AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch adds support for distinguishing the KSZ9897S Ethernet switch variant within the Microchip KSZ switch DSA driver (drivers/net/dsa/microchip/). This driver interacts with discrete physical Microchip switch ASICs over I2C/SPI/SMI buses. Because the required physical hardware is not present or emulated in standard virtualized fuzzing environments (e.g., QEMU amd64), the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 06efc60695d280349732b89b2dc3d7c21c83b580\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Sep 5 14:28:52 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c\nindex 1a9d6f83a0232..81798a9fa671d 100644\n--- a/drivers/net/dsa/microchip/ksz_common.c\n+++ b/drivers/net/dsa/microchip/ksz_common.c\n@@ -1486,6 +1486,41 @@ const struct ksz_chip_data ksz_switch_chips[] = {\n \t\t.gbit_capable\t= {true, true, true, true, true, true, true},\n \t},\n \n+\t[KSZ9897S] = {\n+\t\t.chip_id = KSZ9897S_CHIP_ID,\n+\t\t.dev_name = \"KSZ9897S\",\n+\t\t.num_vlans = 4096,\n+\t\t.num_alus = 4096,\n+\t\t.num_statics = 16,\n+\t\t.cpu_ports = 0x7F,\t/* can be configured as cpu port */\n+\t\t.port_cnt = 7,\t\t/* total physical port count */\n+\t\t.port_nirqs = 2,\n+\t\t.num_tx_queues = 4,\n+\t\t.num_ipms = 8,\n+\t\t.ops = \u0026ksz9477_dev_ops,\n+\t\t.switch_ops = \u0026ksz9477_switch_ops,\n+\t\t.phylink_mac_ops = \u0026ksz9477_phylink_mac_ops,\n+\t\t.phy_errata_9477 = true,\n+\t\t.mib_names = ksz9477_mib_names,\n+\t\t.mib_cnt = ARRAY_SIZE(ksz9477_mib_names),\n+\t\t.reg_mib_cnt = MIB_COUNTER_NUM,\n+\t\t.regs = ksz9477_regs,\n+\t\t.masks = ksz9477_masks,\n+\t\t.shifts = ksz9477_shifts,\n+\t\t.xmii_ctrl0 = ksz9477_xmii_ctrl0,\n+\t\t.xmii_ctrl1 = ksz9477_xmii_ctrl1,\n+\t\t.supports_mii\t= {false, false, false, false,\n+\t\t\t\t   false, true, false},\n+\t\t.supports_rmii\t= {false, false, false, false,\n+\t\t\t\t   false, true, false},\n+\t\t.supports_rgmii = {false, false, false, false,\n+\t\t\t\t   false, true, false},\n+\t\t.internal_phy\t= {true, true, true, true,\n+\t\t\t\t   true, false, false},\n+\t\t.gbit_capable\t= {true, true, true, true, true, true, true},\n+\t\t.sgmii_port = 7,\n+\t},\n+\n \t[KSZ9893] = {\n \t\t.chip_id = KSZ9893_CHIP_ID,\n \t\t.dev_name = \"KSZ9893\",\n@@ -3897,6 +3932,7 @@ int ksz_switch_register(struct ksz_device *dev)\n \tstruct device_node *ports;\n \tphy_interface_t interface;\n \tunsigned int port_num;\n+\tu32 lookup_chip_id;\n \tint ret;\n \tint i;\n \n@@ -3933,7 +3969,30 @@ int ksz_switch_register(struct ksz_device *dev)\n \tif (ret)\n \t\treturn ret;\n \n-\tinfo = ksz_lookup_info(dev-\u003echip_id);\n+\tlookup_chip_id = dev-\u003echip_id;\n+\n+\t/* The KSZ9897S and the KSZ9897R report the same chip ID and differ\n+\t * only in chip_data: only the S has the SGMII port 7, the R has a\n+\t * second RGMII port instead. Bit 7 of the port 7 XMII control 0\n+\t * register is read-only and tells them apart; it reads one on the S.\n+\t * Compare the KSZ9897S data sheet DS00002394C section 5.2.4.1 with\n+\t * the KSZ9897R data sheet DS00002330D section 5.2.3.1.\n+\t *\n+\t * Only the chip_data entry differs, so dev-\u003echip_id keeps the shared\n+\t * chip ID and nothing else has to know about the variant.\n+\t */\n+\tif (dev-\u003echip_id == KSZ9897_CHIP_ID) {\n+\t\tu8 val;\n+\n+\t\tret = ksz_read8(dev, KSZ9897_REG_PORT7_XMII_CTRL_0, \u0026val);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tif (val \u0026 KSZ9897_PORT7_SGMII_SEL)\n+\t\t\tlookup_chip_id = KSZ9897S_CHIP_ID;\n+\t}\n+\n+\tinfo = ksz_lookup_info(lookup_chip_id);\n \tif (!info)\n \t\treturn -ENODEV;\n \ndiff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h\nindex cbe98494578c3..0cff33df06a4b 100644\n--- a/drivers/net/dsa/microchip/ksz_common.h\n+++ b/drivers/net/dsa/microchip/ksz_common.h\n@@ -284,6 +284,7 @@ enum ksz_model {\n \tKSZ9477,\n \tKSZ9896,\n \tKSZ9897,\n+\tKSZ9897S,\n \tKSZ9893,\n \tKSZ9563,\n \tKSZ9567,\n@@ -874,6 +875,10 @@ static inline bool ksz_is_sgmii_port(struct ksz_device *dev, int port)\n #define SKU_ID_KSZ8563\t\t\t0x3c\n #define SKU_ID_KSZ9563\t\t\t0x1c\n \n+/* KSZ9897 specific register: port 7 XMII control 0 */\n+#define KSZ9897_REG_PORT7_XMII_CTRL_0\t0x7300\n+#define KSZ9897_PORT7_SGMII_SEL\t\tBIT(7)\n+\n /* Driver set switch broadcast storm protection at 10% rate. */\n #define BROADCAST_STORM_PROT_RATE\t10\n \ndiff --git a/include/linux/platform_data/microchip-ksz.h b/include/linux/platform_data/microchip-ksz.h\nindex 028781ad40593..fe8df1774289c 100644\n--- a/include/linux/platform_data/microchip-ksz.h\n+++ b/include/linux/platform_data/microchip-ksz.h\n@@ -34,6 +34,7 @@ enum ksz_chip_id {\n \tKSZ9477_CHIP_ID = 0x00947700,\n \tKSZ9896_CHIP_ID = 0x00989600,\n \tKSZ9897_CHIP_ID = 0x00989700,\n+\tKSZ9897S_CHIP_ID = 0x00989701,\n \tKSZ9893_CHIP_ID = 0x00989300,\n \tKSZ9563_CHIP_ID = 0x00956300,\n \tKSZ8567_CHIP_ID = 0x00856700,\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds support for distinguishing the KSZ9897S Ethernet switch variant within the Microchip KSZ switch DSA driver (drivers/net/dsa/microchip/). This driver interacts with discrete physical Microchip switch ASICs over I2C/SPI/SMI buses. Because the required physical hardware is not present or emulated in standard virtualized fuzzing environments (e.g., QEMU amd64), the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 06efc60695d280349732b89b2dc3d7c21c83b580
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Sep 5 14:28:52 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 1a9d6f83a0232..81798a9fa671d 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -1486,6 +1486,41 @@ const struct ksz_chip_data ksz_switch_chips[] = {
 		.gbit_capable	= {true, true, true, true, true, true, true},
 	},
 
+	[KSZ9897S] = {
+		.chip_id = KSZ9897S_CHIP_ID,
+		.dev_name = "KSZ9897S",
+		.num_vlans = 4096,
+		.num_alus = 4096,
+		.num_statics = 16,
+		.cpu_ports = 0x7F,	/* can be configured as cpu port */
+		.port_cnt = 7,		/* total physical port count */
+		.port_nirqs = 2,
+		.num_tx_queues = 4,
+		.num_ipms = 8,
+		.ops = &ksz9477_dev_ops,
+		.switch_ops = &ksz9477_switch_ops,
+		.phylink_mac_ops = &ksz9477_phylink_mac_ops,
+		.phy_errata_9477 = true,
+		.mib_names = ksz9477_mib_names,
+		.mib_cnt = ARRAY_SIZE(ksz9477_mib_names),
+		.reg_mib_cnt = MIB_COUNTER_NUM,
+		.regs = ksz9477_regs,
+		.masks = ksz9477_masks,
+		.shifts = ksz9477_shifts,
+		.xmii_ctrl0 = ksz9477_xmii_ctrl0,
+		.xmii_ctrl1 = ksz9477_xmii_ctrl1,
+		.supports_mii	= {false, false, false, false,
+				   false, true, false},
+		.supports_rmii	= {false, false, false, false,
+				   false, true, false},
+		.supports_rgmii = {false, false, false, false,
+				   false, true, false},
+		.internal_phy	= {true, true, true, true,
+				   true, false, false},
+		.gbit_capable	= {true, true, true, true, true, true, true},
+		.sgmii_port = 7,
+	},
+
 	[KSZ9893] = {
 		.chip_id = KSZ9893_CHIP_ID,
 		.dev_name = "KSZ9893",
@@ -3897,6 +3932,7 @@ int ksz_switch_register(struct ksz_device *dev)
 	struct device_node *ports;
 	phy_interface_t interface;
 	unsigned int port_num;
+	u32 lookup_chip_id;
 	int ret;
 	int i;
 
@@ -3933,7 +3969,30 @@ int ksz_switch_register(struct ksz_device *dev)
 	if (ret)
 		return ret;
 
-	info = ksz_lookup_info(dev->chip_id);
+	lookup_chip_id = dev->chip_id;
+
+	/* The KSZ9897S and the KSZ9897R report the same chip ID and differ
+	 * only in chip_data: only the S has the SGMII port 7, the R has a
+	 * second RGMII port instead. Bit 7 of the port 7 XMII control 0
+	 * register is read-only and tells them apart; it reads one on the S.
+	 * Compare the KSZ9897S data sheet DS00002394C section 5.2.4.1 with
+	 * the KSZ9897R data sheet DS00002330D section 5.2.3.1.
+	 *
+	 * Only the chip_data entry differs, so dev->chip_id keeps the shared
+	 * chip ID and nothing else has to know about the variant.
+	 */
+	if (dev->chip_id == KSZ9897_CHIP_ID) {
+		u8 val;
+
+		ret = ksz_read8(dev, KSZ9897_REG_PORT7_XMII_CTRL_0, &val);
+		if (ret)
+			return ret;
+
+		if (val & KSZ9897_PORT7_SGMII_SEL)
+			lookup_chip_id = KSZ9897S_CHIP_ID;
+	}
+
+	info = ksz_lookup_info(lookup_chip_id);
 	if (!info)
 		return -ENODEV;
 
diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h
index cbe98494578c3..0cff33df06a4b 100644
--- a/drivers/net/dsa/microchip/ksz_common.h
+++ b/drivers/net/dsa/microchip/ksz_common.h
@@ -284,6 +284,7 @@ enum ksz_model {
 	KSZ9477,
 	KSZ9896,
 	KSZ9897,
+	KSZ9897S,
 	KSZ9893,
 	KSZ9563,
 	KSZ9567,
@@ -874,6 +875,10 @@ static inline bool ksz_is_sgmii_port(struct ksz_device *dev, int port)
 #define SKU_ID_KSZ8563			0x3c
 #define SKU_ID_KSZ9563			0x1c
 
