AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies `vfio_cdx_mmap` in the VFIO CDX driver. The CDX (Composable DMA eXpress) bus is a hardware-specific bus for AMD/Xilinx Versal devices that relies on MCDI firmware messages over RPMSG to a remote processor (R5 core) to scan and discover devices. There is no software emulation or mock driver for the CDX bus or its firmware in the kernel. Consequently, it is impossible to create a CDX device or bind it to the `vfio-cdx` driver in a standard virtualized environment like QEMU, making the modified code path unreachable for fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit ce556c3df11a11a65ed389093fb528bea8c076cf\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Aug 19 09:06:40 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/vfio/cdx/main.c b/drivers/vfio/cdx/main.c\nindex b31ed4be7bdc1..b6b17a6a46811 100644\n--- a/drivers/vfio/cdx/main.c\n+++ b/drivers/vfio/cdx/main.c\n@@ -285,6 +285,10 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev,\n \t    (vma-\u003evm_flags \u0026 VM_WRITE))\n \t\treturn -EPERM;\n \n+\t/* Prevent read-only region mappings from being upgraded with mprotect() */\n+\tif (!(vdev-\u003eregions[index].flags \u0026 VFIO_REGION_INFO_FLAG_WRITE))\n+\t\tvm_flags_clear(vma, VM_MAYWRITE);\n+\n \treturn vfio_cdx_mmap_mmio(vdev-\u003eregions[index], vma);\n }\n \n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `vfio_cdx_mmap` in the VFIO CDX driver. The CDX (Composable DMA eXpress) bus is a hardware-specific bus for AMD/Xilinx Versal devices that relies on MCDI firmware messages over RPMSG to a remote processor (R5 core) to scan and discover devices. There is no software emulation or mock driver for the CDX bus or its firmware in the kernel. Consequently, it is impossible to create a CDX device or bind it to the `vfio-cdx` driver in a standard virtualized environment like QEMU, making the modified code path unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit ce556c3df11a11a65ed389093fb528bea8c076cf
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Aug 19 09:06:40 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/vfio/cdx/main.c b/drivers/vfio/cdx/main.c
index b31ed4be7bdc1..b6b17a6a46811 100644
--- a/drivers/vfio/cdx/main.c
+++ b/drivers/vfio/cdx/main.c
@@ -285,6 +285,10 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev,
 	    (vma->vm_flags & VM_WRITE))
 		return -EPERM;
 
+	/* Prevent read-only region mappings from being upgraded with mprotect() */
+	if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE))
+		vm_flags_clear(vma, VM_MAYWRITE);
+
 	return vfio_cdx_mmap_mmio(vdev->regions[index], vma);
 }
 

gemini-3.1-pro-preview

null

null

							input: 2026
							output: 36
							thoughts: 176
						

**Analyzing a VFIO CDX Patch**

Okay, so I'm looking at this patch that tweaks `drivers/vfio/cdx/main.c`. Specifically, the change is within `vfio_cdx_mmap`. It looks like they've added a check:

```c
	/* Prevent read-only region mappings from being upgraded with mprotect() */
	if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE))
		vm_flags_clear(vma, VM_MAYWRITE);
```

Basically, if a region is read-only, it's preventing `mprotect()` from being used to escalate its permissions to writeable. Functionally, this is a pretty straightforward change within `vfio_cdx_mmap`, which is good.

My immediate question is: how critical is this? I need to figure out the attack surface. Is `vfio/cdx` something commonly used in virtualized environments? Let me go check if `vfio/cdx` is even reachable. What the heck does CDX even *stand* for? It's something like "Composable DMA eXpress", right? Let's check `drivers/vfio/cdx/Kconfig` or `drivers/cdx/Kconfig` to see if there's any context I can gather about its purpose and dependencies.

{
  "Expression": "config VFIO_CDX",
  "PathPrefix": "drivers/vfio/cdx/Kconfig"
}

{
  "Output": "drivers/vfio/cdx/Kconfig-7-\ndrivers/vfio/cdx/Kconfig:8:config VFIO_CDX\ndrivers/vfio/cdx/Kconfig-9-\ttristate \"VFIO support for CDX bus devices\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 2611
							output: 32
							thoughts: 15
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating `VFIO_CDX` Dependencies**

Okay, time to dig into `VFIO_CDX`. My immediate thought is, what are the upstream and downstream dependencies for this? I want to understand its integration points and how it relies on or impacts other VFIO components or the broader kernel. I need to map out the call graph and identify potential bottlenecks or areas where changes in `VFIO_CDX` could ripple outwards. Are there specific drivers or subsystems it's particularly intertwined with? I'll need to check the relevant Kconfig options, include files, and any related documentation or mailing list discussions to get a good handle on its architecture and ensure I'm aware of the full context when I start to analyze the code. This is step one, before I even start to think about the functionality of the system.

{
  "Expression": "depends on",
  "PathPrefix": "drivers/vfio/cdx/Kconfig"
}

{
  "Output": "drivers/vfio/cdx/Kconfig=8=config VFIO_CDX\ndrivers/vfio/cdx/Kconfig-9-\ttristate \"VFIO support for CDX bus devices\"\ndrivers/vfio/cdx/Kconfig:10:\tdepends on CDX_BUS\ndrivers/vfio/cdx/Kconfig-11-\tselect EVENTFD\n"
}

gemini-3.1-pro-preview

null

null

							input: 2950
							output: 32
							thoughts: 14
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing Dependencies for CDX_BUS**

Alright, let's dive in. My immediate focus is on understanding the dependency structure related to `CDX_BUS`. Given my experience, I'm already anticipating this will likely involve digging into configuration files, perhaps examining build scripts (if this is a software system), or even querying a dependency management system. The goal is to get a clear picture of what `CDX_BUS` relies upon – this could include shared libraries, other modules, external services, or specific hardware/firmware if we're dealing with an embedded system. I want to build a quick dependency graph in my head so I understand the likely impact of any changes. I'll need to identify the key artifacts and their versions. Let's start digging.

{
  "Expression": "config CDX_BUS",
  "PathPrefix": "drivers/cdx/Kconfig"
}

{
  "Output": "drivers/cdx/Kconfig-7-\ndrivers/cdx/Kconfig:8:config CDX_BUS\ndrivers/cdx/Kconfig-9-\tbool \"CDX Bus driver\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 3233
							output: 33
							thoughts: 22
						

Here's my take on those thoughts, tailored for an expert audience:

**Analyzing the CDX_BUS Configuration Dependencies**

Okay, so I need to understand the dependencies for `CDX_BUS`. Given my existing knowledge of the platform and the broader build system, the logical place to start is the Kconfig file for the CDX driver. That's almost always where the crucial build configuration logic resides. Specifically, I'm looking for the Kconfig file in `drivers/cdx/Kconfig`. This is where I expect to find the dependencies declared for `CDX_BUS`. I'll be looking for `depends on` statements, any conditional definitions (like `if` statements), and any other build-time relationships that dictate when and how `CDX_BUS` gets included in the final image. This quick dive into Kconfig should give me the foundational context I need to proceed.

{
  "File": "drivers/cdx/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0\n   2:\t#\n   3:\t# CDX bus configuration\n   4:\t#\n   5:\t# Copyright (C) 2022-2023, Advanced Micro Devices, Inc.\n   6:\t#\n   7:\t\n   8:\tconfig CDX_BUS\n   9:\t\tbool \"CDX Bus driver\"\n  10:\t\tdepends on OF \u0026\u0026 ARM64 || COMPILE_TEST\n  11:\t\thelp\n  12:\t\t  Driver to enable Composable DMA Transfer(CDX) Bus. CDX bus\n  13:\t\t  exposes Fabric devices which uses composable DMA IP to the\n  14:\t\t  APU. CDX bus provides a mechanism for scanning and probing\n  15:\t\t  of CDX devices. CDX devices are memory mapped on system bus\n  16:\t\t  for embedded CPUs. CDX bus uses CDX controller and firmware\n  17:\t\t  to scan these CDX devices.\n  18:\t\n  19:\tsource \"drivers/cdx/controller/Kconfig\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 3754
							output: 27
							thoughts: 129
						

**Analyzing the CDX_BUS Configuration**

Okay, so I'm looking at this `CDX_BUS` thing and immediately see it hinges on `OF && ARM64 || COMPILE_TEST`. Right, that narrows it down a bit – likely dealing with devices on ARM64 systems with device tree support, or used for build testing. The description says it's about "Composable DMA Transfer(CDX) Bus," which makes sense. It's exposing Fabric devices that utilize composable DMA IP to the APU.

The text specifically mentions that "CDX devices are memory mapped on system bus for embedded CPUs," and that it "uses CDX controller and firmware to scan these CDX devices." That confirms my initial suspicion: this is a hardware-specific bus, and it sounds like it's primarily designed for AMD embedded CPUs, specifically APUs.

My immediate follow-up thought is, can we emulate any of this in QEMU? Is there any existing software emulation available for the CDX bus or, more specifically, the CDX devices themselves? I need to check into that. I'll need to dig deeper to see if there's any community support or existing work in this area.

