AI Trajectory

null

{
  "EnableConfigs": [
    "MLX5_INFINIBAND",
    "MLX5_CORE",
    "INFINIBAND",
    "INFINIBAND_USER_ACCESS"
  ],
  "FocusSymbols": [
    "mlx5_ib_stage_bfrag_init",
    "mlx5_ib_stage_bfrag_cleanup",
    "create_kernel_qp",
    "_create_kernel_qp"
  ],
  "Reasoning": "The patch modifies the mlx5 infiniband driver to skip allocating fp_bfreg and setting latency_sensitive when the qp_latency_sensitive_disable capability is set. This is a functional change in the hardware driver's queue pair creation and initialization logic. Since it was tested by syzkaller, it is reachable in the fuzzing environment.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit ad8bb5e1a9654b1b66ca25adcb5ee8ffa4f4fd66\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jul 24 18:41:38 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c\nindex d65ebdef28234f..a0f5341f40ff1c 100644\n--- a/drivers/infiniband/hw/mlx5/main.c\n+++ b/drivers/infiniband/hw/mlx5/main.c\n@@ -4950,6 +4950,9 @@ static int mlx5_ib_stage_bfrag_init(struct mlx5_ib_dev *dev)\n \tif (err)\n \t\treturn err;\n \n+\tif (MLX5_CAP_GEN(dev-\u003emdev, qp_latency_sensitive_disable))\n+\t\treturn 0;\n+\n \terr = mlx5_alloc_bfreg(dev-\u003emdev, \u0026dev-\u003efp_bfreg, false, true);\n \tif (err)\n \t\tmlx5_free_bfreg(dev-\u003emdev, \u0026dev-\u003ebfreg);\n@@ -4959,7 +4962,8 @@ static int mlx5_ib_stage_bfrag_init(struct mlx5_ib_dev *dev)\n \n static void mlx5_ib_stage_bfrag_cleanup(struct mlx5_ib_dev *dev)\n {\n-\tmlx5_free_bfreg(dev-\u003emdev, \u0026dev-\u003efp_bfreg);\n+\tif (!MLX5_CAP_GEN(dev-\u003emdev, qp_latency_sensitive_disable))\n+\t\tmlx5_free_bfreg(dev-\u003emdev, \u0026dev-\u003efp_bfreg);\n \tmlx5_free_bfreg(dev-\u003emdev, \u0026dev-\u003ebfreg);\n }\n \ndiff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c\nindex 7ff02d89c31d5b..9253402ed645c9 100644\n--- a/drivers/infiniband/hw/mlx5/qp.c\n+++ b/drivers/infiniband/hw/mlx5/qp.c\n@@ -1123,7 +1123,8 @@ static int _create_kernel_qp(struct mlx5_ib_dev *dev,\n \tvoid *qpc;\n \tint err;\n \n-\tif (init_attr-\u003eqp_type == MLX5_IB_QPT_REG_UMR)\n+\tif (init_attr-\u003eqp_type == MLX5_IB_QPT_REG_UMR \u0026\u0026\n+\t    !MLX5_CAP_GEN(dev-\u003emdev, qp_latency_sensitive_disable))\n \t\tqp-\u003ebf.bfreg = \u0026dev-\u003efp_bfreg;\n \telse\n \t\tqp-\u003ebf.bfreg = \u0026dev-\u003ebfreg;\n@@ -2509,11 +2510,12 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,\n \tMLX5_SET(qpc, qpc, st, mlx5_st);\n \tMLX5_SET(qpc, qpc, pm_state, MLX5_QP_PM_MIGRATED);\n \n-\tif (attr-\u003eqp_type != MLX5_IB_QPT_REG_UMR)\n+\tif (attr-\u003eqp_type == MLX5_IB_QPT_REG_UMR) {\n+\t\tif (!MLX5_CAP_GEN(dev-\u003emdev, qp_latency_sensitive_disable))\n+\t\t\tMLX5_SET(qpc, qpc, latency_sensitive, 1);\n+\t} else {\n \t\tMLX5_SET(qpc, qpc, pd, to_mpd(pd ? pd : devr-\u003ep0)-\u003epdn);\n-\telse\n-\t\tMLX5_SET(qpc, qpc, latency_sensitive, 1);\n-\n+\t}\n \n \tif (qp-\u003eflags \u0026 IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK)\n \t\tMLX5_SET(qpc, qpc, block_lb_mc, 1);\ndiff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h\nindex 695c86ee6d7a3f..28582c4d94d433 100644\n--- a/include/linux/mlx5/mlx5_ifc.h\n+++ b/include/linux/mlx5/mlx5_ifc.h\n@@ -2005,7 +2005,8 @@ struct mlx5_ifc_cmd_hca_cap_bits {\n \tu8         log_max_stride_sz_rq[0x5];\n \tu8         reserved_at_3a8[0x3];\n \tu8         log_min_stride_sz_rq[0x5];\n-\tu8         reserved_at_3b0[0x3];\n+\tu8         reserved_at_3b0[0x2];\n+\tu8         qp_latency_sensitive_disable[0x1];\n \tu8         log_max_stride_sz_sq[0x5];\n \tu8         reserved_at_3b8[0x3];\n \tu8         log_min_stride_sz_sq[0x5];\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "MLX5_INFINIBAND",
    "MLX5_CORE",
    "INFINIBAND",
    "INFINIBAND_USER_ACCESS"
  ],
  "FocusSymbols": [
    "mlx5_ib_stage_bfrag_init",
    "mlx5_ib_stage_bfrag_cleanup",
    "create_kernel_qp",
    "_create_kernel_qp"
  ],
  "Reasoning": "The patch modifies the mlx5 infiniband driver to skip allocating fp_bfreg and setting latency_sensitive when the qp_latency_sensitive_disable capability is set. This is a functional change in the hardware driver's queue pair creation and initialization logic. Since it was tested by syzkaller, it is reachable in the fuzzing environment.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit ad8bb5e1a9654b1b66ca25adcb5ee8ffa4f4fd66
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jul 24 18:41:38 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index d65ebdef28234f..a0f5341f40ff1c 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -4950,6 +4950,9 @@ static int mlx5_ib_stage_bfrag_init(struct mlx5_ib_dev *dev)
 	if (err)
 		return err;
 
