AI Trajectory

null

{
  "EnableConfigs": [
    "PCIE_TPH",
    "PCI_P2PDMA"
  ],
  "FocusSymbols": [
    "vfio_pci_core_feature_dma_buf_tph",
    "pcie_tph_completer_type"
  ],
  "Reasoning": "The patch adds support for PCIe TLP Processing Hints (TPH) to DMA-BUF and VFIO. The new ioctl VFIO_DEVICE_FEATURE_DMA_BUF_TPH is reachable and can be fuzzed. The changes in drivers/pci/tph.c and drivers/vfio/pci/vfio_pci_dmabuf.c are functional and reachable.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 6d602a8e167464e0bd0a178e3e417b62ebf20cea\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 2 19:59:13 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c\nindex d504c636dc294e..e8314ed240d336 100644\n--- a/drivers/dma-buf/dma-buf.c\n+++ b/drivers/dma-buf/dma-buf.c\n@@ -939,6 +939,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach)\n  *     - dma_buf_unmap_attachment()\n  *     - dma_buf_vmap()\n  *     - dma_buf_vunmap()\n+ *     - dma_buf_get_pci_tph()\n  *\n  * 2. Importers must not hold the dma-buf reservation lock when calling these\n  *    functions:\n@@ -979,6 +980,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach)\n  *     - \u0026dma_buf_ops.unmap_dma_buf()\n  *     - \u0026dma_buf_ops.vmap()\n  *     - \u0026dma_buf_ops.vunmap()\n+ *     - \u0026dma_buf_ops.get_pci_tph()\n  *\n  * 3. Exporters must hold the dma-buf reservation lock when calling these\n  *    functions:\n@@ -1144,6 +1146,36 @@ void dma_buf_unpin(struct dma_buf_attachment *attach)\n }\n EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, \"DMA_BUF\");\n \n+/**\n+ * dma_buf_get_pci_tph - Retrieve PCIe TLP Processing Hint (TPH) metadata\n+ * @dmabuf: DMA buffer to query\n+ * @extended: false for 8-bit ST, true for 16-bit Extended ST\n+ * @steering_tag: returns the raw steering tag for the requested namespace\n+ * @ph: returns the TPH processing hint\n+ *\n+ * Wrapper for the optional \u0026dma_buf_ops.get_pci_tph callback.\n+ *\n+ * Must be called with \u0026dma_buf.resv held. Returns -EOPNOTSUPP if the\n+ * exporter does not implement the callback or has no metadata for the\n+ * requested namespace.\n+ *\n+ * The returned steering tag and processing hint are only valid until the\n+ * exporter invalidates the current mapping (signalled to the importer via\n+ * \u0026dma_buf_attach_ops.move_notify). Importers must re-query after a new\n+ * mapping is established following invalidation.\n+ */\n+int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\n+\t\t\tu16 *steering_tag, u8 *ph)\n+{\n+\tdma_resv_assert_held(dmabuf-\u003eresv);\n+\n+\tif (!dmabuf-\u003eops-\u003eget_pci_tph)\n+\t\treturn -EOPNOTSUPP;\n+\n+\treturn dmabuf-\u003eops-\u003eget_pci_tph(dmabuf, extended, steering_tag, ph);\n+}\n+EXPORT_SYMBOL_NS_GPL(dma_buf_get_pci_tph, \"DMA_BUF\");\n+\n /**\n  * dma_buf_map_attachment - Returns the scatterlist table of the attachment;\n  * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the\ndiff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c\nindex 02809114fc79af..a2b497f6b16bdc 100644\n--- a/drivers/infiniband/hw/mlx5/main.c\n+++ b/drivers/infiniband/hw/mlx5/main.c\n@@ -60,6 +60,7 @@\n MODULE_AUTHOR(\"Eli Cohen \u003celi@mellanox.com\u003e\");\n MODULE_DESCRIPTION(\"Mellanox 5th generation network adapters (ConnectX series) IB driver\");\n MODULE_LICENSE(\"Dual BSD/GPL\");\n+MODULE_IMPORT_NS(\"DMA_BUF\");\n \n struct mlx5_ib_event_work {\n \tstruct work_struct\twork;\ndiff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c\nindex e6b74955d95dcd..55216ae6376142 100644\n--- a/drivers/infiniband/hw/mlx5/mr.c\n+++ b/drivers/infiniband/hw/mlx5/mr.c\n@@ -39,6 +39,7 @@\n #include \u003clinux/delay.h\u003e\n #include \u003clinux/dma-buf.h\u003e\n #include \u003clinux/dma-resv.h\u003e\n+#include \u003clinux/pci-tph.h\u003e\n #include \u003crdma/frmr_pools.h\u003e\n #include \u003crdma/ib_umem_odp.h\u003e\n #include \"dm.h\"\n@@ -167,6 +168,39 @@ static int get_unchangeable_access_flags(struct mlx5_ib_dev *dev,\n #define MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK GENMASK_ULL(23, 16)\n #define MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK GENMASK_ULL(15, 0)\n \n+static u8 mlx5_ib_tph_key_ph(u8 ph)\n+{\n+\tif (ph == MLX5_IB_NO_PH || ph == 0)\n+\t\tph ^= MLX5_IB_NO_PH;\n+\n+\treturn ph;\n+}\n+\n+static int mlx5_ib_get_st_handle_ref(struct mlx5_ib_dev *dev, u16 st_index)\n+{\n+\tif (st_index == MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX)\n+\t\treturn 0;\n+\n+\treturn mlx5_st_get_index(dev-\u003emdev, st_index);\n+}\n+\n+static void mlx5_ib_put_st_index_ref(struct mlx5_ib_dev *dev, u16 st_index)\n+{\n+\tif (st_index == MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX)\n+\t\treturn;\n+\n+\tmlx5_st_dealloc_index(dev-\u003emdev, st_index);\n+}\n+\n+static void mlx5_ib_put_st_handle_ref(struct mlx5_ib_dev *dev,\n+\t\t\t\t      u64 kernel_vendor_key)\n+{\n+\tu16 st_index = FIELD_GET(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK,\n+\t\t\t\t kernel_vendor_key);\n+\n+\tmlx5_ib_put_st_index_ref(dev, st_index);\n+}\n+\n static struct mlx5_ib_mr *\n _mlx5_frmr_pool_alloc(struct mlx5_ib_dev *dev, struct ib_umem *umem,\n \t\t      int access_flags, int access_mode,\n@@ -189,13 +223,10 @@ _mlx5_frmr_pool_alloc(struct mlx5_ib_dev *dev, struct ib_umem *umem,\n \t\t\tMLX5_FRMR_POOLS_KEY_ACCESS_MODE_KSM_MASK :\n \t\t\t0;\n \n-\t/* Normalize ph: swap 0 and MLX5_IB_NO_PH */\n-\tif (ph == MLX5_IB_NO_PH || ph == 0)\n-\t\tph ^= MLX5_IB_NO_PH;\n-\n \tmr-\u003eibmr.frmr.key.kernel_vendor_key =\n \t\tFIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK, st_index) |\n-\t\tFIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK, ph);\n+\t\tFIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK,\n+\t\t\t   mlx5_ib_tph_key_ph(ph));\n \terr = ib_frmr_pool_pop(\u0026dev-\u003eib_dev, \u0026mr-\u003eibmr);\n \tif (err) {\n \t\tkfree(mr);\n@@ -218,7 +249,9 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(struct mlx5_ib_dev *dev,\n \t\t\t\t      0 :\n \t\t\t\t      MLX5_FRMR_POOLS_KEY_ACCESS_MODE_KSM_MASK,\n \t\t.num_dma_blocks = ndescs,\n-\t\t.kernel_vendor_key = 0, /* no PH and no ST index */\n+\t\t.kernel_vendor_key =\n+\t\t\tFIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK,\n+\t\t\t\t   MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX),\n \t};\n \tstruct mlx5_ib_mr *mr;\n \tint ret;\n@@ -557,6 +590,10 @@ static struct mlx5_ib_mr *reg_create(struct ib_pd *pd, struct ib_umem *umem,\n \tmr-\u003eibmr.pd = pd;\n \tmr-\u003eaccess_flags = access_flags;\n \tmr-\u003epage_shift = order_base_2(page_size);\n+\tmr-\u003eibmr.frmr.key.kernel_vendor_key =\n+\t\tFIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK, st_index) |\n+\t\tFIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK,\n+\t\t\t   mlx5_ib_tph_key_ph(ph));\n \n \tinlen = MLX5_ST_SZ_BYTES(create_mkey_in);\n \tif (populate)\n@@ -753,6 +790,12 @@ static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem,\n \t\t\tst_index = mdmah-\u003est_index;\n \t}\n \n+\terr = mlx5_ib_get_st_handle_ref(dev, st_index);\n+\tif (err) {\n+\t\tib_umem_release(umem);\n+\t\treturn ERR_PTR(err);\n+\t}\n+\n \txlt_with_umr = mlx5r_umr_can_load_pas(dev, umem-\u003elength);\n \tif (xlt_with_umr) {\n \t\tmr = alloc_cacheable_mr(pd, umem, iova, access_flags,\n@@ -769,6 +812,7 @@ static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem,\n \t\tmutex_unlock(\u0026dev-\u003eslow_path_mutex);\n \t}\n \tif (IS_ERR(mr)) {\n+\t\tmlx5_ib_put_st_index_ref(dev, st_index);\n \t\tib_umem_release(umem);\n \t\treturn ERR_CAST(mr);\n \t}\n@@ -903,6 +947,52 @@ static struct dma_buf_attach_ops mlx5_ib_dmabuf_attach_ops = {\n \t.invalidate_mappings = mlx5_ib_dmabuf_invalidate_cb,\n };\n \n+static void get_pci_tph_mr_dmabuf(struct mlx5_ib_dev *dev, struct dma_buf *dmabuf,\n+\t\t\t\t  u16 *st_index, u8 *ph)\n+{\n+\tu16 local_st_index;\n+\tu16 steering_tag;\n+\tu8 local_ph;\n+\tbool extended;\n+\tint ret;\n+\n+\tswitch (pcie_tph_enabled_req_type(dev-\u003emdev-\u003epdev)) {\n+\tcase PCI_TPH_REQ_TPH_ONLY:\n+\t\textended = false;\n+\t\tbreak;\n+\tcase PCI_TPH_REQ_EXT_TPH:\n+\t\textended = true;\n+\t\tbreak;\n+\tdefault:\n+\t\treturn;\n+\t}\n+\n+\tdma_resv_lock(dmabuf-\u003eresv, NULL);\n+\tret = dma_buf_get_pci_tph(dmabuf, extended, \u0026steering_tag, \u0026local_ph);\n+\tdma_resv_unlock(dmabuf-\u003eresv);\n+\tif (ret) {\n+\t\tif (ret != -EOPNOTSUPP)\n+\t\t\tmlx5_ib_dbg(dev, \"get_pci_tph failed (%d)\\n\", ret);\n+\t\treturn;\n+\t}\n+\n+\tret = mlx5_st_alloc_index_by_tag(dev-\u003emdev, steering_tag,\n+\t\t\t\t\t \u0026local_st_index);\n+\tif (ret) {\n+\t\tmlx5_ib_dbg(dev, \"st_alloc_index_by_tag failed (%d)\\n\", ret);\n+\t\treturn;\n+\t}\n+\n+\t*st_index = local_st_index;\n+\t*ph = local_ph;\n+}\n+\n+static void mlx5_ib_mr_put_st_handle_ref(struct mlx5_ib_mr *mr)\n+{\n+\tmlx5_ib_put_st_handle_ref(mr_to_mdev(mr),\n+\t\t\t\t  mr-\u003eibmr.frmr.key.kernel_vendor_key);\n+}\n+\n static struct ib_mr *\n reg_user_mr_dmabuf(struct ib_pd *pd, struct device *dma_device,\n \t\t   u64 offset, u64 length, u64 virt_addr,\n@@ -945,12 +1035,22 @@ reg_user_mr_dmabuf(struct ib_pd *pd, struct device *dma_device,\n \t\tph = dmah-\u003eph;\n \t\tif (dmah-\u003evalid_fields \u0026 BIT(IB_DMAH_CPU_ID_EXISTS))\n \t\t\tst_index = mdmah-\u003est_index;\n+\n+\t\terr = mlx5_ib_get_st_handle_ref(dev, st_index);\n+\t\tif (err) {\n+\t\t\tib_umem_release(\u0026umem_dmabuf-\u003eumem);\n+\t\t\treturn ERR_PTR(err);\n+\t\t}\n+\t} else {\n+\t\tget_pci_tph_mr_dmabuf(dev, umem_dmabuf-\u003eattach-\u003edmabuf,\n+\t\t\t\t      \u0026st_index, \u0026ph);\n \t}\n \n \tmr = alloc_cacheable_mr(pd, \u0026umem_dmabuf-\u003eumem, virt_addr,\n \t\t\t\taccess_flags, access_mode,\n \t\t\t\tst_index, ph);\n \tif (IS_ERR(mr)) {\n+\t\tmlx5_ib_put_st_index_ref(dev, st_index);\n \t\tib_umem_release(\u0026umem_dmabuf-\u003eumem);\n \t\treturn ERR_CAST(mr);\n \t}\n@@ -1405,6 +1505,7 @@ static int mlx5r_handle_mkey_cleanup(struct mlx5_ib_mr *mr)\n \tif (mr-\u003eibmr.frmr.pool) {\n \t\tif (!mlx5_umr_revoke_mr_with_lock(mr)) {\n \t\t\tib_frmr_pool_push(mr-\u003eibmr.device, \u0026mr-\u003eibmr);\n+\t\t\tmlx5_ib_mr_put_st_handle_ref(mr);\n \t\t\treturn 0;\n \t\t}\n \t}\n@@ -1432,6 +1533,9 @@ static int mlx5r_handle_mkey_cleanup(struct mlx5_ib_mr *mr)\n \tif (mr-\u003eibmr.frmr.pool \u0026\u0026 !ret)\n \t\tib_frmr_pool_drop(\u0026mr-\u003eibmr);\n \n+\tif (!ret)\n+\t\tmlx5_ib_mr_put_st_handle_ref(mr);\n+\n \treturn ret;\n }\n \ndiff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c\nindex 997be91f0a135a..bf14a7a6df15e1 100644\n--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c\n+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c\n@@ -92,23 +92,18 @@ void mlx5_st_destroy(struct mlx5_core_dev *dev)\n \tkfree(st);\n }\n \n-int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,\n-\t\t\tunsigned int cpu_uid, u16 *st_index)\n+int mlx5_st_alloc_index_by_tag(struct mlx5_core_dev *dev, u16 tag,\n+\t\t\t       u16 *st_index)\n {\n \tstruct mlx5_st_idx_data *idx_data;\n \tstruct mlx5_st *st = dev-\u003est;\n \tunsigned long index;\n \tu32 xa_id;\n-\tu16 tag;\n-\tint ret;\n+\tint ret = 0;\n \n \tif (!st)\n \t\treturn -EOPNOTSUPP;\n \n-\tret = pcie_tph_get_cpu_st(dev-\u003epdev, mem_type, cpu_uid, \u0026tag);\n-\tif (ret)\n-\t\treturn ret;\n-\n \tif (st-\u003edirect_mode) {\n \t\t*st_index = tag;\n \t\treturn 0;\n@@ -152,8 +147,46 @@ int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,\n \tmutex_unlock(\u0026st-\u003elock);\n \treturn ret;\n }\n+EXPORT_SYMBOL_GPL(mlx5_st_alloc_index_by_tag);\n+\n+int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,\n+\t\t\tunsigned int cpu_uid, u16 *st_index)\n+{\n+\tu16 tag;\n+\tint ret;\n+\n+\tret = pcie_tph_get_cpu_st(dev-\u003epdev, mem_type, cpu_uid, \u0026tag);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\treturn mlx5_st_alloc_index_by_tag(dev, tag, st_index);\n+}\n EXPORT_SYMBOL_GPL(mlx5_st_alloc_index);\n \n+int mlx5_st_get_index(struct mlx5_core_dev *dev, u16 st_index)\n+{\n+\tstruct mlx5_st_idx_data *idx_data;\n+\tstruct mlx5_st *st = dev-\u003est;\n+\tint ret = 0;\n+\n+\tif (!st)\n+\t\treturn -EOPNOTSUPP;\n+\n+\tif (st-\u003edirect_mode)\n+\t\treturn 0;\n+\n+\tmutex_lock(\u0026st-\u003elock);\n+\tidx_data = xa_load(\u0026st-\u003eidx_xa, st_index);\n+\tif (WARN_ON_ONCE(!idx_data))\n+\t\tret = -EINVAL;\n+\telse\n+\t\trefcount_inc(\u0026idx_data-\u003eusecount);\n+\tmutex_unlock(\u0026st-\u003elock);\n+\n+\treturn ret;\n+}\n+EXPORT_SYMBOL_GPL(mlx5_st_get_index);\n+\n int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index)\n {\n \tstruct mlx5_st_idx_data *idx_data;\ndiff --git a/drivers/pci/tph.c b/drivers/pci/tph.c\nindex 655ffd60e62f6a..e7693fd9d67637 100644\n--- a/drivers/pci/tph.c\n+++ b/drivers/pci/tph.c\n@@ -173,6 +173,51 @@ u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev)\n }\n EXPORT_SYMBOL(pcie_tph_get_st_table_loc);\n \n+/**\n+ * pcie_tph_enabled_req_type - Return the device's enabled TPH requester type\n+ * @pdev: PCI device to query\n+ *\n+ * Return: PCI_TPH_REQ_DISABLE, PCI_TPH_REQ_TPH_ONLY or PCI_TPH_REQ_EXT_TPH.\n+ */\n+u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)\n+{\n+\treturn pdev-\u003etph_req_type;\n+}\n+EXPORT_SYMBOL(pcie_tph_enabled_req_type);\n+\n+/**\n+ * pcie_tph_completer_type - Return the device's TPH Completer support\n+ * @pdev: PCI device to query\n+ *\n+ * Reads the \"TPH Completer Supported\" field (bits 13:12) of Device\n+ * Capabilities 2. The reserved 0b10 encoding is folded into\n+ * \"not supported\" so callers only need to compare against the three\n+ * defined values.\n+ *\n+ * Return: one of %PCI_EXP_DEVCAP2_TPH_COMP_NONE,\n+ *         %PCI_EXP_DEVCAP2_TPH_COMP_TPH_ONLY or\n+ *         %PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH.\n+ */\n+u8 pcie_tph_completer_type(struct pci_dev *pdev)\n+{\n+\tu32 reg;\n+\n+\tif (pcie_capability_read_dword(pdev, PCI_EXP_DEVCAP2, \u0026reg))\n+\t\treturn PCI_EXP_DEVCAP2_TPH_COMP_NONE;\n+\tif (PCI_POSSIBLE_ERROR(reg))\n+\t\treturn PCI_EXP_DEVCAP2_TPH_COMP_NONE;\n+\n+\tswitch (FIELD_GET(PCI_EXP_DEVCAP2_TPH_COMP_MASK, reg)) {\n+\tcase PCI_EXP_DEVCAP2_TPH_COMP_TPH_ONLY:\n+\t\treturn PCI_EXP_DEVCAP2_TPH_COMP_TPH_ONLY;\n+\tcase PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH:\n+\t\treturn PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH;\n+\tdefault:\n+\t\treturn PCI_EXP_DEVCAP2_TPH_COMP_NONE;\n+\t}\n+}\n+EXPORT_SYMBOL(pcie_tph_completer_type);\n+\n /*\n  * Return the size of ST table. If ST table is not in TPH Requester Extended\n  * Capability space, return 0. Otherwise return the ST Table Size + 1.