| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/03 07:35 | flow | patch-triage |
4mArgs:null Results: {
"EnableConfigs": [
"REALTEK_PHY"
],
"FocusSymbols": [
"rtl8261x_probe",
"rtl8261x_get_features",
"rtl8261x_read_status",
"rtl8261x_verify_firmware",
"rtl8261x_fw_execute_entry",
"rtl8261x_fw_load",
"rtl8261x_config_intr",
"rtl8261x_handle_interrupt",
"rtl8261x_config_aneg",
"rtl8261x_config_init",
"genphy_c45_pma_soft_reset",
"genphy_c45_an_setup_master_slave",
"genphy_c45_read_master_slave"
],
"Reasoning": "The patch adds support for the Realtek RTL8261C 10Gbps PHY, including firmware loading and parsing, and new Clause 45 master/slave configuration functions. This code is reachable in virtualized environments by emulating a USB network adapter that registers an MDIO bus and responds with the RTL8261C PHY ID. The firmware parsing logic is particularly interesting for fuzzing as it processes external data.",
"WorthFuzzing": true
} |
| 1/1 | 2026/07/03 07:35 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 061d3f7314d4f2b026ea510bf811aef2b5a79fee\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Jul 3 07:35:04 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c\nindex 1269517414288f..870920311f9a01 100644\n--- a/drivers/net/phy/phy-c45.c\n+++ b/drivers/net/phy/phy-c45.c\n@@ -384,6 +384,119 @@ int genphy_c45_check_and_restart_aneg(struct phy_device *phydev, bool restart)\n }\n EXPORT_SYMBOL_GPL(genphy_c45_check_and_restart_aneg);\n \n+/**\n+ * genphy_c45_pma_soft_reset - software reset the PHY via Clause 45 PMA/PMD control register\n+ * @phydev: target phy_device struct\n+ *\n+ * Return: 0 on success, negative errno on failure.\n+ */\n+int genphy_c45_pma_soft_reset(struct phy_device *phydev)\n+{\n+\tint ret, val;\n+\n+\tret = phy_set_bits_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_CTRL1,\n+\t\t\t MDIO_CTRL1_RESET);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\treturn phy_read_mmd_poll_timeout(phydev, MDIO_MMD_PMAPMD,\n+\t\t\t\t\t MDIO_CTRL1, val,\n+\t\t\t\t\t !(val \u0026 MDIO_CTRL1_RESET),\n+\t\t\t\t\t 5000, 600000, true);\n+}\n+EXPORT_SYMBOL_GPL(genphy_c45_pma_soft_reset);\n+\n+/**\n+ * genphy_c45_an_setup_master_slave - Configure Master/Slave setting for C45 PHYs\n+ * @phydev: target phy_device struct\n+ *\n+ * Description: Configure the forced or preferred Master/Slave role\n+ * 10GBASE-T control register (MMD 7, Register 0x0020) according to\n+ * IEEE 802.3 standards.\n+ *\n+ * Return: negative errno code on failure, 0 if Master/Slave didn't change,\n+ * or 1 if Master/Slave modes changed.\n+ */\n+static int genphy_c45_an_setup_master_slave(struct phy_device *phydev)\n+{\n+\tu16 ctl = 0;\n+\n+\tswitch (phydev-\u003emaster_slave_set) {\n+\tcase MASTER_SLAVE_CFG_MASTER_PREFERRED:\n+\t\tctl = MDIO_AN_10GBT_CTRL_MS_PORT_TYPE;\n+\t\tbreak;\n+\tcase MASTER_SLAVE_CFG_SLAVE_PREFERRED:\n+\t\tbreak;\n+\tcase MASTER_SLAVE_CFG_MASTER_FORCE:\n+\t\tctl = MDIO_AN_10GBT_CTRL_MS_ENABLE | MDIO_AN_10GBT_CTRL_MS_VALUE;\n+\t\tbreak;\n+\tcase MASTER_SLAVE_CFG_SLAVE_FORCE:\n+\t\tctl = MDIO_AN_10GBT_CTRL_MS_ENABLE;\n+\t\tbreak;\n+\tcase MASTER_SLAVE_CFG_UNKNOWN:\n+\tcase MASTER_SLAVE_CFG_UNSUPPORTED:\n+\t\treturn 0;\n+\tdefault:\n+\t\tphydev_warn(phydev, \"Unsupported Master/Slave mode\\n\");\n+\t\treturn -EOPNOTSUPP;\n+\t}\n+\n+\treturn phy_modify_mmd_changed(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL,\n+\t\t\t\t MDIO_AN_10GBT_CTRL_MS_ENABLE |\n+\t\t\t\t MDIO_AN_10GBT_CTRL_MS_VALUE |\n+\t\t\t\t MDIO_AN_10GBT_CTRL_MS_PORT_TYPE, ctl);\n+}\n+\n+/**\n+ * genphy_c45_read_master_slave - read master/slave status\n+ * @phydev: target phy_device struct\n+ *\n+ * Description: Read the Master/Slave configuration and status\n+ * from 10GBASE-T control/status registers (MMD 7, Reg 0x0020 and 0x0021).\n+ *\n+ * Return: 0 on success, or a negative error code on failure.\n+ */\n+static int genphy_c45_read_master_slave(struct phy_device *phydev)\n+{\n+\tint val;\n+\n+\tphydev-\u003emaster_slave_get = MASTER_SLAVE_CFG_UNKNOWN;\n+\tphydev-\u003emaster_slave_state = MASTER_SLAVE_STATE_UNKNOWN;\n+\n+\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\n+\tif (val \u0026 MDIO_AN_10GBT_CTRL_MS_ENABLE) {\n+\t\tif (val \u0026 MDIO_AN_10GBT_CTRL_MS_VALUE)\n+\t\t\tphydev-\u003emaster_slave_get = MASTER_SLAVE_CFG_MASTER_FORCE;\n+\t\telse\n+\t\t\tphydev-\u003emaster_slave_get = MASTER_SLAVE_CFG_SLAVE_FORCE;\n+\t} else {\n+\t\tif (val \u0026 MDIO_AN_10GBT_CTRL_MS_PORT_TYPE)\n+\t\t\tphydev-\u003emaster_slave_get = MASTER_SLAVE_CFG_MASTER_PREFERRED;\n+\t\telse\n+\t\t\tphydev-\u003emaster_slave_get = MASTER_SLAVE_CFG_SLAVE_PREFERRED;\n+\t}\n+\n+\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_STAT);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\n+\tif (val \u0026 MDIO_AN_10GBT_STAT_MS_FAULT) {\n+\t\tphydev-\u003emaster_slave_state = MASTER_SLAVE_STATE_ERR;\n+\t} else if (phydev-\u003elink) {\n+\t\tif (val \u0026 MDIO_AN_10GBT_STAT_MS_RES)\n+\t\t\tphydev-\u003emaster_slave_state = MASTER_SLAVE_STATE_MASTER;\n+\t\telse\n+\t\t\tphydev-\u003emaster_slave_state = MASTER_SLAVE_STATE_SLAVE;\n+\t} else {\n+\t\tphydev-\u003emaster_slave_state = MASTER_SLAVE_STATE_UNKNOWN;\n+\t}\n+\n+\treturn 0;\n+}\n+\n /**\n * genphy_c45_aneg_done - return auto-negotiation complete status\n * @phydev: target phy_device struct\n@@ -1192,6 +1305,10 @@ int genphy_c45_read_status(struct phy_device *phydev)\n \t\t\tret = genphy_c45_baset1_read_status(phydev);\n \t\t\tif (ret \u003c 0)\n \t\t\t\treturn ret;\n+\t\t} else {\n+\t\t\tret = genphy_c45_read_master_slave(phydev);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\treturn ret;\n \t\t}\n \n \t\tphy_resolve_aneg_linkmode(phydev);\n@@ -1225,6 +1342,14 @@ int genphy_c45_config_aneg(struct phy_device *phydev)\n \tif (ret \u003e 0)\n \t\tchanged = true;\n \n+\tif (!genphy_c45_baset1_able(phydev)) {\n+\t\tret = genphy_c45_an_setup_master_slave(phydev);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t\tif (ret \u003e 0)\n+\t\t\tchanged = true;\n+\t}\n+\n \treturn genphy_c45_check_and_restart_aneg(phydev, changed);\n }\n EXPORT_SYMBOL_GPL(genphy_c45_config_aneg);\ndiff --git a/drivers/net/phy/realtek/realtek_main.c b/drivers/net/phy/realtek/realtek_main.c\nindex 27268811f564f2..68a2de0b2bd3ba 100644\n--- a/drivers/net/phy/realtek/realtek_main.c\n+++ b/drivers/net/phy/realtek/realtek_main.c\n@@ -8,7 +8,9 @@\n * Copyright (c) 2004 Freescale Semiconductor, Inc.\n */\n #include \u003clinux/bitops.h\u003e\n+#include \u003clinux/crc32.h\u003e\n #include \u003clinux/ethtool_netlink.h\u003e\n+#include \u003clinux/firmware.h\u003e\n #include \u003clinux/of.h\u003e\n #include \u003clinux/phy.h\u003e\n #include \u003clinux/pm_wakeirq.h\u003e\n@@ -141,6 +143,10 @@\n #define RTL8211F_PHYSICAL_ADDR_WORD1\t\t17\n #define RTL8211F_PHYSICAL_ADDR_WORD2\t\t18\n \n+#define RTL8261X_EXT_ADDR_REG\t\t\t0xa436\n+#define RTL8261X_EXT_DATA_REG\t\t\t0xa438\n+#define RTL_8261X_SUB_PHY_ID_ADDR\t\t0x801d\n+\n #define RTL822X_VND1_SERDES_OPTION\t\t\t0x697a\n #define RTL822X_VND1_SERDES_OPTION_MODE_MASK\t\tGENMASK(5, 0)\n #define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII\t\t0\n@@ -251,6 +257,69 @@\n #define RTL_8221B_VM_CG\t\t\t\t0x001cc84a\n #define RTL_8251B\t\t\t\t0x001cc862\n #define RTL_8261C\t\t\t\t0x001cc890\n+#define RTL_8261C_CG\t\t\t\t0x001cc898\n+\n+#define RTL8261C_CE_MODEL\t\t0x00\n+#define RTL8261X_INT_AUTONEG_ERROR\tBIT(0)\n+#define RTL8261X_INT_PAGE_RECV\t\tBIT(2)\n+#define RTL8261X_INT_AUTONEG_DONE\tBIT(3)\n+#define RTL8261X_INT_LINK_CHG\t\tBIT(4)\n+#define RTL8261X_INT_PHY_REG_ACCESS\tBIT(5)\n+#define RTL8261X_INT_PME\t\tBIT(7)\n+#define RTL8261X_INT_ALDPS_CHG\t\tBIT(9)\n+#define RTL8261X_INT_JABBER\t\tBIT(10)\n+\n+#define RTL8261X_INT_MASK_DEFAULT\t(RTL8261X_INT_AUTONEG_DONE | \\\n+\t\t\t\t\t RTL8261X_INT_LINK_CHG | \\\n+\t\t\t\t\t RTL8261X_INT_AUTONEG_ERROR | \\\n+\t\t\t\t\t RTL8261X_INT_JABBER)\n+\n+#define RTL8261X_INT_MASK_ALL\t\t(RTL8261X_INT_AUTONEG_ERROR | \\\n+\t\t\t\t\t RTL8261X_INT_PAGE_RECV | \\\n+\t\t\t\t\t RTL8261X_INT_AUTONEG_DONE | \\\n+\t\t\t\t\t RTL8261X_INT_LINK_CHG | \\\n+\t\t\t\t\t RTL8261X_INT_PHY_REG_ACCESS | \\\n+\t\t\t\t\t RTL8261X_INT_PME | \\\n+\t\t\t\t\t RTL8261X_INT_ALDPS_CHG | \\\n+\t\t\t\t\t RTL8261X_INT_JABBER)\n+\n+#define FW_MAIN_MAGIC\t\t\t0x52544C38\n+#define FW_SUB_MAGIC_8261C\t\t0x32363143\n+#define RTL8261X_POLL_TIMEOUT_MS\t100\n+#define RTL8261X_MAX_MMD_DEV\t\t31\n+\n+#define RTL8261C_CE_FW_NAME\t\"rtl_nic/rtl8261c.bin\"\n+MODULE_FIRMWARE(RTL8261C_CE_FW_NAME);\n+\n+enum rtl8261x_fw_op {\n+\tOP_WRITE = 0x00,\t/* Write */\n+\tOP_POLL = 0x02,\t/* Polling */\n+};\n+\n+struct rtl8261x_fw_header {\n+\t__le32 main_magic;\t/* Main magic number */\n+\t__le32 sub_magic;\t/* Sub magic number */\n+\t__le16 version_major;\t/* Major version */\n+\t__le16 version_minor;\t/* Minor version */\n+\t__le16 num_entries;\t/* Number of entries */\n+\t__le16 reserved;\t/* Reserved */\n+\t__le32 crc32;\t\t/* CRC32 checksum */\n+};\n+\n+struct rtl8261x_fw_entry {\n+\t__u8 type;\t\t/* Operation type (OP_*) */\n+\t__u8 dev;\t\t/* MMD device */\n+\t__le16 addr;\t\t/* Register address */\n+\t__u8 msb;\t\t/* MSB bit position */\n+\t__u8 lsb;\t\t/* LSB bit position */\n+\t__le16 value;\t\t/* Value to write/compare */\n+\t__le16 timeout_ms;\t/* Poll timeout in milliseconds */\n+\t__u8 poll_set;\t\t/* Poll until equal (1) or not equal (0) */\n+\t__u8 reserved;\t\t/* Reserved */\n+};\n+\n+#define FW_HEADER_SIZE\t\tsizeof(struct rtl8261x_fw_header)\n+#define FW_ENTRY_SIZE\t\tsizeof(struct rtl8261x_fw_entry)\n \n /* RTL8211E and RTL8211F support up to three LEDs */\n #define RTL8211x_LED_COUNT\t\t\t3\n@@ -270,6 +339,11 @@ struct rtl821x_priv {\n \tu16 iner;\n };\n \n+struct rtl8261x_priv {\n+\tconst char *fw_name;\n+\tbool fw_loaded;\n+};\n+\n static int rtl821x_read_page(struct phy_device *phydev)\n {\n \treturn __phy_read(phydev, RTL821x_PAGE_SELECT);\n@@ -310,6 +384,325 @@ static int rtl821x_modify_ext_page(struct phy_device *phydev, u16 ext_page,\n \treturn phy_restore_page(phydev, oldpage, ret);\n }\n \n+static int rtl8261x_probe(struct phy_device *phydev)\n+{\n+\tstruct device *dev = \u0026phydev-\u003emdio.dev;\n+\tstruct rtl8261x_priv *priv;\n+\tint sub_phy_id, ret;\n+\n+\tpriv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);\n+\tif (!priv)\n+\t\treturn -ENOMEM;\n+\n+\tphydev-\u003epriv = priv;\n+\n+\tret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8261X_EXT_ADDR_REG,\n+\t\t\t RTL_8261X_SUB_PHY_ID_ADDR);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8261X_EXT_DATA_REG);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tsub_phy_id = (ret \u003e\u003e 8) \u0026 0xff;\n+\n+\tswitch (sub_phy_id) {\n+\tcase RTL8261C_CE_MODEL:\n+\t\tpriv-\u003efw_name = RTL8261C_CE_FW_NAME;\n+\t\tphydev_info(phydev, \"RTL8261C detected (sub_id 0x%02x)\\n\", sub_phy_id);\n+\t\tbreak;\n+\n+\tdefault:\n+\t\tphydev_warn(phydev, \"Unknown sub_id 0x%02x, default behavior\\n\", sub_phy_id);\n+\t\treturn -ENODEV;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int rtl8261x_get_features(struct phy_device *phydev)\n+{\n+\tint ret;\n+\n+\tret = genphy_c45_pma_read_abilities(phydev);\n+\tif (ret)\n+\t\treturn ret;\n+\t/*\n+\t * Supplement Multi-Gig speeds that may not be automatically detected\n+\t * RTL8261X supports 2.5G/5G in addition to standard 10G\n+\t */\n+\tlinkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,\n+\t\t\t phydev-\u003esupported);\n+\tlinkmode_set_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,\n+\t\t\t phydev-\u003esupported);\n+\n+\treturn 0;\n+}\n+\n+static int rtl8261x_read_status(struct phy_device *phydev)\n+{\n+\tint ret, val = 0;\n+\n+\tif (phydev-\u003eautoneg == AUTONEG_ENABLE) {\n+\t\tret = genphy_c45_aneg_done(phydev);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\n+\t\tif (ret) {\n+\t\t\tval = phy_read_mmd(phydev, MDIO_MMD_VEND2,\n+\t\t\t\t\t RTL822X_VND2_C22_REG(MII_STAT1000));\n+\t\t\tif (val \u003c 0)\n+\t\t\t\treturn val;\n+\t\t}\n+\t}\n+\n+\tmii_stat1000_mod_linkmode_lpa_t(phydev-\u003elp_advertising, val);\n+\n+\tret = genphy_c45_read_status(phydev);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\treturn 0;\n+}\n+\n+static int rtl8261x_verify_firmware(struct phy_device *phydev, const struct firmware *fw)\n+{\n+\tconst struct rtl8261x_fw_header *hdr;\n+\tu32 main_magic, sub_magic;\n+\tu32 calc_crc, file_crc;\n+\tsize_t data_len;\n+\tu16 num_entries;\n+\n+\tif (fw-\u003esize \u003c FW_HEADER_SIZE) {\n+\t\tphydev_err(phydev, \"Firmware too small: %zu bytes\\n\", fw-\u003esize);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\thdr = (const struct rtl8261x_fw_header *)fw-\u003edata;\n+\n+\tmain_magic = le32_to_cpu(hdr-\u003emain_magic);\n+\tif (main_magic != FW_MAIN_MAGIC) {\n+\t\tphydev_err(phydev, \"Invalid firmware magic: 0x%08x\\n\", main_magic);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tsub_magic = le32_to_cpu(hdr-\u003esub_magic);\n+\tif (sub_magic != FW_SUB_MAGIC_8261C) {\n+\t\tphydev_err(phydev, \"Invalid sub magic: 0x%08x\\n\", sub_magic);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tnum_entries = le16_to_cpu(hdr-\u003enum_entries);\n+\tdata_len = num_entries * FW_ENTRY_SIZE;\n+\n+\tif (fw-\u003esize != sizeof(*hdr) + data_len) {\n+\t\tphydev_err(phydev, \"Firmware size mismatch\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tcalc_crc = crc32(~0, fw-\u003edata + FW_HEADER_SIZE, data_len) ^ ~0;\n+\tfile_crc = le32_to_cpu(hdr-\u003ecrc32);\n+\n+\tif (calc_crc != file_crc) {\n+\t\tphydev_err(phydev, \"CRC32 mismatch: calculated=0x%08x file=0x%08x\\n\",\n+\t\t\t calc_crc, file_crc);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int rtl8261x_fw_execute_entry(struct phy_device *phydev,\n+\t\t\t\t