| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/25 20:37 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies the Broadcom ThorUltra (bnge) Ethernet driver. This is a vendor-specific driver for physical PCIe hardware cards (50/100/200/400/800 Gbps NICs) that are not emulated in standard QEMU or virtualized environments. Therefore, the modified code paths cannot be reached or tested by the fuzzer.",
"WorthFuzzing": false
} |
| 1/1 | 2026/07/25 20:37 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 72bbde07f872a7b3392deabba8da88e4551b698a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sat Jul 25 20:37:51 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_core.c b/drivers/net/ethernet/broadcom/bnge/bnge_core.c\nindex 68b74eb2c3a29a..9846d29b4fe3c0 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_core.c\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_core.c\n@@ -5,12 +5,14 @@\n #include \u003clinux/crash_dump.h\u003e\n #include \u003clinux/module.h\u003e\n #include \u003clinux/pci.h\u003e\n+#include \u003clinux/rtnetlink.h\u003e\n \n #include \"bnge.h\"\n #include \"bnge_devlink.h\"\n #include \"bnge_hwrm.h\"\n #include \"bnge_hwrm_lib.h\"\n #include \"bnge_link.h\"\n+#include \"bnge_resc.h\"\n \n MODULE_LICENSE(\"GPL\");\n MODULE_DESCRIPTION(DRV_SUMMARY);\n@@ -406,12 +408,34 @@ static void bnge_remove_one(struct pci_dev *pdev)\n \n static void bnge_shutdown(struct pci_dev *pdev)\n {\n+\tstruct bnge_dev *bd = pci_get_drvdata(pdev);\n+\tstruct net_device *dev;\n+\n+\tdev = bd ? bd-\u003enetdev : NULL;\n+\tif (!dev)\n+\t\treturn;\n+\n+\trtnl_lock();\n+\tnetdev_lock(dev);\n+\n+\tif (netif_running(dev))\n+\t\tnetif_close(dev);\n+\n+\tif (bnge_hwrm_func_drv_unrgtr(bd)) {\n+\t\tpcie_flr(pdev);\n+\t\tgoto shutdown_exit;\n+\t}\n+\tbnge_free_irqs(bd);\n \tpci_disable_device(pdev);\n \n \tif (system_state == SYSTEM_POWER_OFF) {\n \t\tpci_wake_from_d3(pdev, 0);\n \t\tpci_set_power_state(pdev, PCI_D3hot);\n \t}\n+\n+shutdown_exit:\n+\tnetdev_unlock(dev);\n+\trtnl_unlock();\n }\n \n static struct pci_driver bnge_driver = {\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c\nindex 6f7ef506d4e18c..220bdcced0db95 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c\n@@ -20,6 +20,7 @@\n #include \u003cnet/page_pool/helpers.h\u003e\n \n #include \"bnge.h\"\n+#include \"bnge_hwrm.h\"\n #include \"bnge_hwrm_lib.h\"\n #include \"bnge_ethtool.h\"\n #include \"bnge_rmem.h\"\n@@ -2144,16 +2145,16 @@ static int bnge_hwrm_set_vnic_filter(struct bnge_net *bn, u16 vnic_id, u16 idx,\n \treturn rc;\n }\n \n-static bool bnge_mc_list_updated(struct bnge_net *bn, u32 *rx_mask)\n+static bool bnge_mc_list_updated(struct bnge_net *bn, u32 *rx_mask,\n+\t\t\t\t const struct netdev_hw_addr_list *mc)\n {\n \tstruct bnge_vnic_info *vnic = \u0026bn-\u003evnic_info[BNGE_VNIC_DEFAULT];\n-\tstruct net_device *dev = bn-\u003enetdev;\n \tstruct netdev_hw_addr *ha;\n \tint mc_count = 0, off = 0;\n \tbool update = false;\n \tu8 *haddr;\n \n-\tnetdev_for_each_mc_addr(ha, dev) {\n+\tnetdev_hw_addr_list_for_each(ha, mc) {\n \t\tif (mc_count \u003e= BNGE_MAX_MC_ADDRS) {\n \t\t\t*rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;\n \t\t\tvnic-\u003emc_list_count = 0;\n@@ -2177,17 +2178,17 @@ static bool bnge_mc_list_updated(struct bnge_net *bn, u32 *rx_mask)\n \treturn update;\n }\n \n-static bool bnge_uc_list_updated(struct bnge_net *bn)\n+static bool bnge_uc_list_updated(struct bnge_net *bn,\n+\t\t\t\t const struct netdev_hw_addr_list *uc)\n {\n \tstruct bnge_vnic_info *vnic = \u0026bn-\u003evnic_info[BNGE_VNIC_DEFAULT];\n-\tstruct net_device *dev = bn-\u003enetdev;\n \tstruct netdev_hw_addr *ha;\n \tint off = 0;\n \n-\tif (netdev_uc_count(dev) != (vnic-\u003euc_filter_count - 1))\n+\tif (netdev_hw_addr_list_count(uc) != (vnic-\u003euc_filter_count - 1))\n \t\treturn true;\n \n-\tnetdev_for_each_uc_addr(ha, dev) {\n+\tnetdev_hw_addr_list_for_each(ha, uc) {\n \t\tif (!ether_addr_equal(ha-\u003eaddr, vnic-\u003euc_list + off))\n \t\t\treturn true;\n \n@@ -2201,18 +2202,14 @@ static bool bnge_promisc_ok(struct