net: dsa: mxl862xx: support firmware update

The firmware of MxL862xx managed Ethernet switches can be updated in-system via the same MDIO bus which is also used to manage the switch. Wire up the devlink flash_update operation for DSA drivers and implement firmware update and version reporting in the mxl862xx driver.

Changes since v3:
- only install the flash_update devlink op for switches whose driver implements it, so the devlink core rejects unsupported requests before fetching the firmware file from userspace
- run the deferred reprobe from a kernel thread which ends in module_put_and_kthread_exit() instead of a work item that dropped its module reference while still executing module code
- fail firmware API read commands with -ENODEV after the update has finished instead of faking success with an unfilled buffer, which could send port_fdb_dump() into an endless loop
- keep the host block in place across the post-update version query by exempting SYS_MISC_FW_VERSION from block_host instead of briefly lifting the block, and write all blocking flags under the MDIO bus lock
- check the return value of all SB PDI control writes; a failed address write during the half-bank switch could otherwise place the second half of the payload at the wrong flash offset
- initialise the progress notification deadline from jiffies so notifications are not suppressed on 32-bit systems shortly after boot
- log a distinct diagnostic when rescue mode detection fails on an SMDIO bus error instead of silently treating it as not being in rescue mode
- flush the switchdev deferred queue after closing the ports so the bridge's deferred STP DISABLED transitions reach the firmware while it is still running instead of failing against the host block with "failed to set STP state" errors
- treat -ENODEV as successful deletion in port_mdb_del() so the post-update teardown no longer leaves host MDB entries behind for the DSA core to report when the tree is torn down

Changes since v2:
- validate the firmware image, including both CRCs, before taking down any ports, so that a malformed file is rejected without disturbing the running switch and without the needless flash and reprobe cycle it previously triggered
- reject images whose declared payload sizes overflow when summed (check_add_overflow) or sum up to zero; the latter previously erased the flash without writing anything back
- allocate the reprobe work item and take the module and device references before starting the update, so scheduling the reprobe can no longer fail after the switch has been pushed into MCUboot
- prevent the stats poll work from being re-armed and cancel the CRC error work before starting the transfer
- check the host-blocking flags in mxl862xx_api_wrap() under the MDIO bus lock to close the race window where an API command which had already passed the check could reach the bus after the switch rebooted into MCUboot
- check the return value of SB PDI data word writes so a failed MDIO transaction aborts the transfer instead of being noticed only through a corrupted image
- report a per-model chip name (e.g. "MaxLinear MxL86252") as the devlink "asic.id" fixed version instead of the devicetree compatible string, whose comma is awkward for userspace consumers such as fwupd (see discussion on v2 patch 3)
- report the canonical null version "0.0.0" instead of "mcuboot-rescue" as the running firmware version in rescue mode, so that version-comparing update tools like fwupd treat every available release as an upgrade and offer it for recovery

Changes since RFC [1]:
- detect a switch stuck in MCUboot rescue mode at probe, register the switch without any ports and report "mcuboot-rescue" as the running firmware version, so devlink flash can recover from a failed or interrupted update (Andrew Lunn)
- clarify in the commit message of patch 2 that the per-transaction MDIO bus locking is about other, non-switch devices on the same MDIO bus (Andrew Lunn)
- mention in the commit message of patch 3 that closing the ports also stops phylib from polling the switch-internal PHYs during the transfer (Andrew Lunn)
- split up run-on sentence and explain the dynamically allocated reprobe work item instead of just pointing at iwlwifi in the commit message of patch 3 (Manuel Ebner)
- use kzalloc_obj() (Manuel Ebner)
- state the actual duration of a complete flash and reprobe cycle (just under a minute) in comments and the commit message, and clarify that the timeout values are generous upper bounds (Manuel Ebner)