const struct rtl8261x_fw_entry *entry)\n+{\n+\tu16 addr, value, timeout_ms;\n+\tu8 dev, msb, lsb, poll_set;\n+\tu32 bits, expect_val;\n+\tint ret, val;\n+\n+\tdev = entry-\u003edev;\n+\taddr = le16_to_cpu(entry-\u003eaddr);\n+\tmsb = entry-\u003emsb;\n+\tlsb = entry-\u003elsb;\n+\tvalue = le16_to_cpu(entry-\u003evalue);\n+\ttimeout_ms = le16_to_cpu(entry-\u003etimeout_ms);\n+\tpoll_set = entry-\u003epoll_set;\n+\n+\tif (timeout_ms == 0)\n+\t\ttimeout_ms = RTL8261X_POLL_TIMEOUT_MS;\n+\n+\tif (dev \u003e RTL8261X_MAX_MMD_DEV) {\n+\t\tphydev_err(phydev, \"invalid firmware MMD device: dev=%u\\n\", dev);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (msb \u003e 15 || lsb \u003e msb) {\n+\t\tphydev_err(phydev, \"invalid firmware bits: msb=%u, lsb=%u\\n\", msb, lsb);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tswitch (entry-\u003etype) {\n+\tcase OP_WRITE:\n+\t\tret = phy_modify_mmd(phydev, dev, addr,\n+\t\t\t\t GENMASK(msb, lsb), (value \u003c\u003c lsb) \u0026 GENMASK(msb, lsb));\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t\tbreak;\n+\n+\tcase OP_POLL:\n+\t\tbits = GENMASK(msb, lsb);\n+\t\texpect_val = (value \u003c\u003c lsb) \u0026 bits;\n+\n+\t\tif (poll_set)\n+\t\t\tret = phy_read_mmd_poll_timeout(phydev, dev, addr, val,\n+\t\t\t\t\t\t\t(val \u0026 bits) == expect_val,\n+\t\t\t\t\t\t\t1000, timeout_ms * 1000, false);\n+\t\telse\n+\t\t\tret = phy_read_mmd_poll_timeout(phydev, dev, addr, val,\n+\t\t\t\t\t\t\t(val \u0026 bits) != expect_val,\n+\t\t\t\t\t\t\t1000, timeout_ms * 1000, false);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t\tbreak;\n+\n+\tdefault:\n+\t\treturn -EINVAL;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int rtl8261x_fw_load(struct phy_device *phydev)\n+{\n+\tstruct rtl8261x_priv *priv = phydev-\u003epriv;\n+\tconst struct rtl8261x_fw_entry *entry;\n+\tconst struct rtl8261x_fw_header *hdr;\n+\tconst struct firmware *fw;\n+\tint ret, i;\n+\n+\tif (!priv-\u003efw_name)\n+\t\treturn 0;\n+\n+\tret = request_firmware(\u0026fw, priv-\u003efw_name, \u0026phydev-\u003emdio.dev);\n+\tif (ret) {\n+\t\tphydev_err(phydev, \"Failed to load firmware %s: %d\\n\", priv-\u003efw_name, ret);\n+\t\treturn ret;\n+\t}\n+\n+\tret = rtl8261x_verify_firmware(phydev, fw);\n+\tif (ret)\n+\t\tgoto release_fw;\n+\n+\thdr = (const struct rtl8261x_fw_header *)fw-\u003edata;\n+\n+\tentry = (const struct rtl8261x_fw_entry *)(fw-\u003edata + FW_HEADER_SIZE);\n+\tfor (i = 0; i \u003c le16_to_cpu(hdr-\u003enum_entries); i++, entry++) {\n+\t\tret = rtl8261x_fw_execute_entry(phydev, entry);\n+\t\tif (ret) {\n+\t\t\tphydev_err(phydev, \"Entry %d failed: %d\\n\", i, ret);\n+\t\t\tgoto release_fw;\n+\t\t}\n+\t}\n+\n+\tpriv-\u003efw_loaded = true;\n+\n+release_fw:\n+\trelease_firmware(fw);\n+\treturn ret;\n+}\n+\n+static int rtl8261x_config_intr(struct phy_device *phydev)\n+{\n+\tint ret;\n+\n+\tif (phydev-\u003einterrupts == PHY_INTERRUPT_ENABLED) {\n+\t\tret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\n+\t\tret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INER,\n+\t\t\t\t RTL8261X_INT_MASK_DEFAULT);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t} else {\n+\t\tret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INER, 0);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\n+\t\tret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);\n+\t\tif (ret \u003c 0)\n+\t\t\treturn ret;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static irqreturn_t rtl8261x_handle_interrupt(struct phy_device *phydev)\n+{\n+\tint irq_status;\n+\n+\tirq_status = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);\n+\tif (irq_status \u003c 0) {\n+\t\tphy_error(phydev);\n+\t\treturn IRQ_NONE;\n+\t}\n+\n+\tif (!(irq_status \u0026 RTL8261X_INT_MASK_ALL))\n+\t\treturn IRQ_NONE;\n+\n+\tif (irq_status \u0026 (RTL8261X_INT_LINK_CHG | RTL8261X_INT_AUTONEG_DONE |\n+\t RTL8261X_INT_AUTONEG_ERROR | RTL8261X_INT_JABBER))\n+\t\tphy_trigger_machine(phydev);\n+\n+\treturn IRQ_HANDLED;\n+}\n+\n+static int rtl8261x_config_aneg(struct phy_device *phydev)\n+{\n+\tu16 adv_1g = 0;\n+\tint ret;\n+\n+\tret = genphy_c45_config_aneg(phydev);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\n+\tif (phydev-\u003eautoneg == AUTONEG_DISABLE)\n+\t\treturn 0;\n+\n+\tif (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,\n+\t\t\t phydev-\u003eadvertising))\n+\t\tadv_1g = ADVERTISE_1000FULL;\n+\tif (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT,\n+\t\t\t phydev-\u003eadvertising))\n+\t\tadv_1g |= ADVERTISE_1000HALF;\n+\n+\tret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2,\n+\t\t\t\t RTL822X_VND2_C22_REG(MII_CTRL1000),\n+\t\t\t\t ADVERTISE_1000FULL | ADVERTISE_1000HALF,\n+\t\t\t\t adv_1g);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tif (ret \u003e 0)\n+\t\treturn genphy_c45_restart_aneg(phydev);\n+\n+\treturn 0;\n+}\n+\n+static int rtl8261x_config_init(struct phy_device *phydev)\n+{\n+\tstruct rtl8261x_priv *priv = phydev-\u003epriv;\n+\n+\t/* The firmware parameters are preserved across IEEE soft resets and\n+\t * suspend/resume cycles. Reloading is only necessary after a power\n+\t * cycle or hard reset.\n+\t */\n+\tif (priv-\u003efw_name \u0026\u0026 !priv-\u003efw_loaded)\n+\t\treturn rtl8261x_fw_load(phydev);\n+\n+\treturn 0;\n+}\n+\n static int rtl821x_probe(struct phy_device *phydev)\n {\n \tstruct device *dev = \u0026phydev-\u003emdio.dev;\n@@ -3001,6 +3394,19 @@ static struct phy_driver realtek_drvs[] = {\n \t\t.resume\t\t= genphy_resume,\n \t\t.read_mmd\t= genphy_read_mmd_unsupported,\n \t\t.write_mmd\t= genphy_write_mmd_unsupported,\n+\t}, {\n+\t\tPHY_ID_MATCH_EXACT(RTL_8261C_CG),\n+\t\t.name\t\t\t= \"Realtek RTL8261C 10Gbps PHY\",\n+\t\t.probe\t\t\t= rtl8261x_probe,\n+\t\t.config_init\t\t= rtl8261x_config_init,\n+\t\t.get_features\t\t= rtl8261x_get_features,\n+\t\t.config_aneg\t\t= rtl8261x_config_aneg,\n+\t\t.read_status\t\t= rtl8261x_read_status,\n+\t\t.config_intr\t\t= rtl8261x_config_intr,\n+\t\t.handle_interrupt\t= rtl8261x_handle_interrupt,\n+\t\t.soft_reset\t\t= genphy_c45_pma_soft_reset,\n+\t\t.suspend\t\t= genphy_c45_pma_suspend,\n+\t\t.resume\t\t\t= genphy_c45_pma_resume,\n \t},\n };\n \ndiff --git a/include/linux/phy.h b/include/linux/phy.h\nindex 199a7aaa341bfd..d6bc19931fb835 100644\n--- a/include/linux/phy.h\n+++ b/include/linux/phy.h\n@@ -2309,6 +2309,7 @@ int genphy_c37_read_status(struct phy_device *phydev, bool *changed);\n /* Clause 45 PHY */\n int genphy_c45_restart_aneg(struct phy_device *phydev);\n int genphy_c45_check_and_restart_aneg(struct phy_device *phydev, bool restart);\n+int genphy_c45_pma_soft_reset(struct phy_device *phydev);\n int genphy_c45_aneg_done(struct phy_device *phydev);\n int genphy_c45_read_link(struct phy_device *phydev);\n int genphy_c45_read_lpa(struct phy_device *phydev);\ndiff --git a/include/uapi/linux/mdio.h b/include/uapi/linux/mdio.h\nindex b2541c948fc1eb..06f4bc3c20c717 100644\n--- a/include/uapi/linux/mdio.h\n+++ b/include/uapi/linux/mdio.h\n@@ -332,8 +332,13 @@\n #define MDIO_AN_10GBT_CTRL_ADV2_5G\t0x0080\t/* Advertise 2.5GBASE-T */\n #define MDIO_AN_10GBT_CTRL_ADV5G\t0x0100\t/* Advertise 5GBASE-T */\n #define MDIO_AN_10GBT_CTRL_ADV10G\t0x1000\t/* Advertise 10GBASE-T */\n+#define MDIO_AN_10GBT_CTRL_MS_ENABLE\t0x8000\t/* Master/slave manual config enable */\n+#define MDIO_AN_10GBT_CTRL_MS_VALUE\t0x4000\t/* Master/slave config value (1=Master) */\n+#define MDIO_AN_10GBT_CTRL_MS_PORT_TYPE\t0x2000\t/* Master Preferred Type */\n \n /* AN 10GBASE-T status register. */\n+#define MDIO_AN_10GBT_STAT_MS_FAULT\t0x8000\t/* Master/slave fault */\n+#define MDIO_AN_10GBT_STAT_MS_RES\t0x4000\t/* Master/slave resolution (1=Master) */\n #define MDIO_AN_10GBT_STAT_LP2_5G\t0x0020 /* LP is 2.5GBT capable */\n #define MDIO_AN_10GBT_STAT_LP5G\t\t0x0040 /* LP is 5GBT capable */\n #define MDIO_AN_10GBT_STAT_LPTRR\t0x0200\t/* LP training reset req. */\n"
} |
| 2/1 | 2026/07/03 07:35 | agent | patch-evaluator |
4mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"REALTEK_PHY"
],
"FocusSymbols": [
"rtl8261x_probe",
"rtl8261x_get_features",
"rtl8261x_read_status",
"rtl8261x_verify_firmware",
"rtl8261x_fw_execute_entry",
"rtl8261x_fw_load",
"rtl8261x_config_intr",
"rtl8261x_handle_interrupt",
"rtl8261x_config_aneg",
"rtl8261x_config_init",
"genphy_c45_pma_soft_reset",
"genphy_c45_an_setup_master_slave",
"genphy_c45_read_master_slave"
],
"Reasoning": "The patch adds support for the Realtek RTL8261C 10Gbps PHY, including firmware loading and parsing, and new Clause 45 master/slave configuration functions. This code is reachable in virtualized environments by emulating a USB network adapter that registers an MDIO bus and responds with the RTL8261C PHY ID. The firmware parsing logic is particularly interesting for fuzzing as it processes external data.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 061d3f7314d4f2b026ea510bf811aef2b5a79fee
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Jul 3 07:35:04 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c
index 1269517414288f..870920311f9a01 100644
--- a/drivers/net/phy/phy-c45.c
+++ b/drivers/net/phy/phy-c45.c
@@ -384,6 +384,119 @@ int genphy_c45_check_and_restart_aneg(struct phy_device *phydev, bool restart)
}
EXPORT_SYMBOL_GPL(genphy_c45_check_and_restart_aneg);
+/**
+ * genphy_c45_pma_soft_reset - software reset the PHY via Clause 45 PMA/PMD control register
+ * @phydev: target phy_device struct
+ *
+ * Return: 0 on success, negative errno on failure.
+ */
+int genphy_c45_pma_soft_reset(struct phy_device *phydev)
+{
+ int ret, val;
+
+ ret = phy_set_bits_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_CTRL1,
+ MDIO_CTRL1_RESET);
+ if (ret < 0)
+ return ret;
+
+ return phy_read_mmd_poll_timeout(phydev, MDIO_MMD_PMAPMD,
+ MDIO_CTRL1, val,
+ !(val & MDIO_CTRL1_RESET),
+ 5000, 600000, true);
+}
+EXPORT_SYMBOL_GPL(genphy_c45_pma_soft_reset);
+
+/**
+ * genphy_c45_an_setup_master_slave - Configure Master/Slave setting for C45 PHYs
+ * @phydev: target phy_device struct
+ *
+ * Description: Configure the forced or preferred Master/Slave role
+ * 10GBASE-T control register (MMD 7, Register 0x0020) according to
+ * IEEE 802.3 standards.
+ *
+ * Return: negative errno code on failure, 0 if Master/Slave didn't change,
+ * or 1 if Master/Slave modes changed.
+ */
+static int genphy_c45_an_setup_master_slave(struct phy_device *phydev)
+{
+ u16 ctl = 0;
+
+ switch (phydev->master_slave_set) {
+ case MASTER_SLAVE_CFG_MASTER_PREFERRED:
+ ctl = MDIO_AN_10GBT_CTRL_MS_PORT_TYPE;
+ break;
+ case MASTER_SLAVE_CFG_SLAVE_PREFERRED:
+ break;
+ case MASTER_SLAVE_CFG_MASTER_FORCE:
+ ctl = MDIO_AN_10GBT_CTRL_MS_ENABLE | MDIO_AN_10GBT_CTRL_MS_VALUE;
+ break;
+ case MASTER_SLAVE_CFG_SLAVE_FORCE:
+ ctl = MDIO_AN_10GBT_CTRL_MS_ENABLE;
+ break;
+ case MASTER_SLAVE_CFG_UNKNOWN:
+ case MASTER_SLAVE_CFG_UNSUPPORTED:
+ return 0;
+ default:
+ phydev_warn(phydev, "Unsupported Master/Slave mode\n");
+ return -EOPNOTSUPP;
+ }
+
+ return phy_modify_mmd_changed(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL,
+ MDIO_AN_10GBT_CTRL_MS_ENABLE |
+ MDIO_AN_10GBT_CTRL_MS_VALUE |
+ MDIO_AN_10GBT_CTRL_MS_PORT_TYPE, ctl);
+}
+
+/**
+ * genphy_c45_read_master_slave - read master/slave status
+ * @phydev: target phy_device struct
+ *
+ * Description: Read the Master/Slave configuration and status
+ * from 10GBASE-T control/status registers (MMD 7, Reg 0x0020 and 0x0021).
+ *
+ * Return: 0 on success, or a negative error code on failure.
+ */
+static int genphy_c45_read_master_slave(struct phy_device *phydev)
+{
+ int val;
+
+ phydev->master_slave_get = MASTER_SLAVE_CFG_UNKNOWN;
+ phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+
+ val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL);
+ if (val < 0)
+ return val;
+
+ if (val & MDIO_AN_10GBT_CTRL_MS_ENABLE) {
+ if (val & MDIO_AN_10GBT_CTRL_MS_VALUE)
+ phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_FORCE;
+ else
+ phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_FORCE;
+ } else {
+ if (val & MDIO_AN_10GBT_CTRL_MS_PORT_TYPE)
+ phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_PREFERRED;
+ else
+ phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_PREFERRED;
+ }
+
+ val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_STAT);
+ if (val < 0)
+ return val;
+
+ if (val & MDIO_AN_10GBT_STAT_MS_FAULT) {
+ phydev->master_slave_state = MASTER_SLAVE_STATE_ERR;
+ } else if (phydev->link) {
+ if (val & MDIO_AN_10GBT_STAT_MS_RES)
+ phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
+ else
+ phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
+ } else {
+ phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+ }
+
+ return 0;
+}
+
/**
* genphy_c45_aneg_done - return auto-negotiation complete status
* @phydev: target phy_device struct
@@ -1192,6 +1305,10 @@ int genphy_c45_read_status(struct phy_device *phydev)
ret = genphy_c45_baset1_read_status(phydev);
if (ret < 0)
return ret;
+ } else {
+ ret = genphy_c45_read_master_slave(phydev);
+ if (ret < 0)
+ return ret;
}
phy_resolve_aneg_linkmode(phydev);
@@ -1225,6 +1342,14 @@ int genphy_c45_config_aneg(struct phy_device *phydev)
if (ret > 0)
changed = true;
+ if (!genphy_c45_baset1_able(phydev)) {
+ ret = genphy_c45_an_setup_master_slave(phydev);
+ if (ret < 0)
+ return ret;
+ if (ret > 0)
+ changed = true;
+ }
+
return genphy_c45_check_and_restart_aneg(phydev, changed);
}
EXPORT_SYMBOL_GPL(genphy_c45_config_aneg);
diff --git a/drivers/net/phy/realtek/realtek_main.c b/drivers/net/phy/realtek/realtek_main.c
index 27268811f564f2..68a2de0b2bd3ba 100644
--- a/drivers/net/phy/realtek/realtek_main.c
+++ b/drivers/net/phy/realtek/realtek_main.c
@@ -8,7 +8,9 @@
* Copyright (c) 2004 Freescale Semiconductor, Inc.