+	if (MLX5_CAP_GEN(dev->mdev, qp_latency_sensitive_disable))
+		return 0;
+
 	err = mlx5_alloc_bfreg(dev->mdev, &dev->fp_bfreg, false, true);
 	if (err)
 		mlx5_free_bfreg(dev->mdev, &dev->bfreg);
@@ -4959,7 +4962,8 @@ static int mlx5_ib_stage_bfrag_init(struct mlx5_ib_dev *dev)
 
 static void mlx5_ib_stage_bfrag_cleanup(struct mlx5_ib_dev *dev)
 {
-	mlx5_free_bfreg(dev->mdev, &dev->fp_bfreg);
+	if (!MLX5_CAP_GEN(dev->mdev, qp_latency_sensitive_disable))
+		mlx5_free_bfreg(dev->mdev, &dev->fp_bfreg);
 	mlx5_free_bfreg(dev->mdev, &dev->bfreg);
 }
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 7ff02d89c31d5b..9253402ed645c9 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1123,7 +1123,8 @@ static int _create_kernel_qp(struct mlx5_ib_dev *dev,
 	void *qpc;
 	int err;
 
-	if (init_attr->qp_type == MLX5_IB_QPT_REG_UMR)
+	if (init_attr->qp_type == MLX5_IB_QPT_REG_UMR &&
+	    !MLX5_CAP_GEN(dev->mdev, qp_latency_sensitive_disable))
 		qp->bf.bfreg = &dev->fp_bfreg;
 	else
 		qp->bf.bfreg = &dev->bfreg;
@@ -2509,11 +2510,12 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 	MLX5_SET(qpc, qpc, st, mlx5_st);
 	MLX5_SET(qpc, qpc, pm_state, MLX5_QP_PM_MIGRATED);
 
