\t\tstruct mxl862xx_priv priv =\n 455:\t\t\tcontainer_of(work, struct mxl862xx_priv, rescue_heal_work);\n 456:\t\tstruct device dev = \u0026priv-\u003emdiodev-\u003edev;\n 457:\t\tstruct mxl862xx_reprobe ko;\n 458:\t\tint ret;\n 459:\t\n 460:\t\tret = mxl862xx_rescue_drain(priv);\n 461:\t\tif (ret == -ECANCELED)\n 462:\t\t\treturn;\n 463:\t\tif (ret) {\n 464:\t\t\t/ Nothing retries this, so say so: rescue_ready stays clear\n 465:\t\t\t * and devlink dev flash reports why it refuses.\n 466:\t\t\t /\n 467:\t\t\tdev_err(dev, \"flash: download recovery failed: %pe\\n\",\n 468:\t\t\t\tERR_PTR(ret));\n 469:\t\t\tWRITE_ONCE(priv-\u003erescue_failed, true);\n 470:\t\t\treturn;\n 471:\t\t}\n 472:\t\n 473:\t\t/ The interrupted transfer is finalised; reprobe so the probe-time\n 474:\t\t * detection brings the driver up -- flashable in rescue mode if the\n 475:\t\t * loader is at READY, or normally if a valid image booted. The refs\n 476:\t\t * are released by the reprobe once it completes. heal_lock makes the\n 477:\t\t * flag test and the queueing atomic against teardown, which cannot\n 478:\t\t * cancel a work item this one has already queued.\n 479:\t\t /\n 480:\t\tmutex_lock(\u0026priv-\u003eheal_lock);\n 481:\t\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n 482:\t\t\tgoto out;\n 483:\t\tif (!try_module_get(THIS_MODULE))\n 484:\t\t\tgoto out;\n 485:\t\tget_device(dev);\n 486:\t\tko = mxl862xx_reprobe_alloc(dev);\n 487:\t\tif (!ko) {\n 488:\t\t\tput_device(dev);\n 489:\t\t\tmodule_put(THIS_MODULE);\n 490:\t\t\tgoto out;\n 491:\t\t}\n 492:\t\tqueue_delayed_work(system_long_wq, \u0026ko-\u003ework,\n 493:\t\t\t\t msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));\n 494:\tout:\n 495:\t\tmutex_unlock(\u0026priv-\u003eheal_lock);\n 496:\t}\n 497:\t\n 498:\t/ Detect MCUboot rescue mode over clause-22 SMDIO alone, so the caller can rule\n 499:\t * the loader out before any C45 API request (which spews CRC errors when no WSP\n" }
15/2	2026/08/03 04:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 53376 output: 53 thoughts: 21 Thoughts: Okay, let's dive into the rest of `mxl862xx_rescue_mode_detect`. I need to get a clear picture of how this rescue mode detection is actually implemented. I'm already familiar with the broader architecture, but this function is the key to understanding the specifics. I'm expecting to see the low-level interactions with the hardware, perhaps register reads, interrupt handling, or timing loops – something that directly probes the device's state to determine if it's in a rescue scenario. My focus will be on identifying the trigger condition; what specific signals or events tip it off. Is it a particular sequence of operations, a specific error code, or a hardware signal asserted at a specific pin? Furthermore, I'll be looking for the mechanism that sets the rescue flag - is it a simple boolean, a state variable, or perhaps a more complex state machine? Finally, any clues as to how this information is then subsequently used by the rescue process will be of immediate interest. This is where the rubber meets the road.
16/2	2026/08/03 04:47	tool	read-file	0m Args: { "File": "drivers/net/dsa/mxl862xx/mxl862xx-fw.c", "FirstLine": 500, "LineCount": 100 } Results: { "Contents": " 500:\t * firmware answers). A scratch write to ADDR/DATA must latch or the chip is\n 501:\t * absent (-ENODEV); the mailbox is reset first, or a transfer interrupted with\n 502:\t * CTRL=WR would take that write as a payload word instead of latching it. STAT\n 503:\t * then classifies the state, poked destructively only when 0, the one value a\n 504:\t * running firmware never holds:\n 505:\t \n 506:\t - 0xc33c: flashless loop; recognised but not supported here.\n 507:\t * - 0xc55c: console loop, if the register-read challenge is serviced.\n 508:\t * - other non-zero: running firmware, left unpoked.\n 509:\t * - 0: wedged receive loop; the 1-byte slice-advance then says whether it\n 510:\t * still needs draining or has just finished.\n 511:\t \n 512:\t Return: MXL862XX_IN_RESCUE, MXL862XX_NOT_RESCUE, -ENODEV when nothing\n 513:\t * answers, -EOPNOTSUPP for the flashless loop, -ENXIO for a READY loader whose\n 514:\t * mailbox fails the challenge, or an SMDIO bus error.\n 515:\t /\n 516:\tint mxl862xx_rescue_mode_detect(struct mxl862xx_priv priv)\n 517:\t{\n 518:\t\tint stat, dat, ret, rb, a, d;\n 519:\t\n 520:\t\t/* rescue_ready gates flashing; a wedged loader needs the drain first. /\n 521:\t\tWRITE_ONCE(priv-\u003erescue_ready, false);\n 522:\t\n 523:\t\tret = mxl862xx_sb_pdi_reset(priv);\n 524:\t\tif (ret \u003c 0)\n 525:\t\t\treturn ret;\n 526:\t\n 527:\t\t/ Presence: a live chip latches the scratch write, an absent one floats. /\n 528:\t\ta = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n 529:\t\t\t\t\t MXL862XX_SB_PDI_PROBE_A);\n 530:\t\tif (a \u003c 0)\n 531:\t\t\treturn a;\n 532:\t\td = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n 533:\t\t\t\t\t MXL862XX_SB_PDI_PROBE_D);\n 534:\t\tif (d \u003c 0)\n 535:\t\t\treturn d;\n 536:\t\ta = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_ADDR);\n 537:\t\tif (a \u003c 0)\n 538:\t\t\treturn a;\n 539:\t\td = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n 540:\t\tif (d \u003c 0)\n 541:\t\t\treturn d;\n 542:\t\tif ((u16)a != MXL862XX_SB_PDI_PROBE_A \|\|\n 543:\t\t (u16)d != MXL862XX_SB_PDI_PROBE_D)\n 544:\t\t\treturn -ENODEV;\n 545:\t\n 546:\t\tret = mxl862xx_sb_pdi_reset(priv);\n 547:\t\tif (ret \u003c 0)\n 548:\t\t\treturn ret;\n 549:\t\n 550:\t\tstat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);\n 551:\t\tif (stat \u003c 0)\n 552:\t\t\treturn stat;\n 553:\t\n 554:\t\t/ Flashless-download loop (MxL86281S tier): this driver does not\n 555:\t\t * support it -- the console flash path expects READY. Treat it as an\n 556:\t\t * unusable configuration, like any other unsupported state.\n 557:\t\t /\n 558:\t\tif ((u16)stat == MXL862XX_SB_PDI_DL_READY)\n 559:\t\t\treturn -EOPNOTSUPP;\n 560:\t\n 561:\t\t/ Console loop at READY: confirm the live mailbox with the register-read\n 562:\t\t * challenge (consumes the marker from DATA and re-arms READY).\n 563:\t\t /\n 564:\t\tif ((u16)stat == MXL862XX_SB_PDI_READY) {\n 565:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n 566:\t\t\t\t\t\t MXL862XX_SB_PDI_RDREG_MARK);\n 567:\t\t\tif (ret \u003c 0)\n 568:\t\t\t\treturn ret;\n 569:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n 570:\t\t\t\t\t\t MXL862XX_SB_PDI_RDREG);\n 571:\t\t\tif (ret \u003c 0)\n 572:\t\t\t\treturn ret;\n 573:\t\t\trb = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,\n 574:\t\t\t\t\t\t MXL862XX_RESCUE_READY_TIMEOUT_MS);\n 575:\t\t\tdat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n 576:\t\t\tret = mxl862xx_sb_pdi_reset(priv);\n 577:\t\t\tif (rb \u003c 0)\n 578:\t\t\t\treturn rb;\n 579:\t\t\tif (dat \u003c 0)\n 580:\t\t\t\treturn dat;\n 581:\t\t\tif (ret \u003c 0)\n 582:\t\t\t\treturn ret;\n 583:\t\t\tif (!rb \u0026\u0026 (u16)dat != MXL862XX_SB_PDI_RDREG_MARK) {\n 584:\t\t\t\tWRITE_ONCE(priv-\u003erescue_ready, true);\n 585:\t\t\t\treturn MXL862XX_IN_RESCUE;\n 586:\t\t\t}\n 587:\t\t\treturn -ENXIO;\n 588:\t\t}\n 589:\t\n 590:\t\t/ Any other non-zero value is a running firmware, not a loader. /\n 591:\t\tif (stat)\n 592:\t\t\treturn MXL862XX_NOT_RESCUE;\n 593:\t\n 594:\t\t/ STAT == 0: a wedged receive loop takes a 1-byte slice-advance (feed\n 595:\t\t * one DATA word first, like a drain chunk) and asks for the next chunk\n 596:\t\t * by publishing 0 again. Had that byte been the last one outstanding,\n 597:\t\t * the loader leaves the loop instead and returns to READY, having\n 598:\t\t * consumed the advance -- proof enough of a live mailbox to skip the\n 599:\t\t * challenge. Anything else means it is still working on it. All three\n" }
17/2	2026/08/03 04:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 55640 output: 19 thoughts: 435 Thoughts: Analyzing the `mxl862xx_rescue_mode_detect` Function Okay, so looking at this `mxl862xx_rescue_mode_detect` function, it's pretty straightforward. It's doing a probe to see if the hardware is present, right? It writes some specific values (`MXL862XX_SB_PDI_PROBE_A` and `MXL862XX_SB_PDI_PROBE_D`) to some registers using `mxl862xx_smdio_write`, and then reads them back with `mxl862xx_smdio_read`. If the read values don't match the written ones, it returns `-ENODEV`. My immediate thought is, if there's no hardware connected, the `mxl862xx_smdio_read` calls will likely return some default value, maybe `0xffff` or `0`, right? These won't match the expected probe values (`0x5a5a` and `0xa5a5` in this example). Consequently, the `rescue` variable will become `-ENODEV`. This, in turn, will cause `mxl862xx_setup` to return `-ENODEV`, and the driver will, therefore, fail its probe. So, logically, if there's no physical hardware, the driver will always fail during the probe. Now, the real question is, how do I emulate this for testing purposes, specifically with syzkaller? Syzkaller doesn't seem to have direct support for mocking MDIO reads. However, a thought just struck me. What if syzkaller can inject MDIO devices? I vaguely remember something called `mdio-mockup` or something similar. Let's dig and see if we have access to a tool like `mdio-mockup` to simulate MDIO devices and control the read responses. That could be a workaround to test the failure path without needing physical hardware!
18/2	2026/08/03 04:48	tool	grepper	0m Error: no matches Args: { "Expression": "mdio-mockup" } Results: { "error": "no matches" }
19/2	2026/08/03 04:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 56542 output: 19 thoughts: 10 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: Initial Assessment of the `mdio_mockup` Consideration Alright, so the prompt throws in `mdio_mockup`. My first reaction is to quickly evaluate its potential relevance. The fact that it's just mentioned, without any context, immediately triggers a mental checklist. Is it a tool, a library, a design pattern, or some specific piece of code I need to consider? I need to think about what the original prompt and problem were that lead to this consideration. Is this an approach that I have considered before, and if not, how might it relate to the existing design?
20/2	2026/08/03 04:48	tool	grepper	0m Error: no matches Args: { "Expression": "mdio_mockup" } Results: { "error": "no matches" }
21/2	2026/08/03 04:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 56735 output: 18 thoughts: 9 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: Initial Inquiry: MDIO Dummy Consideration Alright, so the question is, what about `mdio-dummy`? It's a fairly specific prompt, implying a pre-existing context – most likely, we're talking about an MDIO interface, and this "dummy" component is relevant to a specific problem or scenario. My immediate thought process begins to branch out: Is this about testing? Simulation? Emulation of a PHY? Perhaps the actual hardware isn't available, or it's a software-only development phase and we need a stand-in for the PHY interaction. The utility of an MDIO dummy depends massively on the specific problem at hand. We're obviously at a point where a placeholder or test harness for MDIO functionality may be critical.
22/2	2026/08/03 04:48	tool	grepper	0m Error: no matches Args: { "Expression": "mdio-dummy" } Results: { "error": "no matches" }
23/2	2026/08/03 04:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 56962 output: 18 thoughts: 9 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm an expert in this field, and rendered in the first person: Considering a Specific Abstraction Hmm, the task at hand… I'm thinking about the most appropriate approach for managing this particular hardware interface. Should I reach for a more generalized solution, or something tailored? And then it hits me: what about `dummy_mdio`? It's a tempting idea, as this abstraction is designed for a scenario with MDIO. I need to consider if `dummy_mdio` fits into the design, and if there are considerations with its use.
24/2	2026/08/03 04:48	tool	grepper	0m Error: no matches Args: { "Expression": "dummy_mdio" } Results: { "error": "no matches" }
25/2	2026/08/03 04:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 57137 output: 111 thoughts: 358 Thoughts: My Assessment of the Code Patch Okay, let me think this through. The question is whether this code is worth fuzzing. I need to determine if it's reachable in a virtualized environment like QEMU. The prompt explicitly says to return `WorthFuzzing=false` if the patch involves vendor-specific drivers for things like PCIe switches or GPUs that demand physical hardware. Looking at the code, this `mxl862xx` driver immediately raises a flag. It's a vendor-specific driver for an MDIO switch. And, right off the bat, I suspect it relies on physical hardware, specifically something like a MaxLinear switch chip. My initial impression is that this is not going to work without the actual physical hardware. It seems very likely it's impossible to reach in a virtualized environment. Just to be certain, I'll quickly confirm my initial assessment. I'll double-check the code to be sure. Yep, the `mxl862xx_probe` function takes a `struct mdio_device *mdiodev` argument, and the driver itself is an `mdio_driver`. This confirms that it's interacting with the MDIO bus. Without a specific emulation of the `mxl862xx` chip in QEMU, the driver will never probe correctly. It will be looking for specific responses over MDIO. It will look for `MXL862XX_SB_PDI_PROBE_A` and `MXL862XX_SB_PDI_PROBE_D`, which will not be there, as no hardware is actually present. So, the firmware flashing and devlink code changes within this patch are simply unreachable for fuzzing purposes. We won't be able to trigger those code paths with syzkaller. Therefore, I'm confident in returning `WorthFuzzing=false` and I'll use `set-results` to reflect my conclusion.
26/2	2026/08/03 04:48	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.", "WorthFuzzing": false }

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.",
  "WorthFuzzing": false
}