+/* KSZ9897 specific register: port 7 XMII control 0 */
+#define KSZ9897_REG_PORT7_XMII_CTRL_0	0x7300
+#define KSZ9897_PORT7_SGMII_SEL		BIT(7)
+
 /* Driver set switch broadcast storm protection at 10% rate. */
 #define BROADCAST_STORM_PROT_RATE	10
 
diff --git a/include/linux/platform_data/microchip-ksz.h b/include/linux/platform_data/microchip-ksz.h
index 028781ad40593..fe8df1774289c 100644
--- a/include/linux/platform_data/microchip-ksz.h
+++ b/include/linux/platform_data/microchip-ksz.h
@@ -34,6 +34,7 @@ enum ksz_chip_id {
 	KSZ9477_CHIP_ID = 0x00947700,
 	KSZ9896_CHIP_ID = 0x00989600,
 	KSZ9897_CHIP_ID = 0x00989700,
+	KSZ9897S_CHIP_ID = 0x00989701,
 	KSZ9893_CHIP_ID = 0x00989300,
 	KSZ9563_CHIP_ID = 0x00956300,
 	KSZ8567_CHIP_ID = 0x00856700,

gemini-3.7-flash

null

null

							input: 4703
							output: 32
							thoughts: 180
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Analyzing a KSZ Switch Driver Patch**

Alright, this patch affects `drivers/net/dsa/microchip/ksz_common.c`, the header, and a platform data include. Immediately, I'm thinking Microchip KSZ – that means we're dealing with DSA switches. Specifically, things like the KSZ9897, KSZ9477, KSZ8795, KSZ8863, all solid players. My first instinct is to size up the reach of this code in a standard virtualized environment. Are there even any virtual environments that would realistically hit this? Probably not directly, but it’s worth keeping in mind potential implications.

My next step is to quickly refresh my memory on the attachment and probe mechanisms for these KSZ switches. We're most likely looking at SPI, I2C, or MDIO for communication with the main system. I need to understand how the driver interfaces with the hardware and handles the DSA architecture. Grepper is my friend here. Time to dive into `drivers/net/dsa/microchip/` and see what the driver is doing at its core. I’ll be looking for clues on how the driver handles device enumeration, initialization, and data transfer. Gotta understand the low-level interactions to gauge the impact of this change.