[1] https://lore.kernel.org/all/[email protected]/
Daniel Golle (4):
net: dsa: wire flash_update devlink callback to drivers
net: dsa: mxl862xx: add SMDIO clause-22 register access
net: dsa: mxl862xx: add devlink flash_update and info_get
net: dsa: mxl862xx: recover switch stuck in MCUboot rescue mode

 drivers/net/dsa/mxl862xx/Makefile           |   2 +-
 drivers/net/dsa/mxl862xx/mxl862xx-cmd.h     |   1 +
 drivers/net/dsa/mxl862xx/mxl862xx-fw.c      | 535 ++++++++++++++++++++
 drivers/net/dsa/mxl862xx/mxl862xx-fw.h      |  18 +
 drivers/net/dsa/mxl862xx/mxl862xx-host.c    |  52 ++
 drivers/net/dsa/mxl862xx/mxl862xx-host.h    |   2 +
 drivers/net/dsa/mxl862xx/mxl862xx-phylink.c |   2 +
 drivers/net/dsa/mxl862xx/mxl862xx.c         |  50 +-
 drivers/net/dsa/mxl862xx/mxl862xx.h         |   9 +
 include/net/dsa.h                           |   3 +
 net/dsa/devlink.c                           |  50 +-
 11 files changed, 706 insertions(+), 18 deletions(-)
 create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.c
 create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.h

base-commit: e0722efbcfeb142e02b0b8031136ce81610a8507

2.55.0

Add a devlink_flash_update callback to dsa_switch_ops so that DSA drivers can support devlink dev flash without open-coding the devlink plumbing. Unlike the other trampolines in net/dsa/devlink.c, the flash_update op is only installed for switches whose driver implements the callback: the devlink core rejects flash requests up front when the op is absent, before fetching the firmware file from userspace, and an unconditionally present trampoline would defeat that early check and let unsupported requests block on request_firmware() only to fail with -EOPNOTSUPP afterwards.

---
v4: only install the flash_update op for drivers implementing the
callback so the devlink core keeps rejecting unsupported flash requests before fetching the firmware file

v3: no changes
v2: align continuation lines with the open parenthesis

 include/net/dsa.h |  3 +++
 net/dsa/devlink.c | 50 +++++++++++++++++++++++++++++++++++------------
 2 files changed, 41 insertions(+), 12 deletions(-)

index 8c16ef23cc10..c9e19348de61 100644
@@ -1170,6 +1170,9 @@ struct dsa_switch_ops {
 	int	(*devlink_info_get)(struct dsa_switch *ds,
 				    struct devlink_info_req *req,
 				    struct netlink_ext_ack *extack);
+	int	(*devlink_flash_update)(struct dsa_switch *ds,
+					struct devlink_flash_update_params *params,
+					struct netlink_ext_ack *extack);
 	int	(*devlink_sb_pool_get)(struct dsa_switch *ds,
 				       unsigned int sb_index, u16 pool_index,
 				       struct devlink_sb_pool_info *pool_info);

2.55.0

Add mxl862xx_smdio_read() and mxl862xx_smdio_write() for clause-22 SMDIO register access. MCUboot rescue mode only exposes clause-22 registers; the existing clause-45 MMD interface is unavailable during firmware transfer. The MDIO bus lock is held per-transaction (not across polls) so that SB PDI polling during flash erase does not starve other non-switch users of the same MDIO bus, such as separate PHYs providing WAN or management interfaces.

Unlike mxl862xx_api_wrap(), which takes the bus lock with MDIO_MUTEX_NESTED because it can be entered from the accessors of the switch-internal MDIO bus while that bus's lock of the same lock class is already held, the SMDIO helpers take it with a plain mutex_lock(). They are only called from probe and devlink flash contexts where no other MDIO bus lock can be held.

---
v4: no changes

v3: explain the plain mutex_lock() vs MDIO_MUTEX_NESTED choice in
the commit message

v2: clarify in the commit message that the per-transaction bus
locking is about unrelated non-switch devices on the same MDIO bus (Andrew Lunn)

 drivers/net/dsa/mxl862xx/mxl862xx-host.c | 35 ++++++++++++++++++++++++
 drivers/net/dsa/mxl862xx/mxl862xx-host.h |  2 ++
 2 files changed, 37 insertions(+)

index 4acd216f7cc0..6e582caea1fa 100644
@@ -495,6 +495,41 @@ int mxl862xx_reset(struct mxl862xx_priv *priv)
 	return ret;
 }
 