bnge_net *bn)\n \treturn true;\n }\n \n-static int bnge_cfg_def_vnic(struct bnge_net *bn)\n+static int bnge_cfg_rx_mode(struct bnge_net *bn, struct netdev_hw_addr_list *uc,\n+\t\t\t bool uc_update, bool snapshot)\n {\n \tstruct bnge_vnic_info *vnic = \u0026bn-\u003evnic_info[BNGE_VNIC_DEFAULT];\n \tstruct net_device *dev = bn-\u003enetdev;\n \tstruct bnge_dev *bd = bn-\u003ebd;\n \tstruct netdev_hw_addr *ha;\n \tint i, off = 0, rc;\n-\tbool uc_update;\n-\n-\tnetif_addr_lock_bh(dev);\n-\tuc_update = bnge_uc_list_updated(bn);\n-\tnetif_addr_unlock_bh(dev);\n \n \tif (!uc_update)\n \t\tgoto skip_uc;\n@@ -2226,22 +2223,28 @@ static int bnge_cfg_def_vnic(struct bnge_net *bn)\n \n \tvnic-\u003euc_filter_count = 1;\n \n-\tnetif_addr_lock_bh(dev);\n-\tif (netdev_uc_count(dev) \u003e (BNGE_MAX_UC_ADDRS - 1)) {\n+\tif (!snapshot)\n+\t\tnetif_addr_lock_bh(dev);\n+\tif (netdev_hw_addr_list_count(uc) \u003e (BNGE_MAX_UC_ADDRS - 1)) {\n \t\tvnic-\u003erx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;\n \t} else {\n-\t\tnetdev_for_each_uc_addr(ha, dev) {\n+\t\tnetdev_hw_addr_list_for_each(ha, uc) {\n \t\t\tmemcpy(vnic-\u003euc_list + off, ha-\u003eaddr, ETH_ALEN);\n \t\t\toff += ETH_ALEN;\n \t\t\tvnic-\u003euc_filter_count++;\n \t\t}\n \t}\n-\tnetif_addr_unlock_bh(dev);\n+\tif (!snapshot)\n+\t\tnetif_addr_unlock_bh(dev);\n \n \tfor (i = 1, off = 0; i \u003c vnic-\u003euc_filter_count; i++, off += ETH_ALEN) {\n \t\trc = bnge_hwrm_set_vnic_filter(bn, 0, i, vnic-\u003euc_list + off);\n \t\tif (rc) {\n-\t\t\tnetdev_err(dev, \"HWRM vnic filter failure rc: %d\\n\", rc);\n+\t\t\tif (rc == -EAGAIN)\n+\t\t\t\tnetdev_warn(dev, \"FW busy while setting vnic filter, will retry\\n\");\n+\t\t\telse\n+\t\t\t\tnetdev_err(dev, \"HWRM vnic filter failure rc: %d\\n\",\n+\t\t\t\t\t rc);\n \t\t\tvnic-\u003euc_filter_count = i;\n \t\t\treturn rc;\n \t\t}\n@@ -2267,6 +2270,48 @@ static int bnge_cfg_def_vnic(struct bnge_net *bn)\n \treturn rc;\n }\n \n+static int bnge_set_rx_mode(struct net_device *dev,\n+\t\t\t struct netdev_hw_addr_list *uc,\n+\t\t\t struct netdev_hw_addr_list *mc)\n+{\n+\tstruct bnge_net *bn = netdev_priv(dev);\n+\tstruct bnge_vnic_info *vnic;\n+\tbool mc_update = false;\n+\tbool uc_update;\n+\tu32 mask;\n+\n+\tif (!test_bit(BNGE_STATE_OPEN, \u0026bn-\u003ebd-\u003estate))\n+\t\treturn 0;\n+\n+\tvnic = \u0026bn-\u003evnic_info[BNGE_VNIC_DEFAULT];\n+\tmask = vnic-\u003erx_mask;\n+\tmask \u0026= ~(CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS |\n+\t\t CFA_L2_SET_RX_MASK_REQ_MASK_MCAST |\n+\t\t CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST |\n+\t\t CFA_L2_SET_RX_MASK_REQ_MASK_BCAST);\n+\n+\tif (dev-\u003eflags \u0026 IFF_PROMISC)\n+\t\tmask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;\n+\n+\tuc_update = bnge_uc_list_updated(bn, uc);\n+\n+\tif (dev-\u003eflags \u0026 IFF_BROADCAST)\n+\t\tmask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;\n+\tif (dev-\u003eflags \u0026 IFF_ALLMULTI) {\n+\t\tmask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;\n+\t\tvnic-\u003emc_list_count = 0;\n+\t} else if (dev-\u003eflags \u0026 IFF_MULTICAST) {\n+\t\tmc_update = bnge_mc_list_updated(bn, \u0026mask, mc);\n+\t}\n+\n+\tif (mask != vnic-\u003erx_mask || uc_update || mc_update) {\n+\t\tvnic-\u003erx_mask = mask;\n+\t\treturn bnge_cfg_rx_mode(bn, uc, uc_update, true);\n+\t}\n+\n+\treturn 0;\n+}\n+\n static void bnge_disable_int(struct bnge_net *bn)\n {\n \tstruct bnge_dev *bd = bn-\u003ebd;\n@@ -2695,13 +2740,17 @@ static int bnge_init_chip(struct bnge_net *bn)\n \t} else if (bn-\u003enetdev-\u003eflags \u0026 IFF_MULTICAST) {\n \t\tu32 mask = 0;\n \n-\t\tbnge_mc_list_updated(bn, \u0026mask);\n+\t\tbnge_mc_list_updated(bn, \u0026mask, \u0026bn-\u003enetdev-\u003emc);\n \t\tvnic-\u003erx_mask |= mask;\n \t}\n \n-\trc = bnge_cfg_def_vnic(bn);\n-\tif (rc)\n+\trc = bnge_cfg_rx_mode(bn, \u0026bn-\u003enetdev-\u003euc, true, false);\n+\tif (rc == -EAGAIN) {\n+\t\tnetif_rx_mode_schedule_retry(bn-\u003enetdev);\n+\t\trc = 0;\n+\t} else if (rc) {\n \t\tgoto err_out;\n+\t}\n \treturn 0;\n \n err_out:\n@@ -2813,6 +2862,24 @@ static void bnge_tx_enable(struct bnge_net *bn)\n \t\tnetif_carrier_on(bn-\u003enetdev);\n }\n \n+static int bnge_hwrm_if_change(struct bnge_dev *bd, bool up)\n+{\n+\tstruct hwrm_func_drv_if_change_input *req;\n+\tint rc;\n+\n+\tif (!