{
  "PatchDiff": "commit 15bf5418d47d7d5e1b4a3bc26285fcb69c18c1b8\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Aug 3 04:46:56 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/Documentation/networking/devlink/index.rst b/Documentation/networking/devlink/index.rst\nindex 4745148fecf4f..058999d0dc56f 100644\n--- a/Documentation/networking/devlink/index.rst\n+++ b/Documentation/networking/devlink/index.rst\n@@ -94,6 +94,7 @@ parameters, info versions, and other features it supports.\n    mlx5\n    mlxsw\n    mv88e6xxx\n+   mxl862xx\n    netdevsim\n    nfp\n    octeontx2\ndiff --git a/Documentation/networking/devlink/mxl862xx.rst b/Documentation/networking/devlink/mxl862xx.rst\nnew file mode 100644\nindex 0000000000000..7c2dc11f65856\n--- /dev/null\n+++ b/Documentation/networking/devlink/mxl862xx.rst\n@@ -0,0 +1,71 @@\n+.. SPDX-License-Identifier: GPL-2.0\n+\n+========================\n+mxl862xx devlink support\n+========================\n+\n+This document describes the devlink features implemented by the\n+``mxl862xx`` device driver.\n+\n+Info versions\n+=============\n+\n+The ``mxl862xx`` driver reports the following versions\n+\n+.. list-table:: devlink info versions implemented\n+   :widths: 5 5 5 85\n+\n+   * - Name\n+     - Type\n+     - Example\n+     - Description\n+   * - ``asic.id``\n+     - fixed\n+     - 8628\n+     - The chip part number read from the CHIP ID registers. Omitted\n+       when the part number reads as zero, which happens for a switch\n+       sitting in MCUboot rescue mode (the registers need a running\n+       firmware), for an unfused part, and after a failed flash.\n+   * - ``asic.rev``\n+     - fixed\n+     - 0\n+     - The chip version read from the same register word, so it is\n+       omitted whenever ``asic.id`` is.\n+   * - ``fw``\n+     - running, stored\n+     - 1.0.70\n+     - Version of the firmware running on the switch, reported as both\n+       running and stored since the switch boots it from its own flash.\n+       It is omitted while no firmware version is known: after a failed\n+       flash, and in MCUboot rescue mode while an interrupted download\n+       is still being recovered in the background. Once the loader is\n+       ready to accept a new image the version appears as \"0.0.0\",\n+       which no released firmware reports, so version-comparing tools\n+       offer any available release as an upgrade. Use ``devlink dev\n+       flash`` to tell a recovering switch from a ready one, see below;\n+       a missing version on its own does not say why.\n+\n+Flash update\n+============\n+\n+The ``mxl862xx`` driver implements support for ``devlink dev flash``.\n+The signed firmware image is transferred to the switch over the same\n+MDIO bus which is also used to manage the switch, then verified and\n+installed by the MCUboot bootloader running on the switch. All ports\n+of the switch are closed for the duration of the update and the driver\n+reprobes the switch after it has rebooted into the new firmware. A\n+complete flash and reprobe cycle takes about one minute.\n+\n+A switch stuck in MCUboot rescue mode, e.g. after an interrupted\n+update, is registered without user ports. If the previous download was\n+interrupted mid-transfer the loader is wedged; the driver drains it\n+back to a clean ready state in the background, one byte at a time,\n+which takes tens of minutes for a large image and is reported through\n+the kernel log as it progresses. During that recovery ``devlink dev\n+flash`` returns ``-EBUSY`` with an extack message saying so, and\n+``devlink dev info`` reports no firmware version. Once the loader is\n+ready the firmware version appears and flashing a firmware image\n+through the regular update flow recovers the switch.\n+\n+If the recovery fails, the loader needs a power cycle: ``devlink dev\n+flash`` then returns ``-EIO`` and says so in its extack message.\ndiff --git a/MAINTAINERS b/MAINTAINERS\nindex 932ea1db048e5..c27c449159c5a 100644\n--- a/MAINTAINERS\n+++ b/MAINTAINERS\n@@ -16107,6 +16107,7 @@ M:\tDaniel Golle \u003cdaniel@makrotopia.org\u003e\n L:\tnetdev@vger.kernel.org\n S:\tMaintained\n F:\tDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml\n+F:\tDocumentation/networking/devlink/mxl862xx.rst\n F:\tdrivers/net/dsa/mxl862xx/\n F:\tnet/dsa/tag_mxl862xx.c\n \ndiff --git a/drivers/net/dsa/mxl862xx/Makefile b/drivers/net/dsa/mxl862xx/Makefile\nindex a7be0e6669dfa..bccac0d0f703f 100644\n--- a/drivers/net/dsa/mxl862xx/Makefile\n+++ b/drivers/net/dsa/mxl862xx/Makefile\n@@ -1,3 +1,3 @@\n # SPDX-License-Identifier: GPL-2.0\n obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o\n-mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o\n+mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-api.h b/drivers/net/dsa/mxl862xx/mxl862xx-api.h\nindex a180a5decffc0..6f771895984cb 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-api.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-api.h\n@@ -1224,6 +1224,16 @@ struct mxl862xx_sys_fw_image_version {\n \t__le32 iv_build_num;\n } __packed;\n \n+/**\n+ * struct mxl862xx_sys_reg_rw - System register read/write\n+ * @addr: 32-bit register address\n+ * @val: register value\n+ */\n+struct mxl862xx_sys_reg_rw {\n+\t__le32 addr;\n+\t__le32 val;\n+} __packed;\n+\n /**\n  * enum mxl862xx_port_type - Port Type\n  * @MXL862XX_LOGICAL_PORT: Logical Port\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h\nindex c87a955c13c48..a865425aa61e1 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h\n@@ -70,7 +70,9 @@\n #define INT_GPHY_READ\t\t\t(GPY_GPY2XX_MAGIC + 0x1)\n #define INT_GPHY_WRITE\t\t\t(GPY_GPY2XX_MAGIC + 0x2)\n \n+#define SYS_MISC_FW_UPDATE\t\t(SYS_MISC_MAGIC + 0x1)\n #define SYS_MISC_FW_VERSION\t\t(SYS_MISC_MAGIC + 0x2)\n+#define SYS_MISC_REG_RD\t\t\t(SYS_MISC_MAGIC + 0x8)\n \n #define MXL862XX_XPCS_PCS_CONFIG\t(MXL862XX_XPCS_MAGIC + 0x1)\n #define MXL862XX_XPCS_PCS_GET_STATE\t(MXL862XX_XPCS_MAGIC + 0x2)\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.c b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c\nnew file mode 100644\nindex 0000000000000..94aa658a62db9\n--- /dev/null\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c\n@@ -0,0 +1,1102 @@\n+// SPDX-License-Identifier: GPL-2.0-or-later\n+/*\n+ * Firmware flash and devlink support for MaxLinear MxL862xx\n+ *\n+ * Copyright (C) 2025 Daniel Golle \u003cdaniel@makrotopia.org\u003e\n+ *\n+ * SB PDI - firmware download interface over clause-22 SMDIO\n+ * =========================================================\n+ *\n+ * The MxL862xx MCUboot loader accepts a firmware image through four \"SB PDI\"\n+ * registers in the switch SMDIO register space. It runs whenever no WSP\n+ * firmware is active: the normal firmware update enters it deliberately - the\n+ * SYS_MISC_FW_UPDATE API command sets a sticky rescue bit and reboots into\n+ * MCUboot - and the loader also stays here when the stored WSP firmware fails\n+ * its boot-time integrity check. This driver drives the loader's 0xc55c\n+ * \"console\" download path.\n+ *\n+ * SMDIO register access (mxl862xx_smdio_read/write):\n+ *   MII reg 0x1f := (\u003csb_pdi_reg\u003e \u0026 0xfff0)   ; page latch\n+ *   MII reg (\u003csb_pdi_reg\u003e \u0026 0x000f) := / =\u003e \u003cu16 data\u003e\n+ * so CTRL/ADDR/DATA/STAT (0xe100..0xe103) are MII regs 0/1/2/3 of page\n+ * 0xe100, not all reg 0x00.\n+ *\n+ * SB PDI registers (host name/addr  -\u003e  MCU mailbox):\n+ *   CTRL 0xe100 -\u003e 0xc0938400   mode: RST=0x00  RD=0x01  WR=0x02\n+ *   ADDR 0xe101 -\u003e 0xc0938404   SB target word address (SB1 bank = 0x7800)\n+ *   DATA 0xe102 -\u003e 0xc0938408   16-bit data / reply word\n+ *   STAT 0xe103 -\u003e 0xc093840c   handshake: a magic (below) or a byte count\n+ *\n+ * STAT magics:\n+ *   READY  0xc55c   loader idle in the console loop        (this driver)\n+ *   DL_RDY 0xc33c   loader idle in the flashless loop\n+ *   START  0xf48f   host   -\u003e begin download session\n+ *   ACK    0xf490   loader -\u003e START acknowledged (START + 1)\n+ *   END    0x3cc3   host   -\u003e finalise now (optional, see below)\n+ *   RDREG  0xe2c0   host   -\u003e register-read command (| index), see below\n+ *\n+ * Console flash path (STAT=0xc55c) - mxl862xx_flash_firmware():\n+ *\n+ *   host                                   loader\n+ *   ----                                   ------\n+ *   reset (CTRL=ADDR=DATA=0)\n+ *   read STAT ............................ 0xc55c   (READY, idle)\n+ *   STAT := START(0xf48f)  --------------\u003e\n+ *                          \u003c-------------- STAT = 0xf490 (ACK)\n+ *   CTRL := WR\n+ *   DATA := hdr[0..9]  (20-byte header: type,size1,crc1,size2,crc2)\n+ *   reset; STAT := 20 (header len)  -----\u003e parse hdr; r_remain=size1+size2;\n+ *                                          ERASE target region(s)\n+ *                          \u003c-------------- STAT=21 (len+1), then STAT=0\n+ *                                          (erased)\n+ *   -- payload, streamed in slices: --\n+ *   CTRL := WR\n+ *   DATA := word x N ...\n+ *     at word 16384: CTRL:=RST; ADDR:=0x7800; CTRL:=WR  (half-bank -\u003e SB1)\n+ *     at word 32760: flush slice:\n+ *        reset; STAT := \u003cbytes_this_slice\u003e ---\u003e r_remain -= bytes; program\n+ *                          \u003c------------------- STAT=0  (ready for next slice)\n+ *   ... repeat until the whole payload is sent ...\n+ *                          \u003c------------------- STAT=0  image verified\n+ *                                               (STAT=1: image rejected)\n+ *   STAT := END(0x3cc3)  ---------------------\u003e finalise and boot\n+ *\n+ * The r_remain == 0 rule (critical):\n+ *   Every host STAT write in the payload phase is a byte count; the loader\n+ *   does r_remain -= count and stays in the receive loop while r_remain != 0.\n+ *   It leaves the loop ONLY when r_remain hits EXACTLY 0, and a count larger\n+ *   than r_remain underflows the 32-bit counter and wedges the loader until a\n+ *   power cycle. Having left it, the loader verifies the image, publishes the\n+ *   verdict in STAT (0 good, 1 rejected) and waits 2 s for END before\n+ *   finalising regardless -- clearing its rescue-enable bit so boot_go boots\n+ *   the new image -- so END only saves that wait. Hence:\n+ *     - never send a slice/chunk count larger than what is outstanding;\n+ *     - a STAT write is a command only once the loader has left the loop;\n+ *     - the loader leaves the count in STAT while it programs the chunk, so\n+ *       a lingering count does not distinguish \"busy\" from \"verdict\";\n+ *     - interrupted-download recovery feeds 1 byte at a time (see below).\n+ *\n+ * Interrupted-flash recovery (mxl862xx_rescue_drain):\n+ *   A host that dies mid-payload leaves the loader in the receive loop holding\n+ *   STAT=0. Feed single 1-byte chunks (one DATA word + STAT=1) until r_remain\n+ *   reaches 0; the loader then verifies the (now corrupt) image, publishes its\n+ *   verdict and comes back to READY by itself. END is never sent here: while\n+ *   r_remain is non-zero it would be consumed as a 15555-byte count, and a\n+ *   lingering STAT=1 cannot be told from a chunk still being programmed.\n+ *\n+ * Register-read challenge (non-destructive liveness proof):\n+ *   DATA := 0x7c23 (marker); STAT := 0xe2c0|idx\n+ *     -\u003e loader returns a runtime word in DATA and re-arms STAT=0xc55c.\n+ *   The reply source is loader BSS, not a chip id; used only to prove a live\n+ *   mailbox in mxl862xx_rescue_mode_detect().\n+ *\n+ * The other STAT ready magic, 0xc33c, marks the loader's flashless\n+ * chip-to-chip download mode (MxL86281S 16-port tier); this driver does not\n+ * use it.\n+ *\n+ * Rescue lifecycle (devlink): probe runs mxl862xx_rescue_mode_detect(); a\n+ * wedged loader is drained back to READY by a background self-heal\n+ * (rescue_heal_work), so the long recovery never holds the devlink lock.\n+ * devlink dev info exposes the fw version (the \"flashable\" signal) only once at\n+ * READY; flash_update returns -EBUSY until then, and reprobes to WSP firmware\n+ * on success.\n+ *\n+ * Notes:\n+ *   - Chip id/revision (0xc0d28884/88) are NOT reachable on this channel; they\n+ *     need the clause-45 MMD firmware mailbox, which is dead under MCUboot.\n+ *     Rescue identity is by SB PDI behaviour only (mxl862xx_rescue_mode_detect).\n+ *   - The SMDIO PHY address comes from the device tree; the 0xe1xx register\n+ *     offsets are the OTP reset defaults and the only layout supported here.\n+ */\n+\n+#include \u003clinux/crc32.h\u003e\n+#include \u003clinux/delay.h\u003e\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/iopoll.h\u003e\n+#include \u003clinux/module.h\u003e\n+#include \u003clinux/netdevice.h\u003e\n+#include \u003clinux/overflow.h\u003e\n+#include \u003clinux/rtnetlink.h\u003e\n+#include \u003clinux/workqueue.h\u003e\n+#include \u003cnet/dsa.h\u003e\n+#include \u003cnet/switchdev.h\u003e\n+\n+#include \"mxl862xx.h\"\n+#include \"mxl862xx-api.h\"\n+#include \"mxl862xx-cmd.h\"\n+#include \"mxl862xx-fw.h\"\n+#include \"mxl862xx-host.h\"\n+\n+/* SB PDI registers (clause-22 SMDIO address space) */\n+#define MXL862XX_SB_PDI_CTRL\t\t0xe100\n+#define MXL862XX_SB_PDI_ADDR\t\t0xe101\n+#define MXL862XX_SB_PDI_DATA\t\t0xe102\n+#define MXL862XX_SB_PDI_STAT\t\t0xe103\n+\n+/* SB PDI CTRL modes */\n+#define MXL862XX_SB_PDI_CTRL_RST\t0x00\n+#define MXL862XX_SB_PDI_CTRL_WR\t\t0x02\n+\n+/* SB PDI handshake magic (published/consumed via STAT) */\n+#define MXL862XX_SB_PDI_READY\t\t0xc55c\t/* loader idle, console loop */\n+#define MXL862XX_SB_PDI_DL_READY\t0xc33c\t/* loader idle, flashless loop */\n+#define MXL862XX_SB_PDI_START\t\t0xf48f\n+#define MXL862XX_SB_PDI_END\t\t0x3cc3\n+#define MXL862XX_SB_PDI_RDREG\t\t0xe2c0\t/* register-read cmd (| index) */\n+#define MXL862XX_SB_PDI_RDREG_MARK\t0x7c23\t/* marker placed in DATA for RDREG */\n+\n+/* Behavioural presence probe: two distinct 16-bit latches on ADDR/DATA. */\n+#define MXL862XX_SB_PDI_PROBE_A\t\t0x5a5a\n+#define MXL862XX_SB_PDI_PROBE_D\t\t0xa5a5\n+\n+/* Image verification verdict published in STAT once the receive loop ends */\n+#define MXL862XX_SB_PDI_VERIFY_OK\t0\n+#define MXL862XX_SB_PDI_VERIFY_BAD\t1\n+\n+/* Firmware transfer geometry */\n+#define MXL862XX_FW_HDR_SIZE\t\t20\n+#define MXL862XX_FW_BANK_HALF\t\t16384\t/* words per half-bank */\n+#define MXL862XX_FW_BANK_SLICE\t\t32760\t/* words per full slice */\n+#define MXL862XX_FW_SB1_ADDR\t\t0x7800\t/* SB1 word address */\n+\n+/* Timeouts (generous upper bounds) */\n+#define MXL862XX_FW_READY_TIMEOUT_MS\t3000\n+#define MXL862XX_FW_ACK_TIMEOUT_MS\t5000\n+#define MXL862XX_FW_ERASE_TIMEOUT_MS\t300000\n+#define MXL862XX_FW_WRITE_TIMEOUT_MS\t120000\n+#define MXL862XX_FW_REBOOT_DELAY_MS\t5000\n+#define MXL862XX_FW_REPROBE_DELAY_MS\t500\n+#define MXL862XX_RESCUE_READY_TIMEOUT_MS 1000\n+#define MXL862XX_DRAIN_POLL_MS\t\t2000\n+/* Covers the loader's END wait, verification and the reset into READY */\n+#define MXL862XX_DRAIN_DONE_MS\t\t15000\n+\n+static int mxl862xx_sb_pdi_reset(struct mxl862xx_priv *priv)\n+{\n+\tint ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t   MXL862XX_SB_PDI_CTRL_RST);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n+\t\t\t\t   MXL862XX_SB_PDI_CTRL_RST);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\treturn mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n+\t\t\t\t    MXL862XX_SB_PDI_CTRL_RST);\n+}\n+\n+static int mxl862xx_sb_pdi_poll_stat(struct mxl862xx_priv *priv, u16 expected,\n+\t\t\t\t     unsigned long timeout_ms)\n+{\n+\tint ret, val;\n+\n+\tret = read_poll_timeout(mxl862xx_smdio_read, val,\n+\t\t\t\tval \u003c 0 || (u16)val == expected,\n+\t\t\t\t10000, timeout_ms * 1000, false,\n+\t\t\t\tpriv, MXL862XX_SB_PDI_STAT);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\treturn ret;\n+}\n+\n+static int mxl862xx_sb_pdi_flush_slice(struct mxl862xx_priv *priv,\n+\t\t\t\t       u32 data_written)\n+{\n+\tint ret;\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\treturn mxl862xx_sb_pdi_poll_stat(priv, 0,\n+\t\t\t\t\t MXL862XX_FW_WRITE_TIMEOUT_MS);\n+}\n+\n+/* Flush the last slice, which ends the receive loop: the loader verifies the\n+ * image and replaces the count in STAT with its verdict, so wait for the count\n+ * to go rather than for a fixed value.\n+ */\n+static int mxl862xx_sb_pdi_flush_last(struct mxl862xx_priv *priv,\n+\t\t\t\t      u32 data_written)\n+{\n+\tint ret, val;\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = read_poll_timeout(mxl862xx_smdio_read, val,\n+\t\t\t\tval \u003c 0 || (u16)val != (u16)data_written,\n+\t\t\t\t10000, MXL862XX_FW_WRITE_TIMEOUT_MS * 1000,\n+\t\t\t\tfalse, priv, MXL862XX_SB_PDI_STAT);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\n+\tif (!ret \u0026\u0026 (u16)val == MXL862XX_SB_PDI_VERIFY_OK)\n+\t\treturn 0;\n+\n+\t/* A final count of 1 is indistinguishable from the reject verdict, so\n+\t * a timeout still holding it lands here too.\n+\t */\n+\tif ((u16)val == MXL862XX_SB_PDI_VERIFY_BAD) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: loader rejected the image\\n\");\n+\t\treturn -EBADMSG;\n+\t}\n+\n+\treturn ret ? ret : -EPROTO;\n+}\n+\n+static void mxl862xx_flash_notify(struct devlink *dl, const char *status,\n+\t\t\t\t  u32 done, u32 total)\n+{\n+\tdevlink_flash_update_status_notify(dl, status, NULL, done, total);\n+}\n+\n+/* Post-flash reprobe. device_reprobe() detaches the driver -- running\n+ * remove(), which frees priv -- then re-probes, so this work touches only its\n+ * own device and module references and frees itself. A re-probe failure leaves\n+ * the device unbound, exactly as a failed initial probe would, so it is only\n+ * logged. Running from a workqueue keeps device_reprobe() out of the devlink\n+ * caller's locking and signal context.\n+ */\n+struct mxl862xx_reprobe {\n+\tstruct delayed_work work;\n+\tstruct device *dev;\n+};\n+\n+static void mxl862xx_reprobe_work_fn(struct work_struct *work)\n+{\n+\tstruct mxl862xx_reprobe *rp =\n+\t\tcontainer_of(work, struct mxl862xx_reprobe, work.work);\n+\tstruct device *dev = rp-\u003edev;\n+\n+\tif (device_reprobe(dev))\n+\t\tdev_err(dev, \"reprobe failed; device left unbound\\n\");\n+\tput_device(dev);\n+\tkfree(rp);\n+\tmodule_put(THIS_MODULE);\n+}\n+\n+/* Allocate the reprobe up front, before the switch is disturbed, so an\n+ * allocation failure aborts cleanly. The caller holds a module and a device\n+ * reference; the work releases both once it runs. Returns NULL on -ENOMEM.\n+ */\n+static struct mxl862xx_reprobe *mxl862xx_reprobe_alloc(struct device *dev)\n+{\n+\tstruct mxl862xx_reprobe *rp;\n+\n+\trp = kzalloc_obj(*rp);\n+\tif (!rp)\n+\t\treturn NULL;\n+\trp-\u003edev = dev;\n+\tINIT_DELAYED_WORK(\u0026rp-\u003ework, mxl862xx_reprobe_work_fn);\n+\treturn rp;\n+}\n+\n+/* Byte-count of each chunk fed to the loader during drain. It MUST be 1: the\n+ * loader only lets us observe \"counter == 0\", never \"counter \u003c step\", so any\n+ * step \u003e 1 can subtract past zero, underflow the 32-bit counter and wedge the\n+ * loader for ~2^32 more bytes (a state only a power cycle clears). Stepping by\n+ * 1 walks the counter through every value and is guaranteed to land on zero\n+ * whatever its (possibly odd) start. A 1-byte chunk is a path the loader\n+ * already handles: the normal transfer ends with a single trailing byte for\n+ * odd-sized images (see Step 6).\n+ */\n+#define MXL862XX_DRAIN_CHUNK_BYTES\t1\n+\n+/* Log the drain's progress every so many bytes; it can run for a long time */\n+#define MXL862XX_DRAIN_LOG_BYTES\t(128 * 1024)\n+\n+/* Wait for the loader to ask for the next chunk (STAT 0) or to come back to its\n+ * command loop (STAT READY), and return the STAT value either way. On timeout\n+ * that is whatever STAT still holds, which carries no further information: the\n+ * loader keeps the count we wrote visible while it programs the chunk, and that\n+ * is the same value it publishes as the \"image rejected\" verdict once the\n+ * counter reaches zero.\n+ */\n+static int mxl862xx_sb_pdi_poll_drain(struct mxl862xx_priv *priv,\n+\t\t\t\t      unsigned long timeout_ms)\n+{\n+\tint val;\n+\n+\tread_poll_timeout(mxl862xx_smdio_read, val,\n+\t\t\t  val \u003c 0 || (u16)val == MXL862XX_SB_PDI_READY ||\n+\t\t\t  (u16)val == 0,\n+\t\t\t  50, timeout_ms * 1000, false,\n+\t\t\t  priv, MXL862XX_SB_PDI_STAT);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\treturn (u16)val;\n+}\n+\n+/* The loader is not asking for a chunk: it may still be programming the last\n+ * one, or the counter has reached zero and it is verifying the image and\n+ * resetting into READY. Wait that out -- STAT cannot tell the two apart, and\n+ * guessing would mean writing END into a live receive loop. Returns 0 once the\n+ * loader has left the loop, -EAGAIN if it asks for another chunk after all.\n+ */\n+static int mxl862xx_rescue_drain_finish(struct mxl862xx_priv *priv, u32 chunk)\n+{\n+\tstruct device *dev = \u0026priv-\u003emdiodev-\u003edev;\n+\tint stat;\n+\n+\tstat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_DONE_MS);\n+\tif (stat \u003c 0)\n+\t\treturn stat;\n+\tif (stat == MXL862XX_SB_PDI_READY)\n+\t\treturn 0;\n+\tif (stat == MXL862XX_SB_PDI_VERIFY_BAD) {\n+\t\tdev_err(dev,\n+\t\t\t\"flash: loader stuck after %u chunks, power cycle it\\n\",\n+\t\t\tchunk);\n+\t\treturn -EIO;\n+\t}\n+\tif (stat) {\n+\t\t/* A firmware is answering, not the loader: an image survived\n+\t\t * in flash and booted.\n+\t\t */\n+\t\tdev_info(dev, \"flash: firmware booted while draining\\n\");\n+\t\treturn 0;\n+\t}\n+\n+\treturn -EAGAIN;\n+}\n+\n+/* Recover a switch whose SB PDI download was interrupted mid-transfer - the\n+ * host died after MCUboot began erasing flash, whether it aborted mid erase or\n+ * mid image-write, both end up in the same place: the payload receive loop.\n+ * There the loader publishes STAT=0, waits for the host to write a byte-count\n+ * to STAT, DMAs that many bytes and subtracts the count from a remaining-bytes\n+ * counter, leaving the loop only when the counter reaches exactly zero. The\n+ * image size died with the host, so we feed single-byte chunks (see\n+ * MXL862XX_DRAIN_CHUNK_BYTES) to walk the counter to zero without underflow.\n+ * The loader then verifies the (now corrupt) image and returns to READY by\n+ * itself, or boots a valid image that happened to survive in flash; either way\n+ * the caller's reprobe classifies the result. Every byte costs about a dozen\n+ * MDIO frames, so a multi-MiB outstanding count takes tens of minutes.\n+ * Returns 0 once the loader has left the receive loop, \u003c0 on error. Does NOT\n+ * recover a counter already underflowed by an earlier oversized-chunk attempt\n+ * - that needs a power cycle.\n+ */\n+static int mxl862xx_rescue_drain(struct mxl862xx_priv *priv)\n+{\n+\tstruct device *dev = \u0026priv-\u003emdiodev-\u003edev;\n+\t/* Bound: twice the loader's 16 MiB image cap, one byte per chunk. */\n+\tu32 max_chunks = 2u * (16u \u003c\u003c 20) / MXL862XX_DRAIN_CHUNK_BYTES;\n+\tu32 chunk = 0;\n+\tint ret, stat;\n+\n+\twhile (chunk \u003c max_chunks) {\n+\t\t/* Teardown can interrupt this long drain. */\n+\t\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n+\t\t\treturn -ECANCELED;\n+\n+\t\tstat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_POLL_MS);\n+\t\tif (stat \u003c 0)\n+\t\t\treturn stat;\n+\t\tif (stat == MXL862XX_SB_PDI_READY)\n+\t\t\treturn 0;\n+\n+\t\tif (stat) {\n+\t\t\tret = mxl862xx_rescue_drain_finish(priv, chunk);\n+\t\t\tif (ret != -EAGAIN)\n+\t\t\t\treturn ret;\n+\t\t}\n+\n+\t\t/* Feed one zero byte; reset cleared the write latch. */\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t   MXL862XX_SB_PDI_CTRL_WR);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_sb_pdi_reset(priv);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t\t   MXL862XX_DRAIN_CHUNK_BYTES);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tchunk++;\n+\t\tif (!(chunk % MXL862XX_DRAIN_LOG_BYTES))\n+\t\t\tdev_info(dev, \"flash: drained %u KiB so far\\n\",\n+\t\t\t\t chunk / 1024);\n+\t\tcond_resched();\n+\t}\n+\n+\tdev_err(dev,\n+\t\t\"flash: interrupted download did not drain after %u chunks\\n\",\n+\t\tchunk);\n+\n+\treturn -ETIMEDOUT;\n+}\n+\n+/* Background self-heal: drain a wedged download off the devlink flash path, so\n+ * the long recovery never holds the devlink lock. Scheduled from probe;\n+ * reprobes on success so the probe-time detection re-classifies the switch.\n+ */\n+void mxl862xx_rescue_heal_work_fn(struct work_struct *work)\n+{\n+\tstruct mxl862xx_priv *priv =\n+\t\tcontainer_of(work, struct mxl862xx_priv, rescue_heal_work);\n+\tstruct device *dev = \u0026priv-\u003emdiodev-\u003edev;\n+\tstruct mxl862xx_reprobe *ko;\n+\tint ret;\n+\n+\tret = mxl862xx_rescue_drain(priv);\n+\tif (ret == -ECANCELED)\n+\t\treturn;\n+\tif (ret) {\n+\t\t/* Nothing retries this, so say so: rescue_ready stays clear\n+\t\t * and devlink dev flash reports why it refuses.\n+\t\t */\n+\t\tdev_err(dev, \"flash: download recovery failed: %pe\\n\",\n+\t\t\tERR_PTR(ret));\n+\t\tWRITE_ONCE(priv-\u003erescue_failed, true);\n+\t\treturn;\n+\t}\n+\n+\t/* The interrupted transfer is finalised; reprobe so the probe-time\n+\t * detection brings the driver up -- flashable in rescue mode if the\n+\t * loader is at READY, or normally if a valid image booted. The refs\n+\t * are released by the reprobe once it completes. heal_lock makes the\n+\t * flag test and the queueing atomic against teardown, which cannot\n+\t * cancel a work item this one has already queued.\n+\t */\n+\tmutex_lock(\u0026priv-\u003eheal_lock);\n+\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n+\t\tgoto out;\n+\tif (!try_module_get(THIS_MODULE))\n+\t\tgoto out;\n+\tget_device(dev);\n+\tko = mxl862xx_reprobe_alloc(dev);\n+\tif (!ko) {\n+\t\tput_device(dev);\n+\t\tmodule_put(THIS_MODULE);\n+\t\tgoto out;\n+\t}\n+\tqueue_delayed_work(system_long_wq, \u0026ko-\u003ework,\n+\t\t\t   msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));\n+out:\n+\tmutex_unlock(\u0026priv-\u003eheal_lock);\n+}\n+\n+/* Detect MCUboot rescue mode over clause-22 SMDIO alone, so the caller can rule\n+ * the loader out before any C45 API request (which spews CRC errors when no WSP\n+ * firmware answers). A scratch write to ADDR/DATA must latch or the chip is\n+ * absent (-ENODEV); the mailbox is reset first, or a transfer interrupted with\n+ * CTRL=WR would take that write as a payload word instead of latching it. STAT\n+ * then classifies the state, poked destructively only when 0, the one value a\n+ * running firmware never holds:\n+ *\n+ *  - 0xc33c: flashless loop; recognised but not supported here.\n+ *  - 0xc55c: console loop, if the register-read challenge is serviced.\n+ *  - other non-zero: running firmware, left unpoked.\n+ *  - 0: wedged receive loop; the 1-byte slice-advance then says whether it\n+ *    still needs draining or has just finished.\n+ *\n+ * Return: MXL862XX_IN_RESCUE, MXL862XX_NOT_RESCUE, -ENODEV when nothing\n+ * answers, -EOPNOTSUPP for the flashless loop, -ENXIO for a READY loader whose\n+ * mailbox fails the challenge, or an SMDIO bus error.\n+ */\n+int mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv)\n+{\n+\tint stat, dat, ret, rb, a, d;\n+\n+\t/* rescue_ready gates flashing; a wedged loader needs the drain first. */\n+\tWRITE_ONCE(priv-\u003erescue_ready, false);\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\t/* Presence: a live chip latches the scratch write, an absent one floats. */\n+\ta = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n+\t\t\t\t MXL862XX_SB_PDI_PROBE_A);\n+\tif (a \u003c 0)\n+\t\treturn a;\n+\td = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n+\t\t\t\t MXL862XX_SB_PDI_PROBE_D);\n+\tif (d \u003c 0)\n+\t\treturn d;\n+\ta = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_ADDR);\n+\tif (a \u003c 0)\n+\t\treturn a;\n+\td = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n+\tif (d \u003c 0)\n+\t\treturn d;\n+\tif ((u16)a != MXL862XX_SB_PDI_PROBE_A ||\n+\t    (u16)d != MXL862XX_SB_PDI_PROBE_D)\n+\t\treturn -ENODEV;\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tstat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);\n+\tif (stat \u003c 0)\n+\t\treturn stat;\n+\n+\t/* Flashless-download loop (MxL86281S tier): this driver does not\n+\t * support it -- the console flash path expects READY. Treat it as an\n+\t * unusable configuration, like any other unsupported state.\n+\t */\n+\tif ((u16)stat == MXL862XX_SB_PDI_DL_READY)\n+\t\treturn -EOPNOTSUPP;\n+\n+\t/* Console loop at READY: confirm the live mailbox with the register-read\n+\t * challenge (consumes the marker from DATA and re-arms READY).\n+\t */\n+\tif ((u16)stat == MXL862XX_SB_PDI_READY) {\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n+\t\t\t\t\t   MXL862XX_SB_PDI_RDREG_MARK);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t\t   MXL862XX_SB_PDI_RDREG);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\trb = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,\n+\t\t\t\t\t       MXL862XX_RESCUE_READY_TIMEOUT_MS);\n+\t\tdat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n+\t\tret = mxl862xx_sb_pdi_reset(priv);\n+\t\tif (rb \u003c 0)\n+\t\t\treturn rb;\n+\t\tif (dat \u003c 0)\n+\t\t\treturn dat;\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tif (!rb \u0026\u0026 (u16)dat != MXL862XX_SB_PDI_RDREG_MARK) {\n+\t\t\tWRITE_ONCE(priv-\u003erescue_ready, true);\n+\t\t\treturn MXL862XX_IN_RESCUE;\n+\t\t}\n+\t\treturn -ENXIO;\n+\t}\n+\n+\t/* Any other non-zero value is a running firmware, not a loader. */\n+\tif (stat)\n+\t\treturn MXL862XX_NOT_RESCUE;\n+\n+\t/* STAT == 0: a wedged receive loop takes a 1-byte slice-advance (feed\n+\t * one DATA word first, like a drain chunk) and asks for the next chunk\n+\t * by publishing 0 again. Had that byte been the last one outstanding,\n+\t * the loader leaves the loop instead and returns to READY, having\n+\t * consumed the advance -- proof enough of a live mailbox to skip the\n+\t * challenge. Anything else means it is still working on it. All three\n+\t * are rescue, so this never fails probe; only the drain does.\n+\t */\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t   MXL862XX_SB_PDI_CTRL_WR);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t   MXL862XX_DRAIN_CHUNK_BYTES);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\trb = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_RESCUE_READY_TIMEOUT_MS);\n+\tif (rb \u003c 0)\n+\t\treturn rb;\n+\tif (rb == MXL862XX_SB_PDI_READY)\n+\t\tWRITE_ONCE(priv-\u003erescue_ready, true);\n+\n+\treturn MXL862XX_IN_RESCUE;\n+}\n+\n+/* MCUboot firmware image header */\n+struct mxl862xx_fw_hdr {\n+\t__le32 image_type;\n+\t__le32 image_size_1;\n+\t__le32 image_checksum_1;\n+\t__le32 image_size_2;\n+\t__le32 image_checksum_2;\n+} __packed;\n+\n+static int mxl862xx_flash_validate(struct mxl862xx_priv *priv,\n+\t\t\t\t   const struct firmware *fw,\n+\t\t\t\t   u32 *payload_size)\n+{\n+\tconst struct mxl862xx_fw_hdr *hdr;\n+\tu32 size1, size2, total;\n+\tconst u8 *payload;\n+\tu32 crc;\n+\n+\tif (fw-\u003esize \u003c MXL862XX_FW_HDR_SIZE)\n+\t\treturn -EINVAL;\n+\n+\thdr = (const struct mxl862xx_fw_hdr *)fw-\u003edata;\n+\tpayload = fw-\u003edata + MXL862XX_FW_HDR_SIZE;\n+\tsize1 = le32_to_cpu(hdr-\u003eimage_size_1);\n+\tsize2 = le32_to_cpu(hdr-\u003eimage_size_2);\n+\n+\tif (check_add_overflow(size1, size2, \u0026total) ||\n+\t    total \u003e fw-\u003esize - MXL862XX_FW_HDR_SIZE) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: firmware file too small for declared size\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (!total) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: firmware file with empty payload\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (size1) {\n+\t\tcrc = ~crc32_le(~0U, payload, size1);\n+\t\tif (crc != le32_to_cpu(hdr-\u003eimage_checksum_1)) {\n+\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\"flash: image 1 CRC mismatch (got %08x, expected %08x)\\n\",\n+\t\t\t\tcrc, le32_to_cpu(hdr-\u003eimage_checksum_1));\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\t}\n+\n+\tif (size2) {\n+\t\tcrc = ~crc32_le(~0U, payload + size1, size2);\n+\t\tif (crc != le32_to_cpu(hdr-\u003eimage_checksum_2)) {\n+\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\"flash: image 2 CRC mismatch (got %08x, expected %08x)\\n\",\n+\t\t\t\tcrc, le32_to_cpu(hdr-\u003eimage_checksum_2));\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\t}\n+\n+\t*payload_size = total;\n+\n+\treturn 0;\n+}\n+\n+static int mxl862xx_flash_firmware(struct mxl862xx_priv *priv,\n+\t\t\t\t   const struct firmware *fw,\n+\t\t\t\t   u32 payload_size, struct devlink *dl)\n+{\n+\tconst u8 *payload = fw-\u003edata + MXL862XX_FW_HDR_SIZE;\n+\tu32 word_idx = 0, data_written = 0, idx = 0;\n+\tunsigned long next_notify = jiffies - 1;\n+\tu16 word, fdata;\n+\tint ret, i;\n+\n+\t/* Step 1: reboot the firmware into MCUboot rescue mode */\n+\tif (!priv-\u003erescue_mode) {\n+\t\tret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,\n+\t\t\t\t\tfalse, false);\n+\t\tif (ret) {\n+\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\"flash: FW_UPDATE command failed: %pe\\n\",\n+\t\t\t\tERR_PTR(ret));\n+\t\t\treturn ret;\n+\t\t}\n+\t}\n+\n+\t/* Step 2: wait for bootloader ready */\n+\tmxl862xx_flash_notify(dl, \"Waiting for bootloader\", 0, 0);\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\t/* Failures from here on end up at no_end, which returns the error\n+\t * without signalling END -- see there.\n+\t */\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,\n+\t\t\t\t\tMXL862XX_FW_READY_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: bootloader not ready: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/* Step 3: start handshake */\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t   MXL862XX_SB_PDI_START);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_START + 1,\n+\t\t\t\t\tMXL862XX_FW_ACK_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: start handshake failed: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/* Step 4: transfer image header */\n+\tmxl862xx_flash_notify(dl, \"Erasing flash\", 0, 0);\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t   MXL862XX_SB_PDI_CTRL_WR);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\tfor (i = 0; i \u003c MXL862XX_FW_HDR_SIZE / 2; i++) {\n+\t\tword = fw-\u003edata[i * 2] |\n+\t\t       ((u16)fw-\u003edata[i * 2 + 1] \u003c\u003c 8);\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, word);\n+\t\tif (ret \u003c 0)\n+\t\t\tgoto write_err;\n+\t}\n+\n+\tret = mxl862xx_sb_pdi_reset(priv);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\t/* the byte count in STAT triggers the erase */\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t   MXL862XX_FW_HDR_SIZE);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\t/* ACK is byte count + 1 */\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_FW_HDR_SIZE + 1,\n+\t\t\t\t\tMXL862XX_FW_ACK_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: header ACK failed: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/* Step 5: wait for erase to complete */\n+\tret = mxl862xx_sb_pdi_poll_stat(priv, 0,\n+\t\t\t\t\tMXL862XX_FW_ERASE_TIMEOUT_MS);\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: erase timeout: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\t/* Step 6: transfer payload */\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t   MXL862XX_SB_PDI_CTRL_WR);\n+\tif (ret \u003c 0)\n+\t\tgoto write_err;\n+\n+\twhile (idx \u003c payload_size) {\n+\t\tcond_resched();\n+\t\tif (idx + 1 \u003c payload_size) {\n+\t\t\tfdata = payload[idx] |\n+\t\t\t\t((u16)payload[idx + 1] \u003c\u003c 8);\n+\t\t\tidx += 2;\n+\t\t\tdata_written += 2;\n+\t\t} else {\n+\t\t\tfdata = payload[idx];\n+\t\t\tidx++;\n+\t\t\tdata_written++;\n+\t\t}\n+\n+\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, fdata);\n+\t\tif (ret \u003c 0)\n+\t\t\tgoto write_err;\n+\t\tword_idx++;\n+\n+\t\tif (idx \u003e= payload_size) {\n+\t\t\tret = mxl862xx_sb_pdi_flush_last(priv, data_written);\n+\t\t\tbreak;\n+\t\t}\n+\n+\t\t/* Half-bank boundary: switch to SB1 address */\n+\t\tif (word_idx == MXL862XX_FW_BANK_HALF) {\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t\t   MXL862XX_SB_PDI_CTRL_RST);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n+\t\t\t\t\t\t   MXL862XX_FW_SB1_ADDR);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t\t   MXL862XX_SB_PDI_CTRL_WR);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\t\t} else if (word_idx \u003e= MXL862XX_FW_BANK_SLICE) {\n+\t\t\tret = mxl862xx_sb_pdi_flush_slice(priv, data_written);\n+\t\t\tif (ret) {\n+\t\t\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\t\t\"flash: write timeout at %u/%u: %pe\\n\",\n+\t\t\t\t\tidx, payload_size, ERR_PTR(ret));\n+\t\t\t\tgoto no_end;\n+\t\t\t}\n+\t\t\tword_idx = 0;\n+\t\t\tdata_written = 0;\n+\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n+\t\t\t\t\t\t   MXL862XX_SB_PDI_CTRL_WR);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto write_err;\n+\n+\t\t\tif (time_after(jiffies, next_notify)) {\n+\t\t\t\tmxl862xx_flash_notify(dl, \"Flashing\", idx,\n+\t\t\t\t\t\t      payload_size);\n+\t\t\t\tnext_notify = jiffies + msecs_to_jiffies(500);\n+\t\t\t}\n+\t\t}\n+\t}\n+\n+\tif (ret) {\n+\t\tdev_err(\u0026priv-\u003emdiodev-\u003edev,\n+\t\t\t\"flash: final slice failed: %pe\\n\", ERR_PTR(ret));\n+\t\tgoto no_end;\n+\t}\n+\n+\tmxl862xx_flash_notify(dl, \"Flashing\", payload_size, payload_size);\n+\n+\t/* Success: the loader has left the receive loop at r_remain == 0 and\n+\t * verified the image, so END(0x3cc3) is a finalise/boot request rather\n+\t * than a byte count. Signal it here -- and only here -- to boot the new\n+\t * image without waiting out the loader's 2 s END timeout.\n+\t */\n+\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n+\t\t\t\t   MXL862XX_SB_PDI_END);\n+\tmsleep(MXL862XX_FW_REBOOT_DELAY_MS);\n+\treturn ret;\n+\n+write_err:\n+\tdev_err(\u0026priv-\u003emdiodev-\u003edev, \"flash: SMDIO write failed: %pe\\n\",\n+\t\tERR_PTR(ret));\n+no_end:\n+\t/* A failure leaves the loader mid transfer; do not signal END (a STAT\n+\t * write is a byte count then, and END would be misread as one, risking\n+\t * a receive-counter underflow). Return the error; the caller reprobes.\n+\t */\n+\treturn ret;\n+}\n+\n+int mxl862xx_devlink_info_get(struct dsa_switch *ds,\n+\t\t\t      struct devlink_info_req *req,\n+\t\t\t      struct netlink_ext_ack *extack)\n+{\n+\tstruct mxl862xx_priv *priv = ds-\u003epriv;\n+\tchar buf[16];\n+\tint ret;\n+\n+\t/* No chip-id/revision in MCUboot (needs the firmware MMD mailbox). The\n+\t * fw version doubles as the \"ready to flash\" signal: report it only\n+\t * once the loader is at a clean READY, nothing while still draining.\n+\t */\n+\tif (priv-\u003erescue_mode) {\n+\t\tif (!READ_ONCE(priv-\u003erescue_ready))\n+\t\t\treturn 0;\n+\n+\t\tsnprintf(buf, sizeof(buf), \"%u.%u.%u\",\n+\t\t\t priv-\u003efw_version.major, priv-\u003efw_version.minor,\n+\t\t\t priv-\u003efw_version.revision);\n+\t\tret = devlink_info_version_running_put(req,\n+\t\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t\treturn devlink_info_version_stored_put(req,\n+\t\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+\t}\n+\n+\t/* A 0 part number means the CHIP ID read failed or the part is\n+\t * unfused; omit it rather than publish a bogus \"0000\" that fwupd\n+\t * would match firmware against -- it then falls back to the driver\n+\t * name.\n+\t */\n+\tif (priv-\u003easic_id) {\n+\t\tsnprintf(buf, sizeof(buf), \"%04X\", priv-\u003easic_id);\n+\t\tret = devlink_info_version_fixed_put(req,\n+\t\t\t\t\t\t     DEVLINK_INFO_VERSION_GENERIC_ASIC_ID,\n+\t\t\t\t\t\t     buf);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tsnprintf(buf, sizeof(buf), \"%u\", priv-\u003easic_rev);\n+\t\tret = devlink_info_version_fixed_put(req,\n+\t\t\t\t\t\t     DEVLINK_INFO_VERSION_GENERIC_ASIC_REV,\n+\t\t\t\t\t\t     buf);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t}\n+\n+\t/* An all-zero version is the cache a failed flash left behind, not a\n+\t * released firmware; omit it like the part number above.\n+\t */\n+\tif (!priv-\u003efw_version.major \u0026\u0026 !priv-\u003efw_version.minor \u0026\u0026\n+\t    !priv-\u003efw_version.revision)\n+\t\treturn 0;\n+\n+\tsnprintf(buf, sizeof(buf), \"%u.%u.%u\",\n+\t\t priv-\u003efw_version.major, priv-\u003efw_version.minor,\n+\t\t priv-\u003efw_version.revision);\n+\n+\tret = devlink_info_version_running_put(req,\n+\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\t/* boots this image from its own flash: stored == running */\n+\treturn devlink_info_version_stored_put(req,\n+\t\t\tDEVLINK_INFO_VERSION_GENERIC_FW, buf);\n+}\n+\n+int mxl862xx_devlink_flash_update(struct dsa_switch *ds,\n+\t\t\t\t  struct devlink_flash_update_params *params,\n+\t\t\t\t  struct netlink_ext_ack *extack)\n+{\n+\tstruct mxl862xx_reprobe *ko;\n+\tstruct mxl862xx_priv *priv = ds-\u003epriv;\n+\tstruct dsa_port *dp;\n+\tu32 payload_size;\n+\tint ret, i;\n+\n+\tif (params-\u003ecomponent) {\n+\t\tNL_SET_ERR_MSG_MOD(extack, \"component is not supported\");\n+\t\treturn -EOPNOTSUPP;\n+\t}\n+\n+\t/* A previous flash is still waiting for its reprobe: the firmware API\n+\t * is short-circuited, so the raw SB PDI writes below would run against\n+\t * a switch this driver no longer tracks.\n+\t */\n+\tif (priv-\u003eskip_teardown) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t   \"device is reinitializing, retry later\");\n+\t\treturn -EBUSY;\n+\t}\n+\n+\tret = mxl862xx_flash_validate(priv, params-\u003efw, \u0026payload_size);\n+\tif (ret) {\n+\t\tNL_SET_ERR_MSG_MOD(extack, \"firmware image validation failed\");\n+\t\treturn ret;\n+\t}\n+\n+\t/* Refuse to flash while the background self-heal is still draining, and\n+\t * for good once it has given up on the loader.\n+\t */\n+\tif (READ_ONCE(priv-\u003erescue_failed)) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t   \"download recovery failed, power cycle the switch\");\n+\t\treturn -EIO;\n+\t}\n+\n+\tif (priv-\u003erescue_mode \u0026\u0026 !READ_ONCE(priv-\u003erescue_ready)) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t   \"switch is recovering an interrupted download, retry shortly\");\n+\t\treturn -EBUSY;\n+\t}\n+\n+\t/* The references the reprobe work needs to restore normal operation\n+\t * must be held before the switch is disturbed; the work itself is\n+\t * scheduled only once the flash is done (see below).\n+\t */\n+\tif (!try_module_get(THIS_MODULE))\n+\t\treturn -ENODEV;\n+\n+\tget_device(ds-\u003edev);\n+\n+\t/* Allocate the reprobe work before disturbing the switch, so an\n+\t * -ENOMEM here cannot strand it flashed but never reprobed.\n+\t */\n+\tko = mxl862xx_reprobe_alloc(ds-\u003edev);\n+\tif (!ko) {\n+\t\tput_device(ds-\u003edev);\n+\t\tmodule_put(THIS_MODULE);\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\tif (priv-\u003erescue_mode)\n+\t\tdev_info(ds-\u003edev,\n+\t\t\t \"flash: flashing switch via MCUboot rescue mode\\n\");\n+\telse\n+\t\tdev_info(ds-\u003edev, \"flash: running firmware %u.%u.%u\\n\",\n+\t\t\t priv-\u003efw_version.major, priv-\u003efw_version.minor,\n+\t\t\t priv-\u003efw_version.revision);\n+\n+\t/* Close ports while the firmware is still alive so the DSA core's\n+\t * MDB/FDB tracking is drained, and detach user ports so userspace\n+\t * cannot reopen them during the flash. The conduit is only closed,\n+\t * not detached: it belongs to the MAC driver. This driver binds a\n+\t * single switch with a direct host link and no cascade ports, so the\n+\t * conduit serves only this switch, and flashing it reboots the switch,\n+\t * which takes the tree down regardless.\n+\t */\n+\trtnl_lock();\n+\tdsa_switch_for_each_user_port(dp, ds) {\n+\t\tif (dp-\u003euser) {\n+\t\t\tdev_close(dp-\u003euser);\n+\t\t\tnetif_device_detach(dp-\u003euser);\n+\t\t}\n+\t}\n+\tdsa_switch_for_each_cpu_port(dp, ds)\n+\t\tdev_close(dp-\u003econduit);\n+\t/* The bridge defers the STP state changes triggered by closing\n+\t * the ports; let them reach the firmware while it is still alive.\n+\t */\n+\tswitchdev_deferred_process();\n+\trtnl_unlock();\n+\n+\tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock, MDIO_MUTEX_NESTED);\n+\tpriv-\u003eblock_host = true;\n+\tmutex_unlock(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock);\n+\n+\tmxl862xx_stop_work(priv);\n+\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n+\tcancel_work_sync(\u0026priv-\u003ecrc_err_work);\n+\tfor (i = 0; i \u003c ds-\u003enum_ports; i++)\n+\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n+\n+\tret = mxl862xx_flash_firmware(priv, params-\u003efw, payload_size,\n+\t\t\t\t      ds-\u003edevlink);\n+\tif (ret)\n+\t\tNL_SET_ERR_MSG_MOD(extack, \"firmware transfer failed\");\n+\n+\tif (!ret) {\n+\t\tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock,\n+\t\t\t\t  MDIO_MUTEX_NESTED);\n+\t\tpriv-\u003eblock_host = false;\n+\t\tpriv-\u003erescue_mode = false;\n+\t\tmutex_unlock(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock);\n+\n+\t\t/* Refresh the cached versions so the flash update only\n+\t\t * completes once the new firmware is confirmed running and\n+\t\t * devlink dev info reports it. Must happen before setting\n+\t\t * skip_teardown, which discards all firmware API reads.\n+\t\t */\n+\t\tret = mxl862xx_wait_ready(ds);\n+\t\tif (ret)\n+\t\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t\t   \"new firmware did not become ready\");\n+\t}\n+\n+\tif (ret) {\n+\t\t/* The switch is in MCUboot with erased or partly written flash;\n+\t\t * drop the cached identity so devlink dev info stops reporting\n+\t\t * the pre-flash version until the reprobe re-reads the truth.\n+\t\t */\n+\t\tmemset(\u0026priv-\u003efw_version, 0, sizeof(priv-\u003efw_version));\n+\t\tpriv-\u003easic_id = 0;\n+\t\tpriv-\u003easic_rev = 0;\n+\t}\n+\n+\tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock, MDIO_MUTEX_NESTED);\n+\tpriv-\u003eskip_teardown = true;\n+\tmutex_unlock(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock);\n+\n+\t/* Queue the reprobe last; the work was allocated up front and its\n+\t * module and device references are already held.\n+\t */\n+\tqueue_delayed_work(system_long_wq, \u0026ko-\u003ework,\n+\t\t\t   msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));\n+\n+\treturn ret;\n+}\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.h b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h\nnew file mode 100644\nindex 0000000000000..7cd87c7ad8716\n--- /dev/null\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h\n@@ -0,0 +1,20 @@\n+/* SPDX-License-Identifier: GPL-2.0-or-later */\n+\n+#ifndef __MXL862XX_FW_H\n+#define __MXL862XX_FW_H\n+\n+#include \u003cnet/dsa.h\u003e\n+\n+struct mxl862xx_priv;\n+struct work_struct;\n+\n+int mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv);\n+void mxl862xx_rescue_heal_work_fn(struct work_struct *work);\n+int mxl862xx_devlink_info_get(struct dsa_switch *ds,\n+\t\t\t      struct devlink_info_req *req,\n+\t\t\t      struct netlink_ext_ack *extack);\n+int mxl862xx_devlink_flash_update(struct dsa_switch *ds,\n+\t\t\t\t  struct devlink_flash_update_params *params,\n+\t\t\t\t  struct netlink_ext_ack *extack);\n+\n+#endif /* __MXL862XX_FW_H */\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.c b/drivers/net/dsa/mxl862xx/mxl862xx-host.c\nindex 4acd216f7cc00..469ba1b2a2e18 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.c\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.c\n@@ -15,6 +15,8 @@\n #include \u003clinux/unaligned.h\u003e\n #include \u003cnet/dsa.h\u003e\n #include \"mxl862xx.h\"\n+#include \"mxl862xx-cmd.h\"\n+#include \"mxl862xx-fw.h\"\n #include \"mxl862xx-host.h\"\n \n #define CTRL_BUSY_MASK\t\t\tBIT(15)\n@@ -340,6 +342,21 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *_data,\n \n \tmutex_lock_nested(\u0026priv-\u003emdiodev-\u003ebus-\u003emdio_lock, MDIO_MUTEX_NESTED);\n \n+\tif (priv-\u003eskip_teardown) {\n+\t\tret = read ? -ENODEV : 0;\n+\t\tgoto out;\n+\t}\n+\n+\tif (priv-\u003erescue_mode) {\n+\t\tret = -ENODEV;\n+\t\tgoto out;\n+\t}\n+\n+\tif (priv-\u003eblock_host \u0026\u0026 cmd != SYS_MISC_FW_UPDATE) {\n+\t\tret = -EBUSY;\n+\t\tgoto out;\n+\t}\n+\n \tmax = (size + 1) / 2;\n \n \tret = mxl862xx_busy_wait(priv);\n@@ -495,12 +512,55 @@ int mxl862xx_reset(struct mxl862xx_priv *priv)\n \treturn ret;\n }\n \n+#define MXL862XX_SMDIO_ADDR_REG\t\t0x1f\n+#define MXL862XX_SMDIO_PAGE_MASK\t0xfff0\n+#define MXL862XX_SMDIO_OFF_MASK\t\t0x000f\n+\n+/* Paged clause-22 window: the page goes into MII register 0x1f, the low nibble\n+ * of addr selects one of the 16 registers within it. Both helpers take the MDIO\n+ * bus lock per transaction, so callers must not already hold it -- unlike\n+ * mxl862xx_api_wrap(), which holds it across a whole firmware command.\n+ */\n+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr)\n+{\n+\tstruct mii_bus *bus = priv-\u003emdiodev-\u003ebus;\n+\tint phy = priv-\u003emdiodev-\u003eaddr;\n+\tint ret;\n+\n+\tmutex_lock(\u0026bus-\u003emdio_lock);\n+\tret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,\n+\t\t\t      addr \u0026 MXL862XX_SMDIO_PAGE_MASK);\n+\tif (ret \u003e= 0)\n+\t\tret = __mdiobus_read(bus, phy, addr \u0026 MXL862XX_SMDIO_OFF_MASK);\n+\tmutex_unlock(\u0026bus-\u003emdio_lock);\n+\treturn ret;\n+}\n+\n+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val)\n+{\n+\tstruct mii_bus *bus = priv-\u003emdiodev-\u003ebus;\n+\tint phy = priv-\u003emdiodev-\u003eaddr;\n+\tint ret;\n+\n+\tmutex_lock(\u0026bus-\u003emdio_lock);\n+\tret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,\n+\t\t\t      addr \u0026 MXL862XX_SMDIO_PAGE_MASK);\n+\tif (ret \u003e= 0)\n+\t\tret = __mdiobus_write(bus, phy, addr \u0026 MXL862XX_SMDIO_OFF_MASK,\n+\t\t\t\t      val);\n+\tmutex_unlock(\u0026bus-\u003emdio_lock);\n+\treturn ret;\n+}\n+\n void mxl862xx_host_init(struct mxl862xx_priv *priv)\n {\n+\tmutex_init(\u0026priv-\u003eheal_lock);\n \tINIT_WORK(\u0026priv-\u003ecrc_err_work, mxl862xx_crc_err_work_fn);\n+\tINIT_WORK(\u0026priv-\u003erescue_heal_work, mxl862xx_rescue_heal_work_fn);\n }\n \n void mxl862xx_host_shutdown(struct mxl862xx_priv *priv)\n {\n \tcancel_work_sync(\u0026priv-\u003ecrc_err_work);\n+\tcancel_work_sync(\u0026priv-\u003erescue_heal_work);\n }\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.h b/drivers/net/dsa/mxl862xx/mxl862xx-host.h\nindex 66d6ae198aff4..4e054c6e4c0e4 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.h\n@@ -18,5 +18,7 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *data, u16 size,\n \tmxl862xx_api_wrap(dev, cmd, \u0026(data), sizeof((data)), true, true)\n \n int mxl862xx_reset(struct mxl862xx_priv *priv);\n+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr);\n+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val);\n \n #endif /* __MXL862XX_HOST_H */\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c\nindex b689652aa9b92..a5b6940b552e9 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c\n@@ -406,6 +406,8 @@ mxl862xx_phylink_mac_select_pcs(struct phylink_config *config,\n \n \tswitch (port) {\n \tcase 9 ... 16:\n+\t\tif (priv-\u003erescue_mode)\n+\t\t\treturn NULL;\n \t\tif (!MXL862XX_FW_VER_MIN(priv, 1, 0, 84)) {\n \t\t\tdev_warn_once(dp-\u003eds-\u003edev,\n \t\t\t\t      \"SerDes PCS unsupported on old firmware.\\n\");\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c\nindex 45d237b3a40f1..300eb19a344e5 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx.c\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c\n@@ -21,6 +21,7 @@\n #include \"mxl862xx.h\"\n #include \"mxl862xx-api.h\"\n #include \"mxl862xx-cmd.h\"\n+#include \"mxl862xx-fw.h\"\n #include \"mxl862xx-host.h\"\n #include \"mxl862xx-phylink.h\"\n \n@@ -71,6 +72,13 @@ static const struct ethtool_rmon_hist_range mxl862xx_rmon_ranges[] = {\n #define MXL862XX_READY_TIMEOUT_MS\t10000\n #define MXL862XX_READY_POLL_MS\t\t100\n \n+/* Chip ID registers, read via SYS_MISC_REG_RD */\n+#define MXL862XX_CHIPID_L\t\t0xc0d28884\n+#define MXL862XX_CHIPID_M\t\t0xc0d28888\n+#define MXL862XX_CHIPID_L_PNUML\t\tGENMASK(15, 12)\n+#define MXL862XX_CHIPID_M_PNUMM\t\tGENMASK(11, 0)\n+#define MXL862XX_CHIPID_M_VERSION\tGENMASK(14, 12)\n+\n #define MXL862XX_TCM_INST_SEL\t\t0xe00\n #define MXL862XX_TCM_CBS\t\t0xe12\n #define MXL862XX_TCM_EBS\t\t0xe13\n@@ -222,7 +230,46 @@ static int mxl862xx_phy_write_c45_mii_bus(struct mii_bus *bus, int addr,\n \treturn mxl862xx_phy_write_mmd(bus-\u003epriv, addr, devadd, regnum, val);\n }\n \n-static int mxl862xx_wait_ready(struct dsa_switch *ds)\n+/* Read the static chip part number and version from the CHIP ID\n+ * registers. Only possible with a running firmware, so the values are\n+ * cached at setup and left zero when the switch is in rescue mode.\n+ */\n+static int mxl862xx_read_chip_id(struct mxl862xx_priv *priv)\n+{\n+\tstruct mxl862xx_sys_reg_rw reg = {};\n+\tu16 chipid_l, chipid_m;\n+\tint ret;\n+\n+\treg.addr = cpu_to_le32(MXL862XX_CHIPID_L);\n+\tret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg);\n+\tif (ret)\n+\t\treturn ret;\n+\tchipid_l = le32_to_cpu(reg.val);\n+\n+\treg.addr = cpu_to_le32(MXL862XX_CHIPID_M);\n+\tret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg);\n+\tif (ret)\n+\t\treturn ret;\n+\tchipid_m = le32_to_cpu(reg.val);\n+\n+\tpriv-\u003easic_id = FIELD_GET(MXL862XX_CHIPID_L_PNUML, chipid_l) |\n+\t\t\tFIELD_GET(MXL862XX_CHIPID_M_PNUMM, chipid_m) \u003c\u003c 4;\n+\tpriv-\u003easic_rev = FIELD_GET(MXL862XX_CHIPID_M_VERSION, chipid_m);\n+\n+\treturn 0;\n+}\n+\n+/**\n+ * mxl862xx_wait_ready - wait for the switch firmware to become operational\n+ * @ds: DSA switch instance\n+ *\n+ * Poll the firmware until it reports its version and accepts\n+ * configuration commands, then cache the firmware version and chip ID.\n+ * Takes at least two seconds.\n+ *\n+ * Return: 0 on success or a negative error code.\n+ */\n+int mxl862xx_wait_ready(struct dsa_switch *ds)\n {\n \tstruct mxl862xx_sys_fw_image_version ver = {};\n \tunsigned long start = jiffies, timeout;\n@@ -254,6 +301,11 @@ static int mxl862xx_wait_ready(struct dsa_switch *ds)\n \t\tpriv-\u003efw_version.major = ver.iv_major;\n \t\tpriv-\u003efw_version.minor = ver.iv_minor;\n \t\tpriv-\u003efw_version.revision = le16_to_cpu(ver.iv_revision);\n+\n+\t\tret = mxl862xx_read_chip_id(priv);\n+\t\tif (ret)\n+\t\t\tdev_warn(ds-\u003edev, \"failed to read chip ID: %pe\\n\",\n+\t\t\t\t ERR_PTR(ret));\n \t\treturn 0;\n \n not_ready_yet:\n@@ -622,21 +674,66 @@ static int mxl862xx_setup(struct dsa_switch *ds)\n \tint n_user_ports = 0, max_vlans;\n \tint ingress_finals, vid_rules;\n \tstruct dsa_port *dp;\n-\tint ret, i;\n-\n-\tret = mxl862xx_reset(priv);\n-\tif (ret)\n-\t\treturn ret;\n-\n-\tret = mxl862xx_wait_ready(ds);\n-\tif (ret)\n-\t\treturn ret;\n+\tint ret, i, rescue;\n \n+\t/* The SerDes state is software-only and must exist before anything can\n+\t * reach phylink, including a rescue-mode flash clearing rescue_mode\n+\t * ahead of the reprobe.\n+\t */\n \tmutex_init(\u0026priv-\u003eserdes_lock);\n \tfor (i = 0; i \u003c ARRAY_SIZE(priv-\u003eserdes_ports); i++)\n \t\tmxl862xx_setup_pcs(priv, \u0026priv-\u003eserdes_ports[i],\n \t\t\t\t   i + MXL862XX_FIRST_SERDES_PORT);\n \n+\t/* Detect the loader over SB PDI first: it needs no firmware, unlike the\n+\t * C45 API (mxl862xx_reset/wait_ready) which spews CRC errors when none\n+\t * answers. Touch C45 only once rescue is ruled out.\n+\t */\n+\trescue = mxl862xx_rescue_mode_detect(priv);\n+\tif (rescue \u003c 0) {\n+\t\tdev_err(ds-\u003edev, \"switch state detection failed: %pe\\n\",\n+\t\t\tERR_PTR(rescue));\n+\t\treturn rescue;\n+\t}\n+\n+\tif (rescue == MXL862XX_NOT_RESCUE) {\n+\t\tret = mxl862xx_reset(priv);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tret = mxl862xx_wait_ready(ds);\n+\t\tif (ret) {\n+\t\t\t/* the reset may only now have triggered rescue mode */\n+\t\t\trescue = mxl862xx_rescue_mode_detect(priv);\n+\t\t\tif (rescue \u003c 0) {\n+\t\t\t\tdev_err(ds-\u003edev,\n+\t\t\t\t\t\"switch not responding after reset: %pe\\n\",\n+\t\t\t\t\tERR_PTR(rescue));\n+\t\t\t\treturn rescue;\n+\t\t\t}\n+\t\t\tif (rescue == MXL862XX_NOT_RESCUE)\n+\t\t\t\treturn ret;\n+\t\t}\n+\t}\n+\n+\tpriv-\u003erescue_mode = rescue;\n+\n+\tif (priv-\u003erescue_mode) {\n+\t\tif (priv-\u003erescue_ready) {\n+\t\t\tdev_warn(ds-\u003edev,\n+\t\t\t\t \"switch in MCUboot rescue mode, use devlink to flash new firmware\\n\");\n+\t\t} else {\n+\t\t\t/* Drain the wedged download in the background so it\n+\t\t\t * never holds the devlink lock; info and flash become\n+\t\t\t * available once ready.\n+\t\t\t */\n+\t\t\tdev_warn(ds-\u003edev,\n+\t\t\t\t \"switch in MCUboot with an interrupted download, recovering in background\\n\");\n+\t\t\tqueue_work(system_long_wq, \u0026priv-\u003erescue_heal_work);\n+\t\t}\n+\t\treturn 0;\n+\t}\n+\n \t/* Calculate Extended VLAN block sizes.\n \t * With VLAN Filter handling VID membership checks:\n \t *   Ingress: only final catchall rules (PVID insertion, 802.1Q\n@@ -715,11 +812,21 @@ static int mxl862xx_port_state(struct dsa_switch *ds, int port, bool enable)\n static int mxl862xx_port_enable(struct dsa_switch *ds, int port,\n \t\t\t\tstruct phy_device *phydev)\n {\n+\tstruct mxl862xx_priv *priv = ds-\u003epriv;\n+\n+\tif (priv-\u003erescue_mode)\n+\t\treturn 0;\n+\n \treturn mxl862xx_port_state(ds, port, true);\n }\n \n static void mxl862xx_port_disable(struct dsa_switch *ds, int port)\n {\n+\tstruct mxl862xx_priv *priv = ds-\u003epriv;\n+\n+\tif (priv-\u003erescue_mode)\n+\t\treturn;\n+\n \tif (mxl862xx_port_state(ds, port, false))\n \t\tdev_err(ds-\u003edev, \"failed to disable port %d\\n\", port);\n }\n@@ -1337,6 +1444,17 @@ static int mxl862xx_port_setup(struct dsa_switch *ds, int port)\n \tbool is_cpu_port = dsa_port_is_cpu(dp);\n \tint ret;\n \n+\tif (dsa_port_is_dsa(dp)) {\n+\t\tdev_err(ds-\u003edev, \"port %d: DSA links not supported\\n\", port);\n+\t\treturn -EOPNOTSUPP;\n+\t}\n+\n+\t/* DSA reinits failed user ports as unused; shared ports must\n+\t * succeed for the tree to register.\n+\t */\n+\tif (priv-\u003erescue_mode)\n+\t\treturn dsa_port_is_user(dp) ? -ENODEV : 0;\n+\n \tret = mxl862xx_port_state(ds, port, false);\n \tif (ret)\n \t\treturn ret;\n@@ -1346,11 +1464,6 @@ static int mxl862xx_port_setup(struct dsa_switch *ds, int port)\n \tif (dsa_port_is_unused(dp))\n \t\treturn 0;\n \n-\tif (dsa_port_is_dsa(dp)) {\n-\t\tdev_err(ds-\u003edev, \"port %d: DSA links not supported\\n\", port);\n-\t\treturn -EOPNOTSUPP;\n-\t}\n-\n \tret = mxl862xx_configure_sp_tag_proto(ds, port, is_cpu_port);\n \tif (ret)\n \t\treturn ret;\n@@ -1572,6 +1685,12 @@ static int mxl862xx_port_mdb_del(struct dsa_switch *ds, int port,\n \tether_addr_copy(qparam.mac, mdb-\u003eaddr);\n \n \tret = MXL862XX_API_READ(priv, MXL862XX_MAC_TABLEENTRYQUERY, qparam);\n+\t/* Post-flash teardown or MCUboot: the firmware and its MAC table are\n+\t * gone, so there is nothing left to delete. Outside those, -ENODEV is a\n+\t * bus error and must be reported.\n+\t */\n+\tif (ret == -ENODEV \u0026\u0026 (priv-\u003eskip_teardown || priv-\u003erescue_mode))\n+\t\treturn 0;\n \tif (ret)\n \t\treturn ret;\n \n@@ -1628,6 +1747,9 @@ static void mxl862xx_port_stp_state_set(struct dsa_switch *ds, int port,\n \tstruct mxl862xx_priv *priv = ds-\u003epriv;\n \tint ret;\n \n+\tif (priv-\u003erescue_mode)\n+\t\treturn;\n+\n \tswitch (state) {\n \tcase BR_STATE_DISABLED:\n \t\tparam.port_state = cpu_to_le32(MXL862XX_STP_PORT_STATE_DISABLE);\n@@ -2015,6 +2137,12 @@ static void mxl862xx_stats_work_fn(struct work_struct *work)\n \tstruct dsa_switch *ds = priv-\u003eds;\n \tstruct dsa_port *dp;\n \n+\t/* A get_stats64() re-arm can race the flash teardown's WORK_STOPPED\n+\t * set and cancel; bail here so a stray poll never runs during a flash.\n+\t */\n+\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n+\t\treturn;\n+\n \tdsa_switch_for_each_available_port(dp, ds)\n \t\tmxl862xx_stats_poll(ds, dp-\u003eindex);\n \n@@ -2086,6 +2214,8 @@ static const struct dsa_switch_ops mxl862xx_switch_ops = {\n \t.get_pause_stats = mxl862xx_get_pause_stats,\n \t.get_rmon_stats = mxl862xx_get_rmon_stats,\n \t.get_stats64 = mxl862xx_get_stats64,\n+\t.devlink_info_get = mxl862xx_devlink_info_get,\n+\t.devlink_flash_update = mxl862xx_devlink_flash_update,\n };\n \n static int mxl862xx_probe(struct mdio_device *mdiodev)\n@@ -2129,7 +2259,7 @@ static int mxl862xx_probe(struct mdio_device *mdiodev)\n \n \terr = dsa_register_switch(ds);\n \tif (err) {\n-\t\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\t\tmxl862xx_stop_work(priv);\n \t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n \t\tmxl862xx_host_shutdown(priv);\n \t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n@@ -2150,7 +2280,7 @@ static void mxl862xx_remove(struct mdio_device *mdiodev)\n \n \tpriv = ds-\u003epriv;\n \n-\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\tmxl862xx_stop_work(priv);\n \tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n \n \tdsa_unregister_switch(ds);\n@@ -2179,7 +2309,7 @@ static void mxl862xx_shutdown(struct mdio_device *mdiodev)\n \n \tdsa_switch_shutdown(ds);\n \n-\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\tmxl862xx_stop_work(priv);\n \tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n \n \tmxl862xx_host_shutdown(priv);\ndiff --git a/drivers/net/dsa/mxl862xx/mxl862xx.h b/drivers/net/dsa/mxl862xx/mxl862xx.h\nindex 432a5f3f2e08e..da45d24de7cf9 100644\n--- a/drivers/net/dsa/mxl862xx/mxl862xx.h\n+++ b/drivers/net/dsa/mxl862xx/mxl862xx.h\n@@ -4,7 +4,9 @@\n #define __MXL862XX_H\n \n #include \u003casm/byteorder.h\u003e\n+#include \u003clinux/bitops.h\u003e\n #include \u003clinux/mdio.h\u003e\n+#include \u003clinux/mutex.h\u003e\n #include \u003clinux/workqueue.h\u003e\n #include \u003cnet/dsa.h\u003e\n \n@@ -14,6 +16,10 @@ struct mxl862xx_priv;\n #define MXL862XX_FIRST_SERDES_PORT\t9\n #define MXL862XX_SERDES_SLOTS\t\t4\n \n+/* mxl862xx_rescue_mode_detect() return codes (negative values are errors) */\n+#define MXL862XX_NOT_RESCUE\t\t0\n+#define MXL862XX_IN_RESCUE\t\t1\n+\n #define MXL862XX_DEFAULT_BRIDGE\t\t0\n #define MXL862XX_MAX_BRIDGES\t\t48\n #define MXL862XX_MAX_BRIDGE_PORTS\t128\n@@ -303,6 +309,10 @@ struct mxl862xx_fw_version {\n  *                      flooding)\n  * @fw_version:         cached firmware version, populated at probe and\n  *                      compared with MXL862XX_FW_VER_MIN()\n+ * @asic_id:            chip part number read from the CHIP ID registers,\n+ *                      reported as the devlink \"asic.id\" fixed version\n+ * @asic_rev:           chip version read from the CHIP ID registers,\n+ *                      reported as the devlink \"asic.rev\" fixed version\n  * @serdes_ports:       SerDes interfaces incl. sub-interfaces in case of\n  *                      10G_QXGMII or QSGMII\n  * @serdes_refcount:    per-XPCS count of sub-ports enabled by phylink;\n@@ -319,6 +329,22 @@ struct mxl862xx_fw_version {\n  * @evlan_ingress_size: per-port ingress Extended VLAN block size\n  * @evlan_egress_size:  per-port egress Extended VLAN block size\n  * @vf_block_size:      per-port VLAN Filter block size\n+ * @block_host:         reject firmware API commands (except FW_UPDATE)\n+ *                      during a firmware flash\n+ * @skip_teardown:      discard firmware API commands during the teardown\n+ *                      triggered by the post-flash reprobe\n+ * @rescue_mode:        switch is in MCUboot; firmware API commands fail fast,\n+ *                      only clause-22 SMDIO works. Set from setup() before the\n+ *                      switch is registered and cleared under the MDIO bus lock\n+ *                      for the benefit of mxl862xx_api_wrap(); other readers\n+ *                      only need it to be a stable single flag.\n+ * @rescue_ready:       (rescue_mode) loader is at a clean READY and will accept\n+ *                      a flash; false while rescue_heal_work is draining\n+ * @rescue_failed:      (rescue_mode) the self-heal gave up; the loader needs a\n+ *                      power cycle and no flash can be accepted\n+ * @rescue_heal_work:   background self-heal draining a wedged download to READY\n+ * @heal_lock:          serialises the self-heal's reprobe hand-off against\n+ *                      teardown setting %MXL862XX_FLAG_WORK_STOPPED\n  * @stats_work:         periodic work item that polls RMON hardware counters\n  *                      and accumulates them into 64-bit per-port stats\n  */\n@@ -326,9 +352,12 @@ struct mxl862xx_priv {\n \tstruct dsa_switch *ds;\n \tstruct mdio_device *mdiodev;\n \tstruct work_struct crc_err_work;\n+\tstruct work_struct rescue_heal_work;\n \tunsigned long flags;\n \tu16 drop_meter;\n \tstruct mxl862xx_fw_version fw_version;\n+\tu16 asic_id;\n+\tu8 asic_rev;\n \tstruct mxl862xx_pcs serdes_ports[8];\n \tint serdes_refcount[2];\n \tstruct mutex serdes_lock;\n@@ -337,7 +366,26 @@ struct mxl862xx_priv {\n \tu16 evlan_ingress_size;\n \tu16 evlan_egress_size;\n \tu16 vf_block_size;\n+\tbool block_host;\n+\tbool skip_teardown;\n+\tbool rescue_mode;\n+\tbool rescue_ready;\n+\tbool rescue_failed;\n+\tstruct mutex heal_lock;\n \tstruct delayed_work stats_work;\n };\n \n+/* Stop the background workers. The flag is set under heal_lock, which the\n+ * rescue self-heal also holds across its own flag test and the queueing of its\n+ * reprobe, so no reprobe can slip past a teardown that has begun.\n+ */\n+static inline void mxl862xx_stop_work(struct mxl862xx_priv *priv)\n+{\n+\tmutex_lock(\u0026priv-\u003eheal_lock);\n+\tset_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags);\n+\tmutex_unlock(\u0026priv-\u003eheal_lock);\n+}\n+\n+int mxl862xx_wait_ready(struct dsa_switch *ds);\n+\n #endif /* __MXL862XX_H */\ndiff --git a/include/net/dsa.h b/include/net/dsa.h\nindex 6f7f5c17b5320..58597b14e592a 100644\n--- a/include/net/dsa.h\n+++ b/include/net/dsa.h\n@@ -1172,6 +1172,9 @@ struct dsa_switch_ops {\n \tint\t(*devlink_info_get)(struct dsa_switch *ds,\n \t\t\t\t    struct devlink_info_req *req,\n \t\t\t\t    struct netlink_ext_ack *extack);\n+\tint\t(*devlink_flash_update)(struct dsa_switch *ds,\n+\t\t\t\t\tstruct devlink_flash_update_params *params,\n+\t\t\t\t\tstruct netlink_ext_ack *extack);\n \tint\t(*devlink_sb_pool_get)(struct dsa_switch *ds,\n \t\t\t\t       unsigned int sb_index, u16 pool_index,\n \t\t\t\t       struct devlink_sb_pool_info *pool_info);\ndiff --git a/net/dsa/devlink.c b/net/dsa/devlink.c\nindex ed342f345692b..25311a87cbc56 100644\n--- a/net/dsa/devlink.c\n+++ b/net/dsa/devlink.c\n@@ -20,6 +20,18 @@ static int dsa_devlink_info_get(struct devlink *dl,\n \treturn -EOPNOTSUPP;\n }\n \n+static int dsa_devlink_flash_update(struct devlink *dl,\n+\t\t\t\t    struct devlink_flash_update_params *params,\n+\t\t\t\t    struct netlink_ext_ack *extack)\n+{\n+\tstruct dsa_switch *ds = dsa_devlink_to_ds(dl);\n+\n+\tif (!ds-\u003eops-\u003edevlink_flash_update)\n+\t\treturn -EOPNOTSUPP;\n+\n+\treturn ds-\u003eops-\u003edevlink_flash_update(ds, params, extack);\n+}\n+\n static int dsa_devlink_sb_pool_get(struct devlink *dl,\n \t\t\t\t   unsigned int sb_index, u16 pool_index,\n \t\t\t\t   struct devlink_sb_pool_info *pool_info)\n@@ -169,6 +181,7 @@ dsa_devlink_sb_occ_tc_port_bind_get(struct devlink_port *dlp,\n \n static const struct devlink_ops dsa_devlink_ops = {\n \t.info_get\t\t\t= dsa_devlink_info_get,\n+\t.flash_update\t\t\t= dsa_devlink_flash_update,\n \t.sb_pool_get\t\t\t= dsa_devlink_sb_pool_get,\n \t.sb_pool_set\t\t\t= dsa_devlink_sb_pool_set,\n \t.sb_port_pool_get\t\t= dsa_devlink_sb_port_pool_get,\n"
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 15bf5418d47d7d5e1b4a3bc26285fcb69c18c1b8
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Aug 3 04:46:56 2026 +0000