{
  "Expression": "ksz_",
  "PathPrefix": "drivers/net/dsa/microchip/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 5690 lines.\nUse more precise expression if possible.\n\ndrivers/net/dsa/microchip/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/dsa/microchip/Makefile:2:obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ_COMMON)\t+= ksz_switch.o\ndrivers/net/dsa/microchip/Makefile:3:ksz_switch-objs := ksz_common.o ksz_dcb.o\ndrivers/net/dsa/microchip/Makefile:4:ksz_switch-objs += ksz9477.o ksz9477_acl.o ksz9477_tc_flower.o\ndrivers/net/dsa/microchip/Makefile:5:ksz_switch-objs += ksz8.o\ndrivers/net/dsa/microchip/Makefile:6:ksz_switch-objs += lan937x_main.o\ndrivers/net/dsa/microchip/Makefile-7-\ndrivers/net/dsa/microchip/Makefile=8=ifdef CONFIG_NET_DSA_MICROCHIP_KSZ_PTP\ndrivers/net/dsa/microchip/Makefile:9:ksz_switch-objs += ksz_ptp.o\ndrivers/net/dsa/microchip/Makefile-10-endif\n--\ndrivers/net/dsa/microchip/Makefile=12=obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ9477_I2C)\t+= ksz9477_i2c.o\ndrivers/net/dsa/microchip/Makefile:13:obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ_SPI)\t\t+= ksz_spi.o\ndrivers/net/dsa/microchip/Makefile-14-obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ8863_SMI)\t+= ksz8863_smi.o\n--\ndrivers/net/dsa/microchip/ksz8.c-18-#include \u003clinux/delay.h\u003e\ndrivers/net/dsa/microchip/ksz8.c:19:#include \u003clinux/dsa/ksz_common.h\u003e\ndrivers/net/dsa/microchip/ksz8.c-20-#include \u003clinux/export.h\u003e\n--\ndrivers/net/dsa/microchip/ksz8.c-33-\ndrivers/net/dsa/microchip/ksz8.c:34:#include \"ksz_common.h\"\ndrivers/net/dsa/microchip/ksz8.c:35:#include \"ksz_dcb.h\"\ndrivers/net/dsa/microchip/ksz8.c-36-#include \"ksz8_reg.h\"\n--\ndrivers/net/dsa/microchip/ksz8.c-49- */\ndrivers/net/dsa/microchip/ksz8.c:50:static const struct ksz_drive_strength ksz88x3_drive_strengths[] = {\ndrivers/net/dsa/microchip/ksz8.c-51-\t{ 0,  8000 },\n--\ndrivers/net/dsa/microchip/ksz8.c=55=struct ksz88xx_stats_raw {\n--\ndrivers/net/dsa/microchip/ksz8.c-91-\ndrivers/net/dsa/microchip/ksz8.c:92:static void ksz_cfg(struct ksz_device *dev, u32 addr, u8 bits, bool set)\ndrivers/net/dsa/microchip/ksz8.c-93-{\ndrivers/net/dsa/microchip/ksz8.c:94:\tksz_rmw8(dev, addr, bits, set ? bits : 0);\ndrivers/net/dsa/microchip/ksz8.c-95-}\ndrivers/net/dsa/microchip/ksz8.c-96-\ndrivers/net/dsa/microchip/ksz8.c:97:static void ksz_port_cfg(struct ksz_device *dev, int port, int offset, u8 bits,\ndrivers/net/dsa/microchip/ksz8.c-98-\t\t\t bool set)\ndrivers/net/dsa/microchip/ksz8.c-99-{\ndrivers/net/dsa/microchip/ksz8.c:100:\tksz_rmw8(dev, dev-\u003edev_ops-\u003eget_port_addr(port, offset), bits,\ndrivers/net/dsa/microchip/ksz8.c-101-\t\t set ? bits : 0);\n--\ndrivers/net/dsa/microchip/ksz8.c-112- * PME switch functionalities. Both 8-bit registers 110 and 111 are\ndrivers/net/dsa/microchip/ksz8.c:113: * written at once with ksz_write16, using the serial multiple write\ndrivers/net/dsa/microchip/ksz8.c-114- * functionality.\n--\ndrivers/net/dsa/microchip/ksz8.c-117- */\ndrivers/net/dsa/microchip/ksz8.c:118:static int ksz8_ind_write8(struct ksz_device *dev, u8 table, u16 addr, u8 data)\ndrivers/net/dsa/microchip/ksz8.c-119-{\n--\ndrivers/net/dsa/microchip/ksz8.c-128-\tctrl_addr = IND_ACC_TABLE(table) | addr;\ndrivers/net/dsa/microchip/ksz8.c:129:\tret = ksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c-130-\tif (!ret)\ndrivers/net/dsa/microchip/ksz8.c:131:\t\tret = ksz_write8(dev, regs[REG_IND_BYTE], data);\ndrivers/net/dsa/microchip/ksz8.c-132-\n--\ndrivers/net/dsa/microchip/ksz8.c-146- * PME switch functionalities. Both 8-bit registers 110 and 111 are\ndrivers/net/dsa/microchip/ksz8.c:147: * written at once with ksz_write16, using the serial multiple write\ndrivers/net/dsa/microchip/ksz8.c-148- * functionality.\n--\ndrivers/net/dsa/microchip/ksz8.c-151- */\ndrivers/net/dsa/microchip/ksz8.c:152:static int ksz8_ind_read8(struct ksz_device *dev, u8 table, u16 addr, u8 *val)\ndrivers/net/dsa/microchip/ksz8.c-153-{\n--\ndrivers/net/dsa/microchip/ksz8.c-162-\tctrl_addr = IND_ACC_TABLE(table | TABLE_READ) | addr;\ndrivers/net/dsa/microchip/ksz8.c:163:\tret = ksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c-164-\tif (!ret)\ndrivers/net/dsa/microchip/ksz8.c:165:\t\tret = ksz_read8(dev, regs[REG_IND_BYTE], val);\ndrivers/net/dsa/microchip/ksz8.c-166-\n--\ndrivers/net/dsa/microchip/ksz8.c-171-\ndrivers/net/dsa/microchip/ksz8.c:172:static int ksz8_pme_write8(struct ksz_device *dev, u32 reg, u8 value)\ndrivers/net/dsa/microchip/ksz8.c-173-{\n--\ndrivers/net/dsa/microchip/ksz8.c-176-\ndrivers/net/dsa/microchip/ksz8.c:177:static int ksz8_pme_pread8(struct ksz_device *dev, int port, int offset, u8 *data)\ndrivers/net/dsa/microchip/ksz8.c-178-{\n--\ndrivers/net/dsa/microchip/ksz8.c-183-\ndrivers/net/dsa/microchip/ksz8.c:184:static int ksz8_pme_pwrite8(struct ksz_device *dev, int port, int offset, u8 data)\ndrivers/net/dsa/microchip/ksz8.c-185-{\n--\ndrivers/net/dsa/microchip/ksz8.c=191=static void ksz8463_irq_mask(struct irq_data *d)\ndrivers/net/dsa/microchip/ksz8.c-192-{\ndrivers/net/dsa/microchip/ksz8.c:193:\tstruct ksz_irq *kirq = irq_data_get_irq_chip_data(d);\ndrivers/net/dsa/microchip/ksz8.c-194-\n--\ndrivers/net/dsa/microchip/ksz8.c=198=static void ksz8463_irq_unmask(struct irq_data *d)\ndrivers/net/dsa/microchip/ksz8.c-199-{\ndrivers/net/dsa/microchip/ksz8.c:200:\tstruct ksz_irq *kirq = irq_data_get_irq_chip_data(d);\ndrivers/net/dsa/microchip/ksz8.c-201-\n--\ndrivers/net/dsa/microchip/ksz8.c=205=static const struct irq_chip ksz8463_irq_chip = {\n--\ndrivers/net/dsa/microchip/ksz8.c-208-\t.irq_unmask\t\t= ksz8463_irq_unmask,\ndrivers/net/dsa/microchip/ksz8.c:209:\t.irq_bus_lock\t\t= ksz_irq_bus_lock,\ndrivers/net/dsa/microchip/ksz8.c:210:\t.irq_bus_sync_unlock\t= ksz_irq_bus_sync_unlock,\ndrivers/net/dsa/microchip/ksz8.c-211-};\n--\ndrivers/net/dsa/microchip/ksz8.c=223=static const struct irq_domain_ops ksz8463_irq_domain_ops = {\n--\ndrivers/net/dsa/microchip/ksz8.c-227-\ndrivers/net/dsa/microchip/ksz8.c:228:static int ksz8463_girq_setup(struct ksz_device *dev)\ndrivers/net/dsa/microchip/ksz8.c-229-{\ndrivers/net/dsa/microchip/ksz8.c:230:\tstruct ksz_irq *girq = \u0026dev-\u003egirq;\ndrivers/net/dsa/microchip/ksz8.c-231-\n--\ndrivers/net/dsa/microchip/ksz8.c-239-\ndrivers/net/dsa/microchip/ksz8.c:240:\treturn ksz_irq_common_setup(dev, girq, \u0026ksz8463_irq_domain_ops);\ndrivers/net/dsa/microchip/ksz8.c-241-}\ndrivers/net/dsa/microchip/ksz8.c-242-\ndrivers/net/dsa/microchip/ksz8.c:243:static int ksz8463_reset_switch(struct ksz_device *dev)\ndrivers/net/dsa/microchip/ksz8.c-244-{\ndrivers/net/dsa/microchip/ksz8.c:245:\tksz_cfg(dev, KSZ8463_REG_SW_RESET,\ndrivers/net/dsa/microchip/ksz8.c-246-\t\tKSZ8463_GLOBAL_SOFTWARE_RESET | KSZ8463_PTP_SOFTWARE_RESET,\ndrivers/net/dsa/microchip/ksz8.c-247-\t\ttrue);\ndrivers/net/dsa/microchip/ksz8.c:248:\tksz_cfg(dev, KSZ8463_REG_SW_RESET,\ndrivers/net/dsa/microchip/ksz8.c-249-\t\tKSZ8463_GLOBAL_SOFTWARE_RESET | KSZ8463_PTP_SOFTWARE_RESET,\n--\ndrivers/net/dsa/microchip/ksz8.c-253-\ndrivers/net/dsa/microchip/ksz8.c:254:static int ksz8_reset_switch(struct ksz_device *dev)\ndrivers/net/dsa/microchip/ksz8.c-255-{\ndrivers/net/dsa/microchip/ksz8.c:256:\tif (ksz_is_ksz88x3(dev)) {\ndrivers/net/dsa/microchip/ksz8.c-257-\t\t/* reset switch */\ndrivers/net/dsa/microchip/ksz8.c:258:\t\tksz_cfg(dev, KSZ8863_REG_SW_RESET,\ndrivers/net/dsa/microchip/ksz8.c-259-\t\t\tKSZ8863_GLOBAL_SOFTWARE_RESET | KSZ8863_PCS_RESET, true);\ndrivers/net/dsa/microchip/ksz8.c:260:\t\tksz_cfg(dev, KSZ8863_REG_SW_RESET,\ndrivers/net/dsa/microchip/ksz8.c-261-\t\t\tKSZ8863_GLOBAL_SOFTWARE_RESET | KSZ8863_PCS_RESET, false);\n--\ndrivers/net/dsa/microchip/ksz8.c-263-\t\t/* reset switch */\ndrivers/net/dsa/microchip/ksz8.c:264:\t\tksz_write8(dev, REG_POWER_MANAGEMENT_1,\ndrivers/net/dsa/microchip/ksz8.c-265-\t\t\t   SW_SOFTWARE_POWER_DOWN \u003c\u003c SW_POWER_MANAGEMENT_MODE_S);\ndrivers/net/dsa/microchip/ksz8.c:266:\t\tksz_write8(dev, REG_POWER_MANAGEMENT_1, 0);\ndrivers/net/dsa/microchip/ksz8.c-267-\t}\n--\ndrivers/net/dsa/microchip/ksz8.c=272=static int ksz88xx_change_mtu(struct dsa_switch *ds, int port, int mtu)\ndrivers/net/dsa/microchip/ksz8.c-273-{\ndrivers/net/dsa/microchip/ksz8.c:274:\tstruct ksz_device *dev = ds-\u003epriv;\ndrivers/net/dsa/microchip/ksz8.c-275-\tint frame_size;\n--\ndrivers/net/dsa/microchip/ksz8.c-287-\ndrivers/net/dsa/microchip/ksz8.c:288:\treturn ksz_rmw8(dev, REG_SW_CTRL_2, KSZ8863_LEGAL_PACKET_ENABLE |\ndrivers/net/dsa/microchip/ksz8.c-289-\t\t\tKSZ8863_HUGE_PACKET_ENABLE, ctrl2);\n--\ndrivers/net/dsa/microchip/ksz8.c=292=static int ksz87xx_change_mtu(struct dsa_switch *ds, int port, int mtu)\ndrivers/net/dsa/microchip/ksz8.c-293-{\ndrivers/net/dsa/microchip/ksz8.c:294:\tstruct ksz_device *dev = ds-\u003epriv;\ndrivers/net/dsa/microchip/ksz8.c-295-\tu8 ctrl1 = 0, ctrl2 = 0;\n--\ndrivers/net/dsa/microchip/ksz8.c-308-\ndrivers/net/dsa/microchip/ksz8.c:309:\tret = ksz_rmw8(dev, REG_SW_CTRL_1, SW_HUGE_PACKET, ctrl1);\ndrivers/net/dsa/microchip/ksz8.c-310-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-312-\ndrivers/net/dsa/microchip/ksz8.c:313:\treturn ksz_rmw8(dev, REG_SW_CTRL_2, SW_LEGAL_PACKET_DISABLE, ctrl2);\ndrivers/net/dsa/microchip/ksz8.c-314-}\n--\ndrivers/net/dsa/microchip/ksz8.c=321=static