(bd-\u003efw_cap \u0026 BNGE_FW_CAP_IF_CHANGE))\n+\t\treturn 0;\n+\n+\trc = bnge_hwrm_req_init(bd, req, HWRM_FUNC_DRV_IF_CHANGE);\n+\tif (rc)\n+\t\treturn rc;\n+\n+\tif (up)\n+\t\treq-\u003eflags = cpu_to_le32(FUNC_DRV_IF_CHANGE_REQ_FLAGS_UP);\n+\n+\treturn bnge_hwrm_req_send(bd, req);\n+}\n+\n static int bnge_open_core(struct bnge_net *bn)\n {\n \tstruct bnge_dev *bd = bn-\u003ebd;\n@@ -2820,16 +2887,22 @@ static int bnge_open_core(struct bnge_net *bn)\n \n \tnetif_carrier_off(bn-\u003enetdev);\n \n+\trc = bnge_hwrm_if_change(bd, true);\n+\tif (rc) {\n+\t\tnetdev_err(bn-\u003enetdev, \"bnge_hwrm_if_change err: %d\\n\", rc);\n+\t\treturn rc;\n+\t}\n+\n \trc = bnge_reserve_rings(bd);\n \tif (rc) {\n \t\tnetdev_err(bn-\u003enetdev, \"bnge_reserve_rings err: %d\\n\", rc);\n-\t\treturn rc;\n+\t\tgoto err_if_change;\n \t}\n \n \trc = bnge_alloc_core(bn);\n \tif (rc) {\n \t\tnetdev_err(bn-\u003enetdev, \"bnge_alloc_core err: %d\\n\", rc);\n-\t\treturn rc;\n+\t\tgoto err_if_change;\n \t}\n \n \tbnge_init_napi(bn);\n@@ -2876,6 +2949,8 @@ static int bnge_open_core(struct bnge_net *bn)\n err_del_napi:\n \tbnge_del_napi(bn);\n \tbnge_free_core(bn);\n+err_if_change:\n+\tbnge_hwrm_if_change(bd, false);\n \treturn rc;\n }\n \n@@ -3106,6 +3181,7 @@ static int bnge_close(struct net_device *dev)\n \n \tbnge_close_core(bn);\n \tbnge_hwrm_shutdown_link(bn-\u003ebd);\n+\tbnge_hwrm_if_change(bn-\u003ebd, false);\n \tbn-\u003esp_event = 0;\n \n \treturn 0;\n@@ -3195,6 +3271,7 @@ static const struct net_device_ops bnge_netdev_ops = {\n \t.ndo_stop\t\t= bnge_close,\n \t.ndo_start_xmit\t\t= bnge_start_xmit,\n \t.ndo_get_stats64\t= bnge_get_stats64,\n+\t.ndo_set_rx_mode_async\t= bnge_set_rx_mode,\n \t.ndo_features_check\t= bnge_features_check,\n };\n \ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h\nindex d177919c2e1170..a1a939496ebd3c 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h\n@@ -275,6 +275,8 @@ enum bnge_net_flag {\n \tBNGE_FLAG_PORT_STATS_EXT\t= BIT(1),\n };\n \n+#define BNGE_FW_IF_RETRY\t10\n+\n enum bnge_sp_event {\n \tBNGE_LINK_CHNG_SP_EVENT,\n \tBNGE_LINK_SPEED_CHNG_SP_EVENT,\n"
} |
| 2/1 | 2026/07/25 20:37 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies the Broadcom ThorUltra (bnge) Ethernet driver. This is a vendor-specific driver for physical PCIe hardware cards (50/100/200/400/800 Gbps NICs) that are not emulated in standard QEMU or virtualized environments. Therefore, the modified code paths cannot be reached or tested by the fuzzer.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 72bbde07f872a7b3392deabba8da88e4551b698a
Author: syz-cluster <triage@syzkaller.com>
Date: Sat Jul 25 20:37:51 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_core.c b/drivers/net/ethernet/broadcom/bnge/bnge_core.c
index 68b74eb2c3a29a..9846d29b4fe3c0 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_core.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_core.c
@@ -5,12 +5,14 @@
#include <linux/crash_dump.h>
#include <linux/module.h>
#include <linux/pci.h>
+#include <linux/rtnetlink.h>
#include "bnge.h"
#include "bnge_devlink.h"
#include "bnge_hwrm.h"
#include "bnge_hwrm_lib.h"
#include "bnge_link.h"
+#include "bnge_resc.h"
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION(DRV_SUMMARY);
@@ -406,12 +408,34 @@ static void bnge_remove_one(struct pci_dev *pdev)
static void bnge_shutdown(struct pci_dev *pdev)
{
+ struct bnge_dev *bd = pci_get_drvdata(pdev);
+ struct net_device *dev;
+
+ dev = bd ? bd->netdev : NULL;
+ if (!dev)
+ return;
+
+ rtnl_lock();
+ netdev_lock(dev);
+
+ if (netif_running(dev))
+ netif_close(dev);
+
+ if (bnge_hwrm_func_drv_unrgtr(bd)) {
+ pcie_flr(pdev);
+ goto shutdown_exit;
+ }
+ bnge_free_irqs(bd);
pci_disable_device(pdev);
if (system_state == SYSTEM_POWER_OFF) {
pci_wake_from_d3(pdev, 0);
