AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies hardware-specific Intel Ethernet drivers (iavf, ice, idpf). These drivers require physical hardware and do not have software emulation in the kernel or QEMU, making them impossible to reach and fuzz in virtualized environments like GCE or QEMU.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 1256ac9a8d99ac779d08549554221c1f52a912d0\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jul 17 22:50:07 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c\nindex ec234cc8bd9db0..c4039d2b24a4bb 100644\n--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c\n+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c\n@@ -248,12 +248,28 @@ int iavf_send_vf_ptp_caps_msg(struct iavf_adapter *adapter)\n /**\n  * iavf_validate_num_queues\n  * @adapter: adapter structure\n+ * @msglen: length of the received VF resource message\n  *\n- * Validate that the number of queues the PF has sent in\n- * VIRTCHNL_OP_GET_VF_RESOURCES is not larger than the VF can handle.\n+ * Validate the VIRTCHNL_OP_GET_VF_RESOURCES response from the PF. Ensure\n+ * num_vsis does not exceed what the message length can cover, and cap\n+ * num_queue_pairs to the VF maximum.\n  **/\n-static void iavf_validate_num_queues(struct iavf_adapter *adapter)\n+static void iavf_validate_num_queues(struct iavf_adapter *adapter, u16 msglen)\n {\n+\tu16 max_vsis;\n+\n+\tif (msglen \u003c sizeof(struct virtchnl_vf_resource))\n+\t\tmax_vsis = 0;\n+\telse\n+\t\tmax_vsis = (msglen - sizeof(struct virtchnl_vf_resource)) /\n+\t\t\t   sizeof(struct virtchnl_vsi_resource);\n+\n+\tif (adapter-\u003evf_res-\u003enum_vsis \u003e max_vsis) {\n+\t\tdev_info(\u0026adapter-\u003epdev-\u003edev, \"Received %d VSIs, but message can only cover %d\\n\",\n+\t\t\t adapter-\u003evf_res-\u003enum_vsis, max_vsis);\n+\t\tadapter-\u003evf_res-\u003enum_vsis = max_vsis;\n+\t}\n+\n \tif (adapter-\u003evf_res-\u003enum_queue_pairs \u003e IAVF_MAX_REQ_QUEUES) {\n \t\tstruct virtchnl_vsi_resource *vsi_res;\n \t\tint i;\n@@ -300,7 +316,7 @@ int iavf_get_vf_config(struct iavf_adapter *adapter)\n \t * we aren't getting too many queues\n \t */\n \tif (!err)\n-\t\tiavf_validate_num_queues(adapter);\n+\t\tiavf_validate_num_queues(adapter, min(event.msg_len, len));\n \tiavf_vf_parse_hw_config(hw, adapter-\u003evf_res);\n \n \tkfree(event.msg_buf);\n@@ -2578,7 +2594,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,\n \t\tu16 len = IAVF_VIRTCHNL_VF_RESOURCE_SIZE;\n \n \t\tmemcpy(adapter-\u003evf_res, msg, min(msglen, len));\n-\t\tiavf_validate_num_queues(adapter);\n+\t\tiavf_validate_num_queues(adapter, min(msglen, len));\n \t\tiavf_vf_parse_hw_config(\u0026adapter-\u003ehw, adapter-\u003evf_res);\n \t\tif (is_zero_ether_addr(adapter-\u003ehw.mac.addr)) {\n \t\t\t/* restore current mac address */\ndiff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h\nindex f72bb1aa406741..fc91b6665f905a 100644\n--- a/drivers/net/ethernet/intel/ice/ice.h\n+++ b/drivers/net/ethernet/intel/ice/ice.h\n@@ -767,6 +767,9 @@ static inline bool ice_is_txtime_ena(const struct ice_tx_ring *ring)\n \tstruct ice_vsi *vsi = ring-\u003evsi;\n \tstruct ice_pf *pf = vsi-\u003eback;\n \n+\tif (vsi-\u003etype != ICE_VSI_PF)\n+\t\treturn false;\n+\n \treturn test_bit(ring-\u003eq_index,  pf-\u003etxtime_txqs);\n }\n \ndiff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c\nindex ef1ce106f81b5e..53974ebaaffa00 100644\n--- a/drivers/net/ethernet/intel/ice/ice_common.c\n+++ b/drivers/net/ethernet/intel/ice/ice_common.c\n@@ -1762,6 +1762,7 @@ int ice_sbq_rw_reg(struct ice_hw *hw, struct ice_sbq_msg_input *in, u16 flags)\n {\n \tstruct ice_sbq_cmd_desc desc = {0};\n \tstruct ice_sbq_msg_req msg = {0};\n+\tstruct ice_sq_cd cd = {};\n \tu16 msg_len;\n \tint status;\n \n@@ -1774,19 +1775,33 @@ int ice_sbq_rw_reg(struct ice_hw *hw, struct ice_sbq_msg_input *in, u16 flags)\n \tmsg.msg_addr_low = cpu_to_le16(in-\u003emsg_addr_low);\n \tmsg.msg_addr_high = cpu_to_le32(in-\u003emsg_addr_high);\n \n-\tif (in-\u003eopcode)\n+\tswitch (in-\u003eopcode) {\n+\tcase ice_sbq_msg_wr_p:\n+\tcase ice_sbq_msg_wr_np:\n \t\tmsg.data = cpu_to_le32(in-\u003edata);\n-\telse\n+\t\t/* E810 FW only supports opcode 0x01, convert non-posted to posted */\n+\t\tif (hw-\u003emac_type == ICE_MAC_E810)\n+\t\t\tmsg.opcode = ice_sbq_msg_wr_p;\n+\t\tbreak;\n+\tcase ice_sbq_msg_rd:\n \t\t/* data read comes back in completion, so shorten the struct by\n \t\t * sizeof(msg.data)\n \t\t */\n \t\tmsg_len -= sizeof(msg.data);\n+\t\tbreak;\n+\tdefault:\n+\t\treturn -EINVAL;\n+\t}\n+\n+\t/* E810 doesn't support posted mode, always wait for completion */\n+\tcd.posted = in-\u003eopcode == ice_sbq_msg_wr_p \u0026\u0026\n+\t\t    hw-\u003emac_type != ICE_MAC_E810;\n \n \tdesc.flags = cpu_to_le16(flags);\n \tdesc.opcode = cpu_to_le16(ice_sbq_opc_neigh_dev_req);\n \tdesc.param0.cmd_len = cpu_to_le16(msg_len);\n-\tstatus = ice_sbq_send_cmd(hw, \u0026desc, \u0026msg, msg_len, NULL);\n-\tif (!status \u0026\u0026 !in-\u003eopcode)\n+\tstatus = ice_sbq_send_cmd(hw, \u0026desc, \u0026msg, msg_len, \u0026cd);\n+\tif (!status \u0026\u0026 in-\u003eopcode == ice_sbq_msg_rd)\n \t\tin-\u003edata = le32_to_cpu\n \t\t\t(((struct ice_sbq_msg_cmpl *)\u0026msg)-\u003edata);\n \treturn status;\n@@ -6547,7 +6562,7 @@ int ice_write_cgu_reg(struct ice_hw *hw, u32 addr, u32 val)\n {\n \tstruct ice_sbq_msg_input cgu_msg = {\n \t\t.dest_dev = ice_get_dest_cgu(hw),\n-\t\t.opcode = ice_sbq_msg_wr,\n+\t\t.opcode = ice_sbq_msg_wr_np,\n \t\t.msg_addr_low = addr,\n \t\t.data = val\n \t};\ndiff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c\nindex dcb837cadd1825..a6008dc77fa438 100644\n--- a/drivers/net/ethernet/intel/ice/ice_controlq.c\n+++ b/drivers/net/ethernet/intel/ice/ice_controlq.c\n@@ -1086,6 +1086,10 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq,\n \twr32(hw, cq-\u003esq.tail, cq-\u003esq.next_to_use);\n \tice_flush(hw);\n \n+\t/* If the message is posted, don't wait for completion. */\n+\tif (cd \u0026\u0026 cd-\u003eposted)\n+\t\tgoto sq_send_command_error;\n+\n \t/* Wait for the command to complete. If it finishes within the\n \t * timeout, copy the descriptor back to temp.\n \t */\ndiff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h\nindex 788040dd662e23..c50d6fcbacba56 100644\n--- a/drivers/net/ethernet/intel/ice/ice_controlq.h\n+++ b/drivers/net/ethernet/intel/ice/ice_controlq.h\n@@ -77,6 +77,7 @@ struct ice_ctl_q_ring {\n /* sq transaction details */\n struct ice_sq_cd {\n \tstruct libie_aq_desc *wb_desc;\n+\tu8 posted : 1;\n };\n \n /* rq event information */\ndiff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c\nindex c30e27bbfe6e25..b069e6c514fb12 100644\n--- a/drivers/net/ethernet/intel/ice/ice_eswitch.c\n+++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c\n@@ -512,9 +512,6 @@ int ice_eswitch_attach_vf(struct ice_pf *pf, struct ice_vf *vf)\n \tstruct ice_repr *repr;\n \tint err;\n \n-\tif (!ice_is_eswitch_mode_switchdev(pf))\n-\t\treturn 0;\n-\n \trepr = ice_repr_create_vf(vf);\n \tif (IS_ERR(repr))\n \t\treturn PTR_ERR(repr);\ndiff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c\nindex 310e8fe2925c7d..08a17ded0ad556 100644\n--- a/drivers/net/ethernet/intel/ice/ice_lag.c\n+++ b/drivers/net/ethernet/intel/ice/ice_lag.c\n@@ -2623,7 +2623,7 @@ int ice_init_lag(struct ice_pf *pf)\n \t\tgoto  free_lport_res;\n \n \t/* associate recipes to profiles */\n-\tfor (n = 0; n \u003c ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER; n++) {\n+\tfor (n = 0; n \u003c ICE_MAX_NUM_PROFILES; n++) {\n \t\terr = ice_aq_get_recipe_to_profile(\u0026pf-\u003ehw, n,\n \t\t\t\t\t\t   \u0026recipe_bits, NULL);\n \t\tif (err)\ndiff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c\nindex 8cdc4fda89e978..fc9d4e0fa75587 100644\n--- a/drivers/net/ethernet/intel/ice/ice_lib.c\n+++ b/drivers/net/ethernet/intel/ice/ice_lib.c\n@@ -1415,6 +1415,10 @@ static int ice_vsi_alloc_rings(struct ice_vsi *vsi)\n \t\t\tset_bit(ICE_TX_RING_FLAGS_VLAN_L2TAG2, ring-\u003eflags);\n \t\telse\n \t\t\tset_bit(ICE_TX_RING_FLAGS_VLAN_L2TAG1, ring-\u003eflags);\n+\n+\t\tif (ice_is_feature_supported(pf, ICE_F_GCS))\n+\t\t\tset_bit(ICE_TX_RING_FLAGS_GCS, ring-\u003eflags);\n+\n \t\tWRITE_ONCE(vsi-\u003etx_rings[i], ring);\n \t}\n \ndiff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c\nindex e2fd2dab03e363..8b439e217e02f4 100644\n--- a/drivers/net/ethernet/intel/ice/ice_main.c\n+++ b/drivers/net/ethernet/intel/ice/ice_main.c\n@@ -3491,9 +3491,8 @@ void ice_set_netdev_features(struct net_device *netdev)\n \t\t\tNETIF_F_RXHASH;\n \n \tcsumo_features = NETIF_F_RXCSUM\t  |\n-\t\t\t NETIF_F_IP_CSUM  |\n \t\t\t NETIF_F_SCTP_CRC |\n-\t\t\t NETIF_F_IPV6_CSUM;\n+\t\t\t NETIF_F_HW_CSUM;\n \n \tvlano_features = NETIF_F_HW_VLAN_CTAG_FILTER |\n \t\t\t NETIF_F_HW_VLAN_CTAG_TX     |\n@@ -3555,12 +3554,6 @@ void ice_set_netdev_features(struct net_device *netdev)\n \t/* Allow core to manage IRQs affinity */\n \tnetif_set_affinity_auto(netdev);\n \n-\t/* Mutual exclusivity for TSO and GCS is enforced by the set features\n-\t * ndo callback.\n-\t */\n-\tif (ice_is_feature_supported(pf, ICE_F_GCS))\n-\t\tnetdev-\u003ehw_features |= NETIF_F_HW_CSUM;\n-\n \tnetif_set_tso_max_size(netdev, ICE_MAX_TSO_SIZE);\n }\n \n@@ -6500,18 +6493,6 @@ ice_set_features(struct net_device *netdev, netdev_features_t features)\n \tif (changed \u0026 NETIF_F_LOOPBACK)\n \t\tret = ice_set_loopback(vsi, !!(features \u0026 NETIF_F_LOOPBACK));\n \n-\t/* Due to E830 hardware limitations, TSO (NETIF_F_ALL_TSO) with GCS\n-\t * (NETIF_F_HW_CSUM) is not supported.\n-\t */\n-\tif (ice_is_feature_supported(pf, ICE_F_GCS) \u0026\u0026\n-\t    ((features \u0026 NETIF_F_HW_CSUM) \u0026\u0026 (features \u0026 NETIF_F_ALL_TSO))) {\n-\t\tif (netdev-\u003efeatures \u0026 NETIF_F_HW_CSUM)\n-\t\t\tdev_err(ice_pf_to_dev(pf), \"To enable TSO, you must first disable HW checksum.\\n\");\n-\t\telse\n-\t\t\tdev_err(ice_pf_to_dev(pf), \"To enable HW checksum, you must first disable TSO.\\n\");\n-\t\treturn -EIO;\n-\t}\n-\n \treturn ret;\n }\n \ndiff --git a/drivers/net/ethernet/intel/ice/ice_parser.c b/drivers/net/ethernet/intel/ice/ice_parser.c\nindex f8e69630fb7267..3ede4c1a5a8a5b 100644\n--- a/drivers/net/ethernet/intel/ice/ice_parser.c\n+++ b/drivers/net/ethernet/intel/ice/ice_parser.c\n@@ -2368,6 +2368,9 @@ int ice_parser_profile_init(struct ice_parser_result *rslt,\n \tu16 proto_off = 0;\n \tu16 off;\n \n+\tif (rslt-\u003eptype \u003e= ICE_FLOW_PTYPE_MAX)\n+\t\treturn -EINVAL;\n+\n \tmemset(prof, 0, sizeof(*prof));\n \tset_bit(rslt-\u003eptype, prof-\u003eptypes);\n \tif (blk == ICE_BLK_SW) {\ndiff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c\nindex ec3d89d8d4d345..eaec36ab6ae3f3 100644\n--- a/drivers/net/ethernet/intel/ice/ice_ptp.c\n+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c\n@@ -346,7 +346,7 @@ static u64 ice_ptp_extend_40b_ts(struct ice_pf *pf, u64 in_tstamp)\n \t\treturn 0;\n \t}\n \n-\treturn ice_ptp_extend_32b_ts(pf-\u003eptp.cached_phc_time,\n+\treturn ice_ptp_extend_32b_ts(READ_ONCE(pf-\u003eptp.cached_phc_time),\n \t\t\t\t     (in_tstamp \u003e\u003e 8) \u0026 mask);\n }\n \n@@ -3037,6 +3037,11 @@ void ice_ptp_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type)\n \tstruct ice_ptp *ptp = \u0026pf-\u003eptp;\n \tint err;\n \n+\tif (ptp-\u003estate == ICE_PTP_UNINIT) {\n+\t\tdev_dbg(ice_pf_to_dev(pf), \"PTP was not initialized, skipping rebuild\\n\");\n+\t\treturn;\n+\t}\n+\n \tif (ptp-\u003estate == ICE_PTP_READY) {\n \t\tice_ptp_prepare_for_reset(pf, reset_type);\n \t} else if (ptp-\u003estate != ICE_PTP_RESETTING) {\ndiff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c\nindex 8e5f97835954c3..c6049097f49d78 100644\n--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c\n+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c\n@@ -352,6 +352,20 @@ void ice_ptp_src_cmd(struct ice_hw *hw, enum ice_ptp_tmr_cmd cmd)\n static void ice_ptp_exec_tmr_cmd(struct ice_hw *hw)\n {\n \tstruct ice_pf *pf = container_of(hw, struct ice_pf, hw);\n+\tstruct ice_sbq_msg_input msg = {\n+\t\t.dest_dev = ice_sbq_dev_phy_0,\n+\t\t.opcode = ice_sbq_msg_rd,\n+\t};\n+\tint err;\n+\n+\t/* Flush SBQ to ensure posted writes complete before SYNC command.\n+\t * Skip for E810 - FW always sends completions, so writes are synchronous.\n+\t */\n+\tif (hw-\u003emac_type != ICE_MAC_E810) {\n+\t\terr = ice_sbq_rw_reg(hw, \u0026msg, LIBIE_AQ_FLAG_RD);\n+\t\tif (err)\n+\t\t\tdev_warn(ice_hw_to_dev(hw), \"Failed to flush SBQ: %d\\n\", err);\n+\t}\n \n \tif (!ice_is_primary(hw))\n \t\thw = ice_get_primary_hw(pf);\n@@ -442,7 +456,7 @@ static int ice_write_phy_eth56g(struct ice_hw *hw, u8 port, u32 addr, u32 val)\n {\n \tstruct ice_sbq_msg_input msg = {\n \t\t.dest_dev = ice_ptp_get_dest_dev_e825(hw, port),\n-\t\t.opcode = ice_sbq_msg_wr,\n+\t\t.opcode = ice_sbq_msg_wr_p,\n \t\t.msg_addr_low = lower_16_bits(addr),\n \t\t.msg_addr_high = upper_16_bits(addr),\n \t\t.data = val\n@@ -2614,16 +2628,18 @@ ice_read_64b_phy_reg_e82x(struct ice_hw *hw, u8 port, u16 low_addr, u64 *val)\n  * @val: The value to write to the register\n  *\n  * Write a PHY register for the given port over the device sideband queue.\n+ * Uses posted writes - requires SBQ flush before SYNC_EXEC_CMD.\n  */\n static int\n ice_write_phy_reg_e82x(struct ice_hw *hw, u8 port, u16 offset, u32 val)\n {\n-\tstruct ice_sbq_msg_input msg = {0};\n+\tstruct ice_sbq_msg_input msg = {\n+\t\t.opcode = ice_sbq_msg_wr_p,\n+\t\t.data = val\n+\t};\n \tint err;\n \n \tice_fill_phy_msg_e82x(hw, \u0026msg, port, offset);\n-\tmsg.opcode = ice_sbq_msg_wr;\n-\tmsg.data = val;\n \n \terr = ice_sbq_rw_reg(hw, \u0026msg, LIBIE_AQ_FLAG_RD);\n \tif (err) {\n@@ -2811,16 +2827,16 @@ ice_read_quad_reg_e82x(struct ice_hw *hw, u8 quad, u16 offset, u32 *val)\n int\n ice_write_quad_reg_e82x(struct ice_hw *hw, u8 quad, u16 offset, u32 val)\n {\n-\tstruct ice_sbq_msg_input msg = {0};\n+\tstruct ice_sbq_msg_input msg = {\n+\t\t.opcode = ice_sbq_msg_wr_p,\n+\t\t.data = val\n+\t};\n \tint err;\n \n \terr = ice_fill_quad_msg_e82x(hw, \u0026msg, quad, offset);\n \tif (err)\n \t\treturn err;\n \n-\tmsg.opcode = ice_sbq_msg_wr;\n-\tmsg.data = val;\n-\n \terr = ice_sbq_rw_reg(hw, \u0026msg, LIBIE_AQ_FLAG_RD);\n \tif (err) {\n \t\tice_debug(hw, ICE_DBG_PTP, \"Failed to send message to PHY, err %d\\n\",\n@@ -4514,18 +4530,19 @@ static int ice_read_phy_reg_e810(struct ice_hw *hw, u32 addr, u32 *val)\n  * @val: the value to write to the PHY\n  *\n  * Write a value to a register of the external PHY on the E810 device.\n+ * E810 FW sends completions for opcode 0x01, making writes synchronous.\n  */\n static int ice_write_phy_reg_e810(struct ice_hw *hw, u32 addr, u32 val)\n {\n-\tstruct ice_sbq_msg_input msg = {0};\n+\tstruct ice_sbq_msg_input msg = {\n+\t\t.dest_dev = ice_sbq_dev_phy_0,\n+\t\t.opcode = ice_sbq_msg_wr_p,\n+\t\t.msg_addr_low = lower_16_bits(addr),\n+\t\t.msg_addr_high = upper_16_bits(addr),\n+\t\t.data = val\n+\t};\n \tint err;\n \n-\tmsg.msg_addr_low = lower_16_bits(addr);\n-\tmsg.msg_addr_high = upper_16_bits(addr);\n-\tmsg.opcode = ice_sbq_msg_wr;\n-\tmsg.dest_dev = ice_sbq_dev_phy_0;\n-\tmsg.data = val;\n-\n \terr = ice_sbq_rw_reg(hw, \u0026msg, LIBIE_AQ_FLAG_RD);\n \tif (err) {\n \t\tice_debug(hw, ICE_DBG_PTP, \"Failed to send message to PHY, err %d\\n\",\ndiff --git a/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h b/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h\nindex 226243d3296865..eedcd2481a594a 100644\n--- a/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h\n+++ b/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h\n@@ -55,7 +55,7 @@ enum ice_sbq_dev_id {\n \n enum ice_sbq_msg_opcode {\n \tice_sbq_msg_rd\t\t= 0x00,\n-\tice_sbq_msg_wr\t\t= 0x01,\n+\tice_sbq_msg_wr_p\t= 0x01,\n \tice_sbq_msg_wr_np\t= 0x02\n };\n \ndiff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c\nindex 7e00e091756ddc..e04de021559665 100644\n--- a/drivers/net/ethernet/intel/ice/ice_sriov.c\n+++ b/drivers/net/ethernet/intel/ice/ice_sriov.c\n@@ -484,12 +484,14 @@ static int ice_start_vfs(struct ice_pf *pf)\n \t\t\tgoto teardown;\n \t\t}\n \n-\t\tretval = ice_eswitch_attach_vf(pf, vf);\n-\t\tif (retval) {\n-\t\t\tdev_err(ice_pf_to_dev(pf), \"Failed to attach VF %d to eswitch, error %d\",\n-\t\t\t\tvf-\u003evf_id, retval);\n-\t\t\tice_vf_vsi_release(vf);\n-\t\t\tgoto teardown;\n+\t\tif (ice_is_eswitch_mode_switchdev(pf)) {\n+\t\t\tretval = ice_eswitch_attach_vf(pf, vf);\n+\t\t\tif (retval) {\n+\t\t\t\tdev_err(ice_pf_to_dev(pf), \"Failed to attach VF %d to eswitch, error %d\",\n+\t\t\t\t\tvf-\u003evf_id, retval);\n+\t\t\t\tice_vf_vsi_release(vf);\n+\t\t\t\tgoto teardown;\n+\t\t\t}\n \t\t}\n \n \t\tset_bit(ICE_VF_STATE_INIT, vf-\u003evf_states);\ndiff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c\nindex 4ca1a0602307d0..b2063a54d6d823 100644\n--- a/drivers/net/ethernet/intel/ice/ice_txrx.c\n+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c\n@@ -1654,7 +1654,7 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)\n \t\t\tret = ipv6_skip_exthdr(skb, exthdr - skb-\u003edata,\n \t\t\t\t\t       \u0026l4_proto, \u0026frag_off);\n \t\t\tif (ret \u003c 0)\n-\t\t\t\treturn -1;\n+\t\t\t\tgoto checksum_sw_fb;\n \t\t}\n \n \t\t/* define outer transport */\n@@ -1673,11 +1673,7 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)\n \t\t\tl4.hdr = skb_inner_network_header(skb);\n \t\t\tbreak;\n \t\tdefault:\n-\t\t\tif (first-\u003etx_flags \u0026 ICE_TX_FLAGS_TSO)\n-\t\t\t\treturn -1;\n-\n-\t\t\tskb_checksum_help(skb);\n-\t\t\treturn 0;\n+\t\t\tgoto checksum_sw_fb;\n \t\t}\n \n \t\t/* compute outer L3 header size */\n@@ -1736,14 +1732,14 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)\n \t\t\tipv6_skip_exthdr(skb, exthdr - skb-\u003edata, \u0026l4_proto,\n \t\t\t\t\t \u0026frag_off);\n \t} else {\n-\t\treturn -1;\n+\t\tgoto checksum_sw_fb;\n \t}\n \n \t/* compute inner L3 header size */\n \tl3_len = l4.hdr - ip.hdr;\n \toffset |= (l3_len / 4) \u003c\u003c ICE_TX_DESC_LEN_IPLEN_S;\n \n-\tif ((tx_ring-\u003enetdev-\u003efeatures \u0026 NETIF_F_HW_CSUM) \u0026\u0026\n+\tif (test_bit(ICE_TX_RING_FLAGS_GCS, tx_ring-\u003eflags) \u0026\u0026\n \t    !(first-\u003etx_flags \u0026 ICE_TX_FLAGS_TSO) \u0026\u0026\n \t    !skb_csum_is_sctp(skb)) {\n \t\t/* Set GCS */\n@@ -1789,15 +1785,17 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)\n \t\tbreak;\n \n \tdefault:\n-\t\tif (first-\u003etx_flags \u0026 ICE_TX_FLAGS_TSO)\n-\t\t\treturn -1;\n-\t\tskb_checksum_help(skb);\n-\t\treturn 0;\n+\t\tgoto checksum_sw_fb;\n \t}\n \n \toff-\u003etd_cmd |= cmd;\n \toff-\u003etd_offset |= offset;\n \treturn 1;\n+\n+checksum_sw_fb:\n+\tif (first-\u003etx_flags \u0026 ICE_TX_FLAGS_TSO)\n+\t\treturn -1;\n+\treturn skb_checksum_help(skb);\n }\n \n /**\ndiff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h\nindex 5e517f2193798f..15dbd510091253 100644\n--- a/drivers/net/ethernet/intel/ice/ice_txrx.h\n+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h\n@@ -217,6 +217,7 @@ enum ice_tx_ring_flags {\n \tICE_TX_RING_FLAGS_VLAN_L2TAG1,\n \tICE_TX_RING_FLAGS_VLAN_L2TAG2,\n \tICE_TX_RING_FLAGS_TXTIME,\n+\tICE_TX_RING_FLAGS_GCS,\n \tICE_TX_RING_FLAGS_NBITS,\n };\n \ndiff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c\nindex 27e4acb1620f0c..9052e71e9c99e3 100644\n--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c\n+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c\n@@ -812,7 +812,8 @@ void ice_reset_all_vfs(struct ice_pf *pf)\n \t\t}\n \t\tice_vf_post_vsi_rebuild(vf);\n \n-\t\tice_eswitch_attach_vf(pf, vf);\n+\t\tif (ice_is_eswitch_mode_switchdev(pf))\n+\t\t\tice_eswitch_attach_vf(pf, vf);\n \n \t\tmutex_unlock(\u0026vf-\u003ecfg_lock);\n \t}\ndiff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\nindex be66f9b2e101ca..dc5ad784f456f0 100644\n--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\n+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\n@@ -3555,7 +3555,6 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)\n \n \tpci_sriov_set_totalvfs(adapter-\u003epdev, idpf_get_max_vfs(adapter));\n \tnum_max_vports = idpf_get_max_vports(adapter);\n-\tadapter-\u003emax_vports = num_max_vports;\n \tadapter-\u003evports = kzalloc_objs(*adapter-\u003evports, num_max_vports);\n \tif (!adapter-\u003evports)\n \t\treturn -ENOMEM;\n@@ -3576,6 +3575,12 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)\n \t\tgoto err_netdev_alloc;\n \t}\n \n+\t/* Set max_vports only after vports, netdevs and vport_config buffers\n+\t * are allocated to make sure max_vport bound loops don't end up\n+\t * crashing, following allocation errors on init.\n+\t */\n+\tadapter-\u003emax_vports = num_max_vports;\n+\n \t/* Start the mailbox task before requesting vectors. This will ensure\n \t * vector information response from mailbox is handled\n \t */\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies hardware-specific Intel Ethernet drivers (iavf, ice, idpf). These drivers require physical hardware and do not have software emulation in the kernel or QEMU, making them impossible to reach and fuzz in virtualized environments like GCE or QEMU.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 1256ac9a8d99ac779d08549554221c1f52a912d0
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jul 17 22:50:07 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
index ec234cc8bd9db0..c4039d2b24a4bb 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
@@ -248,12 +248,28 @@ int iavf_send_vf_ptp_caps_msg(struct iavf_adapter *adapter)
 /**
  * iavf_validate_num_queues
  * @adapter: adapter structure
+ * @msglen: length of the received VF resource message
  *
- * Validate that the number of queues the PF has sent in
- * VIRTCHNL_OP_GET_VF_RESOURCES is not larger than the VF can handle.
+ * Validate the VIRTCHNL_OP_GET_VF_RESOURCES response from the PF. Ensure
+ * num_vsis does not exceed what the message length can cover, and cap
+ * num_queue_pairs to the VF maximum.
  **/
-static void iavf_validate_num_queues(struct iavf_adapter *adapter)
+static void iavf_validate_num_queues(struct iavf_adapter *adapter, u16 msglen)
 {
+	u16 max_vsis;
+
+	if (msglen < sizeof(struct virtchnl_vf_resource))
+		max_vsis = 0;
+	else
+		max_vsis = (msglen - sizeof(struct virtchnl_vf_resource)) /
+			   sizeof(struct virtchnl_vsi_resource);
+
+	if (adapter->vf_res->num_vsis > max_vsis) {
+		dev_info(&adapter->pdev->dev, "Received %d VSIs, but message can only cover %d\n",
+			 adapter->vf_res->num_vsis, max_vsis);
+		adapter->vf_res->num_vsis = max_vsis;
+	}
+
 	if (adapter->vf_res->num_queue_pairs > IAVF_MAX_REQ_QUEUES) {
 		struct virtchnl_vsi_resource *vsi_res;
 		int i;
@@ -300,7 +316,7 @@ int iavf_get_vf_config(struct iavf_adapter *adapter)
 	 * we aren't getting too many queues
 	 */
 	if (!err)
-		iavf_validate_num_queues(adapter);
+		iavf_validate_num_queues(adapter, min(event.msg_len, len));
 	iavf_vf_parse_hw_config(hw, adapter->vf_res);
 
 	kfree(event.msg_buf);
@@ -2578,7 +2594,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
 		u16 len = IAVF_VIRTCHNL_VF_RESOURCE_SIZE;
 
 		memcpy(adapter->vf_res, msg, min(msglen, len));
-		iavf_validate_num_queues(adapter);
+		iavf_validate_num_queues(adapter, min(msglen, len));
 		iavf_vf_parse_hw_config(&adapter->hw, adapter->vf_res);
 		if (is_zero_ether_addr(adapter->hw.mac.addr)) {
 			/* restore current mac address */
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index f72bb1aa406741..fc91b6665f905a 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -767,6 +767,9 @@ static inline bool ice_is_txtime_ena(const struct ice_tx_ring *ring)
 	struct ice_vsi *vsi = ring->vsi;
 	struct ice_pf *pf = vsi->back;
 
+	if (vsi->type != ICE_VSI_PF)
+		return false;
+
 	return test_bit(ring->q_index,  pf->txtime_txqs);
 }
 
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index ef1ce106f81b5e..53974ebaaffa00 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -1762,6 +1762,7 @@ int ice_sbq_rw_reg(struct ice_hw *hw, struct ice_sbq_msg_input *in, u16 flags)
 {
 	struct ice_sbq_cmd_desc desc = {0};
 	struct ice_sbq_msg_req msg = {0};
+	struct ice_sq_cd cd = {};
 	u16 msg_len;
 	int status;
 
@@ -1774,19 +1775,33 @@ int ice_sbq_rw_reg(struct ice_hw *hw, struct ice_sbq_msg_input *in, u16 flags)
 	msg.msg_addr_low = cpu_to_le16(in->msg_addr_low);
 	msg.msg_addr_high = cpu_to_le32(in->msg_addr_high);
 
-	if (in->opcode)
+	switch (in->opcode) {
+	case ice_sbq_msg_wr_p:
+	case ice_sbq_msg_wr_np:
 		msg.data = cpu_to_le32(in->data);
-	else
+		/* E810 FW only supports opcode 0x01, convert non-posted to posted */
+		if (hw->mac_type == ICE_MAC_E810)
+			msg.opcode = ice_sbq_msg_wr_p;
+		break;
+	case ice_sbq_msg_rd:
 		/* data read comes back in completion, so shorten the struct by
 		 * sizeof(msg.data)
 		 */
 		msg_len -= sizeof(msg.data);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* E810 doesn't support posted mode, always wait for completion */
+	cd.posted = in->opcode == ice_sbq_msg_wr_p &&
+		    hw->mac_type != ICE_MAC_E810;
 
 	desc.flags = cpu_to_le16(flags);
 	desc.opcode = cpu_to_le16(ice_sbq_opc_neigh_dev_req);
 	desc.param0.cmd_len = cpu_to_le16(msg_len);
-	status = ice_sbq_send_cmd(hw, &desc, &msg, msg_len, NULL);
-	if (!status && !in->opcode)
+	status = ice_sbq_send_cmd(hw, &desc, &msg, msg_len, &cd);
+	if (!status && in->opcode == ice_sbq_msg_rd)
 		in->data = le32_to_cpu
 			(((struct ice_sbq_msg_cmpl *)&msg)->data);
 	return status;
@@ -6547,7 +6562,7 @@ int ice_write_cgu_reg(struct ice_hw *hw, u32 addr, u32 val)
 {
 	struct ice_sbq_msg_input cgu_msg = {
 		.dest_dev = ice_get_dest_cgu(hw),
-		.opcode = ice_sbq_msg_wr,
+		.opcode = ice_sbq_msg_wr_np,
 		.msg_addr_low = addr,
 		.data = val
 	};
diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
index dcb837cadd1825..a6008dc77fa438 100644
--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
+++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
@@ -1086,6 +1086,10 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq,
 	wr32(hw, cq->sq.tail, cq->sq.next_to_use);
 	ice_flush(hw);
 
+	/* If the message is posted, don't wait for completion. */
+	if (cd && cd->posted)
+		goto sq_send_command_error;
+
 	/* Wait for the command to complete. If it finishes within the
 	 * timeout, copy the descriptor back to temp.
 	 */
diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h
index 788040dd662e23..c50d6fcbacba56 100644
--- a/drivers/net/ethernet/intel/ice/ice_controlq.h
+++ b/drivers/net/ethernet/intel/ice/ice_controlq.h
@@ -77,6 +77,7 @@ struct ice_ctl_q_ring {
 /* sq transaction details */
 struct ice_sq_cd {
 	struct libie_aq_desc *wb_desc;
+	u8 posted : 1;
 };
 
 /* rq event information */
diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c
index c30e27bbfe6e25..b069e6c514fb12 100644
--- a/drivers/net/ethernet/intel/ice/ice_eswitch.c
+++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c
@@ -512,9 +512,6 @@ int ice_eswitch_attach_vf(struct ice_pf *pf, struct ice_vf *vf)
 	struct ice_repr *repr;
 	int err;
 
-	if (!ice_is_eswitch_mode_switchdev(pf))
-		return 0;
-
 	repr = ice_repr_create_vf(vf);
 	if (IS_ERR(repr))
 		return PTR_ERR(repr);
diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c
index 310e8fe2925c7d..08a17ded0ad556 100644
--- a/drivers/net/ethernet/intel/ice/ice_lag.c
+++ b/drivers/net/ethernet/intel/ice/ice_lag.c
@@ -2623,7 +2623,7 @@ int ice_init_lag(struct ice_pf *pf)
 		goto  free_lport_res;
 
 	/* associate recipes to profiles */
-	for (n = 0; n < ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER; n++) {
+	for (n = 0; n < ICE_MAX_NUM_PROFILES; n++) {
 		err = ice_aq_get_recipe_to_profile(&pf->hw, n,
 						   &recipe_bits, NULL);
 		if (err)
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index 8cdc4fda89e978..fc9d4e0fa75587 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -1415,6 +1415,10 @@ static int ice_vsi_alloc_rings(struct ice_vsi *vsi)
 			set_bit(ICE_TX_RING_FLAGS_VLAN_L2TAG2, ring->flags);
 		else
 			set_bit(ICE_TX_RING_FLAGS_VLAN_L2TAG1, ring->flags);
+
+		if (ice_is_feature_supported(pf, ICE_F_GCS))
+			set_bit(ICE_TX_RING_FLAGS_GCS, ring->flags);
+
 		WRITE_ONCE(vsi->tx_rings[i], ring);
 	}
 
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index e2fd2dab03e363..8b439e217e02f4 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -3491,9 +3491,8 @@ void ice_set_netdev_features(struct net_device *netdev)
 			NETIF_F_RXHASH;
 
 	csumo_features = NETIF_F_RXCSUM	  |
-			 NETIF_F_IP_CSUM  |
 			 NETIF_F_SCTP_CRC |
-			 NETIF_F_IPV6_CSUM;
+			 NETIF_F_HW_CSUM;
 
 	vlano_features = NETIF_F_HW_VLAN_CTAG_FILTER |
 			 NETIF_F_HW_VLAN_CTAG_TX     |
@@ -3555,12 +3554,6 @@ void ice_set_netdev_features(struct net_device *netdev)
 	/* Allow core to manage IRQs affinity */
 	netif_set_affinity_auto(netdev);
 
-	/* Mutual exclusivity for TSO and GCS is enforced by the set features
-	 * ndo callback.
-	 */
-	if (ice_is_feature_supported(pf, ICE_F_GCS))
-		netdev->hw_features |= NETIF_F_HW_CSUM;
-
 	netif_set_tso_max_size(netdev, ICE_MAX_TSO_SIZE);
 }
 
@@ -6500,18 +6493,6 @@ ice_set_features(struct net_device *netdev, netdev_features_t features)
 	if (changed & NETIF_F_LOOPBACK)
 		ret = ice_set_loopback(vsi, !!(features & NETIF_F_LOOPBACK));
 
-	/* Due to E830 hardware limitations, TSO (NETIF_F_ALL_TSO) with GCS
-	 * (NETIF_F_HW_CSUM) is not supported.
-	 */
-	if (ice_is_feature_supported(pf, ICE_F_GCS) &&
-	    ((features & NETIF_F_HW_CSUM) && (features & NETIF_F_ALL_TSO))) {
-		if (netdev->features & NETIF_F_HW_CSUM)
-			dev_err(ice_pf_to_dev(pf), "To enable TSO, you must first disable HW checksum.\n");
-		else
-			dev_err(ice_pf_to_dev(pf), "To enable HW checksum, you must first disable TSO.\n");
-		return -EIO;
-	}
-
 	return ret;
 }
 
diff --git a/drivers/net/ethernet/intel/ice/ice_parser.c b/drivers/net/ethernet/intel/ice/ice_parser.c
index f8e69630fb7267..3ede4c1a5a8a5b 100644
--- a/drivers/net/ethernet/intel/ice/ice_parser.c
+++ b/drivers/net/ethernet/intel/ice/ice_parser.c
@@ -2368,6 +2368,9 @@ int ice_parser_profile_init(struct ice_parser_result *rslt,
 	u16 proto_off = 0;
 	u16 off;
 
+	if (rslt->ptype >= ICE_FLOW_PTYPE_MAX)
+		return -EINVAL;
+
 	memset(prof, 0, sizeof(*prof));
 	set_bit(rslt->ptype, prof->ptypes);
 	if (blk == ICE_BLK_SW) {
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index ec3d89d8d4d345..eaec36ab6ae3f3 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -346,7 +346,7 @@ static u64 ice_ptp_extend_40b_ts(struct ice_pf *pf, u64 in_tstamp)
 		return 0;
 	}
 
-	return ice_ptp_extend_32b_ts(pf->ptp.cached_phc_time,
+	return ice_ptp_extend_32b_ts(READ_ONCE(pf->ptp.cached_phc_time),
 				     (in_tstamp >> 8) & mask);
 }
 
@@ -3037,6 +3037,11 @@ void ice_ptp_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type)
 	struct ice_ptp *ptp = &pf->ptp;
 	int err;
 
+	if (ptp->state == ICE_PTP_UNINIT) {
+		dev_dbg(ice_pf_to_dev(pf), "PTP was not initialized, skipping rebuild\n");
+		return;
+	}
+
 	if (ptp->state == ICE_PTP_READY) {
 		ice_ptp_prepare_for_reset(pf, reset_type);
 	} else if (ptp->state != ICE_PTP_RESETTING) {
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
index 8e5f97835954c3..c6049097f49d78 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
@@ -352,6 +352,20 @@ void ice_ptp_src_cmd(struct ice_hw *hw, enum ice_ptp_tmr_cmd cmd)
 static void ice_ptp_exec_tmr_cmd(struct ice_hw *hw)
 {
 	struct ice_pf *pf = container_of(hw, struct ice_pf, hw);
+	struct ice_sbq_msg_input msg = {
+		.dest_dev = ice_sbq_dev_phy_0,
+		.opcode = ice_sbq_msg_rd,
+	};
+	int err;
+
+	/* Flush SBQ to ensure posted writes complete before SYNC command.
+	 * Skip for E810 - FW always sends completions, so writes are synchronous.
+	 */
+	if (hw->mac_type != ICE_MAC_E810) {
+		err = ice_sbq_rw_reg(hw, &msg, LIBIE_AQ_FLAG_RD);
+		if (err)
+			dev_warn(ice_hw_to_dev(hw), "Failed to flush SBQ: %d\n", err);
+	}
 
 	if (!ice_is_primary(hw))
 		hw = ice_get_primary_hw(pf);
@@ -442,7 +456,7 @@ static int ice_write_phy_eth56g(struct ice_hw *hw, u8 port, u32 addr, u32 val)
 {
 	struct ice_sbq_msg_input msg = {
 		.dest_dev = ice_ptp_get_dest_dev_e825(hw, port),
-		.opcode = ice_sbq_msg_wr,
+		.opcode = ice_sbq_msg_wr_p,
 		.msg_addr_low = lower_16_bits(addr),
 		.msg_addr_high = upper_16_bits(addr),
 		.data = val
@@ -2614,16 +2628,18 @@ ice_read_64b_phy_reg_e82x(struct ice_hw *hw, u8 port, u16 low_addr, u64 *val)
  * @val: The value to write to the register
  *
  * Write a PHY register for the given port over the device sideband queue.
+ * Uses posted writes - requires SBQ flush before SYNC_EXEC_CMD.
  */
 static int
 ice_write_phy_reg_e82x(struct ice_hw *hw, u8 port, u16 offset, u32 val)
 {
-	struct ice_sbq_msg_input msg = {0};
+	struct ice_sbq_msg_input msg = {
+		.opcode = ice_sbq_msg_wr_p,
+		.data = val
+	};
 	int err;
 
 	ice_fill_phy_msg_e82x(hw, &msg, port, offset);
-	msg.opcode = ice_sbq_msg_wr;
-	msg.data = val;
 
 	err = ice_sbq_rw_reg(hw, &msg, LIBIE_AQ_FLAG_RD);
 	if (err) {
@@ -2811,16 +2827,16 @@ ice_read_quad_reg_e82x(struct ice_hw *hw, u8 quad, u16 offset, u32 *val)
 int
 ice_write_quad_reg_e82x(struct ice_hw *hw, u8 quad, u16 offset, u32 val)
 {
-	struct ice_sbq_msg_input msg = {0};
+	struct ice_sbq_msg_input msg = {
+		.opcode = ice_sbq_msg_wr_p,
+		.data = val
+	};
 	int err;
 
 	err = ice_fill_quad_msg_e82x(hw, &msg, quad, offset);
 	if (err)
 		return err;
 
-	msg.opcode = ice_sbq_msg_wr;
-	msg.data = val;
-
 	err = ice_sbq_rw_reg(hw, &msg, LIBIE_AQ_FLAG_RD);
 	if (err) {
 		ice_debug(hw, ICE_DBG_PTP, "Failed to send message to PHY, err %d\n",
@@ -4514,18 +4530,19 @@ static int ice_read_phy_reg_e810(struct ice_hw *hw, u32 addr, u32 *val)
  * @val: the value to write to the PHY
  *
  * Write a value to a register of the external PHY on the E810 device.
+ * E810 FW sends completions for opcode 0x01, making writes synchronous.
  */
 static int ice_write_phy_reg_e810(struct ice_hw *hw, u32 addr, u32 val)
 {
-	struct ice_sbq_msg_input msg = {0};
+	struct ice_sbq_msg_input msg = {
+		.dest_dev = ice_sbq_dev_phy_0,
+		.opcode = ice_sbq_msg_wr_p,
+		.msg_addr_low = lower_16_bits(addr),
+		.msg_addr_high = upper_16_bits(addr),
+		.data = val
+	};
 	int err;
 
-	msg.msg_addr_low = lower_16_bits(addr);
-	msg.msg_addr_high = upper_16_bits(addr);
-	msg.opcode = ice_sbq_msg_wr;
-	msg.dest_dev = ice_sbq_dev_phy_0;
-	msg.data = val;
-
 	err = ice_sbq_rw_reg(hw, &msg, LIBIE_AQ_FLAG_RD);
 	if (err) {
 		ice_debug(hw, ICE_DBG_PTP, "Failed to send message to PHY, err %d\n",
diff --git a/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h b/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h
index 226243d3296865..eedcd2481a594a 100644
--- a/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h
+++ b/drivers/net/ethernet/intel/ice/ice_sbq_cmd.h
@@ -55,7 +55,7 @@ enum ice_sbq_dev_id {
 
 enum ice_sbq_msg_opcode {
 	ice_sbq_msg_rd		= 0x00,
-	ice_sbq_msg_wr		= 0x01,
+	ice_sbq_msg_wr_p	= 0x01,
 	ice_sbq_msg_wr_np	= 0x02
 };
 
diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c
index 7e00e091756ddc..e04de021559665 100644
--- a/drivers/net/ethernet/intel/ice/ice_sriov.c
+++ b/drivers/net/ethernet/intel/ice/ice_sriov.c
@@ -484,12 +484,14 @@ static int ice_start_vfs(struct ice_pf *pf)
 			goto teardown;
 		}
 
-		retval = ice_eswitch_attach_vf(pf, vf);
-		if (retval) {
-			dev_err(ice_pf_to_dev(pf), "Failed to attach VF %d to eswitch, error %d",
-				vf->vf_id, retval);
-			ice_vf_vsi_release(vf);
-			goto teardown;
+		if (ice_is_eswitch_mode_switchdev(pf)) {
+			retval = ice_eswitch_attach_vf(pf, vf);
+			if (retval) {
+				dev_err(ice_pf_to_dev(pf), "Failed to attach VF %d to eswitch, error %d",
+					vf->vf_id, retval);
+				ice_vf_vsi_release(vf);
+				goto teardown;
+			}
 		}
 
 		set_bit(ICE_VF_STATE_INIT, vf->vf_states);
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index 4ca1a0602307d0..b2063a54d6d823 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -1654,7 +1654,7 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
 			ret = ipv6_skip_exthdr(skb, exthdr - skb->data,
 					       &l4_proto, &frag_off);
 			if (ret < 0)
-				return -1;
+				goto checksum_sw_fb;
 		}
 
 		/* define outer transport */
@@ -1673,11 +1673,7 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
 			l4.hdr = skb_inner_network_header(skb);
 			break;
 		default:
-			if (first->tx_flags & ICE_TX_FLAGS_TSO)
-				return -1;
-
-			skb_checksum_help(skb);
-			return 0;
+			goto checksum_sw_fb;
 		}
 
 		/* compute outer L3 header size */
@@ -1736,14 +1732,14 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
 			ipv6_skip_exthdr(skb, exthdr - skb->data, &l4_proto,
 					 &frag_off);
 	} else {
-		return -1;
+		goto checksum_sw_fb;
 	}
 
 	/* compute inner L3 header size */
 	l3_len = l4.hdr - ip.hdr;
 	offset |= (l3_len / 4) << ICE_TX_DESC_LEN_IPLEN_S;
 
-	if ((tx_ring->netdev->features & NETIF_F_HW_CSUM) &&
+	if (test_bit(ICE_TX_RING_FLAGS_GCS, tx_ring->flags) &&
 	    !(first->tx_flags & ICE_TX_FLAGS_TSO) &&
 	    !skb_csum_is_sctp(skb)) {
 		/* Set GCS */
@@ -1789,15 +1785,17 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
 		break;
 
 	default:
-		if (first->tx_flags & ICE_TX_FLAGS_TSO)
-			return -1;
-		skb_checksum_help(skb);
-		return 0;
+		goto checksum_sw_fb;
 	}
 
 	off->td_cmd |= cmd;
 	off->td_offset |= offset;
 	return 1;
+
+checksum_sw_fb:
+	if (first->tx_flags & ICE_TX_FLAGS_TSO)
+		return -1;
+	return skb_checksum_help(skb);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h
index 5e517f2193798f..15dbd510091253 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.h
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h
@@ -217,6 +217,7 @@ enum ice_tx_ring_flags {
 	ICE_TX_RING_FLAGS_VLAN_L2TAG1,
 	ICE_TX_RING_FLAGS_VLAN_L2TAG2,
 	ICE_TX_RING_FLAGS_TXTIME,
+	ICE_TX_RING_FLAGS_GCS,
 	ICE_TX_RING_FLAGS_NBITS,
 };
 
diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
index 27e4acb1620f0c..9052e71e9c99e3 100644
--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
@@ -812,7 +812,8 @@ void ice_reset_all_vfs(struct ice_pf *pf)
 		}
 		ice_vf_post_vsi_rebuild(vf);
 
-		ice_eswitch_attach_vf(pf, vf);
+		if (ice_is_eswitch_mode_switchdev(pf))
+			ice_eswitch_attach_vf(pf, vf);
 
 		mutex_unlock(&vf->cfg_lock);
 	}
diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index be66f9b2e101ca..dc5ad784f456f0 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -3555,7 +3555,6 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
 
 	pci_sriov_set_totalvfs(adapter->pdev, idpf_get_max_vfs(adapter));
 	num_max_vports = idpf_get_max_vports(adapter);
-	adapter->max_vports = num_max_vports;
 	adapter->vports = kzalloc_objs(*adapter->vports, num_max_vports);
 	if (!adapter->vports)
 		return -ENOMEM;
@@ -3576,6 +3575,12 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
 		goto err_netdev_alloc;
 	}
 
+	/* Set max_vports only after vports, netdevs and vport_config buffers
+	 * are allocated to make sure max_vport bound loops don't end up
+	 * crashing, following allocation errors on init.
+	 */
+	adapter->max_vports = num_max_vports;
+
 	/* Start the mailbox task before requesting vectors. This will ensure
 	 * vector information response from mailbox is handled
 	 */

gemini-3.1-pro-preview

null

null

							input: 10532
							output: 17
							thoughts: 1272
						

**Analysis of Intel Ethernet Driver Patch Series**

Okay, let's break down these changes to the Intel Ethernet drivers: `iavf`, `ice`, and `idpf`. I see a series of modifications across several files, so I'll go through them methodically.

First, in `iavf_virtchnl.c`, there's enhanced validation in `iavf_validate_num_queues`. It now considers the message length (`msglen`) when validating the number of virtual functions, which is good for robustness. The use of `min(msglen, len)` in `iavf_get_vf_config` and `iavf_virtchnl_completion` suggests they're handling potentially truncated or malformed messages gracefully.

Next, in `ice.h`, the check in `ice_is_txtime_ena` seems to be filtering for specific VSI types, likely optimizing the transmit time enable logic.

`ice_common.c` shows changes to `ice_sbq_rw_reg`, which handles System Bus Queue (SBQ) message writes and reads, with specific functions for posted and non-posted writes. The use of `ice_sbq_msg_wr_np` in `ice_write_cgu_reg` suggests an optimization in register access. The changes to `ice_controlq.c` and `ice_controlq.h` regarding posted messages in `ice_sq_send_cmd` are interesting; not waiting for completion can improve performance, but requires careful synchronization.

Now, a couple of changes in `ice_eswitch.c` and `ice_vf_lib.c` stand out. The removal of the `ice_is_eswitch_mode_switchdev(pf)` check in `ice_eswitch_attach_vf` and `ice_reset_all_vfs` hints that they are generalizing eswitch attach logic. This needs to be understood in the context of eswitch mode. And similarly for `ice_sriov.c`, a check for eswitch mode has been added, to ensure compatibility with switchdev.

In `ice_lag.c`, an update to the loop bound in `ice_init_lag` suggests a potential reconfiguration of the LAG profile handling; changing from a very specific enum to the maximum number of profiles sounds more general.

`ice_lib.c` now conditionally sets the `ICE_TX_RING_FLAGS_GCS` flag based on hardware support (`ICE_F_GCS`) when allocating rings, which means the ring flags may change based on the hardware.

`ice_main.c` is significant. The removal of `NETIF_F_IP_CSUM` and `NETIF_F_IPV6_CSUM` in `ice_set_netdev_features` in favor of `NETIF_F_HW_CSUM` indicates a move towards complete hardware checksum offload. This is a common and usually beneficial shift. The removal of the mutual exclusivity check for TSO and GCS, and the removal of hardware limitations for TSO with GCS, shows they're making an effort to improve the ability to use more modern features.

In `ice_parser.c`, the bounds check in `ice_parser_profile_init` for `rslt->ptype` is another good security/robustness check.

The PTP-related changes in `ice_ptp.c` and `ice_ptp_hw.c` (using `READ_ONCE`, checking `ptp->state`, flushing SBQ in `ice_ptp_exec_tmr_cmd`, and using `ice_sbq_msg_wr_p`) suggest enhancements to PTP (Precision Time Protocol) handling. It implies the usage of the bus queue for this purpose.

`ice_txrx.c` now uses a fallback label for software checksum. Also, it now checks `ICE_TX_RING_FLAGS_GCS` instead of `NETIF_F_HW_CSUM`, which relates to previous feature changes.

Finally, `idpf_virtchnl.c` ensures `adapter->max_vports` is set *after* allocations, preventing potential crashes. This is critical for robust initialization.

Now, the main question is, are these drivers reachable in virtualized environments? `iavf`, `ice`, and `idpf` are all clearly for network functions. The `iavf` part deals with the Intel Ethernet Adaptive Virtual Function, `ice` is the Intel Ethernet Connection E800 Series Linux Driver, and `idpf` is Intel Infrastructure Data Path Function Linux Driver.

Can we fuzz them? Syzkaller fuzzer is a strong candidate, as it is a kernel fuzzer. It often focuses on netlink and ioct

{
  "Expression": "CONFIG_ICE"
}

{
  "Output": "arch/loongarch/configs/loongson32_defconfig=592=CONFIG_I40E=y\narch/loongarch/configs/loongson32_defconfig:593:CONFIG_ICE=y\narch/loongarch/configs/loongson32_defconfig-594-CONFIG_FM10K=y\n--\narch/loongarch/configs/loongson64_defconfig=608=CONFIG_I40E=y\narch/loongarch/configs/loongson64_defconfig:609:CONFIG_ICE=y\narch/loongarch/configs/loongson64_defconfig-610-CONFIG_FM10K=y\n--\ndrivers/net/ethernet/intel/Makefile=19=obj-$(CONFIG_FM10K) += fm10k/\ndrivers/net/ethernet/intel/Makefile:20:obj-$(CONFIG_ICE) += ice/\ndrivers/net/ethernet/intel/Makefile-21-obj-$(CONFIG_IDPF) += idpf/\n--\ndrivers/net/ethernet/intel/ice/Makefile=8=subdir-ccflags-y += -I$(src)\ndrivers/net/ethernet/intel/ice/Makefile:9:obj-$(CONFIG_ICE) += ice.o\ndrivers/net/ethernet/intel/ice/Makefile-10-\n--\ndrivers/net/ethernet/intel/ice/Makefile=60=ice-$(CONFIG_XDP_SOCKETS) += ice_xsk.o\ndrivers/net/ethernet/intel/ice/Makefile:61:ice-$(CONFIG_ICE_SWITCHDEV) += ice_eswitch.o ice_eswitch_br.o\ndrivers/net/ethernet/intel/ice/Makefile-62-ice-$(CONFIG_GNSS) += ice_gnss.o\ndrivers/net/ethernet/intel/ice/Makefile:63:ice-$(CONFIG_ICE_HWMON) += ice_hwmon.o\n--\ndrivers/net/ethernet/intel/ice/ice_eswitch.h-9-\ndrivers/net/ethernet/intel/ice/ice_eswitch.h:10:#ifdef CONFIG_ICE_SWITCHDEV\ndrivers/net/ethernet/intel/ice/ice_eswitch.h-11-void ice_eswitch_detach_vf(struct ice_pf *pf, struct ice_vf *vf);\n--\ndrivers/net/ethernet/intel/ice/ice_eswitch.h=34=void ice_eswitch_decfg_vsi(struct ice_vsi *vsi, const u8 *mac);\ndrivers/net/ethernet/intel/ice/ice_eswitch.h:35:#else /* CONFIG_ICE_SWITCHDEV */\ndrivers/net/ethernet/intel/ice/ice_eswitch.h-36-static inline void\n--\ndrivers/net/ethernet/intel/ice/ice_eswitch.h=98=static inline void ice_eswitch_decfg_vsi(struct ice_vsi *vsi, const u8 *mac) { }\ndrivers/net/ethernet/intel/ice/ice_eswitch.h:99:#endif /* CONFIG_ICE_SWITCHDEV */\ndrivers/net/ethernet/intel/ice/ice_eswitch.h-100-#endif /* _ICE_ESWITCH_H_ */\n--\ndrivers/net/ethernet/intel/ice/ice_hwmon.h-6-\ndrivers/net/ethernet/intel/ice/ice_hwmon.h:7:#ifdef CONFIG_ICE_HWMON\ndrivers/net/ethernet/intel/ice/ice_hwmon.h-8-void ice_hwmon_init(struct ice_pf *pf);\ndrivers/net/ethernet/intel/ice/ice_hwmon.h=9=void ice_hwmon_exit(struct ice_pf *pf);\ndrivers/net/ethernet/intel/ice/ice_hwmon.h:10:#else /* CONFIG_ICE_HWMON */\ndrivers/net/ethernet/intel/ice/ice_hwmon.h-11-static inline void ice_hwmon_init(struct ice_pf *pf) { }\ndrivers/net/ethernet/intel/ice/ice_hwmon.h=12=static inline void ice_hwmon_exit(struct ice_pf *pf) { }\ndrivers/net/ethernet/intel/ice/ice_hwmon.h:13:#endif /* CONFIG_ICE_HWMON */\ndrivers/net/ethernet/intel/ice/ice_hwmon.h-14-\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c=2036=static const struct ice_crosststamp_cfg ice_crosststamp_cfg_e82x = {\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2048-\ndrivers/net/ethernet/intel/ice/ice_ptp.c:2049:#ifdef CONFIG_ICE_HWTS\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2050-static const struct ice_crosststamp_cfg ice_crosststamp_cfg_e830 = {\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2062-\ndrivers/net/ethernet/intel/ice/ice_ptp.c:2063:#endif /* CONFIG_ICE_HWTS */\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2064-/**\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c=2175=static int ice_ptp_getcrosststamp(struct ptp_clock_info *info,\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2188-\t\tbreak;\ndrivers/net/ethernet/intel/ice/ice_ptp.c:2189:#ifdef CONFIG_ICE_HWTS\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2190-\tcase ICE_MAC_E830:\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2192-\t\tbreak;\ndrivers/net/ethernet/intel/ice/ice_ptp.c:2193:#endif /* CONFIG_ICE_HWTS */\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2194-\tdefault:\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c=2523=static void ice_ptp_set_funcs_e830(struct ice_pf *pf)\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2524-{\ndrivers/net/ethernet/intel/ice/ice_ptp.c:2525:#ifdef CONFIG_ICE_HWTS\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2526-\tif (pcie_ptm_enabled(pf-\u003epdev) \u0026\u0026 boot_cpu_has(X86_FEATURE_ART))\n--\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2528-\ndrivers/net/ethernet/intel/ice/ice_ptp.c:2529:#endif /* CONFIG_ICE_HWTS */\ndrivers/net/ethernet/intel/ice/ice_ptp.c-2530-\t/* Rest of the config is the same as base E810 */\n"
}

gemini-3.1-pro-preview

null

null

							input: 14691
							output: 18
							thoughts: 297
						

**Fuzzing Intel Ethernet Drivers: A Feasibility Check**

Okay, so I'm looking at these Intel Ethernet drivers – specifically, `ice`, `iavf`, and `idpf`. My initial thought is, can syzkaller even touch them? I know PCI drivers are generally fair game if they're enabled and syzkaller uses something like `syz_pci`. But, I'm aware that syzkaller's PCI fuzzing has its limitations.

Then I recalled that `WorthFuzzing` caveat – the "impossible to reach" paths in virtualized environments like GCE or QEMU, especially when software emulation is employed (think usb gadget or mac80211_hwsim). So, if there isn't any software-emulated hardware for `ice`, `iavf`, or `idpf`, that probably means these drivers are out of reach for a standard GCE or QEMU setup.

Now, I need to confirm if QEMU *actually* offers emulation for `iavf` or `ice`. I can't just assume they're missing. A quick mental review of QEMU's network devices gives me the usual suspects: `e1000`, `e1000e`, `igb`, etc., all the way through to `virtio-net`. I don't recall seeing anything specific for the E800 series or Adaptive Virtual Functionality. But I really need to double check the QEMU documentation to be absolutely sure. Gotta be thorough.

no matches

{
  "Expression": "hw/net/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 15348
							output: 20
							thoughts: 80
						

**Kernel-Based ICE Emulation Inquiry**

Okay, first things first, I need to recalibrate. I was just searching in the kernel source tree, not QEMU. Wrong context. Now, I'm trying to figure out if there's any kernel-level software emulation for the `ice` driver. You know, something akin to `mac80211_hwsim` for wireless or `netdevsim` for network devices. I'm hoping I can find a way to test and interact with this `ice` driver without needing the actual hardware. Let's see... `netdevsim` isn't going to cut it, I already know that. So, the question now is, does *any* of the kernel provide me with emulation for `ice`? I'll need to dig deeper.

{
  "Expression": "ice_pci_tbl"
}

{
  "Output": "drivers/net/ethernet/intel/ice/ice_main.c=5110=static int ice_probe_recovery_mode(struct ice_pf *pf)\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5142- * @pdev: PCI device information struct\ndrivers/net/ethernet/intel/ice/ice_main.c:5143: * @ent: entry in ice_pci_tbl\ndrivers/net/ethernet/intel/ice/ice_main.c-5144- *\n--\ndrivers/net/ethernet/intel/ice/ice_main.c=5754=static void ice_pci_err_reset_done(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5758-\ndrivers/net/ethernet/intel/ice/ice_main.c:5759:/* ice_pci_tbl - PCI Device ID Table\ndrivers/net/ethernet/intel/ice/ice_main.c-5760- *\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5766- */\ndrivers/net/ethernet/intel/ice/ice_main.c:5767:static const struct pci_device_id ice_pci_tbl[] = {\ndrivers/net/ethernet/intel/ice/ice_main.c-5768-\t{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_BACKPLANE) },\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5819-};\ndrivers/net/ethernet/intel/ice/ice_main.c:5820:MODULE_DEVICE_TABLE(pci, ice_pci_tbl);\ndrivers/net/ethernet/intel/ice/ice_main.c-5821-\n--\ndrivers/net/ethernet/intel/ice/ice_main.c=5832=static struct pci_driver ice_driver = {\ndrivers/net/ethernet/intel/ice/ice_main.c-5833-\t.name = KBUILD_MODNAME,\ndrivers/net/ethernet/intel/ice/ice_main.c:5834:\t.id_table = ice_pci_tbl,\ndrivers/net/ethernet/intel/ice/ice_main.c-5835-\t.probe = ice_probe,\n"
}

gemini-3.1-pro-preview

null

null

							input: 16239
							output: 18
							thoughts: 622
						

**Reaching Inaccessible Code Paths**

Okay, these PCI IDs are definitely tied to real hardware. My initial thought is, can this code even be touched in a virtualized setting without access to the actual hardware? I know Syzkaller has `syz_pci`, which sounds promising as it can emulate PCI devices. However, it's not a *full* hardware emulator; it's more like a tool to inject PCI config space and MMIO reads/writes. Hmm, I wonder if Syzkaller fuzzed something like `ice` using that method? I don't have access to Syzkaller descriptions to confirm, but the prompt is helpful and clear: "Code paths that are impossible to reach in virtualized environments...". If `syz_pci` can't reach it, then it's clearly impossible to reach. Wait a moment, `syz_pci` isn't software-emulated hardware, but a fuzzer pseudo-device. The prompt is specifically talking about emulated hardware. If it needs real hardware, and there's no software emulator (like the examples given), then it's unreachable.