    syz-cluster: applied patch under review

diff --git a/Documentation/networking/devlink/index.rst b/Documentation/networking/devlink/index.rst
index 4745148fecf4f..058999d0dc56f 100644
--- a/Documentation/networking/devlink/index.rst
+++ b/Documentation/networking/devlink/index.rst
@@ -94,6 +94,7 @@ parameters, info versions, and other features it supports.
    mlx5
    mlxsw
    mv88e6xxx
+   mxl862xx
    netdevsim
    nfp
    octeontx2
diff --git a/Documentation/networking/devlink/mxl862xx.rst b/Documentation/networking/devlink/mxl862xx.rst
new file mode 100644
index 0000000000000..7c2dc11f65856
--- /dev/null
+++ b/Documentation/networking/devlink/mxl862xx.rst
@@ -0,0 +1,71 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+========================
+mxl862xx devlink support
+========================
+
+This document describes the devlink features implemented by the
+``mxl862xx`` device driver.
+
+Info versions
+=============
+
+The ``mxl862xx`` driver reports the following versions
+
+.. list-table:: devlink info versions implemented
+   :widths: 5 5 5 85
+
+   * - Name
+     - Type
+     - Example
+     - Description
+   * - ``asic.id``
+     - fixed
+     - 8628
+     - The chip part number read from the CHIP ID registers. Omitted
+       when the part number reads as zero, which happens for a switch
+       sitting in MCUboot rescue mode (the registers need a running
+       firmware), for an unfused part, and after a failed flash.
+   * - ``asic.rev``
+     - fixed
+     - 0
+     - The chip version read from the same register word, so it is
+       omitted whenever ``asic.id`` is.
+   * - ``fw``
+     - running, stored
+     - 1.0.70
+     - Version of the firmware running on the switch, reported as both
+       running and stored since the switch boots it from its own flash.
+       It is omitted while no firmware version is known: after a failed
+       flash, and in MCUboot rescue mode while an interrupted download
+       is still being recovered in the background. Once the loader is
+       ready to accept a new image the version appears as "0.0.0",
+       which no released firmware reports, so version-comparing tools
+       offer any available release as an upgrade. Use ``devlink dev
+       flash`` to tell a recovering switch from a ready one, see below;
+       a missing version on its own does not say why.
+
+Flash update
+============
+
+The ``mxl862xx`` driver implements support for ``devlink dev flash``.
+The signed firmware image is transferred to the switch over the same
+MDIO bus which is also used to manage the switch, then verified and
+installed by the MCUboot bootloader running on the switch. All ports
+of the switch are closed for the duration of the update and the driver
+reprobes the switch after it has rebooted into the new firmware. A
+complete flash and reprobe cycle takes about one minute.
+
+A switch stuck in MCUboot rescue mode, e.g. after an interrupted
+update, is registered without user ports. If the previous download was
+interrupted mid-transfer the loader is wedged; the driver drains it
+back to a clean ready state in the background, one byte at a time,
+which takes tens of minutes for a large image and is reported through
+the kernel log as it progresses. During that recovery ``devlink dev
+flash`` returns ``-EBUSY`` with an extack message saying so, and
+``devlink dev info`` reports no firmware version. Once the loader is
+ready the firmware version appears and flashing a firmware image
+through the regular update flow recovers the switch.
+
+If the recovery fails, the loader needs a power cycle: ``devlink dev
+flash`` then returns ``-EIO`` and says so in its extack message.
diff --git a/MAINTAINERS b/MAINTAINERS
index 932ea1db048e5..c27c449159c5a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -16107,6 +16107,7 @@ M:	Daniel Golle <daniel@makrotopia.org>
 L:	netdev@vger.kernel.org
 S:	Maintained
 F:	Documentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml
+F:	Documentation/networking/devlink/mxl862xx.rst
 F:	drivers/net/dsa/mxl862xx/
 F:	net/dsa/tag_mxl862xx.c
 
diff --git a/drivers/net/dsa/mxl862xx/Makefile b/drivers/net/dsa/mxl862xx/Makefile
index a7be0e6669dfa..bccac0d0f703f 100644
--- a/drivers/net/dsa/mxl862xx/Makefile
+++ b/drivers/net/dsa/mxl862xx/Makefile
@@ -1,3 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o
-mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o
+mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-api.h b/drivers/net/dsa/mxl862xx/mxl862xx-api.h
index a180a5decffc0..6f771895984cb 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-api.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-api.h
@@ -1224,6 +1224,16 @@ struct mxl862xx_sys_fw_image_version {
 	__le32 iv_build_num;
 } __packed;
 
+/**
+ * struct mxl862xx_sys_reg_rw - System register read/write
+ * @addr: 32-bit register address
+ * @val: register value
+ */
+struct mxl862xx_sys_reg_rw {
+	__le32 addr;
+	__le32 val;
+} __packed;
+
 /**
  * enum mxl862xx_port_type - Port Type
  * @MXL862XX_LOGICAL_PORT: Logical Port
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h
index c87a955c13c48..a865425aa61e1 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h
@@ -70,7 +70,9 @@
 #define INT_GPHY_READ			(GPY_GPY2XX_MAGIC + 0x1)
 #define INT_GPHY_WRITE			(GPY_GPY2XX_MAGIC + 0x2)
 
+#define SYS_MISC_FW_UPDATE		(SYS_MISC_MAGIC + 0x1)
 #define SYS_MISC_FW_VERSION		(SYS_MISC_MAGIC + 0x2)
+#define SYS_MISC_REG_RD			(SYS_MISC_MAGIC + 0x8)
 