pci_set_power_state(pdev, PCI_D3hot);
}
+
+shutdown_exit:
+ netdev_unlock(dev);
+ rtnl_unlock();
}
static struct pci_driver bnge_driver = {
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
index 6f7ef506d4e18c..220bdcced0db95 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
@@ -20,6 +20,7 @@
#include <net/page_pool/helpers.h>
#include "bnge.h"
+#include "bnge_hwrm.h"
#include "bnge_hwrm_lib.h"
#include "bnge_ethtool.h"
#include "bnge_rmem.h"
@@ -2144,16 +2145,16 @@ static int bnge_hwrm_set_vnic_filter(struct bnge_net *bn, u16 vnic_id, u16 idx,
return rc;
}
-static bool bnge_mc_list_updated(struct bnge_net *bn, u32 *rx_mask)
+static bool bnge_mc_list_updated(struct bnge_net *bn, u32 *rx_mask,
+ const struct netdev_hw_addr_list *mc)
{
struct bnge_vnic_info *vnic = &bn->vnic_info[BNGE_VNIC_DEFAULT];
- struct net_device *dev = bn->netdev;
struct netdev_hw_addr *ha;
int mc_count = 0, off = 0;
bool update = false;
u8 *haddr;
- netdev_for_each_mc_addr(ha, dev) {
+ netdev_hw_addr_list_for_each(ha, mc) {
if (mc_count >= BNGE_MAX_MC_ADDRS) {
*rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
vnic->mc_list_count = 0;
@@ -2177,17 +2178,17 @@ static bool bnge_mc_list_updated(struct bnge_net *bn, u32 *rx_mask)
return update;
}
-static bool bnge_uc_list_updated(struct bnge_net *bn)
+static bool bnge_uc_list_updated(struct bnge_net *bn,
+ const struct netdev_hw_addr_list *uc)
{
struct bnge_vnic_info *vnic = &bn->vnic_info[BNGE_VNIC_DEFAULT];
- struct net_device *dev = bn->netdev;
struct netdev_hw_addr *ha;
int off = 0;
- if (netdev_uc_count(dev) != (vnic->uc_filter_count - 1))
+ if (netdev_hw_addr_list_count(uc) != (vnic->uc_filter_count - 1))
return true;
- netdev_for_each_uc_addr(ha, dev) {
+ netdev_hw_addr_list_for_each(ha, uc) {
if (!ether_addr_equal(ha->addr, vnic->uc_list + off))
return true;
@@ -2201,18 +2202,14 @@ static bool bnge_promisc_ok(struct bnge_net *bn)
return true;
}
-static int bnge_cfg_def_vnic(struct bnge_net *bn)
+static int bnge_cfg_rx_mode(struct bnge_net *bn, struct netdev_hw_addr_list *uc,
+ bool uc_update, bool snapshot)
{
struct bnge_vnic_info *vnic = &bn->vnic_info[BNGE_VNIC_DEFAULT];
struct net_device *dev = bn->netdev;
struct bnge_dev *bd = bn->bd;
struct netdev_hw_addr *ha;
int i, off = 0, rc;
- bool uc_update;
-
- netif_addr_lock_bh(dev);
- uc_update = bnge_uc_list_updated(bn);
- netif_addr_unlock_bh(dev);
if (!uc_update)
goto skip_uc;
@@ -2226,22 +2223,28 @@ static int bnge_cfg_def_vnic(struct bnge_net *bn)
vnic->uc_filter_count = 1;
- netif_addr_lock_bh(dev);
- if (netdev_uc_count(dev) > (BNGE_MAX_UC_ADDRS - 1)) {
+ if (!snapshot)
+ netif_addr_lock_bh(dev);
+ if (netdev_hw_addr_list_count(uc) > (BNGE_MAX_UC_ADDRS - 1)) {
vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
} else {
- netdev_for_each_uc_addr(ha, dev) {
+ netdev_hw_addr_list_for_each(ha, uc) {
memcpy(vnic->uc_list + off, ha->addr, ETH_ALEN);
off += ETH_ALEN;
vnic->uc_filter_count++;
}
}
- netif_addr_unlock_bh(dev);
+ if (!snapshot)
+ netif_addr_unlock_bh(dev);
for (i = 1, off = 0; i < vnic->uc_filter_count; i++, off += ETH_ALEN) {
rc = bnge_hwrm_set_vnic_filter(bn, 0, i, vnic->uc_list + off);
if (rc) {
- netdev_err(dev, "HWRM vnic filter failure rc: %d\n", rc);
+ if (rc == -EAGAIN)
+ netdev_warn(dev, "FW busy while setting vnic filter, will retry\n");
+ else
+ netdev_err(dev, "HWRM vnic filter failure rc: %d\n",
+ rc);
vnic->uc_filter_count = i;
return rc;
}
@@ -2267,6 +2270,48 @@ static int bnge_cfg_def_vnic(struct bnge_net *bn)
return rc;
}
+static int bnge_set_rx_mode(struct net_device *dev,
+ struct netdev_hw_addr_list *uc,
+ struct netdev_hw_addr_list *mc)
+{
+ struct bnge_net *bn = netdev_priv(dev);
+ struct bnge_vnic_info *vnic;
+ bool mc_update = false;
+ bool uc_update;
+ u32 mask;
+
+ if (!test_bit(BNGE_STATE_OPEN, &bn->bd->state))
+ return 0;
+
+ vnic = &bn->vnic_info[BNGE_VNIC_DEFAULT];
+ mask = vnic->rx_mask;
+ mask &= ~(CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS |
+ CFA_L2_SET_RX_MASK_REQ_MASK_MCAST |
+ CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST |
+ CFA_L2_SET_RX_MASK_REQ_MASK_BCAST);
+
+ if (dev->flags & IFF_PROMISC)
+ mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
+
+ uc_update = bnge_uc_list_updated(bn, uc);
+
+ if (dev->flags & IFF_BROADCAST)
+ mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
+ if (dev->flags & IFF_ALLMULTI) {
+ mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
+ vnic->mc_list_count = 0;
+ } else if (dev->flags & IFF_MULTICAST) {
+ mc_update = bnge_mc_list_updated(bn, &mask, mc);
+ }
+
+ if (mask != vnic->rx_mask || uc_update || mc_update) {
+ vnic->rx_mask = mask;
+ return bnge_cfg_rx_mode(bn, uc, uc_update, true);
+ }
+
+ return 0;
+}
+
static void bnge_disable_int(struct bnge_net *bn)
{
struct bnge_dev *bd = bn->bd;
@@ -2695,13 +2740,17 @@ static int bnge_init_chip(struct bnge_net *bn)
} else if (bn->netdev->flags & IFF_MULTICAST) {
u32 mask = 0;
- bnge_mc_list_updated(bn, &mask);
+ bnge_mc_list_updated(bn, &mask, &bn->netdev->mc);
vnic->rx_mask |= mask;
}
- rc = bnge_cfg_def_vnic(bn);
- if (rc)
+ rc = bnge_cfg_rx_mode(bn, &bn->netdev->uc, true, false);
+ if (rc == -EAGAIN) {
+ netif_rx_mode_schedule_retry(bn->netdev);
+ rc = 0;
+ } else if (rc) {
goto err_out;
+ }
return 0;
err_out:
@@ -2813,6 +2862,24 @@ static void bnge_tx_enable(struct bnge_net *bn)
netif_carrier_on(bn->netdev);
}
+static int bnge_hwrm_if_change(struct bnge_dev *bd, bool up)
+{
+ struct hwrm_func_drv_if_change_input *req;
+ int rc;
+
+ if (!(bd->fw_cap & BNGE_FW_CAP_IF_CHANGE))
+ return 0;
+
+ rc = bnge_hwrm_req_init(bd, req, HWRM_FUNC_DRV_IF_CHANGE);
+ if (rc)
+ return rc;
+
+ if (up)
+ req->flags = cpu_to_le32(FUNC_DRV_IF_CHANGE_REQ_FLAGS_UP);
+
+ return bnge_hwrm_req_send(bd, req);
+}
+
static int bnge_open_core(struct bnge_net *bn)
{
struct bnge_dev *bd = bn->bd;
@@ -2820,16 +2887,22 @@ static int bnge_open_core(struct bnge_net *bn)
netif_carrier_off(bn->netdev);
+ rc = bnge_hwrm_if_change(bd, true);
+ if (rc) {
+ netdev_err(bn->netdev, "bnge_hwrm_if_change err: %d\n", rc);
+ return rc;
+ }
+
rc = bnge_reserve_rings(bd);
if (rc) {
netdev_err(bn->netdev, "bnge_reserve_rings err: %d\n", rc);
- return rc;
+ goto err_if_change;
}
rc = bnge_alloc_core(bn);
if (rc) {
netdev_err(bn->netdev, "bnge_alloc_core err: %d\n", rc);
- return rc;
+ goto err_if_change;
}
bnge_init_napi(bn);
@@ -2876,6 +2949,8 @@ static int bnge_open_core(struct bnge_net *bn)
err_del_napi:
bnge_del_napi(bn);
bnge_free_core(bn);
+err_if_change:
+ bnge_hwrm_if_change(bd, false);
return rc;
}
@@ -3106,6 +3181,7 @@ static int bnge_close(struct net_device *dev)
bnge_close_core(bn);
bnge_hwrm_shutdown_link(bn->bd);
+ bnge_hwrm_if_change(bn->bd, false);
bn->sp_event = 0;
return 0;
@@ -3195,6 +3271,7 @@ static const struct net_device_ops bnge_netdev_ops = {
.ndo_stop = bnge_close,
.ndo_start_xmit = bnge_start_xmit,
.ndo_get_stats64 = bnge_get_stats64,
+ .ndo_set_rx_mode_async = bnge_set_rx_mode,
.ndo_features_check = bnge_features_check,
};
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h
index d177919c2e1170..a1a939496ebd3c 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h
@@ -275,6 +275,8 @@ enum bnge_net_flag {
BNGE_FLAG_PORT_STATS_EXT = BIT(1),
};
+#define BNGE_FW_IF_RETRY 10
+
enum bnge_sp_event {
BNGE_LINK_CHNG_SP_EVENT,
BNGE_LINK_SPEED_CHNG_SP_EVENT,
|
| 3/2 | 2026/07/25 20:37 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6187 output: 18 thoughts: 299 Thoughts: **Analyzing a `bnge` Driver Patch** Okay, so I'm looking at a patch here, and it seems to be targeting the `bnge` driver. Hmm, `bnge`... is that Broadcom NetXtreme-E or something similar? Actually, the name sounds more like Broadcom Next Generation Ethernet. I should probably double-check that this is a *real* driver and not some internal name. I'll need to verify that later. The patch itself is touching `bnge_core.c` and `bnge_netdev.c`, so it seems to be impacting both core functionality and network device interaction, which is typical for a NIC driver. In `bnge_core.c`, the changes to `bnge_shutdown` are interesting. It looks like they're being *very* careful with locking now, taking `rtnl_lock()` and `netdev_lock()` before proceeding. Seems logical for a shutdown procedure. It closes the device if it's running, unregisters the function driver, issues a PCIe FLR (that's good, a clean reset is often helpful), and finally frees up the IRQs. That's a pretty thorough shutdown sequence, which suggests potentially dealing with some tricky hardware issues previously, possibly related to resource management or potential race conditions. Then in `bnge_netdev.c`, there are modifications to multicast and unicast list update functions: `bnge_mc_list_updated` and `bnge_uc_list_updated`. The most significant change is the use of a `const struct netdev_hw_addr_list *` instead of fetching the address list from `bn->netdev`. That's a good change, as it decouples the function from the netdev, making it more flexible and potentially reusable. This is a common pattern for more robust code, in the event of an interruption that would cause a re-evaluation of the data. Also, `bnge_cfg_rx_mode` is replacing `bnge_cfg_def_vnic`, and `bnge_set_rx_mode` is added, now being hooked up to `ndo_set_rx_mode_async`. Nice, that's moving to a more modern approach. Implementing a more optimized and efficient setup should allow for performance increases. Finally, `bnge_hwrm_if_change` is newly added, and it seems to be called in `bnge_open_core` and `bnge_close`. That suggests it's likely responsible for hardware resource management or interface changes based on the device's open/close state. It's likely handling some hardware-specific reconfiguration or maybe even power management-related stuff. Right now, though, I need to confirm whether `bnge` is even a valid driver in the kernel I'm working with. That's the first thing I'll check. If this is some in-house driver, or a custom build, then the entire approach will be different. |
| 4/2 | 2026/07/25 20:38 | tool | grepper |
0mArgs:{
"Expression": "bnge_shutdown"
}Results: {
"Output": "drivers/net/ethernet/broadcom/bnge/bnge_core.c=382=static void bnge_remove_one(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-408-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:409:static void bnge_shutdown(struct pci_dev *pdev)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-410-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=441=static struct pci_driver bnge_driver = {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-445-\t.remove\t\t= bnge_remove_one,\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:446:\t.shutdown\t= bnge_shutdown,\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-447-};\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c=2957=static int bnge_open(struct net_device *dev)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c-2968-\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c:2969:static int bnge_shutdown_nic(struct bnge_net *bn)\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c-2970-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c=3153=static void bnge_close_core(struct bnge_net *bn)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c-3161-\ttimer_delete_sync(\u0026bn-\u003etimer);\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c:3162:\tbnge_shutdown_nic(bn);\ndrivers/net/ethernet/broadcom/bnge/bnge_netdev.c-3163-\tbnge_disable_napi(bn);\n"
} |
| 5/2 | 2026/07/25 20:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7733 output: 18 thoughts: 80 Thoughts: **Investigating the `bnge` Driver** Okay, so I see `bnge` listed as a driver within `drivers/net/ethernet/broadcom/bnge/`. My first thought is, hang on a minute...is this a legitimate, real-world driver, or is it something that's been created for syzkaller for fuzzing purposes? Given my experience with Broadcom network adapters, my instinct says that NetXtreme-E cards typically use the `bnxt` driver. Therefore, I need to quickly ascertain whether `bnge` represents a true hardware driver or not. It's crucial for understanding the overall architecture here. |
| 6/2 | 2026/07/25 20:38 | tool | grepper |
0mArgs:{
"Expression": "bnge_driver"
}Results: {