Okay, does Syzkaller test Ethernet drivers with `syz_pci`? I know Syzkaller does use `syz_pci` to fuzz some PCI drivers, but usually, it's pretty shallow. So, back to `ice` or `iavf`, can they actually be reached? Wait, `iavf` is a Virtual Function driver. Can it even be instantiated in QEMU? And the answer is likely no, QEMU doesn't emulate those. So, what else is possible?

Then I went back to the prompt, which confirms: "...impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim)." Since `ice`, `iavf`, and `idpf` are all fundamentally physical hardware drivers, or SR-IOV virtual functions of physical hardware, and there's no software emulation in the kernel or QEMU, these code paths are impossible to reach within any standard virtualized environment. To be absolutely sure, I'll just quickly double-check that there isn't some obscure emulation that I'm missing, but I'm pretty confident in that conclusion.

{
  "Expression": "CONFIG_IAVF"
}

{
  "Output": "drivers/net/ethernet/intel/Kconfig=250=config I40E_DCB\n--\ndrivers/net/ethernet/intel/Kconfig-260-# this is here to allow seamless migration from I40EVF --\u003e IAVF name\ndrivers/net/ethernet/intel/Kconfig:261:# so that CONFIG_IAVF symbol will always mirror the state of CONFIG_I40EVF\ndrivers/net/ethernet/intel/Kconfig-262-config IAVF\n--\ndrivers/net/ethernet/intel/Makefile=17=obj-$(CONFIG_I40E) += i40e/\ndrivers/net/ethernet/intel/Makefile:18:obj-$(CONFIG_IAVF) += iavf/\ndrivers/net/ethernet/intel/Makefile-19-obj-$(CONFIG_FM10K) += fm10k/\n--\ndrivers/net/ethernet/intel/iavf/Makefile=10=subdir-ccflags-y += -I$(src)\ndrivers/net/ethernet/intel/iavf/Makefile-11-\ndrivers/net/ethernet/intel/iavf/Makefile:12:obj-$(CONFIG_IAVF) += iavf.o\ndrivers/net/ethernet/intel/iavf/Makefile-13-\n"
}

gemini-3.1-pro-preview

null

null

							input: 17706
							output: 18
							thoughts: 9
						

Okay, here's my summary, taking on the persona you've described:

**IDPF Emulation: A Quick Check**

Hmm, interesting. My immediate thought is, "Is there any current, actively maintained emulation of the IDPF standard?" I know ePub is the most common format, and the IDPF (International Digital Publishing Forum) was pivotal in its development. Now that the W3C has taken over, I'm curious if there are any projects out there that specifically focus on emulating the *older* IDPF specifications for compatibility testing, historical analysis, or perhaps even retro-computing purposes. I need to quickly determine if any such emulation exists, or if the focus has solely shifted to more contemporary standards. It's a key question when thinking about the evolution of the format itself.

{
  "Expression": "CONFIG_IDPF"
}

{
  "Output": "arch/loongarch/configs/loongson32_defconfig=595=CONFIG_IGC=y\narch/loongarch/configs/loongson32_defconfig:596:CONFIG_IDPF=y\narch/loongarch/configs/loongson32_defconfig-597-# CONFIG_NET_VENDOR_MARVELL is not set\n--\narch/loongarch/configs/loongson64_defconfig=611=CONFIG_IGC=y\narch/loongarch/configs/loongson64_defconfig:612:CONFIG_IDPF=y\narch/loongarch/configs/loongson64_defconfig-613-# CONFIG_NET_VENDOR_MARVELL is not set\n--\ndrivers/net/ethernet/intel/Makefile=20=obj-$(CONFIG_ICE) += ice/\ndrivers/net/ethernet/intel/Makefile:21:obj-$(CONFIG_IDPF) += idpf/\n--\ndrivers/net/ethernet/intel/idpf/Makefile-5-\ndrivers/net/ethernet/intel/idpf/Makefile:6:obj-$(CONFIG_IDPF) += idpf.o\ndrivers/net/ethernet/intel/idpf/Makefile-7-\ndrivers/net/ethernet/intel/idpf/Makefile=8=idpf-y := \\\n--\ndrivers/net/ethernet/intel/idpf/Makefile-19-\ndrivers/net/ethernet/intel/idpf/Makefile:20:idpf-$(CONFIG_IDPF_SINGLEQ)\t+= idpf_singleq_txrx.o\ndrivers/net/ethernet/intel/idpf/Makefile-21-\n--\ndrivers/net/ethernet/intel/idpf/idpf.h=746=static inline int idpf_is_queue_model_split(u16 q_model)\ndrivers/net/ethernet/intel/idpf/idpf.h-747-{\ndrivers/net/ethernet/intel/idpf/idpf.h:748:\treturn !IS_ENABLED(CONFIG_IDPF_SINGLEQ) ||\ndrivers/net/ethernet/intel/idpf/idpf.h-749-\t       q_model == VIRTCHNL2_QUEUE_MODEL_SPLIT;\n--\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c=1550=int idpf_send_create_vport_msg(struct idpf_adapter *adapter,\n--\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c-1570-\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c:1571:\tif (adapter-\u003ereq_tx_splitq || !IS_ENABLED(CONFIG_IDPF_SINGLEQ))\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c-1572-\t\tvport_msg-\u003etxq_model = cpu_to_le16(VIRTCHNL2_QUEUE_MODEL_SPLIT);\n--\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c-1575-\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c:1576:\tif (adapter-\u003ereq_rx_splitq || !IS_ENABLED(CONFIG_IDPF_SINGLEQ))\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c-1577-\t\tvport_msg-\u003erxq_model = cpu_to_le16(VIRTCHNL2_QUEUE_MODEL_SPLIT);\n--\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c=1626=int idpf_check_supported_desc_ids(struct idpf_vport *vport)\n--\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c-1634-\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c:1635:\tif (!IS_ENABLED(CONFIG_IDPF_SINGLEQ) \u0026\u0026\ndrivers/net/ethernet/intel/idpf/idpf_virtchnl.c-1636-\t    (vport_msg-\u003erxq_model == VIRTCHNL2_QUEUE_MODEL_SINGLE ||\n"
}

gemini-3.1-pro-preview

null

null

							input: 18969
							output: 88
							thoughts: 1047
						

**Analysis of Reachability for Fuzzing**

Okay, let's break this down. First, I need to determine if these changes warrant fuzzing. The immediate concern is whether the code paths are reachable in our standard virtualized environments, like GCE or QEMU. The prompt's wording is quite specific: "impossible to reach... even when utilizing software-emulated hardware". That's key.

My initial thought is to check for software emulation of `idpf`. Nope, there isn't any. That means these are hardware drivers, plain and simple. We're dealing with PCI drivers here, so let me quickly remember if syzkaller can reach these. Yes, `syz_pci` exists, it allows fuzzing of PCI drivers. But it's limited. It can inject a fake device but usually can't emulate hardware behaviors properly. Often, probe functions fail early because of this. Usually not worth fuzzing.

Now, let's look at the specific files. The changes are all within `drivers/net/ethernet/intel/iavf/`, `drivers/net/ethernet/intel/ice/`, and `drivers/net/ethernet/intel/idpf/`. Okay, these are all Intel Ethernet drivers, hardware-specific. Since they lack software emulation, and QEMU doesn't emulate the associated hardware, they're not reachable in a virtualized environment. The prompt is clear on this: if the paths are impossible to reach in the standard environment, return `WorthFuzzing=false`.

Just to be absolutely certain, let me quickly confirm that there's no software emulation for `iavf`, `ice`, or `idpf`. `iavf` is the Adaptive Virtual Function driver, interacting with the PF. `ice` is the PF driver, and `idpf` is the Infrastructure Data Path Function driver. Nope, no emulation in the upstream kernel, and QEMU doesn't emulate them. They're dead-ends in GCE or QEMU.

I'm comfortable with the analysis. The core of it boils down to the fact that these drivers are tied to specific Intel hardware without software emulation. They fall directly into the "impossible to reach" category. It's time to set the results and flag `WorthFuzzing=false`.

Okay, double check the files modified:  `iavf_virtchnl.c`, multiple `ice` files, and `idpf_virtchnl.c`. All Intel Ethernet drivers, all hardware dependent.

I'll finalize the result: `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies hardware-specific Intel Ethernet drivers (iavf, ice, idpf). These drivers require physical hardware and do not have software emulation in the kernel or QEMU, making them impossible to reach and fuzz in virtualized environments like GCE or QEMU.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies hardware-specific Intel Ethernet drivers (iavf, ice, idpf). These drivers require physical hardware and do not have software emulation in the kernel or QEMU, making them impossible to reach and fuzz in virtualized environments like GCE or QEMU.",
  "WorthFuzzing": false
}