*/
#include <linux/bitops.h>
+#include <linux/crc32.h>
#include <linux/ethtool_netlink.h>
+#include <linux/firmware.h>
#include <linux/of.h>
#include <linux/phy.h>
#include <linux/pm_wakeirq.h>
@@ -141,6 +143,10 @@
#define RTL8211F_PHYSICAL_ADDR_WORD1 17
#define RTL8211F_PHYSICAL_ADDR_WORD2 18
+#define RTL8261X_EXT_ADDR_REG 0xa436
+#define RTL8261X_EXT_DATA_REG 0xa438
+#define RTL_8261X_SUB_PHY_ID_ADDR 0x801d
+
#define RTL822X_VND1_SERDES_OPTION 0x697a
#define RTL822X_VND1_SERDES_OPTION_MODE_MASK GENMASK(5, 0)
#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII 0
@@ -251,6 +257,69 @@
#define RTL_8221B_VM_CG 0x001cc84a
#define RTL_8251B 0x001cc862
#define RTL_8261C 0x001cc890
+#define RTL_8261C_CG 0x001cc898
+
+#define RTL8261C_CE_MODEL 0x00
+#define RTL8261X_INT_AUTONEG_ERROR BIT(0)
+#define RTL8261X_INT_PAGE_RECV BIT(2)
+#define RTL8261X_INT_AUTONEG_DONE BIT(3)
+#define RTL8261X_INT_LINK_CHG BIT(4)
+#define RTL8261X_INT_PHY_REG_ACCESS BIT(5)
+#define RTL8261X_INT_PME BIT(7)
+#define RTL8261X_INT_ALDPS_CHG BIT(9)
+#define RTL8261X_INT_JABBER BIT(10)
+
+#define RTL8261X_INT_MASK_DEFAULT (RTL8261X_INT_AUTONEG_DONE | \
+ RTL8261X_INT_LINK_CHG | \
+ RTL8261X_INT_AUTONEG_ERROR | \
+ RTL8261X_INT_JABBER)
+
+#define RTL8261X_INT_MASK_ALL (RTL8261X_INT_AUTONEG_ERROR | \
+ RTL8261X_INT_PAGE_RECV | \
+ RTL8261X_INT_AUTONEG_DONE | \
+ RTL8261X_INT_LINK_CHG | \
+ RTL8261X_INT_PHY_REG_ACCESS | \
+ RTL8261X_INT_PME | \
+ RTL8261X_INT_ALDPS_CHG | \
+ RTL8261X_INT_JABBER)
+
+#define FW_MAIN_MAGIC 0x52544C38
+#define FW_SUB_MAGIC_8261C 0x32363143
+#define RTL8261X_POLL_TIMEOUT_MS 100
+#define RTL8261X_MAX_MMD_DEV 31
+
+#define RTL8261C_CE_FW_NAME "rtl_nic/rtl8261c.bin"
+MODULE_FIRMWARE(RTL8261C_CE_FW_NAME);
+
+enum rtl8261x_fw_op {
+ OP_WRITE = 0x00, /* Write */
+ OP_POLL = 0x02, /* Polling */
+};
+
+struct rtl8261x_fw_header {
+ __le32 main_magic; /* Main magic number */
+ __le32 sub_magic; /* Sub magic number */
+ __le16 version_major; /* Major version */
+ __le16 version_minor; /* Minor version */
+ __le16 num_entries; /* Number of entries */
+ __le16 reserved; /* Reserved */
+ __le32 crc32; /* CRC32 checksum */
+};
+
+struct rtl8261x_fw_entry {
+ __u8 type; /* Operation type (OP_*) */
+ __u8 dev; /* MMD device */
+ __le16 addr; /* Register address */
+ __u8 msb; /* MSB bit position */
+ __u8 lsb; /* LSB bit position */
+ __le16 value; /* Value to write/compare */
+ __le16 timeout_ms; /* Poll timeout in milliseconds */
+ __u8 poll_set; /* Poll until equal (1) or not equal (0) */
+ __u8 reserved; /* Reserved */
+};
+
+#define FW_HEADER_SIZE sizeof(struct rtl8261x_fw_header)
+#define FW_ENTRY_SIZE sizeof(struct rtl8261x_fw_entry)
/* RTL8211E and RTL8211F support up to three LEDs */
#define RTL8211x_LED_COUNT 3
@@ -270,6 +339,11 @@ struct rtl821x_priv {
u16 iner;
};
+struct rtl8261x_priv {
+ const char *fw_name;
+ bool fw_loaded;
+};
+
static int rtl821x_read_page(struct phy_device *phydev)
{
return __phy_read(phydev, RTL821x_PAGE_SELECT);
@@ -310,6 +384,325 @@ static int rtl821x_modify_ext_page(struct phy_device *phydev, u16 ext_page,
return phy_restore_page(phydev, oldpage, ret);
}
+static int rtl8261x_probe(struct phy_device *phydev)
+{
+ struct device *dev = &phydev->mdio.dev;
+ struct rtl8261x_priv *priv;
+ int sub_phy_id, ret;
+
+ priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+
+ phydev->priv = priv;
+
+ ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8261X_EXT_ADDR_REG,
+ RTL_8261X_SUB_PHY_ID_ADDR);
+ if (ret < 0)
+ return ret;
+
+ ret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8261X_EXT_DATA_REG);
+ if (ret < 0)
+ return ret;
+
+ sub_phy_id = (ret >> 8) & 0xff;
+
+ switch (sub_phy_id) {
+ case RTL8261C_CE_MODEL:
+ priv->fw_name = RTL8261C_CE_FW_NAME;
+ phydev_info(phydev, "RTL8261C detected (sub_id 0x%02x)\n", sub_phy_id);
+ break;
+
+ default:
+ phydev_warn(phydev, "Unknown sub_id 0x%02x, default behavior\n", sub_phy_id);
+ return -ENODEV;
+ }
+
+ return 0;
+}
+
+static int rtl8261x_get_features(struct phy_device *phydev)
+{
+ int ret;
+
+ ret = genphy_c45_pma_read_abilities(phydev);
+ if (ret)
+ return ret;
+ /*
+ * Supplement Multi-Gig speeds that may not be automatically detected
+ * RTL8261X supports 2.5G/5G in addition to standard 10G
+ */
+ linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+ phydev->supported);
+ linkmode_set_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+ phydev->supported);
+
+ return 0;
+}
+
+static int rtl8261x_read_status(struct phy_device *phydev)
+{
+ int ret, val = 0;
+
+ if (phydev->autoneg == AUTONEG_ENABLE) {
+ ret = genphy_c45_aneg_done(phydev);
+ if (ret < 0)
+ return ret;
+
+ if (ret) {
+ val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
+ RTL822X_VND2_C22_REG(MII_STAT1000));
+ if (val < 0)
+ return val;
+ }
+ }
+
+ mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
+
+ ret = genphy_c45_read_status(phydev);
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+static int rtl8261x_verify_firmware(struct phy_device *phydev, const struct firmware *fw)
+{
+ const struct rtl8261x_fw_header *hdr;
+ u32 main_magic, sub_magic;
+ u32 calc_crc, file_crc;
+ size_t data_len;
+ u16 num_entries;
+
+ if (fw->size < FW_HEADER_SIZE) {
+ phydev_err(phydev, "Firmware too small: %zu bytes\n", fw->size);
+ return -EINVAL;
+ }
+
+ hdr = (const struct rtl8261x_fw_header *)fw->data;
+
+ main_magic = le32_to_cpu(hdr->main_magic);
+ if (main_magic != FW_MAIN_MAGIC) {
+ phydev_err(phydev, "Invalid firmware magic: 0x%08x\n", main_magic);
+ return -EINVAL;
+ }
+
+ sub_magic = le32_to_cpu(hdr->sub_magic);
+ if (sub_magic != FW_SUB_MAGIC_8261C) {
+ phydev_err(phydev, "Invalid sub magic: 0x%08x\n", sub_magic);
+ return -EINVAL;
+ }
+
+ num_entries = le16_to_cpu(hdr->num_entries);
+ data_len = num_entries * FW_ENTRY_SIZE;
+
+ if (fw->size != sizeof(*hdr) + data_len) {
+ phydev_err(phydev, "Firmware size mismatch\n");
+ return -EINVAL;
+ }
+
+ calc_crc = crc32(~0, fw->data + FW_HEADER_SIZE, data_len) ^ ~0;
+ file_crc = le32_to_cpu(hdr->crc32);
+
+ if (calc_crc != file_crc) {
+ phydev_err(phydev, "CRC32 mismatch: calculated=0x%08x file=0x%08x\n",
+ calc_crc, file_crc);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static int rtl8261x_fw_execute_entry(struct phy_device *phydev,
+ const struct rtl8261x_fw_entry *entry)
+{
+ u16 addr, value, timeout_ms;
+ u8 dev, msb, lsb, poll_set;
+ u32 bits, expect_val;
+ int ret, val;
+
+ dev = entry->dev;
+ addr = le16_to_cpu(entry->addr);
+ msb = entry->msb;
+ lsb = entry->lsb;
+ value = le16_to_cpu(entry->value);
+ timeout_ms = le16_to_cpu(entry->timeout_ms);
+ poll_set = entry->poll_set;
+
+ if (timeout_ms == 0)
+ timeout_ms = RTL8261X_POLL_TIMEOUT_MS;
+
+ if (dev > RTL8261X_MAX_MMD_DEV) {
+ phydev_err(phydev, "invalid firmware MMD device: dev=%u\n", dev);
+ return -EINVAL;
+ }
+
+ if (msb > 15 || lsb > msb) {
+ phydev_err(phydev, "invalid firmware bits: msb=%u, lsb=%u\n", msb, lsb);
+ return -EINVAL;
+ }
+
+ switch (entry->type) {
+ case OP_WRITE:
+ ret = phy_modify_mmd(phydev, dev, addr,
+ GENMASK(msb, lsb), (value << lsb) & GENMASK(msb, lsb));
+ if (ret)
+ return ret;
+ break;
+
+ case OP_POLL:
+ bits = GENMASK(msb, lsb);
+ expect_val = (value << lsb) & bits;
+
+ if (poll_set)
+ ret = phy_read_mmd_poll_timeout(phydev, dev, addr, val,
+ (val & bits) == expect_val,
+ 1000, timeout_ms * 1000, false);
+ else
+ ret = phy_read_mmd_poll_timeout(phydev, dev, addr, val,
+ (val & bits) != expect_val,
+ 1000, timeout_ms * 1000, false);
+ if (ret)
+ return ret;
+ break;
+
+ default:
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static int rtl8261x_fw_load(struct phy_device *phydev)
+{
+ struct rtl8261x_priv *priv = phydev->priv;
+ const struct rtl8261x_fw_entry *entry;
+ const struct rtl8261x_fw_header *hdr;
+ const struct firmware *fw;
+ int ret, i;
+
+ if (!priv->fw_name)
+ return 0;
+
+ ret = request_firmware(&fw, priv->fw_name, &phydev->mdio.dev);
+ if (ret) {
+ phydev_err(phydev, "Failed to load firmware %s: %d\n", priv->fw_name, ret);
+ return ret;
+ }
+
+ ret = rtl8261x_verify_firmware(phydev, fw);
+ if (ret)
+ goto release_fw;
+
+ hdr = (const struct rtl8261x_fw_header *)fw->data;
+
+ entry = (const struct rtl8261x_fw_entry *)(fw->data + FW_HEADER_SIZE);
+ for (i = 0; i < le16_to_cpu(hdr->num_entries); i++, entry++) {
+ ret = rtl8261x_fw_execute_entry(phydev, entry);
+ if (ret) {
+ phydev_err(phydev, "Entry %d failed: %d\n", i, ret);
+ goto release_fw;
+ }
+ }
+
+ priv->fw_loaded = true;
+
+release_fw:
+ release_firmware(fw);
+ return ret;
+}
+
+static int rtl8261x_config_intr(struct phy_device *phydev)
+{
+ int ret;
+
+ if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+ ret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);
+ if (ret < 0)
+ return ret;
+
+ ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INER,
+ RTL8261X_INT_MASK_DEFAULT);
+ if (ret < 0)
+ return ret;
+ } else {
+ ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INER, 0);
+ if (ret < 0)
+ return ret;
+
+ ret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);
+ if (ret < 0)
+ return ret;
+ }
+
+ return 0;
+}
+
+static irqreturn_t rtl8261x_handle_interrupt(struct phy_device *phydev)
+{
+ int irq_status;
+
+ irq_status = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);
+ if (irq_status < 0) {
+ phy_error(phydev);
+ return IRQ_NONE;
+ }
+
+ if (!(irq_status & RTL8261X_INT_MASK_ALL))
+ return IRQ_NONE;
+
+ if (irq_status & (RTL8261X_INT_LINK_CHG | RTL8261X_INT_AUTONEG_DONE |
+ RTL8261X_INT_AUTONEG_ERROR | RTL8261X_INT_JABBER))
+ phy_trigger_machine(phydev);
+
+ return IRQ_HANDLED;
+}
+
+static int rtl8261x_config_aneg(struct phy_device *phydev)
+{
+ u16 adv_1g = 0;
+ int ret;
+
+ ret = genphy_c45_config_aneg(phydev);
+ if (ret < 0)
+ return ret;
+
+ if (phydev->autoneg == AUTONEG_DISABLE)
+ return 0;
+
+ if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+ phydev->advertising))
+ adv_1g = ADVERTISE_1000FULL;
+ if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT,
+ phydev->advertising))
+ adv_1g |= ADVERTISE_1000HALF;
+
+ ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2,
+ RTL822X_VND2_C22_REG(MII_CTRL1000),
+ ADVERTISE_1000FULL | ADVERTISE_1000HALF,
+ adv_1g);
+ if (ret < 0)
+ return ret;
+ if (ret > 0)
+ return genphy_c45_restart_aneg(phydev);
+
+ return 0;
+}
+
+static int rtl8261x_config_init(struct phy_device *phydev)
+{
+ struct rtl8261x_priv *priv = phydev->priv;
+
+ /* The firmware parameters are preserved across IEEE soft resets and
+ * suspend/resume cycles. Reloading is only necessary after a power
+ * cycle or hard reset.