int ksz88xx_max_mtu(struct dsa_switch *ds, int port)\n--\ndrivers/net/dsa/microchip/ksz8.c-325-\ndrivers/net/dsa/microchip/ksz8.c:326:static int ksz8_port_queue_split(struct ksz_device *dev, int port, int queues)\ndrivers/net/dsa/microchip/ksz8.c-327-{\n--\ndrivers/net/dsa/microchip/ksz8.c-333-\ndrivers/net/dsa/microchip/ksz8.c:334:\tif (ksz_is_ksz88x3(dev)) {\ndrivers/net/dsa/microchip/ksz8.c-335-\t\tmask_4q = KSZ8873_PORT_4QUEUE_SPLIT_EN;\n--\ndrivers/net/dsa/microchip/ksz8.c-345-\t\t */\ndrivers/net/dsa/microchip/ksz8.c:346:\t\tret = ksz_rmw8(dev, REG_SW_CTRL_3, WEIGHTED_FAIR_QUEUE_ENABLE,\ndrivers/net/dsa/microchip/ksz8.c-347-\t\t\t       WEIGHTED_FAIR_QUEUE_ENABLE);\n--\ndrivers/net/dsa/microchip/ksz8.c-349-\t\t\treturn ret;\ndrivers/net/dsa/microchip/ksz8.c:350:\t} else if (ksz_is_ksz8463(dev)) {\ndrivers/net/dsa/microchip/ksz8.c-351-\t\tmask_4q = KSZ8873_PORT_4QUEUE_SPLIT_EN;\n--\ndrivers/net/dsa/microchip/ksz8.c-363-\t\t */\ndrivers/net/dsa/microchip/ksz8.c:364:\t\tret = ksz_rmw8(dev, REG_SW_CTRL_19,\ndrivers/net/dsa/microchip/ksz8.c-365-\t\t\t       SW_OUT_RATE_LIMIT_QUEUE_BASED,\n--\ndrivers/net/dsa/microchip/ksz8.c-375-\ndrivers/net/dsa/microchip/ksz8.c:376:\tret = ksz_prmw8(dev, port, reg_4q, mask_4q, data_4q);\ndrivers/net/dsa/microchip/ksz8.c-377-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-379-\ndrivers/net/dsa/microchip/ksz8.c:380:\treturn ksz_prmw8(dev, port, reg_2q, mask_2q, data_2q);\ndrivers/net/dsa/microchip/ksz8.c-381-}\ndrivers/net/dsa/microchip/ksz8.c-382-\ndrivers/net/dsa/microchip/ksz8.c:383:static void ksz8_r_mib_cnt(struct ksz_device *dev, int port, u16 addr, u64 *cnt)\ndrivers/net/dsa/microchip/ksz8.c-384-{\n--\ndrivers/net/dsa/microchip/ksz8.c-398-\tmutex_lock(\u0026dev-\u003ealu_mutex);\ndrivers/net/dsa/microchip/ksz8.c:399:\tksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c-400-\n--\ndrivers/net/dsa/microchip/ksz8.c-404-\tfor (loop = 2; loop \u003e 0; loop--) {\ndrivers/net/dsa/microchip/ksz8.c:405:\t\tksz_read8(dev, regs[REG_IND_MIB_CHECK], \u0026check);\ndrivers/net/dsa/microchip/ksz8.c-406-\ndrivers/net/dsa/microchip/ksz8.c-407-\t\tif (check \u0026 masks[MIB_COUNTER_VALID]) {\ndrivers/net/dsa/microchip/ksz8.c:408:\t\t\tksz_read32(dev, regs[REG_IND_DATA_LO], \u0026data);\ndrivers/net/dsa/microchip/ksz8.c-409-\t\t\tif (check \u0026 masks[MIB_COUNTER_OVERFLOW])\n--\ndrivers/net/dsa/microchip/ksz8.c-417-\ndrivers/net/dsa/microchip/ksz8.c:418:static void ksz8795_r_mib_pkt(struct ksz_device *dev, int port, u16 addr,\ndrivers/net/dsa/microchip/ksz8.c-419-\t\t\t      u64 *dropped, u64 *cnt)\n--\ndrivers/net/dsa/microchip/ksz8.c-436-\tmutex_lock(\u0026dev-\u003ealu_mutex);\ndrivers/net/dsa/microchip/ksz8.c:437:\tksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c-438-\n--\ndrivers/net/dsa/microchip/ksz8.c-442-\tfor (loop = 2; loop \u003e 0; loop--) {\ndrivers/net/dsa/microchip/ksz8.c:443:\t\tksz_read8(dev, regs[REG_IND_MIB_CHECK], \u0026check);\ndrivers/net/dsa/microchip/ksz8.c-444-\ndrivers/net/dsa/microchip/ksz8.c-445-\t\tif (check \u0026 masks[MIB_COUNTER_VALID]) {\ndrivers/net/dsa/microchip/ksz8.c:446:\t\t\tksz_read32(dev, regs[REG_IND_DATA_LO], \u0026data);\ndrivers/net/dsa/microchip/ksz8.c-447-\t\t\tif (addr \u003c 2) {\n--\ndrivers/net/dsa/microchip/ksz8.c-469-\ndrivers/net/dsa/microchip/ksz8.c:470:static void ksz8863_r_mib_pkt(struct ksz_device *dev, int port, u16 addr,\ndrivers/net/dsa/microchip/ksz8.c-471-\t\t\t      u64 *dropped, u64 *cnt)\n--\ndrivers/net/dsa/microchip/ksz8.c-483-\t\t\t   KSZ8863_MIB_PACKET_DROPPED_RX_0;\ndrivers/net/dsa/microchip/ksz8.c:484:\tif (ksz_is_8895_family(dev) \u0026\u0026\ndrivers/net/dsa/microchip/ksz8.c-485-\t    ctrl_addr == KSZ8863_MIB_PACKET_DROPPED_RX_0)\n--\ndrivers/net/dsa/microchip/ksz8.c-490-\tmutex_lock(\u0026dev-\u003ealu_mutex);\ndrivers/net/dsa/microchip/ksz8.c:491:\tksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c:492:\tksz_read32(dev, regs[REG_IND_DATA_LO], \u0026data);\ndrivers/net/dsa/microchip/ksz8.c-493-\tmutex_unlock(\u0026dev-\u003ealu_mutex);\n--\ndrivers/net/dsa/microchip/ksz8.c-505-\ndrivers/net/dsa/microchip/ksz8.c:506:static void ksz8_r_mib_pkt(struct ksz_device *dev, int port, u16 addr,\ndrivers/net/dsa/microchip/ksz8.c-507-\t\t\t   u64 *dropped, u64 *cnt)\n--\ndrivers/net/dsa/microchip/ksz8.c-514-\ndrivers/net/dsa/microchip/ksz8.c:515:static void ksz8_freeze_mib(struct ksz_device *dev, int port, bool freeze)\ndrivers/net/dsa/microchip/ksz8.c-516-{\n--\ndrivers/net/dsa/microchip/ksz8.c-521-\tif (freeze)\ndrivers/net/dsa/microchip/ksz8.c:522:\t\tksz_cfg(dev, REG_SW_CTRL_6, BIT(port), true);\ndrivers/net/dsa/microchip/ksz8.c:523:\tksz_cfg(dev, REG_SW_CTRL_6, SW_MIB_COUNTER_FREEZE, freeze);\ndrivers/net/dsa/microchip/ksz8.c-524-\n--\ndrivers/net/dsa/microchip/ksz8.c-526-\tif (!freeze)\ndrivers/net/dsa/microchip/ksz8.c:527:\t\tksz_cfg(dev, REG_SW_CTRL_6, BIT(port), false);\ndrivers/net/dsa/microchip/ksz8.c-528-}\ndrivers/net/dsa/microchip/ksz8.c-529-\ndrivers/net/dsa/microchip/ksz8.c:530:static void ksz8_port_init_cnt(struct ksz_device *dev, int port)\ndrivers/net/dsa/microchip/ksz8.c-531-{\ndrivers/net/dsa/microchip/ksz8.c:532:\tstruct ksz_port_mib *mib = \u0026dev-\u003eports[port].mib;\ndrivers/net/dsa/microchip/ksz8.c-533-\tu64 *dropped;\n--\ndrivers/net/dsa/microchip/ksz8.c-535-\t/* For KSZ8795 family. */\ndrivers/net/dsa/microchip/ksz8.c:536:\tif (ksz_is_ksz87xx(dev)) {\ndrivers/net/dsa/microchip/ksz8.c-537-\t\t/* flush all enabled port MIB counters */\ndrivers/net/dsa/microchip/ksz8.c:538:\t\tksz_cfg(dev, REG_SW_CTRL_6, BIT(port), true);\ndrivers/net/dsa/microchip/ksz8.c:539:\t\tksz_cfg(dev, REG_SW_CTRL_6, SW_MIB_COUNTER_FLUSH, true);\ndrivers/net/dsa/microchip/ksz8.c:540:\t\tksz_cfg(dev, REG_SW_CTRL_6, BIT(port), false);\ndrivers/net/dsa/microchip/ksz8.c-541-\t}\n--\ndrivers/net/dsa/microchip/ksz8.c-562-\ndrivers/net/dsa/microchip/ksz8.c:563:static int ksz8_r_table(struct ksz_device *dev, int table, u16 addr, u64 *data)\ndrivers/net/dsa/microchip/ksz8.c-564-{\n--\ndrivers/net/dsa/microchip/ksz8.c-573-\tmutex_lock(\u0026dev-\u003ealu_mutex);\ndrivers/net/dsa/microchip/ksz8.c:574:\tret = ksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c-575-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-577-\ndrivers/net/dsa/microchip/ksz8.c:578:\tret = ksz_read64(dev, regs[REG_IND_DATA_HI], data);\ndrivers/net/dsa/microchip/ksz8.c-579-unlock_alu:\n--\ndrivers/net/dsa/microchip/ksz8.c-584-\ndrivers/net/dsa/microchip/ksz8.c:585:static int ksz8_w_table(struct ksz_device *dev, int table, u16 addr, u64 data)\ndrivers/net/dsa/microchip/ksz8.c-586-{\n--\ndrivers/net/dsa/microchip/ksz8.c-595-\tmutex_lock(\u0026dev-\u003ealu_mutex);\ndrivers/net/dsa/microchip/ksz8.c:596:\tret = ksz_write64(dev, regs[REG_IND_DATA_HI], data);\ndrivers/net/dsa/microchip/ksz8.c-597-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-599-\ndrivers/net/dsa/microchip/ksz8.c:600:\tret = ksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c-601-unlock_alu:\n--\ndrivers/net/dsa/microchip/ksz8.c-606-\ndrivers/net/dsa/microchip/ksz8.c:607:static int ksz8_valid_dyn_entry(struct ksz_device *dev, u8 *data)\ndrivers/net/dsa/microchip/ksz8.c-608-{\n--\ndrivers/net/dsa/microchip/ksz8.c-617-\tdo {\ndrivers/net/dsa/microchip/ksz8.c:618:\t\tret = ksz_read8(dev, regs[REG_IND_DATA_CHECK], data);\ndrivers/net/dsa/microchip/ksz8.c-619-\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-629-\t/* Entry is ready for accessing. */\ndrivers/net/dsa/microchip/ksz8.c:630:\treturn ksz_read8(dev, regs[REG_IND_DATA_8], data);\ndrivers/net/dsa/microchip/ksz8.c-631-}\ndrivers/net/dsa/microchip/ksz8.c-632-\ndrivers/net/dsa/microchip/ksz8.c:633:static int ksz8_r_dyn_mac_table(struct ksz_device *dev, u16 addr, u8 *mac_addr,\ndrivers/net/dsa/microchip/ksz8.c-634-\t\t\t\tu8 *fid, u8 *src_port, u16 *entries)\n--\ndrivers/net/dsa/microchip/ksz8.c-652-\tmutex_lock(\u0026dev-\u003ealu_mutex);\ndrivers/net/dsa/microchip/ksz8.c:653:\tret = ksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr);\ndrivers/net/dsa/microchip/ksz8.c-654-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-665-\ndrivers/net/dsa/microchip/ksz8.c:666:\tret = ksz_read64(dev, regs[REG_IND_DATA_HI], \u0026buf);\ndrivers/net/dsa/microchip/ksz8.c-667-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-698-\ndrivers/net/dsa/microchip/ksz8.c:699:static int ksz8_r_sta_mac_table(struct ksz_device *dev, u16 addr,\ndrivers/net/dsa/microchip/ksz8.c-700-\t\t\t\tstruct alu_struct *alu, bool *valid)\n--\ndrivers/net/dsa/microchip/ksz8.c-738-\t */\ndrivers/net/dsa/microchip/ksz8.c:739:\tif (ksz_is_ksz87xx(dev) || ksz_is_8895_family(dev))\ndrivers/net/dsa/microchip/ksz8.c-740-\t\tdata_hi \u003e\u003e= 1;\n--\ndrivers/net/dsa/microchip/ksz8.c-750-\ndrivers/net/dsa/microchip/ksz8.c:751:static int ksz8_w_sta_mac_table(struct ksz_device *dev, u16 addr,\ndrivers/net/dsa/microchip/ksz8.c-752-\t\t\t\tstruct alu_struct *alu)\n--\ndrivers/net/dsa/microchip/ksz8.c-783-\ndrivers/net/dsa/microchip/ksz8.c:784:static void ksz8_from_vlan(struct ksz_device *dev, u32 vlan, u8 *fid,\ndrivers/net/dsa/microchip/ksz8.c-785-\t\t\t   u8 *member, u8 *valid)\n--\ndrivers/net/dsa/microchip/ksz8.c-798-\ndrivers/net/dsa/microchip/ksz8.c:799:static void ksz8_to_vlan(struct ksz_device *dev, u8 fid, u8 member, u8 