+#define MXL862XX_SMDIO_ADDR_REG		0x1f
+#define MXL862XX_SMDIO_PAGE_MASK	0xfff0
+#define MXL862XX_SMDIO_OFF_MASK		0x000f
+
+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr)
+{
+	struct mii_bus *bus = priv->mdiodev->bus;
+	int phy = priv->mdiodev->addr;
+	int ret;
+
+	mutex_lock(&bus->mdio_lock);
+	ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,
+			      addr & MXL862XX_SMDIO_PAGE_MASK);
+	if (ret >= 0)
+		ret = __mdiobus_read(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK);
+	mutex_unlock(&bus->mdio_lock);
+	return ret;
+}
+
+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val)
+{
+	struct mii_bus *bus = priv->mdiodev->bus;
+	int phy = priv->mdiodev->addr;
+	int ret;
+
+	mutex_lock(&bus->mdio_lock);
+	ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,
+			      addr & MXL862XX_SMDIO_PAGE_MASK);
+	if (ret >= 0)
+		ret = __mdiobus_write(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK,
+				      val);
+	mutex_unlock(&bus->mdio_lock);
+	return ret;
+}
+
 void mxl862xx_host_init(struct mxl862xx_priv *priv)
 {
 	INIT_WORK(&priv->crc_err_work, mxl862xx_crc_err_work_fn);

index 66d6ae198aff..4e054c6e4c0e 100644
@@ -18,5 +18,7 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *data, u16 size,
 	mxl862xx_api_wrap(dev, cmd, &(data), sizeof((data)), true, true)
 
 int mxl862xx_reset(struct mxl862xx_priv *priv);
+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr);
+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val);
 
 #endif /* __MXL862XX_HOST_H */

2.55.0

Implement runtime firmware upgrade via "devlink dev flash" and version reporting via "devlink dev info":

devlink dev info mdio_bus/<bus>/<addr>
devlink dev flash mdio_bus/<bus>/<addr> file <firmware.bin>

The "asic.id" fixed version reports a per-model chip name taken from the OF match data, e.g. "MaxLinear MxL86252", following the mv88e6xxx example. Userspace such as fwupd should build firmware matching identifiers from this value.

The firmware image is validated first, including both payload CRCs, so a malformed file is rejected without disturbing the running switch. The driver then sends SYS_MISC_FW_UPDATE to enter MCUboot rescue mode and transfers the signed image over the SB PDI bulk-transfer protocol (clause-22 SMDIO). Every SMDIO write during the transfer is checked; in particular a failed address write during the half-bank switch would otherwise place the second half of the payload at the wrong flash offset without any status poll noticing. Once the transfer has finished and the switch has rebooted, the driver launches device_reprobe() for a clean remove()+probe() cycle.

Before the transfer begins the driver closes all user and conduit interfaces and additionally marks the user ports not-present via netif_device_detach() so that userspace cannot bring them back up during the flash and reprobe cycle, which takes just under a minute. The conduit belongs to the MAC driver and is only closed. Closing the ports also stops phylib from polling the switch-internal PHYs, whose firmware-relayed MDIO access is unavailable while the switch is in MCUboot mode. The bridge defers the STP state changes triggered by closing its ports, so the driver flushes the switchdev deferred queue while still holding the rtnl lock; the DISABLED transitions thus reach the firmware while it is still running instead of failing against the host block later. Progress is reported through devlink status notifications.

While the update runs, firmware API commands from any other path are rejected. The blocking flags are read and written under the MDIO bus lock so that a command which had already passed the check cannot reach the bus once the switch has rebooted into MCUboot. The block is never lifted again; SYS_MISC_FW_VERSION is exempt from it so the new firmware version can be queried after a successful transfer, and the version query is only issued from the flash path itself. The periodic stats poll and the CRC error handler are stopped before the transfer starts.

After the transfer, API read commands fail with -ENODEV while write commands return fake success: the scheduled reprobe tears the driver down through remove(), whose teardown writes must not stall on the absent firmware, but read paths such as an FDB dump must not consume buffers the firmware never filled -- port_fdb_dump() would loop forever on such fabricated data. port_mdb_del() maps -ENODEV from its lookup to successful deletion: the firmware holding the entry is gone, and reporting failure would only make the DSA core keep the software entry and report leftover host MDB addresses when the tree is torn down for the reprobe.