{
  "Expression": "cdx",
  "PathPrefix": "drivers/cdx/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1964 lines.\nUse more precise expression if possible.\n\ndrivers/cdx/Kconfig=8=config CDX_BUS\n--\ndrivers/cdx/Kconfig-18-\ndrivers/cdx/Kconfig:19:source \"drivers/cdx/controller/Kconfig\"\n--\ndrivers/cdx/Makefile=8=ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='\"CDX_BUS\"'\ndrivers/cdx/Makefile-9-\ndrivers/cdx/Makefile:10:obj-$(CONFIG_CDX_BUS) += cdx.o controller/\ndrivers/cdx/Makefile-11-\ndrivers/cdx/Makefile=12=ifdef CONFIG_GENERIC_MSI_IRQ\ndrivers/cdx/Makefile:13:obj-$(CONFIG_CDX_BUS) += cdx_msi.o\ndrivers/cdx/Makefile-14-endif\n--\ndrivers/cdx/cdx.c-67-#include \u003clinux/idr.h\u003e\ndrivers/cdx/cdx.c:68:#include \u003clinux/cdx/cdx_bus.h\u003e\ndrivers/cdx/cdx.c-69-#include \u003clinux/iommu.h\u003e\n--\ndrivers/cdx/cdx.c-71-#include \u003clinux/debugfs.h\u003e\ndrivers/cdx/cdx.c:72:#include \"cdx.h\"\ndrivers/cdx/cdx.c-73-\n--\ndrivers/cdx/cdx.c-78-/* IDA for CDX controllers registered with the CDX bus */\ndrivers/cdx/cdx.c:79:static DEFINE_IDA(cdx_controller_ida);\ndrivers/cdx/cdx.c-80-/* Lock to protect controller ops */\ndrivers/cdx/cdx.c:81:static DEFINE_MUTEX(cdx_controller_lock);\ndrivers/cdx/cdx.c:82:/* Debugfs dir for cdx bus */\ndrivers/cdx/cdx.c:83:static struct dentry *cdx_debugfs_dir;\ndrivers/cdx/cdx.c-84-\ndrivers/cdx/cdx.c:85:static char *compat_node_name = \"xlnx,versal-net-cdx\";\ndrivers/cdx/cdx.c-86-\ndrivers/cdx/cdx.c:87:static void cdx_destroy_res_attr(struct cdx_device *cdx_dev, int num);\ndrivers/cdx/cdx.c-88-\ndrivers/cdx/cdx.c-89-/**\ndrivers/cdx/cdx.c:90: * cdx_dev_reset - Reset a CDX device\ndrivers/cdx/cdx.c-91- * @dev: CDX device\n--\ndrivers/cdx/cdx.c-94- */\ndrivers/cdx/cdx.c:95:int cdx_dev_reset(struct device *dev)\ndrivers/cdx/cdx.c-96-{\ndrivers/cdx/cdx.c:97:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:98:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:99:\tstruct cdx_device_config dev_config = {0};\ndrivers/cdx/cdx.c:100:\tstruct cdx_driver *cdx_drv;\ndrivers/cdx/cdx.c-101-\tint ret;\ndrivers/cdx/cdx.c-102-\ndrivers/cdx/cdx.c:103:\tcdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c-104-\t/* Notify driver that device is being reset */\ndrivers/cdx/cdx.c:105:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003ereset_prepare)\ndrivers/cdx/cdx.c:106:\t\tcdx_drv-\u003ereset_prepare(cdx_dev);\ndrivers/cdx/cdx.c-107-\ndrivers/cdx/cdx.c-108-\tdev_config.type = CDX_DEV_RESET_CONF;\ndrivers/cdx/cdx.c:109:\tret = cdx-\u003eops-\u003edev_configure(cdx, cdx_dev-\u003ebus_num,\ndrivers/cdx/cdx.c:110:\t\t\t\t      cdx_dev-\u003edev_num, \u0026dev_config);\ndrivers/cdx/cdx.c-111-\tif (ret)\ndrivers/cdx/cdx.c:112:\t\tdev_err(dev, \"cdx device reset failed\\n\");\ndrivers/cdx/cdx.c-113-\ndrivers/cdx/cdx.c-114-\t/* Notify driver that device reset is complete */\ndrivers/cdx/cdx.c:115:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003ereset_done)\ndrivers/cdx/cdx.c:116:\t\tcdx_drv-\u003ereset_done(cdx_dev);\ndrivers/cdx/cdx.c-117-\n--\ndrivers/cdx/cdx.c-119-}\ndrivers/cdx/cdx.c:120:EXPORT_SYMBOL_GPL(cdx_dev_reset);\ndrivers/cdx/cdx.c-121-\ndrivers/cdx/cdx.c-122-/**\ndrivers/cdx/cdx.c:123: * reset_cdx_device - Reset a CDX device\ndrivers/cdx/cdx.c-124- * @dev: CDX device\n--\ndrivers/cdx/cdx.c-130- */\ndrivers/cdx/cdx.c:131:static int reset_cdx_device(struct device *dev, void *data)\ndrivers/cdx/cdx.c-132-{\ndrivers/cdx/cdx.c:133:\treturn cdx_dev_reset(dev);\ndrivers/cdx/cdx.c-134-}\n--\ndrivers/cdx/cdx.c-136-/**\ndrivers/cdx/cdx.c:137: * cdx_unregister_device - Unregister a CDX device\ndrivers/cdx/cdx.c-138- * @dev: CDX device\n--\ndrivers/cdx/cdx.c-140- *\t  but is required here as the bus_for_each_dev() API expects\ndrivers/cdx/cdx.c:141: *\t  the passed function (cdx_unregister_device) to have this\ndrivers/cdx/cdx.c-142- *\t  as an argument.\n--\ndrivers/cdx/cdx.c-145- */\ndrivers/cdx/cdx.c:146:static int cdx_unregister_device(struct device *dev,\ndrivers/cdx/cdx.c-147-\t\t\t\t void *data)\ndrivers/cdx/cdx.c-148-{\ndrivers/cdx/cdx.c:149:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:150:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-151-\ndrivers/cdx/cdx.c:152:\tif (cdx_dev-\u003eis_bus) {\ndrivers/cdx/cdx.c:153:\t\tdevice_for_each_child(dev, NULL, cdx_unregister_device);\ndrivers/cdx/cdx.c:154:\t\tif (cdx_dev-\u003eenabled \u0026\u0026 cdx-\u003eops-\u003ebus_disable)\ndrivers/cdx/cdx.c:155:\t\t\tcdx-\u003eops-\u003ebus_disable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c-156-\t} else {\ndrivers/cdx/cdx.c:157:\t\tcdx_destroy_res_attr(cdx_dev, MAX_CDX_DEV_RESOURCES);\ndrivers/cdx/cdx.c:158:\t\tdebugfs_remove_recursive(cdx_dev-\u003edebugfs_dir);\ndrivers/cdx/cdx.c-159-\t}\n--\ndrivers/cdx/cdx.c-161-\t/*\ndrivers/cdx/cdx.c:162:\t * Do not free cdx_dev here as it would be freed in\ndrivers/cdx/cdx.c:163:\t * cdx_device_release() called from within put_device().\ndrivers/cdx/cdx.c-164-\t */\ndrivers/cdx/cdx.c:165:\tdevice_del(\u0026cdx_dev-\u003edev);\ndrivers/cdx/cdx.c:166:\tput_device(\u0026cdx_dev-\u003edev);\ndrivers/cdx/cdx.c-167-\n--\ndrivers/cdx/cdx.c-170-\ndrivers/cdx/cdx.c:171:static void cdx_unregister_devices(const struct bus_type *bus)\ndrivers/cdx/cdx.c-172-{\ndrivers/cdx/cdx.c:173:\t/* Reset all the devices attached to cdx bus */\ndrivers/cdx/cdx.c:174:\tbus_for_each_dev(bus, NULL, NULL, cdx_unregister_device);\ndrivers/cdx/cdx.c-175-}\n--\ndrivers/cdx/cdx.c-177-/**\ndrivers/cdx/cdx.c:178: * cdx_match_one_device - Tell if a CDX device structure has a matching\ndrivers/cdx/cdx.c-179- *\t\t\t  CDX device id structure\n--\ndrivers/cdx/cdx.c-182- *\ndrivers/cdx/cdx.c:183: * Return: matching cdx_device_id structure or NULL if there is no match.\ndrivers/cdx/cdx.c-184- */\ndrivers/cdx/cdx.c:185:static inline const struct cdx_device_id *\ndrivers/cdx/cdx.c:186:cdx_match_one_device(const struct cdx_device_id *id,\ndrivers/cdx/cdx.c:187:\t\t     const struct cdx_device *dev)\ndrivers/cdx/cdx.c-188-{\n--\ndrivers/cdx/cdx.c-199-/**\ndrivers/cdx/cdx.c:200: * cdx_match_id - See if a CDX device matches a given cdx_id table\ndrivers/cdx/cdx.c-201- * @ids: array of CDX device ID structures to search in\n--\ndrivers/cdx/cdx.c-204- * Used by a driver to check whether a CDX device is in its list of\ndrivers/cdx/cdx.c:205: * supported devices. Returns the matching cdx_device_id structure or\ndrivers/cdx/cdx.c-206- * NULL if there is no match.\ndrivers/cdx/cdx.c-207- *\ndrivers/cdx/cdx.c:208: * Return: matching cdx_device_id structure or NULL if there is no match.\ndrivers/cdx/cdx.c-209- */\ndrivers/cdx/cdx.c:210:static inline const struct cdx_device_id *\ndrivers/cdx/cdx.c:211:cdx_match_id(const struct cdx_device_id *ids, struct cdx_device *dev)\ndrivers/cdx/cdx.c-212-{\n--\ndrivers/cdx/cdx.c-214-\t\twhile (ids-\u003evendor || ids-\u003edevice) {\ndrivers/cdx/cdx.c:215:\t\t\tif (cdx_match_one_device(ids, dev))\ndrivers/cdx/cdx.c-216-\t\t\t\treturn ids;\n--\ndrivers/cdx/cdx.c-222-\ndrivers/cdx/cdx.c:223:int cdx_set_master(struct cdx_device *cdx_dev)\ndrivers/cdx/cdx.c-224-{\ndrivers/cdx/cdx.c:225:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:226:\tstruct cdx_device_config dev_config;\ndrivers/cdx/cdx.c-227-\tint ret = -EOPNOTSUPP;\n--\ndrivers/cdx/cdx.c-230-\tdev_config.bus_master_enable = true;\ndrivers/cdx/cdx.c:231:\tif (cdx-\u003eops-\u003edev_configure)\ndrivers/cdx/cdx.c:232:\t\tret = cdx-\u003eops-\u003edev_configure(cdx, cdx_dev-\u003ebus_num,\ndrivers/cdx/cdx.c:233:\t\t\t\t\t      cdx_dev-\u003edev_num, \u0026dev_config);\ndrivers/cdx/cdx.c-234-\n--\ndrivers/cdx/cdx.c-236-}\ndrivers/cdx/cdx.c:237:EXPORT_SYMBOL_GPL(cdx_set_master);\ndrivers/cdx/cdx.c-238-\ndrivers/cdx/cdx.c:239:int cdx_clear_master(struct cdx_device *cdx_dev)\ndrivers/cdx/cdx.c-240-{\ndrivers/cdx/cdx.c:241:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:242:\tstruct cdx_device_config dev_config;\ndrivers/cdx/cdx.c-243-\tint ret = -EOPNOTSUPP;\n--\ndrivers/cdx/cdx.c-246-\tdev_config.bus_master_enable = false;\ndrivers/cdx/cdx.c:247:\tif (cdx-\u003eops-\u003edev_configure)\ndrivers/cdx/cdx.c:248:\t\tret = cdx-\u003eops-\u003edev_configure(cdx, cdx_dev-\u003ebus_num,\ndrivers/cdx/cdx.c:249:\t\t\t\t\t      cdx_dev-\u003edev_num, \u0026dev_config);\ndrivers/cdx/cdx.c-250-\n--\ndrivers/cdx/cdx.c-252-}\ndrivers/cdx/cdx.c:253:EXPORT_SYMBOL_GPL(cdx_clear_master);\ndrivers/cdx/cdx.c-254-\ndrivers/cdx/cdx.c-255-/**\ndrivers/cdx/cdx.c:256: * cdx_bus_match - device to driver matching callback\ndrivers/cdx/cdx.c:257: * @dev: the cdx device to match against\ndrivers/cdx/cdx.c:258: * @drv: the device driver to search for matching cdx device\ndrivers/cdx/cdx.c-259- * structures\n--\ndrivers/cdx/cdx.c-262- */\ndrivers/cdx/cdx.c:263:static int cdx_bus_match(struct device *dev, const struct device_driver *drv)\ndrivers/cdx/cdx.c-264-{\ndrivers/cdx/cdx.c:265:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:266:\tconst struct cdx_driver *cdx_drv = to_cdx_driver(drv);\ndrivers/cdx/cdx.c:267:\tconst struct cdx_device_id *found_id = NULL;\ndrivers/cdx/cdx.c:268:\tconst struct cdx_device_id *ids;\ndrivers/cdx/cdx.c-269-\tint ret;\ndrivers/cdx/cdx.c-270-\ndrivers/cdx/cdx.c:271:\tif (cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c-272-\t\treturn false;\ndrivers/cdx/cdx.c-273-\ndrivers/cdx/cdx.c:274:\tids = cdx_drv-\u003ematch_id_table;\ndrivers/cdx/cdx.c-275-\n--\ndrivers/cdx/cdx.c-280-\ndrivers/cdx/cdx.c:281:\tfound_id = cdx_match_id(ids, cdx_dev);\ndrivers/cdx/cdx.c-282-\tif (!found_id)\n--\ndrivers/cdx/cdx.c-295-\t\tids = found_id + 1;\ndrivers/cdx/cdx.c:296:\t\tfound_id = cdx_match_id(ids, cdx_dev);\ndrivers/cdx/cdx.c-297-\t} while (found_id);\n--\ndrivers/cdx/cdx.c-301-\ndrivers/cdx/cdx.c:302:static int cdx_probe(struct device *dev)\ndrivers/cdx/cdx.c-303-{\ndrivers/cdx/cdx.c:304:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:305:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:306:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-307-\tint error;\n--\ndrivers/cdx/cdx.c-312-\t */\ndrivers/cdx/cdx.c:313:\tif (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) \u0026\u0026 cdx-\u003emsi_domain) {\ndrivers/cdx/cdx.c:314:\t\terror = msi_setup_device_data(\u0026cdx_dev-\u003edev);\ndrivers/cdx/cdx.c-315-\t\tif (error)\n--\ndrivers/cdx/cdx.c-318-\ndrivers/cdx/cdx.c:319:\terror = cdx_drv-\u003eprobe(cdx_dev);\ndrivers/cdx/cdx.c-320-\tif (error) {\n--\ndrivers/cdx/cdx.c-327-\ndrivers/cdx/cdx.c:328:static void cdx_remove(struct device *dev)\ndrivers/cdx/cdx.c-329-{\ndrivers/cdx/cdx.c:330:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:331:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-332-\ndrivers/cdx/cdx.c:333:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003eremove)\ndrivers/cdx/cdx.c:334:\t\tcdx_drv-\u003eremove(cdx_dev);\ndrivers/cdx/cdx.c-335-}\ndrivers/cdx/cdx.c-336-\ndrivers/cdx/cdx.c:337:static void cdx_shutdown(struct device *dev)\ndrivers/cdx/cdx.c-338-{\ndrivers/cdx/cdx.c:339:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:340:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:341:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-342-\ndrivers/cdx/cdx.c:343:\tif (cdx_dev-\u003eis_bus \u0026\u0026 cdx_dev-\u003eenabled \u0026\u0026 cdx-\u003eops-\u003ebus_disable)\ndrivers/cdx/cdx.c:344:\t\tcdx-\u003eops-\u003ebus_disable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c:345:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003eshutdown)\ndrivers/cdx/cdx.c:346:\t\tcdx_drv-\u003eshutdown(cdx_dev);\ndrivers/cdx/cdx.c-347-}\ndrivers/cdx/cdx.c-348-\ndrivers/cdx/cdx.c:349:static int cdx_dma_configure(struct device *dev)\ndrivers/cdx/cdx.c-350-{\ndrivers/cdx/cdx.c:351:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:352:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:353:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:354:\tu32 input_id = cdx_dev-\u003ereq_id;\ndrivers/cdx/cdx.c-355-\tint ret;\ndrivers/cdx/cdx.c-356-\ndrivers/cdx/cdx.c:357:\tret = of_dma_configure_id(dev, cdx-\u003edev-\u003eof_node, 0, \u0026input_id);\ndrivers/cdx/cdx.c-358-\tif (ret \u0026\u0026 ret != -EPROBE_DEFER) {\n--\ndrivers/cdx/cdx.c-362-\ndrivers/cdx/cdx.c:363:\t/* @cdx_drv may not be valid when we're called from the IOMMU layer */\ndrivers/cdx/cdx.c:364:\tif (!ret \u0026\u0026 dev-\u003edriver \u0026\u0026 !cdx_drv-\u003edriver_managed_dma) {\ndrivers/cdx/cdx.c-365-\t\tret = iommu_device_use_default_domain(dev);\n--\ndrivers/cdx/cdx.c-372-\ndrivers/cdx/cdx.c:373:static void cdx_dma_cleanup(struct device *dev)\ndrivers/cdx/cdx.c-374-{\ndrivers/cdx/cdx.c:375:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c-376-\ndrivers/cdx/cdx.c:377:\tif (!cdx_drv-\u003edriver_managed_dma)\ndrivers/cdx/cdx.c-378-\t\tiommu_device_unuse_default_domain(dev);\n--\ndrivers/cdx/cdx.c-381-/* show configuration fields */\ndrivers/cdx/cdx.c:382:#define cdx_config_attr(field, format_string)\t\\\ndrivers/cdx/cdx.c-383-static ssize_t\t\\\ndrivers/cdx/cdx.c=384=field##_show(struct device *dev, struct device_attribute *attr, char *buf)\t\\\ndrivers/cdx/cdx.c-385-{\t\\\ndrivers/cdx/cdx.c:386:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\t\\\ndrivers/cdx/cdx.c:387:\treturn sysfs_emit(buf, format_string, cdx_dev-\u003efield);\t\\\ndrivers/cdx/cdx.c-388-}\t\\\ndrivers/cdx/cdx.c=389=static DEVICE_ATTR_RO(field)\ndrivers/cdx/cdx.c-390-\ndrivers/cdx/cdx.c:391:cdx_config_attr(vendor, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:392:cdx_config_attr(device, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:393:cdx_config_attr(subsystem_vendor, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:394:cdx_config_attr(subsystem_device, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:395:cdx_config_attr(revision, \"0x%02x\\n\");\ndrivers/cdx/cdx.c:396:cdx_config_attr(class, \"0x%06x\\n\");\ndrivers/cdx/cdx.c-397-\ndrivers/cdx/cdx.c=398=static ssize_t remove_store(struct device *dev,\n--\ndrivers/cdx/cdx.c-412-\ndrivers/cdx/cdx.c:413:\t\tret = cdx_unregister_device(dev, NULL);\ndrivers/cdx/cdx.c-414-\t\tif (ret)\n--\ndrivers/cdx/cdx.c=422=static ssize_t reset_store(struct device *dev, struct device_attribute *attr,\n--\ndrivers/cdx/cdx.c-424-{\ndrivers/cdx/cdx.c:425:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-426-\tbool val;\n--\ndrivers/cdx/cdx.c-434-\ndrivers/cdx/cdx.c:435:\tif (cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c:436:\t\t/* Reset all the devices attached to cdx bus */\ndrivers/cdx/cdx.c:437:\t\tret = device_for_each_child(dev, NULL, reset_cdx_device);\ndrivers/cdx/cdx.c-438-\telse\ndrivers/cdx/cdx.c:439:\t\tret = cdx_dev_reset(dev);\ndrivers/cdx/cdx.c-440-\n--\ndrivers/cdx/cdx.c=445=static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,\n--\ndrivers/cdx/cdx.c-447-{\ndrivers/cdx/cdx.c:448:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-449-\ndrivers/cdx/cdx.c:450:\treturn sprintf(buf, \"cdx:v%04Xd%04Xsv%04Xsd%04Xc%06X\\n\", cdx_dev-\u003evendor,\ndrivers/cdx/cdx.c:451:\t\t\tcdx_dev-\u003edevice, cdx_dev-\u003esubsystem_vendor, cdx_dev-\u003esubsystem_device,\ndrivers/cdx/cdx.c:452:\t\t\tcdx_dev-\u003eclass);\ndrivers/cdx/cdx.c-453-}\n--\ndrivers/cdx/cdx.c=456=static ssize_t enable_store(struct device *dev, struct device_attribute *attr,\n--\ndrivers/cdx/cdx.c-458-{\ndrivers/cdx/cdx.c:459:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:460:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-461-\tbool enable;\n--\ndrivers/cdx/cdx.c-466-\ndrivers/cdx/cdx.c:467:\tif (enable == cdx_dev-\u003eenabled)\ndrivers/cdx/cdx.c-468-\t\treturn count;\ndrivers/cdx/cdx.c-469-\ndrivers/cdx/cdx.c:470:\tif (enable \u0026\u0026 cdx-\u003eops-\u003ebus_enable)\ndrivers/cdx/cdx.c:471:\t\tret = cdx-\u003eops-\u003ebus_enable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c:472:\telse if (!enable \u0026\u0026 cdx-\u003eops-\u003ebus_disable)\ndrivers/cdx/cdx.c:473:\t\tret = cdx-\u003eops-\u003ebus_disable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c-474-\telse\n--\ndrivers/cdx/cdx.c-477-\tif (!ret)\ndrivers/cdx/cdx.c:478:\t\tcdx_dev-\u003eenabled = enable;\ndrivers/cdx/cdx.c-479-\n--\ndrivers/cdx/cdx.c=483=static ssize_t enable_show(struct device *dev, struct device_attribute *attr, char *buf)\ndrivers/cdx/cdx.c-484-{\ndrivers/cdx/cdx.c:485:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-486-\ndrivers/cdx/cdx.c:487:\treturn sysfs_emit(buf, \"%u\\n\", cdx_dev-\u003eenabled);\ndrivers/cdx/cdx.c-488-}\ndrivers/cdx/cdx.c=489=static DEVICE_ATTR_RW(enable);\ndrivers/cdx/cdx.c-490-\ndrivers/cdx/cdx.c:491:static umode_t cdx_dev_attrs_are_visible(struct kobject *kobj, struct attribute *a, int n)\ndrivers/cdx/cdx.c-492-{\ndrivers/cdx/cdx.c-493-\tstruct device *dev = kobj_to_dev(kobj);\ndrivers/cdx/cdx.c:494:\tstruct cdx_device *cdx_dev;\ndrivers/cdx/cdx.c-495-\ndrivers/cdx/cdx.c:496:\tcdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:497:\tif (!cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c-498-\t\treturn a-\u003emode;\n--\ndrivers/cdx/cdx.c-502-\ndrivers/cdx/cdx.c:503:static umode_t cdx_bus_attrs_are_visible(struct kobject *kobj, struct attribute *a, int n)\ndrivers/cdx/cdx.c-504-{\ndrivers/cdx/cdx.c-505-\tstruct device *dev = kobj_to_dev(kobj);\ndrivers/cdx/cdx.c:506:\tstruct cdx_device *cdx_dev;\ndrivers/cdx/cdx.c-507-\ndrivers/cdx/cdx.c:508:\tcdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:509:\tif (cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c-510-\t\treturn a-\u003emode;\n--\ndrivers/cdx/cdx.c-514-\ndrivers/cdx/cdx.c:515:static struct attribute *cdx_dev_attrs[] = {\ndrivers/cdx/cdx.c-516-\t\u0026dev_attr_remove.attr,\n--\ndrivers/cdx/cdx.c-527-\ndrivers/cdx/cdx.c:528:static const struct attribute_group cdx_dev_group = {\ndrivers/cdx/cdx.c:529:\t.attrs = cdx_dev_attrs,\ndrivers/cdx/cdx.c:530:\t.is_visible = cdx_dev_attrs_are_visible,\ndrivers/cdx/cdx.c-531-};\ndrivers/cdx/cdx.c-532-\ndrivers/cdx/cdx.c:533:static struct attribute *cdx_bus_dev_attrs[] = {\ndrivers/cdx/cdx.c-534-\t\u0026dev_attr_enable.attr,\n--\ndrivers/cdx/cdx.c-538-\ndrivers/cdx/cdx.c:539:static const struct attribute_group cdx_bus_dev_group = {\ndrivers/cdx/cdx.c:540:\t.attrs = cdx_bus_dev_attrs,\ndrivers/cdx/cdx.c:541:\t.is_visible = cdx_bus_attrs_are_visible,\ndrivers/cdx/cdx.c-542-};\ndrivers/cdx/cdx.c-543-\ndrivers/cdx/cdx.c:544:static const struct attribute_group *cdx_dev_groups[] = {\ndrivers/cdx/cdx.c:545:\t\u0026cdx_dev_group,\ndrivers/cdx/cdx.c:546:\t\u0026cdx_bus_dev_group,\ndrivers/cdx/cdx.c-547-\tNULL,\n--\ndrivers/cdx/cdx.c-549-\ndrivers/cdx/cdx.c:550:static int cdx_debug_resource_show(struct seq_file *s, void *data)\ndrivers/cdx/cdx.c-551-{\ndrivers/cdx/cdx.c:552:\tstruct cdx_device *cdx_dev = s-\u003eprivate;\ndrivers/cdx/cdx.c-553-\tint i;\n--\ndrivers/cdx/cdx.c-555-\tfor (i = 0; i \u003c MAX_CDX_DEV_RESOURCES; i++) {\ndrivers/cdx/cdx.c:556:\t\tstruct resource *res =  \u0026cdx_dev-\u003eres[i];\ndrivers/cdx/cdx.c-557-\n--\ndrivers/cdx/cdx.c-562-}\ndrivers/cdx/cdx.c:563:DEFINE_SHOW_ATTRIBUTE(cdx_debug_resource);\ndrivers/cdx/cdx.c-564-\ndrivers/cdx/cdx.c:565:static void cdx_device_debugfs_init(struct cdx_device *cdx_dev)\ndrivers/cdx/cdx.c-566-{\ndrivers/cdx/cdx.c:567:\tcdx_dev-\u003edebugfs_dir = debugfs_create_dir(dev_name(\u0026cdx_dev-\u003edev), cdx_debugfs_dir);\ndrivers/cdx/cdx.c:568:\tif (IS_ERR(cdx_dev-\u003edebugfs_dir))\ndrivers/cdx/cdx.c-569-\t\treturn;\ndrivers/cdx/cdx.c-570-\ndrivers/cdx/cdx.c:571:\tdebugfs_create_file(\"resource\", 0444, cdx_dev-\u003edebugfs_dir, cdx_dev,\ndrivers/cdx/cdx.c:572:\t\t\t    \u0026cdx_debug_resource_fops);\ndrivers/cdx/cdx.c-573-}\n--\ndrivers/cdx/cdx.c=575=static ssize_t rescan_store(const struct bus_type *bus,\n--\ndrivers/cdx/cdx.c-577-{\ndrivers/cdx/cdx.c:578:\tstruct cdx_controller *cdx;\ndrivers/cdx/cdx.c-579-\tstruct platform_device *pd;\n--\ndrivers/cdx/cdx.c-587-\ndrivers/cdx/cdx.c:588:\tguard(mutex)(\u0026cdx_controller_lock);\ndrivers/cdx/cdx.c-589-\ndrivers/cdx/cdx.c-590-\t/* Unregister all the devices on the bus */\ndrivers/cdx/cdx.c:591:\tcdx_unregister_devices(\u0026cdx_bus_type);\ndrivers/cdx/cdx.c-592-\n--\ndrivers/cdx/cdx.c-598-\ndrivers/cdx/cdx.c:599:\t\tcdx = platform_get_drvdata(pd);\ndrivers/cdx/cdx.c:600:\t\tif (cdx \u0026\u0026 cdx-\u003econtroller_registered \u0026\u0026 cdx-\u003eops-\u003escan)\ndrivers/cdx/cdx.c:601:\t\t\tcdx-\u003eops-\u003escan(cdx);\ndrivers/cdx/cdx.c-602-\n--\ndrivers/cdx/cdx.c=608=static BUS_ATTR_WO(rescan);\ndrivers/cdx/cdx.c-609-\ndrivers/cdx/cdx.c:610:static struct attribute *cdx_bus_attrs[] = {\ndrivers/cdx/cdx.c-611-\t\u0026bus_attr_rescan.attr,\n--\ndrivers/cdx/cdx.c-613-};\ndrivers/cdx/cdx.c:614:ATTRIBUTE_GROUPS(cdx_bus);\ndrivers/cdx/cdx.c-615-\ndrivers/cdx/cdx.c:616:const struct bus_type cdx_bus_type = {\ndrivers/cdx/cdx.c:617:\t.name\t\t= \"cdx\",\ndrivers/cdx/cdx.c-618-\t.driver_override = true,\ndrivers/cdx/cdx.c:619:\t.match\t\t= cdx_bus_match,\ndrivers/cdx/cdx.c:620:\t.probe\t\t= cdx_probe,\ndrivers/cdx/cdx.c:621:\t.remove\t\t= cdx_remove,\ndrivers/cdx/cdx.c:622:\t.shutdown\t= cdx_shutdown,\ndrivers/cdx/cdx.c:623:\t.dma_configure\t= cdx_dma_configure,\ndrivers/cdx/cdx.c:624:\t.dma_cleanup\t= cdx_dma_cleanup,\ndrivers/cdx/cdx.c:625:\t.bus_groups\t= cdx_bus_groups,\ndrivers/cdx/cdx.c:626:\t.dev_groups\t= cdx_dev_groups,\ndrivers/cdx/cdx.c-627-};\ndrivers/cdx/cdx.c:628:EXPORT_SYMBOL_GPL(cdx_bus_type);\ndrivers/cdx/cdx.c-629-\ndrivers/cdx/cdx.c:630:int __cdx_driver_register(struct cdx_driver *cdx_driver,\ndrivers/cdx/cdx.c-631-\t\t\t  struct module *owner)\n--\ndrivers/cdx/cdx.c-634-\ndrivers/cdx/cdx.c:635:\tcdx_driver-\u003edriver.owner = owner;\ndrivers/cdx/cdx.c:636:\tcdx_driver-\u003edriver.bus = \u0026cdx_bus_type;\ndrivers/cdx/cdx.c-637-\ndrivers/cdx/cdx.c:638:\terror = driver_register(\u0026cdx_driver-\u003edriver);\ndrivers/cdx/cdx.c-639-\tif (error) {\ndrivers/cdx/cdx.c-640-\t\tpr_err(\"driver_register() failed for %s: %d\\n\",\ndrivers/cdx/cdx.c:641:\t\t       cdx_driver-\u003edriver.name, error);\ndrivers/cdx/cdx.c-642-\t\treturn error;\n--\ndrivers/cdx/cdx.c-646-}\ndrivers/cdx/cdx.c:647:EXPORT_SYMBOL_GPL(__cdx_driver_register);\ndrivers/cdx/cdx.c-648-\ndrivers/cdx/cdx.c:649:void cdx_driver_unregister(struct cdx_driver *cdx_driver)\ndrivers/cdx/cdx.c-650-{\ndrivers/cdx/cdx.c:651:\tdriver_unregister(\u0026cdx_driver-\u003edriver);\ndrivers/cdx/cdx.c-652-}\ndrivers/cdx/cdx.c:653:EXPORT_SYMBOL_GPL(cdx_driver_unregister);\ndrivers/cdx/cdx.c-654-\ndrivers/cdx/cdx.c:655:static void cdx_device_release(struct device *dev)\ndrivers/cdx/cdx.c-656-{\ndrivers/cdx/cdx.c:657:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-658-\ndrivers/cdx/cdx.c:659:\tkfree(cdx_dev);\ndrivers/cdx/cdx.c-660-}\ndrivers/cdx/cdx.c-661-\ndrivers/cdx/cdx.c:662:static const struct vm_operations_struct cdx_phys_vm_ops = {\ndrivers/cdx/cdx.c-663-#ifdef CONFIG_HAVE_IOREMAP_PROT\n--\ndrivers/cdx/cdx.c-668-/**\ndrivers/cdx/cdx.c:669: * cdx_mmap_resource - map a CDX resource into user memory space\ndrivers/cdx/cdx.c-670- * @fp: File pointer. Not used in this function, but required where\n--\ndrivers/cdx/cdx.c-679- */\ndrivers/cdx/cdx.c:680:static int cdx_mmap_resource(struct file *fp, struct kobject *kobj,\ndrivers/cdx/cdx.c-681-\t\t\t     const struct bin_attribute *attr,\n--\ndrivers/cdx/cdx.c-683-{\ndrivers/cdx/cdx.c:684:\tstruct cdx_device *cdx_dev = to_cdx_device(kobj_to_dev(kobj));\ndrivers/cdx/cdx.c-685-\tint num = (unsigned long)attr-\u003eprivate;\n--\ndrivers/cdx/cdx.c-688-\ndrivers/cdx/cdx.c:689:\tres = \u0026cdx_dev-\u003eres[num];\ndrivers/cdx/cdx.c-690-\tif (iomem_is_exclusive(res-\u003estart))\n--\ndrivers/cdx/cdx.c-693-\t/* Make sure the caller is mapping a valid resource for this device */\ndrivers/cdx/cdx.c:694:\tsize = ((cdx_resource_len(cdx_dev, num) - 1) \u003e\u003e PAGE_SHIFT) + 1;\ndrivers/cdx/cdx.c-695-\tif (vma-\u003evm_pgoff + vma_pages(vma) \u003e size)\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 15268
							output: 35
							thoughts: 85
						

**Considering CDX Bus Emulation in QEMU**

Okay, so the CDX bus driver in this context is dependent on either `OF && ARM64` or `COMPILE_TEST`. This tells me the core requirement or the context in which it operates. The fact that the `vfio/cdx` driver exists, specifically for VFIO support, is interesting. This immediately sparks the question: can we emulate these CDX devices within QEMU? That's the real goal here. To figure out if it's possible.

My next line of thought is to see what resources are available to the CDX bus. Is there a software driver that we can actually probe? If we can find one, that will give us a strong basis for emulation. It looks like the Kconfig files are the place to start. Specifically, `drivers/cdx/controller/Kconfig` is likely to be the right starting point for this investigation.

{
  "File": "drivers/cdx/controller/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t#\n   3:\t# CDX controller configuration\n   4:\t#\n   5:\t# Copyright (C) 2022-2023, Advanced Micro Devices, Inc.\n   6:\t#\n   7:\t\n   8:\tif CDX_BUS\n   9:\t\n  10:\tconfig CDX_CONTROLLER\n  11:\t\ttristate \"CDX bus controller\"\n  12:\t\tdepends on HAS_DMA\n  13:\t\tselect REMOTEPROC\n  14:\t\tselect RPMSG\n  15:\t\thelp\n  16:\t\t  CDX controller drives the CDX bus. It interacts with\n  17:\t\t  firmware to get the hardware devices and registers with\n  18:\t\t  the CDX bus. Say Y to enable the CDX hardware driver.\n  19:\t\n  20:\t\t  If unsure, say N.\n"
}

gemini-3.1-pro-preview

null

null

							input: 15833
							output: 31
							thoughts: 64
						

**My Initial Thoughts on CDX Controller Interaction**

Okay, so I'm looking at this CDX controller and immediately thinking about how it hooks into the hardware. It's clear that it relies on firmware to interface with the devices. My first thought is to dive into how that's orchestrated, keeping an eye out for the critical dependencies: `HAS_DMA`, `REMOTEPROC`, and `RPMSG`. These are the usual suspects. I need to understand if there is a realistic way to mock any of the CDX hardware for testing. My gut feeling tells me to check within the driver directory for `cdx`, focusing in the `controller` subdirectory, specifically looking at `cdx_controller.c` or something analogous. That seems like the most likely place to find the device enumeration and interaction logic. I'll need to see if any mechanisms have been developed to handle virtual devices.

{
  "Expression": "cdx_controller",
  "PathPrefix": "drivers/cdx/controller/"
}

{
  "Output": "drivers/cdx/controller/Makefile=8=obj-$(CONFIG_CDX_CONTROLLER) += cdx-controller.o\ndrivers/cdx/controller/Makefile:9:cdx-controller-objs := cdx_controller.o cdx_rpmsg.o mcdi.o mcdi_functions.o\n--\ndrivers/cdx/controller/cdx_controller.c-12-\ndrivers/cdx/controller/cdx_controller.c:13:#include \"cdx_controller.h\"\ndrivers/cdx/controller/cdx_controller.c-14-#include \"../cdx.h\"\n--\ndrivers/cdx/controller/cdx_controller.c=31=static const struct cdx_mcdi_ops mcdi_ops = {\n--\ndrivers/cdx/controller/cdx_controller.c-35-\ndrivers/cdx/controller/cdx_controller.c:36:static int cdx_bus_enable(struct cdx_controller *cdx, u8 bus_num)\ndrivers/cdx/controller/cdx_controller.c-37-{\n--\ndrivers/cdx/controller/cdx_controller.c-40-\ndrivers/cdx/controller/cdx_controller.c:41:static int cdx_bus_disable(struct cdx_controller *cdx, u8 bus_num)\ndrivers/cdx/controller/cdx_controller.c-42-{\n--\ndrivers/cdx/controller/cdx_controller.c-45-\ndrivers/cdx/controller/cdx_controller.c:46:void cdx_rpmsg_post_probe(struct cdx_controller *cdx)\ndrivers/cdx/controller/cdx_controller.c-47-{\n--\ndrivers/cdx/controller/cdx_controller.c-52-\ndrivers/cdx/controller/cdx_controller.c:53:void cdx_rpmsg_pre_remove(struct cdx_controller *cdx)\ndrivers/cdx/controller/cdx_controller.c-54-{\n--\ndrivers/cdx/controller/cdx_controller.c-58-\ndrivers/cdx/controller/cdx_controller.c:59:static int cdx_configure_device(struct cdx_controller *cdx,\ndrivers/cdx/controller/cdx_controller.c-60-\t\t\t\tu8 bus_num, u8 dev_num,\n--\ndrivers/cdx/controller/cdx_controller.c-92-\ndrivers/cdx/controller/cdx_controller.c:93:static int cdx_scan_devices(struct cdx_controller *cdx)\ndrivers/cdx/controller/cdx_controller.c-94-{\n--\ndrivers/cdx/controller/cdx_controller.c=164=static int xlnx_cdx_probe(struct platform_device *pdev)\ndrivers/cdx/controller/cdx_controller.c-165-{\ndrivers/cdx/controller/cdx_controller.c:166:\tstruct cdx_controller *cdx;\ndrivers/cdx/controller/cdx_controller.c-167-\tstruct cdx_mcdi *cdx_mcdi;\n--\ndrivers/cdx/controller/cdx_controller.c=222=static void xlnx_cdx_remove(struct platform_device *pdev)\ndrivers/cdx/controller/cdx_controller.c-223-{\ndrivers/cdx/controller/cdx_controller.c:224:\tstruct cdx_controller *cdx = platform_get_drvdata(pdev);\ndrivers/cdx/controller/cdx_controller.c-225-\tstruct cdx_mcdi *cdx_mcdi = cdx-\u003epriv;\n--\ndrivers/cdx/controller/cdx_controller.h-13-\ndrivers/cdx/controller/cdx_controller.h:14:void cdx_rpmsg_post_probe(struct cdx_controller *cdx);\ndrivers/cdx/controller/cdx_controller.h-15-\ndrivers/cdx/controller/cdx_controller.h:16:void cdx_rpmsg_pre_remove(struct cdx_controller *cdx);\ndrivers/cdx/controller/cdx_controller.h-17-\n--\ndrivers/cdx/controller/cdx_rpmsg.c-15-#include \"../cdx.h\"\ndrivers/cdx/controller/cdx_rpmsg.c:16:#include \"cdx_controller.h\"\ndrivers/cdx/controller/cdx_rpmsg.c-17-#include \"mcdi_functions.h\"\n--\ndrivers/cdx/controller/cdx_rpmsg.c=46=static int cdx_attach_to_rproc(struct platform_device *pdev)\n--\ndrivers/cdx/controller/cdx_rpmsg.c-48-\tstruct device_node *r5_core_node;\ndrivers/cdx/controller/cdx_rpmsg.c:49:\tstruct cdx_controller *cdx_c;\ndrivers/cdx/controller/cdx_rpmsg.c-50-\tstruct cdx_mcdi *cdx_mcdi;\n--\ndrivers/cdx/controller/cdx_rpmsg.c=85=static void cdx_detach_to_r5(struct platform_device *pdev)\ndrivers/cdx/controller/cdx_rpmsg.c-86-{\ndrivers/cdx/controller/cdx_rpmsg.c:87:\tstruct cdx_controller *cdx_c;\ndrivers/cdx/controller/cdx_rpmsg.c-88-\tstruct cdx_mcdi *cdx_mcdi;\n--\ndrivers/cdx/controller/cdx_rpmsg.c=97=static int cdx_rpmsg_cb(struct rpmsg_device *rpdev, void *data,\n--\ndrivers/cdx/controller/cdx_rpmsg.c-99-{\ndrivers/cdx/controller/cdx_rpmsg.c:100:\tstruct cdx_controller *cdx_c = dev_get_drvdata(\u0026rpdev-\u003edev);\ndrivers/cdx/controller/cdx_rpmsg.c-101-\tstruct cdx_mcdi *cdx_mcdi = cdx_c-\u003epriv;\n--\ndrivers/cdx/controller/cdx_rpmsg.c=111=static void cdx_rpmsg_post_probe_work(struct work_struct *work)\ndrivers/cdx/controller/cdx_rpmsg.c-112-{\ndrivers/cdx/controller/cdx_rpmsg.c:113:\tstruct cdx_controller *cdx_c;\ndrivers/cdx/controller/cdx_rpmsg.c-114-\tstruct cdx_mcdi *cdx_mcdi;\n--\ndrivers/cdx/controller/cdx_rpmsg.c=121=static int cdx_rpmsg_probe(struct rpmsg_device *rpdev)\n--\ndrivers/cdx/controller/cdx_rpmsg.c-123-\tstruct rpmsg_channel_info chinfo = {0};\ndrivers/cdx/controller/cdx_rpmsg.c:124:\tstruct cdx_controller *cdx_c;\ndrivers/cdx/controller/cdx_rpmsg.c-125-\tstruct cdx_mcdi *cdx_mcdi;\ndrivers/cdx/controller/cdx_rpmsg.c-126-\ndrivers/cdx/controller/cdx_rpmsg.c:127:\tcdx_c = (struct cdx_controller *)cdx_rpmsg_id_table[0].driver_data;\ndrivers/cdx/controller/cdx_rpmsg.c-128-\tcdx_mcdi = cdx_c-\u003epriv;\n--\ndrivers/cdx/controller/cdx_rpmsg.c=149=static void cdx_rpmsg_remove(struct rpmsg_device *rpdev)\ndrivers/cdx/controller/cdx_rpmsg.c-150-{\ndrivers/cdx/controller/cdx_rpmsg.c:151:\tstruct cdx_controller *cdx_c = dev_get_drvdata(\u0026rpdev-\u003edev);\ndrivers/cdx/controller/cdx_rpmsg.c-152-\tstruct cdx_mcdi *cdx_mcdi = cdx_c-\u003epriv;\n--\ndrivers/cdx/controller/cdx_rpmsg.c=169=int cdx_setup_rpmsg(struct platform_device *pdev)\ndrivers/cdx/controller/cdx_rpmsg.c-170-{\ndrivers/cdx/controller/cdx_rpmsg.c:171:\tstruct cdx_controller *cdx_c;\ndrivers/cdx/controller/cdx_rpmsg.c-172-\tstruct cdx_mcdi *cdx_mcdi;\n"
}

gemini-3.1-pro-preview

null

null

							input: 18335
							output: 39
							thoughts: 163
						

**Analyzing the CDX Controller**

Okay, so the CDX controller is RPMSG based, and it's using `rproc` – that `remoteproc` thing – to talk to a remote processor, specifically an R5 core. This immediately feels pretty hardware-specific. I'm wondering if we can mock it. Does syzkaller offer anything for that? Like `syz_rpmsg_create`? Nope, nothing tailored specifically for CDX. Hmm, frustrating.

Wait a second... the relevant patch is right there in `drivers/vfio/cdx/main.c`. Okay, that gives me a concrete starting point. Now, let's see if we can trigger `vfio_cdx_mmap`. Is the `VFIO_CDX` driver even testable? I guess that's the real question. Time to dive into `drivers/vfio/cdx/main.c` and figure this out. I need to understand its entry points and see what possibilities exist.

{
  "Expression": "vfio_cdx_mmap",
  "PathPrefix": "drivers/vfio/cdx/main.c"
}

{
  "Output": "drivers/vfio/cdx/main.c=223=static long vfio_cdx_ioctl(struct vfio_device *core_vdev,\n--\ndrivers/vfio/cdx/main.c-243-\ndrivers/vfio/cdx/main.c:244:static int vfio_cdx_mmap_mmio(struct vfio_cdx_region region,\ndrivers/vfio/cdx/main.c-245-\t\t\t      struct vm_area_struct *vma)\n--\ndrivers/vfio/cdx/main.c-263-\ndrivers/vfio/cdx/main.c:264:static int vfio_cdx_mmap(struct vfio_device *core_vdev,\ndrivers/vfio/cdx/main.c-265-\t\t\t struct vm_area_struct *vma)\n--\ndrivers/vfio/cdx/main.c-291-\ndrivers/vfio/cdx/main.c:292:\treturn vfio_cdx_mmap_mmio(vdev-\u003eregions[index], vma);\ndrivers/vfio/cdx/main.c-293-}\n--\ndrivers/vfio/cdx/main.c=295=static const struct vfio_device_ops vfio_cdx_ops = {\n--\ndrivers/vfio/cdx/main.c-303-\t.device_feature = vfio_cdx_ioctl_feature,\ndrivers/vfio/cdx/main.c:304:\t.mmap\t\t= vfio_cdx_mmap,\ndrivers/vfio/cdx/main.c-305-\t.bind_iommufd\t= vfio_iommufd_physical_bind,\n"
}

gemini-3.1-pro-preview

null

null

							input: 19199
							output: 26
							thoughts: 82
						

**My Initial Thoughts on VFIO CDX and mmap**

Okay, so `vfio_cdx_mmap` is the `mmap` function specifically for operations related to the `vfio_cdx` driver. That makes sense, but the crucial point is that this functionality only becomes relevant when a CDX device is actually bound to the `vfio-cdx` driver. I'm wondering... is there a way to create a CDX device virtually, within software? I'm thinking of scenarios for testing or prototyping where I don't necessarily have physical hardware. The immediate question then is, are there any mock or test drivers out there specifically for CDX? If so, that would be a fantastic shortcut to working with `vfio_cdx` without needing actual hardware. I need to investigate that avenue further, it could be a real time saver.

no matches

{
  "Expression": "cdx",
  "PathPrefix": "tools/testing/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 19505
							output: 26
							thoughts: 18
						

Here's my thought process, as it went:

**Checking for a Mock in `drivers/cdx/`**

Okay, so I need to see if we've got a mock implementation anywhere in the `drivers/cdx/` directory. This is standard practice, especially when dealing with drivers – mocks are *incredibly* useful for testing and isolation, whether we're talking unit tests, integration tests, or even just debugging. They let us control the environment, simulate hardware, and verify our code's interactions without having to rely on the actual, sometimes unreliable, driver hardware. Plus, mocks make testing so much faster and more predictable. Let's see if the team has been following best practices, or if this is something that needs to be implemented. I know *I'd* prefer a good mock to keep things moving. Time to dive in!

no matches

{
  "Expression": "mock",
  "PathPrefix": "drivers/cdx/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 19745
							output: 24
							thoughts: 23
						

Okay, here's my thought process, summarized as you requested:

**Checking for Mock `cdx` in Drivers**

Alright, let's get down to brass tacks. I need to quickly ascertain if we've got any mock implementations of `cdx` lurking in the `drivers/` directory. This is standard procedure before I start making any changes, just to ensure that I'm not overlooking a test setup or a temporary workaround. I'll need to know whether to make updates to those too, or whether they're even relevant to what I'm doing. It's a fundamental step; I can't afford to break existing mocking implementations. That would cause untold issues. Let's make sure that's clear.

{
  "Expression": "cdx",
  "PathPrefix": "drivers/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 2546 lines.\nUse more precise expression if possible.\n\ndrivers/Kconfig=250=source \"drivers/hte/Kconfig\"\ndrivers/Kconfig-251-\ndrivers/Kconfig:252:source \"drivers/cdx/Kconfig\"\ndrivers/Kconfig-253-\n--\ndrivers/Makefile=194=obj-$(CONFIG_DRM_ACCEL)\t\t+= accel/\ndrivers/Makefile:195:obj-$(CONFIG_CDX_BUS)\t\t+= cdx/\ndrivers/Makefile-196-obj-$(CONFIG_DPLL)\t\t+= dpll/\n--\ndrivers/cdx/Kconfig=8=config CDX_BUS\n--\ndrivers/cdx/Kconfig-18-\ndrivers/cdx/Kconfig:19:source \"drivers/cdx/controller/Kconfig\"\n--\ndrivers/cdx/Makefile=8=ccflags-y += -DDEFAULT_SYMBOL_NAMESPACE='\"CDX_BUS\"'\ndrivers/cdx/Makefile-9-\ndrivers/cdx/Makefile:10:obj-$(CONFIG_CDX_BUS) += cdx.o controller/\ndrivers/cdx/Makefile-11-\ndrivers/cdx/Makefile=12=ifdef CONFIG_GENERIC_MSI_IRQ\ndrivers/cdx/Makefile:13:obj-$(CONFIG_CDX_BUS) += cdx_msi.o\ndrivers/cdx/Makefile-14-endif\n--\ndrivers/cdx/cdx.c-67-#include \u003clinux/idr.h\u003e\ndrivers/cdx/cdx.c:68:#include \u003clinux/cdx/cdx_bus.h\u003e\ndrivers/cdx/cdx.c-69-#include \u003clinux/iommu.h\u003e\n--\ndrivers/cdx/cdx.c-71-#include \u003clinux/debugfs.h\u003e\ndrivers/cdx/cdx.c:72:#include \"cdx.h\"\ndrivers/cdx/cdx.c-73-\n--\ndrivers/cdx/cdx.c-78-/* IDA for CDX controllers registered with the CDX bus */\ndrivers/cdx/cdx.c:79:static DEFINE_IDA(cdx_controller_ida);\ndrivers/cdx/cdx.c-80-/* Lock to protect controller ops */\ndrivers/cdx/cdx.c:81:static DEFINE_MUTEX(cdx_controller_lock);\ndrivers/cdx/cdx.c:82:/* Debugfs dir for cdx bus */\ndrivers/cdx/cdx.c:83:static struct dentry *cdx_debugfs_dir;\ndrivers/cdx/cdx.c-84-\ndrivers/cdx/cdx.c:85:static char *compat_node_name = \"xlnx,versal-net-cdx\";\ndrivers/cdx/cdx.c-86-\ndrivers/cdx/cdx.c:87:static void cdx_destroy_res_attr(struct cdx_device *cdx_dev, int num);\ndrivers/cdx/cdx.c-88-\ndrivers/cdx/cdx.c-89-/**\ndrivers/cdx/cdx.c:90: * cdx_dev_reset - Reset a CDX device\ndrivers/cdx/cdx.c-91- * @dev: CDX device\n--\ndrivers/cdx/cdx.c-94- */\ndrivers/cdx/cdx.c:95:int cdx_dev_reset(struct device *dev)\ndrivers/cdx/cdx.c-96-{\ndrivers/cdx/cdx.c:97:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:98:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:99:\tstruct cdx_device_config dev_config = {0};\ndrivers/cdx/cdx.c:100:\tstruct cdx_driver *cdx_drv;\ndrivers/cdx/cdx.c-101-\tint ret;\ndrivers/cdx/cdx.c-102-\ndrivers/cdx/cdx.c:103:\tcdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c-104-\t/* Notify driver that device is being reset */\ndrivers/cdx/cdx.c:105:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003ereset_prepare)\ndrivers/cdx/cdx.c:106:\t\tcdx_drv-\u003ereset_prepare(cdx_dev);\ndrivers/cdx/cdx.c-107-\ndrivers/cdx/cdx.c-108-\tdev_config.type = CDX_DEV_RESET_CONF;\ndrivers/cdx/cdx.c:109:\tret = cdx-\u003eops-\u003edev_configure(cdx, cdx_dev-\u003ebus_num,\ndrivers/cdx/cdx.c:110:\t\t\t\t      cdx_dev-\u003edev_num, \u0026dev_config);\ndrivers/cdx/cdx.c-111-\tif (ret)\ndrivers/cdx/cdx.c:112:\t\tdev_err(dev, \"cdx device reset failed\\n\");\ndrivers/cdx/cdx.c-113-\ndrivers/cdx/cdx.c-114-\t/* Notify driver that device reset is complete */\ndrivers/cdx/cdx.c:115:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003ereset_done)\ndrivers/cdx/cdx.c:116:\t\tcdx_drv-\u003ereset_done(cdx_dev);\ndrivers/cdx/cdx.c-117-\n--\ndrivers/cdx/cdx.c-119-}\ndrivers/cdx/cdx.c:120:EXPORT_SYMBOL_GPL(cdx_dev_reset);\ndrivers/cdx/cdx.c-121-\ndrivers/cdx/cdx.c-122-/**\ndrivers/cdx/cdx.c:123: * reset_cdx_device - Reset a CDX device\ndrivers/cdx/cdx.c-124- * @dev: CDX device\n--\ndrivers/cdx/cdx.c-130- */\ndrivers/cdx/cdx.c:131:static int reset_cdx_device(struct device *dev, void *data)\ndrivers/cdx/cdx.c-132-{\ndrivers/cdx/cdx.c:133:\treturn cdx_dev_reset(dev);\ndrivers/cdx/cdx.c-134-}\n--\ndrivers/cdx/cdx.c-136-/**\ndrivers/cdx/cdx.c:137: * cdx_unregister_device - Unregister a CDX device\ndrivers/cdx/cdx.c-138- * @dev: CDX device\n--\ndrivers/cdx/cdx.c-140- *\t  but is required here as the bus_for_each_dev() API expects\ndrivers/cdx/cdx.c:141: *\t  the passed function (cdx_unregister_device) to have this\ndrivers/cdx/cdx.c-142- *\t  as an argument.\n--\ndrivers/cdx/cdx.c-145- */\ndrivers/cdx/cdx.c:146:static int cdx_unregister_device(struct device *dev,\ndrivers/cdx/cdx.c-147-\t\t\t\t void *data)\ndrivers/cdx/cdx.c-148-{\ndrivers/cdx/cdx.c:149:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:150:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-151-\ndrivers/cdx/cdx.c:152:\tif (cdx_dev-\u003eis_bus) {\ndrivers/cdx/cdx.c:153:\t\tdevice_for_each_child(dev, NULL, cdx_unregister_device);\ndrivers/cdx/cdx.c:154:\t\tif (cdx_dev-\u003eenabled \u0026\u0026 cdx-\u003eops-\u003ebus_disable)\ndrivers/cdx/cdx.c:155:\t\t\tcdx-\u003eops-\u003ebus_disable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c-156-\t} else {\ndrivers/cdx/cdx.c:157:\t\tcdx_destroy_res_attr(cdx_dev, MAX_CDX_DEV_RESOURCES);\ndrivers/cdx/cdx.c:158:\t\tdebugfs_remove_recursive(cdx_dev-\u003edebugfs_dir);\ndrivers/cdx/cdx.c-159-\t}\n--\ndrivers/cdx/cdx.c-161-\t/*\ndrivers/cdx/cdx.c:162:\t * Do not free cdx_dev here as it would be freed in\ndrivers/cdx/cdx.c:163:\t * cdx_device_release() called from within put_device().\ndrivers/cdx/cdx.c-164-\t */\ndrivers/cdx/cdx.c:165:\tdevice_del(\u0026cdx_dev-\u003edev);\ndrivers/cdx/cdx.c:166:\tput_device(\u0026cdx_dev-\u003edev);\ndrivers/cdx/cdx.c-167-\n--\ndrivers/cdx/cdx.c-170-\ndrivers/cdx/cdx.c:171:static void cdx_unregister_devices(const struct bus_type *bus)\ndrivers/cdx/cdx.c-172-{\ndrivers/cdx/cdx.c:173:\t/* Reset all the devices attached to cdx bus */\ndrivers/cdx/cdx.c:174:\tbus_for_each_dev(bus, NULL, NULL, cdx_unregister_device);\ndrivers/cdx/cdx.c-175-}\n--\ndrivers/cdx/cdx.c-177-/**\ndrivers/cdx/cdx.c:178: * cdx_match_one_device - Tell if a CDX device structure has a matching\ndrivers/cdx/cdx.c-179- *\t\t\t  CDX device id structure\n--\ndrivers/cdx/cdx.c-182- *\ndrivers/cdx/cdx.c:183: * Return: matching cdx_device_id structure or NULL if there is no match.\ndrivers/cdx/cdx.c-184- */\ndrivers/cdx/cdx.c:185:static inline const struct cdx_device_id *\ndrivers/cdx/cdx.c:186:cdx_match_one_device(const struct cdx_device_id *id,\ndrivers/cdx/cdx.c:187:\t\t     const struct cdx_device *dev)\ndrivers/cdx/cdx.c-188-{\n--\ndrivers/cdx/cdx.c-199-/**\ndrivers/cdx/cdx.c:200: * cdx_match_id - See if a CDX device matches a given cdx_id table\ndrivers/cdx/cdx.c-201- * @ids: array of CDX device ID structures to search in\n--\ndrivers/cdx/cdx.c-204- * Used by a driver to check whether a CDX device is in its list of\ndrivers/cdx/cdx.c:205: * supported devices. Returns the matching cdx_device_id structure or\ndrivers/cdx/cdx.c-206- * NULL if there is no match.\ndrivers/cdx/cdx.c-207- *\ndrivers/cdx/cdx.c:208: * Return: matching cdx_device_id structure or NULL if there is no match.\ndrivers/cdx/cdx.c-209- */\ndrivers/cdx/cdx.c:210:static inline const struct cdx_device_id *\ndrivers/cdx/cdx.c:211:cdx_match_id(const struct cdx_device_id *ids, struct cdx_device *dev)\ndrivers/cdx/cdx.c-212-{\n--\ndrivers/cdx/cdx.c-214-\t\twhile (ids-\u003evendor || ids-\u003edevice) {\ndrivers/cdx/cdx.c:215:\t\t\tif (cdx_match_one_device(ids, dev))\ndrivers/cdx/cdx.c-216-\t\t\t\treturn ids;\n--\ndrivers/cdx/cdx.c-222-\ndrivers/cdx/cdx.c:223:int cdx_set_master(struct cdx_device *cdx_dev)\ndrivers/cdx/cdx.c-224-{\ndrivers/cdx/cdx.c:225:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:226:\tstruct cdx_device_config dev_config;\ndrivers/cdx/cdx.c-227-\tint ret = -EOPNOTSUPP;\n--\ndrivers/cdx/cdx.c-230-\tdev_config.bus_master_enable = true;\ndrivers/cdx/cdx.c:231:\tif (cdx-\u003eops-\u003edev_configure)\ndrivers/cdx/cdx.c:232:\t\tret = cdx-\u003eops-\u003edev_configure(cdx, cdx_dev-\u003ebus_num,\ndrivers/cdx/cdx.c:233:\t\t\t\t\t      cdx_dev-\u003edev_num, \u0026dev_config);\ndrivers/cdx/cdx.c-234-\n--\ndrivers/cdx/cdx.c-236-}\ndrivers/cdx/cdx.c:237:EXPORT_SYMBOL_GPL(cdx_set_master);\ndrivers/cdx/cdx.c-238-\ndrivers/cdx/cdx.c:239:int cdx_clear_master(struct cdx_device *cdx_dev)\ndrivers/cdx/cdx.c-240-{\ndrivers/cdx/cdx.c:241:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:242:\tstruct cdx_device_config dev_config;\ndrivers/cdx/cdx.c-243-\tint ret = -EOPNOTSUPP;\n--\ndrivers/cdx/cdx.c-246-\tdev_config.bus_master_enable = false;\ndrivers/cdx/cdx.c:247:\tif (cdx-\u003eops-\u003edev_configure)\ndrivers/cdx/cdx.c:248:\t\tret = cdx-\u003eops-\u003edev_configure(cdx, cdx_dev-\u003ebus_num,\ndrivers/cdx/cdx.c:249:\t\t\t\t\t      cdx_dev-\u003edev_num, \u0026dev_config);\ndrivers/cdx/cdx.c-250-\n--\ndrivers/cdx/cdx.c-252-}\ndrivers/cdx/cdx.c:253:EXPORT_SYMBOL_GPL(cdx_clear_master);\ndrivers/cdx/cdx.c-254-\ndrivers/cdx/cdx.c-255-/**\ndrivers/cdx/cdx.c:256: * cdx_bus_match - device to driver matching callback\ndrivers/cdx/cdx.c:257: * @dev: the cdx device to match against\ndrivers/cdx/cdx.c:258: * @drv: the device driver to search for matching cdx device\ndrivers/cdx/cdx.c-259- * structures\n--\ndrivers/cdx/cdx.c-262- */\ndrivers/cdx/cdx.c:263:static int cdx_bus_match(struct device *dev, const struct device_driver *drv)\ndrivers/cdx/cdx.c-264-{\ndrivers/cdx/cdx.c:265:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:266:\tconst struct cdx_driver *cdx_drv = to_cdx_driver(drv);\ndrivers/cdx/cdx.c:267:\tconst struct cdx_device_id *found_id = NULL;\ndrivers/cdx/cdx.c:268:\tconst struct cdx_device_id *ids;\ndrivers/cdx/cdx.c-269-\tint ret;\ndrivers/cdx/cdx.c-270-\ndrivers/cdx/cdx.c:271:\tif (cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c-272-\t\treturn false;\ndrivers/cdx/cdx.c-273-\ndrivers/cdx/cdx.c:274:\tids = cdx_drv-\u003ematch_id_table;\ndrivers/cdx/cdx.c-275-\n--\ndrivers/cdx/cdx.c-280-\ndrivers/cdx/cdx.c:281:\tfound_id = cdx_match_id(ids, cdx_dev);\ndrivers/cdx/cdx.c-282-\tif (!found_id)\n--\ndrivers/cdx/cdx.c-295-\t\tids = found_id + 1;\ndrivers/cdx/cdx.c:296:\t\tfound_id = cdx_match_id(ids, cdx_dev);\ndrivers/cdx/cdx.c-297-\t} while (found_id);\n--\ndrivers/cdx/cdx.c-301-\ndrivers/cdx/cdx.c:302:static int cdx_probe(struct device *dev)\ndrivers/cdx/cdx.c-303-{\ndrivers/cdx/cdx.c:304:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:305:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:306:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-307-\tint error;\n--\ndrivers/cdx/cdx.c-312-\t */\ndrivers/cdx/cdx.c:313:\tif (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) \u0026\u0026 cdx-\u003emsi_domain) {\ndrivers/cdx/cdx.c:314:\t\terror = msi_setup_device_data(\u0026cdx_dev-\u003edev);\ndrivers/cdx/cdx.c-315-\t\tif (error)\n--\ndrivers/cdx/cdx.c-318-\ndrivers/cdx/cdx.c:319:\terror = cdx_drv-\u003eprobe(cdx_dev);\ndrivers/cdx/cdx.c-320-\tif (error) {\n--\ndrivers/cdx/cdx.c-327-\ndrivers/cdx/cdx.c:328:static void cdx_remove(struct device *dev)\ndrivers/cdx/cdx.c-329-{\ndrivers/cdx/cdx.c:330:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:331:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-332-\ndrivers/cdx/cdx.c:333:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003eremove)\ndrivers/cdx/cdx.c:334:\t\tcdx_drv-\u003eremove(cdx_dev);\ndrivers/cdx/cdx.c-335-}\ndrivers/cdx/cdx.c-336-\ndrivers/cdx/cdx.c:337:static void cdx_shutdown(struct device *dev)\ndrivers/cdx/cdx.c-338-{\ndrivers/cdx/cdx.c:339:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:340:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:341:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-342-\ndrivers/cdx/cdx.c:343:\tif (cdx_dev-\u003eis_bus \u0026\u0026 cdx_dev-\u003eenabled \u0026\u0026 cdx-\u003eops-\u003ebus_disable)\ndrivers/cdx/cdx.c:344:\t\tcdx-\u003eops-\u003ebus_disable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c:345:\tif (cdx_drv \u0026\u0026 cdx_drv-\u003eshutdown)\ndrivers/cdx/cdx.c:346:\t\tcdx_drv-\u003eshutdown(cdx_dev);\ndrivers/cdx/cdx.c-347-}\ndrivers/cdx/cdx.c-348-\ndrivers/cdx/cdx.c:349:static int cdx_dma_configure(struct device *dev)\ndrivers/cdx/cdx.c-350-{\ndrivers/cdx/cdx.c:351:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c:352:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:353:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c:354:\tu32 input_id = cdx_dev-\u003ereq_id;\ndrivers/cdx/cdx.c-355-\tint ret;\ndrivers/cdx/cdx.c-356-\ndrivers/cdx/cdx.c:357:\tret = of_dma_configure_id(dev, cdx-\u003edev-\u003eof_node, 0, \u0026input_id);\ndrivers/cdx/cdx.c-358-\tif (ret \u0026\u0026 ret != -EPROBE_DEFER) {\n--\ndrivers/cdx/cdx.c-362-\ndrivers/cdx/cdx.c:363:\t/* @cdx_drv may not be valid when we're called from the IOMMU layer */\ndrivers/cdx/cdx.c:364:\tif (!ret \u0026\u0026 dev-\u003edriver \u0026\u0026 !cdx_drv-\u003edriver_managed_dma) {\ndrivers/cdx/cdx.c-365-\t\tret = iommu_device_use_default_domain(dev);\n--\ndrivers/cdx/cdx.c-372-\ndrivers/cdx/cdx.c:373:static void cdx_dma_cleanup(struct device *dev)\ndrivers/cdx/cdx.c-374-{\ndrivers/cdx/cdx.c:375:\tstruct cdx_driver *cdx_drv = to_cdx_driver(dev-\u003edriver);\ndrivers/cdx/cdx.c-376-\ndrivers/cdx/cdx.c:377:\tif (!cdx_drv-\u003edriver_managed_dma)\ndrivers/cdx/cdx.c-378-\t\tiommu_device_unuse_default_domain(dev);\n--\ndrivers/cdx/cdx.c-381-/* show configuration fields */\ndrivers/cdx/cdx.c:382:#define cdx_config_attr(field, format_string)\t\\\ndrivers/cdx/cdx.c-383-static ssize_t\t\\\ndrivers/cdx/cdx.c=384=field##_show(struct device *dev, struct device_attribute *attr, char *buf)\t\\\ndrivers/cdx/cdx.c-385-{\t\\\ndrivers/cdx/cdx.c:386:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\t\\\ndrivers/cdx/cdx.c:387:\treturn sysfs_emit(buf, format_string, cdx_dev-\u003efield);\t\\\ndrivers/cdx/cdx.c-388-}\t\\\ndrivers/cdx/cdx.c=389=static DEVICE_ATTR_RO(field)\ndrivers/cdx/cdx.c-390-\ndrivers/cdx/cdx.c:391:cdx_config_attr(vendor, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:392:cdx_config_attr(device, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:393:cdx_config_attr(subsystem_vendor, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:394:cdx_config_attr(subsystem_device, \"0x%04x\\n\");\ndrivers/cdx/cdx.c:395:cdx_config_attr(revision, \"0x%02x\\n\");\ndrivers/cdx/cdx.c:396:cdx_config_attr(class, \"0x%06x\\n\");\ndrivers/cdx/cdx.c-397-\ndrivers/cdx/cdx.c=398=static ssize_t remove_store(struct device *dev,\n--\ndrivers/cdx/cdx.c-412-\ndrivers/cdx/cdx.c:413:\t\tret = cdx_unregister_device(dev, NULL);\ndrivers/cdx/cdx.c-414-\t\tif (ret)\n--\ndrivers/cdx/cdx.c=422=static ssize_t reset_store(struct device *dev, struct device_attribute *attr,\n--\ndrivers/cdx/cdx.c-424-{\ndrivers/cdx/cdx.c:425:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-426-\tbool val;\n--\ndrivers/cdx/cdx.c-434-\ndrivers/cdx/cdx.c:435:\tif (cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c:436:\t\t/* Reset all the devices attached to cdx bus */\ndrivers/cdx/cdx.c:437:\t\tret = device_for_each_child(dev, NULL, reset_cdx_device);\ndrivers/cdx/cdx.c-438-\telse\ndrivers/cdx/cdx.c:439:\t\tret = cdx_dev_reset(dev);\ndrivers/cdx/cdx.c-440-\n--\ndrivers/cdx/cdx.c=445=static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,\n--\ndrivers/cdx/cdx.c-447-{\ndrivers/cdx/cdx.c:448:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-449-\ndrivers/cdx/cdx.c:450:\treturn sprintf(buf, \"cdx:v%04Xd%04Xsv%04Xsd%04Xc%06X\\n\", cdx_dev-\u003evendor,\ndrivers/cdx/cdx.c:451:\t\t\tcdx_dev-\u003edevice, cdx_dev-\u003esubsystem_vendor, cdx_dev-\u003esubsystem_device,\ndrivers/cdx/cdx.c:452:\t\t\tcdx_dev-\u003eclass);\ndrivers/cdx/cdx.c-453-}\n--\ndrivers/cdx/cdx.c=456=static ssize_t enable_store(struct device *dev, struct device_attribute *attr,\n--\ndrivers/cdx/cdx.c-458-{\ndrivers/cdx/cdx.c:459:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:460:\tstruct cdx_controller *cdx = cdx_dev-\u003ecdx;\ndrivers/cdx/cdx.c-461-\tbool enable;\n--\ndrivers/cdx/cdx.c-466-\ndrivers/cdx/cdx.c:467:\tif (enable == cdx_dev-\u003eenabled)\ndrivers/cdx/cdx.c-468-\t\treturn count;\ndrivers/cdx/cdx.c-469-\ndrivers/cdx/cdx.c:470:\tif (enable \u0026\u0026 cdx-\u003eops-\u003ebus_enable)\ndrivers/cdx/cdx.c:471:\t\tret = cdx-\u003eops-\u003ebus_enable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c:472:\telse if (!enable \u0026\u0026 cdx-\u003eops-\u003ebus_disable)\ndrivers/cdx/cdx.c:473:\t\tret = cdx-\u003eops-\u003ebus_disable(cdx, cdx_dev-\u003ebus_num);\ndrivers/cdx/cdx.c-474-\telse\n--\ndrivers/cdx/cdx.c-477-\tif (!ret)\ndrivers/cdx/cdx.c:478:\t\tcdx_dev-\u003eenabled = enable;\ndrivers/cdx/cdx.c-479-\n--\ndrivers/cdx/cdx.c=483=static ssize_t enable_show(struct device *dev, struct device_attribute *attr, char *buf)\ndrivers/cdx/cdx.c-484-{\ndrivers/cdx/cdx.c:485:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-486-\ndrivers/cdx/cdx.c:487:\treturn sysfs_emit(buf, \"%u\\n\", cdx_dev-\u003eenabled);\ndrivers/cdx/cdx.c-488-}\ndrivers/cdx/cdx.c=489=static DEVICE_ATTR_RW(enable);\ndrivers/cdx/cdx.c-490-\ndrivers/cdx/cdx.c:491:static umode_t cdx_dev_attrs_are_visible(struct kobject *kobj, struct attribute *a, int n)\ndrivers/cdx/cdx.c-492-{\ndrivers/cdx/cdx.c-493-\tstruct device *dev = kobj_to_dev(kobj);\ndrivers/cdx/cdx.c:494:\tstruct cdx_device *cdx_dev;\ndrivers/cdx/cdx.c-495-\ndrivers/cdx/cdx.c:496:\tcdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:497:\tif (!cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c-498-\t\treturn a-\u003emode;\n--\ndrivers/cdx/cdx.c-502-\ndrivers/cdx/cdx.c:503:static umode_t cdx_bus_attrs_are_visible(struct kobject *kobj, struct attribute *a, int n)\ndrivers/cdx/cdx.c-504-{\ndrivers/cdx/cdx.c-505-\tstruct device *dev = kobj_to_dev(kobj);\ndrivers/cdx/cdx.c:506:\tstruct cdx_device *cdx_dev;\ndrivers/cdx/cdx.c-507-\ndrivers/cdx/cdx.c:508:\tcdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c:509:\tif (cdx_dev-\u003eis_bus)\ndrivers/cdx/cdx.c-510-\t\treturn a-\u003emode;\n--\ndrivers/cdx/cdx.c-514-\ndrivers/cdx/cdx.c:515:static struct attribute *cdx_dev_attrs[] = {\ndrivers/cdx/cdx.c-516-\t\u0026dev_attr_remove.attr,\n--\ndrivers/cdx/cdx.c-527-\ndrivers/cdx/cdx.c:528:static const struct attribute_group cdx_dev_group = {\ndrivers/cdx/cdx.c:529:\t.attrs = cdx_dev_attrs,\ndrivers/cdx/cdx.c:530:\t.is_visible = cdx_dev_attrs_are_visible,\ndrivers/cdx/cdx.c-531-};\ndrivers/cdx/cdx.c-532-\ndrivers/cdx/cdx.c:533:static struct attribute *cdx_bus_dev_attrs[] = {\ndrivers/cdx/cdx.c-534-\t\u0026dev_attr_enable.attr,\n--\ndrivers/cdx/cdx.c-538-\ndrivers/cdx/cdx.c:539:static const struct attribute_group cdx_bus_dev_group = {\ndrivers/cdx/cdx.c:540:\t.attrs = cdx_bus_dev_attrs,\ndrivers/cdx/cdx.c:541:\t.is_visible = cdx_bus_attrs_are_visible,\ndrivers/cdx/cdx.c-542-};\ndrivers/cdx/cdx.c-543-\ndrivers/cdx/cdx.c:544:static const struct attribute_group *cdx_dev_groups[] = {\ndrivers/cdx/cdx.c:545:\t\u0026cdx_dev_group,\ndrivers/cdx/cdx.c:546:\t\u0026cdx_bus_dev_group,\ndrivers/cdx/cdx.c-547-\tNULL,\n--\ndrivers/cdx/cdx.c-549-\ndrivers/cdx/cdx.c:550:static int cdx_debug_resource_show(struct seq_file *s, void *data)\ndrivers/cdx/cdx.c-551-{\ndrivers/cdx/cdx.c:552:\tstruct cdx_device *cdx_dev = s-\u003eprivate;\ndrivers/cdx/cdx.c-553-\tint i;\n--\ndrivers/cdx/cdx.c-555-\tfor (i = 0; i \u003c MAX_CDX_DEV_RESOURCES; i++) {\ndrivers/cdx/cdx.c:556:\t\tstruct resource *res =  \u0026cdx_dev-\u003eres[i];\ndrivers/cdx/cdx.c-557-\n--\ndrivers/cdx/cdx.c-562-}\ndrivers/cdx/cdx.c:563:DEFINE_SHOW_ATTRIBUTE(cdx_debug_resource);\ndrivers/cdx/cdx.c-564-\ndrivers/cdx/cdx.c:565:static void cdx_device_debugfs_init(struct cdx_device *cdx_dev)\ndrivers/cdx/cdx.c-566-{\ndrivers/cdx/cdx.c:567:\tcdx_dev-\u003edebugfs_dir = debugfs_create_dir(dev_name(\u0026cdx_dev-\u003edev), cdx_debugfs_dir);\ndrivers/cdx/cdx.c:568:\tif (IS_ERR(cdx_dev-\u003edebugfs_dir))\ndrivers/cdx/cdx.c-569-\t\treturn;\ndrivers/cdx/cdx.c-570-\ndrivers/cdx/cdx.c:571:\tdebugfs_create_file(\"resource\", 0444, cdx_dev-\u003edebugfs_dir, cdx_dev,\ndrivers/cdx/cdx.c:572:\t\t\t    \u0026cdx_debug_resource_fops);\ndrivers/cdx/cdx.c-573-}\n--\ndrivers/cdx/cdx.c=575=static ssize_t rescan_store(const struct bus_type *bus,\n--\ndrivers/cdx/cdx.c-577-{\ndrivers/cdx/cdx.c:578:\tstruct cdx_controller *cdx;\ndrivers/cdx/cdx.c-579-\tstruct platform_device *pd;\n--\ndrivers/cdx/cdx.c-587-\ndrivers/cdx/cdx.c:588:\tguard(mutex)(\u0026cdx_controller_lock);\ndrivers/cdx/cdx.c-589-\ndrivers/cdx/cdx.c-590-\t/* Unregister all the devices on the bus */\ndrivers/cdx/cdx.c:591:\tcdx_unregister_devices(\u0026cdx_bus_type);\ndrivers/cdx/cdx.c-592-\n--\ndrivers/cdx/cdx.c-598-\ndrivers/cdx/cdx.c:599:\t\tcdx = platform_get_drvdata(pd);\ndrivers/cdx/cdx.c:600:\t\tif (cdx \u0026\u0026 cdx-\u003econtroller_registered \u0026\u0026 cdx-\u003eops-\u003escan)\ndrivers/cdx/cdx.c:601:\t\t\tcdx-\u003eops-\u003escan(cdx);\ndrivers/cdx/cdx.c-602-\n--\ndrivers/cdx/cdx.c=608=static BUS_ATTR_WO(rescan);\ndrivers/cdx/cdx.c-609-\ndrivers/cdx/cdx.c:610:static struct attribute *cdx_bus_attrs[] = {\ndrivers/cdx/cdx.c-611-\t\u0026bus_attr_rescan.attr,\n--\ndrivers/cdx/cdx.c-613-};\ndrivers/cdx/cdx.c:614:ATTRIBUTE_GROUPS(cdx_bus);\ndrivers/cdx/cdx.c-615-\ndrivers/cdx/cdx.c:616:const struct bus_type cdx_bus_type = {\ndrivers/cdx/cdx.c:617:\t.name\t\t= \"cdx\",\ndrivers/cdx/cdx.c-618-\t.driver_override = true,\ndrivers/cdx/cdx.c:619:\t.match\t\t= cdx_bus_match,\ndrivers/cdx/cdx.c:620:\t.probe\t\t= cdx_probe,\ndrivers/cdx/cdx.c:621:\t.remove\t\t= cdx_remove,\ndrivers/cdx/cdx.c:622:\t.shutdown\t= cdx_shutdown,\ndrivers/cdx/cdx.c:623:\t.dma_configure\t= cdx_dma_configure,\ndrivers/cdx/cdx.c:624:\t.dma_cleanup\t= cdx_dma_cleanup,\ndrivers/cdx/cdx.c:625:\t.bus_groups\t= cdx_bus_groups,\ndrivers/cdx/cdx.c:626:\t.dev_groups\t= cdx_dev_groups,\ndrivers/cdx/cdx.c-627-};\ndrivers/cdx/cdx.c:628:EXPORT_SYMBOL_GPL(cdx_bus_type);\ndrivers/cdx/cdx.c-629-\ndrivers/cdx/cdx.c:630:int __cdx_driver_register(struct cdx_driver *cdx_driver,\ndrivers/cdx/cdx.c-631-\t\t\t  struct module *owner)\n--\ndrivers/cdx/cdx.c-634-\ndrivers/cdx/cdx.c:635:\tcdx_driver-\u003edriver.owner = owner;\ndrivers/cdx/cdx.c:636:\tcdx_driver-\u003edriver.bus = \u0026cdx_bus_type;\ndrivers/cdx/cdx.c-637-\ndrivers/cdx/cdx.c:638:\terror = driver_register(\u0026cdx_driver-\u003edriver);\ndrivers/cdx/cdx.c-639-\tif (error) {\ndrivers/cdx/cdx.c-640-\t\tpr_err(\"driver_register() failed for %s: %d\\n\",\ndrivers/cdx/cdx.c:641:\t\t       cdx_driver-\u003edriver.name, error);\ndrivers/cdx/cdx.c-642-\t\treturn error;\n--\ndrivers/cdx/cdx.c-646-}\ndrivers/cdx/cdx.c:647:EXPORT_SYMBOL_GPL(__cdx_driver_register);\ndrivers/cdx/cdx.c-648-\ndrivers/cdx/cdx.c:649:void cdx_driver_unregister(struct cdx_driver *cdx_driver)\ndrivers/cdx/cdx.c-650-{\ndrivers/cdx/cdx.c:651:\tdriver_unregister(\u0026cdx_driver-\u003edriver);\ndrivers/cdx/cdx.c-652-}\ndrivers/cdx/cdx.c:653:EXPORT_SYMBOL_GPL(cdx_driver_unregister);\ndrivers/cdx/cdx.c-654-\ndrivers/cdx/cdx.c:655:static void cdx_device_release(struct device *dev)\ndrivers/cdx/cdx.c-656-{\ndrivers/cdx/cdx.c:657:\tstruct cdx_device *cdx_dev = to_cdx_device(dev);\ndrivers/cdx/cdx.c-658-\ndrivers/cdx/cdx.c:659:\tkfree(cdx_dev);\ndrivers/cdx/cdx.c-660-}\ndrivers/cdx/cdx.c-661-\ndrivers/cdx/cdx.c:662:static const struct vm_operations_struct cdx_phys_vm_ops = {\ndrivers/cdx/cdx.c-663-#ifdef CONFIG_HAVE_IOREMAP_PROT\n--\ndrivers/cdx/cdx.c-668-/**\ndrivers/cdx/cdx.c:669: * cdx_mmap_resource - map a CDX resource into user memory space\ndrivers/cdx/cdx.c-670- * @fp: File pointer. Not used in this function, but required where\n--\ndrivers/cdx/cdx.c-679- */\ndrivers/cdx/cdx.c:680:static int cdx_mmap_resource(struct file *fp, struct kobject *kobj,\ndrivers/cdx/cdx.c-681-\t\t\t     const struct bin_attribute *attr,\n--\ndrivers/cdx/cdx.c-683-{\ndrivers/cdx/cdx.c:684:\tstruct cdx_device *cdx_dev = to_cdx_device(kobj_to_dev(kobj));\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 30969
							output: 31
							thoughts: 184
						