-	if (attr->qp_type != MLX5_IB_QPT_REG_UMR)
+	if (attr->qp_type == MLX5_IB_QPT_REG_UMR) {
+		if (!MLX5_CAP_GEN(dev->mdev, qp_latency_sensitive_disable))
+			MLX5_SET(qpc, qpc, latency_sensitive, 1);
+	} else {
 		MLX5_SET(qpc, qpc, pd, to_mpd(pd ? pd : devr->p0)->pdn);
-	else
-		MLX5_SET(qpc, qpc, latency_sensitive, 1);
-
+	}
 
 	if (qp->flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK)
 		MLX5_SET(qpc, qpc, block_lb_mc, 1);
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 695c86ee6d7a3f..28582c4d94d433 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -2005,7 +2005,8 @@ struct mlx5_ifc_cmd_hca_cap_bits {
 	u8         log_max_stride_sz_rq[0x5];
 	u8         reserved_at_3a8[0x3];
 	u8         log_min_stride_sz_rq[0x5];
-	u8         reserved_at_3b0[0x3];
+	u8         reserved_at_3b0[0x2];
+	u8         qp_latency_sensitive_disable[0x1];
 	u8         log_max_stride_sz_sq[0x5];
 	u8         reserved_at_3b8[0x3];
 	u8         log_min_stride_sz_sq[0x5];

gemini-3.1-pro-preview

null

null

							input: 3043
							output: 34
							thoughts: 301
						

**Analyzing a Mellanox Infiniband Patch**

Okay, so I'm looking at this patch and it's touching `drivers/infiniband/hw/mlx5/main.c`, `drivers/infiniband/hw/mlx5/qp.c`, and `include/linux/mlx5/mlx5_ifc.h`. Right away, I see they've added a check for `MLX5_CAP_GEN(dev->mdev, qp_latency_sensitive_disable)`. Basically, if the hardware has this capability enabled, it's skipping some allocation and deallocation of `dev->fp_bfreg` in `mlx5_ib_stage_bfrag_init` and `mlx5_ib_stage_bfrag_cleanup` and it doesn't set `latency_sensitive` in `create_kernel_qp`. This seems pretty straightforward so far – a hardware-specific optimization based on a device capability flag.

The key here is that this is for Mellanox ConnectX-4/5/6 devices, which are specific PCIe devices (mlx5). Knowing this, I'm thinking about virtualization. Drivers like this are *typically* unreachable in environments like GCE or QEMU unless there is a software emulator. Think like vhci for USB, mac80211_hwsim for wifi, or netdevsim for net, which allow those technologies to function without the corresponding physical hardware. So the question is: is there an emulator for mlx5? I'm pretty sure I haven't come across one, and if there were, it would be pretty common knowledge, given that it's a popular NIC.

Wait a second. I remember reading somewhere... Yes! Syzkaller doesn't fuzz mlx5 because it *requires* the actual hardware! That's a huge clue. Just to be completely sure, I'm going to double-check. I'll do a quick kernel search for "mlx5" and see if there are any obvious software-based emulation components. Let's see what turns up...