 #define MXL862XX_XPCS_PCS_CONFIG	(MXL862XX_XPCS_MAGIC + 0x1)
 #define MXL862XX_XPCS_PCS_GET_STATE	(MXL862XX_XPCS_MAGIC + 0x2)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.c b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c
new file mode 100644
index 0000000000000..94aa658a62db9
--- /dev/null
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c
@@ -0,0 +1,1102 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Firmware flash and devlink support for MaxLinear MxL862xx
+ *
+ * Copyright (C) 2025 Daniel Golle <daniel@makrotopia.org>
+ *
+ * SB PDI - firmware download interface over clause-22 SMDIO
+ * =========================================================
+ *
+ * The MxL862xx MCUboot loader accepts a firmware image through four "SB PDI"
+ * registers in the switch SMDIO register space. It runs whenever no WSP
+ * firmware is active: the normal firmware update enters it deliberately - the
+ * SYS_MISC_FW_UPDATE API command sets a sticky rescue bit and reboots into
+ * MCUboot - and the loader also stays here when the stored WSP firmware fails
+ * its boot-time integrity check. This driver drives the loader's 0xc55c
+ * "console" download path.
+ *
+ * SMDIO register access (mxl862xx_smdio_read/write):
+ *   MII reg 0x1f := (<sb_pdi_reg> & 0xfff0)   ; page latch
+ *   MII reg (<sb_pdi_reg> & 0x000f) := / => <u16 data>
+ * so CTRL/ADDR/DATA/STAT (0xe100..0xe103) are MII regs 0/1/2/3 of page
+ * 0xe100, not all reg 0x00.
+ *
+ * SB PDI registers (host name/addr  ->  MCU mailbox):
+ *   CTRL 0xe100 -> 0xc0938400   mode: RST=0x00  RD=0x01  WR=0x02
+ *   ADDR 0xe101 -> 0xc0938404   SB target word address (SB1 bank = 0x7800)
+ *   DATA 0xe102 -> 0xc0938408   16-bit data / reply word
+ *   STAT 0xe103 -> 0xc093840c   handshake: a magic (below) or a byte count
+ *
+ * STAT magics:
+ *   READY  0xc55c   loader idle in the console loop        (this driver)
+ *   DL_RDY 0xc33c   loader idle in the flashless loop
+ *   START  0xf48f   host   -> begin download session
+ *   ACK    0xf490   loader -> START acknowledged (START + 1)
+ *   END    0x3cc3   host   -> finalise now (optional, see below)
+ *   RDREG  0xe2c0   host   -> register-read command (| index), see below
+ *
+ * Console flash path (STAT=0xc55c) - mxl862xx_flash_firmware():
+ *
+ *   host                                   loader
+ *   ----                                   ------
+ *   reset (CTRL=ADDR=DATA=0)
+ *   read STAT ............................ 0xc55c   (READY, idle)
+ *   STAT := START(0xf48f)  -------------->
+ *                          <-------------- STAT = 0xf490 (ACK)
+ *   CTRL := WR
+ *   DATA := hdr[0..9]  (20-byte header: type,size1,crc1,size2,crc2)
+ *   reset; STAT := 20 (header len)  -----> parse hdr; r_remain=size1+size2;
+ *                                          ERASE target region(s)
+ *                          <-------------- STAT=21 (len+1), then STAT=0
+ *                                          (erased)
+ *   -- payload, streamed in slices: --
+ *   CTRL := WR
+ *   DATA := word x N ...
+ *     at word 16384: CTRL:=RST; ADDR:=0x7800; CTRL:=WR  (half-bank -> SB1)
+ *     at word 32760: flush slice:
+ *        reset; STAT := <bytes_this_slice> ---> r_remain -= bytes; program
+ *                          <------------------- STAT=0  (ready for next slice)
+ *   ... repeat until the whole payload is sent ...
+ *                          <------------------- STAT=0  image verified
+ *                                               (STAT=1: image rejected)
+ *   STAT := END(0x3cc3)  ---------------------> finalise and boot
+ *
+ * The r_remain == 0 rule (critical):
+ *   Every host STAT write in the payload phase is a byte count; the loader
+ *   does r_remain -= count and stays in the receive loop while r_remain != 0.
+ *   It leaves the loop ONLY when r_remain hits EXACTLY 0, and a count larger
+ *   than r_remain underflows the 32-bit counter and wedges the loader until a
+ *   power cycle. Having left it, the loader verifies the image, publishes the
+ *   verdict in STAT (0 good, 1 rejected) and waits 2 s for END before
+ *   finalising regardless -- clearing its rescue-enable bit so boot_go boots
+ *   the new image -- so END only saves that wait. Hence:
+ *     - never send a slice/chunk count larger than what is outstanding;
+ *     - a STAT write is a command only once the loader has left the loop;
+ *     - the loader leaves the count in STAT while it programs the chunk, so
+ *       a lingering count does not distinguish "busy" from "verdict";
+ *     - interrupted-download recovery feeds 1 byte at a time (see below).
+ *
+ * Interrupted-flash recovery (mxl862xx_rescue_drain):
+ *   A host that dies mid-payload leaves the loader in the receive loop holding
+ *   STAT=0. Feed single 1-byte chunks (one DATA word + STAT=1) until r_remain
+ *   reaches 0; the loader then verifies the (now corrupt) image, publishes its
+ *   verdict and comes back to READY by itself. END is never sent here: while
+ *   r_remain is non-zero it would be consumed as a 15555-byte count, and a
+ *   lingering STAT=1 cannot be told from a chunk still being programmed.
+ *
+ * Register-read challenge (non-destructive liveness proof):
+ *   DATA := 0x7c23 (marker); STAT := 0xe2c0|idx
+ *     -> loader returns a runtime word in DATA and re-arms STAT=0xc55c.
+ *   The reply source is loader BSS, not a chip id; used only to prove a live
+ *   mailbox in mxl862xx_rescue_mode_detect().
+ *
+ * The other STAT ready magic, 0xc33c, marks the loader's flashless
+ * chip-to-chip download mode (MxL86281S 16-port tier); this driver does not
+ * use it.
+ *
+ * Rescue lifecycle (devlink): probe runs mxl862xx_rescue_mode_detect(); a
+ * wedged loader is drained back to READY by a background self-heal
+ * (rescue_heal_work), so the long recovery never holds the devlink lock.
+ * devlink dev info exposes the fw version (the "flashable" signal) only once at
+ * READY; flash_update returns -EBUSY until then, and reprobes to WSP firmware
+ * on success.
+ *
+ * Notes:
+ *   - Chip id/revision (0xc0d28884/88) are NOT reachable on this channel; they
+ *     need the clause-45 MMD firmware mailbox, which is dead under MCUboot.
+ *     Rescue identity is by SB PDI behaviour only (mxl862xx_rescue_mode_detect).
+ *   - The SMDIO PHY address comes from the device tree; the 0xe1xx register
+ *     offsets are the OTP reset defaults and the only layout supported here.
+ */
+
+#include <linux/crc32.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/iopoll.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/overflow.h>
+#include <linux/rtnetlink.h>
+#include <linux/workqueue.h>
+#include <net/dsa.h>
+#include <net/switchdev.h>
+
+#include "mxl862xx.h"
+#include "mxl862xx-api.h"
+#include "mxl862xx-cmd.h"
+#include "mxl862xx-fw.h"
+#include "mxl862xx-host.h"
+
+/* SB PDI registers (clause-22 SMDIO address space) */
+#define MXL862XX_SB_PDI_CTRL		0xe100
+#define MXL862XX_SB_PDI_ADDR		0xe101
+#define MXL862XX_SB_PDI_DATA		0xe102
+#define MXL862XX_SB_PDI_STAT		0xe103
+
+/* SB PDI CTRL modes */
+#define MXL862XX_SB_PDI_CTRL_RST	0x00
+#define MXL862XX_SB_PDI_CTRL_WR		0x02
+
+/* SB PDI handshake magic (published/consumed via STAT) */
+#define MXL862XX_SB_PDI_READY		0xc55c	/* loader idle, console loop */
+#define MXL862XX_SB_PDI_DL_READY	0xc33c	/* loader idle, flashless loop */
+#define MXL862XX_SB_PDI_START		0xf48f
+#define MXL862XX_SB_PDI_END		0x3cc3
+#define MXL862XX_SB_PDI_RDREG		0xe2c0	/* register-read cmd (| index) */
+#define MXL862XX_SB_PDI_RDREG_MARK	0x7c23	/* marker placed in DATA for RDREG */
+
+/* Behavioural presence probe: two distinct 16-bit latches on ADDR/DATA. */
+#define MXL862XX_SB_PDI_PROBE_A		0x5a5a
+#define MXL862XX_SB_PDI_PROBE_D		0xa5a5
+
+/* Image verification verdict published in STAT once the receive loop ends */
+#define MXL862XX_SB_PDI_VERIFY_OK	0
+#define MXL862XX_SB_PDI_VERIFY_BAD	1
+
+/* Firmware transfer geometry */
+#define MXL862XX_FW_HDR_SIZE		20
+#define MXL862XX_FW_BANK_HALF		16384	/* words per half-bank */
+#define MXL862XX_FW_BANK_SLICE		32760	/* words per full slice */
+#define MXL862XX_FW_SB1_ADDR		0x7800	/* SB1 word address */
+
+/* Timeouts (generous upper bounds) */
+#define MXL862XX_FW_READY_TIMEOUT_MS	3000
+#define MXL862XX_FW_ACK_TIMEOUT_MS	5000
+#define MXL862XX_FW_ERASE_TIMEOUT_MS	300000
+#define MXL862XX_FW_WRITE_TIMEOUT_MS	120000
+#define MXL862XX_FW_REBOOT_DELAY_MS	5000
+#define MXL862XX_FW_REPROBE_DELAY_MS	500
+#define MXL862XX_RESCUE_READY_TIMEOUT_MS 1000
+#define MXL862XX_DRAIN_POLL_MS		2000
+/* Covers the loader's END wait, verification and the reset into READY */
+#define MXL862XX_DRAIN_DONE_MS		15000
+
+static int mxl862xx_sb_pdi_reset(struct mxl862xx_priv *priv)
+{
+	int ret;
+
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+				   MXL862XX_SB_PDI_CTRL_RST);
+	if (ret < 0)
+		return ret;
+
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,
+				   MXL862XX_SB_PDI_CTRL_RST);
+	if (ret < 0)
+		return ret;
+
+	return mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,
+				    MXL862XX_SB_PDI_CTRL_RST);
+}
+
+static int mxl862xx_sb_pdi_poll_stat(struct mxl862xx_priv *priv, u16 expected,
+				     unsigned long timeout_ms)
+{
+	int ret, val;
+
+	ret = read_poll_timeout(mxl862xx_smdio_read, val,
+				val < 0 || (u16)val == expected,
+				10000, timeout_ms * 1000, false,
+				priv, MXL862XX_SB_PDI_STAT);
+	if (val < 0)
+		return val;
+	return ret;
+}
+
+static int mxl862xx_sb_pdi_flush_slice(struct mxl862xx_priv *priv,
+				       u32 data_written)
+{
+	int ret;
+
+	ret = mxl862xx_sb_pdi_reset(priv);
+	if (ret < 0)
+		return ret;
+
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written);
+	if (ret < 0)
+		return ret;
+
+	return mxl862xx_sb_pdi_poll_stat(priv, 0,
+					 MXL862XX_FW_WRITE_TIMEOUT_MS);
+}
+
+/* Flush the last slice, which ends the receive loop: the loader verifies the
+ * image and replaces the count in STAT with its verdict, so wait for the count
+ * to go rather than for a fixed value.
+ */
+static int mxl862xx_sb_pdi_flush_last(struct mxl862xx_priv *priv,
+				      u32 data_written)
+{
+	int ret, val;
+
+	ret = mxl862xx_sb_pdi_reset(priv);
+	if (ret < 0)
+		return ret;
+
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written);
+	if (ret < 0)
+		return ret;
+
+	ret = read_poll_timeout(mxl862xx_smdio_read, val,
+				val < 0 || (u16)val != (u16)data_written,
+				10000, MXL862XX_FW_WRITE_TIMEOUT_MS * 1000,
+				false, priv, MXL862XX_SB_PDI_STAT);
+	if (val < 0)
+		return val;
+
+	if (!ret && (u16)val == MXL862XX_SB_PDI_VERIFY_OK)
+		return 0;
+
+	/* A final count of 1 is indistinguishable from the reject verdict, so
+	 * a timeout still holding it lands here too.
+	 */
+	if ((u16)val == MXL862XX_SB_PDI_VERIFY_BAD) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: loader rejected the image\n");
+		return -EBADMSG;
+	}
+
+	return ret ? ret : -EPROTO;
+}
+
+static void mxl862xx_flash_notify(struct devlink *dl, const char *status,
+				  u32 done, u32 total)
+{
+	devlink_flash_update_status_notify(dl, status, NULL, done, total);
+}
+
+/* Post-flash reprobe. device_reprobe() detaches the driver -- running
+ * remove(), which frees priv -- then re-probes, so this work touches only its
+ * own device and module references and frees itself. A re-probe failure leaves
+ * the device unbound, exactly as a failed initial probe would, so it is only
+ * logged. Running from a workqueue keeps device_reprobe() out of the devlink
+ * caller's locking and signal context.
+ */
+struct mxl862xx_reprobe {
+	struct delayed_work work;
+	struct device *dev;
+};
+
+static void mxl862xx_reprobe_work_fn(struct work_struct *work)
+{
+	struct mxl862xx_reprobe *rp =
+		container_of(work, struct mxl862xx_reprobe, work.work);
+	struct device *dev = rp->dev;
+
+	if (device_reprobe(dev))
+		dev_err(dev, "reprobe failed; device left unbound\n");
+	put_device(dev);
+	kfree(rp);
+	module_put(THIS_MODULE);
+}
+
+/* Allocate the reprobe up front, before the switch is disturbed, so an
+ * allocation failure aborts cleanly. The caller holds a module and a device
+ * reference; the work releases both once it runs. Returns NULL on -ENOMEM.
+ */
+static struct mxl862xx_reprobe *mxl862xx_reprobe_alloc(struct device *dev)
+{
+	struct mxl862xx_reprobe *rp;
+
+	rp = kzalloc_obj(*rp);
+	if (!rp)
+		return NULL;
+	rp->dev = dev;
+	INIT_DELAYED_WORK(&rp->work, mxl862xx_reprobe_work_fn);
+	return rp;
+}
+
+/* Byte-count of each chunk fed to the loader during drain. It MUST be 1: the
+ * loader only lets us observe "counter == 0", never "counter < step", so any
+ * step > 1 can subtract past zero, underflow the 32-bit counter and wedge the
+ * loader for ~2^32 more bytes (a state only a power cycle clears). Stepping by
+ * 1 walks the counter through every value and is guaranteed to land on zero
+ * whatever its (possibly odd) start. A 1-byte chunk is a path the loader
+ * already handles: the normal transfer ends with a single trailing byte for
+ * odd-sized images (see Step 6).
+ */
+#define MXL862XX_DRAIN_CHUNK_BYTES	1
+
+/* Log the drain's progress every so many bytes; it can run for a long time */
+#define MXL862XX_DRAIN_LOG_BYTES	(128 * 1024)
+
+/* Wait for the loader to ask for the next chunk (STAT 0) or to come back to its
+ * command loop (STAT READY), and return the STAT value either way. On timeout
+ * that is whatever STAT still holds, which carries no further information: the
+ * loader keeps the count we wrote visible while it programs the chunk, and that
+ * is the same value it publishes as the "image rejected" verdict once the
+ * counter reaches zero.
+ */
+static int mxl862xx_sb_pdi_poll_drain(struct mxl862xx_priv *priv,
+				      unsigned long timeout_ms)
+{
+	int val;
+
+	read_poll_timeout(mxl862xx_smdio_read, val,
+			  val < 0 || (u16)val == MXL862XX_SB_PDI_READY ||
+			  (u16)val == 0,
+			  50, timeout_ms * 1000, false,
+			  priv, MXL862XX_SB_PDI_STAT);
+	if (val < 0)
+		return val;
+	return (u16)val;
+}
+
+/* The loader is not asking for a chunk: it may still be programming the last
+ * one, or the counter has reached zero and it is verifying the image and
+ * resetting into READY. Wait that out -- STAT cannot tell the two apart, and
+ * guessing would mean writing END into a live receive loop. Returns 0 once the
+ * loader has left the loop, -EAGAIN if it asks for another chunk after all.
+ */
+static int mxl862xx_rescue_drain_finish(struct mxl862xx_priv *priv, u32 chunk)
+{
+	struct device *dev = &priv->mdiodev->dev;
+	int stat;
+
+	stat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_DONE_MS);
+	if (stat < 0)
+		return stat;
+	if (stat == MXL862XX_SB_PDI_READY)
+		return 0;
+	if (stat == MXL862XX_SB_PDI_VERIFY_BAD) {
+		dev_err(dev,
+			"flash: loader stuck after %u chunks, power cycle it\n",
+			chunk);
+		return -EIO;
+	}
+	if (stat) {
+		/* A firmware is answering, not the loader: an image survived
+		 * in flash and booted.
+		 */
+		dev_info(dev, "flash: firmware booted while draining\n");
+		return 0;
+	}
+
+	return -EAGAIN;
+}
+
+/* Recover a switch whose SB PDI download was interrupted mid-transfer - the
+ * host died after MCUboot began erasing flash, whether it aborted mid erase or
+ * mid image-write, both end up in the same place: the payload receive loop.
+ * There the loader publishes STAT=0, waits for the host to write a byte-count
+ * to STAT, DMAs that many bytes and subtracts the count from a remaining-bytes
+ * counter, leaving the loop only when the counter reaches exactly zero. The
+ * image size died with the host, so we feed single-byte chunks (see
+ * MXL862XX_DRAIN_CHUNK_BYTES) to walk the counter to zero without underflow.
+ * The loader then verifies the (now corrupt) image and returns to READY by
+ * itself, or boots a valid image that happened to survive in flash; either way
+ * the caller's reprobe classifies the result. Every byte costs about a dozen
+ * MDIO frames, so a multi-MiB outstanding count takes tens of minutes.
+ * Returns 0 once the loader has left the receive loop, <0 on error. Does NOT
+ * recover a counter already underflowed by an earlier oversized-chunk attempt
+ * - that needs a power cycle.
+ */
+static int mxl862xx_rescue_drain(struct mxl862xx_priv *priv)
+{
+	struct device *dev = &priv->mdiodev->dev;
+	/* Bound: twice the loader's 16 MiB image cap, one byte per chunk. */
+	u32 max_chunks = 2u * (16u << 20) / MXL862XX_DRAIN_CHUNK_BYTES;
+	u32 chunk = 0;
+	int ret, stat;
+
+	while (chunk < max_chunks) {
+		/* Teardown can interrupt this long drain. */
+		if (test_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags))
+			return -ECANCELED;
+
+		stat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_POLL_MS);
+		if (stat < 0)
+			return stat;
+		if (stat == MXL862XX_SB_PDI_READY)
+			return 0;
+
+		if (stat) {
+			ret = mxl862xx_rescue_drain_finish(priv, chunk);
+			if (ret != -EAGAIN)
+				return ret;
+		}
+
+		/* Feed one zero byte; reset cleared the write latch. */
+		ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+					   MXL862XX_SB_PDI_CTRL_WR);
+		if (ret < 0)
+			return ret;
+		ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);
+		if (ret < 0)
+			return ret;
+		ret = mxl862xx_sb_pdi_reset(priv);
+		if (ret < 0)
+			return ret;
+		ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+					   MXL862XX_DRAIN_CHUNK_BYTES);
+		if (ret < 0)
+			return ret;
+		chunk++;
+		if (!(chunk % MXL862XX_DRAIN_LOG_BYTES))
+			dev_info(dev, "flash: drained %u KiB so far\n",
+				 chunk / 1024);
+		cond_resched();
+	}
+
+	dev_err(dev,
+		"flash: interrupted download did not drain after %u chunks\n",
+		chunk);
+
+	return -ETIMEDOUT;
+}
+
+/* Background self-heal: drain a wedged download off the devlink flash path, so
+ * the long recovery never holds the devlink lock. Scheduled from probe;
+ * reprobes on success so the probe-time detection re-classifies the switch.
+ */
+void mxl862xx_rescue_heal_work_fn(struct work_struct *work)
+{
+	struct mxl862xx_priv *priv =
+		container_of(work, struct mxl862xx_priv, rescue_heal_work);
+	struct device *dev = &priv->mdiodev->dev;
+	struct mxl862xx_reprobe *ko;
+	int ret;
+
+	ret = mxl862xx_rescue_drain(priv);
+	if (ret == -ECANCELED)
+		return;
+	if (ret) {
+		/* Nothing retries this, so say so: rescue_ready stays clear
+		 * and devlink dev flash reports why it refuses.
+		 */
+		dev_err(dev, "flash: download recovery failed: %pe\n",
+			ERR_PTR(ret));
+		WRITE_ONCE(priv->rescue_failed, true);
+		return;
+	}
+
+	/* The interrupted transfer is finalised; reprobe so the probe-time
+	 * detection brings the driver up -- flashable in rescue mode if the
+	 * loader is at READY, or normally if a valid image booted. The refs
+	 * are released by the reprobe once it completes. heal_lock makes the
+	 * flag test and the queueing atomic against teardown, which cannot
+	 * cancel a work item this one has already queued.
+	 */
+	mutex_lock(&priv->heal_lock);
+	if (test_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags))
+		goto out;
+	if (!try_module_get(THIS_MODULE))
+		goto out;
+	get_device(dev);
+	ko = mxl862xx_reprobe_alloc(dev);
+	if (!ko) {
+		put_device(dev);
+		module_put(THIS_MODULE);
+		goto out;
+	}
+	queue_delayed_work(system_long_wq, &ko->work,
+			   msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));
+out:
+	mutex_unlock(&priv->heal_lock);
+}
+
+/* Detect MCUboot rescue mode over clause-22 SMDIO alone, so the caller can rule
+ * the loader out before any C45 API request (which spews CRC errors when no WSP
+ * firmware answers). A scratch write to ADDR/DATA must latch or the chip is
+ * absent (-ENODEV); the mailbox is reset first, or a transfer interrupted with
+ * CTRL=WR would take that write as a payload word instead of latching it. STAT
+ * then classifies the state, poked destructively only when 0, the one value a
+ * running firmware never holds:
+ *
+ *  - 0xc33c: flashless loop; recognised but not supported here.
+ *  - 0xc55c: console loop, if the register-read challenge is serviced.
+ *  - other non-zero: running firmware, left unpoked.
+ *  - 0: wedged receive loop; the 1-byte slice-advance then says whether it
+ *    still needs draining or has just finished.
+ *
+ * Return: MXL862XX_IN_RESCUE, MXL862XX_NOT_RESCUE, -ENODEV when nothing
+ * answers, -EOPNOTSUPP for the flashless loop, -ENXIO for a READY loader whose
+ * mailbox fails the challenge, or an SMDIO bus error.
+ */
+int mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv)
+{
+	int stat, dat, ret, rb, a, d;
+
+	/* rescue_ready gates flashing; a wedged loader needs the drain first. */
+	WRITE_ONCE(priv->rescue_ready, false);
+
+	ret = mxl862xx_sb_pdi_reset(priv);
+	if (ret < 0)
+		return ret;
+
+	/* Presence: a live chip latches the scratch write, an absent one floats. */
+	a = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,
+				 MXL862XX_SB_PDI_PROBE_A);
+	if (a < 0)
+		return a;
+	d = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,
+				 MXL862XX_SB_PDI_PROBE_D);
+	if (d < 0)
+		return d;
+	a = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_ADDR);
+	if (a < 0)
+		return a;
+	d = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);
+	if (d < 0)
+		return d;
+	if ((u16)a != MXL862XX_SB_PDI_PROBE_A ||
+	    (u16)d != MXL862XX_SB_PDI_PROBE_D)
+		return -ENODEV;
+
+	ret = mxl862xx_sb_pdi_reset(priv);
+	if (ret < 0)
+		return ret;
+
+	stat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);
+	if (stat < 0)
+		return stat;
+
+	/* Flashless-download loop (MxL86281S tier): this driver does not
+	 * support it -- the console flash path expects READY. Treat it as an
+	 * unusable configuration, like any other unsupported state.
+	 */
+	if ((u16)stat == MXL862XX_SB_PDI_DL_READY)
+		return -EOPNOTSUPP;
+
+	/* Console loop at READY: confirm the live mailbox with the register-read
+	 * challenge (consumes the marker from DATA and re-arms READY).
+	 */
+	if ((u16)stat == MXL862XX_SB_PDI_READY) {
+		ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,
+					   MXL862XX_SB_PDI_RDREG_MARK);
+		if (ret < 0)
+			return ret;
+		ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+					   MXL862XX_SB_PDI_RDREG);
+		if (ret < 0)
+			return ret;
+		rb = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,
+					       MXL862XX_RESCUE_READY_TIMEOUT_MS);
+		dat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);
+		ret = mxl862xx_sb_pdi_reset(priv);
+		if (rb < 0)
+			return rb;
+		if (dat < 0)
+			return dat;
+		if (ret < 0)
+			return ret;
+		if (!rb && (u16)dat != MXL862XX_SB_PDI_RDREG_MARK) {
+			WRITE_ONCE(priv->rescue_ready, true);
+			return MXL862XX_IN_RESCUE;
+		}
+		return -ENXIO;
+	}
+
+	/* Any other non-zero value is a running firmware, not a loader. */
+	if (stat)
+		return MXL862XX_NOT_RESCUE;
+
+	/* STAT == 0: a wedged receive loop takes a 1-byte slice-advance (feed
+	 * one DATA word first, like a drain chunk) and asks for the next chunk
+	 * by publishing 0 again. Had that byte been the last one outstanding,
+	 * the loader leaves the loop instead and returns to READY, having
+	 * consumed the advance -- proof enough of a live mailbox to skip the
+	 * challenge. Anything else means it is still working on it. All three
+	 * are rescue, so this never fails probe; only the drain does.
+	 */
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+				   MXL862XX_SB_PDI_CTRL_WR);
+	if (ret < 0)
+		return ret;
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);
+	if (ret < 0)
+		return ret;
+	ret = mxl862xx_sb_pdi_reset(priv);
+	if (ret < 0)
+		return ret;
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+				   MXL862XX_DRAIN_CHUNK_BYTES);
+	if (ret < 0)
+		return ret;
+
+	rb = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_RESCUE_READY_TIMEOUT_MS);
+	if (rb < 0)
+		return rb;
+	if (rb == MXL862XX_SB_PDI_READY)
+		WRITE_ONCE(priv->rescue_ready, true);
+
+	return MXL862XX_IN_RESCUE;
+}
+
+/* MCUboot firmware image header */
+struct mxl862xx_fw_hdr {
+	__le32 image_type;
+	__le32 image_size_1;
+	__le32 image_checksum_1;
+	__le32 image_size_2;
+	__le32 image_checksum_2;
+} __packed;
+
+static int mxl862xx_flash_validate(struct mxl862xx_priv *priv,
+				   const struct firmware *fw,
+				   u32 *payload_size)
+{
+	const struct mxl862xx_fw_hdr *hdr;
+	u32 size1, size2, total;
+	const u8 *payload;
+	u32 crc;
+
+	if (fw->size < MXL862XX_FW_HDR_SIZE)
+		return -EINVAL;
+
+	hdr = (const struct mxl862xx_fw_hdr *)fw->data;
+	payload = fw->data + MXL862XX_FW_HDR_SIZE;
+	size1 = le32_to_cpu(hdr->image_size_1);
+	size2 = le32_to_cpu(hdr->image_size_2);
+
+	if (check_add_overflow(size1, size2, &total) ||
+	    total > fw->size - MXL862XX_FW_HDR_SIZE) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: firmware file too small for declared size\n");
+		return -EINVAL;
+	}
+
+	if (!total) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: firmware file with empty payload\n");
+		return -EINVAL;
+	}
+
+	if (size1) {
+		crc = ~crc32_le(~0U, payload, size1);
+		if (crc != le32_to_cpu(hdr->image_checksum_1)) {
+			dev_err(&priv->mdiodev->dev,
+				"flash: image 1 CRC mismatch (got %08x, expected %08x)\n",
+				crc, le32_to_cpu(hdr->image_checksum_1));
+			return -EINVAL;
+		}
+	}
+
+	if (size2) {
+		crc = ~crc32_le(~0U, payload + size1, size2);
+		if (crc != le32_to_cpu(hdr->image_checksum_2)) {
+			dev_err(&priv->mdiodev->dev,
+				"flash: image 2 CRC mismatch (got %08x, expected %08x)\n",
+				crc, le32_to_cpu(hdr->image_checksum_2));
+			return -EINVAL;
+		}
+	}
+
+	*payload_size = total;
+
+	return 0;
+}
+
+static int mxl862xx_flash_firmware(struct mxl862xx_priv *priv,
+				   const struct firmware *fw,
+				   u32 payload_size, struct devlink *dl)
+{
+	const u8 *payload = fw->data + MXL862XX_FW_HDR_SIZE;
+	u32 word_idx = 0, data_written = 0, idx = 0;
+	unsigned long next_notify = jiffies - 1;
+	u16 word, fdata;
+	int ret, i;
+
+	/* Step 1: reboot the firmware into MCUboot rescue mode */
+	if (!priv->rescue_mode) {
+		ret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,
+					false, false);
+		if (ret) {
+			dev_err(&priv->mdiodev->dev,
+				"flash: FW_UPDATE command failed: %pe\n",
+				ERR_PTR(ret));
+			return ret;
+		}
+	}
+
+	/* Step 2: wait for bootloader ready */
+	mxl862xx_flash_notify(dl, "Waiting for bootloader", 0, 0);
+	ret = mxl862xx_sb_pdi_reset(priv);
+	if (ret < 0)
+		goto write_err;
+
+	/* Failures from here on end up at no_end, which returns the error
+	 * without signalling END -- see there.
+	 */
+	ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,
+					MXL862XX_FW_READY_TIMEOUT_MS);
+	if (ret) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: bootloader not ready: %pe\n", ERR_PTR(ret));
+		goto no_end;
+	}
+
+	/* Step 3: start handshake */
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+				   MXL862XX_SB_PDI_START);
+	if (ret < 0)
+		goto write_err;
+
+	ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_START + 1,
+					MXL862XX_FW_ACK_TIMEOUT_MS);
+	if (ret) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: start handshake failed: %pe\n", ERR_PTR(ret));
+		goto no_end;
+	}
+
+	/* Step 4: transfer image header */
+	mxl862xx_flash_notify(dl, "Erasing flash", 0, 0);
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+				   MXL862XX_SB_PDI_CTRL_WR);
+	if (ret < 0)
+		goto write_err;
+
+	for (i = 0; i < MXL862XX_FW_HDR_SIZE / 2; i++) {
+		word = fw->data[i * 2] |
+		       ((u16)fw->data[i * 2 + 1] << 8);
+		ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, word);
+		if (ret < 0)
+			goto write_err;
+	}
+
+	ret = mxl862xx_sb_pdi_reset(priv);
+	if (ret < 0)
+		goto write_err;
+
+	/* the byte count in STAT triggers the erase */
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+				   MXL862XX_FW_HDR_SIZE);
+	if (ret < 0)
+		goto write_err;
+
+	/* ACK is byte count + 1 */
+	ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_FW_HDR_SIZE + 1,
+					MXL862XX_FW_ACK_TIMEOUT_MS);
+	if (ret) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: header ACK failed: %pe\n", ERR_PTR(ret));
+		goto no_end;
+	}
+
+	/* Step 5: wait for erase to complete */
+	ret = mxl862xx_sb_pdi_poll_stat(priv, 0,
+					MXL862XX_FW_ERASE_TIMEOUT_MS);
+	if (ret) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: erase timeout: %pe\n", ERR_PTR(ret));
+		goto no_end;
+	}
+
+	/* Step 6: transfer payload */
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+				   MXL862XX_SB_PDI_CTRL_WR);
+	if (ret < 0)
+		goto write_err;
+
+	while (idx < payload_size) {
+		cond_resched();
+		if (idx + 1 < payload_size) {
+			fdata = payload[idx] |
+				((u16)payload[idx + 1] << 8);
+			idx += 2;
+			data_written += 2;
+		} else {
+			fdata = payload[idx];
+			idx++;
+			data_written++;
+		}
+
+		ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, fdata);
+		if (ret < 0)
+			goto write_err;
+		word_idx++;
+
+		if (idx >= payload_size) {
+			ret = mxl862xx_sb_pdi_flush_last(priv, data_written);
+			break;
+		}
+
+		/* Half-bank boundary: switch to SB1 address */
+		if (word_idx == MXL862XX_FW_BANK_HALF) {
+			ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+						   MXL862XX_SB_PDI_CTRL_RST);
+			if (ret < 0)
+				goto write_err;
+
+			ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,
+						   MXL862XX_FW_SB1_ADDR);
+			if (ret < 0)
+				goto write_err;
+
+			ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+						   MXL862XX_SB_PDI_CTRL_WR);
+			if (ret < 0)
+				goto write_err;
+		} else if (word_idx >= MXL862XX_FW_BANK_SLICE) {
+			ret = mxl862xx_sb_pdi_flush_slice(priv, data_written);
+			if (ret) {
+				dev_err(&priv->mdiodev->dev,
+					"flash: write timeout at %u/%u: %pe\n",
+					idx, payload_size, ERR_PTR(ret));
+				goto no_end;
+			}
+			word_idx = 0;
+			data_written = 0;
+			ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+						   MXL862XX_SB_PDI_CTRL_WR);
+			if (ret < 0)
+				goto write_err;
+
+			if (time_after(jiffies, next_notify)) {
+				mxl862xx_flash_notify(dl, "Flashing", idx,
+						      payload_size);
+				next_notify = jiffies + msecs_to_jiffies(500);
+			}
+		}
+	}
+
+	if (ret) {
+		dev_err(&priv->mdiodev->dev,
+			"flash: final slice failed: %pe\n", ERR_PTR(ret));
+		goto no_end;
+	}
+
+	mxl862xx_flash_notify(dl, "Flashing", payload_size, payload_size);
+
+	/* Success: the loader has left the receive loop at r_remain == 0 and
+	 * verified the image, so END(0x3cc3) is a finalise/boot request rather
+	 * than a byte count. Signal it here -- and only here -- to boot the new
+	 * image without waiting out the loader's 2 s END timeout.
+	 */
+	ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+				   MXL862XX_SB_PDI_END);
+	msleep(MXL862XX_FW_REBOOT_DELAY_MS);
+	return ret;
+
+write_err:
+	dev_err(&priv->mdiodev->dev, "flash: SMDIO write failed: %pe\n",
+		ERR_PTR(ret));
+no_end:
+	/* A failure leaves the loader mid transfer; do not signal END (a STAT
+	 * write is a byte count then, and END would be misread as one, risking
+	 * a receive-counter underflow). Return the error; the caller reprobes.
+	 */
+	return ret;
+}
+
+int mxl862xx_devlink_info_get(struct dsa_switch *ds,
+			      struct devlink_info_req *req,
+			      struct netlink_ext_ack *extack)
+{
+	struct mxl862xx_priv *priv = ds->priv;
+	char buf[16];
+	int ret;
+
+	/* No chip-id/revision in MCUboot (needs the firmware MMD mailbox). The
+	 * fw version doubles as the "ready to flash" signal: report it only
+	 * once the loader is at a clean READY, nothing while still draining.
+	 */
+	if (priv->rescue_mode) {
+		if (!READ_ONCE(priv->rescue_ready))
+			return 0;
+
+		snprintf(buf, sizeof(buf), "%u.%u.%u",
+			 priv->fw_version.major, priv->fw_version.minor,
+			 priv->fw_version.revision);
+		ret = devlink_info_version_running_put(req,
+				DEVLINK_INFO_VERSION_GENERIC_FW, buf);
+		if (ret)
+			return ret;
+		return devlink_info_version_stored_put(req,
+				DEVLINK_INFO_VERSION_GENERIC_FW, buf);
+	}
+
+	/* A 0 part number means the CHIP ID read failed or the part is
+	 * unfused; omit it rather than publish a bogus "0000" that fwupd
+	 * would match firmware against -- it then falls back to the driver
+	 * name.
+	 */
+	if (priv->asic_id) {
+		snprintf(buf, sizeof(buf), "%04X", priv->asic_id);
+		ret = devlink_info_version_fixed_put(req,
+						     DEVLINK_INFO_VERSION_GENERIC_ASIC_ID,
+						     buf);
+		if (ret)
+			return ret;
+
+		snprintf(buf, sizeof(buf), "%u", priv->asic_rev);
+		ret = devlink_info_version_fixed_put(req,
+						     DEVLINK_INFO_VERSION_GENERIC_ASIC_REV,
+						     buf);
+		if (ret)
+			return ret;
+	}
+
+	/* An all-zero version is the cache a failed flash left behind, not a
+	 * released firmware; omit it like the part number above.
+	 */
+	if (!priv->fw_version.major && !priv->fw_version.minor &&
+	    !priv->fw_version.revision)
+		return 0;
+
+	snprintf(buf, sizeof(buf), "%u.%u.%u",
+		 priv->fw_version.major, priv->fw_version.minor,
+		 priv->fw_version.revision);
+
+	ret = devlink_info_version_running_put(req,
+			DEVLINK_INFO_VERSION_GENERIC_FW, buf);
+	if (ret)
+		return ret;
+
+	/* boots this image from its own flash: stored == running */
+	return devlink_info_version_stored_put(req,
+			DEVLINK_INFO_VERSION_GENERIC_FW, buf);
+}
+
+int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
+				  struct devlink_flash_update_params *params,
+				  struct netlink_ext_ack *extack)
+{
+	struct mxl862xx_reprobe *ko;
+	struct mxl862xx_priv *priv = ds->priv;
+	struct dsa_port *dp;
+	u32 payload_size;
+	int ret, i;
+
+	if (params->component) {
+		NL_SET_ERR_MSG_MOD(extack, "component is not supported");
+		return -EOPNOTSUPP;
+	}
+
+	/* A previous flash is still waiting for its reprobe: the firmware API
+	 * is short-circuited, so the raw SB PDI writes below would run against
+	 * a switch this driver no longer tracks.
+	 */
+	if (priv->skip_teardown) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "device is reinitializing, retry later");
+		return -EBUSY;
+	}
+
+	ret = mxl862xx_flash_validate(priv, params->fw, &payload_size);
+	if (ret) {
+		NL_SET_ERR_MSG_MOD(extack, "firmware image validation failed");
+		return ret;
+	}
+
+	/* Refuse to flash while the background self-heal is still draining, and
+	 * for good once it has given up on the loader.
+	 */
+	if (READ_ONCE(priv->rescue_failed)) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "download recovery failed, power cycle the switch");
+		return -EIO;
+	}
+
+	if (priv->rescue_mode && !READ_ONCE(priv->rescue_ready)) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "switch is recovering an interrupted download, retry shortly");
+		return -EBUSY;
+	}
+
+	/* The references the reprobe work needs to restore normal operation
+	 * must be held before the switch is disturbed; the work itself is
+	 * scheduled only once the flash is done (see below).
+	 */
+	if (!try_module_get(THIS_MODULE))
+		return -ENODEV;
+
+	get_device(ds->dev);
+
+	/* Allocate the reprobe work before disturbing the switch, so an
+	 * -ENOMEM here cannot strand it flashed but never reprobed.
+	 */
+	ko = mxl862xx_reprobe_alloc(ds->dev);
+	if (!ko) {
+		put_device(ds->dev);
+		module_put(THIS_MODULE);
+		return -ENOMEM;
+	}
+
+	if (priv->rescue_mode)
+		dev_info(ds->dev,
+			 "flash: flashing switch via MCUboot rescue mode\n");
+	else
+		dev_info(ds->dev, "flash: running firmware %u.%u.%u\n",
+			 priv->fw_version.major, priv->fw_version.minor,
+			 priv->fw_version.revision);
+
+	/* Close ports while the firmware is still alive so the DSA core's
+	 * MDB/FDB tracking is drained, and detach user ports so userspace
+	 * cannot reopen them during the flash. The conduit is only closed,
+	 * not detached: it belongs to the MAC driver. This driver binds a
+	 * single switch with a direct host link and no cascade ports, so the
+	 * conduit serves only this switch, and flashing it reboots the switch,
+	 * which takes the tree down regardless.
+	 */
+	rtnl_lock();
+	dsa_switch_for_each_user_port(dp, ds) {
+		if (dp->user) {
+			dev_close(dp->user);
+			netif_device_detach(dp->user);
+		}
+	}
+	dsa_switch_for_each_cpu_port(dp, ds)
+		dev_close(dp->conduit);
+	/* The bridge defers the STP state changes triggered by closing
+	 * the ports; let them reach the firmware while it is still alive.
+	 */
+	switchdev_deferred_process();
+	rtnl_unlock();
+
+	mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED);
+	priv->block_host = true;
+	mutex_unlock(&priv->mdiodev->bus->mdio_lock);
+
+	mxl862xx_stop_work(priv);
+	cancel_delayed_work_sync(&priv->stats_work);
+	cancel_work_sync(&priv->crc_err_work);
+	for (i = 0; i < ds->num_ports; i++)
+		cancel_work_sync(&priv->ports[i].host_flood_work);
+
+	ret = mxl862xx_flash_firmware(priv, params->fw, payload_size,
+				      ds->devlink);
+	if (ret)
+		NL_SET_ERR_MSG_MOD(extack, "firmware transfer failed");
+
+	if (!ret) {
+		mutex_lock_nested(&priv->mdiodev->bus->mdio_lock,
+				  MDIO_MUTEX_NESTED);
+		priv->block_host = false;
+		priv->rescue_mode = false;
+		mutex_unlock(&priv->mdiodev->bus->mdio_lock);
+
+		/* Refresh the cached versions so the flash update only
+		 * completes once the new firmware is confirmed running and
+		 * devlink dev info reports it. Must happen before setting
+		 * skip_teardown, which discards all firmware API reads.
+		 */
+		ret = mxl862xx_wait_ready(ds);
+		if (ret)
+			NL_SET_ERR_MSG_MOD(extack,
+					   "new firmware did not become ready");
+	}
+
+	if (ret) {
+		/* The switch is in MCUboot with erased or partly written flash;
+		 * drop the cached identity so devlink dev info stops reporting
+		 * the pre-flash version until the reprobe re-reads the truth.
+		 */
+		memset(&priv->fw_version, 0, sizeof(priv->fw_version));
+		priv->asic_id = 0;
+		priv->asic_rev = 0;
+	}
+
+	mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED);
+	priv->skip_teardown = true;
+	mutex_unlock(&priv->mdiodev->bus->mdio_lock);
+
+	/* Queue the reprobe last; the work was allocated up front and its
+	 * module and device references are already held.
+	 */
+	queue_delayed_work(system_long_wq, &ko->work,
+			   msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));
+
+	return ret;
+}
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.h b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h
new file mode 100644
index 0000000000000..7cd87c7ad8716
--- /dev/null
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef __MXL862XX_FW_H
+#define __MXL862XX_FW_H
+
+#include <net/dsa.h>
+
+struct mxl862xx_priv;
+struct work_struct;
+
+int mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv);
+void mxl862xx_rescue_heal_work_fn(struct work_struct *work);
+int mxl862xx_devlink_info_get(struct dsa_switch *ds,
+			      struct devlink_info_req *req,
+			      struct netlink_ext_ack *extack);
+int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
+				  struct devlink_flash_update_params *params,
+				  struct netlink_ext_ack *extack);
+
+#endif /* __MXL862XX_FW_H */
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.c b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
index 4acd216f7cc00..469ba1b2a2e18 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
@@ -15,6 +15,8 @@
 #include <linux/unaligned.h>
 #include <net/dsa.h>
 #include "mxl862xx.h"
+#include "mxl862xx-cmd.h"
+#include "mxl862xx-fw.h"
 #include "mxl862xx-host.h"
 