Once the FW_UPDATE command has been sent the switch is in MCUboot mode and normal operation can only be restored by a reprobe, so the reprobe kernel thread and the module and device references it holds are set up before the switch is disturbed and the thread is woken regardless of transfer outcome.

The reprobe runs in a kernel thread rather than a work item because device_reprobe() triggers remove() which frees the devm-managed priv, and a work item's final module_put() would still execute module code afterwards, racing against module unload. The thread instead exits through module_put_and_kthread_exit(), which drops the reference from core-kernel code without returning to module text.

---
v4:
- run the deferred reprobe from a kernel thread ending in module_put_and_kthread_exit() instead of a work item whose final module_put() raced against module unload
- fail API read commands with -ENODEV after the update instead of faking success with an unfilled buffer, which sent port_fdb_dump() into an endless loop
- keep block_host set across the post-update version query by exempting SYS_MISC_FW_VERSION instead of briefly lifting the block, and write the blocking flags under the MDIO bus lock
- check the return value of every SB PDI control write; a failed address write during the half-bank switch could place the second half of the payload at the wrong flash offset undetected
- report SMDIO write failures through one shared error path instead of per-site messages
- initialise the progress notification deadline from jiffies so notifications are not suppressed on 32-bit shortly after boot
- flush the switchdev deferred queue after closing the ports so the bridge's deferred STP DISABLED transitions reach the firmware while it is still running instead of failing with -EBUSY against the host block
- treat -ENODEV as successful deletion in port_mdb_del() so the post-update teardown does not leave leftover host MDB entries behind for the DSA core to report

v3:
- validate the image, including both CRCs, before closing any ports so a malformed file no longer triggers a flash and reprobe cycle
- reject images whose declared payload sizes overflow when summed (check_add_overflow) or sum up to zero; the latter used to erase the flash without writing anything back
- allocate the reprobe work item and take the module and device references before disturbing the switch instead of silently skipping the reprobe when the allocation fails afterwards
- check block_host/skip_teardown under the MDIO bus lock to close the window where a command already past the check could reach the bus after the switch rebooted into MCUboot
- prevent the stats poll work from being re-armed and cancel the CRC error work before the transfer
- check the return value of SB PDI data word writes; control writes are verified by the subsequent status polls
- report a per-model chip name from the OF match data as "asic.id" instead of the devicetree compatible string whose comma is awkward for userspace consumers (Andrew Lunn)
- commit message: the conduit is only closed, not detached

v2:
- factor out SB PDI slice flush and devlink status notification helpers, resolving checkpatch issues
- use kzalloc_obj() (Manuel Ebner)
- add kernel-doc for the new mxl862xx_priv members
- trim comments and state the actual duration of a flash and reprobe cycle, just under a minute (Manuel Ebner)
- reword commit message: split up run-on sentence, explain the dynamically allocated reprobe work item (Manuel Ebner), mention that closing the ports stops phylib polling (Andrew Lunn)

 drivers/net/dsa/mxl862xx/Makefile        |   2 +-
 drivers/net/dsa/mxl862xx/mxl862xx-cmd.h  |   1 +
 drivers/net/dsa/mxl862xx/mxl862xx-fw.c   | 497 +++++++++++++++++++++++
 drivers/net/dsa/mxl862xx/mxl862xx-fw.h   |  15 +
 drivers/net/dsa/mxl862xx/mxl862xx-host.c |  12 +
 drivers/net/dsa/mxl862xx/mxl862xx.c      |  12 +-
 drivers/net/dsa/mxl862xx/mxl862xx.h      |   6 +
 7 files changed, 542 insertions(+), 3 deletions(-)
 create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.c
 create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.h

index a7be0e6669df..bccac0d0f703 100644
@@ -1,3 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o
-mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o
+mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o

index c87a955c13c4..e2aa2934e9e1 100644
@@ -70,6 +70,7 @@
 #define INT_GPHY_READ			(GPY_GPY2XX_MAGIC + 0x1)
 #define INT_GPHY_WRITE			(GPY_GPY2XX_MAGIC + 0x2)
 