valid,\ndrivers/net/dsa/microchip/ksz8.c-800-\t\t\t u16 *vlan)\n--\ndrivers/net/dsa/microchip/ksz8.c-813-\ndrivers/net/dsa/microchip/ksz8.c:814:static void ksz8_r_vlan_entries(struct ksz_device *dev, u16 addr)\ndrivers/net/dsa/microchip/ksz8.c-815-{\n--\ndrivers/net/dsa/microchip/ksz8.c-829-\ndrivers/net/dsa/microchip/ksz8.c:830:static void ksz8_r_vlan_table(struct ksz_device *dev, u16 vid, u16 *vlan)\ndrivers/net/dsa/microchip/ksz8.c-831-{\n--\ndrivers/net/dsa/microchip/ksz8.c-843-\ndrivers/net/dsa/microchip/ksz8.c:844:static void ksz8_w_vlan_table(struct ksz_device *dev, u16 vid, u16 vlan)\ndrivers/net/dsa/microchip/ksz8.c-845-{\n--\ndrivers/net/dsa/microchip/ksz8.c-871- */\ndrivers/net/dsa/microchip/ksz8.c:872:static int ksz879x_get_loopback(struct ksz_device *dev, u16 port,\ndrivers/net/dsa/microchip/ksz8.c-873-\t\t\t\tu16 *val)\n--\ndrivers/net/dsa/microchip/ksz8.c-877-\ndrivers/net/dsa/microchip/ksz8.c:878:\tret = ksz_pread8(dev, port, REG_PORT_STATUS_3, \u0026stat3);\ndrivers/net/dsa/microchip/ksz8.c-879-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-899- */\ndrivers/net/dsa/microchip/ksz8.c:900:static int ksz879x_set_loopback(struct ksz_device *dev, u16 port, u16 val)\ndrivers/net/dsa/microchip/ksz8.c-901-{\n--\ndrivers/net/dsa/microchip/ksz8.c-906-\ndrivers/net/dsa/microchip/ksz8.c:907:\treturn ksz_prmw8(dev, port, REG_PORT_STATUS_3, PORT_PHY_LOOPBACK,\ndrivers/net/dsa/microchip/ksz8.c-908-\t\t\t stat3);\n--\ndrivers/net/dsa/microchip/ksz8.c-910-\ndrivers/net/dsa/microchip/ksz8.c:911:static int ksz87xx_apply_low_loss_preset(struct ksz_device *dev, bool enable)\ndrivers/net/dsa/microchip/ksz8.c-912-{\n--\ndrivers/net/dsa/microchip/ksz8.c-921-\ndrivers/net/dsa/microchip/ksz8.c:922:\tif (!ksz_is_ksz87xx(dev))\ndrivers/net/dsa/microchip/ksz8.c-923-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/dsa/microchip/ksz8.c-957- */\ndrivers/net/dsa/microchip/ksz8.c:958:static int ksz8_r_phy_ctrl(struct ksz_device *dev, int port, u16 *val)\ndrivers/net/dsa/microchip/ksz8.c-959-{\n--\ndrivers/net/dsa/microchip/ksz8.c-965-\ndrivers/net/dsa/microchip/ksz8.c:966:\tret = ksz_pread8(dev, port, regs[P_LINK_STATUS], \u0026reg_val);\ndrivers/net/dsa/microchip/ksz8.c-967-\tif (ret \u003c 0)\n--\ndrivers/net/dsa/microchip/ksz8.c-972-\ndrivers/net/dsa/microchip/ksz8.c:973:\tret = ksz_pread8(dev, port, REG_PORT_LINK_MD_CTRL, \u0026reg_val);\ndrivers/net/dsa/microchip/ksz8.c-974-\tif (ret \u003c 0)\n--\ndrivers/net/dsa/microchip/ksz8.c-1023- */\ndrivers/net/dsa/microchip/ksz8.c:1024:static int ksz8_r_phy_bmcr(struct ksz_device *dev, u16 port, u16 *val)\ndrivers/net/dsa/microchip/ksz8.c-1025-{\n--\ndrivers/net/dsa/microchip/ksz8.c-1031-\ndrivers/net/dsa/microchip/ksz8.c:1032:\tret = ksz_pread8(dev, port, regs[P_NEG_RESTART_CTRL], \u0026restart);\ndrivers/net/dsa/microchip/ksz8.c-1033-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1035-\ndrivers/net/dsa/microchip/ksz8.c:1036:\tret = ksz_pread8(dev, port, regs[P_SPEED_STATUS], \u0026speed);\ndrivers/net/dsa/microchip/ksz8.c-1037-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1039-\ndrivers/net/dsa/microchip/ksz8.c:1040:\tret = ksz_pread8(dev, port, regs[P_FORCE_CTRL], \u0026ctrl);\ndrivers/net/dsa/microchip/ksz8.c-1041-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1046-\ndrivers/net/dsa/microchip/ksz8.c:1047:\tif (ksz_is_ksz88x3(dev)) {\ndrivers/net/dsa/microchip/ksz8.c-1048-\t\tif (restart \u0026 KSZ8873_PORT_PHY_LOOPBACK)\n--\ndrivers/net/dsa/microchip/ksz8.c-1088-\ndrivers/net/dsa/microchip/ksz8.c:1089:static int ksz8_r_phy(struct ksz_device *dev, u16 phy, u16 reg, u16 *val)\ndrivers/net/dsa/microchip/ksz8.c-1090-{\n--\ndrivers/net/dsa/microchip/ksz8.c-1106-\tcase MII_BMSR:\ndrivers/net/dsa/microchip/ksz8.c:1107:\t\tret = ksz_pread8(dev, p, regs[P_LINK_STATUS], \u0026link);\ndrivers/net/dsa/microchip/ksz8.c-1108-\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1124-\tcase MII_PHYSID2:\ndrivers/net/dsa/microchip/ksz8.c:1125:\t\tif (ksz_is_ksz88x3(dev))\ndrivers/net/dsa/microchip/ksz8.c-1126-\t\t\tdata = KSZ8863_ID_LO;\n--\ndrivers/net/dsa/microchip/ksz8.c-1130-\tcase MII_ADVERTISE:\ndrivers/net/dsa/microchip/ksz8.c:1131:\t\tret = ksz_pread8(dev, p, regs[P_LOCAL_CTRL], \u0026ctrl);\ndrivers/net/dsa/microchip/ksz8.c-1132-\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1147-\tcase MII_LPA:\ndrivers/net/dsa/microchip/ksz8.c:1148:\t\tret = ksz_pread8(dev, p, regs[P_REMOTE_STATUS], \u0026link);\ndrivers/net/dsa/microchip/ksz8.c-1149-\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1166-\tcase PHY_REG_LINK_MD:\ndrivers/net/dsa/microchip/ksz8.c:1167:\t\tret = ksz_pread8(dev, p, REG_PORT_LINK_MD_CTRL, \u0026val1);\ndrivers/net/dsa/microchip/ksz8.c-1168-\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1170-\ndrivers/net/dsa/microchip/ksz8.c:1171:\t\tret = ksz_pread8(dev, p, REG_PORT_LINK_MD_RESULT, \u0026val2);\ndrivers/net/dsa/microchip/ksz8.c-1172-\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1194-\tcase PHY_REG_KSZ87XX_SHORT_CABLE:\ndrivers/net/dsa/microchip/ksz8.c:1195:\t\tif (!ksz_is_ksz87xx(dev))\ndrivers/net/dsa/microchip/ksz8.c-1196-\t\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/dsa/microchip/ksz8.c-1200-\tcase PHY_REG_KSZ87XX_LPF_BW:\ndrivers/net/dsa/microchip/ksz8.c:1201:\t\tif (!ksz_is_ksz87xx(dev))\ndrivers/net/dsa/microchip/ksz8.c-1202-\t\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/dsa/microchip/ksz8.c-1205-\tcase PHY_REG_KSZ87XX_EQ_INIT:\ndrivers/net/dsa/microchip/ksz8.c:1206:\t\tif (!ksz_is_ksz87xx(dev))\ndrivers/net/dsa/microchip/ksz8.c-1207-\t\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/dsa/microchip/ksz8.c=1220=static int ksz8_phy_read16(struct dsa_switch *ds, int addr, int reg)\ndrivers/net/dsa/microchip/ksz8.c-1221-{\ndrivers/net/dsa/microchip/ksz8.c:1222:\tstruct ksz_device *dev = ds-\u003epriv;\ndrivers/net/dsa/microchip/ksz8.c-1223-\tu16 val = 0xffff;\n--\ndrivers/net/dsa/microchip/ksz8.c-1245- */\ndrivers/net/dsa/microchip/ksz8.c:1246:static int ksz8_w_phy_ctrl(struct ksz_device *dev, int port, u16 val)\ndrivers/net/dsa/microchip/ksz8.c-1247-{\n--\ndrivers/net/dsa/microchip/ksz8.c-1259-\ndrivers/net/dsa/microchip/ksz8.c:1260:\tret = ksz_prmw8(dev, port, REG_PORT_LINK_MD_CTRL, PORT_FORCE_LINK |\ndrivers/net/dsa/microchip/ksz8.c-1261-\t\t\tPORT_POWER_SAVING | PORT_PHY_REMOTE_LOOPBACK, reg_val);\n--\ndrivers/net/dsa/microchip/ksz8.c-1299- */\ndrivers/net/dsa/microchip/ksz8.c:1300:static int ksz8_w_phy_bmcr(struct ksz_device *dev, u16 port, u16 val)\ndrivers/net/dsa/microchip/ksz8.c-1301-{\n--\ndrivers/net/dsa/microchip/ksz8.c-1313-\ndrivers/net/dsa/microchip/ksz8.c:1314:\tret = ksz_prmw8(dev, port, regs[P_SPEED_STATUS], PORT_HP_MDIX, speed);\ndrivers/net/dsa/microchip/ksz8.c-1315-\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1318-\tctrl = 0;\ndrivers/net/dsa/microchip/ksz8.c:1319:\tif (ksz_is_ksz88x3(dev)) {\ndrivers/net/dsa/microchip/ksz8.c-1320-\t\tif ((val \u0026 BMCR_ANENABLE))\n--\ndrivers/net/dsa/microchip/ksz8.c-1336-\ndrivers/net/dsa/microchip/ksz8.c:1337:\tret = ksz_prmw8(dev, port, regs[P_FORCE_CTRL], PORT_FORCE_100_MBIT |\ndrivers/net/dsa/microchip/ksz8.c-1338-\t\t /* PORT_AUTO_NEG_ENABLE and PORT_AUTO_NEG_DISABLE are the same\n--\ndrivers/net/dsa/microchip/ksz8.c-1366-\ndrivers/net/dsa/microchip/ksz8.c:1367:\tif (ksz_is_ksz88x3(dev)) {\ndrivers/net/dsa/microchip/ksz8.c-1368-\t\trestart_mask |= KSZ8873_PORT_PHY_LOOPBACK;\n--\ndrivers/net/dsa/microchip/ksz8.c-1377-\ndrivers/net/dsa/microchip/ksz8.c:1378:\treturn ksz_prmw8(dev, port, regs[P_NEG_RESTART_CTRL], restart_mask,\ndrivers/net/dsa/microchip/ksz8.c-1379-\t\t\t restart);\n--\ndrivers/net/dsa/microchip/ksz8.c-1381-\ndrivers/net/dsa/microchip/ksz8.c:1382:static int ksz8_w_phy(struct ksz_device *dev, u16 phy, u16 reg, u16 val)\ndrivers/net/dsa/microchip/ksz8.c-1383-{\n--\ndrivers/net/dsa/microchip/ksz8.c-1397-\tcase MII_ADVERTISE:\ndrivers/net/dsa/microchip/ksz8.c:1398:\t\tret = ksz_pread8(dev, p, regs[P_LOCAL_CTRL], \u0026ctrl);\ndrivers/net/dsa/microchip/ksz8.c-1399-\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1419-\t\tif (data != ctrl) {\ndrivers/net/dsa/microchip/ksz8.c:1420:\t\t\tret = ksz_pwrite8(dev, p, regs[P_LOCAL_CTRL], data);\ndrivers/net/dsa/microchip/ksz8.c-1421-\t\t\tif (ret)\n--\ndrivers/net/dsa/microchip/ksz8.c-1426-\t\tif (val \u0026 PHY_START_CABLE_DIAG)\ndrivers/net/dsa/microchip/ksz8.c:1427:\t\t\tksz_port_cfg(dev, p, REG_PORT_LINK_MD_CTRL, PORT_START_CABLE_DIAG, true);\ndrivers/net/dsa/microchip/ksz8.c-1428-\t\tbreak;\n--\ndrivers/net/dsa/microchip/ksz8.c-1435-\tcase PHY_REG_KSZ87XX_SHORT_CABLE:\ndrivers/net/dsa/microchip/ksz8.c:1436:\t\tif (!ksz_is_ksz87xx(dev))\ndrivers/net/dsa/microchip/ksz8.c-1437-\t\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/dsa/microchip/ksz8.c-1444-\tcase PHY_REG_KSZ87XX_LPF_BW:\ndrivers/net/dsa/microchip/ksz8.c:1445:\t\tif (!ksz_is_ksz87xx(dev))\ndrivers/net/dsa/microchip/ksz8.c-1446-\t\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/dsa/microchip/ksz8.c-1457-\tcase PHY_REG_KSZ87XX_EQ_INIT:\ndrivers/net/dsa/microchip/ksz8.c:1458:\t\tif (!ksz_is_ksz87xx(dev))\ndrivers/net/dsa/microchip/ksz8.c-1459-\t\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/dsa/microchip/ksz8.c=1477=static int ksz8_phy_write16(struct dsa_switch *ds, int addr, int reg, u16 val)\n\n"
}

gemini-3.7-flash

null

null

							input: 18211
							output: 19
							thoughts: 38
						

Okay, let's dive into this. I need to understand the control flow around `ksz_switch_register`. My immediate focus is on how it's invoked and, critically, what buses it's probing over. This is likely the key to understanding its device discovery mechanism.

Right, time to execute a code search for `ksz_switch_register` within the codebase. Hopefully, I'll find all the call sites and understand the entry points for this function. Knowing which bus drivers might be calling into this is where to focus the investigation. This will give a good overview of the design!

{
  "Expression": "ksz_switch_register"
}

{
  "Output": "drivers/net/dsa/microchip/ksz8863_smi.c=133=static int ksz8863_smi_probe(struct mdio_device *mdiodev)\n--\ndrivers/net/dsa/microchip/ksz8863_smi.c-168-\ndrivers/net/dsa/microchip/ksz8863_smi.c:169:\tret = ksz_switch_register(dev);\ndrivers/net/dsa/microchip/ksz8863_smi.c-170-\n--\ndrivers/net/dsa/microchip/ksz9477_i2c.c=17=static int ksz9477_i2c_probe(struct i2c_client *i2c)\n--\ndrivers/net/dsa/microchip/ksz9477_i2c.c-50-\ndrivers/net/dsa/microchip/ksz9477_i2c.c:51:\tret = ksz_switch_register(dev);\ndrivers/net/dsa/microchip/ksz9477_i2c.c-52-\n--\ndrivers/net/dsa/microchip/ksz_common.c=3924=static int ksz8463_release_straps_spi(struct ksz_device *dev)\n--\ndrivers/net/dsa/microchip/ksz_common.c-3928-\ndrivers/net/dsa/microchip/ksz_common.c:3929:int ksz_switch_register(struct ksz_device *dev)\ndrivers/net/dsa/microchip/ksz_common.c-3930-{\n--\ndrivers/net/dsa/microchip/ksz_common.c-4098-}\ndrivers/net/dsa/microchip/ksz_common.c:4099:EXPORT_SYMBOL(ksz_switch_register);\ndrivers/net/dsa/microchip/ksz_common.c-4100-\n--\ndrivers/net/dsa/microchip/ksz_common.h=428=struct ksz_device *ksz_switch_alloc(struct device *base,\n--\ndrivers/net/dsa/microchip/ksz_common.h-430-\t\t\t\t    void *priv);\ndrivers/net/dsa/microchip/ksz_common.h:431:int ksz_switch_register(struct ksz_device *dev);\ndrivers/net/dsa/microchip/ksz_common.h-432-void ksz_switch_remove(struct ksz_device *dev);\n--\ndrivers/net/dsa/microchip/ksz_spi.c=137=static int ksz_spi_probe(struct spi_device *spi)\n--\ndrivers/net/dsa/microchip/ksz_spi.c-194-\ndrivers/net/dsa/microchip/ksz_spi.c:195:\tret = ksz_switch_register(dev);\ndrivers/net/dsa/microchip/ksz_spi.c-196-\n"
}

gemini-3.7-flash

null

null

							input: 19162
							output: 47
							thoughts: 408
						

**My Assessment of Reachability in QEMU/Syzkaller for Microchip Switch Drivers**

Okay, let's break this down. I see we're looking at `ksz9477_i2c.c`, `ksz_spi.c`, and potentially `ksz8863_smi.c`. My immediate thought is, can these be instantiated, probed, and ultimately fuzzed effectively within QEMU or Syzkaller? Or are we dealing with a situation requiring actual hardware, specifically DSA switch hardware?

The critical question here is whether I2C/SPI DSA switches can be instantiated or even emulated somehow, perhaps from userspace, which would be ideal. I need to recall how syzkaller handles I2C devices. Does it use `syz_mount_image`, the `new_device` sysfs interface, or perhaps leverage device trees or ACPI? I need to clarify what syzkaller *actually* fuzzes.

Right, time to consult our guidelines. Let's see... the core triage philosophy states fuzzing is only valid for code that *executes* in standard virtualized environments. No structural unreachable code should be fuzzed, regardless of how complex the code. I remember the section on structurally unreachable hardware well. This points directly to the problem: vendor-specific PCIe switches, SmartNICs, GPU drivers – these all require physical ASICs or PCIe cards not emulated in standard QEMU.

Now, what about DSA switches? Are these generally implemented as hardware ASIC switches that are connected via SPI/I2C/MDIO or memory-mapped buses? This is a key point. Can DSA microchip switch drivers, like the ones in these files, actually be instantiated or reached within standard QEMU/syzkaller setups?

My next step is clear. I need to dive into the code itself. I'll read `ksz9477_i2c.c` and `ksz_spi.c` closely to understand how `ksz9477` and `ksz_common` are designed and how they interact with the hardware. This will determine if there's any pathway for them to be fuzzed, or if they are doomed to be structurally unreachable.

{
  "File": "drivers/net/dsa/microchip/ksz9477_i2c.c",
  "FirstLine": 1,
  "LineCount": 80
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: GPL-2.0\n   2:\t/*\n   3:\t * Microchip KSZ9477 series register access through I2C\n   4:\t *\n   5:\t * Copyright (C) 2018-2024 Microchip Technology Inc.\n   6:\t */\n   7:\t\n   8:\t#include \u003clinux/i2c.h\u003e\n   9:\t#include \u003clinux/kernel.h\u003e\n  10:\t#include \u003clinux/module.h\u003e\n  11:\t#include \u003clinux/regmap.h\u003e\n  12:\t\n  13:\t#include \"ksz_common.h\"\n  14:\t\n  15:\tKSZ_REGMAP_TABLE(ksz9477, not_used, 16, 0, 0);\n  16:\t\n  17:\tstatic int ksz9477_i2c_probe(struct i2c_client *i2c)\n  18:\t{\n  19:\t\tconst struct ksz_chip_data *chip;\n  20:\t\tstruct device *ddev = \u0026i2c-\u003edev;\n  21:\t\tstruct regmap_config rc;\n  22:\t\tstruct ksz_device *dev;\n  23:\t\tint i, ret;\n  24:\t\n  25:\t\tchip = device_get_match_data(ddev);\n  26:\t\tif (!chip)\n  27:\t\t\treturn -EINVAL;\n  28:\t\n  29:\t\tdev = ksz_switch_alloc(\u0026i2c-\u003edev, chip, i2c);\n  30:\t\tif (!dev)\n  31:\t\t\treturn -ENOMEM;\n  32:\t\n  33:\t\t/* Save chip id to do special initialization when probing. */\n  34:\t\tdev-\u003echip_id = chip-\u003echip_id;\n  35:\t\tfor (i = 0; i \u003c __KSZ_NUM_REGMAPS; i++) {\n  36:\t\t\trc = ksz9477_regmap_config[i];\n  37:\t\t\trc.lock_arg = \u0026dev-\u003eregmap_mutex;\n  38:\t\t\tdev-\u003eregmap[i] = devm_regmap_init_i2c(i2c, \u0026rc);\n  39:\t\t\tif (IS_ERR(dev-\u003eregmap[i])) {\n  40:\t\t\t\treturn dev_err_probe(\u0026i2c-\u003edev, PTR_ERR(dev-\u003eregmap[i]),\n  41:\t\t\t\t\t\t     \"Failed to initialize regmap%i\\n\",\n  42:\t\t\t\t\t\t     ksz9477_regmap_config[i].val_bits);\n  43:\t\t\t}\n  44:\t\t}\n  45:\t\n  46:\t\tif (i2c-\u003edev.platform_data)\n  47:\t\t\tdev-\u003epdata = i2c-\u003edev.platform_data;\n  48:\t\n  49:\t\tdev-\u003eirq = i2c-\u003eirq;\n  50:\t\n  51:\t\tret = ksz_switch_register(dev);\n  52:\t\n  53:\t\t/* Main DSA driver may not be started yet. */\n  54:\t\tif (ret)\n  55:\t\t\treturn ret;\n  56:\t\n  57:\t\ti2c_set_clientdata(i2c, dev);\n  58:\t\n  59:\t\treturn 0;\n  60:\t}\n  61:\t\n  62:\tstatic void ksz9477_i2c_remove(struct i2c_client *i2c)\n  63:\t{\n  64:\t\tstruct ksz_device *dev = i2c_get_clientdata(i2c);\n  65:\t\n  66:\t\tif (dev)\n  67:\t\t\tksz_switch_remove(dev);\n  68:\t}\n  69:\t\n  70:\tstatic void ksz9477_i2c_shutdown(struct i2c_client *i2c)\n  71:\t{\n  72:\t\tstruct ksz_device *dev = i2c_get_clientdata(i2c);\n  73:\t\n  74:\t\tif (!dev)\n  75:\t\t\treturn;\n  76:\t\n  77:\t\tksz_switch_shutdown(dev);\n  78:\t\n  79:\t\ti2c_set_clientdata(i2c, NULL);\n  80:\t}\n"
}

gemini-3.7-flash

null

null

							input: 21226
							output: 36
							thoughts: 89
						

Here's my thought process, as an expert in this area:

**Analyzing the I2C Probe Function and Relevant Kconfig Options**

Okay, so I'm looking at `ksz9477_i2c_probe`. The name immediately tells me this is dealing with an I2C client, which is what I suspected. My first thought is whether this driver or the I2C client it's meant to interface with is something that can be targeted effectively in fuzzing campaigns. I have to think about whether `NET_DSA_MICROCHIP_KSZ_COMMON` or `NET_DSA` are even reachable in a pure software context, or if they're tied to a hardware switch ASIC. The latter would make fuzzing directly less efficient, if not impossible.

To figure out the potential fuzzing surface and how to reach the functionality that the probe function covers, I'm going to dig into the Kconfig for `NET_DSA_MICROCHIP_KSZ_COMMON` and any related configurations. I need to understand the dependencies and build options to determine whether I can trigger this code path from a test environment or if it requires a specific hardware setup.