"Output": "drivers/net/ethernet/broadcom/bnge/bnge.h-19-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:20:extern char bnge_driver_name[];\ndrivers/net/ethernet/broadcom/bnge/bnge.h-21-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=18=MODULE_DESCRIPTION(DRV_SUMMARY);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-19-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:20:char bnge_driver_name[] = DRV_NAME;\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-21-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=188=static int bnge_pci_enable(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-204-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:205:\trc = pci_request_regions(pdev, bnge_driver_name);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-206-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=409=static void bnge_shutdown(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-440-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:441:static struct pci_driver bnge_driver = {\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:442:\t.name\t\t= bnge_driver_name,\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-443-\t.id_table\t= bnge_pci_tbl,\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=449=static int __init bnge_init_module(void)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-450-{\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:451:\treturn pci_register_driver(\u0026bnge_driver);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-452-}\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=455=static void __exit bnge_exit_module(void)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-456-{\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:457:\tpci_unregister_driver(\u0026bnge_driver);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-458-}\n"
} |
| 7/2 | 2026/07/25 20:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8767 output: 17 thoughts: 12 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: **Examining the Kconfig for `bnge`** Alright, let's dive right in. My first thought is to zero in on the `bnge` Kconfig entry. I need to understand its current state, dependencies, and any associated configurations. I'm immediately interested in the typical things: Is it a tristate? What are its default values? Are there any conditional dependencies that might be impacting its availability, or that *should* be impacting it? I’ll need to quickly discern the relevant architecture and platform selections to ensure the feature is configured correctly for the desired build. I'm going to scan for the typical stuff, the usual suspects like feature flags, driver options, and any specific hardware-related configurations. I need to make sure this module will be included as the user is expecting. I'll need to double-check that this matches the broader system configuration and that it is what I think it is and that the code I'm looking for is what is selected. Time to dive into the details. |
| 8/2 | 2026/07/25 20:38 | tool | grepper |
0mArgs:{
"Expression": "config BNGE"
}Results: {
"Output": "drivers/net/ethernet/broadcom/Kconfig=250=config BNXT_HWMON\n--\ndrivers/net/ethernet/broadcom/Kconfig-257-\ndrivers/net/ethernet/broadcom/Kconfig:258:config BNGE\ndrivers/net/ethernet/broadcom/Kconfig-259-\ttristate \"Broadcom ThorUltra Ethernet device support\"\n"
} |
| 9/2 | 2026/07/25 20:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9136 output: 16 thoughts: 43 Thoughts: **Initial Assessment of Broadcom ThorUltra Ethernet Support** Alright, "Broadcom ThorUltra Ethernet device support"... that immediately sounds like we're talking about a physical piece of hardware, a PCIe card, a Network Interface Controller, or NIC, from Broadcom. The name "ThorUltra" really leans into the idea of a high-performance, perhaps even a server-class, Ethernet adapter. Before diving too deep, I need to check the Kconfig dependencies. Understanding the configuration options and dependencies will give me a solid foundation for evaluating how this support is structured and if there are any specific kernel features tied to this hardware. |