+#define SYS_MISC_FW_UPDATE		(SYS_MISC_MAGIC + 0x1)
 #define SYS_MISC_FW_VERSION		(SYS_MISC_MAGIC + 0x2)
 
 #define MXL862XX_XPCS_PCS_CONFIG	(MXL862XX_XPCS_MAGIC + 0x1)

new file mode 100644
index 000000000000..a1b60fbacebf
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef __MXL862XX_FW_H
+#define __MXL862XX_FW_H
+
+#include <net/dsa.h>
+
+int mxl862xx_devlink_info_get(struct dsa_switch *ds,
+			      struct devlink_info_req *req,
+			      struct netlink_ext_ack *extack);
+int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
+				  struct devlink_flash_update_params *params,
+				  struct netlink_ext_ack *extack);
+
+#endif /* __MXL862XX_FW_H */

index 6e582caea1fa..2b69eac24b31 100644
@@ -15,6 +15,7 @@
 #include <linux/unaligned.h>
 #include <net/dsa.h>
 #include "mxl862xx.h"
+#include "mxl862xx-cmd.h"
 #include "mxl862xx-host.h"
 
 #define CTRL_BUSY_MASK			BIT(15)

@@ -340,6 +341,17 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *_data,
 
 	mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED);
 
+	if (priv->skip_teardown) {
+		ret = read ? -ENODEV : 0;
+		goto out;
+	}
+
+	if (priv->block_host && cmd != SYS_MISC_FW_UPDATE &&
+	    cmd != SYS_MISC_FW_VERSION) {
+		ret = -EBUSY;
+		goto out;
+	}
+
 	max = (size + 1) / 2;
 
 	ret = mxl862xx_busy_wait(priv);

index 45d237b3a40f..bf0f2264a931 100644
@@ -21,6 +21,7 @@
 #include "mxl862xx.h"
 #include "mxl862xx-api.h"
 #include "mxl862xx-cmd.h"
+#include "mxl862xx-fw.h"
 #include "mxl862xx-host.h"
 #include "mxl862xx-phylink.h"
 

@@ -1572,6 +1573,11 @@ static int mxl862xx_port_mdb_del(struct dsa_switch *ds, int port,
 	ether_addr_copy(qparam.mac, mdb->addr);
 
 	ret = MXL862XX_API_READ(priv, MXL862XX_MAC_TABLEENTRYQUERY, qparam);
+	/* -ENODEV: the firmware and its MAC table are gone, nothing left
+	 * to delete
+	 */
+	if (ret == -ENODEV)
+		return 0;
 	if (ret)
 		return ret;
 

@@ -2086,6 +2092,8 @@ static const struct dsa_switch_ops mxl862xx_switch_ops = {
 	.get_pause_stats = mxl862xx_get_pause_stats,
 	.get_rmon_stats = mxl862xx_get_rmon_stats,
 	.get_stats64 = mxl862xx_get_stats64,
+	.devlink_info_get = mxl862xx_devlink_info_get,
+	.devlink_flash_update = mxl862xx_devlink_flash_update,
 };
 
 static int mxl862xx_probe(struct mdio_device *mdiodev)

@@ -2191,8 +2199,8 @@ static void mxl862xx_shutdown(struct mdio_device *mdiodev)
 }
 
 static const struct of_device_id mxl862xx_of_match[] = {
-	{ .compatible = "maxlinear,mxl86282" },
-	{ .compatible = "maxlinear,mxl86252" },
+	{ .compatible = "maxlinear,mxl86282", .data = "MaxLinear MxL86282" },
+	{ .compatible = "maxlinear,mxl86252", .data = "MaxLinear MxL86252" },
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, mxl862xx_of_match);

index 432a5f3f2e08..64d91ad51936 100644
@@ -319,6 +319,10 @@ struct mxl862xx_fw_version {
  * @evlan_ingress_size: per-port ingress Extended VLAN block size
  * @evlan_egress_size:  per-port egress Extended VLAN block size
  * @vf_block_size:      per-port VLAN Filter block size
+ * @block_host:         reject firmware API commands (except FW_UPDATE)
+ *                      during a firmware flash
+ * @skip_teardown:      discard firmware API commands during the teardown
+ *                      triggered by the post-flash reprobe
  * @stats_work:         periodic work item that polls RMON hardware counters
  *                      and accumulates them into 64-bit per-port stats
  */