{
  "Expression": "NET_DSA_MICROCHIP",
  "PathPrefix": "drivers/net/dsa/microchip"
}

{
  "Output": "drivers/net/dsa/microchip/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/dsa/microchip/Kconfig:2:menuconfig NET_DSA_MICROCHIP_KSZ_COMMON\ndrivers/net/dsa/microchip/Kconfig-3-\ttristate \"Microchip KSZ8XXX/KSZ9XXX/LAN937X series switch support\"\n--\ndrivers/net/dsa/microchip/Kconfig-16-\ndrivers/net/dsa/microchip/Kconfig:17:config NET_DSA_MICROCHIP_KSZ9477_I2C\ndrivers/net/dsa/microchip/Kconfig-18-\ttristate \"KSZ series I2C connected switch driver\"\ndrivers/net/dsa/microchip/Kconfig:19:\tdepends on NET_DSA_MICROCHIP_KSZ_COMMON \u0026\u0026 I2C\ndrivers/net/dsa/microchip/Kconfig-20-\tselect REGMAP_I2C\n--\ndrivers/net/dsa/microchip/Kconfig-23-\ndrivers/net/dsa/microchip/Kconfig:24:config NET_DSA_MICROCHIP_KSZ_SPI\ndrivers/net/dsa/microchip/Kconfig-25-\ttristate \"KSZ series SPI connected switch driver\"\ndrivers/net/dsa/microchip/Kconfig:26:\tdepends on NET_DSA_MICROCHIP_KSZ_COMMON \u0026\u0026 SPI\ndrivers/net/dsa/microchip/Kconfig-27-\tselect REGMAP_SPI\n--\ndrivers/net/dsa/microchip/Kconfig-30-\ndrivers/net/dsa/microchip/Kconfig:31:config NET_DSA_MICROCHIP_KSZ_PTP\ndrivers/net/dsa/microchip/Kconfig-32-\tbool \"Support for the PTP clock on the KSZ9563/LAN937x Ethernet Switch\"\ndrivers/net/dsa/microchip/Kconfig:33:\tdepends on NET_DSA_MICROCHIP_KSZ_COMMON \u0026\u0026 PTP_1588_CLOCK\ndrivers/net/dsa/microchip/Kconfig:34:\tdepends on NET_DSA_MICROCHIP_KSZ_COMMON=m || PTP_1588_CLOCK=y\ndrivers/net/dsa/microchip/Kconfig-35-\thelp\n--\ndrivers/net/dsa/microchip/Kconfig-40-\ndrivers/net/dsa/microchip/Kconfig:41:config NET_DSA_MICROCHIP_KSZ8863_SMI\ndrivers/net/dsa/microchip/Kconfig-42-\ttristate \"KSZ series SMI connected switch driver\"\ndrivers/net/dsa/microchip/Kconfig:43:\tdepends on NET_DSA_MICROCHIP_KSZ_COMMON\ndrivers/net/dsa/microchip/Kconfig-44-\tselect MDIO_BITBANG\n--\ndrivers/net/dsa/microchip/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/dsa/microchip/Makefile:2:obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ_COMMON)\t+= ksz_switch.o\ndrivers/net/dsa/microchip/Makefile-3-ksz_switch-objs := ksz_common.o ksz_dcb.o\n--\ndrivers/net/dsa/microchip/Makefile=6=ksz_switch-objs += lan937x_main.o\ndrivers/net/dsa/microchip/Makefile-7-\ndrivers/net/dsa/microchip/Makefile:8:ifdef CONFIG_NET_DSA_MICROCHIP_KSZ_PTP\ndrivers/net/dsa/microchip/Makefile-9-ksz_switch-objs += ksz_ptp.o\ndrivers/net/dsa/microchip/Makefile=10=endif\ndrivers/net/dsa/microchip/Makefile-11-\ndrivers/net/dsa/microchip/Makefile:12:obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ9477_I2C)\t+= ksz9477_i2c.o\ndrivers/net/dsa/microchip/Makefile:13:obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ_SPI)\t\t+= ksz_spi.o\ndrivers/net/dsa/microchip/Makefile:14:obj-$(CONFIG_NET_DSA_MICROCHIP_KSZ8863_SMI)\t+= ksz8863_smi.o\n--\ndrivers/net/dsa/microchip/ksz_common.h=169=struct ksz_port {\n--\ndrivers/net/dsa/microchip/ksz_common.h-192-\tstruct phylink_pcs *pcs;\ndrivers/net/dsa/microchip/ksz_common.h:193:#if IS_ENABLED(CONFIG_NET_DSA_MICROCHIP_KSZ_PTP)\ndrivers/net/dsa/microchip/ksz_common.h-194-\tstruct kernel_hwtstamp_config tstamp_config;\n--\ndrivers/net/dsa/microchip/ksz_ptp.h-10-\ndrivers/net/dsa/microchip/ksz_ptp.h:11:#if IS_ENABLED(CONFIG_NET_DSA_MICROCHIP_KSZ_PTP)\ndrivers/net/dsa/microchip/ksz_ptp.h-12-\n--\ndrivers/net/dsa/microchip/ksz_ptp.h=87=static inline void ksz8463_ptp_irq_free(struct dsa_switch *ds) {}\n--\ndrivers/net/dsa/microchip/ksz_ptp.h-102-\ndrivers/net/dsa/microchip/ksz_ptp.h:103:#endif\t/* End of CONFIG_NET_DSA_MICROCHIP_KSZ_PTP */\ndrivers/net/dsa/microchip/ksz_ptp.h-104-\n"
}

gemini-3.7-flash

null

null

							input: 23093
							output: 44
							thoughts: 208
						

**Accessing DSA Switch Hardware & I2C Device Instantiation**

Okay, so I'm trying to figure out the access methods for DSA switch hardware, specifically how to interact with it. First, I need to understand how I2C devices are accessed within this context. Can I probe these devices using the standard `/sys/bus/i2c/devices/i2c-X/new_device` method? Ah, yes, in Linux, that's it! Userspace can write to that path to instantiate an I2C device. For example, using `echo "ksz9477 0x5f" > /sys/bus/i2c/devices/i2c-0/new_device`.

But now I need to check something: does the `ksz9477` driver, or the `ksz_common` library it uses, *require* actual physical hardware to successfully read registers? If I instantiate it on, say, i2c-0, even if there's no physical chip present, or even using a dummy I2C adapter, what exactly *happens* within `ksz_switch_register`? That's the key. I need to dive into the code. Let's examine `ksz_switch_register` function, it's defined within `ksz_common.c`.

{
  "File": "drivers/net/dsa/microchip/ksz_common.c",
  "FirstLine": 3925,
  "LineCount": 80
}

{
  "Contents": "3925:\t{\n3926:\t\treturn pinctrl_select_default_state(dev-\u003edev);\n3927:\t}\n3928:\t\n3929:\tint ksz_switch_register(struct ksz_device *dev)\n3930:\t{\n3931:\t\tconst struct ksz_chip_data *info;\n3932:\t\tstruct device_node *ports;\n3933:\t\tphy_interface_t interface;\n3934:\t\tunsigned int port_num;\n3935:\t\tu32 lookup_chip_id;\n3936:\t\tint ret;\n3937:\t\tint i;\n3938:\t\n3939:\t\tdev-\u003ereset_gpio = devm_gpiod_get_optional(dev-\u003edev, \"reset\",\n3940:\t\t\t\t\t\t\t  GPIOD_OUT_LOW);\n3941:\t\tif (IS_ERR(dev-\u003ereset_gpio))\n3942:\t\t\treturn PTR_ERR(dev-\u003ereset_gpio);\n3943:\t\n3944:\t\tif (dev-\u003ereset_gpio) {\n3945:\t\t\tif (of_device_is_compatible(dev-\u003edev-\u003eof_node, \"microchip,ksz8463\")) {\n3946:\t\t\t\tret = ksz8463_configure_straps_spi(dev);\n3947:\t\t\t\tif (ret)\n3948:\t\t\t\t\treturn ret;\n3949:\t\t\t}\n3950:\t\n3951:\t\t\tgpiod_set_value_cansleep(dev-\u003ereset_gpio, 1);\n3952:\t\t\tusleep_range(10000, 12000);\n3953:\t\t\tgpiod_set_value_cansleep(dev-\u003ereset_gpio, 0);\n3954:\t\t\tmsleep(100);\n3955:\t\n3956:\t\t\tif (of_device_is_compatible(dev-\u003edev-\u003eof_node, \"microchip,ksz8463\")) {\n3957:\t\t\t\tret = ksz8463_release_straps_spi(dev);\n3958:\t\t\t\tif (ret)\n3959:\t\t\t\t\treturn ret;\n3960:\t\t\t}\n3961:\t\t}\n3962:\t\n3963:\t\tmutex_init(\u0026dev-\u003edev_mutex);\n3964:\t\tmutex_init(\u0026dev-\u003eregmap_mutex);\n3965:\t\tmutex_init(\u0026dev-\u003ealu_mutex);\n3966:\t\tmutex_init(\u0026dev-\u003evlan_mutex);\n3967:\t\n3968:\t\tret = ksz_switch_detect(dev);\n3969:\t\tif (ret)\n3970:\t\t\treturn ret;\n3971:\t\n3972:\t\tlookup_chip_id = dev-\u003echip_id;\n3973:\t\n3974:\t\t/* The KSZ9897S and the KSZ9897R report the same chip ID and differ\n3975:\t\t * only in chip_data: only the S has the SGMII port 7, the R has a\n3976:\t\t * second RGMII port instead. Bit 7 of the port 7 XMII control 0\n3977:\t\t * register is read-only and tells them apart; it reads one on the S.\n3978:\t\t * Compare the KSZ9897S data sheet DS00002394C section 5.2.4.1 with\n3979:\t\t * the KSZ9897R data sheet DS00002330D section 5.2.3.1.\n3980:\t\t *\n3981:\t\t * Only the chip_data entry differs, so dev-\u003echip_id keeps the shared\n3982:\t\t * chip ID and nothing else has to know about the variant.\n3983:\t\t */\n3984:\t\tif (dev-\u003echip_id == KSZ9897_CHIP_ID) {\n3985:\t\t\tu8 val;\n3986:\t\n3987:\t\t\tret = ksz_read8(dev, KSZ9897_REG_PORT7_XMII_CTRL_0, \u0026val);\n3988:\t\t\tif (ret)\n3989:\t\t\t\treturn ret;\n3990:\t\n3991:\t\t\tif (val \u0026 KSZ9897_PORT7_SGMII_SEL)\n3992:\t\t\t\tlookup_chip_id = KSZ9897S_CHIP_ID;\n3993:\t\t}\n3994:\t\n3995:\t\tinfo = ksz_lookup_info(lookup_chip_id);\n3996:\t\tif (!info)\n3997:\t\t\treturn -ENODEV;\n3998:\t\n3999:\t\t/* Update the compatible info with the probed one */\n4000:\t\tdev-\u003einfo = info;\n4001:\t\n4002:\t\tdev_info(dev-\u003edev, \"found switch: %s, rev %i\\n\",\n4003:\t\t\t dev-\u003einfo-\u003edev_name, dev-\u003echip_rev);\n4004:\t\n"
}

gemini-3.7-flash

null

null

							input: 24959
							output: 34
							thoughts: 33
						

Here's my take on those thoughts, from an expert's perspective:

**Diving into the `ksz_switch_detect` Function**

Alright, so the task at hand is to analyze the `ksz_switch_detect(dev)` function. The initial clue is that it's interacting directly with the physical chip, likely through register reads. My immediate mental process is to drill down into the details. I need to understand how it's interacting with the hardware. What registers are we talking about? What are the expected values? What are the implications of those values? This function is probably the heart of the switch's initial identification or bring-up sequence. I'll need to confirm, but I'm expecting this is where we check for chip presence, version, and possibly basic configuration. Let's get to the source code and figure out the exact register interactions.