 #define CTRL_BUSY_MASK			BIT(15)
@@ -340,6 +342,21 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *_data,
 
 	mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED);
 
+	if (priv->skip_teardown) {
+		ret = read ? -ENODEV : 0;
+		goto out;
+	}
+
+	if (priv->rescue_mode) {
+		ret = -ENODEV;
+		goto out;
+	}
+
+	if (priv->block_host && cmd != SYS_MISC_FW_UPDATE) {
+		ret = -EBUSY;
+		goto out;
+	}
+
 	max = (size + 1) / 2;
 
 	ret = mxl862xx_busy_wait(priv);
@@ -495,12 +512,55 @@ int mxl862xx_reset(struct mxl862xx_priv *priv)
 	return ret;
 }
 
+#define MXL862XX_SMDIO_ADDR_REG		0x1f
+#define MXL862XX_SMDIO_PAGE_MASK	0xfff0
+#define MXL862XX_SMDIO_OFF_MASK		0x000f
+
+/* Paged clause-22 window: the page goes into MII register 0x1f, the low nibble
+ * of addr selects one of the 16 registers within it. Both helpers take the MDIO
+ * bus lock per transaction, so callers must not already hold it -- unlike
+ * mxl862xx_api_wrap(), which holds it across a whole firmware command.
+ */
+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr)
+{
+	struct mii_bus *bus = priv->mdiodev->bus;
+	int phy = priv->mdiodev->addr;
+	int ret;
+
+	mutex_lock(&bus->mdio_lock);
+	ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,
+			      addr & MXL862XX_SMDIO_PAGE_MASK);
+	if (ret >= 0)
+		ret = __mdiobus_read(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK);
+	mutex_unlock(&bus->mdio_lock);
+	return ret;
+}
+
+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val)
+{
+	struct mii_bus *bus = priv->mdiodev->bus;
+	int phy = priv->mdiodev->addr;
+	int ret;
+
+	mutex_lock(&bus->mdio_lock);
+	ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,
+			      addr & MXL862XX_SMDIO_PAGE_MASK);
+	if (ret >= 0)
+		ret = __mdiobus_write(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK,
+				      val);
+	mutex_unlock(&bus->mdio_lock);
+	return ret;
+}
+
 void mxl862xx_host_init(struct mxl862xx_priv *priv)
 {
+	mutex_init(&priv->heal_lock);
 	INIT_WORK(&priv->crc_err_work, mxl862xx_crc_err_work_fn);
+	INIT_WORK(&priv->rescue_heal_work, mxl862xx_rescue_heal_work_fn);
 }
 
 void mxl862xx_host_shutdown(struct mxl862xx_priv *priv)
 {
 	cancel_work_sync(&priv->crc_err_work);
+	cancel_work_sync(&priv->rescue_heal_work);
 }
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.h b/drivers/net/dsa/mxl862xx/mxl862xx-host.h
index 66d6ae198aff4..4e054c6e4c0e4 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.h
@@ -18,5 +18,7 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *data, u16 size,
 	mxl862xx_api_wrap(dev, cmd, &(data), sizeof((data)), true, true)
 
 int mxl862xx_reset(struct mxl862xx_priv *priv);
+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr);
+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val);
 
 #endif /* __MXL862XX_HOST_H */
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c
index b689652aa9b92..a5b6940b552e9 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c
@@ -406,6 +406,8 @@ mxl862xx_phylink_mac_select_pcs(struct phylink_config *config,
 
 	switch (port) {
 	case 9 ... 16:
+		if (priv->rescue_mode)
+			return NULL;
 		if (!MXL862XX_FW_VER_MIN(priv, 1, 0, 84)) {
 			dev_warn_once(dp->ds->dev,
 				      "SerDes PCS unsupported on old firmware.\n");
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index 45d237b3a40f1..300eb19a344e5 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -21,6 +21,7 @@
 #include "mxl862xx.h"
 #include "mxl862xx-api.h"
 #include "mxl862xx-cmd.h"
+#include "mxl862xx-fw.h"
 #include "mxl862xx-host.h"
 #include "mxl862xx-phylink.h"
 
@@ -71,6 +72,13 @@ static const struct ethtool_rmon_hist_range mxl862xx_rmon_ranges[] = {
 #define MXL862XX_READY_TIMEOUT_MS	10000
 #define MXL862XX_READY_POLL_MS		100
 
+/* Chip ID registers, read via SYS_MISC_REG_RD */
+#define MXL862XX_CHIPID_L		0xc0d28884
+#define MXL862XX_CHIPID_M		0xc0d28888
+#define MXL862XX_CHIPID_L_PNUML		GENMASK(15, 12)
+#define MXL862XX_CHIPID_M_PNUMM		GENMASK(11, 0)
+#define MXL862XX_CHIPID_M_VERSION	GENMASK(14, 12)
+
 #define MXL862XX_TCM_INST_SEL		0xe00
 #define MXL862XX_TCM_CBS		0xe12
 #define MXL862XX_TCM_EBS		0xe13
@@ -222,7 +230,46 @@ static int mxl862xx_phy_write_c45_mii_bus(struct mii_bus *bus, int addr,
 	return mxl862xx_phy_write_mmd(bus->priv, addr, devadd, regnum, val);
 }
 
-static int mxl862xx_wait_ready(struct dsa_switch *ds)
+/* Read the static chip part number and version from the CHIP ID
+ * registers. Only possible with a running firmware, so the values are
+ * cached at setup and left zero when the switch is in rescue mode.
+ */
+static int mxl862xx_read_chip_id(struct mxl862xx_priv *priv)
+{
+	struct mxl862xx_sys_reg_rw reg = {};
+	u16 chipid_l, chipid_m;
+	int ret;
+
+	reg.addr = cpu_to_le32(MXL862XX_CHIPID_L);
+	ret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg);
+	if (ret)
+		return ret;
+	chipid_l = le32_to_cpu(reg.val);
+
+	reg.addr = cpu_to_le32(MXL862XX_CHIPID_M);
+	ret = MXL862XX_API_READ(priv, SYS_MISC_REG_RD, reg);
+	if (ret)
+		return ret;
+	chipid_m = le32_to_cpu(reg.val);
+
+	priv->asic_id = FIELD_GET(MXL862XX_CHIPID_L_PNUML, chipid_l) |
+			FIELD_GET(MXL862XX_CHIPID_M_PNUMM, chipid_m) << 4;
+	priv->asic_rev = FIELD_GET(MXL862XX_CHIPID_M_VERSION, chipid_m);
+
+	return 0;
+}
+
+/**
+ * mxl862xx_wait_ready - wait for the switch firmware to become operational
+ * @ds: DSA switch instance
+ *
+ * Poll the firmware until it reports its version and accepts
+ * configuration commands, then cache the firmware version and chip ID.
+ * Takes at least two seconds.
+ *
+ * Return: 0 on success or a negative error code.
+ */
+int mxl862xx_wait_ready(struct dsa_switch *ds)
 {
 	struct mxl862xx_sys_fw_image_version ver = {};
 	unsigned long start = jiffies, timeout;
@@ -254,6 +301,11 @@ static int mxl862xx_wait_ready(struct dsa_switch *ds)
 		priv->fw_version.major = ver.iv_major;
 		priv->fw_version.minor = ver.iv_minor;
 		priv->fw_version.revision = le16_to_cpu(ver.iv_revision);
+
+		ret = mxl862xx_read_chip_id(priv);
+		if (ret)
+			dev_warn(ds->dev, "failed to read chip ID: %pe\n",
+				 ERR_PTR(ret));
 		return 0;
 
 not_ready_yet:
@@ -622,21 +674,66 @@ static int mxl862xx_setup(struct dsa_switch *ds)
 	int n_user_ports = 0, max_vlans;
 	int ingress_finals, vid_rules;
 	struct dsa_port *dp;
-	int ret, i;
-
-	ret = mxl862xx_reset(priv);
-	if (ret)
-		return ret;
-
-	ret = mxl862xx_wait_ready(ds);
-	if (ret)
-		return ret;
+	int ret, i, rescue;
 
+	/* The SerDes state is software-only and must exist before anything can
+	 * reach phylink, including a rescue-mode flash clearing rescue_mode
+	 * ahead of the reprobe.
+	 */
 	mutex_init(&priv->serdes_lock);
 	for (i = 0; i < ARRAY_SIZE(priv->serdes_ports); i++)
 		mxl862xx_setup_pcs(priv, &priv->serdes_ports[i],
 				   i + MXL862XX_FIRST_SERDES_PORT);
 
+	/* Detect the loader over SB PDI first: it needs no firmware, unlike the
+	 * C45 API (mxl862xx_reset/wait_ready) which spews CRC errors when none
+	 * answers. Touch C45 only once rescue is ruled out.
+	 */
+	rescue = mxl862xx_rescue_mode_detect(priv);
+	if (rescue < 0) {
+		dev_err(ds->dev, "switch state detection failed: %pe\n",
+			ERR_PTR(rescue));
+		return rescue;
+	}
+
+	if (rescue == MXL862XX_NOT_RESCUE) {
+		ret = mxl862xx_reset(priv);
+		if (ret)
+			return ret;
+
+		ret = mxl862xx_wait_ready(ds);
+		if (ret) {
+			/* the reset may only now have triggered rescue mode */
+			rescue = mxl862xx_rescue_mode_detect(priv);
+			if (rescue < 0) {
+				dev_err(ds->dev,
+					"switch not responding after reset: %pe\n",
+					ERR_PTR(rescue));
+				return rescue;
+			}
+			if (rescue == MXL862XX_NOT_RESCUE)
+				return ret;
+		}
+	}
+
+	priv->rescue_mode = rescue;
+
+	if (priv->rescue_mode) {
+		if (priv->rescue_ready) {
+			dev_warn(ds->dev,
+				 "switch in MCUboot rescue mode, use devlink to flash new firmware\n");
+		} else {
+			/* Drain the wedged download in the background so it
+			 * never holds the devlink lock; info and flash become
+			 * available once ready.
+			 */
+			dev_warn(ds->dev,
+				 "switch in MCUboot with an interrupted download, recovering in background\n");
+			queue_work(system_long_wq, &priv->rescue_heal_work);
+		}
+		return 0;
+	}
+
 	/* Calculate Extended VLAN block sizes.
 	 * With VLAN Filter handling VID membership checks:
 	 *   Ingress: only final catchall rules (PVID insertion, 802.1Q
@@ -715,11 +812,21 @@ static int mxl862xx_port_state(struct dsa_switch *ds, int port, bool enable)
 static int mxl862xx_port_enable(struct dsa_switch *ds, int port,
 				struct phy_device *phydev)
 {
+	struct mxl862xx_priv *priv = ds->priv;
+
+	if (priv->rescue_mode)
+		return 0;
+
 	return mxl862xx_port_state(ds, port, true);
 }
 
 static void mxl862xx_port_disable(struct dsa_switch *ds, int port)
 {
+	struct mxl862xx_priv *priv = ds->priv;
+
+	if (priv->rescue_mode)
+		return;
+
 	if (mxl862xx_port_state(ds, port, false))
 		dev_err(ds->dev, "failed to disable port %d\n", port);
 }
@@ -1337,6 +1444,17 @@ static int mxl862xx_port_setup(struct dsa_switch *ds, int port)
 	bool is_cpu_port = dsa_port_is_cpu(dp);
 	int ret;
 
+	if (dsa_port_is_dsa(dp)) {
+		dev_err(ds->dev, "port %d: DSA links not supported\n", port);
+		return -EOPNOTSUPP;
+	}
+
+	/* DSA reinits failed user ports as unused; shared ports must
+	 * succeed for the tree to register.
+	 */
+	if (priv->rescue_mode)
+		return dsa_port_is_user(dp) ? -ENODEV : 0;
+
 	ret = mxl862xx_port_state(ds, port, false);
 	if (ret)
 		return ret;
@@ -1346,11 +1464,6 @@ static int mxl862xx_port_setup(struct dsa_switch *ds, int port)
 	if (dsa_port_is_unused(dp))
 		return 0;
 
-	if (dsa_port_is_dsa(dp)) {
-		dev_err(ds->dev, "port %d: DSA links not supported\n", port);
-		return -EOPNOTSUPP;
-	}
-
 	ret = mxl862xx_configure_sp_tag_proto(ds, port, is_cpu_port);
 	if (ret)
 		return ret;
@@ -1572,6 +1685,12 @@ static int mxl862xx_port_mdb_del(struct dsa_switch *ds, int port,
 	ether_addr_copy(qparam.mac, mdb->addr);
 
 	ret = MXL862XX_API_READ(priv, MXL862XX_MAC_TABLEENTRYQUERY, qparam);
+	/* Post-flash teardown or MCUboot: the firmware and its MAC table are
+	 * gone, so there is nothing left to delete. Outside those, -ENODEV is a
+	 * bus error and must be reported.
+	 */
+	if (ret == -ENODEV && (priv->skip_teardown || priv->rescue_mode))
+		return 0;
 	if (ret)
 		return ret;
 
@@ -1628,6 +1747,9 @@ static void mxl862xx_port_stp_state_set(struct dsa_switch *ds, int port,
 	struct mxl862xx_priv *priv = ds->priv;
 	int ret;
 
+	if (priv->rescue_mode)
+		return;
+
 	switch (state) {
 	case BR_STATE_DISABLED:
 		param.port_state = cpu_to_le32(MXL862XX_STP_PORT_STATE_DISABLE);
@@ -2015,6 +2137,12 @@ static void mxl862xx_stats_work_fn(struct work_struct *work)
 	struct dsa_switch *ds = priv->ds;
 	struct dsa_port *dp;
 
+	/* A get_stats64() re-arm can race the flash teardown's WORK_STOPPED
+	 * set and cancel; bail here so a stray poll never runs during a flash.
+	 */
+	if (test_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags))
+		return;
+
 	dsa_switch_for_each_available_port(dp, ds)
 		mxl862xx_stats_poll(ds, dp->index);
 
@@ -2086,6 +2214,8 @@ static const struct dsa_switch_ops mxl862xx_switch_ops = {
 	.get_pause_stats = mxl862xx_get_pause_stats,
 	.get_rmon_stats = mxl862xx_get_rmon_stats,
 	.get_stats64 = mxl862xx_get_stats64,
+	.devlink_info_get = mxl862xx_devlink_info_get,
+	.devlink_flash_update = mxl862xx_devlink_flash_update,
 };
 
 static int mxl862xx_probe(struct mdio_device *mdiodev)
@@ -2129,7 +2259,7 @@ static int mxl862xx_probe(struct mdio_device *mdiodev)
 
 	err = dsa_register_switch(ds);
 	if (err) {
-		set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
+		mxl862xx_stop_work(priv);
 		cancel_delayed_work_sync(&priv->stats_work);
 		mxl862xx_host_shutdown(priv);
 		for (i = 0; i < MXL862XX_MAX_PORTS; i++)
@@ -2150,7 +2280,7 @@ static void mxl862xx_remove(struct mdio_device *mdiodev)
 
 	priv = ds->priv;
 
-	set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
+	mxl862xx_stop_work(priv);
 	cancel_delayed_work_sync(&priv->stats_work);
 
 	dsa_unregister_switch(ds);
@@ -2179,7 +2309,7 @@ static void mxl862xx_shutdown(struct mdio_device *mdiodev)
 
 	dsa_switch_shutdown(ds);
 
-	set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
+	mxl862xx_stop_work(priv);
 	cancel_delayed_work_sync(&priv->stats_work);
 
 	mxl862xx_host_shutdown(priv);
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.h b/drivers/net/dsa/mxl862xx/mxl862xx.h
index 432a5f3f2e08e..da45d24de7cf9 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.h
@@ -4,7 +4,9 @@
 #define __MXL862XX_H
 
 #include <asm/byteorder.h>
+#include <linux/bitops.h>
 #include <linux/mdio.h>
+#include <linux/mutex.h>
 #include <linux/workqueue.h>
 #include <net/dsa.h>
 
@@ -14,6 +16,10 @@ struct mxl862xx_priv;
 #define MXL862XX_FIRST_SERDES_PORT	9
 #define MXL862XX_SERDES_SLOTS		4
 
+/* mxl862xx_rescue_mode_detect() return codes (negative values are errors) */
+#define MXL862XX_NOT_RESCUE		0
+#define MXL862XX_IN_RESCUE		1
+
 #define MXL862XX_DEFAULT_BRIDGE		0
 #define MXL862XX_MAX_BRIDGES		48
 #define MXL862XX_MAX_BRIDGE_PORTS	128
@@ -303,6 +309,10 @@ struct mxl862xx_fw_version {
  *                      flooding)
  * @fw_version:         cached firmware version, populated at probe and
  *                      compared with MXL862XX_FW_VER_MIN()
+ * @asic_id:            chip part number read from the CHIP ID registers,
+ *                      reported as the devlink "asic.id" fixed version
+ * @asic_rev:           chip version read from the CHIP ID registers,
+ *                      reported as the devlink "asic.rev" fixed version
  * @serdes_ports:       SerDes interfaces incl. sub-interfaces in case of
  *                      10G_QXGMII or QSGMII
  * @serdes_refcount:    per-XPCS count of sub-ports enabled by phylink;
@@ -319,6 +329,22 @@ struct mxl862xx_fw_version {
  * @evlan_ingress_size: per-port ingress Extended VLAN block size
  * @evlan_egress_size:  per-port egress Extended VLAN block size
  * @vf_block_size:      per-port VLAN Filter block size
+ * @block_host:         reject firmware API commands (except FW_UPDATE)
+ *                      during a firmware flash
+ * @skip_teardown:      discard firmware API commands during the teardown
+ *                      triggered by the post-flash reprobe
+ * @rescue_mode:        switch is in MCUboot; firmware API commands fail fast,
+ *                      only clause-22 SMDIO works. Set from setup() before the
+ *                      switch is registered and cleared under the MDIO bus lock
+ *                      for the benefit of mxl862xx_api_wrap(); other readers
+ *                      only need it to be a stable single flag.
+ * @rescue_ready:       (rescue_mode) loader is at a clean READY and will accept
+ *                      a flash; false while rescue_heal_work is draining
+ * @rescue_failed:      (rescue_mode) the self-heal gave up; the loader needs a
+ *                      power cycle and no flash can be accepted
+ * @rescue_heal_work:   background self-heal draining a wedged download to READY
+ * @heal_lock:          serialises the self-heal's reprobe hand-off against
+ *                      teardown setting %MXL862XX_FLAG_WORK_STOPPED
  * @stats_work:         periodic work item that polls RMON hardware counters
  *                      and accumulates them into 64-bit per-port stats
  */
@@ -326,9 +352,12 @@ struct mxl862xx_priv {
 	struct dsa_switch *ds;
 	struct mdio_device *mdiodev;
 	struct work_struct crc_err_work;
+	struct work_struct rescue_heal_work;
 	unsigned long flags;
 	u16 drop_meter;
 	struct mxl862xx_fw_version fw_version;
+	u16 asic_id;
+	u8 asic_rev;
 	struct mxl862xx_pcs serdes_ports[8];
 	int serdes_refcount[2];
 	struct mutex serdes_lock;
@@ -337,7 +366,26 @@ struct mxl862xx_priv {
 	u16 evlan_ingress_size;
 	u16 evlan_egress_size;
 	u16 vf_block_size;
+	bool block_host;
+	bool skip_teardown;
+	bool rescue_mode;
+	bool rescue_ready;
+	bool rescue_failed;
+	struct mutex heal_lock;
 	struct delayed_work stats_work;
 };
 
+/* Stop the background workers. The flag is set under heal_lock, which the
+ * rescue self-heal also holds across its own flag test and the queueing of its
+ * reprobe, so no reprobe can slip past a teardown that has begun.
+ */
+static inline void mxl862xx_stop_work(struct mxl862xx_priv *priv)
+{
+	mutex_lock(&priv->heal_lock);
+	set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
+	mutex_unlock(&priv->heal_lock);
+}
+
+int mxl862xx_wait_ready(struct dsa_switch *ds);
+
 #endif /* __MXL862XX_H */
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 6f7f5c17b5320..58597b14e592a 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -1172,6 +1172,9 @@ struct dsa_switch_ops {
 	int	(*devlink_info_get)(struct dsa_switch *ds,
 				    struct devlink_info_req *req,
 				    struct netlink_ext_ack *extack);
+	int	(*devlink_flash_update)(struct dsa_switch *ds,
+					struct devlink_flash_update_params *params,
+					struct netlink_ext_ack *extack);
 	int	(*devlink_sb_pool_get)(struct dsa_switch *ds,
 				       unsigned int sb_index, u16 pool_index,
 				       struct devlink_sb_pool_info *pool_info);
diff --git a/net/dsa/devlink.c b/net/dsa/devlink.c
index ed342f345692b..25311a87cbc56 100644
--- a/net/dsa/devlink.c
+++ b/net/dsa/devlink.c
@@ -20,6 +20,18 @@ static int dsa_devlink_info_get(struct devlink *dl,
 	return -EOPNOTSUPP;
 }
 
+static int dsa_devlink_flash_update(struct devlink *dl,
+				    struct devlink_flash_update_params *params,
+				    struct netlink_ext_ack *extack)
+{
+	struct dsa_switch *ds = dsa_devlink_to_ds(dl);
+
+	if (!ds->ops->devlink_flash_update)
+		return -EOPNOTSUPP;
+
+	return ds->ops->devlink_flash_update(ds, params, extack);
+}
+
 static int dsa_devlink_sb_pool_get(struct devlink *dl,
 				   unsigned int sb_index, u16 pool_index,
 				   struct devlink_sb_pool_info *pool_info)
@@ -169,6 +181,7 @@ dsa_devlink_sb_occ_tc_port_bind_get(struct devlink_port *dlp,
 
 static const struct devlink_ops dsa_devlink_ops = {
 	.info_get			= dsa_devlink_info_get,
+	.flash_update			= dsa_devlink_flash_update,
 	.sb_pool_get			= dsa_devlink_sb_pool_get,
 	.sb_pool_set			= dsa_devlink_sb_pool_set,
 	.sb_port_pool_get		= dsa_devlink_sb_port_pool_get,

gemini-3.1-pro-preview

							input: 27986
							output: 20
							thoughts: 439

**Analyzing the MxL862xx Driver Patch Series**

Okay, so I'm looking at this patch series adding firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. My initial reaction is, this seems straightforward enough. It introduces `mxl862xx-fw.c` which handles the firmware flashing and devlink information retrieval, and then modifies the main driver file, `mxl862xx.c`, to integrate these new functions into the switch operations. Plus, a small modification to `net/dsa/devlink.c` to enable `devlink_flash_update` within the DSA devlink ops. Standard stuff for this kind of feature addition.

Now, my immediate concern is, can I test this easily? I need to think about how this would be reachable in a virtualized setup. The driver is for a DSA switch connected via MDIO, which isn't the most common thing to emulate. I need to figure out if I can even probe this in QEMU. MDIO devices usually require some kind of device tree entry or a scanning MDIO bus to discover them. But is there an emulated MxL862xx switch in QEMU? Almost certainly not. And can syzkaller handle MDIO? I know it can be creative but I don't think it emulates MDIO directly. It might be able to inject some device tree stuff, but that's a long shot.

Wait, let me double-check something. The prompt... ah, there it is! The note about "vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU". That's useful context. This is an MDIO switch driver, not a PCIe one, so it doesn't quite fit the same criteria. Let me make sure it's vendor-specific, which is a good bet for something like this. Yep, MaxLinear MxL862xx.

So, the next question is, can this be tested without specialized hardware? I need to start searching for `mxl862xx` within the kernel to try and find examples of how it's used and what it's dependent on.

{
  "Expression": "mxl862xx"
}

{
  "Output": "\nFull output is too long, showing 500 out of 2637 lines.\nUse more precise expression if possible.\n\nDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml-3----\nDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml:4:$id: http://devicetree.org/schemas/net/dsa/maxlinear,mxl862xx.yaml#\nDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml-5-$schema: http://devicetree.org/meta-schemas/core.yaml#\n--\nDocumentation/networking/devlink/index.rst=77=parameters, info versions, and other features it supports.\n--\nDocumentation/networking/devlink/index.rst-96-   mv88e6xxx\nDocumentation/networking/devlink/index.rst:97:   mxl862xx\nDocumentation/networking/devlink/index.rst-98-   netdevsim\n--\nDocumentation/networking/devlink/mxl862xx.rst-3-========================\nDocumentation/networking/devlink/mxl862xx.rst:4:mxl862xx devlink support\nDocumentation/networking/devlink/mxl862xx.rst-5-========================\n--\nDocumentation/networking/devlink/mxl862xx.rst=7=This document describes the devlink features implemented by the\nDocumentation/networking/devlink/mxl862xx.rst:8:``mxl862xx`` device driver.\nDocumentation/networking/devlink/mxl862xx.rst-9-\nDocumentation/networking/devlink/mxl862xx.rst=10=Info versions\n--\nDocumentation/networking/devlink/mxl862xx.rst-12-\nDocumentation/networking/devlink/mxl862xx.rst:13:The ``mxl862xx`` driver reports the following versions\nDocumentation/networking/devlink/mxl862xx.rst-14-\n--\nDocumentation/networking/devlink/mxl862xx.rst=48=Flash update\n--\nDocumentation/networking/devlink/mxl862xx.rst-50-\nDocumentation/networking/devlink/mxl862xx.rst:51:The ``mxl862xx`` driver implements support for ``devlink dev flash``.\nDocumentation/networking/devlink/mxl862xx.rst-52-The signed firmware image is transferred to the switch over the same\n--\nMAINTAINERS=16108=S:\tMaintained\nMAINTAINERS:16109:F:\tDocumentation/devicetree/bindings/net/dsa/maxlinear,mxl862xx.yaml\nMAINTAINERS:16110:F:\tDocumentation/networking/devlink/mxl862xx.rst\nMAINTAINERS:16111:F:\tdrivers/net/dsa/mxl862xx/\nMAINTAINERS:16112:F:\tnet/dsa/tag_mxl862xx.c\nMAINTAINERS-16113-\n--\ndrivers/net/dsa/Kconfig=75=source \"drivers/net/dsa/mv88e6xxx/Kconfig\"\ndrivers/net/dsa/Kconfig-76-\ndrivers/net/dsa/Kconfig:77:source \"drivers/net/dsa/mxl862xx/Kconfig\"\ndrivers/net/dsa/Kconfig-78-\n--\ndrivers/net/dsa/Makefile=22=obj-y\t\t\t\t+= mv88e6xxx/\ndrivers/net/dsa/Makefile:23:obj-y\t\t\t\t+= mxl862xx/\ndrivers/net/dsa/Makefile-24-obj-y\t\t\t\t+= netc/\n--\ndrivers/net/dsa/mxl862xx/Makefile-1-# SPDX-License-Identifier: GPL-2.0\ndrivers/net/dsa/mxl862xx/Makefile:2:obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o\ndrivers/net/dsa/mxl862xx/Makefile:3:mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h=16=struct mdio_relay_data {\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-23-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:24: * struct mxl862xx_register_mod - Register access parameter to directly\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-25- *                                modify internal registers\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-31- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:32:struct mxl862xx_register_mod {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-33-\t__le16 addr;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-38-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:39: * enum mxl862xx_mac_table_filter - Source/Destination MAC address filtering\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-40- *\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-45- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:46:enum mxl862xx_mac_table_filter {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-47-\tMXL862XX_MAC_FILTER_NONE = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-64-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:65: * struct mxl862xx_mac_table_add - MAC Table Entry to be added\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-66- * @fid: Filtering Identifier (FID) (not supported by all switches)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-74- * @mac: MAC Address to add to the table\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:75: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-76- * @igmp_controlled: Packet is marked as IGMP controlled if destination MAC\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-83- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:84:struct mxl862xx_mac_table_add {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-85-\t__le16 fid;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-100-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:101: * struct mxl862xx_mac_table_remove - MAC Table Entry to be removed\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-102- * @fid: Filtering Identifier (FID)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-103- * @mac: MAC Address to be removed from the table.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:104: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-105- * @tci: TCI for B-Step\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-109- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:110:struct mxl862xx_mac_table_remove {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-111-\t__le16 fid;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-117-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:118: * struct mxl862xx_mac_table_read - MAC Table Entry to be read\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-119- * @initial: Restart the get operation from the beginning of the table\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-128- * @mac: MAC Address. Filled out by the switch API implementation.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:129: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-130- * @igmp_controlled: Packet is marked as IGMP controlled if destination MAC\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-141- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:142:struct mxl862xx_mac_table_read {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-143-\tu8 initial;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-162-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:163: * struct mxl862xx_mac_table_query - MAC Table Entry key-based lookup\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-164- * @mac: MAC Address to search for (input)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-172- * @static_entry: Indicates if this is a Static Entry\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:173: * @filter_flag: See \u0026enum mxl862xx_mac_table_filter (input+output)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-174- * @igmp_controlled: IGMP controlled flag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-180- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:181:struct mxl862xx_mac_table_query {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-182-\tu8 mac[ETH_ALEN];\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-200-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:201: * enum mxl862xx_mac_clear_type - MAC table clear type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-202- * @MXL862XX_MAC_CLEAR_PHY_PORT: clear dynamic entries based on port_id\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-204- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:205:enum mxl862xx_mac_clear_type {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-206-\tMXL862XX_MAC_CLEAR_PHY_PORT = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-210-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:211: * struct mxl862xx_mac_table_clear - MAC table clear\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:212: * @type: see \u0026enum mxl862xx_mac_clear_type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-213- * @port_id: physical port id\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-214- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:215:struct mxl862xx_mac_table_clear {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-216-\tu8 type;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-220-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:221: * enum mxl862xx_age_timer - Aging Timer Value.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-222- * @MXL862XX_AGETIMER_1_SEC: 1 second aging time\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-228- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:229:enum mxl862xx_age_timer {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-230-\tMXL862XX_AGETIMER_1_SEC = 1,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-238-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:239: * struct mxl862xx_bridge_alloc - Bridge Allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-240- * @bridge_id: If the bridge allocation is successful, a valid ID will be\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-247- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:248:struct mxl862xx_bridge_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-249-\t__le16 bridge_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-252-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:253: * enum mxl862xx_bridge_config_mask - Bridge configuration mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-254- * @MXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNING_LIMIT:\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-267- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:268:enum mxl862xx_bridge_config_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-269-\tMXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNING_LIMIT = BIT(0),\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-278-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:279: * enum mxl862xx_bridge_port_egress_meter - Meters for egress traffic type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-280- * @MXL862XX_BRIDGE_PORT_EGRESS_METER_BROADCAST:\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-293- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:294:enum mxl862xx_bridge_port_egress_meter {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-295-\tMXL862XX_BRIDGE_PORT_EGRESS_METER_BROADCAST = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-304-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:305: * struct mxl862xx_qos_meter_cfg - Rate meter configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-306- * @enable: Enable/disable meter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-320- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:321:struct mxl862xx_qos_meter_cfg {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-322-\tu8 enable;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-338-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:339: * enum mxl862xx_bridge_forward_mode - Bridge forwarding type of packet\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-340- * @MXL862XX_BRIDGE_FORWARD_FLOOD: Packet is flooded to port members of\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-343- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:344:enum mxl862xx_bridge_forward_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-345-\tMXL862XX_BRIDGE_FORWARD_FLOOD = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-349-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:350: * struct mxl862xx_bridge_config - Bridge Configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-351- * @bridge_id: Bridge ID (FID)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:352: * @mask: See \u0026enum mxl862xx_bridge_config_mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-353- * @mac_learning_limit_enable: Enable MAC learning limitation\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-363- * @forward_broadcast: Forwarding mode of broadcast traffic. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:364: *                     \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-365- * @forward_unknown_multicast_ip: Forwarding mode of unknown multicast IP\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-366- *                                traffic.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:367: *                                See \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-368- * @forward_unknown_multicast_non_ip: Forwarding mode of unknown multicast\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-369- *                                    non-IP traffic.\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:370: *                                    See \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-371- * @forward_unknown_unicast: Forwarding mode of unknown unicast traffic. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:372: *                           \u0026enum mxl862xx_bridge_forward_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-373- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:374:struct mxl862xx_bridge_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-375-\t__le16 bridge_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:376:\t__le32 mask; /* enum mxl862xx_bridge_config_mask */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-377-\tu8 mac_learning_limit_enable;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-382-\t__le16 traffic_sub_meter_id[MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX];\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:383:\t__le32 forward_broadcast; /* enum mxl862xx_bridge_forward_mode */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:384:\t__le32 forward_unknown_multicast_ip; /* enum mxl862xx_bridge_forward_mode */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:385:\t__le32 forward_unknown_multicast_non_ip; /* enum mxl862xx_bridge_forward_mode */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:386:\t__le32 forward_unknown_unicast; /* enum mxl862xx_bridge_forward_mode */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-387-} __packed;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-389-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:390: * struct mxl862xx_bridge_port_alloc - Bridge Port Allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-391- * @bridge_port_id: If the bridge port allocation is successful, a valid ID\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-397- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:398:struct mxl862xx_bridge_port_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-399-\t__le16 bridge_port_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-402-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:403: * enum mxl862xx_bridge_port_config_mask - Bridge Port configuration mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-404- * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_ID:\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-462- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:463:enum mxl862xx_bridge_port_config_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-464-\tMXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_ID = BIT(0),\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-491-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:492: * enum mxl862xx_color_marking_mode - Color Marking Mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-493- * @MXL862XX_MARKING_ALL_GREEN: mark packets (except critical) to green\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-501- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:502:enum mxl862xx_color_marking_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-503-\tMXL862XX_MARKING_ALL_GREEN = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-513-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:514: * enum mxl862xx_color_remarking_mode - Color Remarking Mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-515- * @MXL862XX_REMARKING_NONE: values from last process stage\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-522- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:523:enum mxl862xx_color_remarking_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-524-\tMXL862XX_REMARKING_NONE = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-533-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:534: * enum mxl862xx_pmapper_mapping_mode - P-mapper Mapping Mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-535- * @MXL862XX_PMAPPER_MAPPING_PCP: Use PCP for VLAN tagged packets to derive\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-541- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:542:enum mxl862xx_pmapper_mapping_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-543-\tMXL862XX_PMAPPER_MAPPING_PCP = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-548-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:549: * struct mxl862xx_pmapper - P-mapper Configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-550- * @pmapper_id: Index of P-mapper (0-31)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-560- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:561:struct mxl862xx_pmapper {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-562-\t__le16 pmapper_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-566-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:567: * struct mxl862xx_bridge_port_config - Bridge Port Configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-568- * @bridge_port_id: Bridge Port ID allocated by bridge port allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:569: * @mask: See \u0026enum mxl862xx_bridge_port_config_mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-570- * @bridge_id: Bridge ID (FID) to which this bridge port is associated\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-583- * @ingress_marking_mode: Ingress color marking mode. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:584: *                        \u0026enum mxl862xx_color_marking_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-585- * @egress_remarking_mode: Color remarking for egress traffic. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:586: *                         \u0026enum mxl862xx_color_remarking_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-587- * @ingress_metering_enable: Traffic metering on ingress traffic applies\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-597- * @pmapper_mapping_mode: P-mapper mapping mode. See\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:598: *                        \u0026enum mxl862xx_pmapper_mapping_mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-599- * @pmapper_id_valid: When true, P-mapper is re-used; when false,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-653- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:654:struct mxl862xx_bridge_port_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-655-\t__le16 bridge_port_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:656:\t__le32 mask; /* enum mxl862xx_bridge_port_config_mask */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-657-\t__le16 bridge_id;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-663-\t__le16 egress_extended_vlan_block_size;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:664:\t__le32 ingress_marking_mode; /* enum mxl862xx_color_marking_mode */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:665:\t__le32 egress_remarking_mode; /* enum mxl862xx_color_remarking_mode */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-666-\tu8 ingress_metering_enable;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-672-\t__le16 dest_sub_if_id_group;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:673:\t__le32 pmapper_mapping_mode; /* enum mxl862xx_pmapper_mapping_mode */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-674-\tu8 pmapper_id_valid;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:675:\tstruct mxl862xx_pmapper pmapper;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-676-\t__le16 bridge_port_map[8];\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-709-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:710: * struct mxl862xx_cfg -  Global Switch configuration Attributes\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:711: * @mac_table_age_timer: See \u0026enum mxl862xx_age_timer\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-712- * @age_timer: Custom MAC table aging timer in seconds\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-722- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:723:struct mxl862xx_cfg {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:724:\t__le32 mac_table_age_timer; /* enum mxl862xx_age_timer */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-725-\t__le32 age_timer;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-734-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:735: * enum mxl862xx_extended_vlan_filter_type - Extended VLAN filter tag type\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-736- * @MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NORMAL: Normal tagged\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-740- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:741:enum mxl862xx_extended_vlan_filter_type {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-742-\tMXL862XX_EXTENDEDVLAN_FILTER_TYPE_NORMAL = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-748-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:749: * enum mxl862xx_extended_vlan_filter_tpid - Extended VLAN filter TPID\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-750- * @MXL862XX_EXTENDEDVLAN_FILTER_TPID_NO_FILTER: No TPID filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-753- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:754:enum mxl862xx_extended_vlan_filter_tpid {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-755-\tMXL862XX_EXTENDEDVLAN_FILTER_TPID_NO_FILTER = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-760-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:761: * enum mxl862xx_extended_vlan_filter_dei - Extended VLAN filter DEI\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-762- * @MXL862XX_EXTENDEDVLAN_FILTER_DEI_NO_FILTER: No DEI filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-765- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:766:enum mxl862xx_extended_vlan_filter_dei {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-767-\tMXL862XX_EXTENDEDVLAN_FILTER_DEI_NO_FILTER = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-772-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:773: * enum mxl862xx_extended_vlan_treatment_remove_tag - Tag removal action\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-774- * @MXL862XX_EXTENDEDVLAN_TREATMENT_NOT_REMOVE_TAG: Do not remove tag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-778- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:779:enum mxl862xx_extended_vlan_treatment_remove_tag {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-780-\tMXL862XX_EXTENDEDVLAN_TREATMENT_NOT_REMOVE_TAG = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-786-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:787: * enum mxl862xx_extended_vlan_treatment_priority - Treatment priority mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-788- * @MXL862XX_EXTENDEDVLAN_TREATMENT_PRIORITY_VAL: Use explicit value\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-792- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:793:enum mxl862xx_extended_vlan_treatment_priority {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-794-\tMXL862XX_EXTENDEDVLAN_TREATMENT_PRIORITY_VAL = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-800-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:801: * enum mxl862xx_extended_vlan_treatment_vid - Treatment VID mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-802- * @MXL862XX_EXTENDEDVLAN_TREATMENT_VID_VAL: Use explicit VID value\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-805- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:806:enum mxl862xx_extended_vlan_treatment_vid {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-807-\tMXL862XX_EXTENDEDVLAN_TREATMENT_VID_VAL = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-812-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:813: * enum mxl862xx_extended_vlan_treatment_tpid - Treatment TPID mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-814- * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_TPID: Copy from inner tag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-818- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:819:enum mxl862xx_extended_vlan_treatment_tpid {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-820-\tMXL862XX_EXTENDEDVLAN_TREATMENT_INNER_TPID = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-826-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:827: * enum mxl862xx_extended_vlan_treatment_dei - Treatment DEI mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-828- * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_DEI: Copy from inner tag\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-832- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:833:enum mxl862xx_extended_vlan_treatment_dei {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-834-\tMXL862XX_EXTENDEDVLAN_TREATMENT_INNER_DEI = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-840-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:841: * enum mxl862xx_extended_vlan_4_tpid_mode - 4-TPID mode selector\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-842- * @MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_1: VLAN TPID type 1\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-846- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:847:enum mxl862xx_extended_vlan_4_tpid_mode {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-848-\tMXL862XX_EXTENDEDVLAN_TPID_VTETYPE_1 = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-854-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:855: * enum mxl862xx_extended_vlan_filter_ethertype - Filter EtherType match\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-856- * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_NO_FILTER: No filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-864- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:865:enum mxl862xx_extended_vlan_filter_ethertype {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-866-\tMXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_NO_FILTER = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-876-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:877: * struct mxl862xx_extendedvlan_filter_vlan - Per-tag filter in Extended VLAN\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:878: * @type: Tag presence/type match (see \u0026enum mxl862xx_extended_vlan_filter_type)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-879- * @priority_enable: Enable PCP value matching\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-882- * @vid_val: VID value to match\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:883: * @tpid: TPID match mode (see \u0026enum mxl862xx_extended_vlan_filter_tpid)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:884: * @dei: DEI match mode (see \u0026enum mxl862xx_extended_vlan_filter_dei)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-885- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:886:struct mxl862xx_extendedvlan_filter_vlan {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-887-\t__le32 type;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-896-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:897: * struct mxl862xx_extendedvlan_filter - Extended VLAN filter configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-898- * @original_packet_filter_mode: If true, filter on original (pre-treatment)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-899- *                               packet\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:900: * @filter_4_tpid_mode: 4-TPID mode (see \u0026enum mxl862xx_extended_vlan_4_tpid_mode)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-901- * @outer_vlan: Outer VLAN tag filter\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-903- * @ether_type: EtherType filter (see\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:904: *              \u0026enum mxl862xx_extended_vlan_filter_ethertype)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-905- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:906:struct mxl862xx_extendedvlan_filter {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-907-\tu8 original_packet_filter_mode;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-908-\t__le32 filter_4_tpid_mode;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:909:\tstruct mxl862xx_extendedvlan_filter_vlan outer_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:910:\tstruct mxl862xx_extendedvlan_filter_vlan inner_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-911-\t__le32 ether_type;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-914-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:915: * struct mxl862xx_extendedvlan_treatment_vlan - Per-tag treatment in\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-916- *                                               Extended VLAN\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-917- * @priority_mode: Priority assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:918: *                 (see \u0026enum mxl862xx_extended_vlan_treatment_priority)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-919- * @priority_val: Priority value (when mode is VAL)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-920- * @vid_mode: VID assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:921: *            (see \u0026enum mxl862xx_extended_vlan_treatment_vid)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-922- * @vid_val: VID value (when mode is VAL)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-923- * @tpid: TPID assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:924: *        (see \u0026enum mxl862xx_extended_vlan_treatment_tpid)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-925- * @dei: DEI assignment mode\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:926: *       (see \u0026enum mxl862xx_extended_vlan_treatment_dei)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-927- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:928:struct mxl862xx_extendedvlan_treatment_vlan {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-929-\t__le32 priority_mode;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-937-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:938: * struct mxl862xx_extendedvlan_treatment - Extended VLAN treatment\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-939- * @remove_tag: Tag removal action\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:940: *              (see \u0026enum mxl862xx_extended_vlan_treatment_remove_tag)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-941- * @treatment_4_tpid_mode: 4-TPID treatment mode\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-958- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:959:struct mxl862xx_extendedvlan_treatment {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-960-\t__le32 remove_tag;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-962-\tu8 add_outer_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:963:\tstruct mxl862xx_extendedvlan_treatment_vlan outer_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-964-\tu8 add_inner_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:965:\tstruct mxl862xx_extendedvlan_treatment_vlan inner_vlan;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-966-\tu8 reassign_bridge_port;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-980-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:981: * struct mxl862xx_extendedvlan_alloc - Extended VLAN block allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-982- * @number_of_entries: Number of entries to allocate (input) / allocated\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-988- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:989:struct mxl862xx_extendedvlan_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-990-\t__le16 number_of_entries;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-994-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:995: * struct mxl862xx_extendedvlan_config - Extended VLAN entry configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-996- * @extended_vlan_block_id: Block ID from allocation\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1002- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1003:struct mxl862xx_extendedvlan_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1004-\t__le16 extended_vlan_block_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1005-\t__le16 entry_index;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1006:\tstruct mxl862xx_extendedvlan_filter filter;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1007:\tstruct mxl862xx_extendedvlan_treatment treatment;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1008-} __packed;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1010-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1011: * enum mxl862xx_vlan_filter_tci_mask - VLAN Filter TCI mask\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1012- * @MXL862XX_VLAN_FILTER_TCI_MASK_VID: TCI mask for VLAN ID\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1015- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1016:enum mxl862xx_vlan_filter_tci_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1017-\tMXL862XX_VLAN_FILTER_TCI_MASK_VID = 0,\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1022-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1023: * struct mxl862xx_vlanfilter_alloc - VLAN Filter block allocation\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1024- * @number_of_entries: Number of entries to allocate (input) / allocated\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1034- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1035:struct mxl862xx_vlanfilter_alloc {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1036-\t__le16 number_of_entries;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1043-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1044: * struct mxl862xx_vlanfilter_config - VLAN Filter entry configuration\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1045- * @vlan_filter_block_id: Block ID from allocation\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1047- * @vlan_filter_mask: TCI field(s) to match (see\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1048: *                    \u0026enum mxl862xx_vlan_filter_tci_mask)\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1049- * @val: TCI value(s) to match (VID, PCP, or full TCI depending on mask)\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1054- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1055:struct mxl862xx_vlanfilter_config {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1056-\t__le16 vlan_filter_block_id;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1057-\t__le16 entry_index;\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1058:\t__le32 vlan_filter_mask; /* enum mxl862xx_vlan_filter_tci_mask */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1059-\t__le32 val;\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1063-/**\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1064: * enum mxl862xx_ss_sp_tag_mask - Special tag valid field indicator bits\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1065- * @MXL862XX_SS_SP_TAG_MASK_RX: valid RX special tag mode\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1069- */\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h:1070:enum mxl862xx_ss_sp_tag_mask {\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1071-\tMXL862XX_SS_SP_TAG_MASK_RX = BIT(0),\n--\ndrivers/net/dsa/mxl862xx/mxl862xx-api.h-1077-/**\n\n"
}

gemini-3.1-pro-preview

							input: 45699
							output: 20
							thoughts: 286

**Analyzing the mxl862xx Driver for Syzkaller Testing**

Okay, so I'm looking at `drivers/net/dsa/mxl862xx/mxl862xx.c`. The immediate question is, can I get this thing to probe in QEMU and, crucially, can Syzkaller test it? It's an MDIO device, which means it's likely to be probed via the device tree or ACPI. I seem to recall some potential for MDIO device injection with `syz_genetlink`... no, wait, that's not quite right. Syzkaller doesn't have a generic MDIO injector, I was thinking of something else. But, hold on... if the device is registered on a virtual MDIO bus, Syzkaller *can* test it, right?

Thinking further, and remembering this is `mxl862xx`, it's a DSA switch. DSA switches, like MDIO devices, are often brought up via the device tree. Hmm, does Syzkaller have any existing tests for DSA switches? Let me check quickly. I know about `syz_genetlink` and `syz_init_net_socket` but I don't remember any device tree injection directly.

So, Syzkaller *can* test a driver if it is instantiated. So the key is, is there a virtual MDIO bus in the kernel that Syzkaller could use to instantiate this `mxl862xx`? I need to go back to `drivers/net/dsa/mxl862xx/mxl862xx.c` and check how it's actually probed to see if a virtual MDIO bus could be utilized.

{
  "Expression": "module_mdio_driver"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 46394
							output: 22
							thoughts: 8

Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and written in the first person:

**Analyzing the Probe Function**

Right, let's get down to brass tacks. I need to make sure this probe function is behaving as expected. There are numerous factors to consider and any deviation from these factors could severely impact the integrity of this entire operation. Is it correctly interpreting the incoming data streams? Is its response time within acceptable parameters for the system's overall latency requirements? I need to verify its sensitivity and selectivity; is it picking up the signal properly and, critically, not triggering on spurious noise or irrelevant inputs? A thorough examination of its internal logic, perhaps tracing a few critical data paths, seems like the most efficient approach to start. Ultimately, I need absolute confidence in its reliability. A weak spot here could compromise everything.

{
  "Expression": "mxl862xx_probe"
}

{
  "Output": "drivers/net/dsa/mxl862xx/mxl862xx.c=2185=static const struct dsa_switch_ops mxl862xx_switch_ops = {\n--\ndrivers/net/dsa/mxl862xx/mxl862xx.c-2220-\ndrivers/net/dsa/mxl862xx/mxl862xx.c:2221:static int mxl862xx_probe(struct mdio_device *mdiodev)\ndrivers/net/dsa/mxl862xx/mxl862xx.c-2222-{\n--\ndrivers/net/dsa/mxl862xx/mxl862xx.c=2330=static struct mdio_driver mxl862xx_driver = {\ndrivers/net/dsa/mxl862xx/mxl862xx.c:2331:\t.probe  = mxl862xx_probe,\ndrivers/net/dsa/mxl862xx/mxl862xx.c-2332-\t.remove = mxl862xx_remove,\n"
}

gemini-3.1-pro-preview

							input: 46907
							output: 52
							thoughts: 454

**Analyzing the Potential for Fuzzing an MDIO Driver in a Virtualized Environment**

Okay, so I'm looking at an `mdio_driver` – specifically, I'm thinking about the `mxl862xx` driver, which is intriguing because it's a physical switch. The initial question is whether or not this driver can even be probed within QEMU. My immediate gut feeling is, *no*, not unless there's a virtual MDIO bus already set up that would instantiate it. I vaguely recall something like `mdio-mockup`, but that's a fleeting thought, and not likely the key here.

My next line of thinking is about Syzkaller. Can Syzkaller reach this driver? The answer, I suspect, is also no. Syzkaller doesn't easily create arbitrary MDIO devices unless they are part of a virtual driver like `mac80211_hwsim` or `netdevsim`. That's where it could work.

Then I get to the crux of the matter: `mxl862xx` is a *physical* switch. The prompt, as I read it, makes it clear that we should rule out patches that involve code paths that are impossible to reach in virtualized environments, like QEMU. That's even when using software-emulated hardware. It calls out specific examples like vendor-specific PCIe switches, and that makes me wonder…is `mxl862xx` a vendor-specific switch that requires physical hardware?

The answer, after some reflection, is a resounding *yes*. It's a MaxLinear MxL862xx switch. It's an MDIO device, which means it's a physical chip connected to an MDIO bus. Crucially, there's no QEMU emulation for this particular chip. Therefore, the code paths in `mxl862xx-fw.c` are simply inaccessible in a virtualized environment. That's the key to this question.

Just to be sure, I briefly consider a workaround: can I instantiate the MDIO device using `sysfs`? Could I potentially override the driver like `echo "mxl862xx" > /sys/bus/mdio_bus/devices/.../driver_override`? Even if that were possible, the probe function, `mxl862xx_probe`, will read and write to the MDIO bus to communicate with the chip. So even with this method, it's impossible.