\ndiff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c\nindex a28f1e99362c1e..c7d6902bc61b07 100644\n--- a/drivers/vfio/pci/vfio_pci_core.c\n+++ b/drivers/vfio/pci/vfio_pci_core.c\n@@ -1572,6 +1572,9 @@ int vfio_pci_core_ioctl_feature(struct vfio_device *device, u32 flags,\n \t\treturn vfio_pci_core_feature_token(vdev, flags, arg, argsz);\n \tcase VFIO_DEVICE_FEATURE_DMA_BUF:\n \t\treturn vfio_pci_core_feature_dma_buf(vdev, flags, arg, argsz);\n+\tcase VFIO_DEVICE_FEATURE_DMA_BUF_TPH:\n+\t\treturn vfio_pci_core_feature_dma_buf_tph(vdev, flags, arg,\n+\t\t\t\t\t\t\t argsz);\n \tdefault:\n \t\treturn -ENOTTY;\n \t}\ndiff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c\nindex c16f460c01d681..5351839c1338af 100644\n--- a/drivers/vfio/pci/vfio_pci_dmabuf.c\n+++ b/drivers/vfio/pci/vfio_pci_dmabuf.c\n@@ -3,6 +3,7 @@\n  */\n #include \u003clinux/dma-buf-mapping.h\u003e\n #include \u003clinux/pci-p2pdma.h\u003e\n+#include \u003clinux/pci-tph.h\u003e\n #include \u003clinux/dma-resv.h\u003e\n \n #include \"vfio_pci_priv.h\"\n@@ -19,7 +20,17 @@ struct vfio_pci_dma_buf {\n \tu32 nr_ranges;\n \tstruct kref kref;\n \tstruct completion comp;\n-\tu8 revoked : 1;\n+\n+\t/*\n+\t * Updates protected by dmabuf-\u003eresv, @revoked additionally\n+\t * protected by memory_lock.\n+\t */\n+\tu16 tph_st_ext;\n+\tu8 tph_st;\n+\tbool revoked;\n+\tu8 tph_st_valid:1;\n+\tu8 tph_st_ext_valid:1;\n+\tu8 tph_ph:2;\n };\n \n static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf,\n@@ -30,7 +41,7 @@ static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf,\n \tif (!attachment-\u003epeer2peer)\n \t\treturn -EOPNOTSUPP;\n \n-\tif (priv-\u003erevoked)\n+\tif (READ_ONCE(priv-\u003erevoked))\n \t\treturn -ENODEV;\n \n \tif (!dma_buf_attach_revocable(attachment))\n@@ -69,6 +80,26 @@ vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment,\n \treturn ret;\n }\n \n+static int vfio_pci_dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\n+\t\t\t\t\tu16 *steering_tag, u8 *ph)\n+{\n+\tstruct vfio_pci_dma_buf *priv = dmabuf-\u003epriv;\n+\n+\tdma_resv_assert_held(dmabuf-\u003eresv);\n+\n+\tif (extended) {\n+\t\tif (!priv-\u003etph_st_ext_valid)\n+\t\t\treturn -EOPNOTSUPP;\n+\t\t*steering_tag = priv-\u003etph_st_ext;\n+\t} else {\n+\t\tif (!priv-\u003etph_st_valid)\n+\t\t\treturn -EOPNOTSUPP;\n+\t\t*steering_tag = priv-\u003etph_st;\n+\t}\n+\t*ph = priv-\u003etph_ph;\n+\treturn 0;\n+}\n+\n static void vfio_pci_dma_buf_unmap(struct dma_buf_attachment *attachment,\n \t\t\t\t   struct sg_table *sgt,\n \t\t\t\t   enum dma_data_direction dir)\n@@ -101,6 +132,7 @@ static void vfio_pci_dma_buf_release(struct dma_buf *dmabuf)\n \n static const struct dma_buf_ops vfio_pci_dmabuf_ops = {\n \t.attach = vfio_pci_dma_buf_attach,\n+\t.get_pci_tph = vfio_pci_dma_buf_get_pci_tph,\n \t.map_dma_buf = vfio_pci_dma_buf_map,\n \t.unmap_dma_buf = vfio_pci_dma_buf_unmap,\n \t.release = vfio_pci_dma_buf_release,\n@@ -333,6 +365,72 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,\n \treturn ret;\n }\n \n+int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,\n+\t\t\t\t      u32 flags,\n+\t\t\t\t      struct vfio_device_feature_dma_buf_tph __user *arg,\n+\t\t\t\t      size_t argsz)\n+{\n+\tstruct vfio_device_feature_dma_buf_tph set_tph;\n+\tstruct vfio_pci_dma_buf *priv;\n+\tstruct dma_buf *dmabuf;\n+\tu8 comp;\n+\tint ret;\n+\n+\tcomp = pcie_tph_completer_type(vdev-\u003epdev);\n+\tif (comp == PCI_EXP_DEVCAP2_TPH_COMP_NONE)\n+\t\treturn -EOPNOTSUPP;\n+\n+\tret = vfio_check_feature(flags, argsz, VFIO_DEVICE_FEATURE_SET,\n+\t\t\t\t sizeof(set_tph));\n+\tif (ret != 1)\n+\t\treturn ret;\n+\n+\tif (copy_from_user(\u0026set_tph, arg, sizeof(set_tph)))\n+\t\treturn -EFAULT;\n+\n+\tif (set_tph.flags \u0026 ~(VFIO_DMA_BUF_TPH_ST | VFIO_DMA_BUF_TPH_ST_EXT))\n+\t\treturn -EINVAL;\n+\n+\tif (set_tph.ph \u0026 ~0x3)\n+\t\treturn -EINVAL;\n+\n+\tif ((set_tph.flags \u0026 VFIO_DMA_BUF_TPH_ST_EXT) \u0026\u0026\n+\t    comp != PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH)\n+\t\treturn -EOPNOTSUPP;\n+\n+\tdmabuf = dma_buf_get(set_tph.dmabuf_fd);\n+\tif (IS_ERR(dmabuf))\n+\t\treturn PTR_ERR(dmabuf);\n+\n+\tif (dmabuf-\u003eops != \u0026vfio_pci_dmabuf_ops) {\n+\t\tret = -EINVAL;\n+\t\tgoto out_put;\n+\t}\n+\n+\tpriv = dmabuf-\u003epriv;\n+\tif (priv-\u003evdev != vdev) {\n+\t\tret = -EINVAL;\n+\t\tgoto out_put;\n+\t}\n+\n+\tret = dma_resv_lock_interruptible(dmabuf-\u003eresv, NULL);\n+\tif (ret)\n+\t\tgoto out_put;\n+\n+\tpriv-\u003etph_st         = set_tph.steering_tag;\n+\tpriv-\u003etph_st_ext     = set_tph.steering_tag_ext;\n+\tpriv-\u003etph_ph         = set_tph.ph;\n+\tpriv-\u003etph_st_valid   = !!(set_tph.flags \u0026 VFIO_DMA_BUF_TPH_ST);\n+\tpriv-\u003etph_st_ext_valid =\n+\t\t!!(set_tph.flags \u0026 VFIO_DMA_BUF_TPH_ST_EXT);\n+\tdma_resv_unlock(dmabuf-\u003eresv);\n+\tret = 0;\n+\n+out_put:\n+\tdma_buf_put(dmabuf);\n+\treturn ret;\n+}\n+\n void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked)\n {\n \tstruct vfio_pci_dma_buf *priv;\ndiff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h\nindex fca9d0dfac90f8..c58f369be4b398 100644\n--- a/drivers/vfio/pci/vfio_pci_priv.h\n+++ b/drivers/vfio/pci/vfio_pci_priv.h\n@@ -118,6 +118,10 @@ static inline bool vfio_pci_is_vga(struct pci_dev *pdev)\n int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,\n \t\t\t\t  struct vfio_device_feature_dma_buf __user *arg,\n \t\t\t\t  size_t argsz);\n+int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,\n+\t\t\t\t      u32 flags,\n+\t\t\t\t      struct vfio_device_feature_dma_buf_tph __user *arg,\n+\t\t\t\t      size_t argsz);\n void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev);\n void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked);\n #else\n@@ -128,6 +132,14 @@ vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,\n {\n \treturn -ENOTTY;\n }\n+\n+static inline int\n+vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev, u32 flags,\n+\t\t\t\t  struct vfio_device_feature_dma_buf_tph __user *arg,\n+\t\t\t\t  size_t argsz)\n+{\n+\treturn -ENOTTY;\n+}\n static inline void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev)\n {\n }\ndiff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h\nindex d1203da56fc5f7..14e8eb61a62c04 100644\n--- a/include/linux/dma-buf.h\n+++ b/include/linux/dma-buf.h\n@@ -113,6 +113,29 @@ struct dma_buf_ops {\n \t */\n \tvoid (*unpin)(struct dma_buf_attachment *attach);\n \n+\t/**\n+\t * @get_pci_tph:\n+\t *\n+\t * Retrieve PCIe TLP Processing Hint (TPH) steering metadata for\n+\t * this buffer so an importer can program a matching ST/PH hint on\n+\t * outbound TLPs targeting the exporter for peer-to-peer DMA.\n+\t *\n+\t * @dmabuf: DMA buffer for which to retrieve TPH metadata\n+\t * @extended: false for 8-bit ST, true for 16-bit Extended ST\n+\t * @steering_tag: Returns the raw TPH steering tag for the requested\n+\t *                namespace\n+\t * @ph: Returns the TPH processing hint (2-bit value)\n+\t *\n+\t * Optional callback for dma_buf_get_pci_tph(). Called with\n+\t * \u0026dma_buf.resv held. Returns 0 on success or -EOPNOTSUPP when\n+\t * the exporter has no metadata for the requested namespace.\n+\t *\n+\t * Returned metadata follows the lifetime rules documented for\n+\t * dma_buf_get_pci_tph().\n+\t */\n+\tint (*get_pci_tph)(struct dma_buf *dmabuf, bool extended,\n+\t\t\t   u16 *steering_tag, u8 *ph);\n+\n \t/**\n \t * @map_dma_buf:\n \t *\n@@ -563,6 +586,8 @@ void dma_buf_detach(struct dma_buf *dmabuf,\n \t\t    struct dma_buf_attachment *attach);\n int dma_buf_pin(struct dma_buf_attachment *attach);\n void dma_buf_unpin(struct dma_buf_attachment *attach);\n+int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\n+\t\t\tu16 *steering_tag, u8 *ph);\n \n struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info);\n \ndiff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h\nindex b1871c0821d0b9..d26e5744c843bf 100644\n--- a/include/linux/mlx5/driver.h\n+++ b/include/linux/mlx5/driver.h\n@@ -1182,16 +1182,31 @@ int mlx5_dm_sw_icm_dealloc(struct mlx5_core_dev *dev, enum mlx5_sw_icm_type type\n \t\t\t   u64 length, u16 uid, phys_addr_t addr, u32 obj_id);\n \n #ifdef CONFIG_PCIE_TPH\n+int mlx5_st_alloc_index_by_tag(struct mlx5_core_dev *dev, u16 tag,\n+\t\t\t       u16 *st_index);\n+int mlx5_st_get_index(struct mlx5_core_dev *dev, u16 st_index);\n int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,\n \t\t\tunsigned int cpu_uid, u16 *st_index);\n int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index);\n #else\n+static inline int mlx5_st_alloc_index_by_tag(struct mlx5_core_dev *dev,\n+\t\t\t\t\t     u16 tag, u16 *st_index)\n+{\n+\treturn -EOPNOTSUPP;\n+}\n+\n+static inline int mlx5_st_get_index(struct mlx5_core_dev *dev, u16 st_index)\n+{\n+\treturn -EOPNOTSUPP;\n+}\n+\n static inline int mlx5_st_alloc_index(struct mlx5_core_dev *dev,\n \t\t\t\t      enum tph_mem_type mem_type,\n \t\t\t\t      unsigned int cpu_uid, u16 *st_index)\n {\n \treturn -EOPNOTSUPP;\n }\n+\n static inline int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index)\n {\n \treturn -EOPNOTSUPP;\ndiff --git a/include/linux/pci-tph.h b/include/linux/pci-tph.h\nindex be68cd17f2f833..7743af6fe4326e 100644\n--- a/include/linux/pci-tph.h\n+++ b/include/linux/pci-tph.h\n@@ -9,6 +9,8 @@\n #ifndef LINUX_PCI_TPH_H\n #define LINUX_PCI_TPH_H\n \n+#include \u003clinux/pci_regs.h\u003e\n+\n /*\n  * According to the ECN for PCI Firmware Spec, Steering Tag can be different\n  * depending on the memory type: Volatile Memory or Persistent Memory. When a\n@@ -30,6 +32,8 @@ void pcie_disable_tph(struct pci_dev *pdev);\n int pcie_enable_tph(struct pci_dev *pdev, int mode);\n u16 pcie_tph_get_st_table_size(struct pci_dev *pdev);\n u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev);\n+u8 pcie_tph_enabled_req_type(struct pci_dev *pdev);\n+u8 pcie_tph_completer_type(struct pci_dev *pdev);\n #else\n static inline int pcie_tph_set_st_entry(struct pci_dev *pdev,\n \t\t\t\t\tunsigned int index, u16 tag)\n@@ -41,6 +45,10 @@ static inline int pcie_tph_get_cpu_st(struct pci_dev *dev,\n static inline void pcie_disable_tph(struct pci_dev *pdev) { }\n static inline int pcie_enable_tph(struct pci_dev *pdev, int mode)\n { return -EINVAL; }\n+static inline u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)\n+{ return PCI_TPH_REQ_DISABLE; }\n+static inline u8 pcie_tph_completer_type(struct pci_dev *pdev)\n+{ return PCI_EXP_DEVCAP2_TPH_COMP_NONE; }\n #endif\n \n #endif /* LINUX_PCI_TPH_H */\ndiff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h\nindex 5de618a3a5eeee..4c1c70aac15097 100644\n--- a/include/uapi/linux/vfio.h\n+++ b/include/uapi/linux/vfio.h\n@@ -1534,6 +1534,49 @@ struct vfio_device_feature_dma_buf {\n  */\n #define VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2  12\n \n+/**\n+ * Upon VFIO_DEVICE_FEATURE_SET associate TPH (TLP Processing Hints) metadata\n+ * with a vfio-exported dma-buf. The dma-buf must have been created by\n+ * VFIO_DEVICE_FEATURE_DMA_BUF on this device, and the device must report\n+ * TPH Completer support in Device Capabilities 2 (bits 13:12); requests\n+ * carrying VFIO_DMA_BUF_TPH_ST_EXT additionally require the device to\n+ * report the Extended TPH Completer encoding. Otherwise the ioctl\n+ * returns -EOPNOTSUPP.\n+ *\n+ * @dmabuf_fd is the file descriptor returned by VFIO_DEVICE_FEATURE_DMA_BUF.\n+ *\n+ * 8-bit ST (@steering_tag) and 16-bit Extended ST (@steering_tag_ext) are\n+ * distinct namespaces. @flags is the authoritative validity mask for the\n+ * two namespaces: VFIO_DMA_BUF_TPH_ST marks @steering_tag valid and\n+ * VFIO_DMA_BUF_TPH_ST_EXT marks @steering_tag_ext valid. An importer\n+ * requests one namespace and receives the matching value.\n+ *\n+ * Each SET fully replaces the dma-buf's TPH state for future queries\n+ * only. A namespace whose flag bit is clear is reported as unsupported\n+ * to future importers; an importer that has already retrieved a value\n+ * is unaffected. @flags == 0 leaves both namespaces unsupported for\n+ * future importers.\n+ *\n+ * @ph is the 2-bit TLP Processing Hint and must be in the range [0, 3].\n+ *\n+ * Undefined @flags and @ph bits must always be zero.\n+ *\n+ * Userspace must configure TPH before handing the dma-buf fd to an\n+ * importer.\n+ */\n+#define VFIO_DEVICE_FEATURE_DMA_BUF_TPH 13\n+\n+#define VFIO_DMA_BUF_TPH_ST\t\t(1 \u003c\u003c 0)\n+#define VFIO_DMA_BUF_TPH_ST_EXT\t\t(1 \u003c\u003c 1)\n+\n+struct vfio_device_feature_dma_buf_tph {\n+\t__s32\tdmabuf_fd;\n+\t__u32\tflags;\n+\t__u16\tsteering_tag_ext;\n+\t__u8\tsteering_tag;\n+\t__u8\tph;\n+};\n+\n /* -------- API for Type1 VFIO IOMMU -------- */\n \n /**\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "PCIE_TPH",
    "PCI_P2PDMA"
  ],
  "FocusSymbols": [
    "vfio_pci_core_feature_dma_buf_tph",
    "pcie_tph_completer_type"
  ],
  "Reasoning": "The patch adds support for PCIe TLP Processing Hints (TPH) to DMA-BUF and VFIO. The new ioctl VFIO_DEVICE_FEATURE_DMA_BUF_TPH is reachable and can be fuzzed. The changes in drivers/pci/tph.c and drivers/vfio/pci/vfio_pci_dmabuf.c are functional and reachable.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 6d602a8e167464e0bd0a178e3e417b62ebf20cea
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 2 19:59:13 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index d504c636dc294e..e8314ed240d336 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -939,6 +939,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach)
  *     - dma_buf_unmap_attachment()
  *     - dma_buf_vmap()
  *     - dma_buf_vunmap()
+ *     - dma_buf_get_pci_tph()
  *
  * 2. Importers must not hold the dma-buf reservation lock when calling these
  *    functions:
@@ -979,6 +980,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach)
  *     - &dma_buf_ops.unmap_dma_buf()
  *     - &dma_buf_ops.vmap()
  *     - &dma_buf_ops.vunmap()
+ *     - &dma_buf_ops.get_pci_tph()
  *
  * 3. Exporters must hold the dma-buf reservation lock when calling these
  *    functions:
@@ -1144,6 +1146,36 @@ void dma_buf_unpin(struct dma_buf_attachment *attach)
 }
 EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, "DMA_BUF");
 
+/**
+ * dma_buf_get_pci_tph - Retrieve PCIe TLP Processing Hint (TPH) metadata
+ * @dmabuf: DMA buffer to query
+ * @extended: false for 8-bit ST, true for 16-bit Extended ST
+ * @steering_tag: returns the raw steering tag for the requested namespace
+ * @ph: returns the TPH processing hint
+ *
+ * Wrapper for the optional &dma_buf_ops.get_pci_tph callback.
+ *
+ * Must be called with &dma_buf.resv held. Returns -EOPNOTSUPP if the
+ * exporter does not implement the callback or has no metadata for the
+ * requested namespace.
+ *
+ * The returned steering tag and processing hint are only valid until the
+ * exporter invalidates the current mapping (signalled to the importer via
+ * &dma_buf_attach_ops.move_notify). Importers must re-query after a new
+ * mapping is established following invalidation.
+ */
+int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,
+			u16 *steering_tag, u8 *ph)
+{
+	dma_resv_assert_held(dmabuf->resv);
+
+	if (!dmabuf->ops->get_pci_tph)
+		return -EOPNOTSUPP;
+
+	return dmabuf->ops->get_pci_tph(dmabuf, extended, steering_tag, ph);
+}
+EXPORT_SYMBOL_NS_GPL(dma_buf_get_pci_tph, "DMA_BUF");
+
 /**
  * dma_buf_map_attachment - Returns the scatterlist table of the attachment;
  * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 02809114fc79af..a2b497f6b16bdc 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -60,6 +60,7 @@
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox 5th generation network adapters (ConnectX series) IB driver");
 MODULE_LICENSE("Dual BSD/GPL");
+MODULE_IMPORT_NS("DMA_BUF");
 
 struct mlx5_ib_event_work {
 	struct work_struct	work;
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index e6b74955d95dcd..55216ae6376142 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -39,6 +39,7 @@
 #include <linux/delay.h>
 #include <linux/dma-buf.h>
 #include <linux/dma-resv.h>
+#include <linux/pci-tph.h>
 #include <rdma/frmr_pools.h>
 #include <rdma/ib_umem_odp.h>
 #include "dm.h"
@@ -167,6 +168,39 @@ static int get_unchangeable_access_flags(struct mlx5_ib_dev *dev,
 #define MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK GENMASK_ULL(23, 16)
 #define MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK GENMASK_ULL(15, 0)
 
+static u8 mlx5_ib_tph_key_ph(u8 ph)
+{
+	if (ph == MLX5_IB_NO_PH || ph == 0)
+		ph ^= MLX5_IB_NO_PH;
+
+	return ph;
+}
+
+static int mlx5_ib_get_st_handle_ref(struct mlx5_ib_dev *dev, u16 st_index)
+{
+	if (st_index == MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX)
+		return 0;
+
+	return mlx5_st_get_index(dev->mdev, st_index);
+}
+
+static void mlx5_ib_put_st_index_ref(struct mlx5_ib_dev *dev, u16 st_index)
+{
+	if (st_index == MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX)
+		return;
+
+	mlx5_st_dealloc_index(dev->mdev, st_index);
+}
+
+static void mlx5_ib_put_st_handle_ref(struct mlx5_ib_dev *dev,
+				      u64 kernel_vendor_key)
+{
+	u16 st_index = FIELD_GET(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK,
+				 kernel_vendor_key);
+
+	mlx5_ib_put_st_index_ref(dev, st_index);
+}
+
 static struct mlx5_ib_mr *
 _mlx5_frmr_pool_alloc(struct mlx5_ib_dev *dev, struct ib_umem *umem,
 		      int access_flags, int access_mode,
@@ -189,13 +223,10 @@ _mlx5_frmr_pool_alloc(struct mlx5_ib_dev *dev, struct ib_umem *umem,
 			MLX5_FRMR_POOLS_KEY_ACCESS_MODE_KSM_MASK :
 			0;
 
-	/* Normalize ph: swap 0 and MLX5_IB_NO_PH */
-	if (ph == MLX5_IB_NO_PH || ph == 0)
-		ph ^= MLX5_IB_NO_PH;
-
 	mr->ibmr.frmr.key.kernel_vendor_key =
 		FIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK, st_index) |
-		FIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK, ph);
+		FIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK,
+			   mlx5_ib_tph_key_ph(ph));
 	err = ib_frmr_pool_pop(&dev->ib_dev, &mr->ibmr);
 	if (err) {
 		kfree(mr);
@@ -218,7 +249,9 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(struct mlx5_ib_dev *dev,
 				      0 :
 				      MLX5_FRMR_POOLS_KEY_ACCESS_MODE_KSM_MASK,
 		.num_dma_blocks = ndescs,
-		.kernel_vendor_key = 0, /* no PH and no ST index */
+		.kernel_vendor_key =
+			FIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK,
+				   MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX),
 	};
 	struct mlx5_ib_mr *mr;
 	int ret;
@@ -557,6 +590,10 @@ static struct mlx5_ib_mr *reg_create(struct ib_pd *pd, struct ib_umem *umem,
 	mr->ibmr.pd = pd;
 	mr->access_flags = access_flags;
 	mr->page_shift = order_base_2(page_size);
+	mr->ibmr.frmr.key.kernel_vendor_key =
+		FIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_ST_INDEX_MASK, st_index) |
+		FIELD_PREP(MLX5_FRMR_POOLS_KERNEL_KEY_PH_MASK,
+			   mlx5_ib_tph_key_ph(ph));
 
 	inlen = MLX5_ST_SZ_BYTES(create_mkey_in);
 	if (populate)
@@ -753,6 +790,12 @@ static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem,
 			st_index = mdmah->st_index;
 	}
 
+	err = mlx5_ib_get_st_handle_ref(dev, st_index);
+	if (err) {
+		ib_umem_release(umem);
+		return ERR_PTR(err);
+	}
+
 	xlt_with_umr = mlx5r_umr_can_load_pas(dev, umem->length);
 	if (xlt_with_umr) {
 		mr = alloc_cacheable_mr(pd, umem, iova, access_flags,
@@ -769,6 +812,7 @@ static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem,
 		mutex_unlock(&dev->slow_path_mutex);
 	}
 	if (IS_ERR(mr)) {
+		mlx5_ib_put_st_index_ref(dev, st_index);
 		ib_umem_release(umem);
 		return ERR_CAST(mr);
 	}
@@ -903,6 +947,52 @@ static struct dma_buf_attach_ops mlx5_ib_dmabuf_attach_ops = {
 	.invalidate_mappings = mlx5_ib_dmabuf_invalidate_cb,
 };
 
+static void get_pci_tph_mr_dmabuf(struct mlx5_ib_dev *dev, struct dma_buf *dmabuf,
+				  u16 *st_index, u8 *ph)
+{
+	u16 local_st_index;
+	u16 steering_tag;
+	u8 local_ph;
+	bool extended;
+	int ret;
+
+	switch (pcie_tph_enabled_req_type(dev->mdev->pdev)) {
+	case PCI_TPH_REQ_TPH_ONLY:
+		extended = false;
+		break;
+	case PCI_TPH_REQ_EXT_TPH:
+		extended = true;
+		break;
+	default:
+		return;
+	}
+
+	dma_resv_lock(dmabuf->resv, NULL);
+	ret = dma_buf_get_pci_tph(dmabuf, extended, &steering_tag, &local_ph);
+	dma_resv_unlock(dmabuf->resv);
+	if (ret) {
+		if (ret != -EOPNOTSUPP)
+			mlx5_ib_dbg(dev, "get_pci_tph failed (%d)\n", ret);
+		return;
+	}
+
+	ret = mlx5_st_alloc_index_by_tag(dev->mdev, steering_tag,
+					 &local_st_index);
+	if (ret) {
+		mlx5_ib_dbg(dev, "st_alloc_index_by_tag failed (%d)\n", ret);
+		return;
+	}
+
+	*st_index = local_st_index;
+	*ph = local_ph;
+}
+
+static void mlx5_ib_mr_put_st_handle_ref(struct mlx5_ib_mr *mr)
+{
+	mlx5_ib_put_st_handle_ref(mr_to_mdev(mr),
+				  mr->ibmr.frmr.key.kernel_vendor_key);
+}
+
 static struct ib_mr *
 reg_user_mr_dmabuf(struct ib_pd *pd, struct device *dma_device,
 		   u64 offset, u64 length, u64 virt_addr,
@@ -945,12 +1035,22 @@ reg_user_mr_dmabuf(struct ib_pd *pd, struct device *dma_device,
 		ph = dmah->ph;
 		if (dmah->valid_fields & BIT(IB_DMAH_CPU_ID_EXISTS))
 			st_index = mdmah->st_index;
+
+		err = mlx5_ib_get_st_handle_ref(dev, st_index);
+		if (err) {
+			ib_umem_release(&umem_dmabuf->umem);
+			return ERR_PTR(err);
+		}
+	} else {
+		get_pci_tph_mr_dmabuf(dev, umem_dmabuf->attach->dmabuf,
+				      &st_index, &ph);
 	}
 
 	mr = alloc_cacheable_mr(pd, &umem_dmabuf->umem, virt_addr,
 				access_flags, access_mode,
 				st_index, ph);
 	if (IS_ERR(mr)) {
+		mlx5_ib_put_st_index_ref(dev, st_index);
 		ib_umem_release(&umem_dmabuf->umem);
 		return ERR_CAST(mr);
 	}
@@ -1405,6 +1505,7 @@ static int mlx5r_handle_mkey_cleanup(struct mlx5_ib_mr *mr)
 	if (mr->ibmr.frmr.pool) {
 		if (!mlx5_umr_revoke_mr_with_lock(mr)) {
 			ib_frmr_pool_push(mr->ibmr.device, &mr->ibmr);
+			mlx5_ib_mr_put_st_handle_ref(mr);
 			return 0;
 		}
 	}
@@ -1432,6 +1533,9 @@ static int mlx5r_handle_mkey_cleanup(struct mlx5_ib_mr *mr)
 	if (mr->ibmr.frmr.pool && !ret)
 		ib_frmr_pool_drop(&mr->ibmr);
 
+	if (!ret)
+		mlx5_ib_mr_put_st_handle_ref(mr);
+
 	return ret;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c
index 997be91f0a135a..bf14a7a6df15e1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c
@@ -92,23 +92,18 @@ void mlx5_st_destroy(struct mlx5_core_dev *dev)
 	kfree(st);
 }
 
-int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,
-			unsigned int cpu_uid, u16 *st_index)
+int mlx5_st_alloc_index_by_tag(struct mlx5_core_dev *dev, u16 tag,
+			       u16 *st_index)
 {
 	struct mlx5_st_idx_data *idx_data;
 	struct mlx5_st *st = dev->st;
 	unsigned long index;
 	u32 xa_id;
-	u16 tag;
-	int ret;
+	int ret = 0;
 
 	if (!st)
 		return -EOPNOTSUPP;
 
-	ret = pcie_tph_get_cpu_st(dev->pdev, mem_type, cpu_uid, &tag);
-	if (ret)
-		return ret;
-
 	if (st->direct_mode) {
 		*st_index = tag;
 		return 0;
@@ -152,8 +147,46 @@ int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,
 	mutex_unlock(&st->lock);
 	return ret;
 }
+EXPORT_SYMBOL_GPL(mlx5_st_alloc_index_by_tag);
+
+int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,
+			unsigned int cpu_uid, u16 *st_index)
+{
+	u16 tag;
+	int ret;
+
+	ret = pcie_tph_get_cpu_st(dev->pdev, mem_type, cpu_uid, &tag);
+	if (ret)
+		return ret;
+
+	return mlx5_st_alloc_index_by_tag(dev, tag, st_index);
+}
 EXPORT_SYMBOL_GPL(mlx5_st_alloc_index);
 
+int mlx5_st_get_index(struct mlx5_core_dev *dev, u16 st_index)
+{
+	struct mlx5_st_idx_data *idx_data;
+	struct mlx5_st *st = dev->st;
+	int ret = 0;
+
+	if (!st)
+		return -EOPNOTSUPP;
+
+	if (st->direct_mode)
+		return 0;
+
+	mutex_lock(&st->lock);
+	idx_data = xa_load(&st->idx_xa, st_index);
+	if (WARN_ON_ONCE(!idx_data))
+		ret = -EINVAL;
+	else
+		refcount_inc(&idx_data->usecount);
+	mutex_unlock(&st->lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mlx5_st_get_index);
+
 int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index)
 {
 	struct mlx5_st_idx_data *idx_data;
diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
index 655ffd60e62f6a..e7693fd9d67637 100644
--- a/drivers/pci/tph.c
+++ b/drivers/pci/tph.c
@@ -173,6 +173,51 @@ u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev)
 }
 EXPORT_SYMBOL(pcie_tph_get_st_table_loc);
 
+/**
+ * pcie_tph_enabled_req_type - Return the device's enabled TPH requester type
+ * @pdev: PCI device to query
+ *
+ * Return: PCI_TPH_REQ_DISABLE, PCI_TPH_REQ_TPH_ONLY or PCI_TPH_REQ_EXT_TPH.
+ */
+u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)
+{
+	return pdev->tph_req_type;
+}
+EXPORT_SYMBOL(pcie_tph_enabled_req_type);
+
+/**
+ * pcie_tph_completer_type - Return the device's TPH Completer support
+ * @pdev: PCI device to query
+ *
+ * Reads the "TPH Completer Supported" field (bits 13:12) of Device
+ * Capabilities 2. The reserved 0b10 encoding is folded into
+ * "not supported" so callers only need to compare against the three
+ * defined values.
+ *
+ * Return: one of %PCI_EXP_DEVCAP2_TPH_COMP_NONE,
+ *         %PCI_EXP_DEVCAP2_TPH_COMP_TPH_ONLY or
+ *         %PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH.
+ */
+u8 pcie_tph_completer_type(struct pci_dev *pdev)
+{
+	u32 reg;
+
+	if (pcie_capability_read_dword(pdev, PCI_EXP_DEVCAP2, &reg))
+		return PCI_EXP_DEVCAP2_TPH_COMP_NONE;
+	if (PCI_POSSIBLE_ERROR(reg))
+		return PCI_EXP_DEVCAP2_TPH_COMP_NONE;
+
+	switch (FIELD_GET(PCI_EXP_DEVCAP2_TPH_COMP_MASK, reg)) {
+	case PCI_EXP_DEVCAP2_TPH_COMP_TPH_ONLY:
+		return PCI_EXP_DEVCAP2_TPH_COMP_TPH_ONLY;
+	case PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH:
+		return PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH;
+	default:
+		return PCI_EXP_DEVCAP2_TPH_COMP_NONE;
+	}
+}
+EXPORT_SYMBOL(pcie_tph_completer_type);
+
 /*
  * Return the size of ST table. If ST table is not in TPH Requester Extended
  * Capability space, return 0. Otherwise return the ST Table Size + 1.
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index a28f1e99362c1e..c7d6902bc61b07 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -1572,6 +1572,9 @@ int vfio_pci_core_ioctl_feature(struct vfio_device *device, u32 flags,
 		return vfio_pci_core_feature_token(vdev, flags, arg, argsz);
 	case VFIO_DEVICE_FEATURE_DMA_BUF:
 		return vfio_pci_core_feature_dma_buf(vdev, flags, arg, argsz);
+	case VFIO_DEVICE_FEATURE_DMA_BUF_TPH:
+		return vfio_pci_core_feature_dma_buf_tph(vdev, flags, arg,
+							 argsz);
 	default:
 		return -ENOTTY;
 	}
diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c
index c16f460c01d681..5351839c1338af 100644
--- a/drivers/vfio/pci/vfio_pci_dmabuf.c
+++ b/drivers/vfio/pci/vfio_pci_dmabuf.c
@@ -3,6 +3,7 @@
  */
 #include <linux/dma-buf-mapping.h>
 #include <linux/pci-p2pdma.h>
+#include <linux/pci-tph.h>
 #include <linux/dma-resv.h>
 
 #include "vfio_pci_priv.h"
@@ -19,7 +20,17 @@ struct vfio_pci_dma_buf {
 	u32 nr_ranges;
 	struct kref kref;
 	struct completion comp;
-	u8 revoked : 1;
+
+	/*
+	 * Updates protected by dmabuf->resv, @revoked additionally
+	 * protected by memory_lock.
+	 */
+	u16 tph_st_ext;
+	u8 tph_st;
+	bool revoked;
+	u8 tph_st_valid:1;
+	u8 tph_st_ext_valid:1;
+	u8 tph_ph:2;
 };
 
 static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf,
@@ -30,7 +41,7 @@ static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf,
 	if (!attachment->peer2peer)
 		return -EOPNOTSUPP;
 
-	if (priv->revoked)
+	if (READ_ONCE(priv->revoked))
 		return -ENODEV;
 
 	if (!dma_buf_attach_revocable(attachment))
@@ -69,6 +80,26 @@ vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment,
 	return ret;
 }
 
+static int vfio_pci_dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,
+					u16 *steering_tag, u8 *ph)
+{
+	struct vfio_pci_dma_buf *priv = dmabuf->priv;
+
+	dma_resv_assert_held(dmabuf->resv);
+
+	if (extended) {
+		if (!priv->tph_st_ext_valid)
+			return -EOPNOTSUPP;
+		*steering_tag = priv->tph_st_ext;
+	} else {
+		if (!priv->tph_st_valid)
+			return -EOPNOTSUPP;
+		*steering_tag = priv->tph_st;
+	}
+	*ph = priv->tph_ph;
+	return 0;
+}
+
 static void vfio_pci_dma_buf_unmap(struct dma_buf_attachment *attachment,
 				   struct sg_table *sgt,
 				   enum dma_data_direction dir)
@@ -101,6 +132,7 @@ static void vfio_pci_dma_buf_release(struct dma_buf *dmabuf)
 
 static const struct dma_buf_ops vfio_pci_dmabuf_ops = {
 	.attach = vfio_pci_dma_buf_attach,
+	.get_pci_tph = vfio_pci_dma_buf_get_pci_tph,
 	.map_dma_buf = vfio_pci_dma_buf_map,
 	.unmap_dma_buf = vfio_pci_dma_buf_unmap,
 	.release = vfio_pci_dma_buf_release,
@@ -333,6 +365,72 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
 	return ret;
 }
 
+int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,
+				      u32 flags,
+				      struct vfio_device_feature_dma_buf_tph __user *arg,
+				      size_t argsz)
+{
+	struct vfio_device_feature_dma_buf_tph set_tph;
+	struct vfio_pci_dma_buf *priv;
+	struct dma_buf *dmabuf;
+	u8 comp;
+	int ret;
+
+	comp = pcie_tph_completer_type(vdev->pdev);
+	if (comp == PCI_EXP_DEVCAP2_TPH_COMP_NONE)
+		return -EOPNOTSUPP;
+
+	ret = vfio_check_feature(flags, argsz, VFIO_DEVICE_FEATURE_SET,
+				 sizeof(set_tph));
+	if (ret != 1)
+		return ret;
+
+	if (copy_from_user(&set_tph, arg, sizeof(set_tph)))
+		return -EFAULT;
+
+	if (set_tph.flags & ~(VFIO_DMA_BUF_TPH_ST | VFIO_DMA_BUF_TPH_ST_EXT))
+		return -EINVAL;
+
+	if (set_tph.ph & ~0x3)
+		return -EINVAL;
+
+	if ((set_tph.flags & VFIO_DMA_BUF_TPH_ST_EXT) &&
+	    comp != PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH)
+		return -EOPNOTSUPP;
+
+	dmabuf = dma_buf_get(set_tph.dmabuf_fd);
+	if (IS_ERR(dmabuf))
+		return PTR_ERR(dmabuf);
+
+	if (dmabuf->ops != &vfio_pci_dmabuf_ops) {
+		ret = -EINVAL;
+		goto out_put;
+	}
+
+	priv = dmabuf->priv;
+	if (priv->vdev != vdev) {
+		ret = -EINVAL;
+		goto out_put;
+	}
+
+	ret = dma_resv_lock_interruptible(dmabuf->resv, NULL);
+	if (ret)
+		goto out_put;
+
+	priv->tph_st         = set_tph.steering_tag;
+	priv->tph_st_ext     = set_tph.steering_tag_ext;
+	priv->tph_ph         = set_tph.ph;
+	priv->tph_st_valid   = !!(set_tph.flags & VFIO_DMA_BUF_TPH_ST);
+	priv->tph_st_ext_valid =
+		!!(set_tph.flags & VFIO_DMA_BUF_TPH_ST_EXT);
+	dma_resv_unlock(dmabuf->resv);
+	ret = 0;
+
+out_put:
+	dma_buf_put(dmabuf);
+	return ret;
+}
+
 void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked)
 {
 	struct vfio_pci_dma_buf *priv;
diff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h
index fca9d0dfac90f8..c58f369be4b398 100644
--- a/drivers/vfio/pci/vfio_pci_priv.h
+++ b/drivers/vfio/pci/vfio_pci_priv.h
@@ -118,6 +118,10 @@ static inline bool vfio_pci_is_vga(struct pci_dev *pdev)
 int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
 				  struct vfio_device_feature_dma_buf __user *arg,
 				  size_t argsz);
+int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,
+				      u32 flags,
+				      struct vfio_device_feature_dma_buf_tph __user *arg,
+				      size_t argsz);
 void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev);
 void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked);
 #else
@@ -128,6 +132,14 @@ vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
 {
 	return -ENOTTY;
 }
+
+static inline int
+vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev, u32 flags,
+				  struct vfio_device_feature_dma_buf_tph __user *arg,
+				  size_t argsz)
+{
+	return -ENOTTY;
+}
 static inline void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev)
 {
 }
diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h
index d1203da56fc5f7..14e8eb61a62c04 100644
--- a/include/linux/dma-buf.h
+++ b/include/linux/dma-buf.h
@@ -113,6 +113,29 @@ struct dma_buf_ops {
 	 */
 	void (*unpin)(struct dma_buf_attachment *attach);
 
+	/**
+	 * @get_pci_tph:
+	 *
+	 * Retrieve PCIe TLP Processing Hint (TPH) steering metadata for
+	 * this buffer so an importer can program a matching ST/PH hint on
+	 * outbound TLPs targeting the exporter for peer-to-peer DMA.
+	 *
+	 * @dmabuf: DMA buffer for which to retrieve TPH metadata
+	 * @extended: false for 8-bit ST, true for 16-bit Extended ST
+	 * @steering_tag: Returns the raw TPH steering tag for the requested
+	 *                namespace
+	 * @ph: Returns the TPH processing hint (2-bit value)
+	 *
+	 * Optional callback for dma_buf_get_pci_tph(). Called with
+	 * &dma_buf.resv held. Returns 0 on success or -EOPNOTSUPP when
+	 * the exporter has no metadata for the requested namespace.
+	 *
+	 * Returned metadata follows the lifetime rules documented for
+	 * dma_buf_get_pci_tph().
+	 */
+	int (*get_pci_tph)(struct dma_buf *dmabuf, bool extended,
+			   u16 *steering_tag, u8 *ph);
+
 	/**
 	 * @map_dma_buf:
 	 *
@@ -563,6 +586,8 @@ void dma_buf_detach(struct dma_buf *dmabuf,
 		    struct dma_buf_attachment *attach);
 int dma_buf_pin(struct dma_buf_attachment *attach);
 void dma_buf_unpin(struct dma_buf_attachment *attach);
+int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,
+			u16 *steering_tag, u8 *ph);
 
 struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info);
 
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index b1871c0821d0b9..d26e5744c843bf 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -1182,16 +1182,31 @@ int mlx5_dm_sw_icm_dealloc(struct mlx5_core_dev *dev, enum mlx5_sw_icm_type type
 			   u64 length, u16 uid, phys_addr_t addr, u32 obj_id);
 
 #ifdef CONFIG_PCIE_TPH
+int mlx5_st_alloc_index_by_tag(struct mlx5_core_dev *dev, u16 tag,
+			       u16 *st_index);
+int mlx5_st_get_index(struct mlx5_core_dev *dev, u16 st_index);
 int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type,
 			unsigned int cpu_uid, u16 *st_index);
 int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index);
 #else
+static inline int mlx5_st_alloc_index_by_tag(struct mlx5_core_dev *dev,
+					     u16 tag, u16 *st_index)
+{
+	return -EOPNOTSUPP;
+}
+
+static inline int mlx5_st_get_index(struct mlx5_core_dev *dev, u16 st_index)
+{
+	return -EOPNOTSUPP;
+}
+
 static inline int mlx5_st_alloc_index(struct mlx5_core_dev *dev,
 				      enum tph_mem_type mem_type,
 				      unsigned int cpu_uid, u16 *st_index)
 {
 	return -EOPNOTSUPP;
 }
+
 static inline int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index)
 {
 	return -EOPNOTSUPP;
diff --git a/include/linux/pci-tph.h b/include/linux/pci-tph.h
index be68cd17f2f833..7743af6fe4326e 100644
--- a/include/linux/pci-tph.h
+++ b/include/linux/pci-tph.h
@@ -9,6 +9,8 @@
 #ifndef LINUX_PCI_TPH_H
 #define LINUX_PCI_TPH_H
 
+#include <linux/pci_regs.h>
+
 /*
  * According to the ECN for PCI Firmware Spec, Steering Tag can be different
  * depending on the memory type: Volatile Memory or Persistent Memory. When a
@@ -30,6 +32,8 @@ void pcie_disable_tph(struct pci_dev *pdev);
 int pcie_enable_tph(struct pci_dev *pdev, int mode);
 u16 pcie_tph_get_st_table_size(struct pci_dev *pdev);
 u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev);
+u8 pcie_tph_enabled_req_type(struct pci_dev *pdev);
+u8 pcie_tph_completer_type(struct pci_dev *pdev);
 #else
 static inline int pcie_tph_set_st_entry(struct pci_dev *pdev,
 					unsigned int index, u16 tag)
@@ -41,6 +45,10 @@ static inline int pcie_tph_get_cpu_st(struct pci_dev *dev,
 static inline void pcie_disable_tph(struct pci_dev *pdev) { }
 static inline int pcie_enable_tph(struct pci_dev *pdev, int mode)
 { return -EINVAL; }
+static inline u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)
+{ return PCI_TPH_REQ_DISABLE; }
+static inline u8 pcie_tph_completer_type(struct pci_dev *pdev)
+{ return PCI_EXP_DEVCAP2_TPH_COMP_NONE; }
 #endif
 
 #endif /* LINUX_PCI_TPH_H */
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 5de618a3a5eeee..4c1c70aac15097 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -1534,6 +1534,49 @@ struct vfio_device_feature_dma_buf {
  */
 #define VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2  12
 
+/**
+ * Upon VFIO_DEVICE_FEATURE_SET associate TPH (TLP Processing Hints) metadata
+ * with a vfio-exported dma-buf. The dma-buf must have been created by
+ * VFIO_DEVICE_FEATURE_DMA_BUF on this device, and the device must report
+ * TPH Completer support in Device Capabilities 2 (bits 13:12); requests
+ * carrying VFIO_DMA_BUF_TPH_ST_EXT additionally require the device to
+ * report the Extended TPH Completer encoding. Otherwise the ioctl
+ * returns -EOPNOTSUPP.
+ *
+ * @dmabuf_fd is the file descriptor returned by VFIO_DEVICE_FEATURE_DMA_BUF.
+ *
+ * 8-bit ST (@steering_tag) and 16-bit Extended ST (@steering_tag_ext) are
+ * distinct namespaces. @flags is the authoritative validity mask for the
+ * two namespaces: VFIO_DMA_BUF_TPH_ST marks @steering_tag valid and
+ * VFIO_DMA_BUF_TPH_ST_EXT marks @steering_tag_ext valid. An importer
+ * requests one namespace and receives the matching value.
+ *
+ * Each SET fully replaces the dma-buf's TPH state for future queries
+ * only. A namespace whose flag bit is clear is reported as unsupported
+ * to future importers; an importer that has already retrieved a value
+ * is unaffected. @flags == 0 leaves both namespaces unsupported for
+ * future importers.
+ *
+ * @ph is the 2-bit TLP Processing Hint and must be in the range [0, 3].
+ *
+ * Undefined @flags and @ph bits must always be zero.
+ *
+ * Userspace must configure TPH before handing the dma-buf fd to an
+ * importer.
+ */
+#define VFIO_DEVICE_FEATURE_DMA_BUF_TPH 13
+
+#define VFIO_DMA_BUF_TPH_ST		(1 << 0)
+#define VFIO_DMA_BUF_TPH_ST_EXT		(1 << 1)
+
+struct vfio_device_feature_dma_buf_tph {
+	__s32	dmabuf_fd;
+	__u32	flags;
+	__u16	steering_tag_ext;
+	__u8	steering_tag;
+	__u8	ph;
+};
+
 /* -------- API for Type1 VFIO IOMMU -------- */
 
 /**

gemini-3.1-pro-preview

null

null

							input: 12990
							output: 19
							thoughts: 1232
						

**Analyzing the Potential for Fuzzing PCIe TPH Support in VFIO and DMA-BUF**

Okay, so we have this patch that introduces PCIe TLP Processing Hints (TPH) support to DMA-BUF and VFIO. It touches a bunch of drivers, including some core DMA-BUF and VFIO code, along with some Mellanox (mlx5) and PCIe-specific stuff. My immediate thought is, "Can we reach this in a virtualized environment, and more importantly, can we *fuzz* it?".

VFIO is definitely reachable, and DMA-BUF is too, so that's good. But TPH support itself hinges on the PCIe device actually *having* the TPH capability. This can be emulated or not, and that's the key question here. The `VFIO_DEVICE_FEATURE_DMA_BUF_TPH` ioctl seems like our entry point. And after looking at the code in `vfio_pci_core_feature_dma_buf_tph` which uses `pcie_tph_completer_type`, I can see a path, or more specifically, a potential blocker.

`pcie_tph_completer_type` checks `PCI_EXP_DEVCAP2` for the TPH completer. If the virtual device *doesn't* have that capability, the function returns `-EOPNOTSUPP`. That means we will only fuzz the lines before this check.

The real question is, does QEMU (or whatever virtualization we're using) *emulate* TPH capability? If not, we'll only hit that early `-EOPNOTSUPP` return. Even if it *does* return an error, that code path is still reachable.

Looking beyond the check, there's `dma_buf_get_pci_tph` added, and some `mlx5` driver changes. However, I rarely fuzz hardware drivers unless they have software emulation and mlx5 doesn't seem to have any in this context.

So, let's focus on `vfio_pci_core_feature_dma_buf_tph`. If `pcie_tph_completer_type` fails, we're only going to fuzz a couple of lines, which isn't ideal. The `pcie_tph_completer_type` function itself looks like it's reading the `PCI_EXP_DEVCAP2` register and extracting the TPH completer type. 

Is there even a *software-emulated* PCI device with TPH capability? Probably not by default. Syzkaller, with its `syz_pci_device_add` or similar mechanisms, *might* allow us to inject one, but I need to confirm if it supports that. Or maybe vgem? No, vgem isn't PCI.

Hang on. Syzkaller *does* have `syz_kvm_setup_cpu` etc. But how is VFIO actually fuzzed? By opening `/dev/vfio/` and using whatever dummy PCI device is available. But again, the problem is that if the device doesn't have TPH, we hit `-EOPNOTSUPP`.

Okay, but `vfio_pci_core_feature_dma_buf_tph` *is* a new ioctl, and that's the core focus here.

Alright, what about config options? Let's quickly check if `CONFIG_PCIE_TPH` is required. It looks like it *is* used in both `include/linux/mlx5/driver.h` and `include/linux/pci-tph.h`, and that is an important config option to keep in mind. We might need to make sure that config option is enabled.

{
  "Expression": "PCIE_TPH"
}

{
  "Output": "\nFull output is too long, showing 500 out of 16768 lines.\nUse more precise expression if possible.\n\nDocumentation/PCI/tph.rst=39=Enable TPH support in Linux\n--\nDocumentation/PCI/tph.rst-41-\nDocumentation/PCI/tph.rst:42:To support TPH, the kernel must be built with the CONFIG_PCIE_TPH option\nDocumentation/PCI/tph.rst-43-enabled.\n--\nDocumentation/admin-guide/kernel-parameters.txt=95=Kernel parameters\n--\nDocumentation/admin-guide/kernel-parameters.txt-5270-\t\t\t\tone PCI domain per PCI function\nDocumentation/admin-guide/kernel-parameters.txt:5271:\t\tnotph\t\t[PCIE] If the PCIE_TPH kernel config parameter\nDocumentation/admin-guide/kernel-parameters.txt-5272-\t\t\t\tis enabled, this kernel boot option can be used\n--\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_d.h-305-#define mmPCIE_PASID_CNTL                                                       0xb5\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_d.h:306:#define mmPCIE_TPH_REQR_ENH_CAP_LIST                                            0xb8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_d.h:307:#define mmPCIE_TPH_REQR_CAP                                                     0xb9\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_d.h:308:#define mmPCIE_TPH_REQR_CNTL                                                    0xba\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_d.h-309-#define mmPCIE_MC_ENH_CAP_LIST                                                  0xbc\n--\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h-1844-#define PCIE_PASID_CNTL__PASID_PRIV_MODE_SUPPORTED_ENABLE__SHIFT 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1845:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID_MASK 0xffff\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1846:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1847:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER_MASK 0xf0000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1848:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER__SHIFT 0x10\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1849:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR_MASK 0xfff00000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1850:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR__SHIFT 0x14\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1851:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED_MASK 0x1\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1852:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1853:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED_MASK 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1854:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED__SHIFT 0x1\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1855:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED_MASK 0x4\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1856:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED__SHIFT 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1857:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED_MASK 0x100\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1858:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED__SHIFT 0x8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1859:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION_MASK 0x600\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1860:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION__SHIFT 0x9\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1861:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE_MASK 0x7ff0000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1862:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE__SHIFT 0x10\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1863:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL_MASK 0x7\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1864:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1865:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN_MASK 0x300\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h:1866:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN__SHIFT 0x8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_4_1_sh_mask.h-1867-#define PCIE_MC_ENH_CAP_LIST__CAP_ID_MASK 0xffff\n--\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_d.h-360-#define mmPCIE_PASID_CNTL                                                       0xb5\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_d.h:361:#define mmPCIE_TPH_REQR_ENH_CAP_LIST                                            0xb8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_d.h:362:#define mmPCIE_TPH_REQR_CAP                                                     0xb9\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_d.h:363:#define mmPCIE_TPH_REQR_CNTL                                                    0xba\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_d.h-364-#define mmPCIE_MC_ENH_CAP_LIST                                                  0xbc\n--\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h-2080-#define PCIE_PASID_CNTL__PASID_PRIV_MODE_SUPPORTED_ENABLE__SHIFT 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2081:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID_MASK 0xffff\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2082:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2083:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER_MASK 0xf0000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2084:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER__SHIFT 0x10\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2085:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR_MASK 0xfff00000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2086:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR__SHIFT 0x14\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2087:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED_MASK 0x1\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2088:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2089:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED_MASK 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2090:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED__SHIFT 0x1\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2091:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED_MASK 0x4\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2092:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED__SHIFT 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2093:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED_MASK 0x100\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2094:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED__SHIFT 0x8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2095:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION_MASK 0x600\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2096:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION__SHIFT 0x9\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2097:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE_MASK 0x7ff0000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2098:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE__SHIFT 0x10\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2099:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL_MASK 0x7\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2100:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2101:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN_MASK 0x300\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h:2102:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN__SHIFT 0x8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_0_sh_mask.h-2103-#define PCIE_MC_ENH_CAP_LIST__CAP_ID_MASK 0xffff\n--\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_d.h-330-#define mmPCIE_PASID_CNTL                                                       0xb5\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_d.h:331:#define mmPCIE_TPH_REQR_ENH_CAP_LIST                                            0xb8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_d.h:332:#define mmPCIE_TPH_REQR_CAP                                                     0xb9\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_d.h:333:#define mmPCIE_TPH_REQR_CNTL                                                    0xba\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_d.h-334-#define mmPCIE_MC_ENH_CAP_LIST                                                  0xbc\n--\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h-1946-#define PCIE_PASID_CNTL__PASID_PRIV_MODE_SUPPORTED_ENABLE__SHIFT 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1947:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID_MASK 0xffff\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1948:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1949:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER_MASK 0xf0000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1950:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER__SHIFT 0x10\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1951:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR_MASK 0xfff00000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1952:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR__SHIFT 0x14\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1953:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED_MASK 0x1\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1954:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1955:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED_MASK 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1956:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED__SHIFT 0x1\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1957:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED_MASK 0x4\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1958:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED__SHIFT 0x2\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1959:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED_MASK 0x100\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1960:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED__SHIFT 0x8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1961:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION_MASK 0x600\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1962:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION__SHIFT 0x9\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1963:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE_MASK 0x7ff0000\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1964:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE__SHIFT 0x10\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1965:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL_MASK 0x7\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1966:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL__SHIFT 0x0\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1967:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN_MASK 0x300\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h:1968:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN__SHIFT 0x8\ndrivers/gpu/drm/amd/include/asic_reg/bif/bif_5_1_sh_mask.h-1969-#define PCIE_MC_ENH_CAP_LIST__CAP_ID_MASK 0xffff\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_offset.h-186-#define cfgPCIE_PASID_CNTL                                                                              0x02d6 // duplicate \ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_offset.h:187:#define cfgPCIE_TPH_REQR_ENH_CAP_LIST                                                                   0x02e0 // duplicate \ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_offset.h:188:#define cfgPCIE_TPH_REQR_CAP                                                                            0x02e4 // duplicate \ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_offset.h:189:#define cfgPCIE_TPH_REQR_CNTL                                                                           0x02e8 // duplicate \ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_offset.h-190-#define cfgPCIE_MC_ENH_CAP_LIST                                                                         0x02f0 // duplicate \n--\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h-725-#define PCIE_PASID_CNTL__PASID_PRIV_MODE_SUPPORTED_ENABLE__SHIFT                                              0x2\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:726://PCIE_TPH_REQR_ENH_CAP_LIST\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:727:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID__SHIFT                                                             0x0\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:728:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER__SHIFT                                                            0x10\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:729:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR__SHIFT                                                           0x14\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:730://PCIE_TPH_REQR_CAP\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:731:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED__SHIFT                                               0x0\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:732:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED__SHIFT                                             0x1\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:733:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED__SHIFT                                             0x2\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:734:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED__SHIFT                                            0x8\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:735:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION__SHIFT                                                  0x9\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:736:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE__SHIFT                                                      0x10\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:737://PCIE_TPH_REQR_CNTL\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:738:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL__SHIFT                                                       0x0\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:739:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN__SHIFT                                                                0x8\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h-740-//PCIE_MC_ENH_CAP_LIST\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h-5854-#define PCIE_PASID_CNTL__PASID_PRIV_MODE_SUPPORTED_ENABLE__MASK                                               0x0004L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5855://PCIE_TPH_REQR_ENH_CAP_LIST\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5856:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_ID__MASK                                                              0x0000FFFFL\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5857:#define PCIE_TPH_REQR_ENH_CAP_LIST__CAP_VER__MASK                                                             0x000F0000L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5858:#define PCIE_TPH_REQR_ENH_CAP_LIST__NEXT_PTR__MASK                                                            0xFFF00000L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5859://PCIE_TPH_REQR_CAP\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5860:#define PCIE_TPH_REQR_CAP__TPH_REQR_NO_ST_MODE_SUPPORTED__MASK                                                0x00000001L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5861:#define PCIE_TPH_REQR_CAP__TPH_REQR_INT_VEC_MODE_SUPPORTED__MASK                                              0x00000002L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5862:#define PCIE_TPH_REQR_CAP__TPH_REQR_DEV_SPC_MODE_SUPPORTED__MASK                                              0x00000004L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5863:#define PCIE_TPH_REQR_CAP__TPH_REQR_EXTND_TPH_REQR_SUPPORED__MASK                                             0x00000100L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5864:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_LOCATION__MASK                                                   0x00000600L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5865:#define PCIE_TPH_REQR_CAP__TPH_REQR_ST_TABLE_SIZE__MASK                                                       0x07FF0000L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5866://PCIE_TPH_REQR_CNTL\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5867:#define PCIE_TPH_REQR_CNTL__TPH_REQR_ST_MODE_SEL__MASK                                                        0x00000007L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h:5868:#define PCIE_TPH_REQR_CNTL__TPH_REQR_EN__MASK                                                                 0x00000300L\ndrivers/gpu/drm/amd/include/asic_reg/nbif/nbif_6_1_sh_mask.h-5869-//PCIE_MC_ENH_CAP_LIST\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-820-#define cfgBIF_CFG_DEV0_EPF0_0_PCIE_SRIOV_VF_MIGRATION_STATE_ARRAY_OFFSET_DEFAULT 0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:821:#define cfgBIF_CFG_DEV0_EPF0_0_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                 0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:822:#define cfgBIF_CFG_DEV0_EPF0_0_PCIE_TPH_REQR_CAP_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:823:#define cfgBIF_CFG_DEV0_EPF0_0_PCIE_TPH_REQR_CNTL_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-824-#define cfgBIF_CFG_DEV0_EPF0_0_PCIE_DLF_ENH_CAP_LIST_DEFAULT                      0x41010025\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-1172-#define cfgBIF_CFG_DEV0_EPF1_0_PCIE_SRIOV_VF_MIGRATION_STATE_ARRAY_OFFSET_DEFAULT 0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1173:#define cfgBIF_CFG_DEV0_EPF1_0_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                 0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1174:#define cfgBIF_CFG_DEV0_EPF1_0_PCIE_TPH_REQR_CAP_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1175:#define cfgBIF_CFG_DEV0_EPF1_0_PCIE_TPH_REQR_CNTL_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-1176-#define cfgBIF_CFG_DEV0_EPF1_0_PCIE_DLF_ENH_CAP_LIST_DEFAULT                      0x41010025\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-1457-#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_ARI_CNTL_DEFAULT                              0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1458:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                 0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1459:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_REQR_CAP_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1460:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_REQR_CNTL_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1461:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_0_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1462:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_1_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1463:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_2_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1464:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_3_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1465:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_4_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1466:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_5_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1467:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_6_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1468:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_7_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1469:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_8_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1470:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_9_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1471:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_10_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1472:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_11_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1473:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_12_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1474:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_13_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1475:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_14_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1476:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_15_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1477:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_16_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1478:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_17_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1479:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_18_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1480:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_19_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1481:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_20_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1482:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_21_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1483:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_22_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1484:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_23_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1485:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_24_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1486:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_25_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1487:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_26_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1488:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_27_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1489:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_28_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1490:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_29_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1491:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_30_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1492:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_31_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1493:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_32_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1494:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_33_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1495:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_34_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1496:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_35_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1497:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_36_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1498:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_37_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1499:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_38_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1500:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_39_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1501:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_40_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1502:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_41_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1503:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_42_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1504:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_43_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1505:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_44_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1506:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_45_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1507:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_46_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1508:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_47_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1509:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_48_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1510:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_49_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1511:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_50_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1512:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_51_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1513:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_52_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1514:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_53_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1515:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_54_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1516:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_55_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1517:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_56_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1518:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_57_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1519:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_58_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1520:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_59_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1521:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_60_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1522:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_61_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1523:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_62_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1524:#define cfgBIF_CFG_DEV0_EPF2_0_PCIE_TPH_ST_TABLE_63_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-1525-\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-1651-#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_ARI_CNTL_DEFAULT                              0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1652:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                 0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1653:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_REQR_CAP_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1654:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_REQR_CNTL_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1655:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_0_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1656:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_1_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1657:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_2_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1658:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_3_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1659:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_4_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1660:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_5_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1661:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_6_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1662:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_7_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1663:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_8_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1664:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_9_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1665:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_10_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1666:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_11_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1667:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_12_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1668:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_13_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1669:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_14_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1670:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_15_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1671:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_16_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1672:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_17_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1673:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_18_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1674:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_19_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1675:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_20_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1676:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_21_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1677:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_22_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1678:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_23_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1679:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_24_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1680:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_25_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1681:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_26_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1682:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_27_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1683:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_28_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1684:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_29_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1685:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_30_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1686:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_31_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1687:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_32_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1688:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_33_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1689:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_34_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1690:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_35_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1691:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_36_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1692:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_37_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1693:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_38_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1694:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_39_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1695:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_40_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1696:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_41_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1697:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_42_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1698:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_43_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1699:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_44_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1700:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_45_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1701:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_46_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1702:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_47_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1703:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_48_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1704:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_49_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1705:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_50_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1706:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_51_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1707:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_52_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1708:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_53_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1709:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_54_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1710:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_55_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1711:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_56_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1712:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_57_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1713:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_58_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1714:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_59_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1715:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_60_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1716:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_61_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1717:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_62_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:1718:#define cfgBIF_CFG_DEV0_EPF3_0_PCIE_TPH_ST_TABLE_63_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-1719-\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-2995-#define smnBIF_CFG_DEV0_EPF0_PCIE_SRIOV_VF_MIGRATION_STATE_ARRAY_OFFSET_DEFAULT   0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:2996:#define smnBIF_CFG_DEV0_EPF0_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                   0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:2997:#define smnBIF_CFG_DEV0_EPF0_PCIE_TPH_REQR_CAP_DEFAULT                            0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:2998:#define smnBIF_CFG_DEV0_EPF0_PCIE_TPH_REQR_CNTL_DEFAULT                           0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-2999-#define smnBIF_CFG_DEV0_EPF0_PCIE_DLF_ENH_CAP_LIST_DEFAULT                        0x41010025\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-3347-#define smnBIF_CFG_DEV0_EPF1_PCIE_SRIOV_VF_MIGRATION_STATE_ARRAY_OFFSET_DEFAULT   0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3348:#define smnBIF_CFG_DEV0_EPF1_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                   0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3349:#define smnBIF_CFG_DEV0_EPF1_PCIE_TPH_REQR_CAP_DEFAULT                            0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3350:#define smnBIF_CFG_DEV0_EPF1_PCIE_TPH_REQR_CNTL_DEFAULT                           0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-3351-#define smnBIF_CFG_DEV0_EPF1_PCIE_DLF_ENH_CAP_LIST_DEFAULT                        0x41010025\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-3632-#define smnBIF_CFG_DEV0_EPF2_PCIE_ARI_CNTL_DEFAULT                                0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3633:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                   0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3634:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_REQR_CAP_DEFAULT                            0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3635:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_REQR_CNTL_DEFAULT                           0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3636:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_0_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3637:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_1_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3638:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_2_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3639:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_3_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3640:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_4_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3641:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_5_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3642:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_6_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3643:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_7_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3644:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_8_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3645:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_9_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3646:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_10_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3647:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_11_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3648:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_12_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3649:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_13_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3650:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_14_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3651:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_15_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3652:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_16_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3653:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_17_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3654:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_18_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3655:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_19_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3656:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_20_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3657:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_21_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3658:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_22_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3659:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_23_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3660:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_24_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3661:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_25_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3662:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_26_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3663:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_27_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3664:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_28_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3665:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_29_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3666:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_30_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3667:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_31_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3668:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_32_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3669:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_33_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3670:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_34_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3671:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_35_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3672:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_36_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3673:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_37_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3674:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_38_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3675:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_39_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3676:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_40_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3677:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_41_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3678:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_42_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3679:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_43_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3680:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_44_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3681:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_45_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3682:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_46_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3683:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_47_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3684:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_48_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3685:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_49_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3686:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_50_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3687:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_51_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3688:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_52_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3689:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_53_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3690:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_54_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3691:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_55_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3692:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_56_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3693:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_57_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3694:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_58_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3695:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_59_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3696:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_60_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3697:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_61_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3698:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_62_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3699:#define smnBIF_CFG_DEV0_EPF2_PCIE_TPH_ST_TABLE_63_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-3700-\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-3826-#define smnBIF_CFG_DEV0_EPF3_PCIE_ARI_CNTL_DEFAULT                                0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3827:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                   0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3828:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_REQR_CAP_DEFAULT                            0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3829:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_REQR_CNTL_DEFAULT                           0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3830:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_0_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3831:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_1_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3832:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_2_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3833:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_3_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3834:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_4_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3835:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_5_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3836:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_6_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3837:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_7_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3838:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_8_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3839:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_9_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3840:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_10_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3841:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_11_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3842:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_12_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3843:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_13_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3844:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_14_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3845:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_15_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3846:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_16_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3847:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_17_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3848:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_18_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3849:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_19_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3850:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_20_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3851:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_21_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3852:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_22_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3853:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_23_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3854:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_24_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3855:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_25_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3856:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_26_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3857:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_27_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3858:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_28_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3859:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_29_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3860:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_30_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3861:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_31_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3862:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_32_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3863:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_33_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3864:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_34_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3865:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_35_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3866:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_36_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3867:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_37_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3868:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_38_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3869:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_39_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3870:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_40_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3871:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_41_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3872:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_42_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3873:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_43_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3874:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_44_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3875:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_45_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3876:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_46_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3877:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_47_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3878:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_48_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3879:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_49_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3880:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_50_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3881:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_51_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3882:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_52_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3883:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_53_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3884:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_54_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3885:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_55_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3886:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_56_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3887:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_57_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3888:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_58_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3889:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_59_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3890:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_60_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3891:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_61_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3892:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_62_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:3893:#define smnBIF_CFG_DEV0_EPF3_PCIE_TPH_ST_TABLE_63_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-3894-\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-14709-#define cfgBIF_CFG_DEV0_EPF0_1_PCIE_SRIOV_VF_MIGRATION_STATE_ARRAY_OFFSET_DEFAULT 0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:14710:#define cfgBIF_CFG_DEV0_EPF0_1_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                 0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:14711:#define cfgBIF_CFG_DEV0_EPF0_1_PCIE_TPH_REQR_CAP_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:14712:#define cfgBIF_CFG_DEV0_EPF0_1_PCIE_TPH_REQR_CNTL_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-14713-#define cfgBIF_CFG_DEV0_EPF0_1_PCIE_DLF_ENH_CAP_LIST_DEFAULT                      0x41010025\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-15061-#define cfgBIF_CFG_DEV0_EPF1_1_PCIE_SRIOV_VF_MIGRATION_STATE_ARRAY_OFFSET_DEFAULT 0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15062:#define cfgBIF_CFG_DEV0_EPF1_1_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                 0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15063:#define cfgBIF_CFG_DEV0_EPF1_1_PCIE_TPH_REQR_CAP_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15064:#define cfgBIF_CFG_DEV0_EPF1_1_PCIE_TPH_REQR_CNTL_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-15065-#define cfgBIF_CFG_DEV0_EPF1_1_PCIE_DLF_ENH_CAP_LIST_DEFAULT                      0x41010025\n--\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h-15346-#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_ARI_CNTL_DEFAULT                              0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15347:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_REQR_ENH_CAP_LIST_DEFAULT                 0x40000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15348:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_REQR_CAP_DEFAULT                          0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15349:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_REQR_CNTL_DEFAULT                         0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15350:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_0_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15351:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_1_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15352:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_2_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15353:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_3_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15354:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_4_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15355:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_5_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15356:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_6_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15357:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_7_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15358:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_8_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15359:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_9_DEFAULT                        0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15360:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_10_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15361:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_11_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15362:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_12_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15363:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_13_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15364:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_14_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15365:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_15_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15366:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_16_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15367:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_17_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15368:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_18_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15369:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_19_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15370:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_20_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15371:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_21_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15372:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_22_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15373:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_23_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15374:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_24_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15375:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_25_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15376:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_26_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15377:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_27_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15378:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_28_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15379:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_29_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15380:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_30_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15381:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_31_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15382:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_32_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15383:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_33_DEFAULT                       0x00000000\ndrivers/gpu/drm/amd/include/asic_reg/nbio/nbio_2_3_default.h:15384:#define cfgBIF_CFG_DEV0_EPF2_1_PCIE_TPH_ST_TABLE_34_DEFAULT                       0x00000000\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 49103
							output: 20
							thoughts: 176
						

**Analyzing the CONFIG_PCIE_TPH Requirement**

Okay, so I need to figure out if we need to explicitly enable `CONFIG_PCIE_TPH` for this testing. The prompt is very clear: avoid assumptions, dig into the Kconfig files, and only list specific configs related to the modified code. The instructions also specify *not* adding "CONFIG_" to the `EnableConfigs` output.

First things first, I'll need to confirm if `CONFIG_PCIE_TPH` is enabled by default or if it needs to be explicitly enabled. The place to start looking is, as the instructions state, `drivers/pci/Kconfig`. Let's dive in.

{
  "Expression": "config PCIE_TPH"
}

{
  "Output": "drivers/pci/Kconfig=185=config PCI_PASID\n--\ndrivers/pci/Kconfig-196-\ndrivers/pci/Kconfig:197:config PCIE_TPH\ndrivers/pci/Kconfig-198-\tbool \"TLP Processing Hints\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 49532
							output: 35
							thoughts: 20
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into PCI Configuration**

Okay, so I'm digging into some PCI configuration options within the kernel, specifically starting with `drivers/pci/Kconfig` around line 197. This likely centers on a group of related options, probably within a defined "menu" or block, given the `Kconfig` file structure. I'm guessing that line number is a good jumping-off point for a particular set of features. I want to understand how certain PCI-related features are enabled or disabled, possibly dependent on hardware, other kernel configurations, or specific use-cases. I need to get a high-level picture of those dependencies. I'm expecting to find conditional statements, `depends on` clauses, and maybe some help text.

{
  "File": "drivers/pci/Kconfig",
  "FirstLine": 190,
  "LineCount": 20
}

{
  "Contents": " 190:\t\t  to access more than one IO address space at the same time. To make\n 191:\t\t  use of this feature an IOMMU is required which also supports PASIDs.\n 192:\t\t  Select this option if you have such an IOMMU and want to compile the\n 193:\t\t  driver for it into your kernel.\n 194:\t\n 195:\t\t  If unsure, say N.\n 196:\t\n 197:\tconfig PCIE_TPH\n 198:\t\tbool \"TLP Processing Hints\"\n 199:\t\thelp\n 200:\t\t  This option adds support for PCIe TLP Processing Hints (TPH).\n 201:\t\t  TPH allows endpoint devices to provide optimization hints, such as\n 202:\t\t  desired caching behavior, for requests that target memory space.\n 203:\t\t  These hints, called Steering Tags, can empower the system hardware\n 204:\t\t  to optimize the utilization of platform resources.\n 205:\t\n 206:\tconfig PCI_P2PDMA\n 207:\t\tbool \"PCI peer-to-peer transfer support\"\n 208:\t\tdepends on ZONE_DEVICE\n 209:\t\t#\n"
}

gemini-3.1-pro-preview

null

null

							input: 50081
							output: 25
							thoughts: 133
						

**Analyzing the `PCIE_TPH` Configuration Option**

Okay, so I'm looking at this `PCIE_TPH` option. Right away, it seems like something we need to explicitly include within `EnableConfigs`. That's a no-brainer. But let's pause. Are there *any* other config options lurking around that are related? We need to be thorough.

The code seems to be modifying the `drivers/vfio/pci/vfio_pci_dmabuf.c` file. Right. That file is compiled *only* if `CONFIG_VFIO_PCI` is enabled. Makes sense. 

Wait a minute, I see `vfio_pci_core_feature_dma_buf_tph` being added to `vfio_pci_dmabuf.c`. Ok, so the next thing I need to do, before I draw any conclusions, is check if `vfio_pci_dmabuf.c` itself has any other configuration dependencies. Need to see if there's something else that's relevant to understand this whole thing correctly.

{
  "Expression": "vfio_pci_dmabuf\\.o"
}

{
  "Output": "drivers/vfio/pci/Makefile=4=vfio-pci-core-$(CONFIG_VFIO_PCI_ZDEV_KVM) += vfio_pci_zdev.o\ndrivers/vfio/pci/Makefile:5:vfio-pci-core-$(CONFIG_VFIO_PCI_DMABUF) += vfio_pci_dmabuf.o\ndrivers/vfio/pci/Makefile-6-obj-$(CONFIG_VFIO_PCI_CORE) += vfio-pci-core.o\n"
}

gemini-3.1-pro-preview

null

null

							input: 50619
							output: 23
							thoughts: 41
						

Okay, let's see. Here's how I'd approach summarizing those thoughts:

**Analyzing the VFIO PCI DMABUF Configuration**

Alright, so the task at hand is `CONFIG_VFIO_PCI_DMABUF`.  My immediate instinct, given the context of VFIO and DMA buffer support, is to dive straight into the relevant Kconfig file. I'm thinking, "Where would this be defined? It's likely in the `drivers/vfio/pci` directory." Let me just double-check the `drivers/vfio/pci/Kconfig` file and confirm that `VFIO_PCI_DMABUF` is actually defined there. This seems like the obvious starting point to understand its dependencies, default settings, and any relevant documentation. This is where I'd go to find out what this option *actually does* in this particular driver.

{
  "Expression": "config VFIO_PCI_DMABUF"
}

{
  "Output": "drivers/vfio/pci/Kconfig=47=config VFIO_PCI_ZDEV_KVM\n--\ndrivers/vfio/pci/Kconfig-57-\ndrivers/vfio/pci/Kconfig:58:config VFIO_PCI_DMABUF\ndrivers/vfio/pci/Kconfig-59-\tdef_bool y if VFIO_PCI_CORE \u0026\u0026 PCI_P2PDMA \u0026\u0026 DMA_SHARED_BUFFER\n"
}

gemini-3.1-pro-preview

null

null

							input: 50991
							output: 31
							thoughts: 1169
						

**Reaching the VFIO TPH Functionality**

Okay, so I'm looking at this code and trying to figure out if it's fuzzable and what to focus on. First, I see that the `def_bool` for something is conditional on `VFIO_PCI_CORE && PCI_P2PDMA && DMA_SHARED_BUFFER`. This probably means I need to make sure those config options are set. `PCI_P2PDMA` is a boolean, so I should probably add that to my `EnableConfigs` just to be safe. And also `PCIE_TPH`.

Alright, the patch adds support for PCIe TPH to DMA-BUF and VFIO.  Specifically, there's a new `VFIO_DEVICE_FEATURE_DMA_BUF_TPH` ioctl. The critical question: is this ioctl reachable by syzkaller?  Yes, it looks like it's reachable via the usual `/dev/vfio/devices/...` or `/dev/vfio/vfio` ioctls. And I'm pretty sure syzkaller does indeed fuzz VFIO ioctls. So, the ioctl handler, `vfio_pci_core_feature_dma_buf_tph`, is definitely reachable.

The code calls `pcie_tph_completer_type(vdev->pdev)`. If the underlying device doesn't *have* TPH capabilities, it returns `-EOPNOTSUPP`. That's important. Now, the big question is: can syzkaller create a PCI device with *arbitrary* capabilities? If it can, this could lead to a deeper dive. It doesn't look like syzkaller has a generic PCI device injector like `syz_pci_device_add`, though I'm vaguely remembering something about `syz_kvm_setup_cpu`, but it doesn't look like it supports this. So no. It might use some QEMU provided PCI devices. I'll need to check if those devices are capable of TPH.  But even if it *only* hits the `-EOPNOTSUPP` path, it's still executing functional code and could be interesting.

Okay, let's step back and be sure `vfio_pci_core_feature_dma_buf_tph` *is* reachable. It's handled by `vfio_pci_core_ioctl_feature`, which is itself called from `vfio_pci_core_ioctl` for `VFIO_DEVICE_FEATURE`.  So, yes, it's definitely reachable.

Now, which functions are the key ones to focus on for fuzzing? From here it looks like:

*   `vfio_pci_core_feature_dma_buf_tph`
*   `dma_buf_get_pci_tph`
*   `pcie_tph_enabled_req_type`
*   `pcie_tph_completer_type`
*   `mlx5_st_alloc_index_by_tag`
*   `mlx5_st_get_index`

But wait, `mlx5` is a Mellanox hardware driver, so I can probably ignore the `mlx5` functions for now because they're not going to be triggered without that hardware. So that narrows it down a bit.

I'll double-check to see if `vfio_pci_dma_buf_get_pci_tph` is reachable. That's the `get_pci_tph` callback for `vfio_pci_dmabuf_ops`, and it gets called by `dma_buf_get_pci_tph`. Who actually calls `dma_buf_get_pci_tph`?  According to this patch, it's `get_pci_tph_mr_dmabuf` in `drivers/infiniband/hw/mlx5/mr.c`. Since I'm not using Mellanox hardware, `dma_buf_get_pci_tph` may not be triggered by the `mlx5` driver, and that might mean `vfio_pci_dma_buf_get_pci_tph` is not reachable. There are no other callers in this patch, so yes, it's likely not reachable. But the ioctl `vfio_pci_core_feature_dma_buf_tph` is, and `pcie_tph_completer_type` is reachable from there.

Okay, let's make doubly sure that `vfio_pci_core_feature_dma

{
  "Expression": "vfio_pci_core_feature_dma_buf_tph"
}

{
  "Output": "drivers/vfio/pci/vfio_pci_core.c=1557=int vfio_pci_core_ioctl_feature(struct vfio_device *device, u32 flags,\n--\ndrivers/vfio/pci/vfio_pci_core.c-1575-\tcase VFIO_DEVICE_FEATURE_DMA_BUF_TPH:\ndrivers/vfio/pci/vfio_pci_core.c:1576:\t\treturn vfio_pci_core_feature_dma_buf_tph(vdev, flags, arg,\ndrivers/vfio/pci/vfio_pci_core.c-1577-\t\t\t\t\t\t\t argsz);\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=253=int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c-367-\ndrivers/vfio/pci/vfio_pci_dmabuf.c:368:int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,\ndrivers/vfio/pci/vfio_pci_dmabuf.c-369-\t\t\t\t      u32 flags,\n--\ndrivers/vfio/pci/vfio_pci_priv.h=118=int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,\n--\ndrivers/vfio/pci/vfio_pci_priv.h-120-\t\t\t\t  size_t argsz);\ndrivers/vfio/pci/vfio_pci_priv.h:121:int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,\ndrivers/vfio/pci/vfio_pci_priv.h-122-\t\t\t\t      u32 flags,\n--\ndrivers/vfio/pci/vfio_pci_priv.h=136=static inline int\ndrivers/vfio/pci/vfio_pci_priv.h:137:vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev, u32 flags,\ndrivers/vfio/pci/vfio_pci_priv.h-138-\t\t\t\t  struct vfio_device_feature_dma_buf_tph __user *arg,\n"
}

gemini-3.1-pro-preview

null

null

							input: 53890
							output: 24
							thoughts: 23
						

Okay, here's my summarized thought process, presented as if I'm the one thinking it:

**Reaching the Target**

Alright, the initial assessment suggests this is something I can tackle. I believe this *is* reachable – that's the first critical assessment. Now, the next step is to drill down, right? Let's get right to it... I want to check the specific value of the `pcie_tph_completer_type` field. That will be very telling.

{
  "Expression": "pcie_tph_completer_type"
}

{
  "Output": "drivers/pci/tph.c=186=EXPORT_SYMBOL(pcie_tph_enabled_req_type);\n--\ndrivers/pci/tph.c-188-/**\ndrivers/pci/tph.c:189: * pcie_tph_completer_type - Return the device's TPH Completer support\ndrivers/pci/tph.c-190- * @pdev: PCI device to query\n--\ndrivers/pci/tph.c-200- */\ndrivers/pci/tph.c:201:u8 pcie_tph_completer_type(struct pci_dev *pdev)\ndrivers/pci/tph.c-202-{\n--\ndrivers/pci/tph.c-218-}\ndrivers/pci/tph.c:219:EXPORT_SYMBOL(pcie_tph_completer_type);\ndrivers/pci/tph.c-220-\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=368=int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c-378-\ndrivers/vfio/pci/vfio_pci_dmabuf.c:379:\tcomp = pcie_tph_completer_type(vdev-\u003epdev);\ndrivers/vfio/pci/vfio_pci_dmabuf.c-380-\tif (comp == PCI_EXP_DEVCAP2_TPH_COMP_NONE)\n--\ninclude/linux/pci-tph.h=35=u8 pcie_tph_enabled_req_type(struct pci_dev *pdev);\ninclude/linux/pci-tph.h:36:u8 pcie_tph_completer_type(struct pci_dev *pdev);\ninclude/linux/pci-tph.h-37-#else\n--\ninclude/linux/pci-tph.h=48=static inline u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)\ninclude/linux/pci-tph.h-49-{ return PCI_TPH_REQ_DISABLE; }\ninclude/linux/pci-tph.h:50:static inline u8 pcie_tph_completer_type(struct pci_dev *pdev)\ninclude/linux/pci-tph.h-51-{ return PCI_EXP_DEVCAP2_TPH_COMP_NONE; }\n"
}

gemini-3.1-pro-preview

null

null

							input: 54717
							output: 25
							thoughts: 34
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing PCIe TPH Completer Type**

Alright, it looks like we've confirmed that `pcie_tph_completer_type` is indeed reachable within the code. Good. Now, the next logical step in this analysis is to scrutinize `pcie_tph_enabled_req_type`. Understanding how that request type is handled is crucial for a complete picture. We need to dissect the interaction between these two to fully grasp the implications.

{
  "Expression": "pcie_tph_enabled_req_type"
}

{
  "Output": "drivers/infiniband/hw/mlx5/mr.c=950=static void get_pci_tph_mr_dmabuf(struct mlx5_ib_dev *dev, struct dma_buf *dmabuf,\n--\ndrivers/infiniband/hw/mlx5/mr.c-958-\ndrivers/infiniband/hw/mlx5/mr.c:959:\tswitch (pcie_tph_enabled_req_type(dev-\u003emdev-\u003epdev)) {\ndrivers/infiniband/hw/mlx5/mr.c-960-\tcase PCI_TPH_REQ_TPH_ONLY:\n--\ndrivers/pci/tph.c=174=EXPORT_SYMBOL(pcie_tph_get_st_table_loc);\n--\ndrivers/pci/tph.c-176-/**\ndrivers/pci/tph.c:177: * pcie_tph_enabled_req_type - Return the device's enabled TPH requester type\ndrivers/pci/tph.c-178- * @pdev: PCI device to query\n--\ndrivers/pci/tph.c-181- */\ndrivers/pci/tph.c:182:u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)\ndrivers/pci/tph.c-183-{\n--\ndrivers/pci/tph.c-185-}\ndrivers/pci/tph.c:186:EXPORT_SYMBOL(pcie_tph_enabled_req_type);\ndrivers/pci/tph.c-187-\n--\ninclude/linux/pci-tph.h=34=u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev);\ninclude/linux/pci-tph.h:35:u8 pcie_tph_enabled_req_type(struct pci_dev *pdev);\ninclude/linux/pci-tph.h-36-u8 pcie_tph_completer_type(struct pci_dev *pdev);\n--\ninclude/linux/pci-tph.h=46=static inline int pcie_enable_tph(struct pci_dev *pdev, int mode)\ninclude/linux/pci-tph.h-47-{ return -EINVAL; }\ninclude/linux/pci-tph.h:48:static inline u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)\ninclude/linux/pci-tph.h-49-{ return PCI_TPH_REQ_DISABLE; }\n"
}

gemini-3.1-pro-preview

null

null

							input: 55565
							output: 26
							thoughts: 115
						

**Focusing on PCIe TPH and Fuzzing Relevance**

Okay, so I'm looking at `pcie_tph_enabled_req_type`. The code shows it's *only* called from `get_pci_tph_mr_dmabuf`, which is buried deep within the `mlx5` driver's memory region management (`drivers/infiniband/hw/mlx5/mr.c`). Right, and `mlx5` is a hardware driver... that means it's not going to be triggered in my fuzzing environment. I need to be efficient with my `FocusSymbols` list, and including code paths that are fundamentally unreachable during fuzzing is just wasted effort. Therefore, `pcie_tph_enabled_req_type` should *definitely* be excluded from the `FocusSymbols`. Let's move on and take a look at `dma_buf_get_pci_tph` now; maybe there's something relevant there.

{
  "Expression": "dma_buf_get_pci_tph"
}

{
  "Output": "drivers/dma-buf/dma-buf.c=919=dma_buf_pin_on_map(struct dma_buf_attachment *attach)\n--\ndrivers/dma-buf/dma-buf.c-941- *     - dma_buf_vunmap()\ndrivers/dma-buf/dma-buf.c:942: *     - dma_buf_get_pci_tph()\ndrivers/dma-buf/dma-buf.c-943- *\n--\ndrivers/dma-buf/dma-buf.c=1147=EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, \"DMA_BUF\");\n--\ndrivers/dma-buf/dma-buf.c-1149-/**\ndrivers/dma-buf/dma-buf.c:1150: * dma_buf_get_pci_tph - Retrieve PCIe TLP Processing Hint (TPH) metadata\ndrivers/dma-buf/dma-buf.c-1151- * @dmabuf: DMA buffer to query\n--\ndrivers/dma-buf/dma-buf.c-1166- */\ndrivers/dma-buf/dma-buf.c:1167:int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ndrivers/dma-buf/dma-buf.c-1168-\t\t\tu16 *steering_tag, u8 *ph)\n--\ndrivers/dma-buf/dma-buf.c-1176-}\ndrivers/dma-buf/dma-buf.c:1177:EXPORT_SYMBOL_NS_GPL(dma_buf_get_pci_tph, \"DMA_BUF\");\ndrivers/dma-buf/dma-buf.c-1178-\n--\ndrivers/infiniband/hw/mlx5/mr.c=950=static void get_pci_tph_mr_dmabuf(struct mlx5_ib_dev *dev, struct dma_buf *dmabuf,\n--\ndrivers/infiniband/hw/mlx5/mr.c-970-\tdma_resv_lock(dmabuf-\u003eresv, NULL);\ndrivers/infiniband/hw/mlx5/mr.c:971:\tret = dma_buf_get_pci_tph(dmabuf, extended, \u0026steering_tag, \u0026local_ph);\ndrivers/infiniband/hw/mlx5/mr.c-972-\tdma_resv_unlock(dmabuf-\u003eresv);\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=62=vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment,\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c-82-\ndrivers/vfio/pci/vfio_pci_dmabuf.c:83:static int vfio_pci_dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ndrivers/vfio/pci/vfio_pci_dmabuf.c-84-\t\t\t\t\tu16 *steering_tag, u8 *ph)\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=133=static const struct dma_buf_ops vfio_pci_dmabuf_ops = {\ndrivers/vfio/pci/vfio_pci_dmabuf.c-134-\t.attach = vfio_pci_dma_buf_attach,\ndrivers/vfio/pci/vfio_pci_dmabuf.c:135:\t.get_pci_tph = vfio_pci_dma_buf_get_pci_tph,\ndrivers/vfio/pci/vfio_pci_dmabuf.c-136-\t.map_dma_buf = vfio_pci_dma_buf_map,\n--\ninclude/linux/dma-buf.h=37=struct dma_buf_ops {\n--\ninclude/linux/dma-buf.h-128-\t *\ninclude/linux/dma-buf.h:129:\t * Optional callback for dma_buf_get_pci_tph(). Called with\ninclude/linux/dma-buf.h-130-\t * \u0026dma_buf.resv held. Returns 0 on success or -EOPNOTSUPP when\n--\ninclude/linux/dma-buf.h-133-\t * Returned metadata follows the lifetime rules documented for\ninclude/linux/dma-buf.h:134:\t * dma_buf_get_pci_tph().\ninclude/linux/dma-buf.h-135-\t */\n--\ninclude/linux/dma-buf.h=588=void dma_buf_unpin(struct dma_buf_attachment *attach);\ninclude/linux/dma-buf.h:589:int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ninclude/linux/dma-buf.h-590-\t\t\tu16 *steering_tag, u8 *ph);\n"
}

gemini-3.1-pro-preview

null

null

							input: 57258
							output: 24
							thoughts: 219
						

**Analyzing Reachability in the Fuzzing Environment**

Okay, so here's the situation: I've been digging into the code and trying to figure out what's actually reachable in our fuzzing environment, specifically with regard to DMA buffer interactions. I've pinpointed that `dma_buf_get_pci_tph` is *only* called by `get_pci_tph_mr_dmabuf` within `drivers/infiniband/hw/mlx5/mr.c`. That means, as things stand, `dma_buf_get_pci_tph` and the related `vfio_pci_dma_buf_get_pci_tph` are essentially dead code paths from a fuzzing perspective. We just can't get to them given the current configuration.

Therefore, the only functions we can reasonably hit during fuzzing are `vfio_pci_core_feature_dma_buf_tph` and `pcie_tph_completer_type`. But let's not just take my word for it. I need to make sure I'm not missing anything.

Now, I'm going to double-check that `vfio_pci_core_feature_dma_buf_tph` is definitely reachable. I remember seeing it called from `vfio_pci_core_ioctl_feature`. Yep, that confirms it – we can absolutely hit that code path.

Finally, I need to verify that `pcie_tph_completer_type` isn't called from anywhere else to be doubly sure of its reachability. I'll need to check the call graph for that function to make sure my initial assessment is correct.

{
  "Expression": "pcie_tph_completer_type"
}

{
  "Output": "drivers/pci/tph.c=186=EXPORT_SYMBOL(pcie_tph_enabled_req_type);\n--\ndrivers/pci/tph.c-188-/**\ndrivers/pci/tph.c:189: * pcie_tph_completer_type - Return the device's TPH Completer support\ndrivers/pci/tph.c-190- * @pdev: PCI device to query\n--\ndrivers/pci/tph.c-200- */\ndrivers/pci/tph.c:201:u8 pcie_tph_completer_type(struct pci_dev *pdev)\ndrivers/pci/tph.c-202-{\n--\ndrivers/pci/tph.c-218-}\ndrivers/pci/tph.c:219:EXPORT_SYMBOL(pcie_tph_completer_type);\ndrivers/pci/tph.c-220-\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=368=int vfio_pci_core_feature_dma_buf_tph(struct vfio_pci_core_device *vdev,\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c-378-\ndrivers/vfio/pci/vfio_pci_dmabuf.c:379:\tcomp = pcie_tph_completer_type(vdev-\u003epdev);\ndrivers/vfio/pci/vfio_pci_dmabuf.c-380-\tif (comp == PCI_EXP_DEVCAP2_TPH_COMP_NONE)\n--\ninclude/linux/pci-tph.h=35=u8 pcie_tph_enabled_req_type(struct pci_dev *pdev);\ninclude/linux/pci-tph.h:36:u8 pcie_tph_completer_type(struct pci_dev *pdev);\ninclude/linux/pci-tph.h-37-#else\n--\ninclude/linux/pci-tph.h=48=static inline u8 pcie_tph_enabled_req_type(struct pci_dev *pdev)\ninclude/linux/pci-tph.h-49-{ return PCI_TPH_REQ_DISABLE; }\ninclude/linux/pci-tph.h:50:static inline u8 pcie_tph_completer_type(struct pci_dev *pdev)\ninclude/linux/pci-tph.h-51-{ return PCI_EXP_DEVCAP2_TPH_COMP_NONE; }\n"
}

gemini-3.1-pro-preview

null

null

							input: 58549
							output: 21
							thoughts: 468
						

**Fuzzing Strategy for vfio_pci_core_feature_dma_buf_tph**

Okay, my focus needs to be solely on `vfio_pci_core_feature_dma_buf_tph`. The primary symbols I'm concerned with are `vfio_pci_core_feature_dma_buf_tph` and `pcie_tph_completer_type`. The goal here is to determine the fuzzability of `vfio_pci_core_feature_dma_buf_tph`.

My initial concern is that if `pcie_tph_completer_type` returns `PCI_EXP_DEVCAP2_TPH_COMP_NONE`, the function returns `-EOPNOTSUPP`. The question then becomes, can we reliably create a PCI device *with* TPH completer capability within the syzkaller environment? Syzkaller often utilizes `syz_kvm_setup_cpu` or `/dev/vfio/` with dummy devices. The problem is, if the dummy device *lacks* TPH completer capability, we're always going to get that `-EOPNOTSUPP` error, which essentially means we'd never reach the core function.

However, even if the error is always returned, it's still *reachable* code, at least the initial lines. This makes it worth fuzzing. The function *is* a functional change to the kernel that we can reach, and we have to see if some clever fuzzing can leverage that. And, one can't rule out the possibility that syzkaller *could* inject a device with TPH capability or that some default QEMU emulated devices might have it. So, I have to mark this as `WorthFuzzing=true`.

Next, I need to check the relevant `EnableConfigs`. We need to ensure that `PCIE_TPH`, `VFIO_PCI`, and `VFIO_PCI_DMABUF` are enabled. `VFIO_PCI_DMABUF` is dependent on `VFIO_PCI_CORE`, `PCI_P2PDMA` and `DMA_SHARED_BUFFER`. Since `DMA_SHARED_BUFFER` is usually on by default, the key is `PCI_P2PDMA`. Now I'll need to check the status of `PCI_P2PDMA`.

{
  "Expression": "config PCI_P2PDMA"
}

{
  "Output": "drivers/pci/Kconfig=197=config PCIE_TPH\n--\ndrivers/pci/Kconfig-205-\ndrivers/pci/Kconfig:206:config PCI_P2PDMA\ndrivers/pci/Kconfig-207-\tbool \"PCI peer-to-peer transfer support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 59644
							output: 18
							thoughts: 569
						

**My Analysis of the Patch for Fuzzing Suitability**

Okay, so the first step is clear: I need to add `PCIE_TPH` and `PCI_P2PDMA` to `EnableConfigs`. That's straightforward enough.

Now, let's go through the `WorthFuzzing` criteria to determine if this patch is actually suitable for fuzzing. I need to make sure this isn't just documentation changes, logging tweaks, decorative macro updates, or code that's unreachable in a standard QEMU environment.

Looking at the patch, it touches `drivers/vfio/pci/vfio_pci_dmabuf.c`, `drivers/pci/tph.c`, and `drivers/dma-buf/dma-buf.c`. All three of those are reachable within a QEMU environment. Therefore, it's safe to say this should be a `WorthFuzzing=true` scenario.

The `FocusSymbols` are `vfio_pci_core_feature_dma_buf_tph` and `pcie_tph_completer_type`. Those are the two key areas to focus on.

So, let me make sure I'm not missing any other key configurations. I can see that `CONFIG_VFIO_PCI` is already enabled in syzkaller. `CONFIG_INFINIBAND` is also enabled, but mlx5 looks to be hardware specific and likely irrelevant here. So, yes, `PCIE_TPH` and `PCI_P2PDMA` are the main ones that are new.

Let's double-check the dependencies. I know `vfio_pci_core_feature_dma_buf_tph` is compiled when `CONFIG_VFIO_PCI_DMABUF` is enabled. And, yes, it's indeed in `drivers/vfio/pci/vfio_pci_dmabuf.c`. Also, I can see that `CONFIG_VFIO_PCI_DMABUF` requires `PCI_P2PDMA`. So, `PCI_P2PDMA` is a must.

Now, let's make sure `pcie_tph_completer_type` is compiled when `CONFIG_PCIE_TPH` is enabled. Yep, that one lives in `drivers/pci/tph.c`. Wait, is `drivers/pci/tph.c` compiled *only* when `CONFIG_PCIE_TPH` is enabled? Need to double-check that... but overall, it looks good for fuzzing.

{
  "Expression": "tph\\.o"
}

{
  "Output": "drivers/pci/Makefile=40=obj-$(CONFIG_PCI_NPEM)\t\t+= npem.o\ndrivers/pci/Makefile:41:obj-$(CONFIG_PCIE_TPH)\t\t+= tph.o\ndrivers/pci/Makefile-42-obj-$(CONFIG_CARDBUS)\t\t+= setup-cardbus.o\n"
}

gemini-3.1-pro-preview

null

null

							input: 60893
							output: 26
							thoughts: 56
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in device driver development and kernel configuration:

**Analyzing a Kernel Build Dependency**

Right, so I see a line that clearly indicates `tph.o` – a module, I presume – is going to be included in the build output if the `CONFIG_PCIE_TPH` option is set. No surprises there; that's standard kernel build syntax. It's a clear dependency: if we want that `tph.o` object file in the built driver then we have to enable that configuration option.

The key question then becomes: where *else* does this `PCIE_TPH` setting appear, and what's its overall impact? My immediate instinct is to check if there's any code that *unconditionally* calls `dma_buf_get_pci_tph`. If that function is called regardless of the `CONFIG_PCIE_TPH` setting, then we have a potential problem. It would imply that the system may try to link to that object even if `CONFIG_PCIE_TPH` is set to "n" which could result in compile time errors. This is the more interesting situation to understand. I need to dig deeper into the code to determine the conditional logic surrounding that particular function.

{
  "Expression": "dma_buf_get_pci_tph"
}

{
  "Output": "drivers/dma-buf/dma-buf.c=919=dma_buf_pin_on_map(struct dma_buf_attachment *attach)\n--\ndrivers/dma-buf/dma-buf.c-941- *     - dma_buf_vunmap()\ndrivers/dma-buf/dma-buf.c:942: *     - dma_buf_get_pci_tph()\ndrivers/dma-buf/dma-buf.c-943- *\n--\ndrivers/dma-buf/dma-buf.c=1147=EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, \"DMA_BUF\");\n--\ndrivers/dma-buf/dma-buf.c-1149-/**\ndrivers/dma-buf/dma-buf.c:1150: * dma_buf_get_pci_tph - Retrieve PCIe TLP Processing Hint (TPH) metadata\ndrivers/dma-buf/dma-buf.c-1151- * @dmabuf: DMA buffer to query\n--\ndrivers/dma-buf/dma-buf.c-1166- */\ndrivers/dma-buf/dma-buf.c:1167:int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ndrivers/dma-buf/dma-buf.c-1168-\t\t\tu16 *steering_tag, u8 *ph)\n--\ndrivers/dma-buf/dma-buf.c-1176-}\ndrivers/dma-buf/dma-buf.c:1177:EXPORT_SYMBOL_NS_GPL(dma_buf_get_pci_tph, \"DMA_BUF\");\ndrivers/dma-buf/dma-buf.c-1178-\n--\ndrivers/infiniband/hw/mlx5/mr.c=950=static void get_pci_tph_mr_dmabuf(struct mlx5_ib_dev *dev, struct dma_buf *dmabuf,\n--\ndrivers/infiniband/hw/mlx5/mr.c-970-\tdma_resv_lock(dmabuf-\u003eresv, NULL);\ndrivers/infiniband/hw/mlx5/mr.c:971:\tret = dma_buf_get_pci_tph(dmabuf, extended, \u0026steering_tag, \u0026local_ph);\ndrivers/infiniband/hw/mlx5/mr.c-972-\tdma_resv_unlock(dmabuf-\u003eresv);\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=62=vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment,\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c-82-\ndrivers/vfio/pci/vfio_pci_dmabuf.c:83:static int vfio_pci_dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ndrivers/vfio/pci/vfio_pci_dmabuf.c-84-\t\t\t\t\tu16 *steering_tag, u8 *ph)\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=133=static const struct dma_buf_ops vfio_pci_dmabuf_ops = {\ndrivers/vfio/pci/vfio_pci_dmabuf.c-134-\t.attach = vfio_pci_dma_buf_attach,\ndrivers/vfio/pci/vfio_pci_dmabuf.c:135:\t.get_pci_tph = vfio_pci_dma_buf_get_pci_tph,\ndrivers/vfio/pci/vfio_pci_dmabuf.c-136-\t.map_dma_buf = vfio_pci_dma_buf_map,\n--\ninclude/linux/dma-buf.h=37=struct dma_buf_ops {\n--\ninclude/linux/dma-buf.h-128-\t *\ninclude/linux/dma-buf.h:129:\t * Optional callback for dma_buf_get_pci_tph(). Called with\ninclude/linux/dma-buf.h-130-\t * \u0026dma_buf.resv held. Returns 0 on success or -EOPNOTSUPP when\n--\ninclude/linux/dma-buf.h-133-\t * Returned metadata follows the lifetime rules documented for\ninclude/linux/dma-buf.h:134:\t * dma_buf_get_pci_tph().\ninclude/linux/dma-buf.h-135-\t */\n--\ninclude/linux/dma-buf.h=588=void dma_buf_unpin(struct dma_buf_attachment *attach);\ninclude/linux/dma-buf.h:589:int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ninclude/linux/dma-buf.h-590-\t\t\tu16 *steering_tag, u8 *ph);\n"
}

gemini-3.1-pro-preview

null

null

							input: 62595
							output: 26
							thoughts: 289
						

**Analyzing DMA-BUF and PCI-TPH Symbol Reachability**

Okay, let's break this down systematically. I've tracked down the relevant code; `dma_buf_get_pci_tph` is definitely in `drivers/dma-buf/dma-buf.c`, which makes sense given that it's conditional on `CONFIG_DMA_SHARED_BUFFER`. So, based on the kernel configuration, it is compiled. Now, the crucial part is understanding *where* it's actually used. The analysis earlier definitively showed that it's *only* called by the mlx5 driver, which, as we established, isn't on the critical path. Therefore, there's no need to clutter `FocusSymbols` with `dma_buf_get_pci_tph`.

Now, the follow-up: what about `vfio_pci_dma_buf_get_pci_tph`? Ah, right, that's a callback within the `dma_buf_ops` structure. But the key here is its *dependency*. It's only called by `dma_buf_get_pci_tph`, which we've just confirmed is itself unreachable. This means `vfio_pci_dma_buf_get_pci_tph` is *also* unreachable. So, adding it to `FocusSymbols` would be unnecessary.

Therefore, after this thorough examination, my conclusion is that the only reachable functions related to this are `vfio_pci_core_feature_dma_buf_tph` and `pcie_tph_completer_type`. However, I need to make *absolutely* sure there isn't some hidden call that I've missed. I must be completely certain that there aren't any other callers of `dma_buf_get_pci_tph` in the kernel. Let me double-check.

{
  "Expression": "dma_buf_get_pci_tph"
}

{
  "Output": "drivers/dma-buf/dma-buf.c=919=dma_buf_pin_on_map(struct dma_buf_attachment *attach)\n--\ndrivers/dma-buf/dma-buf.c-941- *     - dma_buf_vunmap()\ndrivers/dma-buf/dma-buf.c:942: *     - dma_buf_get_pci_tph()\ndrivers/dma-buf/dma-buf.c-943- *\n--\ndrivers/dma-buf/dma-buf.c=1147=EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, \"DMA_BUF\");\n--\ndrivers/dma-buf/dma-buf.c-1149-/**\ndrivers/dma-buf/dma-buf.c:1150: * dma_buf_get_pci_tph - Retrieve PCIe TLP Processing Hint (TPH) metadata\ndrivers/dma-buf/dma-buf.c-1151- * @dmabuf: DMA buffer to query\n--\ndrivers/dma-buf/dma-buf.c-1166- */\ndrivers/dma-buf/dma-buf.c:1167:int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ndrivers/dma-buf/dma-buf.c-1168-\t\t\tu16 *steering_tag, u8 *ph)\n--\ndrivers/dma-buf/dma-buf.c-1176-}\ndrivers/dma-buf/dma-buf.c:1177:EXPORT_SYMBOL_NS_GPL(dma_buf_get_pci_tph, \"DMA_BUF\");\ndrivers/dma-buf/dma-buf.c-1178-\n--\ndrivers/infiniband/hw/mlx5/mr.c=950=static void get_pci_tph_mr_dmabuf(struct mlx5_ib_dev *dev, struct dma_buf *dmabuf,\n--\ndrivers/infiniband/hw/mlx5/mr.c-970-\tdma_resv_lock(dmabuf-\u003eresv, NULL);\ndrivers/infiniband/hw/mlx5/mr.c:971:\tret = dma_buf_get_pci_tph(dmabuf, extended, \u0026steering_tag, \u0026local_ph);\ndrivers/infiniband/hw/mlx5/mr.c-972-\tdma_resv_unlock(dmabuf-\u003eresv);\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=62=vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment,\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c-82-\ndrivers/vfio/pci/vfio_pci_dmabuf.c:83:static int vfio_pci_dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ndrivers/vfio/pci/vfio_pci_dmabuf.c-84-\t\t\t\t\tu16 *steering_tag, u8 *ph)\n--\ndrivers/vfio/pci/vfio_pci_dmabuf.c=133=static const struct dma_buf_ops vfio_pci_dmabuf_ops = {\ndrivers/vfio/pci/vfio_pci_dmabuf.c-134-\t.attach = vfio_pci_dma_buf_attach,\ndrivers/vfio/pci/vfio_pci_dmabuf.c:135:\t.get_pci_tph = vfio_pci_dma_buf_get_pci_tph,\ndrivers/vfio/pci/vfio_pci_dmabuf.c-136-\t.map_dma_buf = vfio_pci_dma_buf_map,\n--\ninclude/linux/dma-buf.h=37=struct dma_buf_ops {\n--\ninclude/linux/dma-buf.h-128-\t *\ninclude/linux/dma-buf.h:129:\t * Optional callback for dma_buf_get_pci_tph(). Called with\ninclude/linux/dma-buf.h-130-\t * \u0026dma_buf.resv held. Returns 0 on success or -EOPNOTSUPP when\n--\ninclude/linux/dma-buf.h-133-\t * Returned metadata follows the lifetime rules documented for\ninclude/linux/dma-buf.h:134:\t * dma_buf_get_pci_tph().\ninclude/linux/dma-buf.h-135-\t */\n--\ninclude/linux/dma-buf.h=588=void dma_buf_unpin(struct dma_buf_attachment *attach);\ninclude/linux/dma-buf.h:589:int dma_buf_get_pci_tph(struct dma_buf *dmabuf, bool extended,\ninclude/linux/dma-buf.h-590-\t\t\tu16 *steering_tag, u8 *ph);\n"
}

gemini-3.1-pro-preview

null

null

							input: 64669
							output: 164
							thoughts: 548
						

**My Final Thoughts on the Configuration**

Alright, no more incoming calls – time to finalize this configuration. The final list of `FocusSymbols` seems solid: `vfio_pci_core_feature_dma_buf_tph` and `pcie_tph_completer_type`. Those are the core elements.

Now, for the `EnableConfigs`. We've got `PCIE_TPH` and `PCI_P2PDMA`. I need to double-check if any other configurations are necessary, especially since we are dealing with DMA-BUF and VFIO.

Ah, right, `CONFIG_VFIO_PCI_DMABUF` is a `def_bool` and depends on the others, so we don't need to specify it explicitly, that's taken care of. However, `PCI_P2PDMA` has a dependency on `ZONE_DEVICE`. Hmm, is `ZONE_DEVICE` a default or something we *must* enable? Syzkaller configs usually have it enabled, but to be safe, I'll add it. No, wait, hold on. The instructions say, "Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code." `ZONE_DEVICE` is quite generic, but `PCI_P2PDMA` is quite specific. Okay, leave it off.

Let's review the patch's purpose: it adds PCIe TLP Processing Hints (TPH) support to DMA-BUF and VFIO, and the new `VFIO_DEVICE_FEATURE_DMA_BUF_TPH` ioctl can be fuzzed. The driver code is reachable. The changes are functional and reachable.

Is there anything else to consider? Maybe `vfio_pci_dma_buf_get_pci_tph`? Even though mlx5 doesn't directly call it, could syzkaller find another way? But, there aren't any other callers in the kernel. So, no. It can't be triggered.

Let's check `mlx5_st_alloc_index_by_tag` and `mlx5_st_get_index`. These are in `drivers/net/ethernet/mellanox/mlx5/core/lib/st.c`. Since mlx5 is hardware and not directly reachable, we can ignore them.

So, I think we're good. This looks like a solid, targeted configuration.

{
  "EnableConfigs": [
    "PCIE_TPH",
    "PCI_P2PDMA"
  ],
  "FocusSymbols": [
    "vfio_pci_core_feature_dma_buf_tph",
    "pcie_tph_completer_type"
  ],
  "Reasoning": "The patch adds support for PCIe TLP Processing Hints (TPH) to DMA-BUF and VFIO. The new ioctl VFIO_DEVICE_FEATURE_DMA_BUF_TPH is reachable and can be fuzzed. The changes in drivers/pci/tph.c and drivers/vfio/pci/vfio_pci_dmabuf.c are functional and reachable.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "PCIE_TPH",
    "PCI_P2PDMA"
  ],
  "FocusSymbols": [
    "vfio_pci_core_feature_dma_buf_tph",
    "pcie_tph_completer_type"
  ],
  "Reasoning": "The patch adds support for PCIe TLP Processing Hints (TPH) to DMA-BUF and VFIO. The new ioctl VFIO_DEVICE_FEATURE_DMA_BUF_TPH is reachable and can be fuzzed. The changes in drivers/pci/tph.c and drivers/vfio/pci/vfio_pci_dmabuf.c are functional and reachable.",
  "WorthFuzzing": true
}