{
  "Expression": "ksz_switch_detect",
  "PathPrefix": "drivers/net/dsa/microchip"
}

{
  "Output": "drivers/net/dsa/microchip/ksz_common.c=2929=void ksz_phylink_mac_config(struct phylink_config *config,\n--\ndrivers/net/dsa/microchip/ksz_common.c-2940-\ndrivers/net/dsa/microchip/ksz_common.c:2941:static int ksz_switch_detect(struct ksz_device *dev)\ndrivers/net/dsa/microchip/ksz_common.c-2942-{\n--\ndrivers/net/dsa/microchip/ksz_common.c=3929=int ksz_switch_register(struct ksz_device *dev)\n--\ndrivers/net/dsa/microchip/ksz_common.c-3967-\ndrivers/net/dsa/microchip/ksz_common.c:3968:\tret = ksz_switch_detect(dev);\ndrivers/net/dsa/microchip/ksz_common.c-3969-\tif (ret)\n"
}

gemini-3.7-flash

null

null

							input: 25473
							output: 44
							thoughts: 29
						

Okay, let's dive into this. Here's my take on that function, `ksz_switch_detect`, nestled within `drivers/net/dsa/microchip/ksz_common.c`.

**Diving Deep into KSZ Switch Detection**

Alright, time to dissect `ksz_switch_detect` from `ksz_common.c`. I'm going to want to understand what triggers this routine, the key registers it's reading and writing, and the logic behind how it determines if a Microchip KSZ switch is present and functioning correctly. I'll be looking for any hardware-specific quirks or workarounds in this low-level driver. I'll need to remember that this function is part of a larger DSA (Distributed Switch Architecture) framework, so I should be keeping an eye out for how this function interacts with the higher-level DSA components. I'll be particularly interested in any error handling and retry mechanisms. I'm already anticipating some potential challenges – the need to handle different KSZ switch revisions, variations in PHY configurations, and maybe even some clever register probing techniques. This is where the magic happens, so let's see what they've come up with. Let's see if this code is well-written, efficient, and robust.

{
  "File": "drivers/net/dsa/microchip/ksz_common.c",
  "FirstLine": 2941,
  "LineCount": 80
}

{
  "Contents": "2941:\tstatic int ksz_switch_detect(struct ksz_device *dev)\n2942:\t{\n2943:\t\tu8 id1, id2, id4;\n2944:\t\tu16 id16;\n2945:\t\tu32 id32;\n2946:\t\tint ret;\n2947:\t\n2948:\t\t/* read chip id */\n2949:\t\tret = ksz_read16(dev, REG_CHIP_ID0, \u0026id16);\n2950:\t\tif (ret)\n2951:\t\t\treturn ret;\n2952:\t\n2953:\t\tid1 = FIELD_GET(SW_FAMILY_ID_M, id16);\n2954:\t\tid2 = FIELD_GET(SW_CHIP_ID_M, id16);\n2955:\t\n2956:\t\tswitch (id1) {\n2957:\t\tcase KSZ84_FAMILY_ID:\n2958:\t\t\tdev-\u003echip_id = KSZ8463_CHIP_ID;\n2959:\t\t\tbreak;\n2960:\t\tcase KSZ87_FAMILY_ID:\n2961:\t\t\tif (id2 == KSZ87_CHIP_ID_95) {\n2962:\t\t\t\tu8 val;\n2963:\t\n2964:\t\t\t\tdev-\u003echip_id = KSZ8795_CHIP_ID;\n2965:\t\n2966:\t\t\t\tksz_read8(dev, KSZ8_PORT_STATUS_0, \u0026val);\n2967:\t\t\t\tif (val \u0026 KSZ8_PORT_FIBER_MODE)\n2968:\t\t\t\t\tdev-\u003echip_id = KSZ8765_CHIP_ID;\n2969:\t\t\t} else if (id2 == KSZ87_CHIP_ID_94) {\n2970:\t\t\t\tdev-\u003echip_id = KSZ8794_CHIP_ID;\n2971:\t\t\t} else {\n2972:\t\t\t\treturn -ENODEV;\n2973:\t\t\t}\n2974:\t\t\tbreak;\n2975:\t\tcase KSZ88_FAMILY_ID:\n2976:\t\t\tif (id2 == KSZ88_CHIP_ID_63)\n2977:\t\t\t\tdev-\u003echip_id = KSZ88X3_CHIP_ID;\n2978:\t\t\telse\n2979:\t\t\t\treturn -ENODEV;\n2980:\t\t\tbreak;\n2981:\t\tcase KSZ8895_FAMILY_ID:\n2982:\t\t\tif (id2 == KSZ8895_CHIP_ID_95 ||\n2983:\t\t\t    id2 == KSZ8895_CHIP_ID_95R)\n2984:\t\t\t\tdev-\u003echip_id = KSZ8895_CHIP_ID;\n2985:\t\t\telse\n2986:\t\t\t\treturn -ENODEV;\n2987:\t\t\tret = ksz_read8(dev, REG_KSZ8864_CHIP_ID, \u0026id4);\n2988:\t\t\tif (ret)\n2989:\t\t\t\treturn ret;\n2990:\t\t\tif (id4 \u0026 SW_KSZ8864)\n2991:\t\t\t\tdev-\u003echip_id = KSZ8864_CHIP_ID;\n2992:\t\t\tbreak;\n2993:\t\tdefault:\n2994:\t\t\tret = ksz_read32(dev, REG_CHIP_ID0, \u0026id32);\n2995:\t\t\tif (ret)\n2996:\t\t\t\treturn ret;\n2997:\t\n2998:\t\t\tdev-\u003echip_rev = FIELD_GET(SW_REV_ID_M, id32);\n2999:\t\t\tid32 \u0026= ~0xFF;\n3000:\t\n3001:\t\t\tswitch (id32) {\n3002:\t\t\tcase KSZ9477_CHIP_ID:\n3003:\t\t\tcase KSZ9896_CHIP_ID:\n3004:\t\t\tcase KSZ9897_CHIP_ID:\n3005:\t\t\tcase KSZ9567_CHIP_ID:\n3006:\t\t\tcase KSZ8567_CHIP_ID:\n3007:\t\t\tcase LAN9370_CHIP_ID:\n3008:\t\t\tcase LAN9371_CHIP_ID:\n3009:\t\t\tcase LAN9372_CHIP_ID:\n3010:\t\t\tcase LAN9373_CHIP_ID:\n3011:\t\t\tcase LAN9374_CHIP_ID:\n3012:\t\n3013:\t\t\t\t/* LAN9646 does not have its own chip id. */\n3014:\t\t\t\tif (dev-\u003echip_id != LAN9646_CHIP_ID)\n3015:\t\t\t\t\tdev-\u003echip_id = id32;\n3016:\t\t\t\tbreak;\n3017:\t\t\tcase KSZ9893_CHIP_ID:\n3018:\t\t\t\tret = ksz_read8(dev, REG_CHIP_ID4,\n3019:\t\t\t\t\t\t\u0026id4);\n3020:\t\t\t\tif (ret)\n"
}

gemini-3.7-flash

null

null

							input: 27181
							output: 127
							thoughts: 1161
						

**WorthFuzzing=false: Microchip KSZ Switch Driver Update**

Okay, let's break this down. My initial assessment is that this commit deals with the `drivers/net/dsa/microchip/` directory, which indicates a driver for Microchip KSZ series Ethernet switch ASICs. These are physical hardware components accessed via SPI, I2C, or SMI/MDIO.

My next thought is to determine if this code is specific to hardware that's inaccessible in standard virtualized environments. The guidelines explicitly state that structurally unreachable hardware, like vendor-specific PCIe switches or, in this case, physical switch ASICs, should result in `WorthFuzzing=false`.

I've verified that the KSZ9897/S/R, KSZ9477, KSZ8795, and others are indeed physical Ethernet switch ICs from Microchip (formerly Micrel). They're discrete chips, and the driver interacts with them over I2C/SPI/SMI. In a standard QEMU amd64 environment, without custom device trees or actual hardware, there's no emulated KSZ switch device. Any I2C probing (`ksz_switch_detect`) would fail because no device would respond (ENXIO/EIO), or if a dummy regmap returns all zeros or ones, `ksz_switch_detect` returns ENODEV because the chip ID read from the registers wouldn't match any valid KSZ chip ID. I'm thinking here of registers and reading the chip ID: KSZ84_FAMILY_ID = 0x84, KSZ87 = 0x87, KSZ88 = 0x88, KSZ9477_CHIP_ID = 0x00947700, and so on.

The DSA (Distributed Switch Architecture) switch drivers are for *physical* hardware, like Microchip KSZ, Realtek, Marvell, and SJA1105. So, the bottom line is that these drivers require the actual switch hardware / ASICs.

I've taken a look at the modified files: `drivers/net/dsa/microchip/ksz_common.c`, `drivers/net/dsa/microchip/ksz_common.h`, and `include/linux/platform_data/microchip-ksz.h`. This commit's adding support for the KSZ9897S variant by checking a particular bit (bit 7 of the XMII control 0 register) to differentiate it from KSZ9897R.

Analyzing the diff, `ksz_common.c` now includes a `[KSZ9897S]` entry in `ksz_switch_chips[]` and a register check. `ksz_common.h` introduces `KSZ9897S` to the `enum ksz_model` and defines new constants. `microchip-ksz.h` adds `KSZ9897S_CHIP_ID`.

All these changes are *exclusively* within the Microchip KSZ Ethernet switch driver, which is a driver for discrete physical hardware ASICs, and it's unreachable in standard QEMU/syzkaller.

Therefore, because the code exclusively touches structurally unreachable hardware, my conclusion is `WorthFuzzing=false`. The reasoning is straightforward:
1.  The patch adds KSZ9897S support.
2.  The driver interacts with physical Microchip switch ASICs.
3.  No emulation in standard virtualized environments.
4.  Hence, `WorthFuzzing=false`.

Now, time to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch adds support for distinguishing the KSZ9897S Ethernet switch variant within the Microchip KSZ switch DSA driver (drivers/net/dsa/microchip/). This driver interacts with discrete physical Microchip switch ASICs over I2C/SPI/SMI buses. Because the required physical hardware is not present or emulated in standard virtualized fuzzing environments (e.g., QEMU amd64), the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds support for distinguishing the KSZ9897S Ethernet switch variant within the Microchip KSZ switch DSA driver (drivers/net/dsa/microchip/). This driver interacts with discrete physical Microchip switch ASICs over I2C/SPI/SMI buses. Because the required physical hardware is not present or emulated in standard virtualized fuzzing environments (e.g., QEMU amd64), the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null