{
  "File": "drivers/net/dsa/mxl862xx/mxl862xx.c",
  "FirstLine": 2221,
  "LineCount": 100
}

{
  "Contents": "2221:\tstatic int mxl862xx_probe(struct mdio_device *mdiodev)\n2222:\t{\n2223:\t\tstruct device *dev = \u0026mdiodev-\u003edev;\n2224:\t\tstruct mxl862xx_priv *priv;\n2225:\t\tstruct dsa_switch *ds;\n2226:\t\tint err, i;\n2227:\t\n2228:\t\tpriv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);\n2229:\t\tif (!priv)\n2230:\t\t\treturn -ENOMEM;\n2231:\t\n2232:\t\tpriv-\u003emdiodev = mdiodev;\n2233:\t\n2234:\t\tds = devm_kzalloc(dev, sizeof(*ds), GFP_KERNEL);\n2235:\t\tif (!ds)\n2236:\t\t\treturn -ENOMEM;\n2237:\t\n2238:\t\tpriv-\u003eds = ds;\n2239:\t\tds-\u003edev = dev;\n2240:\t\tds-\u003epriv = priv;\n2241:\t\tds-\u003eops = \u0026mxl862xx_switch_ops;\n2242:\t\tds-\u003ephylink_mac_ops = \u0026mxl862xx_phylink_mac_ops;\n2243:\t\tds-\u003enum_ports = MXL862XX_MAX_PORTS;\n2244:\t\tds-\u003efdb_isolation = true;\n2245:\t\tds-\u003emax_num_bridges = MXL862XX_MAX_BRIDGES;\n2246:\t\n2247:\t\tmxl862xx_host_init(priv);\n2248:\t\n2249:\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++) {\n2250:\t\t\tpriv-\u003eports[i].priv = priv;\n2251:\t\t\tINIT_WORK(\u0026priv-\u003eports[i].host_flood_work,\n2252:\t\t\t\t  mxl862xx_host_flood_work_fn);\n2253:\t\t\tspin_lock_init(\u0026priv-\u003eports[i].stats_lock);\n2254:\t\t}\n2255:\t\n2256:\t\tINIT_DELAYED_WORK(\u0026priv-\u003estats_work, mxl862xx_stats_work_fn);\n2257:\t\n2258:\t\tdev_set_drvdata(dev, ds);\n2259:\t\n2260:\t\terr = dsa_register_switch(ds);\n2261:\t\tif (err) {\n2262:\t\t\tmxl862xx_stop_work(priv);\n2263:\t\t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n2264:\t\t\tmxl862xx_host_shutdown(priv);\n2265:\t\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n2266:\t\t\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n2267:\t\t}\n2268:\t\n2269:\t\treturn err;\n2270:\t}\n2271:\t\n2272:\tstatic void mxl862xx_remove(struct mdio_device *mdiodev)\n2273:\t{\n2274:\t\tstruct dsa_switch *ds = dev_get_drvdata(\u0026mdiodev-\u003edev);\n2275:\t\tstruct mxl862xx_priv *priv;\n2276:\t\tint i;\n2277:\t\n2278:\t\tif (!ds)\n2279:\t\t\treturn;\n2280:\t\n2281:\t\tpriv = ds-\u003epriv;\n2282:\t\n2283:\t\tmxl862xx_stop_work(priv);\n2284:\t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n2285:\t\n2286:\t\tdsa_unregister_switch(ds);\n2287:\t\n2288:\t\tmxl862xx_host_shutdown(priv);\n2289:\t\n2290:\t\t/* Cancel any pending host flood work. dsa_unregister_switch()\n2291:\t\t * has already called port_teardown (which sets setup_done=false),\n2292:\t\t * but a worker could still be blocked on rtnl_lock(). Since we\n2293:\t\t * are now outside RTNL, cancel_work_sync() will not deadlock.\n2294:\t\t */\n2295:\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n2296:\t\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n2297:\t}\n2298:\t\n2299:\tstatic void mxl862xx_shutdown(struct mdio_device *mdiodev)\n2300:\t{\n2301:\t\tstruct dsa_switch *ds = dev_get_drvdata(\u0026mdiodev-\u003edev);\n2302:\t\tstruct mxl862xx_priv *priv;\n2303:\t\tint i;\n2304:\t\n2305:\t\tif (!ds)\n2306:\t\t\treturn;\n2307:\t\n2308:\t\tpriv = ds-\u003epriv;\n2309:\t\n2310:\t\tdsa_switch_shutdown(ds);\n2311:\t\n2312:\t\tmxl862xx_stop_work(priv);\n2313:\t\tcancel_delayed_work_sync(\u0026priv-\u003estats_work);\n2314:\t\n2315:\t\tmxl862xx_host_shutdown(priv);\n2316:\t\n2317:\t\tfor (i = 0; i \u003c MXL862XX_MAX_PORTS; i++)\n2318:\t\t\tcancel_work_sync(\u0026priv-\u003eports[i].host_flood_work);\n2319:\t\n2320:\t\tdev_set_drvdata(\u0026mdiodev-\u003edev, NULL);\n"
}

gemini-3.1-pro-preview

							input: 49524
							output: 51
							thoughts: 53

**Analyzing the Data Switch Registration Process**

Okay, so the `probe` function is kicking things off with a call to `dsa_register_switch(ds)`. That's where the magic begins, presumably setting up this DSA switch. My immediate thought is to trace the execution path from there. I know `dsa_register_switch` will, at some point, trigger the `setup` callback associated with the switch operations. Now, let's see which `setup` method is being used in this context. I need to understand how the hardware is being initialized and configured. Time to dive into `mxl862xx_setup` and see what's going on. That should give me a good handle on how this specific switch is being brought online.

{
  "File": "drivers/net/dsa/mxl862xx/mxl862xx.c",
  "FirstLine": 670,
  "LineCount": 100
}

{
  "Contents": " 670:\t\n 671:\tstatic int mxl862xx_setup(struct dsa_switch *ds)\n 672:\t{\n 673:\t\tstruct mxl862xx_priv *priv = ds-\u003epriv;\n 674:\t\tint n_user_ports = 0, max_vlans;\n 675:\t\tint ingress_finals, vid_rules;\n 676:\t\tstruct dsa_port *dp;\n 677:\t\tint ret, i, rescue;\n 678:\t\n 679:\t\t/* The SerDes state is software-only and must exist before anything can\n 680:\t\t * reach phylink, including a rescue-mode flash clearing rescue_mode\n 681:\t\t * ahead of the reprobe.\n 682:\t\t */\n 683:\t\tmutex_init(\u0026priv-\u003eserdes_lock);\n 684:\t\tfor (i = 0; i \u003c ARRAY_SIZE(priv-\u003eserdes_ports); i++)\n 685:\t\t\tmxl862xx_setup_pcs(priv, \u0026priv-\u003eserdes_ports[i],\n 686:\t\t\t\t\t   i + MXL862XX_FIRST_SERDES_PORT);\n 687:\t\n 688:\t\t/* Detect the loader over SB PDI first: it needs no firmware, unlike the\n 689:\t\t * C45 API (mxl862xx_reset/wait_ready) which spews CRC errors when none\n 690:\t\t * answers. Touch C45 only once rescue is ruled out.\n 691:\t\t */\n 692:\t\trescue = mxl862xx_rescue_mode_detect(priv);\n 693:\t\tif (rescue \u003c 0) {\n 694:\t\t\tdev_err(ds-\u003edev, \"switch state detection failed: %pe\\n\",\n 695:\t\t\t\tERR_PTR(rescue));\n 696:\t\t\treturn rescue;\n 697:\t\t}\n 698:\t\n 699:\t\tif (rescue == MXL862XX_NOT_RESCUE) {\n 700:\t\t\tret = mxl862xx_reset(priv);\n 701:\t\t\tif (ret)\n 702:\t\t\t\treturn ret;\n 703:\t\n 704:\t\t\tret = mxl862xx_wait_ready(ds);\n 705:\t\t\tif (ret) {\n 706:\t\t\t\t/* the reset may only now have triggered rescue mode */\n 707:\t\t\t\trescue = mxl862xx_rescue_mode_detect(priv);\n 708:\t\t\t\tif (rescue \u003c 0) {\n 709:\t\t\t\t\tdev_err(ds-\u003edev,\n 710:\t\t\t\t\t\t\"switch not responding after reset: %pe\\n\",\n 711:\t\t\t\t\t\tERR_PTR(rescue));\n 712:\t\t\t\t\treturn rescue;\n 713:\t\t\t\t}\n 714:\t\t\t\tif (rescue == MXL862XX_NOT_RESCUE)\n 715:\t\t\t\t\treturn ret;\n 716:\t\t\t}\n 717:\t\t}\n 718:\t\n 719:\t\tpriv-\u003erescue_mode = rescue;\n 720:\t\n 721:\t\tif (priv-\u003erescue_mode) {\n 722:\t\t\tif (priv-\u003erescue_ready) {\n 723:\t\t\t\tdev_warn(ds-\u003edev,\n 724:\t\t\t\t\t \"switch in MCUboot rescue mode, use devlink to flash new firmware\\n\");\n 725:\t\t\t} else {\n 726:\t\t\t\t/* Drain the wedged download in the background so it\n 727:\t\t\t\t * never holds the devlink lock; info and flash become\n 728:\t\t\t\t * available once ready.\n 729:\t\t\t\t */\n 730:\t\t\t\tdev_warn(ds-\u003edev,\n 731:\t\t\t\t\t \"switch in MCUboot with an interrupted download, recovering in background\\n\");\n 732:\t\t\t\tqueue_work(system_long_wq, \u0026priv-\u003erescue_heal_work);\n 733:\t\t\t}\n 734:\t\t\treturn 0;\n 735:\t\t}\n 736:\t\n 737:\t\t/* Calculate Extended VLAN block sizes.\n 738:\t\t * With VLAN Filter handling VID membership checks:\n 739:\t\t *   Ingress: only final catchall rules (PVID insertion, 802.1Q\n 740:\t\t *            accept, non-8021Q TPID handling, discard).\n 741:\t\t *            Block sized to exactly fit the finals -- no per-VID\n 742:\t\t *            ingress EVLAN rules are needed. (7 entries.)\n 743:\t\t *   Egress:  2 rules per VID that needs tag stripping (untagged VIDs).\n 744:\t\t *            No egress final catchalls -- VLAN Filter does the discard.\n 745:\t\t *   CPU:     EVLAN is left disabled on CPU ports -- frames pass\n 746:\t\t *            through without EVLAN processing.\n 747:\t\t *\n 748:\t\t * Total EVLAN budget:\n 749:\t\t *   n_user_ports * (ingress + egress) \u003c= 1024.\n 750:\t\t * Ingress blocks are small (7 entries), so almost all capacity\n 751:\t\t * goes to egress VID rules.\n 752:\t\t */\n 753:\t\tdsa_switch_for_each_user_port(dp, ds)\n 754:\t\t\tn_user_ports++;\n 755:\t\n 756:\t\tif (n_user_ports) {\n 757:\t\t\tingress_finals = ARRAY_SIZE(ingress_aware_final);\n 758:\t\t\tvid_rules = ARRAY_SIZE(vid_accept_standard);\n 759:\t\n 760:\t\t\t/* Ingress block: fixed at finals count (7 entries) */\n 761:\t\t\tpriv-\u003eevlan_ingress_size = ingress_finals;\n 762:\t\n 763:\t\t\t/* Egress block: remaining budget divided equally among\n 764:\t\t\t * user ports. Each untagged VID needs vid_rules (2)\n 765:\t\t\t * EVLAN entries for tag stripping. Tagged-only VIDs\n 766:\t\t\t * need no EVLAN rules at all.\n 767:\t\t\t */\n 768:\t\t\tmax_vlans = (MXL862XX_TOTAL_EVLAN_ENTRIES -\n 769:\t\t\t\t     n_user_ports * ingress_finals) /\n"
}

gemini-3.1-pro-preview

							input: 51440
							output: 53
							thoughts: 54

**MDIO Driver Inquiry**

Okay, so I'm looking at this code and it's dealing with a driver, specifically an MDIO driver. My immediate thought is, "Right, MDIO, got it." The next part is interesting. It's using `mxl862xx_rescue_mode_detect`. My expertise kicks in – if there's no actual physical hardware present, that function is going to fail, which is logical. Now, let me just quickly double-check that `mxl862xx_rescue_mode_detect` function to confirm my initial assessment and see what it's really doing. I need to understand exactly what that function is about.

{
  "File": "drivers/net/dsa/mxl862xx/mxl862xx-fw.c",
  "FirstLine": 400,
  "LineCount": 100
}

{
  "Contents": " 400:\t\tint ret, stat;\n 401:\t\n 402:\t\twhile (chunk \u003c max_chunks) {\n 403:\t\t\t/* Teardown can interrupt this long drain. */\n 404:\t\t\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n 405:\t\t\t\treturn -ECANCELED;\n 406:\t\n 407:\t\t\tstat = mxl862xx_sb_pdi_poll_drain(priv, MXL862XX_DRAIN_POLL_MS);\n 408:\t\t\tif (stat \u003c 0)\n 409:\t\t\t\treturn stat;\n 410:\t\t\tif (stat == MXL862XX_SB_PDI_READY)\n 411:\t\t\t\treturn 0;\n 412:\t\n 413:\t\t\tif (stat) {\n 414:\t\t\t\tret = mxl862xx_rescue_drain_finish(priv, chunk);\n 415:\t\t\t\tif (ret != -EAGAIN)\n 416:\t\t\t\t\treturn ret;\n 417:\t\t\t}\n 418:\t\n 419:\t\t\t/* Feed one zero byte; reset cleared the write latch. */\n 420:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,\n 421:\t\t\t\t\t\t   MXL862XX_SB_PDI_CTRL_WR);\n 422:\t\t\tif (ret \u003c 0)\n 423:\t\t\t\treturn ret;\n 424:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, 0x0000);\n 425:\t\t\tif (ret \u003c 0)\n 426:\t\t\t\treturn ret;\n 427:\t\t\tret = mxl862xx_sb_pdi_reset(priv);\n 428:\t\t\tif (ret \u003c 0)\n 429:\t\t\t\treturn ret;\n 430:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n 431:\t\t\t\t\t\t   MXL862XX_DRAIN_CHUNK_BYTES);\n 432:\t\t\tif (ret \u003c 0)\n 433:\t\t\t\treturn ret;\n 434:\t\t\tchunk++;\n 435:\t\t\tif (!(chunk % MXL862XX_DRAIN_LOG_BYTES))\n 436:\t\t\t\tdev_info(dev, \"flash: drained %u KiB so far\\n\",\n 437:\t\t\t\t\t chunk / 1024);\n 438:\t\t\tcond_resched();\n 439:\t\t}\n 440:\t\n 441:\t\tdev_err(dev,\n 442:\t\t\t\"flash: interrupted download did not drain after %u chunks\\n\",\n 443:\t\t\tchunk);\n 444:\t\n 445:\t\treturn -ETIMEDOUT;\n 446:\t}\n 447:\t\n 448:\t/* Background self-heal: drain a wedged download off the devlink flash path, so\n 449:\t * the long recovery never holds the devlink lock. Scheduled from probe;\n 450:\t * reprobes on success so the probe-time detection re-classifies the switch.\n 451:\t */\n 452:\tvoid mxl862xx_rescue_heal_work_fn(struct work_struct *work)\n 453:\t{\n 454:\t\tstruct mxl862xx_priv *priv =\n 455:\t\t\tcontainer_of(work, struct mxl862xx_priv, rescue_heal_work);\n 456:\t\tstruct device *dev = \u0026priv-\u003emdiodev-\u003edev;\n 457:\t\tstruct mxl862xx_reprobe *ko;\n 458:\t\tint ret;\n 459:\t\n 460:\t\tret = mxl862xx_rescue_drain(priv);\n 461:\t\tif (ret == -ECANCELED)\n 462:\t\t\treturn;\n 463:\t\tif (ret) {\n 464:\t\t\t/* Nothing retries this, so say so: rescue_ready stays clear\n 465:\t\t\t * and devlink dev flash reports why it refuses.\n 466:\t\t\t */\n 467:\t\t\tdev_err(dev, \"flash: download recovery failed: %pe\\n\",\n 468:\t\t\t\tERR_PTR(ret));\n 469:\t\t\tWRITE_ONCE(priv-\u003erescue_failed, true);\n 470:\t\t\treturn;\n 471:\t\t}\n 472:\t\n 473:\t\t/* The interrupted transfer is finalised; reprobe so the probe-time\n 474:\t\t * detection brings the driver up -- flashable in rescue mode if the\n 475:\t\t * loader is at READY, or normally if a valid image booted. The refs\n 476:\t\t * are released by the reprobe once it completes. heal_lock makes the\n 477:\t\t * flag test and the queueing atomic against teardown, which cannot\n 478:\t\t * cancel a work item this one has already queued.\n 479:\t\t */\n 480:\t\tmutex_lock(\u0026priv-\u003eheal_lock);\n 481:\t\tif (test_bit(MXL862XX_FLAG_WORK_STOPPED, \u0026priv-\u003eflags))\n 482:\t\t\tgoto out;\n 483:\t\tif (!try_module_get(THIS_MODULE))\n 484:\t\t\tgoto out;\n 485:\t\tget_device(dev);\n 486:\t\tko = mxl862xx_reprobe_alloc(dev);\n 487:\t\tif (!ko) {\n 488:\t\t\tput_device(dev);\n 489:\t\t\tmodule_put(THIS_MODULE);\n 490:\t\t\tgoto out;\n 491:\t\t}\n 492:\t\tqueue_delayed_work(system_long_wq, \u0026ko-\u003ework,\n 493:\t\t\t\t   msecs_to_jiffies(MXL862XX_FW_REPROBE_DELAY_MS));\n 494:\tout:\n 495:\t\tmutex_unlock(\u0026priv-\u003eheal_lock);\n 496:\t}\n 497:\t\n 498:\t/* Detect MCUboot rescue mode over clause-22 SMDIO alone, so the caller can rule\n 499:\t * the loader out before any C45 API request (which spews CRC errors when no WSP\n"
}

gemini-3.1-pro-preview

							input: 53376
							output: 53
							thoughts: 21

Okay, let's dive into the rest of `mxl862xx_rescue_mode_detect`. I need to get a clear picture of how this rescue mode detection is actually implemented. I'm already familiar with the broader architecture, but this function is the key to understanding the specifics. I'm expecting to see the low-level interactions with the hardware, perhaps register reads, interrupt handling, or timing loops – something that directly probes the device's state to determine if it's in a rescue scenario. My focus will be on identifying the trigger condition; what specific signals or events tip it off. Is it a particular sequence of operations, a specific error code, or a hardware signal asserted at a specific pin? Furthermore, I'll be looking for the mechanism that sets the rescue flag - is it a simple boolean, a state variable, or perhaps a more complex state machine? Finally, any clues as to how this information is then subsequently used by the rescue process will be of immediate interest. This is where the rubber meets the road.

{
  "File": "drivers/net/dsa/mxl862xx/mxl862xx-fw.c",
  "FirstLine": 500,
  "LineCount": 100
}

{
  "Contents": " 500:\t * firmware answers). A scratch write to ADDR/DATA must latch or the chip is\n 501:\t * absent (-ENODEV); the mailbox is reset first, or a transfer interrupted with\n 502:\t * CTRL=WR would take that write as a payload word instead of latching it. STAT\n 503:\t * then classifies the state, poked destructively only when 0, the one value a\n 504:\t * running firmware never holds:\n 505:\t *\n 506:\t *  - 0xc33c: flashless loop; recognised but not supported here.\n 507:\t *  - 0xc55c: console loop, if the register-read challenge is serviced.\n 508:\t *  - other non-zero: running firmware, left unpoked.\n 509:\t *  - 0: wedged receive loop; the 1-byte slice-advance then says whether it\n 510:\t *    still needs draining or has just finished.\n 511:\t *\n 512:\t * Return: MXL862XX_IN_RESCUE, MXL862XX_NOT_RESCUE, -ENODEV when nothing\n 513:\t * answers, -EOPNOTSUPP for the flashless loop, -ENXIO for a READY loader whose\n 514:\t * mailbox fails the challenge, or an SMDIO bus error.\n 515:\t */\n 516:\tint mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv)\n 517:\t{\n 518:\t\tint stat, dat, ret, rb, a, d;\n 519:\t\n 520:\t\t/* rescue_ready gates flashing; a wedged loader needs the drain first. */\n 521:\t\tWRITE_ONCE(priv-\u003erescue_ready, false);\n 522:\t\n 523:\t\tret = mxl862xx_sb_pdi_reset(priv);\n 524:\t\tif (ret \u003c 0)\n 525:\t\t\treturn ret;\n 526:\t\n 527:\t\t/* Presence: a live chip latches the scratch write, an absent one floats. */\n 528:\t\ta = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,\n 529:\t\t\t\t\t MXL862XX_SB_PDI_PROBE_A);\n 530:\t\tif (a \u003c 0)\n 531:\t\t\treturn a;\n 532:\t\td = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n 533:\t\t\t\t\t MXL862XX_SB_PDI_PROBE_D);\n 534:\t\tif (d \u003c 0)\n 535:\t\t\treturn d;\n 536:\t\ta = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_ADDR);\n 537:\t\tif (a \u003c 0)\n 538:\t\t\treturn a;\n 539:\t\td = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n 540:\t\tif (d \u003c 0)\n 541:\t\t\treturn d;\n 542:\t\tif ((u16)a != MXL862XX_SB_PDI_PROBE_A ||\n 543:\t\t    (u16)d != MXL862XX_SB_PDI_PROBE_D)\n 544:\t\t\treturn -ENODEV;\n 545:\t\n 546:\t\tret = mxl862xx_sb_pdi_reset(priv);\n 547:\t\tif (ret \u003c 0)\n 548:\t\t\treturn ret;\n 549:\t\n 550:\t\tstat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);\n 551:\t\tif (stat \u003c 0)\n 552:\t\t\treturn stat;\n 553:\t\n 554:\t\t/* Flashless-download loop (MxL86281S tier): this driver does not\n 555:\t\t * support it -- the console flash path expects READY. Treat it as an\n 556:\t\t * unusable configuration, like any other unsupported state.\n 557:\t\t */\n 558:\t\tif ((u16)stat == MXL862XX_SB_PDI_DL_READY)\n 559:\t\t\treturn -EOPNOTSUPP;\n 560:\t\n 561:\t\t/* Console loop at READY: confirm the live mailbox with the register-read\n 562:\t\t * challenge (consumes the marker from DATA and re-arms READY).\n 563:\t\t */\n 564:\t\tif ((u16)stat == MXL862XX_SB_PDI_READY) {\n 565:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,\n 566:\t\t\t\t\t\t   MXL862XX_SB_PDI_RDREG_MARK);\n 567:\t\t\tif (ret \u003c 0)\n 568:\t\t\t\treturn ret;\n 569:\t\t\tret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,\n 570:\t\t\t\t\t\t   MXL862XX_SB_PDI_RDREG);\n 571:\t\t\tif (ret \u003c 0)\n 572:\t\t\t\treturn ret;\n 573:\t\t\trb = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,\n 574:\t\t\t\t\t\t       MXL862XX_RESCUE_READY_TIMEOUT_MS);\n 575:\t\t\tdat = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_DATA);\n 576:\t\t\tret = mxl862xx_sb_pdi_reset(priv);\n 577:\t\t\tif (rb \u003c 0)\n 578:\t\t\t\treturn rb;\n 579:\t\t\tif (dat \u003c 0)\n 580:\t\t\t\treturn dat;\n 581:\t\t\tif (ret \u003c 0)\n 582:\t\t\t\treturn ret;\n 583:\t\t\tif (!rb \u0026\u0026 (u16)dat != MXL862XX_SB_PDI_RDREG_MARK) {\n 584:\t\t\t\tWRITE_ONCE(priv-\u003erescue_ready, true);\n 585:\t\t\t\treturn MXL862XX_IN_RESCUE;\n 586:\t\t\t}\n 587:\t\t\treturn -ENXIO;\n 588:\t\t}\n 589:\t\n 590:\t\t/* Any other non-zero value is a running firmware, not a loader. */\n 591:\t\tif (stat)\n 592:\t\t\treturn MXL862XX_NOT_RESCUE;\n 593:\t\n 594:\t\t/* STAT == 0: a wedged receive loop takes a 1-byte slice-advance (feed\n 595:\t\t * one DATA word first, like a drain chunk) and asks for the next chunk\n 596:\t\t * by publishing 0 again. Had that byte been the last one outstanding,\n 597:\t\t * the loader leaves the loop instead and returns to READY, having\n 598:\t\t * consumed the advance -- proof enough of a live mailbox to skip the\n 599:\t\t * challenge. Anything else means it is still working on it. All three\n"
}

gemini-3.1-pro-preview

							input: 55640
							output: 19
							thoughts: 435

**Analyzing the `mxl862xx_rescue_mode_detect` Function**

Okay, so looking at this `mxl862xx_rescue_mode_detect` function, it's pretty straightforward. It's doing a probe to see if the hardware is present, right? It writes some specific values (`MXL862XX_SB_PDI_PROBE_A` and `MXL862XX_SB_PDI_PROBE_D`) to some registers using `mxl862xx_smdio_write`, and then reads them back with `mxl862xx_smdio_read`. If the read values don't match the written ones, it returns `-ENODEV`.

My immediate thought is, if there's no hardware connected, the `mxl862xx_smdio_read` calls will likely return some default value, maybe `0xffff` or `0`, right? These won't match the expected probe values (`0x5a5a` and `0xa5a5` in this example). Consequently, the `rescue` variable will become `-ENODEV`. This, in turn, will cause `mxl862xx_setup` to return `-ENODEV`, and the driver will, therefore, fail its probe.

So, logically, if there's no physical hardware, the driver will always fail during the probe. Now, the real question is, how do I emulate this for testing purposes, specifically with syzkaller? Syzkaller doesn't seem to have direct support for mocking MDIO reads.

However, a thought just struck me. What if syzkaller can inject MDIO devices? I vaguely remember something called `mdio-mockup` or something similar. Let's dig and see if we have access to a tool like `mdio-mockup` to simulate MDIO devices and control the read responses. That could be a workaround to test the failure path without needing physical hardware!

{
  "Expression": "mdio-mockup"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 56542
							output: 19
							thoughts: 10

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Initial Assessment of the `mdio_mockup` Consideration**

Alright, so the prompt throws in `mdio_mockup`. My first reaction is to quickly evaluate its potential relevance. The fact that it's just mentioned, without any context, immediately triggers a mental checklist. Is it a tool, a library, a design pattern, or some specific piece of code I need to consider? I need to think about what the original prompt and problem were that lead to this consideration. Is this an approach that I have considered before, and if not, how might it relate to the existing design?

{
  "Expression": "mdio_mockup"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 56735
							output: 18
							thoughts: 9

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Initial Inquiry: MDIO Dummy Consideration**

Alright, so the question is, what about `mdio-dummy`? It's a fairly specific prompt, implying a pre-existing context – most likely, we're talking about an MDIO interface, and this "dummy" component is relevant to a specific problem or scenario. My immediate thought process begins to branch out: Is this about testing? Simulation? Emulation of a PHY? Perhaps the actual hardware isn't available, or it's a software-only development phase and we need a stand-in for the PHY interaction. The utility of an MDIO dummy depends massively on the specific problem at hand. We're obviously at a point where a placeholder or test harness for MDIO functionality may be critical.

{
  "Expression": "mdio-dummy"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 56962
							output: 18
							thoughts: 9

Okay, here's my interpretation of that thought process, assuming I'm an expert in this field, and rendered in the first person:

**Considering a Specific Abstraction**

Hmm, the task at hand… I'm thinking about the most appropriate approach for managing this particular hardware interface. Should I reach for a more generalized solution, or something tailored? And then it hits me: what about `dummy_mdio`? It's a tempting idea, as this abstraction is designed for a scenario with MDIO. I need to consider if `dummy_mdio` fits into the design, and if there are considerations with its use.

{
  "Expression": "dummy_mdio"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 57137
							output: 111
							thoughts: 358

**My Assessment of the Code Patch**

Okay, let me think this through. The question is whether this code is worth fuzzing. I need to determine if it's reachable in a virtualized environment like QEMU. The prompt explicitly says to return `WorthFuzzing=false` if the patch involves vendor-specific drivers for things like PCIe switches or GPUs that demand physical hardware.

Looking at the code, this `mxl862xx` driver immediately raises a flag. It's a vendor-specific driver for an MDIO switch. And, right off the bat, I suspect it relies on physical hardware, specifically something like a MaxLinear switch chip. My initial impression is that this is not going to work without the actual physical hardware. It seems very likely it's impossible to reach in a virtualized environment.

Just to be certain, I'll quickly confirm my initial assessment. I'll double-check the code to be sure. Yep, the `mxl862xx_probe` function takes a `struct mdio_device *mdiodev` argument, and the driver itself is an `mdio_driver`. This confirms that it's interacting with the MDIO bus. Without a specific emulation of the `mxl862xx` chip in QEMU, the driver will never probe correctly. It will be looking for specific responses over MDIO. It will look for `MXL862XX_SB_PDI_PROBE_A` and `MXL862XX_SB_PDI_PROBE_D`, which will not be there, as no hardware is actually present.

So, the firmware flashing and devlink code changes within this patch are simply unreachable for fuzzing purposes. We won't be able to trigger those code paths with syzkaller.

Therefore, I'm confident in returning `WorthFuzzing=false` and I'll use `set-results` to reflect my conclusion.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds firmware flashing and devlink support to the MaxLinear MxL862xx switch driver. This is a vendor-specific MDIO switch driver that requires physical hardware to probe successfully (it verifies chip presence by writing and reading specific magic values over MDIO). Since this hardware is not emulated in standard QEMU, the code paths are unreachable in virtualized fuzzing environments.",
  "WorthFuzzing": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)