+ */
+ if (priv->fw_name && !priv->fw_loaded)
+ return rtl8261x_fw_load(phydev);
+
+ return 0;
+}
+
static int rtl821x_probe(struct phy_device *phydev)
{
struct device *dev = &phydev->mdio.dev;
@@ -3001,6 +3394,19 @@ static struct phy_driver realtek_drvs[] = {
.resume = genphy_resume,
.read_mmd = genphy_read_mmd_unsupported,
.write_mmd = genphy_write_mmd_unsupported,
+ }, {
+ PHY_ID_MATCH_EXACT(RTL_8261C_CG),
+ .name = "Realtek RTL8261C 10Gbps PHY",
+ .probe = rtl8261x_probe,
+ .config_init = rtl8261x_config_init,
+ .get_features = rtl8261x_get_features,
+ .config_aneg = rtl8261x_config_aneg,
+ .read_status = rtl8261x_read_status,
+ .config_intr = rtl8261x_config_intr,
+ .handle_interrupt = rtl8261x_handle_interrupt,
+ .soft_reset = genphy_c45_pma_soft_reset,
+ .suspend = genphy_c45_pma_suspend,
+ .resume = genphy_c45_pma_resume,
},
};
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 199a7aaa341bfd..d6bc19931fb835 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -2309,6 +2309,7 @@ int genphy_c37_read_status(struct phy_device *phydev, bool *changed);
/* Clause 45 PHY */
int genphy_c45_restart_aneg(struct phy_device *phydev);
int genphy_c45_check_and_restart_aneg(struct phy_device *phydev, bool restart);
+int genphy_c45_pma_soft_reset(struct phy_device *phydev);
int genphy_c45_aneg_done(struct phy_device *phydev);
int genphy_c45_read_link(struct phy_device *phydev);
int genphy_c45_read_lpa(struct phy_device *phydev);
diff --git a/include/uapi/linux/mdio.h b/include/uapi/linux/mdio.h
index b2541c948fc1eb..06f4bc3c20c717 100644
--- a/include/uapi/linux/mdio.h
+++ b/include/uapi/linux/mdio.h
@@ -332,8 +332,13 @@
#define MDIO_AN_10GBT_CTRL_ADV2_5G 0x0080 /* Advertise 2.5GBASE-T */
#define MDIO_AN_10GBT_CTRL_ADV5G 0x0100 /* Advertise 5GBASE-T */
#define MDIO_AN_10GBT_CTRL_ADV10G 0x1000 /* Advertise 10GBASE-T */
+#define MDIO_AN_10GBT_CTRL_MS_ENABLE 0x8000 /* Master/slave manual config enable */
+#define MDIO_AN_10GBT_CTRL_MS_VALUE 0x4000 /* Master/slave config value (1=Master) */
+#define MDIO_AN_10GBT_CTRL_MS_PORT_TYPE 0x2000 /* Master Preferred Type */
/* AN 10GBASE-T status register. */
+#define MDIO_AN_10GBT_STAT_MS_FAULT 0x8000 /* Master/slave fault */
+#define MDIO_AN_10GBT_STAT_MS_RES 0x4000 /* Master/slave resolution (1=Master) */
#define MDIO_AN_10GBT_STAT_LP2_5G 0x0020 /* LP is 2.5GBT capable */
#define MDIO_AN_10GBT_STAT_LP5G 0x0040 /* LP is 5GBT capable */
#define MDIO_AN_10GBT_STAT_LPTRR 0x0200 /* LP training reset req. */
|
| 3/2 | 2026/07/03 07:35 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10233 output: 18 thoughts: 483 Thoughts: **Analyzing the Reachability of the RTL8261C PHY Driver in a Virtualized Context** Okay, so we have this patch adding support for the Realtek RTL8261C 10Gbps PHY in `realtek_main.c`, along with some Clause 45 PHY functions and modifications to existing ones in `phy-c45.c`. Crucially, there's firmware loading for the RTL8261C. My main concern is whether this is actually *reachable* in a virtualized environment. That's the real test. Thinking through it, PHY drivers are usually reachable if we can get a virtual MDIO bus up and running, or if a network driver uses them, which then links to the PHY driver. So, the question becomes: can we instantiate a PHY device through some virtual drivers? Like, maybe `macsec`, or `veth`, or even `netdevsim`? But wait, I'm pretty sure `netdevsim` doesn't actually instantiate *real* PHYs. And then I remember, `netdevsim` doesn't use the `phy_device` structure at all. What about something like `macb` or other drivers that might be emulated in QEMU? Yes, they might be emulated, but they typically use specific PHYs. Then I recall, can Syzkaller inject MDIO traffic? I remembered the existence of `syz_mdio_read`/`syz_mdio_write` system calls, but I have to stop myself - that's not right. Okay, back to basics. Can we reach a function like `genphy_c45_read_status`? Yes, if a PHY device is registered. Now, the key question: can a user register a PHY device? I vaguely recall `mdio-bcm-unimac` and similar things existing. But wait, maybe we could just fuzz the PHY layer directly if there's a way to trigger it. Fuzzing... does Syzkaller fuzz PHY drivers through `tun` or `veth`? No, that doesn't sound right. PHY drivers are usually probed via the MDIO bus. So, is there even a virtual MDIO bus in the kernel? I need to search for that. Let's look for "mdio" combined with something like "mock" or "sim". That's the key. |
| 4/2 | 2026/07/03 07:35 | tool | grepper |
0mError:no matches Args: {
"Expression": "mdio.*sim"
}Results: {
"error": "no matches"
} |
| 5/2 | 2026/07/03 07:36 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11263 output: 18 thoughts: 22 Thoughts: Okay, here's my thought process summarized from that prompt, tailored for an expert audience: **MDIO Driver Instantiation Investigation** Alright, let's get down to brass tacks. My initial thought is to quickly ascertain the landscape of `mdio` drivers within the system. My primary concern is centered on user-space instantiation. Are there any `mdio` drivers exposed, documented, and potentially designed for direct interaction from user applications? I'm thinking about things like direct sysfs access, ioctls, or any other mechanism that provides a user interface. This isn't just a generic probe; I need to understand if the kernel facilitates user-space control over specific `mdio` instances. I'm looking for a quick scan of the typical driver registration patterns, device tree bindings, and any associated character or network interfaces. Understanding the permitted and prohibited user-space instantiation scenarios of MDIO drivers will be important to whatever I am doing. |
| 6/2 | 2026/07/03 07:36 | tool | grepper |
0mError:no matches Args: {
"Expression": "mdio.*virtual"
}Results: {
"error": "no matches"
} |
| 7/2 | 2026/07/03 07:36 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11516 output: 17 thoughts: 18 Thoughts: Okay, here's my interpretation of that thought process, from an expert's perspective: **Diving Deep into the PHY Layer** Hmm, hold on a second. We've been focusing on the higher-level network stack, but I think we're overlooking something critical in this analysis. That file, `drivers/net/phy/fixed_phy.c`... what's its role? I can't ignore it. It's the driver for the "fixed PHY," which, depending on the context, could be a key piece in this network interface puzzle. We need to consider how it's interacting, or *not* interacting, with the rest of the components we're looking at. This could be where the rubber meets the road. |
| 8/2 | 2026/07/03 07:36 | tool | grepper |
0mArgs:{
"Expression": "fixed_phy"
}Results: {
"Output": "drivers/net/dsa/dsa_loop.c=438=static void dsa_loop_phydevs_unregister(void)\n--\ndrivers/net/dsa/dsa_loop.c-441-\t\tif (!IS_ERR(phydevs[i]))\ndrivers/net/dsa/dsa_loop.c:442:\t\t\tfixed_phy_unregister(phydevs[i]);\ndrivers/net/dsa/dsa_loop.c-443-\t}\n--\ndrivers/net/dsa/dsa_loop.c=482=static int __init dsa_loop_init(void)\n--\ndrivers/net/dsa/dsa_loop.c-491-\tfor (i = 0; i \u003c NUM_FIXED_PHYS; i++)\ndrivers/net/dsa/dsa_loop.c:492:\t\tphydevs[i] = fixed_phy_register_100fd();\ndrivers/net/dsa/dsa_loop.c-493-\n--\ndrivers/net/ethernet/broadcom/b44.c=2234=static int b44_register_phy_one(struct b44 *bp)\n--\ndrivers/net/ethernet/broadcom/b44.c-2272-\ndrivers/net/ethernet/broadcom/b44.c:2273:\t\tphydev = fixed_phy_register_100fd();\ndrivers/net/ethernet/broadcom/b44.c-2274-\t\tif (!IS_ERR(phydev))\n--\ndrivers/net/ethernet/broadcom/b44.c=2313=static void b44_unregister_phy_one(struct b44 *bp)\n--\ndrivers/net/ethernet/broadcom/b44.c-2322-\tif (phy_is_pseudo_fixed_link(phydev))\ndrivers/net/ethernet/broadcom/b44.c:2323:\t\tfixed_phy_unregister(phydev);\ndrivers/net/ethernet/broadcom/b44.c-2324-\tmdiobus_unregister(mii_bus);\n--\ndrivers/net/ethernet/broadcom/bgmac.c=1439=int bgmac_phy_connect_direct(struct bgmac *bgmac)\ndrivers/net/ethernet/broadcom/bgmac.c-1440-{\ndrivers/net/ethernet/broadcom/bgmac.c:1441:\tstruct fixed_phy_status fphy_status = {\ndrivers/net/ethernet/broadcom/bgmac.c-1442-\t\t.link = 1,\n--\ndrivers/net/ethernet/broadcom/bgmac.c-1448-\ndrivers/net/ethernet/broadcom/bgmac.c:1449:\tphy_dev = fixed_phy_register(\u0026fphy_status, NULL);\ndrivers/net/ethernet/broadcom/bgmac.c-1450-\tif (IS_ERR(phy_dev)) {\n--\ndrivers/net/ethernet/broadcom/genet/bcmmii.c=97=void bcmgenet_mii_setup(struct net_device *dev)\n--\ndrivers/net/ethernet/broadcom/genet/bcmmii.c-116-\ndrivers/net/ethernet/broadcom/genet/bcmmii.c:117:static int bcmgenet_fixed_phy_link_update(struct net_device *dev,\ndrivers/net/ethernet/broadcom/genet/bcmmii.c:118:\t\t\t\t\t struct fixed_phy_status *status)\ndrivers/net/ethernet/broadcom/genet/bcmmii.c-119-{\n--\ndrivers/net/ethernet/broadcom/genet/bcmmii.c=186=static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)\n--\ndrivers/net/ethernet/broadcom/genet/bcmmii.c-188-\tif (bcmgenet_has_moca_link_det(priv))\ndrivers/net/ethernet/broadcom/genet/bcmmii.c:189:\t\tfixed_phy_set_link_update(priv-\u003edev-\u003ephydev,\ndrivers/net/ethernet/broadcom/genet/bcmmii.c:190:\t\t\t\t\t bcmgenet_fixed_phy_link_update);\ndrivers/net/ethernet/broadcom/genet/bcmmii.c-191-}\n--\ndrivers/net/ethernet/faraday/ftgmac100.c=43=struct ftgmac100_match_data {\n--\ndrivers/net/ethernet/faraday/ftgmac100.c-66-/* For NC-SI to register a fixed-link phy device */\ndrivers/net/ethernet/faraday/ftgmac100.c:67:static struct fixed_phy_status ncsi_phy_status = {\ndrivers/net/ethernet/faraday/ftgmac100.c-68-\t.link = 1,\n--\ndrivers/net/ethernet/faraday/ftgmac100.c=1780=static void ftgmac100_phy_disconnect(struct net_device *netdev)\n--\ndrivers/net/ethernet/faraday/ftgmac100.c-1792-\tif (priv-\u003euse_ncsi)\ndrivers/net/ethernet/faraday/ftgmac100.c:1793:\t\tfixed_phy_unregister(phydev);\ndrivers/net/ethernet/faraday/ftgmac100.c-1794-}\n--\ndrivers/net/ethernet/faraday/ftgmac100.c=1848=static int ftgmac100_probe_ncsi(struct net_device *netdev,\n--\ndrivers/net/ethernet/faraday/ftgmac100.c-1866-\ndrivers/net/ethernet/faraday/ftgmac100.c:1867:\tphydev = fixed_phy_register(\u0026ncsi_phy_status, np);\ndrivers/net/ethernet/faraday/ftgmac100.c-1868-\tif (IS_ERR(phydev)) {\n--\ndrivers/net/ethernet/faraday/ftgmac100.c-1881-err_register_phy:\ndrivers/net/ethernet/faraday/ftgmac100.c:1882:\tfixed_phy_unregister(phydev);\ndrivers/net/ethernet/faraday/ftgmac100.c-1883-err_register_ndev:\n--\ndrivers/net/ethernet/freescale/fec_main.c=2981=static int fec_enet_mii_probe(struct net_device *ndev)\n--\ndrivers/net/ethernet/freescale/fec_main.c-3002-\t\t\tnetdev_info(ndev, \"no PHY, assuming direct connection to switch\\n\");\ndrivers/net/ethernet/freescale/fec_main.c:3003:\t\t\tphy_dev = fixed_phy_register_100fd();\ndrivers/net/ethernet/freescale/fec_main.c-3004-\t\t\tif (IS_ERR(phy_dev)) {\n--\ndrivers/net/ethernet/freescale/fec_main.c-3013-\t\t\tif (phy_is_pseudo_fixed_link(phy_dev))\ndrivers/net/ethernet/freescale/fec_main.c:3014:\t\t\t\tfixed_phy_unregister(phy_dev);\ndrivers/net/ethernet/freescale/fec_main.c-3015-\t\t\tnetdev_err(ndev, \"could not attach to PHY\\n\");\n--\ndrivers/net/ethernet/freescale/fec_main.c=4228=fec_enet_close(struct net_device *ndev)\n--\ndrivers/net/ethernet/freescale/fec_main.c-4243-\tif (!fep-\u003ephy_node \u0026\u0026 phy_is_pseudo_fixed_link(phy_dev))\ndrivers/net/ethernet/freescale/fec_main.c:4244:\t\tfixed_phy_unregister(phy_dev);\ndrivers/net/ethernet/freescale/fec_main.c-4245-\n--\ndrivers/net/ethernet/freescale/gianfar.c=3132=static const struct net_device_ops gfar_netdev_ops = {\n--\ndrivers/net/ethernet/freescale/gianfar.c-3141-\t.ndo_get_stats64 = gfar_get_stats64,\ndrivers/net/ethernet/freescale/gianfar.c:3142:\t.ndo_change_carrier = fixed_phy_change_carrier,\ndrivers/net/ethernet/freescale/gianfar.c-3143-\t.ndo_set_mac_address = gfar_set_mac_addr,\n--\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c=228=void hbg_phy_stop(struct hbg_priv *priv)\n--\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-232-\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c:233:static void hbg_fixed_phy_uninit(void *data)\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-234-{\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c:235:\tfixed_phy_unregister((struct phy_device *)data);\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-236-}\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-237-\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c:238:static int hbg_fixed_phy_init(struct hbg_priv *priv)\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-239-{\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c:240:\tstruct fixed_phy_status hbg_fixed_phy_status = {\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-241-\t\t.link = 1,\n--\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-250-\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c:251:\tphydev = fixed_phy_register(\u0026hbg_fixed_phy_status, NULL);\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-252-\tif (IS_ERR(phydev)) {\n--\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-257-\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c:258:\tret = devm_add_action_or_reset(dev, hbg_fixed_phy_uninit, phydev);\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-259-\tif (ret)\n--\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c=266=int hbg_mdio_init(struct hbg_priv *priv)\n--\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-275-\tif (mac-\u003ephy_addr == HBG_NO_PHY)\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c:276:\t\treturn hbg_fixed_phy_init(priv);\ndrivers/net/ethernet/hisilicon/hibmcge/hbg_mdio.c-277-\n--\ndrivers/net/mdio/of_mdio.c=412=int of_phy_register_fixed_link(struct device_node *np)\ndrivers/net/mdio/of_mdio.c-413-{\ndrivers/net/mdio/of_mdio.c:414:\tstruct fixed_phy_status status = {};\ndrivers/net/mdio/of_mdio.c-415-\tstruct device_node *fixed_link_node;\n--\ndrivers/net/mdio/of_mdio.c-459-register_phy:\ndrivers/net/mdio/of_mdio.c:460:\treturn PTR_ERR_OR_ZERO(fixed_phy_register(\u0026status, np));\ndrivers/net/mdio/of_mdio.c-461-}\n--\ndrivers/net/mdio/of_mdio.c=464=void of_phy_deregister_fixed_link(struct device_node *np)\n--\ndrivers/net/mdio/of_mdio.c-471-\ndrivers/net/mdio/of_mdio.c:472:\tfixed_phy_unregister(phydev);\ndrivers/net/mdio/of_mdio.c-473-\n--\ndrivers/net/phy/Makefile=63=obj-$(CONFIG_DP83TG720_PHY)\t+= dp83tg720.o\ndrivers/net/phy/Makefile:64:obj-$(CONFIG_FIXED_PHY)\t\t+= fixed_phy.o\ndrivers/net/phy/Makefile-65-obj-$(CONFIG_ICPLUS_PHY)\t+= icplus.o\n--\ndrivers/net/phy/fixed_phy.c-27-\ndrivers/net/phy/fixed_phy.c:28:struct fixed_phy {\ndrivers/net/phy/fixed_phy.c-29-\tstruct phy_device *phydev;\ndrivers/net/phy/fixed_phy.c:30:\tstruct fixed_phy_status status;\ndrivers/net/phy/fixed_phy.c:31:\tint (*link_update)(struct net_device *, struct fixed_phy_status *);\ndrivers/net/phy/fixed_phy.c-32-};\ndrivers/net/phy/fixed_phy.c-33-\ndrivers/net/phy/fixed_phy.c:34:static DECLARE_BITMAP(fixed_phy_ids, NUM_FP);\ndrivers/net/phy/fixed_phy.c:35:static struct fixed_phy fmb_fixed_phys[NUM_FP];\ndrivers/net/phy/fixed_phy.c-36-static struct mii_bus *fmb_mii_bus;\ndrivers/net/phy/fixed_phy.c-37-\ndrivers/net/phy/fixed_phy.c:38:static struct fixed_phy *fixed_phy_find(int addr)\ndrivers/net/phy/fixed_phy.c-39-{\ndrivers/net/phy/fixed_phy.c:40:\treturn test_bit(addr, fixed_phy_ids) ? fmb_fixed_phys + addr : NULL;\ndrivers/net/phy/fixed_phy.c-41-}\ndrivers/net/phy/fixed_phy.c-42-\ndrivers/net/phy/fixed_phy.c:43:int fixed_phy_change_carrier(struct net_device *dev, bool new_carrier)\ndrivers/net/phy/fixed_phy.c-44-{\ndrivers/net/phy/fixed_phy.c-45-\tstruct phy_device *phydev = dev-\u003ephydev;\ndrivers/net/phy/fixed_phy.c:46:\tstruct fixed_phy *fp;\ndrivers/net/phy/fixed_phy.c-47-\n--\ndrivers/net/phy/fixed_phy.c-50-\ndrivers/net/phy/fixed_phy.c:51:\tfp = fixed_phy_find(phydev-\u003emdio.addr);\ndrivers/net/phy/fixed_phy.c-52-\tif (!fp)\n--\ndrivers/net/phy/fixed_phy.c-58-}\ndrivers/net/phy/fixed_phy.c:59:EXPORT_SYMBOL_GPL(fixed_phy_change_carrier);\ndrivers/net/phy/fixed_phy.c-60-\ndrivers/net/phy/fixed_phy.c=61=static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)\ndrivers/net/phy/fixed_phy.c-62-{\ndrivers/net/phy/fixed_phy.c:63:\tstruct fixed_phy *fp;\ndrivers/net/phy/fixed_phy.c-64-\ndrivers/net/phy/fixed_phy.c:65:\tfp = fixed_phy_find(phy_addr);\ndrivers/net/phy/fixed_phy.c-66-\tif (!fp)\n--\ndrivers/net/phy/fixed_phy.c=75=static int fixed_mdio_write(struct mii_bus *bus, int phy_addr, int reg_num,\n--\ndrivers/net/phy/fixed_phy.c-85- */\ndrivers/net/phy/fixed_phy.c:86:int fixed_phy_set_link_update(struct phy_device *phydev,\ndrivers/net/phy/fixed_phy.c-87-\t\t\t int (*link_update)(struct net_device *,\ndrivers/net/phy/fixed_phy.c:88:\t\t\t\t\t\t struct fixed_phy_status *))\ndrivers/net/phy/fixed_phy.c-89-{\ndrivers/net/phy/fixed_phy.c:90:\tstruct fixed_phy *fp;\ndrivers/net/phy/fixed_phy.c-91-\n--\ndrivers/net/phy/fixed_phy.c-94-\ndrivers/net/phy/fixed_phy.c:95:\tfp = fixed_phy_find(phydev-\u003emdio.addr);\ndrivers/net/phy/fixed_phy.c-96-\tif (!fp)\n--\ndrivers/net/phy/fixed_phy.c-103-}\ndrivers/net/phy/fixed_phy.c:104:EXPORT_SYMBOL_GPL(fixed_phy_set_link_update);\ndrivers/net/phy/fixed_phy.c-105-\ndrivers/net/phy/fixed_phy.c:106:static void fixed_phy_del(int phy_addr)\ndrivers/net/phy/fixed_phy.c-107-{\ndrivers/net/phy/fixed_phy.c:108:\tstruct fixed_phy *fp;\ndrivers/net/phy/fixed_phy.c-109-\ndrivers/net/phy/fixed_phy.c:110:\tfp = fixed_phy_find(phy_addr);\ndrivers/net/phy/fixed_phy.c-111-\tif (!fp)\n--\ndrivers/net/phy/fixed_phy.c-114-\tmemset(fp, 0, sizeof(*fp));\ndrivers/net/phy/fixed_phy.c:115:\tclear_bit(phy_addr, fixed_phy_ids);\ndrivers/net/phy/fixed_phy.c-116-}\ndrivers/net/phy/fixed_phy.c-117-\ndrivers/net/phy/fixed_phy.c:118:static int fixed_phy_get_free_addr(void)\ndrivers/net/phy/fixed_phy.c-119-{\n--\ndrivers/net/phy/fixed_phy.c-122-\tdo {\ndrivers/net/phy/fixed_phy.c:123:\t\taddr = find_first_zero_bit(fixed_phy_ids, NUM_FP);\ndrivers/net/phy/fixed_phy.c-124-\t\tif (addr == NUM_FP)\ndrivers/net/phy/fixed_phy.c-125-\t\t\treturn -ENOSPC;\ndrivers/net/phy/fixed_phy.c:126:\t} while (test_and_set_bit(addr, fixed_phy_ids));\ndrivers/net/phy/fixed_phy.c-127-\n--\ndrivers/net/phy/fixed_phy.c-130-\ndrivers/net/phy/fixed_phy.c:131:struct phy_device *fixed_phy_register(const struct fixed_phy_status *status,\ndrivers/net/phy/fixed_phy.c-132-\t\t\t\t struct device_node *np)\n--\ndrivers/net/phy/fixed_phy.c-145-\t/* Get the next available PHY address, up to NUM_FP */\ndrivers/net/phy/fixed_phy.c:146:\tphy_addr = fixed_phy_get_free_addr();\ndrivers/net/phy/fixed_phy.c-147-\tif (phy_addr \u003c 0)\n--\ndrivers/net/phy/fixed_phy.c-149-\ndrivers/net/phy/fixed_phy.c:150:\tfmb_fixed_phys[phy_addr].status = *status;\ndrivers/net/phy/fixed_phy.c:151:\tfmb_fixed_phys[phy_addr].status.link = true;\ndrivers/net/phy/fixed_phy.c-152-\n--\ndrivers/net/phy/fixed_phy.c-154-\tif (IS_ERR(phy)) {\ndrivers/net/phy/fixed_phy.c:155:\t\tfixed_phy_del(phy_addr);\ndrivers/net/phy/fixed_phy.c-156-\t\treturn ERR_PTR(-EINVAL);\n--\ndrivers/net/phy/fixed_phy.c-166-\t\tof_node_put(np);\ndrivers/net/phy/fixed_phy.c:167:\t\tfixed_phy_del(phy_addr);\ndrivers/net/phy/fixed_phy.c-168-\t\treturn ERR_PTR(ret);\n--\ndrivers/net/phy/fixed_phy.c-172-}\ndrivers/net/phy/fixed_phy.c:173:EXPORT_SYMBOL_GPL(fixed_phy_register);\ndrivers/net/phy/fixed_phy.c-174-\ndrivers/net/phy/fixed_phy.c:175:struct phy_device *fixed_phy_register_100fd(void)\ndrivers/net/phy/fixed_phy.c-176-{\ndrivers/net/phy/fixed_phy.c:177:\tstatic const struct fixed_phy_status status = {\ndrivers/net/phy/fixed_phy.c-178-\t\t.speed\t= SPEED_100,\n--\ndrivers/net/phy/fixed_phy.c-181-\ndrivers/net/phy/fixed_phy.c:182:\treturn fixed_phy_register(\u0026status, NULL);\ndrivers/net/phy/fixed_phy.c-183-}\ndrivers/net/phy/fixed_phy.c:184:EXPORT_SYMBOL_GPL(fixed_phy_register_100fd);\ndrivers/net/phy/fixed_phy.c-185-\ndrivers/net/phy/fixed_phy.c:186:void fixed_phy_unregister(struct phy_device *phy)\ndrivers/net/phy/fixed_phy.c-187-{\n--\ndrivers/net/phy/fixed_phy.c-189-\tof_node_put(phy-\u003emdio.dev.of_node);\ndrivers/net/phy/fixed_phy.c:190:\tfixed_phy_del(phy-\u003emdio.addr);\ndrivers/net/phy/fixed_phy.c-191-\tphy_device_free(phy);\ndrivers/net/phy/fixed_phy.c-192-}\ndrivers/net/phy/fixed_phy.c:193:EXPORT_SYMBOL_GPL(fixed_phy_unregister);\ndrivers/net/phy/fixed_phy.c-194-\n--\ndrivers/net/phy/phylink.c=3361=static int phylink_mii_emul_read(unsigned int reg,\n--\ndrivers/net/phy/phylink.c-3363-{\ndrivers/net/phy/phylink.c:3364:\tstruct fixed_phy_status fs;\ndrivers/net/phy/phylink.c-3365-\tunsigned long *lpa = state-\u003elp_advertising;\n--\ndrivers/net/phy/swphy.c-4- *\ndrivers/net/phy/swphy.c:5: * Code taken from fixed_phy.c by Russell King.\ndrivers/net/phy/swphy.c-6- *\n--\ndrivers/net/phy/swphy.c=71=static int swphy_decode_speed(int speed)\n--\ndrivers/net/phy/swphy.c-92- */\ndrivers/net/phy/swphy.c:93:int swphy_validate_state(const struct fixed_phy_status *state)\ndrivers/net/phy/swphy.c-94-{\n--\ndrivers/net/phy/swphy.c=106=EXPORT_SYMBOL_GPL(swphy_validate_state);\n--\ndrivers/net/phy/swphy.c-114- */\ndrivers/net/phy/swphy.c:115:int swphy_read_reg(int reg, const struct fixed_phy_status *state)\ndrivers/net/phy/swphy.c-116-{\n--\ndrivers/net/phy/swphy.h-4-\ndrivers/net/phy/swphy.h:5:struct fixed_phy_status;\ndrivers/net/phy/swphy.h-6-\ndrivers/net/phy/swphy.h:7:int swphy_validate_state(const struct fixed_phy_status *state);\ndrivers/net/phy/swphy.h:8:int swphy_read_reg(int reg, const struct fixed_phy_status *state);\ndrivers/net/phy/swphy.h-9-\n--\ninclude/linux/phy_fixed.h-6-\ninclude/linux/phy_fixed.h:7:struct fixed_phy_status {\ninclude/linux/phy_fixed.h-8-\tint speed;\n--\ninclude/linux/phy_fixed.h=16=struct net_device;\n--\ninclude/linux/phy_fixed.h-18-#if IS_ENABLED(CONFIG_FIXED_PHY)\ninclude/linux/phy_fixed.h:19:extern int fixed_phy_change_carrier(struct net_device *dev, bool new_carrier);\ninclude/linux/phy_fixed.h:20:struct phy_device *fixed_phy_register(const struct fixed_phy_status *status,\ninclude/linux/phy_fixed.h-21-\t\t\t\t struct device_node *np);\ninclude/linux/phy_fixed.h:22:struct phy_device *fixed_phy_register_100fd(void);\ninclude/linux/phy_fixed.h-23-\ninclude/linux/phy_fixed.h:24:extern void fixed_phy_unregister(struct phy_device *phydev);\ninclude/linux/phy_fixed.h:25:extern int fixed_phy_set_link_update(struct phy_device *phydev,\ninclude/linux/phy_fixed.h-26-\t\t\tint (*link_update)(struct net_device *,\ninclude/linux/phy_fixed.h:27:\t\t\t\t\t struct fixed_phy_status *));\ninclude/linux/phy_fixed.h-28-#else\ninclude/linux/phy_fixed.h=29=static inline struct phy_device *\ninclude/linux/phy_fixed.h:30:fixed_phy_register(const struct fixed_phy_status *status,\ninclude/linux/phy_fixed.h-31-\t\t struct device_node *np)\n--\ninclude/linux/phy_fixed.h-35-\ninclude/linux/phy_fixed.h:36:static inline struct phy_device *fixed_phy_register_100fd(void)\ninclude/linux/phy_fixed.h-37-{\n--\ninclude/linux/phy_fixed.h-40-\ninclude/linux/phy_fixed.h:41:static inline void fixed_phy_unregister(struct phy_device *phydev)\ninclude/linux/phy_fixed.h-42-{\n"
} |
| 9/2 | 2026/07/03 07:36 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 18803 output: 31 thoughts: 253 Thoughts: **My Current Line of Reasoning** Okay, so I'm trying to figure out how to test these Realtek PHY drivers in a virtual environment. First thought, `fixed_phy` won't work – that's for fixed links, not the dynamic nature of a Realtek PHY. I need something that *simulates* a Realtek PHY. Can I even instantiate one virtually? Using things like `netdevsim`, `dummy`, or `veth` is a dead end; they don't involve PHYs at all. But wait… Syzkaller uses `tun`, `tap`, and `veth`, doesn't it? Could Syzkaller be used to fuzz PHY drivers? It has a `syz_genetlink` interface, doesn't it? Is there an `ethtool` netlink interface? Perhaps I can trigger PHY operations on a virtual device using that. However, virtual devices typically don't *have* a PHY device attached, and I need a device to test the phy functionality. But, hang on... what about `macvlan` or `vlan`? Those sit *on top* of a real device, but if there's no real device, then there's no PHY. Aha! Wait… USB network adapters! Syzkaller fuzzes USB devices, using `dummy_hcd` and `syz_usb_connect`. Many USB network drivers *do* use PHYs! This could be the solution. The key question now is, does *any* USB network driver use MDIO and allow a Realtek PHY to be attached? Let's check that angle. |
| 10/2 | 2026/07/03 07:36 | tool | grepper |
0mArgs:{
"Expression": "mdiobus_register",
"PathPrefix": "drivers/net/usb/"
}Results: {
"Output": "drivers/net/usb/asix_devices.c=669=static int ax88772_init_mdio(struct usbnet *dev)\n--\ndrivers/net/usb/asix_devices.c-686-\ndrivers/net/usb/asix_devices.c:687:\tret = mdiobus_register(priv-\u003emdio);\ndrivers/net/usb/asix_devices.c-688-\tif (ret) {\n--\ndrivers/net/usb/ax88172a.c=61=static int ax88172a_init_mdio(struct usbnet *dev)\n--\ndrivers/net/usb/ax88172a.c-79-\ndrivers/net/usb/ax88172a.c:80:\tret = mdiobus_register(priv-\u003emdio);\ndrivers/net/usb/ax88172a.c-81-\tif (ret) {\n--\ndrivers/net/usb/lan78xx.c=2070=static int lan78xx_mdio_init(struct lan78xx_net *dev)\n--\ndrivers/net/usb/lan78xx.c-2100-\tnode = of_get_child_by_name(dev-\u003eudev-\u003edev.of_node, \"mdio\");\ndrivers/net/usb/lan78xx.c:2101:\tret = of_mdiobus_register(dev-\u003emdiobus, node);\ndrivers/net/usb/lan78xx.c-2102-\tof_node_put(node);\n--\ndrivers/net/usb/smsc95xx.c=1147=static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)\n--\ndrivers/net/usb/smsc95xx.c-1241-\ndrivers/net/usb/smsc95xx.c:1242:\tret = mdiobus_register(pdata-\u003emdiobus);\ndrivers/net/usb/smsc95xx.c-1243-\tif (ret) {\n"
} |
| 11/2 | 2026/07/03 07:36 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19974 output: 34 thoughts: 704 Thoughts: **Realizing the RTL8261C PHY Driver Instantiation Opportunity**
Okay, this is promising. USB network adapters like `asix`, `smsc95xx`, and `lan78xx` all register an MDIO bus. That's key. And when that MDIO bus gets registered, it scans for PHYs. Now, if I can craft a mock USB device using syzkaller that *specifically* responds to MDIO reads with the correct PHY ID for the RTL8261C, I can trick the kernel into instantiating the Realtek PHY driver.
The PHY ID for the RTL8261C is `RTL_8261C_CG`, which translates to `0x001cc898`. So, if the USB device I create responds with `0x001c` on register 2 and `0xc898` on register 3 during an MDIO read, the MDIO bus *should* match it to the Realtek PHY driver and call its probe function! Let's verify this.
I'll check the driver code; it's in `drivers/net/phy/realtek/realtek_main.c`. Ah, yes, the patch explicitly adds a match for that PHY ID:
```c
{
PHY_ID_MATCH_EXACT(RTL_8261C_CG),
.name = "Realtek RTL8261C 10Gbps PHY",
.probe = rtl8261x_probe,
// ... (other functions)
},
```
So, if the MDIO bus detects this PHY ID, it'll bind to this driver, which contains all the required functionality. Now, a crucial detail – is this a Clause 22 or a Clause 45 PHY? The presence of `genphy_c45_pma_soft_reset` in the driver suggests it might be Clause 45.
I need to confirm that `asix` and `smsc95xx` (the potential USB adapter drivers) support Clause 45 MDIO reads. If they don't, I need to figure out if a Clause 22 MDIO bus can instantiate a Clause 45 PHY. Some PHYs are flexible and handle both. The driver seems to be using `MDIO_MMD_VEND2` and `MDIO_MMD_PMAPMD`, which are definitely Clause 45 MMDs. Good. *However*, `phy_read_mmd` *can* actually work over Clause 22 using indirect access (registers 13 and 14) if the PHY supports it. That's a vital point.
And, are there even USB network adapters that are Clause 45 compliant? Yes, something like `Aquantia` should provide a good reference. Time to check `drivers/net/usb/` to see if there are good examples of Clause 45 support. I'm getting closer.