**My Assessment of the CDX Bus and Virtualization**

Okay, so the CDX bus… right, that's specific to those AMD/Xilinx Versal devices (`xlnx,versal-net-cdx`). Not a widely-used standard, definitely hardware-dependent. And the problem is, it requires *actual* hardware or a specifically configured remoteproc to even scan for devices. No mock driver in the kernel, which is a real limitation.

So, in a virtualized environment like GCE or QEMU, that `vfio_cdx_mmap` path is completely unreachable without some dedicated hardware emulation. And QEMU, as far as I know, doesn't have standard support for emulating the CDX bus. It's not like the mac80211_hwsim where there's a generic software emulation available.

Wait a second… can I trick the system? Can I create a "fake" CDX device through sysfs or configfs? Perhaps I could craft something to simulate its presence, even if it's not truly connected to any physical hardware. That would be a way to bypass this requirement for hardware/remoteproc. Let me go check if there's any way to create that CDX device from userspace. That might be a viable workaround.

{
  "Expression": "cdx_device_add",
  "PathPrefix": "drivers/cdx/"
}

{
  "Output": "drivers/cdx/cdx.c=727=static int cdx_create_res_attr(struct cdx_device *cdx_dev, int num)\n--\ndrivers/cdx/cdx.c-755-\ndrivers/cdx/cdx.c:756:int cdx_device_add(struct cdx_dev_params *dev_params)\ndrivers/cdx/cdx.c-757-{\n--\ndrivers/cdx/cdx.c-841-}\ndrivers/cdx/cdx.c:842:EXPORT_SYMBOL_NS_GPL(cdx_device_add, \"CDX_BUS_CONTROLLER\");\ndrivers/cdx/cdx.c-843-\n--\ndrivers/cdx/cdx.h=62=void cdx_unregister_controller(struct cdx_controller *cdx);\n--\ndrivers/cdx/cdx.h-64-/**\ndrivers/cdx/cdx.h:65: * cdx_device_add - Add a CDX device. This function adds a CDX device\ndrivers/cdx/cdx.h-66- *\t\ton the CDX bus as per the device parameters provided\n--\ndrivers/cdx/cdx.h-72- */\ndrivers/cdx/cdx.h:73:int cdx_device_add(struct cdx_dev_params *dev_params);\ndrivers/cdx/cdx.h-74-\n--\ndrivers/cdx/controller/cdx_controller.c=93=static int cdx_scan_devices(struct cdx_controller *cdx)\n--\ndrivers/cdx/controller/cdx_controller.c-141-\t\t\t/* Add the device to the cdx bus */\ndrivers/cdx/controller/cdx_controller.c:142:\t\t\tret = cdx_device_add(\u0026dev_params);\ndrivers/cdx/controller/cdx_controller.c-143-\t\t\tif (ret) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 31961
							output: 40
							thoughts: 174
						

**My Analysis of CDX Device Addition**

Okay, so here's what I've got bouncing around in my head about this `cdx_device_add` function. It seems pretty tightly coupled; from what I can see, the only place it's ever called is directly within `cdx_scan_devices` which resides in `drivers/cdx/controller/cdx_controller.c`. That's a good starting point, meaning my investigation can be pretty focused. Now, when is `cdx_scan_devices` triggered? It happens when the CDX controller itself is probed – which makes sense – or when a rescanning operation is initiated. The CDX controller, remember, is set up as a platform device, specifically the `xlnx_cdx_probe` type.

The interesting question is: can a user, for some reason, create *another* platform device for `xlnx_cdx_probe`? My initial thought is maybe, potentially, through a device tree overlay, right? That seems plausible. However, even if they could, the real bottleneck, the real dependency, appears to be the MCDI (Management Controller Driver Interface) over RPMSG. If there's no working RPMSG endpoint that's actually responding to those MCDI commands, `cdx_scan_devices` is going to ultimately fail at finding any devices. It doesn't matter how many platform devices we might be able to conjure up. It’s all about the underlying communication.

So, where do I go from here? Given the centrality of `cdx_scan_devices`, it seems like checking its implementation will reveal the details of this process, right? The details are in the implementation. I need to dig in and see exactly how it interacts with the RPMSG layer and MCDI.

{
  "File": "drivers/cdx/controller/cdx_controller.c",
  "FirstLine": 93,
  "LineCount": 50
}

{
  "Contents": "  93:\tstatic int cdx_scan_devices(struct cdx_controller *cdx)\n  94:\t{\n  95:\t\tstruct cdx_mcdi *cdx_mcdi = cdx-\u003epriv;\n  96:\t\tu8 bus_num, dev_num, num_cdx_bus;\n  97:\t\tint ret;\n  98:\t\n  99:\t\t/* MCDI FW Read: Fetch the number of CDX buses on this controller */\n 100:\t\tret = cdx_mcdi_get_num_buses(cdx_mcdi);\n 101:\t\tif (ret \u003c 0) {\n 102:\t\t\tdev_err(cdx-\u003edev,\n 103:\t\t\t\t\"Get number of CDX buses failed: %d\\n\", ret);\n 104:\t\t\treturn ret;\n 105:\t\t}\n 106:\t\tnum_cdx_bus = (u8)ret;\n 107:\t\n 108:\t\tfor (bus_num = 0; bus_num \u003c num_cdx_bus; bus_num++) {\n 109:\t\t\tstruct device *bus_dev;\n 110:\t\t\tu8 num_cdx_dev;\n 111:\t\n 112:\t\t\t/* Add the bus on cdx subsystem */\n 113:\t\t\tbus_dev = cdx_bus_add(cdx, bus_num);\n 114:\t\t\tif (!bus_dev)\n 115:\t\t\t\tcontinue;\n 116:\t\n 117:\t\t\t/* MCDI FW Read: Fetch the number of devices present */\n 118:\t\t\tret = cdx_mcdi_get_num_devs(cdx_mcdi, bus_num);\n 119:\t\t\tif (ret \u003c 0) {\n 120:\t\t\t\tdev_err(cdx-\u003edev,\n 121:\t\t\t\t\t\"Get devices on CDX bus %d failed: %d\\n\", bus_num, ret);\n 122:\t\t\t\tcontinue;\n 123:\t\t\t}\n 124:\t\t\tnum_cdx_dev = (u8)ret;\n 125:\t\n 126:\t\t\tfor (dev_num = 0; dev_num \u003c num_cdx_dev; dev_num++) {\n 127:\t\t\t\tstruct cdx_dev_params dev_params;\n 128:\t\n 129:\t\t\t\t/* MCDI FW: Get the device config */\n 130:\t\t\t\tret = cdx_mcdi_get_dev_config(cdx_mcdi, bus_num,\n 131:\t\t\t\t\t\t\t      dev_num, \u0026dev_params);\n 132:\t\t\t\tif (ret) {\n 133:\t\t\t\t\tdev_err(cdx-\u003edev,\n 134:\t\t\t\t\t\t\"CDX device config get failed for %d(bus):%d(dev), %d\\n\",\n 135:\t\t\t\t\t\tbus_num, dev_num, ret);\n 136:\t\t\t\t\tcontinue;\n 137:\t\t\t\t}\n 138:\t\t\t\tdev_params.cdx = cdx;\n 139:\t\t\t\tdev_params.parent = bus_dev;\n 140:\t\n 141:\t\t\t\t/* Add the device to the cdx bus */\n 142:\t\t\t\tret = cdx_device_add(\u0026dev_params);\n"
}

gemini-3.1-pro-preview

null

null

							input: 33409
							output: 38
							thoughts: 286
						

**My Analysis of the `vfio-cdx` Driver in a Virtualized Environment**

Okay, so I'm digging into this `vfio-cdx` driver, and I've got a problem. It looks like the core functionality hinges on these MCDI firmware reads, specifically `cdx_mcdi_get_num_buses`, `cdx_mcdi_get_num_devs`, and `cdx_mcdi_get_dev_config`. These functions depend on sending messages over RPMSG to the firmware. The issue is, in a standard QEMU setup, without a mock RPMSG endpoint that *acts* like the firmware, those `cdx_mcdi_*` calls are going to fail. They'll either timeout or return errors.

And if those calls fail, boom, no CDX devices are created. If there are no CDX devices, then the `vfio-cdx` driver, naturally, can't be bound to anything. That means `vfio_cdx_mmap` – the function I'm really interested in – is never going to be reached.

This seems to fall squarely into that category we've been talking about: code paths that are impossible to reach in virtualized environments, even with emulated hardware. Think about things like USB gadget setups or `mac80211_hwsim` – you can emulate the hardware, but if the underlying dependencies aren't there, you're stuck.

But hold on a second… I need to be absolutely sure. Is there *any* other way `vfio_cdx_mmap` could be called? Let me retrace my steps... it's a static function, defined right there in `drivers/vfio/cdx/main.c`, and it's assigned to `vfio_cdx_ops.mmap`. Ah, yes, right. `vfio_cdx_ops` is used in `vfio_cdx_probe`. So it appears there are no other obvious methods for calling this function.

Alright, looks like my initial assessment is solid. Let's see if this lines up with the broader virtualization strategy.

{
  "Expression": "vfio_cdx_probe",
  "PathPrefix": "drivers/vfio/cdx/main.c"
}

{
  "Output": "drivers/vfio/cdx/main.c=295=static const struct vfio_device_ops vfio_cdx_ops = {\n--\ndrivers/vfio/cdx/main.c-309-\ndrivers/vfio/cdx/main.c:310:static int vfio_cdx_probe(struct cdx_device *cdx_dev)\ndrivers/vfio/cdx/main.c-311-{\n--\ndrivers/vfio/cdx/main.c=352=static struct cdx_driver vfio_cdx_driver = {\ndrivers/vfio/cdx/main.c:353:\t.probe\t\t= vfio_cdx_probe,\ndrivers/vfio/cdx/main.c-354-\t.remove\t\t= vfio_cdx_remove,\n"
}

gemini-3.1-pro-preview

null

null

							input: 34418
							output: 33
							thoughts: 101
						

**Unreachable Code in VFIO-CDX Probe**

Okay, so I'm thinking about `vfio_cdx_probe`. This gets called, as expected, when a `cdx_device` gets bound to the `vfio_cdx_driver`. The thing is, we're dealing with a situation where creating a `cdx_device` is impossible in our current setup. We can't actually probe the driver under these circumstances, and that means we're never hitting the mmap function, either. Given this, it looks pretty clear that this part of the code is unreachable within syzkaller/QEMU's configuration. It's a dead end, plain and simple.

Just to be absolutely sure, I'm going to quickly scan for any existing mocks for MCDI or CDX in the kernel, just in case there's some obscure corner case I'm missing, but I'm pretty confident in my initial assessment.

{
  "Expression": "cdx_mcdi_get_num_buses",
  "PathPrefix": ""
}

{
  "Output": "drivers/cdx/controller/cdx_controller.c=93=static int cdx_scan_devices(struct cdx_controller *cdx)\n--\ndrivers/cdx/controller/cdx_controller.c-99-\t/* MCDI FW Read: Fetch the number of CDX buses on this controller */\ndrivers/cdx/controller/cdx_controller.c:100:\tret = cdx_mcdi_get_num_buses(cdx_mcdi);\ndrivers/cdx/controller/cdx_controller.c-101-\tif (ret \u003c 0) {\n--\ndrivers/cdx/controller/mcdi_functions.c-9-\ndrivers/cdx/controller/mcdi_functions.c:10:int cdx_mcdi_get_num_buses(struct cdx_mcdi *cdx)\ndrivers/cdx/controller/mcdi_functions.c-11-{\n--\ndrivers/cdx/controller/mcdi_functions.h-15-/**\ndrivers/cdx/controller/mcdi_functions.h:16: * cdx_mcdi_get_num_buses - Get the total number of buses on\ndrivers/cdx/controller/mcdi_functions.h-17- *\tthe controller.\n--\ndrivers/cdx/controller/mcdi_functions.h-22- */\ndrivers/cdx/controller/mcdi_functions.h:23:int cdx_mcdi_get_num_buses(struct cdx_mcdi *cdx);\ndrivers/cdx/controller/mcdi_functions.h-24-\n"
}

gemini-3.1-pro-preview

null

null

							input: 35171
							output: 168
							thoughts: 100
						

**My Assessment of the Patch's Fuzzing Worth**

Okay, so looking at this patch, it's pretty clear: no mock is going to cut it here. This whole thing hinges on specific hardware and firmware interactions. The modified code path, in particular, relies on the CDX bus, which, as I recall, needs a very particular setup – MCDI communication over RPMSG, leading to an R5 core. And frankly, this setup isn’t something QEMU, or any standard virtualization environment, emulates.

Therefore, from a practical perspective, it's a dead end. Fuzzing this particular change would be an exercise in futility. It simply won't be reachable. I'm going to mark this as `WorthFuzzing=false`. Then, I'll provide a concise and technically sound explanation. I'll need to specify that the `vfio_cdx_mmap` function is unreachable because the underlying CDX bus architecture is specific to a hardware/firmware arrangement (MCDI via RPMSG to an R5 core) which isn't emulated within QEMU. That should be clear and leave no room for misunderstanding.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `vfio_cdx_mmap` in the VFIO CDX driver. The CDX (Composable DMA eXpress) bus is a hardware-specific bus for AMD/Xilinx Versal devices that relies on MCDI firmware messages over RPMSG to a remote processor (R5 core) to scan and discover devices. There is no software emulation or mock driver for the CDX bus or its firmware in the kernel. Consequently, it is impossible to create a CDX device or bind it to the `vfio-cdx` driver in a standard virtualized environment like QEMU, making the modified code path unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `vfio_cdx_mmap` in the VFIO CDX driver. The CDX (Composable DMA eXpress) bus is a hardware-specific bus for AMD/Xilinx Versal devices that relies on MCDI firmware messages over RPMSG to a remote processor (R5 core) to scan and discover devices. There is no software emulation or mock driver for the CDX bus or its firmware in the kernel. Consequently, it is impossible to create a CDX device or bind it to the `vfio-cdx` driver in a standard virtualized environment like QEMU, making the modified code path unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null