{
  "Expression": "mlx5",
  "PathPrefix": "drivers/infiniband/hw/mlx5/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 14236 lines.\nUse more precise expression if possible.\n\ndrivers/infiniband/hw/mlx5/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/infiniband/hw/mlx5/Makefile:2:obj-$(CONFIG_MLX5_INFINIBAND) += mlx5_ib.o\ndrivers/infiniband/hw/mlx5/Makefile-3-\ndrivers/infiniband/hw/mlx5/Makefile:4:mlx5_ib-y := ah.o \\\ndrivers/infiniband/hw/mlx5/Makefile-5-\t     cmd.o \\\n--\ndrivers/infiniband/hw/mlx5/Makefile-27-\ndrivers/infiniband/hw/mlx5/Makefile:28:mlx5_ib-$(CONFIG_INFINIBAND_ON_DEMAND_PAGING) += odp.o\ndrivers/infiniband/hw/mlx5/Makefile:29:mlx5_ib-$(CONFIG_MLX5_ESWITCH) += ib_rep.o\ndrivers/infiniband/hw/mlx5/Makefile:30:mlx5_ib-$(CONFIG_INFINIBAND_USER_ACCESS) += devx.o \\\ndrivers/infiniband/hw/mlx5/Makefile-31-\t\t\t\t\t    qos.o \\\ndrivers/infiniband/hw/mlx5/Makefile-32-\t\t\t\t\t    std_types.o\ndrivers/infiniband/hw/mlx5/Makefile:33:mlx5_ib-$(CONFIG_MLX5_MACSEC) += macsec.o\n--\ndrivers/infiniband/hw/mlx5/ah.c-32-\ndrivers/infiniband/hw/mlx5/ah.c:33:#include \"mlx5_ib.h\"\ndrivers/infiniband/hw/mlx5/ah.c-34-\ndrivers/infiniband/hw/mlx5/ah.c:35:static __be16 mlx5_ah_get_udp_sport(const struct mlx5_ib_dev *dev,\ndrivers/infiniband/hw/mlx5/ah.c-36-\t\t\t\t  const struct rdma_ah_attr *ah_attr)\n--\ndrivers/infiniband/hw/mlx5/ah.c-46-\telse\ndrivers/infiniband/hw/mlx5/ah.c:47:\t\tsport = mlx5_get_roce_udp_sport_min(dev,\ndrivers/infiniband/hw/mlx5/ah.c-48-\t\t\t\t\t\t    ah_attr-\u003egrh.sgid_attr);\n--\ndrivers/infiniband/hw/mlx5/ah.c-52-\ndrivers/infiniband/hw/mlx5/ah.c:53:static int create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah,\ndrivers/infiniband/hw/mlx5/ah.c-54-\t\t\t struct rdma_ah_init_attr *init_attr)\n--\ndrivers/infiniband/hw/mlx5/ah.c-70-\ndrivers/infiniband/hw/mlx5/ah.c:71:\trate_val = mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr));\ndrivers/infiniband/hw/mlx5/ah.c-72-\tif (rate_val \u003c 0)\n--\ndrivers/infiniband/hw/mlx5/ah.c-78-\t\t\tah-\u003exmit_port =\ndrivers/infiniband/hw/mlx5/ah.c:79:\t\t\t\tmlx5_lag_get_slave_port(dev-\u003emdev,\ndrivers/infiniband/hw/mlx5/ah.c-80-\t\t\t\t\t\t\tinit_attr-\u003exmit_slave);\n--\ndrivers/infiniband/hw/mlx5/ah.c-84-\t\t       sizeof(ah_attr-\u003eroce.dmac));\ndrivers/infiniband/hw/mlx5/ah.c:85:\t\tah-\u003eav.udp_sport = mlx5_ah_get_udp_sport(dev, ah_attr);\ndrivers/infiniband/hw/mlx5/ah.c-86-\t\tah-\u003eav.stat_rate_sl |= (rdma_ah_get_sl(ah_attr) \u0026 0x7) \u003c\u003c 1;\n--\ndrivers/infiniband/hw/mlx5/ah.c-98-\ndrivers/infiniband/hw/mlx5/ah.c:99:int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,\ndrivers/infiniband/hw/mlx5/ah.c-100-\t\t      struct ib_udata *udata)\n--\ndrivers/infiniband/hw/mlx5/ah.c-103-\tstruct rdma_ah_attr *ah_attr = init_attr-\u003eah_attr;\ndrivers/infiniband/hw/mlx5/ah.c:104:\tstruct mlx5_ib_ah *ah = to_mah(ibah);\ndrivers/infiniband/hw/mlx5/ah.c:105:\tstruct mlx5_ib_dev *dev = to_mdev(ibah-\u003edevice);\ndrivers/infiniband/hw/mlx5/ah.c-106-\tenum rdma_ah_attr_type ah_type = ah_attr-\u003etype;\n--\ndrivers/infiniband/hw/mlx5/ah.c-113-\t\tint err;\ndrivers/infiniband/hw/mlx5/ah.c:114:\t\tstruct mlx5_ib_create_ah_resp