|
| 12/2 | 2026/07/03 07:37 | tool | grepper |
0mError:no matches Args: {
"Expression": "MDIO_.*_C45",
"PathPrefix": "drivers/net/usb/"
}Results: {
"error": "no matches"
} |
| 13/2 | 2026/07/03 07:37 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 21383 output: 34 thoughts: 21 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person: **Decoding the MII_ADDR_C45 Flag** Okay, so I'm looking at this flag, `MII_ADDR_C45`. Instantly, it clicks. *That's* the Clause 45 indicator! Right, Clause 45 MII registers, got it. This means we're dealing with the advanced management interface. Not the old Clause 22 stuff. Now I need to remember the nuances of Clause 45, the register addressing scheme, the extended registers, the… aha! This explains the bit pattern I was seeing in the data. With Clause 45, the addressing works differently. I need to re-evaluate my assumption with the understanding that I'm not dealing with the older, more straightforward MII register set. |
| 14/2 | 2026/07/03 07:37 | tool | grepper |
0mError:no matches Args: {
"Expression": "MII_ADDR_C45",
"PathPrefix": "drivers/net/usb/"
}Results: {
"error": "no matches"
} |
| 15/2 | 2026/07/03 07:37 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 21641 output: 32 thoughts: 63 Thoughts: Okay, here's my take on those thoughts, framed as my own: **Analyzing PHY Access in a Clause 22 Limited Environment** Alright, so even if we're dealing with a USB driver that's only giving us Clause 22 support, I know the PHY framework is clever enough to still tap into those Clause 45 registers. It’ll do this using indirect access through those register pairs, 13 and 14, as long as the bus itself doesn’t have the built-in capability to `read_c45`. I'm pretty sure I've seen that behavior implemented before. That's a good approach. Let's start by digging into `phy_read_mmd` and see exactly how it's handling this situation. Time to see this in practice. |
| 16/2 | 2026/07/03 07:37 | tool | grepper |
0mArgs:{
"Expression": "phy_read_mmd",
"PathPrefix": "drivers/net/phy/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 2178 lines.\nUse more precise expression if possible.\n\ndrivers/net/phy/adin.c=275=static int adin_config_rgmii_mode(struct phy_device *phydev)\n--\ndrivers/net/phy/adin.c-284-\ndrivers/net/phy/adin.c:285:\treg = phy_read_mmd(phydev, MDIO_MMD_VEND1, ADIN1300_GE_RGMII_CFG_REG);\ndrivers/net/phy/adin.c-286-\tif (reg \u003c 0)\n--\ndrivers/net/phy/adin.c=321=static int adin_config_rmii_mode(struct phy_device *phydev)\n--\ndrivers/net/phy/adin.c-330-\ndrivers/net/phy/adin.c:331:\treg = phy_read_mmd(phydev, MDIO_MMD_VEND1, ADIN1300_GE_RMII_CFG_REG);\ndrivers/net/phy/adin.c-332-\tif (reg \u003c 0)\n--\ndrivers/net/phy/adin.c=440=static int adin_get_fast_down(struct phy_device *phydev, u8 *msecs)\n--\ndrivers/net/phy/adin.c-443-\ndrivers/net/phy/adin.c:444:\treg = phy_read_mmd(phydev, MDIO_MMD_VEND1, ADIN1300_FLD_EN_REG);\ndrivers/net/phy/adin.c-445-\tif (reg \u003c 0)\n--\ndrivers/net/phy/adin.c=795=static int adin_soft_reset(struct phy_device *phydev)\n--\ndrivers/net/phy/adin.c-808-\t/* If we get a read error something may be wrong */\ndrivers/net/phy/adin.c:809:\trc = phy_read_mmd(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/adin.c-810-\t\t\t ADIN1300_GE_SOFT_RESET_REG);\n--\ndrivers/net/phy/adin.c=828=static int adin_read_mmd_stat_regs(struct phy_device *phydev,\n--\ndrivers/net/phy/adin.c-833-\ndrivers/net/phy/adin.c:834:\tret = phy_read_mmd(phydev, MDIO_MMD_VEND1, stat-\u003ereg1);\ndrivers/net/phy/adin.c-835-\tif (ret \u003c 0)\n--\ndrivers/net/phy/adin.c-842-\ndrivers/net/phy/adin.c:843:\tret = phy_read_mmd(phydev, MDIO_MMD_VEND1, stat-\u003ereg2);\ndrivers/net/phy/adin.c-844-\tif (ret \u003c 0)\n--\ndrivers/net/phy/adin.c=945=static int adin_cable_test_report_pair(struct phy_device *phydev,\n--\ndrivers/net/phy/adin.c-950-\ndrivers/net/phy/adin.c:951:\tret = phy_read_mmd(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/adin.c-952-\t\t\t ADIN1300_CDIAG_DTLD_RSLTS(pair));\n--\ndrivers/net/phy/adin.c-961-\ndrivers/net/phy/adin.c:962:\tret = phy_read_mmd(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/adin.c-963-\t\t\t ADIN1300_CDIAG_FLT_DIST(pair));\n--\ndrivers/net/phy/adin.c=991=static int adin_cable_test_get_status(struct phy_device *phydev,\n--\ndrivers/net/phy/adin.c-997-\ndrivers/net/phy/adin.c:998:\tret = phy_read_mmd(phydev, MDIO_MMD_VEND1, ADIN1300_CDIAG_RUN);\ndrivers/net/phy/adin.c-999-\tif (ret \u003c 0)\n--\ndrivers/net/phy/adin1100.c=76=static int adin_read_status(struct phy_device *phydev)\n--\ndrivers/net/phy/adin1100.c-83-\ndrivers/net/phy/adin1100.c:84:\tret = phy_read_mmd(phydev, MDIO_MMD_AN, ADIN_AN_PHY_INST_STATUS);\ndrivers/net/phy/adin1100.c-85-\tif (ret \u003c 0)\n--\ndrivers/net/phy/adin1100.c=145=static int adin_phy_ack_intr(struct phy_device *phydev)\n--\ndrivers/net/phy/adin1100.c-147-\t/* Clear pending interrupts */\ndrivers/net/phy/adin1100.c:148:\tint rc = phy_read_mmd(phydev, MDIO_MMD_VEND2,\ndrivers/net/phy/adin1100.c-149-\t\t\t ADIN_PHY_SUBSYS_IRQ_STATUS);\n--\ndrivers/net/phy/adin1100.c=173=static irqreturn_t adin_phy_handle_interrupt(struct phy_device *phydev)\n--\ndrivers/net/phy/adin1100.c-176-\ndrivers/net/phy/adin1100.c:177:\tirq_status = phy_read_mmd(phydev, MDIO_MMD_VEND2,\ndrivers/net/phy/adin1100.c-178-\t\t\t\t ADIN_PHY_SUBSYS_IRQ_STATUS);\n--\ndrivers/net/phy/adin1100.c=192=static int adin_set_powerdown_mode(struct phy_device *phydev, bool en)\n--\ndrivers/net/phy/adin1100.c-201-\ndrivers/net/phy/adin1100.c:202:\treturn phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1, ADIN_CRSM_STAT, ret,\ndrivers/net/phy/adin1100.c-203-\t\t\t\t\t !!(ret \u0026 ADIN_CRSM_SFT_PD_RDY) == en,\n--\ndrivers/net/phy/adin1100.c=231=static int adin_soft_reset(struct phy_device *phydev)\n--\ndrivers/net/phy/adin1100.c-238-\ndrivers/net/phy/adin1100.c:239:\treturn phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1, ADIN_CRSM_STAT, ret,\ndrivers/net/phy/adin1100.c-240-\t\t\t\t\t (ret \u0026 ADIN_CRSM_SYS_RDY),\n--\ndrivers/net/phy/adin1100.c=244=static int adin_get_features(struct phy_device *phydev)\n--\ndrivers/net/phy/adin1100.c-250-\ndrivers/net/phy/adin1100.c:251:\tret = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PMA_10T1L_STAT);\ndrivers/net/phy/adin1100.c-252-\tif (ret \u003c 0)\n--\ndrivers/net/phy/adin1100.c=279=static int adin_get_sqi(struct phy_device *phydev)\n--\ndrivers/net/phy/adin1100.c-284-\ndrivers/net/phy/adin1100.c:285:\tret = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_STAT1);\ndrivers/net/phy/adin1100.c-286-\tif (ret \u003c 0)\n--\ndrivers/net/phy/adin1100.c-290-\ndrivers/net/phy/adin1100.c:291:\tret = phy_read_mmd(phydev, MDIO_STAT1, ADIN_MSE_VAL);\ndrivers/net/phy/adin1100.c-292-\tif (ret \u003c 0)\n--\ndrivers/net/phy/air_an8801.c=357=static int an8801r_led_hw_control_get(struct phy_device *phydev, u8 index,\n--\ndrivers/net/phy/air_an8801.c-364-\ndrivers/net/phy/air_an8801.c:365:\ton = phy_read_mmd(phydev, MDIO_MMD_VEND2, LED_ON_CTRL(index));\ndrivers/net/phy/air_an8801.c-366-\tif (on \u003c 0)\n--\ndrivers/net/phy/air_an8801.c-368-\ndrivers/net/phy/air_an8801.c:369:\tblink = phy_read_mmd(phydev, MDIO_MMD_VEND2, LED_BLINK_CTRL(index));\ndrivers/net/phy/air_an8801.c-370-\tif (blink \u003c 0)\n--\ndrivers/net/phy/air_en8811h.c=327=static int en8811h_wait_mcu_ready(struct phy_device *phydev)\n--\ndrivers/net/phy/air_en8811h.c-336-\t/* Because of mdio-lock, may have to wait for multiple loads */\ndrivers/net/phy/air_en8811h.c:337:\tret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/air_en8811h.c-338-\t\t\t\t\tEN8811H_PHY_FW_STATUS, reg_value,\n--\ndrivers/net/phy/air_en8811h.c=1368=static int en8811h_read_status(struct phy_device *phydev)\n--\ndrivers/net/phy/air_en8811h.c-1394-\tif (phy_id_compare_model(phydev-\u003ephy_id, AN8811HB_PHY_ID)) {\ndrivers/net/phy/air_en8811h.c:1395:\t\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_STAT);\ndrivers/net/phy/air_en8811h.c-1396-\t\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_firmware.c=90=static int aqr_fw_load_memory(struct phy_device *phydev, u32 addr,\n--\ndrivers/net/phy/aquantia/aquantia_firmware.c-137-\t/* ...gets CRC from MAILBOX after we have loaded the entire section... */\ndrivers/net/phy/aquantia/aquantia_firmware.c:138:\tup_crc = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_MAILBOX_INTERFACE2);\ndrivers/net/phy/aquantia/aquantia_firmware.c-139-\t/* ...and make sure it does match our calculated CRC */\n--\ndrivers/net/phy/aquantia/aquantia_hwmon.c=42=static int aqr_hwmon_get(struct phy_device *phydev, int reg, long *value)\ndrivers/net/phy/aquantia/aquantia_hwmon.c-43-{\ndrivers/net/phy/aquantia/aquantia_hwmon.c:44:\tint temp = phy_read_mmd(phydev, MDIO_MMD_VEND1, reg);\ndrivers/net/phy/aquantia/aquantia_hwmon.c-45-\n--\ndrivers/net/phy/aquantia/aquantia_hwmon.c=68=static int aqr_hwmon_test_bit(struct phy_device *phydev, int reg, int bit)\ndrivers/net/phy/aquantia/aquantia_hwmon.c-69-{\ndrivers/net/phy/aquantia/aquantia_hwmon.c:70:\tint val = phy_read_mmd(phydev, MDIO_MMD_VEND1, reg);\ndrivers/net/phy/aquantia/aquantia_hwmon.c-71-\n--\ndrivers/net/phy/aquantia/aquantia_leds.c=47=int aqr_phy_led_hw_control_get(struct phy_device *phydev, u8 index,\n--\ndrivers/net/phy/aquantia/aquantia_leds.c-54-\ndrivers/net/phy/aquantia/aquantia_leds.c:55:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1, AQR_LED_PROV(index));\ndrivers/net/phy/aquantia/aquantia_leds.c-56-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=133=static u64 aqr107_get_stat(struct phy_device *phydev, int index)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-140-\ndrivers/net/phy/aquantia/aquantia_main.c:141:\tval = phy_read_mmd(phydev, MDIO_MMD_C22EXT, stat-\u003ereg);\ndrivers/net/phy/aquantia/aquantia_main.c-142-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-146-\tif (len_h) {\ndrivers/net/phy/aquantia/aquantia_main.c:147:\t\tval = phy_read_mmd(phydev, MDIO_MMD_C22EXT, stat-\u003ereg + 1);\ndrivers/net/phy/aquantia/aquantia_main.c-148-\t\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=253=static int aqr_config_intr(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-259-\t\t/* Clear any pending interrupts before enabling them */\ndrivers/net/phy/aquantia/aquantia_main.c:260:\t\terr = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_TX_VEND_INT_STATUS2);\ndrivers/net/phy/aquantia/aquantia_main.c-261-\t\tif (err \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-282-\t\t/* Clear any pending interrupts after we have disabled them */\ndrivers/net/phy/aquantia/aquantia_main.c:283:\t\terr = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_TX_VEND_INT_STATUS2);\ndrivers/net/phy/aquantia/aquantia_main.c-284-\t\tif (err \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=291=static irqreturn_t aqr_handle_interrupt(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-294-\ndrivers/net/phy/aquantia/aquantia_main.c:295:\tirq_status = phy_read_mmd(phydev, MDIO_MMD_AN,\ndrivers/net/phy/aquantia/aquantia_main.c-296-\t\t\t\t MDIO_AN_TX_VEND_INT_STATUS2);\n--\ndrivers/net/phy/aquantia/aquantia_main.c=310=static int aqr_read_status(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-314-\tif (phydev-\u003eautoneg == AUTONEG_ENABLE) {\ndrivers/net/phy/aquantia/aquantia_main.c:315:\t\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_RX_LP_STAT1);\ndrivers/net/phy/aquantia/aquantia_main.c-316-\t\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-330-\tif (val) {\ndrivers/net/phy/aquantia/aquantia_main.c:331:\t\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_RESVD_VEND_STATUS1);\ndrivers/net/phy/aquantia/aquantia_main.c-332-\t\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=476=static int aqr_gen1_read_rate(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-479-\ndrivers/net/phy/aquantia/aquantia_main.c:480:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_TX_VEND_STATUS1);\ndrivers/net/phy/aquantia/aquantia_main.c-481-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=537=static int aqr_gen1_read_status(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-553-\t */\ndrivers/net/phy/aquantia/aquantia_main.c:554:\tret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_PHYXS,\ndrivers/net/phy/aquantia/aquantia_main.c-555-\t\t\t\t\tMDIO_PHYXS_VEND_IF_STATUS, val,\n--\ndrivers/net/phy/aquantia/aquantia_main.c=626=static int aqr107_get_downshift(struct phy_device *phydev, u8 *data)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-629-\ndrivers/net/phy/aquantia/aquantia_main.c:630:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_VEND_PROV);\ndrivers/net/phy/aquantia/aquantia_main.c-631-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=691=int aqr_wait_reset_complete(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-694-\ndrivers/net/phy/aquantia/aquantia_main.c:695:\tret = read_poll_timeout(phy_read_mmd, val, val != 0,\ndrivers/net/phy/aquantia/aquantia_main.c-696-\t\t\t\tAQR_FW_WAIT_SLEEP_US, AQR_FW_WAIT_TIMEOUT_US,\n--\ndrivers/net/phy/aquantia/aquantia_main.c=708=static int aqr_build_fingerprint(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-714-\ndrivers/net/phy/aquantia/aquantia_main.c:715:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_FW_ID);\ndrivers/net/phy/aquantia/aquantia_main.c-716-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-721-\ndrivers/net/phy/aquantia/aquantia_main.c:722:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_RSVD_STAT1);\ndrivers/net/phy/aquantia/aquantia_main.c-723-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-728-\ndrivers/net/phy/aquantia/aquantia_main.c:729:\tval = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, PMAPMD_FW_MISC_ID);\ndrivers/net/phy/aquantia/aquantia_main.c-730-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-734-\ndrivers/net/phy/aquantia/aquantia_main.c:735:\tval = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, PMAPMD_FW_MISC_VER);\ndrivers/net/phy/aquantia/aquantia_main.c-736-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=833=static int aqr_gen2_read_global_syscfg(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-844-\ndrivers/net/phy/aquantia/aquantia_main.c:845:\t\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/aquantia/aquantia_main.c-846-\t\t\t\t aqr_global_cfg_regs[i].reg);\n--\ndrivers/net/phy/aquantia/aquantia_main.c=910=static int aqr_gen2_fill_interface_modes(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-923-\tif (priv-\u003ewait_on_global_cfg) {\ndrivers/net/phy/aquantia/aquantia_main.c:924:\t\tret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/aquantia/aquantia_main.c-925-\t\t\t\t\t\tVEND1_GLOBAL_CFG_100M, val,\n--\ndrivers/net/phy/aquantia/aquantia_main.c=970=static void aqr107_link_change_notify(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-978-\ndrivers/net/phy/aquantia/aquantia_main.c:979:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_RX_LP_STAT1);\ndrivers/net/phy/aquantia/aquantia_main.c-980-\t/* call failed or link partner is no Aquantia PHY */\n--\ndrivers/net/phy/aquantia/aquantia_main.c-986-\ndrivers/net/phy/aquantia/aquantia_main.c:987:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_RX_LP_STAT4);\ndrivers/net/phy/aquantia/aquantia_main.c-988-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-993-\ndrivers/net/phy/aquantia/aquantia_main.c:994:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_RX_VEND_STAT3);\ndrivers/net/phy/aquantia/aquantia_main.c-995-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-1005-\ndrivers/net/phy/aquantia/aquantia_main.c:1006:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_RSVD_STAT9);\ndrivers/net/phy/aquantia/aquantia_main.c-1007-\tif (val \u003c 0)\n--\ndrivers/net/phy/aquantia/aquantia_main.c=1015=static int aqr_gen1_wait_processor_intensive_op(struct phy_device *phydev)\n--\ndrivers/net/phy/aquantia/aquantia_main.c-1025-\ndrivers/net/phy/aquantia/aquantia_main.c:1026:\terr = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/aquantia/aquantia_main.c-1027-\t\t\t\t\tVEND1_GLOBAL_GEN_STAT2, val,\n--\ndrivers/net/phy/as21xxx.c=297=static int aeon_firmware_boot(struct phy_device *phydev, const u8 *data,\n--\ndrivers/net/phy/as21xxx.c-318-\ndrivers/net/phy/as21xxx.c:319:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/as21xxx.c-320-\t\t\t VEND1_GLB_REG_MDIO_INDIRECT_STATUS);\n--\ndrivers/net/phy/as21xxx.c=392=static int aeon_ipc_wait_cmd(struct phy_device *phydev, bool parity_status)\n--\ndrivers/net/phy/as21xxx.c-399-\t */\ndrivers/net/phy/as21xxx.c:400:\treturn phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1, VEND1_IPC_STS, val,\ndrivers/net/phy/as21xxx.c-401-\t\t\t\t\t aeon_ipc_ready(val, parity_status),\n--\ndrivers/net/phy/as21xxx.c=405=static int aeon_ipc_send_cmd(struct phy_device *phydev,\n--\ndrivers/net/phy/as21xxx.c-439-\ndrivers/net/phy/as21xxx.c:440:\tret = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_IPC_STS);\ndrivers/net/phy/as21xxx.c-441-\tif (ret \u003c 0)\n--\ndrivers/net/phy/as21xxx.c=455=static int aeon_ipc_send_msg(struct phy_device *phydev,\n--\ndrivers/net/phy/as21xxx.c-506-\tfor (i = 0; i \u003c DIV_ROUND_UP(ret_size, sizeof(u16)); i++) {\ndrivers/net/phy/as21xxx.c:507:\t\tret = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_IPC_DATA(i));\ndrivers/net/phy/as21xxx.c-508-\t\tif (ret \u003c 0)\n--\ndrivers/net/phy/as21xxx.c=636=static int as21xxx_read_link(struct phy_device *phydev, int *bmcr)\n--\ndrivers/net/phy/as21xxx.c-642-\t */\ndrivers/net/phy/as21xxx.c:643:\t*bmcr = phy_read_mmd(phydev, MDIO_MMD_AN,\ndrivers/net/phy/as21xxx.c-644-\t\t\t AS21XXX_MDIO_AN_C22 + MII_BMCR);\n--\ndrivers/net/phy/as21xxx.c-655-\ndrivers/net/phy/as21xxx.c:656:\tstatus = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_STAT1);\ndrivers/net/phy/as21xxx.c-657-\tif (status \u003c 0)\n--\ndrivers/net/phy/as21xxx.c=665=static int as21xxx_read_c22_lpa(struct phy_device *phydev)\n--\ndrivers/net/phy/as21xxx.c-671-\t */\ndrivers/net/phy/as21xxx.c:672:\tlpagb = phy_read_mmd(phydev, MDIO_MMD_AN,\ndrivers/net/phy/as21xxx.c-673-\t\t\t AS21XXX_MDIO_AN_C22 + MII_STAT1000);\n--\ndrivers/net/phy/as21xxx.c-677-\tif (lpagb \u0026 LPA_1000MSFAIL) {\ndrivers/net/phy/as21xxx.c:678:\t\tint adv = phy_read_mmd(phydev, MDIO_MMD_AN,\ndrivers/net/phy/as21xxx.c-679-\t\t\t\t AS21XXX_MDIO_AN_C22 + MII_CTRL1000);\n--\ndrivers/net/phy/as21xxx.c=697=static int as21xxx_read_status(struct phy_device *phydev)\n--\ndrivers/net/phy/as21xxx.c-729-\ndrivers/net/phy/as21xxx.c:730:\t\tspeed = phy_read_mmd(phydev, MDIO_MMD_VEND1,\ndrivers/net/phy/as21xxx.c-731-\t\t\t\t VEND1_SPEED_STATUS);\n--\ndrivers/net/phy/as21xxx.c=803=static int as21xxx_led_hw_control_get(struct phy_device *phydev, u8 index,\n--\ndrivers/net/phy/as21xxx.c-810-\ndrivers/net/phy/as21xxx.c:811:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_LED_REG(index));\ndrivers/net/phy/as21xxx.c-812-\tif (val \u003c 0)\n--\ndrivers/net/phy/as21xxx.c=879=static int as21xxx_match_phy_device(struct phy_device *phydev,\n--\ndrivers/net/phy/as21xxx.c-892-\t/* Read PHY ID to handle firmware loaded or HW reset */\ndrivers/net/phy/as21xxx.c:893:\tret = phy_read_mmd(phydev, MDIO_MMD_PCS, MII_PHYSID1);\ndrivers/net/phy/as21xxx.c-894-\tif (ret \u003c 0)\n--\ndrivers/net/phy/as21xxx.c-897-\ndrivers/net/phy/as21xxx.c:898:\tret = phy_read_mmd(phydev, MDIO_MMD_PCS, MII_PHYSID2);\ndrivers/net/phy/as21xxx.c-899-\tif (ret \u003c 0)\n--\ndrivers/net/phy/bcm-phy-lib.c=372=int bcm_phy_set_eee(struct phy_device *phydev, bool enable)\n--\ndrivers/net/phy/bcm-phy-lib.c-376-\t/* Enable EEE at PHY level */\ndrivers/net/phy/bcm-phy-lib.c:377:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, BRCM_CL45VEN_EEE_CONTROL);\ndrivers/net/phy/bcm-phy-lib.c-378-\tif (val \u003c 0)\n--\ndrivers/net/phy/bcm-phy-lib.c-388-\t/* Advertise EEE */\ndrivers/net/phy/bcm-phy-lib.c:389:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, BCM_CL45VEN_EEE_ADV);\ndrivers/net/phy/bcm-phy-lib.c-390-\tif (val \u003c 0)\n--\ndrivers/net/phy/bcm-phy-lib.c=533=static u64 bcm_phy_get_stat(struct phy_device *phydev, u64 *shadow,\n--\ndrivers/net/phy/bcm-phy-lib.c-542-\telse\ndrivers/net/phy/bcm-phy-lib.c:543:\t\tval = phy_read_mmd(phydev, stat.devad, stat.reg);\ndrivers/net/phy/bcm-phy-lib.c-544-\tif (val \u003c 0) {\n--\ndrivers/net/phy/bcm7xxx.c=623=static bool bcm7xxx_28nm_ephy_dev_valid(int devnum)\n--\ndrivers/net/phy/bcm7xxx.c-627-\ndrivers/net/phy/bcm7xxx.c:628:static int bcm7xxx_28nm_ephy_read_mmd(struct phy_device *phydev,\ndrivers/net/phy/bcm7xxx.c-629-\t\t\t\t int devnum, u16 regnum)\n--\ndrivers/net/phy/bcm7xxx.c=821=static int bcm7xxx_28nm_probe(struct phy_device *phydev)\n--\ndrivers/net/phy/bcm7xxx.c-885-\t.probe\t\t= bcm7xxx_28nm_probe,\t\t\t\t\\\ndrivers/net/phy/bcm7xxx.c:886:\t.read_mmd\t= bcm7xxx_28nm_ephy_read_mmd,\t\t\t\\\ndrivers/net/phy/bcm7xxx.c-887-\t.write_mmd\t= bcm7xxx_28nm_ephy_write_mmd,\t\t\t\\\n--\ndrivers/net/phy/bcm84881.c=50=static int bcm84881_wait_init(struct phy_device *phydev)\n--\ndrivers/net/phy/bcm84881.c-53-\ndrivers/net/phy/bcm84881.c:54:\treturn phy_read_mmd_poll_timeout(phydev, MDIO_MMD_PMAPMD, MDIO_CTRL1,\ndrivers/net/phy/bcm84881.c-55-\t\t\t\t\t val, !(val \u0026 MDIO_CTRL1_RESET),\n--\ndrivers/net/phy/bcm84881.c=184=static int bcm8489x_led_hw_control_get(struct phy_device *phydev, u8 index,\n--\ndrivers/net/phy/bcm84881.c-191-\ndrivers/net/phy/bcm84881.c:192:\tlow = phy_read_mmd(phydev, MDIO_MMD_PMAPMD,\ndrivers/net/phy/bcm84881.c-193-\t\t\t bcm8489x_led_regs[index].mask_low);\n--\ndrivers/net/phy/bcm84881.c-195-\t\treturn low;\ndrivers/net/phy/bcm84881.c:196:\text = phy_read_mmd(phydev, MDIO_MMD_PMAPMD,\ndrivers/net/phy/bcm84881.c-197-\t\t\t bcm8489x_led_regs[index].mask_ext);\n--\ndrivers/net/phy/bcm84881.c=288=static int bcm84881_aneg_done(struct phy_device *phydev)\n--\ndrivers/net/phy/bcm84881.c-291-\ndrivers/net/phy/bcm84881.c:292:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_STAT1);\ndrivers/net/phy/bcm84881.c-293-\tif (val \u003c 0)\n--\ndrivers/net/phy/bcm84881.c-295-\ndrivers/net/phy/bcm84881.c:296:\tbmsr = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_C22 + MII_BMSR);\ndrivers/net/phy/bcm84881.c-297-\tif (bmsr \u003c 0)\n--\ndrivers/net/phy/bcm84881.c=304=static int bcm84881_read_status(struct phy_device *phydev)\n--\ndrivers/net/phy/bcm84881.c-308-\ndrivers/net/phy/bcm84881.c:309:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_CTRL1);\ndrivers/net/phy/bcm84881.c-310-\tif (val \u003c 0)\n--\ndrivers/net/phy/bcm84881.c-317-\ndrivers/net/phy/bcm84881.c:318:\tval = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_STAT1);\ndrivers/net/phy/bcm84881.c-319-\tif (val \u003c 0)\n--\ndrivers/net/phy/bcm84881.c-321-\ndrivers/net/phy/bcm84881.c:322:\tbmsr = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_C22 + MII_BMSR);\ndrivers/net/phy/bcm84881.c-323-\tif (bmsr \u003c 0)\n--\ndrivers/net/phy/bcm84881.c-347-\ndrivers/net/phy/bcm84881.c:348:\t\tval = phy_read_mmd(phydev, MDIO_MMD_AN,\ndrivers/net/phy/bcm84881.c-349-\t\t\t\t MDIO_AN_C22 + MII_STAT1000);\n--\ndrivers/net/phy/bcm84881.c-380-\t */\ndrivers/net/phy/bcm84881.c:381:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND1, 0x4011);\ndrivers/net/phy/bcm84881.c-382-\tmode = (val \u0026 0x1e) \u003e\u003e 1;\n--\ndrivers/net/phy/bcm87xx.c=34=static int bcm87xx_of_reg_init(struct phy_device *phydev)\n--\ndrivers/net/phy/bcm87xx.c-59-\t\tif (mask) {\ndrivers/net/phy/bcm87xx.c:60:\t\t\tval = phy_read_mmd(phydev, devid, reg);\ndrivers/net/phy/bcm87xx.c-61-\t\t\tif (val \u003c 0) {\n--\ndrivers/net/phy/bcm87xx.c=100=static int bcm87xx_read_status(struct phy_device *phydev)\n--\ndrivers/net/phy/bcm87xx.c-105-\ndrivers/net/phy/bcm87xx.c:106:\trx_signal_detect = phy_read_mmd(phydev, MDIO_MMD_PMAPMD,\ndrivers/net/phy/bcm87xx.c-107-\t\t\t\t\tBCM87XX_PMD_RX_SIGNAL_DETECT);\n--\ndrivers/net/phy/bcm87xx.c-113-\ndrivers/net/phy/bcm87xx.c:114:\tpcs_status = phy_read_mmd(phydev, MDIO_MMD_PCS,\ndrivers/net/phy/bcm87xx.c-115-\t\t\t\t BCM87XX_10GBASER_PCS_STATUS);\n--\ndrivers/net/phy/bcm87xx.c-121-\ndrivers/net/phy/bcm87xx.c:122:\txgxs_lane_status = phy_read_mmd(phydev, MDIO_MMD_PHYXS,\ndrivers/net/phy/bcm87xx.c-123-\t\t\t\t\tBCM87XX_XGXS_LANE_STATUS);\n--\ndrivers/net/phy/bcm87xx.c=140=static int bcm87xx_config_intr(struct phy_device *phydev)\n--\ndrivers/net/phy/bcm87xx.c-143-\ndrivers/net/phy/bcm87xx.c:144:\treg = phy_read_mmd(phydev, MDIO_MMD_PCS, BCM87XX_LASI_CONTROL);\ndrivers/net/phy/bcm87xx.c-145-\n--\ndrivers/net/phy/bcm87xx.c-149-\tif (phydev-\u003einterrupts == PHY_INTERRUPT_ENABLED) {\ndrivers/net/phy/bcm87xx.c:150:\t\terr = phy_read_mmd(phydev, MDIO_MMD_PCS, BCM87XX_LASI_STATUS);\ndrivers/net/phy/bcm87xx.c-151-\t\tif (err)\n--\ndrivers/net/phy/bcm87xx.c-163-\ndrivers/net/phy/bcm87xx.c:164:\t\terr = phy_read_mmd(phydev, MDIO_MMD_PCS, BCM87XX_LASI_STATUS);\ndrivers/net/phy/bcm87xx.c-165-\t}\n--\ndrivers/net/phy/dp83822.c=214=static int dp83822_config_wol(struct phy_device *phydev,\n--\ndrivers/net/phy/dp83822.c-236-\ndrivers/net/phy/dp83822.c:237:\t\tvalue = phy_read_mmd(phydev, MDIO_MMD_VEND2,\ndrivers/net/phy/dp83822.c-238-\t\t\t\t MII_DP83822_WOL_CFG);\n--\ndrivers/net/phy/dp83822.c=288=static void dp83822_get_wol(struct phy_device *phydev,\n--\ndrivers/net/phy/dp83822.c-296-\ndrivers/net/phy/dp83822.c:297:\tvalue = phy_read_mmd(phydev, MDIO_MMD_VEND2, MII_DP83822_WOL_CFG);\ndrivers/net/phy/dp83822.c-298-\n--\ndrivers/net/phy/dp83822.c-302-\tif (value \u0026 DP83822_WOL_SECURE_ON) {\ndrivers/net/phy/dp83822.c:303:\t\tsopass_val = phy_read_mmd(phydev, MDIO_MMD_VEND2,\ndrivers/net/phy/dp83822.c-304-\t\t\t\t\t MII_DP83822_RXSOP1);\n--\ndrivers/net/phy/dp83822.c-307-\ndrivers/net/phy/dp83822.c:308:\t\tsopass_val = phy_read_mmd(phydev, MDIO_MMD_VEND2,\ndrivers/net/phy/dp83822.c-309-\t\t\t\t\t MII_DP83822_RXSOP2);\n--\ndrivers/net/phy/dp83822.c-312-\ndrivers/net/phy/dp83822.c:313:\t\tsopass_val = phy_read_mmd(phydev, MDIO_MMD_VEND2,\ndrivers/net/phy/dp83822.c-314-\t\t\t\t\t MII_DP83822_RXSOP3);\n--\ndrivers/net/phy/dp83822.c=917=static int dp83822_read_straps(struct phy_device *phydev)\n--\ndrivers/net/phy/dp83822.c-922-\ndrivers/net/phy/dp83822.c:923:\tval = phy_read_mmd(phydev, MDIO_MMD_VEND2, MII_DP83822_SOR1);\ndrivers/net/phy/dp83822.c-924-\tif (val \u003c 0)\n--\ndrivers/net/phy/dp83822.c=1033=static int dp83822_suspend(struct phy_device *phydev)\n--\ndrivers/net/phy/dp83822.c-1036-\ndrivers/net/phy/dp83822.c:1037:\tvalue = phy_read_mmd(phydev, MDIO_MMD_VEND2, MII_DP83822_WOL_CFG);\ndrivers/net/phy/dp83822.c-1038-\n--\ndrivers/net/phy/dp83822.c=1045=static int dp83822_resume(struct phy_device *phydev)\n--\ndrivers/net/phy/dp83822.c-1050-\ndrivers/net/phy/dp83822.c:1051:\tvalue = phy_read_mmd(phydev, MDIO_MMD_VEND2, MII_DP83822_WOL_CFG);\ndrivers/net/phy/dp83822.c-1052-\n--\ndrivers/net/phy/dp83822.c=1124=static int dp83822_led_hw_control_get(struct phy_device *phydev, u8 index,\n--\ndrivers/net/phy/dp83822.c-1129-\tif (index == DP83822_LED_INDEX_LED_0 || index == DP83822_LED_INDEX_COL_GPIO2) {\ndrivers/net/phy/dp83822.c:1130:\t\tval = phy_read_mmd(phydev, MDIO_MMD_VEND2, MII_DP83822_MLEDCR);\ndrivers/net/phy/dp83822.c-1131-\t\tif (val \u003c 0)\n--\ndrivers/net/phy/dp83822.c-1135-\t} else {\ndrivers/net/phy/dp83822.c:1136:\t\tval = phy_read_mmd(phydev, MDIO_MMD_VEND2, MII_DP83822_LEDCFG1);\ndrivers/net/phy/dp83822.c-1137-\t\tif (val \u003c 0)\n--\ndrivers/net/phy/dp83867.c=211=static int dp83867_set_wol(struct phy_device *phydev,\n--\ndrivers/net/phy/dp83867.c-217-\ndrivers/net/phy/dp83867.c:218:\tval_rxcfg = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_RXFCFG);\ndrivers/net/phy/dp83867.c-219-\tval_micr = phy_read(phydev, MII_DP83867_MICR);\n--\ndrivers/net/phy/dp83867.c=277=static void dp83867_get_wol(struct phy_device *phydev,\n--\ndrivers/net/phy/dp83867.c-285-\ndrivers/net/phy/dp83867.c:286:\tvalue = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_RXFCFG);\ndrivers/net/phy/dp83867.c-287-\n--\ndrivers/net/phy/dp83867.c-297-\tif (value \u0026 DP83867_WOL_SEC_EN) {\ndrivers/net/phy/dp83867.c:298:\t\tsopass_val = phy_read_mmd(phydev, DP83867_DEVADDR,\ndrivers/net/phy/dp83867.c-299-\t\t\t\t\t DP83867_RXFSOP1);\n--\ndrivers/net/phy/dp83867.c-302-\ndrivers/net/phy/dp83867.c:303:\t\tsopass_val = phy_read_mmd(phydev, DP83867_DEVADDR,\n\n"
} |
| 17/2 | 2026/07/03 07:37 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 34845 output: 32 thoughts: 331 Thoughts: **Realizing the Potential of USB-Emulated PHY Driver Access** Okay, hold on a second... `phy_read_mmd` is *everywhere*. If a USB device supports Clause 22, the PHY framework cleverly uses indirect access (registers 13 and 14) to essentially translate Clause 45 accesses. So, wait... `phy_read_mmd` *works* on Clause 22 PHYs! This clicks, because I know the Realtek PHY driver uses `phy_read_mmd`, right? Yes, it does. So here's the thought. If we construct a mock USB network device that also registers an MDIO bus, and we can control the responses to MDIO reads... we can *trick* it into reporting the Realtek PHY ID (`0x001cc898`) when the MDIO bus scans for PHYs. Then, the kernel, thinking a Realtek PHY is present, will instantiate the Realtek PHY driver and call `rtl8261x_probe`. And that's where syzkaller comes in. I recall it has a `syz_usb_connect` tool which can emulate USB devices. Can it emulate a USB network device that registers an MDIO bus? Yes, syzkaller fuzzes USB devices by feeding them arbitrary USB descriptors. If it uses descriptors for the `smsc95xx` or `asix` drivers, then the driver will bind, register an MDIO bus, and start scanning. The exciting part is, syzkaller can give the responses to the USB control messages which the driver uses to read MDIO registers! This is it! This means the PHY driver is reachable from a virtualized environment via USB emulation! Wait, is the Realtek PHY driver enabled by default or is there some config needed? Let's check the Kconfig for Realtek PHY. This is potentially huge. |
| 18/2 | 2026/07/03 07:37 | tool | grepper |
0mArgs:{
"Expression": "config REALTEK_PHY",
"PathPrefix": "drivers/net/phy/"
}Results: {
"Output": "drivers/net/phy/realtek/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/phy/realtek/Kconfig:2:config REALTEK_PHY\ndrivers/net/phy/realtek/Kconfig-3-\ttristate \"Realtek PHYs\"\n--\ndrivers/net/phy/realtek/Kconfig=8=if REALTEK_PHY\ndrivers/net/phy/realtek/Kconfig-9-\ndrivers/net/phy/realtek/Kconfig:10:config REALTEK_PHY_HWMON\ndrivers/net/phy/realtek/Kconfig-11-\tbool \"HWMON support for Realtek PHYs\"\n"
} |
