Contact:       thunderbolt-software@lists.01.org
 Description:   When new NVM image is written to the non-active NVM
                area (through non_activeX NVMem device), the
-               authentication procedure is started by writing 1 to
-               this file. If everything goes well, the device is
+               authentication procedure is started by writing to
+               this file.
+               If everything goes well, the device is
                restarted with the new NVM firmware. If the image
                verification fails an error code is returned instead.
 
+               This file will accept writing values "1" or "2"
+               - Writing "1" will flush the image to the storage
+               area and authenticate the image in one action.
+               - Writing "2" will run some basic validation on the image
+               and flush it to the storage area.
+
                When read holds status of the last authentication
                operation if an error occurred during the process. This
                is directly the status value from the DMA configuration
 
        u32 status;
 };
 
+enum nvm_write_ops {
+       WRITE_AND_AUTHENTICATE = 1,
+       WRITE_ONLY = 2,
+};
+
 /*
  * Hold NVM authentication failure status per switch This information
  * needs to stay around even when the switch gets power cycled so we
        }
 
        if (tb_switch_is_usb4(sw))
-               return usb4_switch_nvm_write(sw, 0, buf, image_size);
-       return dma_port_flash_write(sw->dma_port, 0, buf, image_size);
+               ret = usb4_switch_nvm_write(sw, 0, buf, image_size);
+       else
+               ret = dma_port_flash_write(sw->dma_port, 0, buf, image_size);
+       if (!ret)
+               sw->nvm->flushed = true;
+       return ret;
 }
 
 static int nvm_authenticate_host_dma_port(struct tb_switch *sw)
        struct device_attribute *attr, const char *buf, size_t count)
 {
        struct tb_switch *sw = tb_to_switch(dev);
-       bool val;
+       int val;
        int ret;
 
        pm_runtime_get_sync(&sw->dev);
                goto exit_unlock;
        }
 
-       ret = kstrtobool(buf, &val);
+       ret = kstrtoint(buf, 10, &val);
        if (ret)
                goto exit_unlock;
 
        /* Always clear the authentication status */
        nvm_clear_auth_status(sw);
 
-       if (val) {
-               if (!sw->nvm->buf) {
-                       ret = -EINVAL;
-                       goto exit_unlock;
-               }
-
-               ret = nvm_validate_and_write(sw);
-               if (ret)
-                       goto exit_unlock;
+       if (val > 0) {
+               if (!sw->nvm->flushed) {
+                       if (!sw->nvm->buf) {
+                               ret = -EINVAL;
+                               goto exit_unlock;
+                       }
 
-               sw->nvm->authenticating = true;
-               ret = nvm_authenticate(sw);
+                       ret = nvm_validate_and_write(sw);
+                       if (ret || val == WRITE_ONLY)
+                               goto exit_unlock;
+               }
+               if (val == WRITE_AND_AUTHENTICATE) {
+                       sw->nvm->authenticating = true;
+                       ret = nvm_authenticate(sw);
+               }
        }
 
 exit_unlock: