| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/04 10:04 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies the Marvell OcteonTX2 RVU (Resource Virtualization Unit) ethernet driver and representor handling under drivers/net/ethernet/marvell/octeontx2/. This code requires proprietary Cavium/Marvell OcteonTX2 hardware/SmartNIC ASICs that are not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/04 10:04 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 43d9bc0cdbd1b376010d5ff94a5c92fa862060ee\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Sep 4 10:04:26 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h\nindex 73f743e4a83d7..f8342a71aac91 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h\n@@ -1775,10 +1775,12 @@ struct ptp_get_cap_rsp {\n \tu64 cap;\n };\n \n+#define RVU_MAX_REP\t64\n+\n struct get_rep_cnt_rsp {\n \tstruct mbox_msghdr hdr;\n \tu16 rep_cnt;\n-\tu16 rep_pf_map[64];\n+\tu16 rep_pf_map[RVU_MAX_REP];\n \tu64 rsvd;\n };\n \ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c\nindex ffba56ee8a60c..392d02963f070 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c\n@@ -3709,6 +3709,20 @@ static void rvu_remove(struct pci_dev *pdev)\n \trvu_unregister_dl(rvu);\n \trvu_unregister_interrupts(rvu);\n \trvu_flr_wq_destroy(rvu);\n+\tif (rvu-\u003erep_evt_wq) {\n+\t\tstruct workqueue_struct *rep_wq = rvu-\u003erep_evt_wq;\n+\n+\t\t/* NULL the pointer before flushing mbox_wq. Any mbox handler\n+\t\t * still in flight will snapshot NULL via READ_ONCE() and return\n+\t\t * -EINVAL without calling queue_work(), so no new items can be\n+\t\t * added to rep_wq after flush_workqueue(mbox_wq) returns.\n+\t\t */\n+\t\tWRITE_ONCE(rvu-\u003erep_evt_wq, NULL);\n+\t\tflush_workqueue(rvu-\u003eafpf_wq_info.mbox_wq);\n+\t\tdestroy_workqueue(rep_wq);\n+\t} else {\n+\t\tflush_workqueue(rvu-\u003eafpf_wq_info.mbox_wq);\n+\t}\n \trvu_cgx_exit(rvu);\n \trvu_fwdata_exit(rvu);\n \trvu_mcs_exit(rvu);\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\nindex a2781e0f504e3..69b260fdd52d1 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\n@@ -44,6 +44,8 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)\n \tif (event-\u003eevent \u0026 RVU_EVENT_MAC_ADDR_CHANGE)\n \t\tether_addr_copy(pfvf-\u003emac_addr, event-\u003eevt_data.mac);\n \n+\tif (event-\u003eevent \u0026 RVU_EVENT_PFVF_STATE)\n+\t\tpf = rvu_get_pf(rvu-\u003epdev, event-\u003ehdr.pcifunc);\n \tmutex_lock(\u0026rvu-\u003embox_lock);\n \tmsg = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);\n \tif (!msg) {\n@@ -53,6 +55,10 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)\n \n \tmsg-\u003ehdr.pcifunc = event-\u003epcifunc;\n \tmsg-\u003eevent = event-\u003eevent;\n+\tmsg-\u003epcifunc = event-\u003epcifunc;\n+\n+\tif (event-\u003eevent \u0026 RVU_EVENT_PFVF_STATE)\n+\t\tmsg-\u003ehdr.pcifunc = event-\u003ehdr.pcifunc;\n \n \tmemcpy(\u0026msg-\u003eevt_data, \u0026event-\u003eevt_data, sizeof(struct rep_evt_data));\n \n@@ -95,8 +101,17 @@ static void rvu_rep_wq_handler(struct work_struct *work)\n int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,\n \t\t\t\t struct msg_rsp *rsp)\n {\n+\tstruct workqueue_struct *wq;\n \tstruct rep_evtq_ent *qentry;\n \n+\twq = READ_ONCE(rvu-\u003erep_evt_wq);\n+\tif (!wq)\n+\t\treturn -EINVAL;\n+\n+\t/* Only the registered representor PF may send REP_EVENT_NOTIFY. */\n+\tif (req-\u003ehdr.pcifunc != rvu-\u003erep_pcifunc)\n+\t\treturn -EPERM;\n+\n \t/* The mailbox dispatcher normalises only the header pcifunc; the\n \t * nested struct rep_event::pcifunc body field is sender-controlled\n \t * and is later used by rvu_rep_up_notify() to index rvu-\u003epf[] /\n@@ -105,6 +120,14 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,\n \tif (!is_pf_func_valid(rvu, req-\u003epcifunc))\n \t\treturn -EINVAL;\n \n+\t/* Only CGX-mapped PFs are present in the representor map. */\n+\tif (!is_pf_cgxmapped(rvu, rvu_get_pf(rvu-\u003epdev, req-\u003epcifunc)))\n+\t\treturn -EINVAL;\n+\n+\tif ((req-\u003eevent \u0026 RVU_EVENT_PFVF_STATE) \u0026\u0026\n+\t rvu_get_pf(rvu-\u003epdev, req-\u003ehdr.pcifunc) \u003e= rvu-\u003ehw-\u003etotal_pfs)\n+\t\treturn -EINVAL;\n+\n \tqentry = kmalloc_obj(*qentry, GFP_ATOMIC);\n \tif (!qentry)\n \t\treturn -ENOMEM;\n@@ -113,37 +136,23 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,\n \tspin_lock(\u0026rvu-\u003erep_evtq_lock);\n \tlist_add_tail(\u0026qentry-\u003enode, \u0026rvu-\u003erep_evtq_head);\n \tspin_unlock(\u0026rvu-\u003erep_evtq_lock);\n-\tqueue_work(rvu-\u003erep_evt_wq, \u0026rvu-\u003erep_evt_work);\n+\tqueue_work(wq, \u0026rvu-\u003erep_evt_work);\n \treturn 0;\n }\n \n int rvu_rep_notify_pfvf_state(struct rvu *rvu, u16 pcifunc, bool enable)\n {\n-\tstruct rep_event *req;\n-\tint pf;\n+\tstruct rep_event req = { 0 };\n+\tstruct msg_rsp rsp;\n \n \tif (!is_pf_cgxmapped(rvu, rvu_get_pf(rvu-\u003epdev, pcifunc)))\n \t\treturn 0;\n \n-\tpf = rvu_get_pf(rvu-\u003epdev, rvu-\u003erep_pcifunc);\n-\n-\tmutex_lock(\u0026rvu-\u003embox_lock);\n-\treq = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);\n-\tif (!req) {\n-\t\tmutex_unlock(\u0026rvu-\u003embox_lock);\n-\t\treturn -ENOMEM;\n-\t}\n-\n-\treq-\u003ehdr.pcifunc = rvu-\u003erep_pcifunc;\n-\treq-\u003eevent |= RVU_EVENT_PFVF_STATE;\n-\treq-\u003epcifunc = pcifunc;\n-\treq-\u003eevt_data.vf_state = enable;\n-\n-\totx2_mbox_wait_for_zero(\u0026rvu-\u003eafpf_wq_info.mbox_up, pf);\n-\totx2_mbox_msg_send_up(\u0026rvu-\u003eafpf_wq_info.mbox_up, pf);\n-\n-\tmutex_unlock(\u0026rvu-\u003embox_lock);\n-\treturn 0;\n+\treq.hdr.pcifunc = rvu-\u003erep_pcifunc;\n+\treq.event = RVU_EVENT_PFVF_STATE;\n+\treq.pcifunc = pcifunc;\n+\treq.evt_data.vf_state = enable;\n+\treturn rvu_mbox_handler_rep_event_notify(rvu, \u0026req, \u0026rsp);\n }\n \n #define RVU_LF_RX_STATS(reg) \\\n@@ -325,6 +334,7 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \tu16 start = rswitch-\u003estart_entry;\n \tstruct rvu_hwinfo *hw = rvu-\u003ehw;\n \tu16 pcifunc, entry = 0;\n+\tstruct rvu_pfvf *pfvf;\n \tint pf, vf, numvfs;\n \tint err, nixlf, i;\n \tu8 rep;\n@@ -334,19 +344,22 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \t\t\tcontinue;\n \n \t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, 0);\n+\t\tpfvf = rvu_get_pfvf(rvu, pcifunc);\n \t\trvu_get_nix_blkaddr(rvu, pcifunc);\n+\t\tif (test_bit(NIXLF_INITIALIZED, \u0026pfvf-\u003eflags))\n+\t\t\trvu_switch_enable_lbk_link(rvu, pcifunc, true);\n \t\trep = true;\n \t\tfor (i = 0; i \u003c 2; i++) {\n \t\t\terr = rvu_rep_install_rx_rule(rvu, pcifunc,\n \t\t\t\t\t\t start + entry, rep);\n \t\t\tif (err)\n-\t\t\t\treturn err;\n+\t\t\t\tgoto err_disable_lbk;\n \t\t\trswitch-\u003eentry2pcifunc[entry++] = pcifunc;\n \n \t\t\terr = rvu_rep_install_tx_rule(rvu, pcifunc,\n \t\t\t\t\t\t start + entry, rep);\n \t\t\tif (err)\n-\t\t\t\treturn err;\n+\t\t\t\tgoto err_disable_lbk;\n \t\t\trswitch-\u003eentry2pcifunc[entry++] = pcifunc;\n \t\t\trep = false;\n \t\t}\n@@ -354,9 +367,12 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \t\trvu_get_pf_numvfs(rvu, pf, \u0026numvfs, NULL);\n \t\tfor (vf = 0; vf \u003c numvfs; vf++) {\n \t\t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, vf + 1);\n+\t\t\tpfvf = rvu_get_pfvf(rvu, pcifunc);\n+\t\t\tif (test_bit(NIXLF_INITIALIZED, \u0026pfvf-\u003eflags))\n+\t\t\t\trvu_switch_enable_lbk_link(rvu, pcifunc, true);\n \t\t\trvu_get_nix_blkaddr(rvu, pcifunc);\n \n-\t\t\t/* Skip installimg rules if nixlf is not attached */\n+\t\t\t/* Skip installing rules if nixlf is not attached */\n \t\t\terr = nix_get_nixlf(rvu, pcifunc, \u0026nixlf, NULL);\n \t\t\tif (err)\n \t\t\t\tcontinue;\n@@ -366,30 +382,37 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \t\t\t\t\t\t\t start + entry,\n \t\t\t\t\t\t\t rep);\n \t\t\t\tif (err)\n-\t\t\t\t\treturn err;\n+\t\t\t\t\tgoto err_disable_lbk;\n \t\t\t\trswitch-\u003eentry2pcifunc[entry++] = pcifunc;\n \n \t\t\t\terr = rvu_rep_install_tx_rule(rvu, pcifunc,\n \t\t\t\t\t\t\t start + entry,\n \t\t\t\t\t\t\t rep);\n \t\t\t\tif (err)\n-\t\t\t\t\treturn err;\n+\t\t\t\t\tgoto err_disable_lbk;\n \t\t\t\trswitch-\u003eentry2pcifunc[entry++] = pcifunc;\n \t\t\t\trep = false;\n \t\t\t}\n \t\t}\n \t}\n+\treturn 0;\n \n-\t/* Initialize the wq for handling REP events */\n-\tspin_lock_init(\u0026rvu-\u003erep_evtq_lock);\n-\tINIT_LIST_HEAD(\u0026rvu-\u003erep_evtq_head);\n-\tINIT_WORK(\u0026rvu-\u003erep_evt_work, rvu_rep_wq_handler);\n-\trvu-\u003erep_evt_wq = alloc_workqueue(\"rep_evt_wq\", WQ_PERCPU, 0);\n-\tif (!rvu-\u003erep_evt_wq) {\n-\t\tdev_err(rvu-\u003edev, \"REP workqueue allocation failed\\n\");\n-\t\treturn -ENOMEM;\n+err_disable_lbk:\n+\t/* Undo any LBK links enabled above before the MCAM rule failure.\n+\t * Disabling a link that was never enabled is a safe no-op.\n+\t */\n+\tfor (pf = 1; pf \u003c hw-\u003etotal_pfs; pf++) {\n+\t\tif (!is_pf_cgxmapped(rvu, pf))\n+\t\t\tcontinue;\n+\t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, 0);\n+\t\trvu_switch_enable_lbk_link(rvu, pcifunc, false);\n+\t\trvu_get_pf_numvfs(rvu, pf, \u0026numvfs, NULL);\n+\t\tfor (vf = 0; vf \u003c numvfs; vf++) {\n+\t\t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, vf + 1);\n+\t\t\trvu_switch_enable_lbk_link(rvu, pcifunc, false);\n+\t\t}\n \t}\n-\treturn 0;\n+\treturn err;\n }\n \n void rvu_rep_update_rules(struct rvu *rvu, u16 pcifunc, bool ena)\n@@ -443,35 +466,92 @@ int rvu_mbox_handler_esw_cfg(struct rvu *rvu, struct esw_cfg_req *req,\n \treturn 0;\n }\n \n+static int rvu_rep_get_rep_map(struct rvu *rvu, struct msg_req *req,\n+\t\t\t struct get_rep_cnt_rsp *rsp)\n+{\n+\tint rep;\n+\n+\tif (req-\u003ehdr.pcifunc != rvu-\u003erep_pcifunc)\n+\t\treturn -EPERM;\n+\n+\trsp-\u003erep_cnt = rvu-\u003erep_cnt;\n+\tfor (rep = 0; rep \u003c rvu-\u003erep_cnt; rep++)\n+\t\trsp-\u003erep_pf_map[rep] = rvu-\u003erep2pfvf_map[rep];\n+\n+\treturn 0;\n+}\n+\n int rvu_mbox_handler_get_rep_cnt(struct rvu *rvu, struct msg_req *req,\n \t\t\t\t struct get_rep_cnt_rsp *rsp)\n {\n-\tint pf, vf, numvfs, hwvf, rep = 0;\n+\tint pf, vf, numvfs, hwvf, rep = 0, cnt;\n+\tint ret = 0;\n \tu16 pcifunc;\n+\tu16 *map;\n+\n+\t/* Serialize first-time initialization. mbox_wq is WQ_PERCPU so\n+\t * handlers for different PFs can run concurrently; without this\n+\t * lock two callers could both observe rep2pfvf_map == NULL and\n+\t * double-allocate the workqueue, leaking one permanently.\n+\t */\n+\tmutex_lock(\u0026rvu-\u003ersrc_lock);\n+\n+\tif (rvu-\u003erep2pfvf_map) {\n+\t\tret = rvu_rep_get_rep_map(rvu, req, rsp);\n+\t\tgoto unlock;\n+\t}\n \n \trvu-\u003erep_pcifunc = req-\u003ehdr.pcifunc;\n-\trsp-\u003erep_cnt = rvu-\u003ecgx_mapped_pfs + rvu-\u003ecgx_mapped_vfs;\n-\trvu-\u003erep_cnt = rsp-\u003erep_cnt;\n+\tcnt = min_t(int, rvu-\u003ecgx_mapped_pfs + rvu-\u003ecgx_mapped_vfs,\n+\t\t RVU_MAX_REP);\n \n-\trvu-\u003erep2pfvf_map = devm_kzalloc(rvu-\u003edev, rvu-\u003erep_cnt *\n-\t\t\t\t\t sizeof(u16), GFP_KERNEL);\n-\tif (!rvu-\u003erep2pfvf_map)\n-\t\treturn -ENOMEM;\n+\t/* Allocate at least one element so the pointer is always non-NULL\n+\t * once published, keeping the fast-path check above reliable.\n+\t */\n+\tmap = devm_kzalloc(rvu-\u003edev, (cnt ?: 1) * sizeof(u16), GFP_KERNEL);\n+\tif (!map) {\n+\t\tret = -ENOMEM;\n+\t\tgoto unlock;\n+\t}\n \n \tfor (pf = 0; pf \u003c rvu-\u003ehw-\u003etotal_pfs; pf++) {\n \t\tif (!is_pf_cgxmapped(rvu, pf))\n \t\t\tcontinue;\n+\t\tif (rep \u003e= cnt)\n+\t\t\tbreak;\n \t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, 0);\n-\t\trvu-\u003erep2pfvf_map[rep] = pcifunc;\n+\t\tmap[rep] = pcifunc;\n \t\trsp-\u003erep_pf_map[rep] = pcifunc;\n \t\trep++;\n \t\trvu_get_pf_numvfs(rvu, pf, \u0026numvfs, \u0026hwvf);\n-\t\tfor (vf = 0; vf \u003c numvfs; vf++) {\n-\t\t\trvu-\u003erep2pfvf_map[rep] = pcifunc |\n-\t\t\t\t((vf + 1) \u0026 RVU_PFVF_FUNC_MASK);\n-\t\t\trsp-\u003erep_pf_map[rep] = rvu-\u003erep2pfvf_map[rep];\n+\t\tfor (vf = 0; vf \u003c numvfs \u0026\u0026 rep \u003c cnt; vf++) {\n+\t\t\tmap[rep] = pcifunc | ((vf + 1) \u0026 RVU_PFVF_FUNC_MASK);\n+\t\t\trsp-\u003erep_pf_map[rep] = map[rep];\n \t\t\trep++;\n \t\t}\n \t}\n-\treturn 0;\n+\n+\tif (!cnt) {\n+\t\trvu-\u003erep2pfvf_map = map;\n+\t\tgoto unlock;\n+\t}\n+\n+\t/* Initialize the wq for handling REP events */\n+\tspin_lock_init(\u0026rvu-\u003erep_evtq_lock);\n+\tINIT_LIST_HEAD(\u0026rvu-\u003erep_evtq_head);\n+\tINIT_WORK(\u0026rvu-\u003erep_evt_work, rvu_rep_wq_handler);\n+\trvu-\u003erep_evt_wq = alloc_workqueue(\"rep_evt_wq\", WQ_UNBOUND, 0);\n+\tif (!rvu-\u003erep_evt_wq) {\n+\t\tdev_err(rvu-\u003edev, \"REP workqueue allocation failed\\n\");\n+\t\tdevm_kfree(rvu-\u003edev, map);\n+\t\tret = -ENOMEM;\n+\t\tgoto unlock;\n+\t}\n+\n+\trvu-\u003erep_cnt = cnt;\n+\trsp-\u003erep_cnt = cnt;\n+\trvu-\u003erep2pfvf_map = map;\n+unlock:\n+\tmutex_unlock(\u0026rvu-\u003ersrc_lock);\n+\treturn ret;\n }\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c\nindex 49ce38685a7e6..8c2c984035074 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c\n@@ -12,11 +12,18 @@ void rvu_switch_enable_lbk_link(struct rvu *rvu, u16 pcifunc, bool enable)\n {\n \tstruct rvu_pfvf *pfvf = rvu_get_pfvf(rvu, pcifunc);\n \tstruct nix_hw *nix_hw;\n+\tint blkaddr;\n \n-\tnix_hw = get_nix_hw(rvu-\u003ehw, pfvf-\u003enix_blkaddr);\n+\tmutex_lock(\u0026rvu-\u003ersrc_lock);\n+\tblkaddr = pfvf-\u003enix_blkaddr;\n+\tnix_hw = get_nix_hw(rvu-\u003ehw, blkaddr);\n \t/* Enable LBK links with channel 63 for TX MCAM rule */\n-\trvu_nix_tx_tl2_cfg(rvu, pfvf-\u003enix_blkaddr, pcifunc,\n+\tif (!nix_hw)\n+\t\tgoto unlock;\n+\trvu_nix_tx_tl2_cfg(rvu, blkaddr, pcifunc,\n \t\t\t \u0026nix_hw-\u003etxsch[NIX_TXSCH_LVL_TL2], enable);\n+unlock:\n+\tmutex_unlock(\u0026rvu-\u003ersrc_lock);\n }\n \n static int rvu_switch_install_rx_rule(struct rvu *rvu, u16 pcifunc,\n@@ -229,8 +236,20 @@ void rvu_switch_disable(struct rvu *rvu)\n \tif (!rswitch-\u003eused_entries)\n \t\treturn;\n \n-\tif (rvu-\u003erep_mode)\n+\tif (rvu-\u003erep_mode) {\n+\t\tfor (pf = 1; pf \u003c hw-\u003etotal_pfs; pf++) {\n+\t\t\tif (!is_pf_cgxmapped(rvu, pf))\n+\t\t\t\tcontinue;\n+\t\t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, 0);\n+\t\t\trvu_switch_enable_lbk_link(rvu, pcifunc, false);\n+\t\t\trvu_get_pf_numvfs(rvu, pf, \u0026numvfs, NULL);\n+\t\t\tfor (vf = 0; vf \u003c numvfs; vf++) {\n+\t\t\t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, vf + 1);\n+\t\t\t\trvu_switch_enable_lbk_link(rvu, pcifunc, false);\n+\t\t\t}\n+\t\t}\n \t\tgoto free_ents;\n+\t}\n \n \tfor (pf = 1; pf \u003c hw-\u003etotal_pfs; pf++) {\n \t\tif (!is_pf_cgxmapped(rvu, pf))\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c\nindex 0f5d5642d3f7a..ef47e7e219016 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c\n@@ -301,6 +301,12 @@ static void rvu_rep_state_evt_handler(struct otx2_nic *priv,\n \tint rep_id;\n \n \trep_id = rvu_rep_get_repid(priv, info-\u003epcifunc);\n+\tif (rep_id \u003c 0) {\n+\t\tdev_warn_ratelimited(priv-\u003edev,\n+\t\t\t\t \"REP state event for unknown pcifunc 0x%x (err %d)\\n\",\n+\t\t\t\t info-\u003epcifunc, rep_id);\n+\t\treturn;\n+\t}\n \trep = priv-\u003ereps[rep_id];\n \tif (info-\u003eevt_data.vf_state)\n \t\trep-\u003eflags |= RVU_REP_VF_INITIALIZED;\n@@ -459,6 +465,9 @@ static int rvu_rep_open(struct net_device *dev)\n \tnetif_carrier_on(dev);\n \tnetif_tx_start_all_queues(dev);\n \n+\tif (rep-\u003epcifunc \u0026 RVU_PFVF_FUNC_MASK)\n+\t\treturn 0;\n+\n \tevt.event = RVU_EVENT_PORT_STATE;\n \tevt.evt_data.port_state = 1;\n \tevt.pcifunc = rep-\u003epcifunc;\n@@ -478,6 +487,9 @@ static int rvu_rep_stop(struct net_device *dev)\n \tnetif_carrier_off(dev);\n \tnetif_tx_disable(dev);\n \n+\tif (rep-\u003epcifunc \u0026 RVU_PFVF_FUNC_MASK)\n+\t\treturn 0;\n+\n \tevt.event = RVU_EVENT_PORT_STATE;\n \tevt.pcifunc = rep-\u003epcifunc;\n \trvu_rep_notify_pfvf(priv, RVU_EVENT_PORT_STATE, \u0026evt);\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.h b/drivers/net/ethernet/marvell/octeontx2/nic/rep.h\nindex 5bc9e2c7d800b..b98fe191e83a3 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.h\n+++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.h\n@@ -16,7 +16,6 @@\n \n #define PCI_DEVID_RVU_REP\t0xA0E0\n \n-#define RVU_MAX_REP\tOTX2_MAX_CQ_CNT\n \n struct rep_stats {\n \tu64 rx_bytes;\n"
} |
| 2/1 | 2026/09/04 10:04 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the Marvell OcteonTX2 RVU (Resource Virtualization Unit) ethernet driver and representor handling under drivers/net/ethernet/marvell/octeontx2/. This code requires proprietary Cavium/Marvell OcteonTX2 hardware/SmartNIC ASICs that are not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 43d9bc0cdbd1b376010d5ff94a5c92fa862060ee
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Sep 4 10:04:26 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
index 73f743e4a83d7..f8342a71aac91 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
@@ -1775,10 +1775,12 @@ struct ptp_get_cap_rsp {
u64 cap;
};
+#define RVU_MAX_REP 64
+
struct get_rep_cnt_rsp {
struct mbox_msghdr hdr;
u16 rep_cnt;
- u16 rep_pf_map[64];
+ u16 rep_pf_map[RVU_MAX_REP];
u64 rsvd;
};
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
index ffba56ee8a60c..392d02963f070 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -3709,6 +3709,20 @@ static void rvu_remove(struct pci_dev *pdev)
rvu_unregister_dl(rvu);
rvu_unregister_interrupts(rvu);
rvu_flr_wq_destroy(rvu);
+ if (rvu->rep_evt_wq) {
+ struct workqueue_struct *rep_wq = rvu->rep_evt_wq;
+
+ /* NULL the pointer before flushing mbox_wq. Any mbox handler
+ * still in flight will snapshot NULL via READ_ONCE() and return
+ * -EINVAL without calling queue_work(), so no new items can be
+ * added to rep_wq after flush_workqueue(mbox_wq) returns.
+ */
+ WRITE_ONCE(rvu->rep_evt_wq, NULL);
+ flush_workqueue(rvu->afpf_wq_info.mbox_wq);
+ destroy_workqueue(rep_wq);
+ } else {
+ flush_workqueue(rvu->afpf_wq_info.mbox_wq);
+ }
rvu_cgx_exit(rvu);
rvu_fwdata_exit(rvu);
rvu_mcs_exit(rvu);
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c
index a2781e0f504e3..69b260fdd52d1 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c
@@ -44,6 +44,8 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)
if (event->event & RVU_EVENT_MAC_ADDR_CHANGE)
ether_addr_copy(pfvf->mac_addr, event->evt_data.mac);
+ if (event->event & RVU_EVENT_PFVF_STATE)
+ pf = rvu_get_pf(rvu->pdev, event->hdr.pcifunc);
mutex_lock(&rvu->mbox_lock);
msg = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);
if (!msg) {
@@ -53,6 +55,10 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)
msg->hdr.pcifunc = event->pcifunc;
msg->event = event->event;
+ msg->pcifunc = event->pcifunc;
+
+ if (event->event & RVU_EVENT_PFVF_STATE)
+ msg->hdr.pcifunc = event->hdr.pcifunc;
memcpy(&msg->evt_data, &event->evt_data, sizeof(struct rep_evt_data));
@@ -95,8 +101,17 @@ static void rvu_rep_wq_handler(struct work_struct *work)
int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,
struct msg_rsp *rsp)
{
+ struct workqueue_struct *wq;
struct rep_evtq_ent *qentry;
+ wq = READ_ONCE(rvu->rep_evt_wq);
+ if (!wq)
+ return -EINVAL;
+
+ /* Only the registered representor PF may send REP_EVENT_NOTIFY. */
+ if (req->hdr.pcifunc != rvu->rep_pcifunc)
+ return -EPERM;
+
/* The mailbox dispatcher normalises only the header pcifunc; the
* nested struct rep_event::pcifunc body field is sender-controlled
* and is later used by rvu_rep_up_notify() to index rvu->pf[] /
@@ -105,6 +120,14 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,
if (!is_pf_func_valid(rvu, req->pcifunc))
return -EINVAL;
+ /* Only CGX-mapped PFs are present in the representor map. */
+ if (!is_pf_cgxmapped(rvu, rvu_get_pf(rvu->pdev, req->pcifunc)))
+ return -EINVAL;
+
+ if ((req->event & RVU_EVENT_PFVF_STATE) &&
+ rvu_get_pf(rvu->pdev, req->hdr.pcifunc) >= rvu->hw->total_pfs)
+ return -EINVAL;
+
qentry = kmalloc_obj(*qentry, GFP_ATOMIC);
if (!qentry)
return -ENOMEM;
@@ -113,37 +136,23 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,
spin_lock(&rvu->rep_evtq_lock);
list_add_tail(&qentry->node, &rvu->rep_evtq_head);
spin_unlock(&rvu->rep_evtq_lock);
- queue_work(rvu->rep_evt_wq, &rvu->rep_evt_work);
+ queue_work(wq, &rvu->rep_evt_work);
return 0;
}
int rvu_rep_notify_pfvf_state(struct rvu *rvu, u16 pcifunc, bool enable)
{
- struct rep_event *req;
- int pf;
+ struct rep_event req = { 0 };
+ struct msg_rsp rsp;
if (!is_pf_cgxmapped(rvu, rvu_get_pf(rvu->pdev, pcifunc)))
return 0;
- pf = rvu_get_pf(rvu->pdev, rvu->rep_pcifunc);
-
- mutex_lock(&rvu->mbox_lock);
- req = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);
- if (!req) {
- mutex_unlock(&rvu->mbox_lock);
- return -ENOMEM;
- }
-
- req->hdr.pcifunc = rvu->rep_pcifunc;
- req->event |= RVU_EVENT_PFVF_STATE;
- req->pcifunc = pcifunc;
- req->evt_data.vf_state = enable;
-
- otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, pf);
- otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, pf);
-
- mutex_unlock(&rvu->mbox_lock);
- return 0;
+ req.hdr.pcifunc = rvu->rep_pcifunc;
+ req.event = RVU_EVENT_PFVF_STATE;
+ req.pcifunc = pcifunc;
+ req.evt_data.vf_state = enable;
+ return rvu_mbox_handler_rep_event_notify(rvu, &req, &rsp);
}
#define RVU_LF_RX_STATS(reg) \
@@ -325,6 +334,7 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
u16 start = rswitch->start_entry;
struct rvu_hwinfo *hw = rvu->hw;
u16 pcifunc, entry = 0;
+ struct rvu_pfvf *pfvf;
int pf, vf, numvfs;
int err, nixlf, i;
u8 rep;
@@ -334,19 +344,22 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
continue;
pcifunc = rvu_make_pcifunc(rvu->pdev, pf, 0);
+ pfvf = rvu_get_pfvf(rvu, pcifunc);
rvu_get_nix_blkaddr(rvu, pcifunc);
+ if (test_bit(NIXLF_INITIALIZED, &pfvf->flags))
+ rvu_switch_enable_lbk_link(rvu, pcifunc, true);
rep = true;
for (i = 0; i < 2; i++) {
err = rvu_rep_install_rx_rule(rvu, pcifunc,
start + entry, rep);
if (err)
- return err;
+ goto err_disable_lbk;
rswitch->entry2pcifunc[entry++] = pcifunc;
err = rvu_rep_install_tx_rule(rvu, pcifunc,
start + entry, rep);
if (err)
- return err;
+ goto err_disable_lbk;
rswitch->entry2pcifunc[entry++] = pcifunc;
rep = false;
}
@@ -354,9 +367,12 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
rvu_get_pf_numvfs(rvu, pf, &numvfs, NULL);
for (vf = 0; vf < numvfs; vf++) {
pcifunc = rvu_make_pcifunc(rvu->pdev, pf, vf + 1);
+ pfvf = rvu_get_pfvf(rvu, pcifunc);
+ if (test_bit(NIXLF_INITIALIZED, &pfvf->flags))
+ rvu_switch_enable_lbk_link(rvu, pcifunc, true);
rvu_get_nix_blkaddr(rvu, pcifunc);
- /* Skip installimg rules if nixlf is not attached */
+ /* Skip installing rules if nixlf is not attached */
err = nix_get_nixlf(rvu, pcifunc, &nixlf, NULL);
if (err)
continue;
@@ -366,30 +382,37 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
start + entry,
rep);
if (err)
- return err;
+ goto err_disable_lbk;
rswitch->entry2pcifunc[entry++] = pcifunc;
err = rvu_rep_install_tx_rule(rvu, pcifunc,
start + entry,
rep);
if (err)
- return err;
+ goto err_disable_lbk;
rswitch->entry2pcifunc[entry++] = pcifunc;
rep = false;
}
}
}
+ return 0;
- /* Initialize the wq for handling REP events */
- spin_lock_init(&rvu->rep_evtq_lock);
- INIT_LIST_HEAD(&rvu->rep_evtq_head);
- INIT_WORK(&rvu->rep_evt_work, rvu_rep_wq_handler);
- rvu->rep_evt_wq = alloc_workqueue("rep_evt_wq", WQ_PERCPU, 0);
- if (!rvu->rep_evt_wq) {
- dev_err(rvu->dev, "REP workqueue allocation failed\n");
- return -ENOMEM;
+err_disable_lbk:
+ /* Undo any LBK links enabled above before the MCAM rule failure.
+ * Disabling a link that was never enabled is a safe no-op.
+ */
+ for (pf = 1; pf < hw->total_pfs; pf++) {
+ if (!is_pf_cgxmapped(rvu, pf))
+ continue;
+ pcifunc = rvu_make_pcifunc(rvu->pdev, pf, 0);
+ rvu_switch_enable_lbk_link(rvu, pcifunc, false);
+ rvu_get_pf_numvfs(rvu, pf, &numvfs, NULL);
+ for (vf = 0; vf < numvfs; vf++) {
+ pcifunc = rvu_make_pcifunc(rvu->pdev, pf, vf + 1);
+ rvu_switch_enable_lbk_link(rvu, pcifunc, false);
+ }
}
- return 0;
+ return err;
}
void rvu_rep_update_rules(struct rvu *rvu, u16 pcifunc, bool ena)
@@ -443,35 +466,92 @@ int rvu_mbox_handler_esw_cfg(struct rvu *rvu, struct esw_cfg_req *req,
return 0;
}
+static int rvu_rep_get_rep_map(struct rvu *rvu, struct msg_req *req,
+ struct get_rep_cnt_rsp *rsp)
+{
+ int rep;
+
+ if (req->hdr.pcifunc != rvu->rep_pcifunc)
+ return -EPERM;
+
+ rsp->rep_cnt = rvu->rep_cnt;
+ for (rep = 0; rep < rvu->rep_cnt; rep++)
+ rsp->rep_pf_map[rep] = rvu->rep2pfvf_map[rep];
+
+ return 0;
+}
+
int rvu_mbox_handler_get_rep_cnt(struct rvu *rvu, struct msg_req *req,
struct get_rep_cnt_rsp *rsp)
{
- int pf, vf, numvfs, hwvf, rep = 0;
+ int pf, vf, numvfs, hwvf, rep = 0, cnt;
+ int ret = 0;
u16 pcifunc;
+ u16 *map;
+
+ /* Serialize first-time initialization. mbox_wq is WQ_PERCPU so
+ * handlers for different PFs can run concurrently; without this
+ * lock two callers could both observe rep2pfvf_map == NULL and
+ * double-allocate the workqueue, leaking one permanently.
+ */
+ mutex_lock(&rvu->rsrc_lock);
+
+ if (rvu->rep2pfvf_map) {
+ ret = rvu_rep_get_rep_map(rvu, req, rsp);
+ goto unlock;
+ }
rvu->rep_pcifunc = req->hdr.pcifunc;
- rsp->rep_cnt = rvu->cgx_mapped_pfs + rvu->cgx_mapped_vfs;
- rvu->rep_cnt = rsp->rep_cnt;
+ cnt = min_t(int, rvu->cgx_mapped_pfs + rvu->cgx_mapped_vfs,
+ RVU_MAX_REP);
- rvu->rep2pfvf_map = devm_kzalloc(rvu->dev, rvu->rep_cnt *
- sizeof(u16), GFP_KERNEL);
- if (!rvu->rep2pfvf_map)
- return -ENOMEM;
+ /* Allocate at least one element so the pointer is always non-NULL
+ * once published, keeping the fast-path check above reliable.
+ */
+ map = devm_kzalloc(rvu->dev, (cnt ?: 1) * sizeof(u16), GFP_KERNEL);
+ if (!map) {
+ ret = -ENOMEM;
+ goto unlock;
+ }
for (pf = 0; pf < rvu->hw->total_pfs; pf++) {
if (!is_pf_cgxmapped(rvu, pf))
continue;
+ if (rep >= cnt)
+ break;
pcifunc = rvu_make_pcifunc(rvu->pdev, pf, 0);
- rvu->rep2pfvf_map[rep] = pcifunc;
+ map[rep] = pcifunc;
rsp->rep_pf_map[rep] = pcifunc;
rep++;
rvu_get_pf_numvfs(rvu, pf, &numvfs, &hwvf);
- for (vf = 0; vf < numvfs; vf++) {
- rvu->rep2pfvf_map[rep] = pcifunc |
- ((vf + 1) & RVU_PFVF_FUNC_MASK);
- rsp->rep_pf_map[rep] = rvu->rep2pfvf_map[rep];
+ for (vf = 0; vf < numvfs && rep < cnt; vf++) {
+ map[rep] = pcifunc | ((vf + 1) & RVU_PFVF_FUNC_MASK);
+ rsp->rep_pf_map[rep] = map[rep];
rep++;
}
}
- return 0;
+
+ if (!cnt) {
+ rvu->rep2pfvf_map = map;
+ goto unlock;
+ }
+
+ /* Initialize the wq for handling REP events */
+ spin_lock_init(&rvu->rep_evtq_lock);
+ INIT_LIST_HEAD(&rvu->rep_evtq_head);
+ INIT_WORK(&rvu->rep_evt_work, rvu_rep_wq_handler);
+ rvu->rep_evt_wq = alloc_workqueue("rep_evt_wq", WQ_UNBOUND, 0);
+ if (!rvu->rep_evt_wq) {
+ dev_err(rvu->dev, "REP workqueue allocation failed\n");
+ devm_kfree(rvu->dev, map);
+ ret = -ENOMEM;
+ goto unlock;
+ }
+
+ rvu->rep_cnt = cnt;
+ rsp->rep_cnt = cnt;
+ rvu->rep2pfvf_map = map;
+unlock:
+ mutex_unlock(&rvu->rsrc_lock);
+ return ret;
}
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c
index 49ce38685a7e6..8c2c984035074 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c
@@ -12,11 +12,18 @@ void rvu_switch_enable_lbk_link(struct rvu *rvu, u16 pcifunc, bool enable)
{
struct rvu_pfvf *pfvf = rvu_get_pfvf(rvu, pcifunc);
struct nix_hw *nix_hw;
+ int blkaddr;
- nix_hw = get_nix_hw(rvu->hw, pfvf->nix_blkaddr);
+ mutex_lock(&rvu->rsrc_lock);
+ blkaddr = pfvf->nix_blkaddr;
+ nix_hw = get_nix_hw(rvu->hw, blkaddr);
/* Enable LBK links with channel 63 for TX MCAM rule */
- rvu_nix_tx_tl2_cfg(rvu, pfvf->nix_blkaddr, pcifunc,
+ if (!nix_hw)
+ goto unlock;
+ rvu_nix_tx_tl2_cfg(rvu, blkaddr, pcifunc,
&nix_hw->txsch[NIX_TXSCH_LVL_TL2], enable);
+unlock:
+ mutex_unlock(&rvu->rsrc_lock);
}
static int rvu_switch_install_rx_rule(struct rvu *rvu, u16 pcifunc,
@@ -229,8 +236,20 @@ void rvu_switch_disable(struct rvu *rvu)
if (!rswitch->used_entries)
return;
- if (rvu->rep_mode)
+ if (rvu->rep_mode) {
+ for (pf = 1; pf < hw->total_pfs; pf++) {
+ if (!is_pf_cgxmapped(rvu, pf))
+ continue;
+ pcifunc = rvu_make_pcifunc(rvu->pdev, pf, 0);
+ rvu_switch_enable_lbk_link(rvu, pcifunc, false);
+ rvu_get_pf_numvfs(rvu, pf, &numvfs, NULL);
+ for (vf = 0; vf < numvfs; vf++) {
+ pcifunc = rvu_make_pcifunc(rvu->pdev, pf, vf + 1);
+ rvu_switch_enable_lbk_link(rvu, pcifunc, false);
+ }
+ }
goto free_ents;
+ }
for (pf = 1; pf < hw->total_pfs; pf++) {
if (!is_pf_cgxmapped(rvu, pf))
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
index 0f5d5642d3f7a..ef47e7e219016 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
@@ -301,6 +301,12 @@ static void rvu_rep_state_evt_handler(struct otx2_nic *priv,
int rep_id;
rep_id = rvu_rep_get_repid(priv, info->pcifunc);
+ if (rep_id < 0) {
+ dev_warn_ratelimited(priv->dev,
+ "REP state event for unknown pcifunc 0x%x (err %d)\n",
+ info->pcifunc, rep_id);
+ return;
+ }
rep = priv->reps[rep_id];
if (info->evt_data.vf_state)
rep->flags |= RVU_REP_VF_INITIALIZED;
@@ -459,6 +465,9 @@ static int rvu_rep_open(struct net_device *dev)
netif_carrier_on(dev);
netif_tx_start_all_queues(dev);
+ if (rep->pcifunc & RVU_PFVF_FUNC_MASK)
+ return 0;
+
evt.event = RVU_EVENT_PORT_STATE;
evt.evt_data.port_state = 1;
evt.pcifunc = rep->pcifunc;
@@ -478,6 +487,9 @@ static int rvu_rep_stop(struct net_device *dev)
netif_carrier_off(dev);
netif_tx_disable(dev);
+ if (rep->pcifunc & RVU_PFVF_FUNC_MASK)
+ return 0;
+
evt.event = RVU_EVENT_PORT_STATE;
evt.pcifunc = rep->pcifunc;
rvu_rep_notify_pfvf(priv, RVU_EVENT_PORT_STATE, &evt);
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.h b/drivers/net/ethernet/marvell/octeontx2/nic/rep.h
index 5bc9e2c7d800b..b98fe191e83a3 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.h
@@ -16,7 +16,6 @@
#define PCI_DEVID_RVU_REP 0xA0E0
-#define RVU_MAX_REP OTX2_MAX_CQ_CNT
struct rep_stats {
u64 rx_bytes;
|
| 3/2 | 2026/09/04 10:04 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 9453 output: 41 thoughts: 279 Thoughts: **Analyzing a Patch for Syzkaller Fuzzing Suitability** Okay, let's break this down. The first thing I'm doing is seeing if this patch is a good candidate for fuzzing with syzkaller. I need to understand the scope and potential impact. The modified files jump out: `drivers/net/ethernet/marvell/octeontx2/af/mbox.h`, `rvu.c`, `rvu_rep.c`, `rvu_switch.c`, `nic/rep.c`, and `nic/rep.h`. That immediately tells me this is related to the OcteonTX2 Ethernet driver, specifically in the Marvell ecosystem. So, the question becomes, is this a physical hardware driver, or is there an emulated environment? Is this a SmartNIC or just standard network functionality? Now, to assess its fuzzing potential, I need to know the context. Is this a physical network card, something vendor-specific like a PCIe SmartNIC, or something emulated? My next step would be to search, maybe `grep` the codebase, or check the `Kconfig` files. That should give me a better understanding of how the device is accessed and configured. Understanding this will define the ease of setting up an environment to fuzz this code. |
| 4/2 | 2026/09/04 10:04 | tool | grepper |
0mArgs:{
"Expression": "config OCTEONTX2",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/Kconfig-5-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:6:config OCTEONTX2_MBOX\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-7-\ttristate\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-8-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:9:config OCTEONTX2_AF\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-10-\ttristate \"Marvell OcteonTX2 RVU Admin Function driver\"\n--\ndrivers/net/ethernet/marvell/octeontx2/Kconfig=22=config NDC_DIS_DYNAMIC_CACHING\n--\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-30-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:31:config OCTEONTX2_PF\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-32-\ttristate \"Marvell OcteonTX2 NIC Physical Function driver\"\n--\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-44-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:45:config OCTEONTX2_VF\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-46-\ttristate \"Marvell OcteonTX2 NIC Virtual Function driver\"\n"
} |
| 5/2 | 2026/09/04 10:04 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10461 output: 44 thoughts: 29 Thoughts: Here's my summary, as if I were thinking these thoughts: **Examining the Octeon TX2 Ethernet Driver Configuration** Okay, time to dive into the specifics of this Marvell Octeon TX2 Ethernet driver. I need to understand its configuration options and dependencies. Let's start by digging into the `drivers/net/ethernet/marvell/octeontx2/Kconfig` file. That's where the heart of the configuration lies, defining what features are available, any dependencies on other kernel components, and how these options are presented to the user during the build process. It's the key to understanding how to enable or disable specific functionalities of this driver and tailor it to a particular use case. I need to get a handle on the various symbols, their defaults, and any constraints. |
| 6/2 | 2026/09/04 10:04 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/marvell/octeontx2/Kconfig",
"FirstLine": 1,
"LineCount": 60
}Results: {
"Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\t#\n 3:\t# Marvell RVU Network drivers configuration\n 4:\t#\n 5:\t\n 6:\tconfig OCTEONTX2_MBOX\n 7:\t\ttristate\n 8:\t\n 9:\tconfig OCTEONTX2_AF\n 10:\t\ttristate \"Marvell OcteonTX2 RVU Admin Function driver\"\n 11:\t\tselect OCTEONTX2_MBOX\n 12:\t\tselect NET_DEVLINK\n 13:\t\tdepends on (64BIT \u0026\u0026 COMPILE_TEST) || ARM64\n 14:\t\tdepends on PCI\n 15:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n 16:\t\thelp\n 17:\t\t This driver supports Marvell's OcteonTX2 Resource Virtualization\n 18:\t\t Unit's admin function manager which manages all RVU HW resources\n 19:\t\t and provides a medium to other PF/VFs to configure HW. Should be\n 20:\t\t enabled for other RVU device drivers to work.\n 21:\t\n 22:\tconfig NDC_DIS_DYNAMIC_CACHING\n 23:\t\tbool \"Disable caching of dynamic entries in NDC\"\n 24:\t\tdepends on OCTEONTX2_AF\n 25:\t\tdefault n\n 26:\t\thelp\n 27:\t\t This config option disables caching of dynamic entries such as NIX SQEs\n 28:\t\t , NPA stack pages etc in NDC. Also locks down NIX SQ/CQ/RQ/RSS and\n 29:\t\t NPA Aura/Pool contexts.\n 30:\t\n 31:\tconfig OCTEONTX2_PF\n 32:\t\ttristate \"Marvell OcteonTX2 NIC Physical Function driver\"\n 33:\t\tselect OCTEONTX2_MBOX\n 34:\t\tselect NET_DEVLINK\n 35:\t\tselect PAGE_POOL\n 36:\t\tselect CRYPTO_LIB_AES if MACSEC\n 37:\t\tdepends on (64BIT \u0026\u0026 COMPILE_TEST) || ARM64\n 38:\t\tselect DIMLIB\n 39:\t\tdepends on PCI\n 40:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n 41:\t\tdepends on MACSEC || !MACSEC\n 42:\t\thelp\n 43:\t\t This driver supports Marvell's OcteonTX2 NIC physical function.\n 44:\t\n 45:\tconfig OCTEONTX2_VF\n 46:\t\ttristate \"Marvell OcteonTX2 NIC Virtual Function driver\"\n 47:\t\tdepends on OCTEONTX2_PF\n 48:\t\thelp\n 49:\t\t This driver supports Marvell's OcteonTX2 NIC virtual function.\n 50:\t\n 51:\tconfig RVU_ESWITCH\n 52:\t\ttristate \"Marvell RVU E-Switch support\"\n 53:\t\tdepends on OCTEONTX2_PF\n 54:\t\tdefault m\n 55:\t\thelp\n 56:\t\t This driver supports Marvell's RVU E-Switch that\n 57:\t\t provides internal SRIOV packet steering and switching.\n"
} |
| 7/2 | 2026/09/04 10:04 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 11517 output: 41 thoughts: 186 Thoughts: **Analyzing the Triage Criteria and OcteonTX2 Compatibility** Okay, let's break this down. First, I need to confirm if this falls under our standard triage guidelines, specifically the negative criteria. Section 2 highlights "Structurally unreachable hardware." We're looking at vendor-specific PCIe switches, SmartNICs, or GPU drivers that *require* specific physical ASIC/PCIe cards not emulated in standard QEMU. This is a crucial point. Now, let's focus on the OcteonTX2. It's Marvell's ARM64 SoC, a network processor, essentially a SmartNIC with its Resource Virtualization Unit (RVU) Admin Function and Physical Function. Alright, important notes here. There are dependency checks: it relies on both 64-bit architecture with a compile test, *or* just the ARM64 architecture, and *also* requires PCI support. That’s a good starting point. The key question is whether this OcteonTX2 *is* a physical PCI or SoC device. That's the core of the problem. If it is, then the negative criteria could come into play. I need to dig into the probing routines – `rvu_probe` and `otx2_probe`. These will tell us how the system interacts with the hardware, and whether it’s attempting to access a physical device in a way that’s incompatible with our standard QEMU environment. This will confirm if it is structurally unreachable hardware. We need to understand how the system identifies and interacts with the OcteonTX2. |
| 8/2 | 2026/09/04 10:04 | tool | grepper |
0mError:no matches Args: {
"Expression": "module_pci_driver",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2"
}Results: {
"error": "no matches"
} |
| 9/2 | 2026/09/04 10:04 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12094 output: 41 thoughts: 19 Thoughts: Here's my take on those thoughts, tailored for an expert audience: **Diving into Octeon TX2 Driver Registration** Okay, time to dig into the `pci_register_driver` call, specifically within the context of the Octeon TX2 architecture. I need to refresh my understanding of how this particular driver registration is handled on this platform. I want to check for any platform-specific nuances or quirks that might influence driver initialization, resource allocation, or interrupt handling. Are there any custom hooks or overrides in place compared to a more generic PCI driver registration? I'm particularly interested in seeing how they're managing device ID matching and probe routines within the Octeon environment. I'll need to look closely at any interaction with the hardware configuration, and the chip's internal registers to see how that's handled. The goal is to fully understand how the driver integrates into the Octeon TX2's system-on-chip framework. I'm looking for potential areas of concern, optimization opportunities, or any unexpected behaviors that might impact performance or stability. |
| 10/2 | 2026/09/04 10:04 | tool | grepper |
0mArgs:{
"Expression": "pci_register_driver",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/rvu.c=3765=static int __init rvu_init_module(void)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3770-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3771:\terr = pci_register_driver(\u0026cgx_driver);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3772-\tif (err \u003c 0)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3774-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3775:\terr = pci_register_driver(\u0026ptp_driver);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3776-\tif (err \u003c 0)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3778-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3779:\terr = pci_register_driver(\u0026mcs_driver);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3780-\tif (err \u003c 0)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3782-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3783:\terr = pci_register_driver(\u0026rvu_driver);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3784-\tif (err \u003c 0)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c=3581=static int __init otx2_rvupf_init_module(void)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-3584-\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c:3585:\treturn pci_register_driver(\u0026otx2_pf_driver);\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-3586-}\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c=869=static int __init otx2vf_init_module(void)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-872-\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c:873:\treturn pci_register_driver(\u0026otx2vf_driver);\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-874-}\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c=881=static int __init rvu_rep_init_module(void)\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c-882-{\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c:883:\treturn pci_register_driver(\u0026rvu_rep_driver);\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c-884-}\n"
} |
| 11/2 | 2026/09/04 10:04 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13349 output: 41 thoughts: 17 Thoughts: Here's my thought process, summarized as you requested: **PCI ID Verification for Octeon TX2 Drivers** Okay, so I need to get started on this driver work for the Octeon TX2. First things first, before I even *think* about diving into the code, I need to verify something fundamental – the PCI IDs. I have to make absolutely certain that these drivers are targeting the correct devices. A misidentification here, even at this early stage, could lead to a massive headache down the line, potentially causing major system instability or, even worse, bricking some hardware. Therefore, I need to double-check that the PCI identifiers are correct within the configuration of the drivers. I'll need to go through the code meticulously to confirm that the driver configuration is using the right PCI vendor and device IDs for the Octeon TX2. It’s a crucial first step; better to be paranoid now and prevent potential disastrous outcome than to regret later. This needs to be done meticulously, no room for error. Let's get to it. |
| 12/2 | 2026/09/04 10:04 | tool | grepper |
0mArgs:{
"Expression": "pci_device_id",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/cgx.c=63=static int cgx_fwi_link_change(struct cgx *cgx, int lmac_id, bool en);\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cgx.c-65-/* Supported devices */\ndrivers/net/ethernet/marvell/octeontx2/af/cgx.c:66:static const struct pci_device_id cgx_id_table[] = {\ndrivers/net/ethernet/marvell/octeontx2/af/cgx.c-67-\t{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_OCTEONTX2_CGX) },\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cgx.c=1916=static struct mac_ops\tcgx_mac_ops = {\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cgx.c-1950-\ndrivers/net/ethernet/marvell/octeontx2/af/cgx.c:1951:static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/marvell/octeontx2/af/cgx.c-1952-{\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs.c-19-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs.c:20:static const struct pci_device_id mcs_id_table[] = {\ndrivers/net/ethernet/marvell/octeontx2/af/mcs.c-21-\t{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CN10K_MCS) },\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs.c=1497=static struct mcs_ops cn10kb_mcs_ops = {\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs.c-1506-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs.c:1507:static int mcs_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/marvell/octeontx2/af/mcs.c-1508-{\n--\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c=77=static struct ptp *first_ptp_block;\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c:78:static const struct pci_device_id ptp_id_table[];\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-79-\n--\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c=517=static int ptp_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c:518:\t\t const struct pci_device_id *ent)\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-519-{\n--\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c=571=static void ptp_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-588-\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c:589:static const struct pci_device_id ptp_id_table[] = {\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-590-\t{ PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_OCTEONTX2_PTP,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=41=static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq);\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-43-/* Supported devices */\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:44:static const struct pci_device_id rvu_id_table[] = {\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-45-\t{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_OCTEONTX2_RVU_AF) },\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=3545=static atomic_t device_bound = ATOMIC_INIT(0);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3546-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3547:static int rvu_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3548-{\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-35-/* Supported devices */\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c:36:static const struct pci_device_id otx2_pf_id_table[] = {\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-37-\t{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_OCTEONTX2_RVU_PF) },\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c=3152=EXPORT_SYMBOL(otx2_init_rsrc);\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-3153-\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c:3154:static int otx2_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-3155-{\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-21-\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c:22:static const struct pci_device_id otx2_vf_id_table[] = {\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-23-\t{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_OCTEONTX2_RVU_AFVF) },\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c=551=static int otx2vf_realloc_msix_vectors(struct otx2_nic *vf)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-570-\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c:571:static int otx2vf_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-572-{\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c-21-\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c:22:static const struct pci_device_id rvu_rep_id_table[] = {\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c-23-\t{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_RVU_REP) },\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c=745=static int rvu_get_rep_cnt(struct otx2_nic *priv)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c-779-\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c:780:static int rvu_rep_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/marvell/octeontx2/nic/rep.c-781-{\n"
} |
| 13/2 | 2026/09/04 10:04 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 15978 output: 123 thoughts: 897 Thoughts: **My Assessment: Structurally Unreachable Hardware** Okay, so I've looked at this patch and, based on my understanding of the system, I think we have a definitive answer. These changes are all deeply tied to the Marvell/Cavium OcteonTX2 architecture. Specifically, we're dealing with the RVU (Resource Virtualization Unit) component, represented by drivers like `rvu.c`, `rvu_rep.c`, and others within the `drivers/net/ethernet/marvell/octeontx2/af/` directory. These are *all* vendor-specific drivers (Cavium/Marvell) for OcteonTX2 PCI devices – we're talking about things like `PCI_VENDOR_ID_CAVIUM`, and distinct device IDs such as `PCI_DEVID_OCTEONTX2_RVU_AF`. The core problem is that *standard* QEMU or Google Compute Engine (GCE) environments simply do not emulate this OcteonTX2 hardware. My knowledge of these setups tells me there's no way to instantiate these devices virtually. The drivers are designed to probe, interact with, and manage physical Cavium/Marvell OcteonTX2 SoC or SmartNIC hardware. I even checked the "structurally unreachable hardware" section of the triage criteria. It seems like a perfect match. Based on the triage criteria, it looks like `WorthFuzzing` should be false because the modified code strictly falls under the category of "Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU". So, I'm going to set my results as follows: * `WorthFuzzing`: false * `Reasoning`: The patch modifies the Marvell OcteonTX2 RVU (Resource Virtualization Unit) driver (`drivers/net/ethernet/marvell/octeontx2/`), specifically representor mailbox handling, MCAM rule management, and teardown logic. This code requires physical Marvell/Cavium OcteonTX2 hardware / SmartNIC ASIC that is not emulated in standard virtualized environments (QEMU/GCE), making the modified code structurally unreachable for fuzzing. * `EnableConfigs`: [] * `FocusSymbols`: [] And then call `set-results`. |
| 14/2 | 2026/09/04 10:04 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the Marvell OcteonTX2 RVU (Resource Virtualization Unit) ethernet driver and representor handling under drivers/net/ethernet/marvell/octeontx2/. This code requires proprietary Cavium/Marvell OcteonTX2 hardware/SmartNIC ASICs that are not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the Marvell OcteonTX2 RVU (Resource Virtualization Unit) ethernet driver and representor handling under drivers/net/ethernet/marvell/octeontx2/. This code requires proprietary Cavium/Marvell OcteonTX2 hardware/SmartNIC ASICs that are not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 15/1 | 2026/09/04 10:04 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|