| 19/2 | 2026/07/03 07:37 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 35791 output: 34 thoughts: 350 Thoughts: **Analyzing the Realtek PHY Configuration** Okay, so I'm looking at this `CONFIG_REALTEK_PHY` config option. I need to figure out if there are any other related configs in play here. The patch adds this firmware name, `RTL8261C_CE_FW_NAME "rtl_nic/rtl8261c.bin"`. Now, I remember seeing `request_firmware` being called in `rtl8261x_fw_load`. If that fails, because the firmware isn't present, `rtl8261x_fw_load` returns an error, which, of course, propagates up to `rtl8261x_config_init`. My initial thought is that this might be a roadblock for fuzzing. However, that's assuming we *need* the firmware. Wait, Syzkaller can provide the firmware using `syz_mount_image` or something similar, right? Or, maybe some code paths don't even use the firmware. I need to clarify that. Okay, I think if Syzkaller provides the file, then we can definitely fuzz `request_firmware`. Otherwise, we can just say it's reachable. Hold on, I see `priv->fw_name` is set, and it tries to load that. A failure gives us an error. Can we then reach `genphy_c45_pma_soft_reset`? It's defined as `.soft_reset = genphy_c45_pma_soft_reset`. Ah, yes, `soft_reset` is called during the PHY initialization, *before* `config_init`! Okay, let me go check the call order in `phy_device.c` or `phy.c` to be sure. |
| 20/2 | 2026/07/03 07:38 | tool | grepper |
0mArgs:{
"Expression": "soft_reset",
"PathPrefix": "drivers/net/phy/phy_device.c"
}Results: {
"Output": "drivers/net/phy/phy_device.c=1341=int phy_init_hw(struct phy_device *phydev)\n--\ndrivers/net/phy/phy_device.c-1350-\ndrivers/net/phy/phy_device.c:1351:\tif (phydev-\u003edrv-\u003esoft_reset) {\ndrivers/net/phy/phy_device.c:1352:\t\tret = phydev-\u003edrv-\u003esoft_reset(phydev);\ndrivers/net/phy/phy_device.c-1353-\t\tif (ret \u003c 0)\n--\ndrivers/net/phy/phy_device.c-1355-\ndrivers/net/phy/phy_device.c:1356:\t\t/* see comment in genphy_soft_reset for an explanation */\ndrivers/net/phy/phy_device.c-1357-\t\tphydev-\u003esuspended = 0;\n--\ndrivers/net/phy/phy_device.c=2664=EXPORT_SYMBOL(genphy_c37_read_status);\n--\ndrivers/net/phy/phy_device.c-2666-/**\ndrivers/net/phy/phy_device.c:2667: * genphy_soft_reset - software reset the PHY via BMCR_RESET bit\ndrivers/net/phy/phy_device.c-2668- * @phydev: target phy_device struct\n--\ndrivers/net/phy/phy_device.c-2674- */\ndrivers/net/phy/phy_device.c:2675:int genphy_soft_reset(struct phy_device *phydev)\ndrivers/net/phy/phy_device.c-2676-{\n--\ndrivers/net/phy/phy_device.c-2702-}\ndrivers/net/phy/phy_device.c:2703:EXPORT_SYMBOL(genphy_soft_reset);\ndrivers/net/phy/phy_device.c-2704-\n"
} |
| 21/2 | 2026/07/03 07:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 37059 output: 36 thoughts: 187 Thoughts: **My Concerns Regarding the PHY Initialization Sequence** Okay, so I'm focusing on the PHY initialization flow and I've got a couple of important things to consider here. Right, so `soft_reset` is called within `phy_init_hw`, which happens *before* `config_init`. Actually, wait, let me rephrase that... `phy_init_hw` calls `soft_reset` *before* `config_init`. That's critical. That means that `genphy_c45_pma_soft_reset` is going to execute regardless of whether the subsequent firmware loading is successful or not. We need to be aware of this and ensure that's the intended behaviour. Furthermore, I'm noting that `genphy_c45_an_setup_master_slave` and `genphy_c45_read_master_slave` are linked to `genphy_c45_config_aneg` and `genphy_c45_read_status` respectively. Those functions are triggered when the network interface comes online. So, what happens if `config_init` subsequently fails? Does the PHY device get properly registered with the system? I need to look into this more deeply. I should probably be checking `phy_device_attach` or `phy_attach_direct` to see how that interacts with a potential `config_init` failure. I need to understand that call flow in more detail. |
| 22/2 | 2026/07/03 07:38 | tool | grepper |
0mArgs:{
"Expression": "phy_init_hw",
"PathPrefix": "drivers/net/phy/phy_device.c"
}Results: {
"Output": "drivers/net/phy/phy_device.c=378=static __maybe_unused int mdio_bus_phy_resume(struct device *dev)\n--\ndrivers/net/phy/phy_device.c-398-\ndrivers/net/phy/phy_device.c:399:\tret = phy_init_hw(phydev);\ndrivers/net/phy/phy_device.c-400-\tif (ret \u003c 0)\n--\ndrivers/net/phy/phy_device.c=1305=EXPORT_SYMBOL(phy_disconnect);\n--\ndrivers/net/phy/phy_device.c-1321- * effort to support such broken PHYs, this function is separate from the\ndrivers/net/phy/phy_device.c:1322: * standard phy_init_hw() which will zero all the other bits in the BMCR\ndrivers/net/phy/phy_device.c-1323- * and reapply all driver-specific and board-specific fixups.\n--\ndrivers/net/phy/phy_device.c=1325=static int phy_poll_reset(struct phy_device *phydev)\n--\ndrivers/net/phy/phy_device.c-1340-\ndrivers/net/phy/phy_device.c:1341:int phy_init_hw(struct phy_device *phydev)\ndrivers/net/phy/phy_device.c-1342-{\n--\ndrivers/net/phy/phy_device.c-1387-}\ndrivers/net/phy/phy_device.c:1388:EXPORT_SYMBOL(phy_init_hw);\ndrivers/net/phy/phy_device.c-1389-\n--\ndrivers/net/phy/phy_device.c=1752=int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,\n--\ndrivers/net/phy/phy_device.c-1874-\t */\ndrivers/net/phy/phy_device.c:1875:\terr = phy_init_hw(phydev);\ndrivers/net/phy/phy_device.c-1876-\tif (err)\n"
} |
| 23/2 | 2026/07/03 07:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 38141 output: 35 thoughts: 679 Thoughts: **Fuzzing the RTL8261x PHY Firmware** Okay, so here's the deal: `phy_init_hw` gets called within `phy_attach_direct`. If `phy_init_hw` bombs out – maybe because `config_init` chokes on missing firmware – then `phy_attach_direct` goes down with it, and that means the network driver fails to open. But, there's a saving grace: Syzkaller! We can actually leverage Syzkaller to inject that missing firmware. It has the capability to provide the firmware files when requested. Looking closer, the firmware loading only happens if `priv->fw_name` is set. Now, where is `priv->fw_name` set? Ah, in `rtl8261x_probe`, but only if `sub_phy_id` is equal to `RTL8261C_CE_MODEL`. If `sub_phy_id` is anything else, `rtl8261x_probe` returns `-ENODEV`. And how do we determine the value of `sub_phy_id`? `rtl8261x_probe` reads `RTL_8261X_SUB_PHY_ID_ADDR` from `MDIO_MMD_VEND2`. So here’s the interesting part: if our mock USB device tells it that the `sub_phy_id` is `RTL8261C_CE_MODEL` (which is conveniently `0x00`), it sets `priv->fw_name` to `RTL8261C_CE_FW_NAME`. That's our trigger! Now, if we want to fuzz the firmware execution, Syzkaller can provide the firmware. The firmware format is parsed in `rtl8261x_verify_firmware` and then executed in `rtl8261x_fw_execute_entry`. This is gold! This is *textbook* fuzzing territory. This code is functional, and it should be fuzzed! It reads an external file (the firmware) and then interacts with hardware (the MDIO bus), making it a great target. Syzkaller can generate arbitrary firmware files, which can then trigger this code. This is definitely a promising avenue for fuzzing, because it’s a file parsing and hardware interaction sequence. Alright, let's list the functions, just to be sure we've got all the pieces: `genphy_c45_pma_soft_reset`, `genphy_c45_an_setup_master_slave`, `genphy_c45_read_master_slave`, `rtl8261x_probe`, `rtl8261x_get_features`, `rtl8261x_read_status`, `rtl8261x_verify_firmware`, `rtl8261x_fw_execute_entry`, `rtl8261x_fw_load`, `rtl8261x_config_intr`, `rtl8261x_handle_interrupt`, `rtl8261x_config_aneg`, and `rtl8261x_config_init`. Yep, those all look reachable. The only config needed seems to be `REALTEK_PHY`, which compiles `drivers/net/phy/realtek/realtek_main.c`. Perfect. Let's make sure `REALTEK_PHY` is the only config required. |
| 24/2 | 2026/07/03 07:38 | tool | grepper |
0mArgs:{
"Expression": "realtek_main.o",
"PathPrefix": "drivers/net/phy/realtek/"
}Results: {
"Output": "drivers/net/phy/realtek/Makefile-1-# SPDX-License-Identifier: GPL-2.0\ndrivers/net/phy/realtek/Makefile:2:realtek-y\t\t\t+= realtek_main.o\ndrivers/net/phy/realtek/Makefile-3-realtek-$(CONFIG_REALTEK_PHY_HWMON) += realtek_hwmon.o\n"
} |
| 25/2 | 2026/07/03 07:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 39720 output: 29 thoughts: 40 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: **Investigating a Realtek PHY Issue** Right, let's see. The identifier `realtek-y`... that immediately suggests it's a component of the `realtek` module, which is a key lead. I'll need to confirm that suspicion and understand where to find related configuration. Therefore, my next step is to examine the `drivers/net/phy/Makefile`. That's where the PHY driver configurations usually reside. I'm expecting to find references to the `realtek` component there, which will confirm my initial hypothesis and point me towards the relevant build and include directives. Knowing the structure of the `Makefile`, I should quickly be able to see the build options and associated dependencies. |
| 26/2 | 2026/07/03 07:38 | tool | grepper |
0mArgs:{
"Expression": "realtek",
"PathPrefix": "drivers/net/phy/Makefile"
}Results: {
"Output": "drivers/net/phy/Makefile=94=obj-$(CONFIG_QSEMI_PHY)\t\t+= qsemi.o\ndrivers/net/phy/Makefile:95:obj-$(CONFIG_REALTEK_PHY)\t+= realtek/\ndrivers/net/phy/Makefile-96-obj-$(CONFIG_RENESAS_PHY)\t+= uPD60620.o\n"
} |
| 27/2 | 2026/07/03 07:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 40059 output: 34 thoughts: 60 Thoughts: Okay, here's my summary, tailored as if I'm an expert in this field: **Kernel Configuration Analysis: Realtek PHY** Alright, confirmed, `CONFIG_REALTEK_PHY` is indeed the configuration item we're looking at. Good start. Now, the next logical step is to quickly double-check if there are any *other* relevant configs that might be involved or impact this one, just to be thorough. We don't want to miss anything subtle. The patch itself points directly to `drivers/net/phy/phy-c45.c`. This suggests a potential conditional compilation scenario, so that's the angle I'm focusing on now. Specifically, I need to verify *how* `phy-c45.c` is compiled. Is it directly tied to `CONFIG_REALTEK_PHY`, or are there other dependencies or surrounding configs that control its inclusion? That's the key question to figure out if there is anything that could impact a user's device. |
| 28/2 | 2026/07/03 07:38 | tool | grepper |
0mArgs:{
"Expression": "phy-c45.o",
"PathPrefix": "drivers/net/phy/Makefile"
}Results: {
"Output": "drivers/net/phy/Makefile-3-\ndrivers/net/phy/Makefile:4:libphy-y\t\t\t:= phy.o phy-c45.o phy-core.o phy_device.o \\\ndrivers/net/phy/Makefile-5-\t\t\t\t linkmode.o phy_link_topology.o \\\n"
} |
| 29/2 | 2026/07/03 07:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 40456 output: 306 thoughts: 966 Thoughts: **Refining the Target for Fuzzing the Realtek RTL8261C PHY Support** Okay, so I'm thinking about how to effectively target this new Realtek RTL8261C PHY support in the kernel for fuzzing. This isn't just a simple driver; it includes firmware loading and Clause 45 master/slave configuration, which immediately makes it more interesting from a security perspective, especially the firmware handling. It's part of `libphy`, and that's conditionally compiled based on `CONFIG_PHYLIB`, which is enabled by default for networking, which is good. That should simplify things. So, the key configuration option is `REALTEK_PHY`. That's the one we need. Now, let's nail down the specific functions we should focus on. I initially listed these: `rtl8261x_probe`, `rtl8261x_get_features`, `rtl8261x_read_status`, `rtl8261x_verify_firmware`, `rtl8261x_fw_execute_entry`, `rtl8261x_fw_load`, `rtl8261x_config_intr`, `rtl8261x_handle_interrupt`, `rtl8261x_config_aneg`, `rtl8261x_config_init`, `genphy_c45_pma_soft_reset`, `genphy_c45_an_setup_master_slave`, and `genphy_c45_read_master_slave`. Wait, `rtl8261x_handle_interrupt` is an interrupt handler. It is triggered only if interrupts are supported and enabled on the PHY. Syzkaller might be able to trigger those if the virtual MDIO bus or USB device emulates the interrupt status register and interrupt line. I'm not entirely sure how easy that will be without a more sophisticated mock device. The other functions are definitely reachable, though. So, I should refine this list. I'll definitely keep: `rtl8261x_fw_execute_entry`, `rtl8261x_verify_firmware`, `rtl8261x_fw_load`, `rtl8261x_config_init`, `rtl8261x_probe`, `rtl8261x_config_aneg`, and `rtl8261x_read_status`. Then I'll add `genphy_c45_pma_soft_reset`, `genphy_c45_an_setup_master_slave`, and `genphy_c45_read_master_slave` because they're part of this feature. Are there any others? Yes! I should also include `rtl8261x_get_features` and `rtl8261x_config_intr`, and `rtl8261x_handle_interrupt`. I'll include them all. They are specific to this new feature and not generic hot-path functions. Hang on. I recall that `genphy_c45_an_setup_master_slave` and `genphy_c45_read_master_slave` are actually *static* functions in `phy-c45.c`. The question is: Can syzkaller even deal with static functions in `FocusSymbols`? Yes, it can, that's fine. Now, to be completely sure, let's double-check that `REALTEK_PHY` is a tristate config, not a bool. Yep, good. That's the only one we *need* to enable. Okay, let's step back and review. The new code supports the Realtek RTL8261C 10Gbps PHY, including firmware loading and parsing, and Clause 45 master/slave configuration. This code is reachable through emulation, by, for instance, emulating a USB network adapter that registers an MDIO bus and responds with the RTL8261C PHY ID. Firmware parsing (`rtl8261x_verify_firmware`, `rtl8261x_fw_execute_entry`) is where the real fuzzing interest lies since it processes external data. Do I need to specify generic configs like `CONFIG_USB_NET_DRIVERS` or generic USB or Net configurations? No, not specifically. We only need the one for the new code. Finally, is there anything else? Let me see... Is `RTL8261C_CE_FW_NAME` used anywhere else? No, it's defined in the patch. Let's check `gen |
| 30/2 | 2026/07/03 07:39 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"REALTEK_PHY"
],
"FocusSymbols": [
"rtl8261x_probe",
"rtl8261x_get_features",
"rtl8261x_read_status",
"rtl8261x_verify_firmware",
"rtl8261x_fw_execute_entry",
"rtl8261x_fw_load",
"rtl8261x_config_intr",
"rtl8261x_handle_interrupt",
"rtl8261x_config_aneg",
"rtl8261x_config_init",
"genphy_c45_pma_soft_reset",
"genphy_c45_an_setup_master_slave",
"genphy_c45_read_master_slave"
],
"Reasoning": "The patch adds support for the Realtek RTL8261C 10Gbps PHY, including firmware loading and parsing, and new Clause 45 master/slave configuration functions. This code is reachable in virtualized environments by emulating a USB network adapter that registers an MDIO bus and responds with the RTL8261C PHY ID. The firmware parsing logic is particularly interesting for fuzzing as it processes external data.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"REALTEK_PHY"
],
"FocusSymbols": [
"rtl8261x_probe",
"rtl8261x_get_features",
"rtl8261x_read_status",
"rtl8261x_verify_firmware",
"rtl8261x_fw_execute_entry",
"rtl8261x_fw_load",
"rtl8261x_config_intr",
"rtl8261x_handle_interrupt",
"rtl8261x_config_aneg",
"rtl8261x_config_init",
"genphy_c45_pma_soft_reset",
"genphy_c45_an_setup_master_slave",
"genphy_c45_read_master_slave"
],
"Reasoning": "The patch adds support for the Realtek RTL8261C 10Gbps PHY, including firmware loading and parsing, and new Clause 45 master/slave configuration functions. This code is reachable in virtualized environments by emulating a USB network adapter that registers an MDIO bus and responds with the RTL8261C PHY ID. The firmware parsing logic is particularly interesting for fuzzing as it processes external data.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|