@@ -337,6 +341,8 @@ struct mxl862xx_priv {
 	u16 evlan_ingress_size;
 	u16 evlan_egress_size;
 	u16 vf_block_size;
+	bool block_host;
+	bool skip_teardown;
 	struct delayed_work stats_work;
 };
 

2.55.0

When the application firmware image is broken (e.g. after an interrupted flash update) or the sticky rescue flag is set, the switch stays in MCUboot which only exposes the clause-22 SMDIO interface used for firmware download. The clause-45 MMD API never becomes ready, probe fails with -ETIMEDOUT and the user is left without any way to install a working firmware image other than physical access to the UART console of the switch.

Detect this state during setup by reading the SB PDI STAT register via SMDIO: MCUboot signals readiness for a firmware download with the ready magic. Probe this register first to avoid pointlessly waiting for the MMD API on a switch sitting in rescue mode, and probe it again after a ready timeout to catch firmware which was still alive enough to accept the reset command but then fell into rescue mode due to a broken image on flash. An SMDIO bus error during detection logs its own diagnostic, distinct from the MMD ready timeout on a live bus, and counts as not in rescue mode.

In rescue mode, complete the switch registration without any user interfaces so that devlink is available: user ports fail port_setup with -ENODEV which makes the DSA core re-register them as unused ports, while shared and unused ports succeed as their setup must not fail for the tree to register. The CPU port works without firmware access since it uses a fixed link and the phylink MAC ops do not touch the hardware; mac_select_pcs returns no PCS in rescue mode. Firmware API commands fail fast with -ENODEV instead of running into the MDIO poll timeout, and the port enable/disable and STP callbacks invoked by the DSA core during registration and teardown become no-ops.

devlink dev info reports the running firmware version as the canonical null version "0.0.0" in rescue mode. An operational switch can never report this version since the major version of any released firmware is non-zero. Version-comparing update tools like fwupd thus treat every available release as an upgrade and offer to install it, so the switch can be recovered through the regular update flow. devlink flash update skips the FW_UPDATE command in rescue mode as MCUboot is already waiting for a download, and proceeds directly with the SB PDI handshake. After a successful transfer the usual reprobe cycle restores normal operation; after a failed one rescue mode is detected again and the user can simply retry.

---
v4:
- log a distinct diagnostic when rescue mode detection fails on an SMDIO bus error instead of silently treating it as "not in rescue mode"
- clear the rescue_mode flag under the MDIO bus lock, following the flag write locking in the previous patch

v3:
- report the canonical null version "0.0.0" instead of "mcuboot-rescue" so that version-comparing update tools like fwupd offer any available release as an upgrade for recovery
- check the rescue_mode flag under the MDIO bus lock, following the block_host/skip_teardown change in the previous patch

v2: new patch, allowing recovery from a failed or interrupted update
without having to use a special recovery OS image (Andrew Lunn)

 drivers/net/dsa/mxl862xx/mxl862xx-fw.c      | 58 +++++++++++++++++----
 drivers/net/dsa/mxl862xx/mxl862xx-fw.h      |  3 ++
 drivers/net/dsa/mxl862xx/mxl862xx-host.c    |  5 ++
 drivers/net/dsa/mxl862xx/mxl862xx-phylink.c |  2 +
 drivers/net/dsa/mxl862xx/mxl862xx.c         | 38 ++++++++++++--
 drivers/net/dsa/mxl862xx/mxl862xx.h         |  3 ++
 6 files changed, 96 insertions(+), 13 deletions(-)

index 4cd8231c7eca..a3f941580852 100644
@@ -111,6 +111,29 @@ static void mxl862xx_flash_notify(struct devlink *dl, const char *status,
 	devlink_flash_update_status_notify(dl, status, NULL, done, total);
 }
 