| 10/2 | 2026/07/25 20:38 | tool | grepper |
0mArgs:{
"Expression": "ThorUltra"
}Results: {
"Output": "drivers/net/ethernet/broadcom/Kconfig=258=config BNGE\ndrivers/net/ethernet/broadcom/Kconfig:259:\ttristate \"Broadcom ThorUltra Ethernet device support\"\ndrivers/net/ethernet/broadcom/Kconfig-260-\tdepends on PCI\n--\ndrivers/net/ethernet/broadcom/Kconfig-264-\thelp\ndrivers/net/ethernet/broadcom/Kconfig:265:\t This driver supports Broadcom ThorUltra 50/100/200/400/800 gigabit\ndrivers/net/ethernet/broadcom/Kconfig-266-\t Ethernet cards. The module will be called bng_en. To compile this\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-7-#define DRV_NAME\t\"bng_en\"\ndrivers/net/ethernet/broadcom/bnge/bnge.h:8:#define DRV_SUMMARY\t\"Broadcom ThorUltra NIC Ethernet Driver\"\ndrivers/net/ethernet/broadcom/bnge/bnge.h-9-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=22=static const struct {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-24-} board_info[] = {\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:25:\t[BCM57708] = { \"Broadcom BCM57708 ThorUltra 50Gb/100Gb/200Gb/400Gb/800Gb Ethernet\" },\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-26-};\n"
} |
| 11/2 | 2026/07/25 20:38 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9770 output: 115 thoughts: 645 Thoughts: **WorthFuzzing Decision for bnge Driver** Okay, let's break this down. The instructions specify that if a patch touches code in vendor-specific PCIe switch, SmartNIC, or GPU drivers that *require* physical hardware cards not emulated in QEMU, we should return `WorthFuzzing=false`. The question is, does this patch fall into that category? First, I need to confirm what `bnge` is. Based on my understanding, `bnge` refers to Broadcom ThorUltra 50/100/200/400/800 gigabit Ethernet cards. These are indeed physical PCIe hardware cards. And, to be absolutely sure, I checked – QEMU *does not* emulate `bnge`. It's pretty clear that this driver relies on physical hardware, which immediately puts it in the `WorthFuzzing=false` bucket. Now, the patch also involves `bnge_shutdown`, a `.shutdown` callback, and the instructions also flag teardown callbacks like `.remove` and `.shutdown` as reasons to return `false`. However, the code also touches `bnge_netdev.c` with a `ndo_set_rx_mode_async` function. But, the fact that the entire driver is for a physical NIC outweighs the presence of this function. To be absolutely sure, I've verified that `bnge` *is* a physical NIC. The description confirms "Broadcom ThorUltra 50/100/200/400/800 gigabit Ethernet cards". It unequivocally falls under the vendor-specific PCIe category. Finally, I've checked the diff itself. The changes are confined to `drivers/net/ethernet/broadcom/bnge/bnge_core.c`, `drivers/net/ethernet/broadcom/bnge/bnge_netdev.c`, and `drivers/net/ethernet/broadcom/bnge/bnge_netdev.h`. All these files are within the `bnge` driver. It's safe to say this entire patch is squarely within the boundaries of a vendor-specific physical NIC driver not amenable to fuzzing in a virtualized QEMU environment. Therefore, my decision is `WorthFuzzing=false`. I am confident in this classification. |
| 12/2 | 2026/07/25 20:38 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch only modifies the Broadcom ThorUltra (bnge) Ethernet driver. This is a vendor-specific driver for physical PCIe hardware cards (50/100/200/400/800 Gbps NICs) that are not emulated in standard QEMU or virtualized environments. Therefore, the modified code paths cannot be reached or tested by the fuzzer.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies the Broadcom ThorUltra (bnge) Ethernet driver. This is a vendor-specific driver for physical PCIe hardware cards (50/100/200/400/800 Gbps NICs) that are not emulated in standard QEMU or virtualized environments. Therefore, the modified code paths cannot be reached or tested by the fuzzer.",
"WorthFuzzing": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|