+/**
+ * mxl862xx_rescue_mode_detect - check whether the switch sits in MCUboot
+ * @priv: driver private data
+ *
+ * MCUboot signals readiness for a firmware download with the SB PDI
+ * ready magic; only the clause-22 SMDIO interface works in this state.
+ *
+ * Return: true if MCUboot is waiting for a firmware download.
+ */
+bool mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv)
+{
+	int ret;
+
+	ret = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);
+	if (ret < 0) {
+		dev_err(&priv->mdiodev->dev,
+			"rescue mode detection failed: %pe\n", ERR_PTR(ret));
+		return false;
+	}
+
+	return ret == MXL862XX_SB_PDI_READY;
+}
+
 /* device_reprobe() -> remove() frees priv while the thread runs, so
  * the thread must not dereference priv; it drops its module reference
  * without returning to module code afterwards.

@@ -201,13 +224,15 @@ static int mxl862xx_flash_firmware(struct mxl862xx_priv *priv,
 	int ret, i;
 
 	/* Step 1: reboot the firmware into MCUboot rescue mode */
-	ret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,
-				false, false);
-	if (ret) {
-		dev_err(&priv->mdiodev->dev,
-			"flash: FW_UPDATE command failed: %pe\n",
-			ERR_PTR(ret));
-		return ret;
+	if (!priv->rescue_mode) {
+		ret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,
+					false, false);
+		if (ret) {
+			dev_err(&priv->mdiodev->dev,
+				"flash: FW_UPDATE command failed: %pe\n",
+				ERR_PTR(ret));
+			return ret;
+		}
 	}
 
 	/* Failures from here on must go through end_magic so MCUboot

@@ -391,6 +416,10 @@ int mxl862xx_devlink_info_get(struct dsa_switch *ds,
 			return ret;
 	}
 
+	/* canonical null version: no operational firmware on the switch */
+	if (priv->rescue_mode)
+		return devlink_info_version_running_put(req, "fw", "0.0.0");
+
 	snprintf(ver_str, sizeof(ver_str), "%u.%u.%u",
 		 priv->fw_version.major, priv->fw_version.minor,
 		 priv->fw_version.revision);

@@ -436,9 +465,13 @@ int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
 
 	get_device(ds->dev);
 
-	dev_info(ds->dev, "flash: running firmware %u.%u.%u\n",
-		 priv->fw_version.major, priv->fw_version.minor,
-		 priv->fw_version.revision);
+	if (priv->rescue_mode)
+		dev_info(ds->dev,
+			 "flash: recovering switch from MCUboot rescue mode\n");
+	else
+		dev_info(ds->dev, "flash: running firmware %u.%u.%u\n",
+			 priv->fw_version.major, priv->fw_version.minor,
+			 priv->fw_version.revision);
 
 	/* Close ports while the firmware is still alive so the DSA
 	 * core's MDB/FDB tracking is drained, and detach user ports

@@ -476,6 +509,11 @@ int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
 		NL_SET_ERR_MSG_MOD(extack, "firmware transfer failed");
 
 	if (!ret) {
+		mutex_lock_nested(&priv->mdiodev->bus->mdio_lock,
+				  MDIO_MUTEX_NESTED);
+		priv->rescue_mode = false;
+		mutex_unlock(&priv->mdiodev->bus->mdio_lock);
+
 		/* SYS_MISC_FW_VERSION is exempt from block_host, so the
 		 * new version can be queried with the block still up.
 		 */

index a1b60fbacebf..57c2000cfee5 100644
@@ -5,6 +5,9 @@
 
 #include <net/dsa.h>
 
+struct mxl862xx_priv;
+
+bool mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv);
 int mxl862xx_devlink_info_get(struct dsa_switch *ds,
 			      struct devlink_info_req *req,
 			      struct netlink_ext_ack *extack);

index 2b69eac24b31..4c61820f05ee 100644
@@ -346,6 +346,11 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *_data,
 		goto out;
 	}
 
+	if (priv->rescue_mode) {
+		ret = -ENODEV;
+		goto out;
+	}
+
 	if (priv->block_host && cmd != SYS_MISC_FW_UPDATE &&
 	    cmd != SYS_MISC_FW_VERSION) {
 		ret = -EBUSY;

index b689652aa9b9..a5b6940b552e 100644
@@ -406,6 +406,8 @@ mxl862xx_phylink_mac_select_pcs(struct phylink_config *config,
 
 	switch (port) {
 	case 9 ... 16:
+		if (priv->rescue_mode)
+			return NULL;
 		if (!MXL862XX_FW_VER_MIN(priv, 1, 0, 84)) {
 			dev_warn_once(dp->ds->dev,
 				      "SerDes PCS unsupported on old firmware.\n");

index bf0f2264a931..7a2ea580e6f0 100644
@@ -629,9 +629,22 @@ static int mxl862xx_setup(struct dsa_switch *ds)
 	if (ret)
 		return ret;
 
-	ret = mxl862xx_wait_ready(ds);
-	if (ret)
-		return ret;
+	priv->rescue_mode = mxl862xx_rescue_mode_detect(priv);
+	if (!priv->rescue_mode) {
+		ret = mxl862xx_wait_ready(ds);
+		if (ret) {
+			/* the reset may only now have triggered rescue mode */
+			priv->rescue_mode = mxl862xx_rescue_mode_detect(priv);
+			if (!priv->rescue_mode)
+				return ret;
+		}
+	}
+
+	if (priv->rescue_mode) {
+		dev_warn(ds->dev,
+			 "switch stuck in MCUboot rescue mode, use devlink to flash new firmware\n");
+		return 0;
+	}
 
 	mutex_init(&priv->serdes_lock);
 	for (i = 0; i < ARRAY_SIZE(priv->serdes_ports); i++)

@@ -716,11 +729,21 @@ static int mxl862xx_port_state(struct dsa_switch *ds, int port, bool enable)
 static int mxl862xx_port_enable(struct dsa_switch *ds, int port,
 				struct phy_device *phydev)
 {
+	struct mxl862xx_priv *priv = ds->priv;
+
+	if (priv->rescue_mode)
+		return 0;
+
 	return mxl862xx_port_state(ds, port, true);
 }
 
 static void mxl862xx_port_disable(struct dsa_switch *ds, int port)
 {
+	struct mxl862xx_priv *priv = ds->priv;
+
+	if (priv->rescue_mode)
+		return;
+
 	if (mxl862xx_port_state(ds, port, false))
 		dev_err(ds->dev, "failed to disable port %d\n", port);
 }

@@ -1338,6 +1361,12 @@ static int mxl862xx_port_setup(struct dsa_switch *ds, int port)
 	bool is_cpu_port = dsa_port_is_cpu(dp);
 	int ret;
 
+	/* DSA reinits failed user ports as unused; shared ports must
+	 * succeed for the tree to register.
+	 */
+	if (priv->rescue_mode)
+		return dsa_port_is_user(dp) ? -ENODEV : 0;
+
 	ret = mxl862xx_port_state(ds, port, false);
 	if (ret)
 		return ret;

@@ -1634,6 +1663,9 @@ static void mxl862xx_port_stp_state_set(struct dsa_switch *ds, int port,
 	struct mxl862xx_priv *priv = ds->priv;
 	int ret;
 
+	if (priv->rescue_mode)
+		return;
+
 	switch (state) {
 	case BR_STATE_DISABLED:
 		param.port_state = cpu_to_le32(MXL862XX_STP_PORT_STATE_DISABLE);

index 64d91ad51936..5d21296561e3 100644
@@ -323,6 +323,8 @@ struct mxl862xx_fw_version {
  *                      during a firmware flash
  * @skip_teardown:      discard firmware API commands during the teardown
  *                      triggered by the post-flash reprobe
+ * @rescue_mode:        switch is stuck in MCUboot; firmware API commands
+ *                      fail fast, only clause-22 SMDIO works
  * @stats_work:         periodic work item that polls RMON hardware counters
  *                      and accumulates them into 64-bit per-port stats
  */

@@ -343,6 +345,7 @@ struct mxl862xx_priv {
 	u16 vf_block_size;
 	bool block_host;
 	bool skip_teardown;
+	bool rescue_mode;
 	struct delayed_work stats_work;
 };
 

2.55.0

You have to create a documentation file under Documentation/networking/devlink/ for the driver. Commit messages must contain example outputs for info.

pw-bot: cr