resp = {};\ndrivers/infiniband/hw/mlx5/ah.c-115-\t\tu32 min_resp_len =\ndrivers/infiniband/hw/mlx5/ah.c:116:\t\t\toffsetofend(struct mlx5_ib_create_ah_resp, dmac);\ndrivers/infiniband/hw/mlx5/ah.c-117-\n--\ndrivers/infiniband/hw/mlx5/ah.c-131-\ndrivers/infiniband/hw/mlx5/ah.c:132:int mlx5_ib_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr)\ndrivers/infiniband/hw/mlx5/ah.c-133-{\ndrivers/infiniband/hw/mlx5/ah.c:134:\tstruct mlx5_ib_ah *ah = to_mah(ibah);\ndrivers/infiniband/hw/mlx5/ah.c-135-\tu32 tmp;\n--\ndrivers/infiniband/hw/mlx5/cmd.c-7-\ndrivers/infiniband/hw/mlx5/cmd.c:8:int mlx5r_cmd_query_special_mkeys(struct mlx5_ib_dev *dev)\ndrivers/infiniband/hw/mlx5/cmd.c-9-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-24-\t\t MLX5_CMD_OP_QUERY_SPECIAL_CONTEXTS);\ndrivers/infiniband/hw/mlx5/cmd.c:25:\terr = mlx5_cmd_exec_inout(dev-\u003emdev, query_special_contexts, in, out);\ndrivers/infiniband/hw/mlx5/cmd.c-26-\tif (err)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-44-\ndrivers/infiniband/hw/mlx5/cmd.c:45:int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,\ndrivers/infiniband/hw/mlx5/cmd.c-46-\t\t\t       void *out)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-53-\ndrivers/infiniband/hw/mlx5/cmd.c:54:\treturn mlx5_cmd_exec_inout(dev, query_cong_params, in, out);\ndrivers/infiniband/hw/mlx5/cmd.c-55-}\ndrivers/infiniband/hw/mlx5/cmd.c-56-\ndrivers/infiniband/hw/mlx5/cmd.c:57:void mlx5_cmd_destroy_tir(struct mlx5_core_dev *dev, u32 tirn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-58-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-63-\tMLX5_SET(destroy_tir_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:64:\tmlx5_cmd_exec_in(dev, destroy_tir, in);\ndrivers/infiniband/hw/mlx5/cmd.c-65-}\ndrivers/infiniband/hw/mlx5/cmd.c-66-\ndrivers/infiniband/hw/mlx5/cmd.c:67:void mlx5_cmd_destroy_tis(struct mlx5_core_dev *dev, u32 tisn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-68-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-73-\tMLX5_SET(destroy_tis_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:74:\tmlx5_cmd_exec_in(dev, destroy_tis, in);\ndrivers/infiniband/hw/mlx5/cmd.c-75-}\ndrivers/infiniband/hw/mlx5/cmd.c-76-\ndrivers/infiniband/hw/mlx5/cmd.c:77:int mlx5_cmd_destroy_rqt(struct mlx5_core_dev *dev, u32 rqtn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-78-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-83-\tMLX5_SET(destroy_rqt_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:84:\treturn mlx5_cmd_exec_in(dev, destroy_rqt, in);\ndrivers/infiniband/hw/mlx5/cmd.c-85-}\ndrivers/infiniband/hw/mlx5/cmd.c-86-\ndrivers/infiniband/hw/mlx5/cmd.c:87:int mlx5_cmd_alloc_transport_domain(struct mlx5_core_dev *dev, u32 *tdn,\ndrivers/infiniband/hw/mlx5/cmd.c-88-\t\t\t\t    u16 uid)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-97-\ndrivers/infiniband/hw/mlx5/cmd.c:98:\terr = mlx5_cmd_exec_inout(dev, alloc_transport_domain, in, out);\ndrivers/infiniband/hw/mlx5/cmd.c-99-\tif (!err)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-105-\ndrivers/infiniband/hw/mlx5/cmd.c:106:void mlx5_cmd_dealloc_transport_domain(struct mlx5_core_dev *dev, u32 tdn,\ndrivers/infiniband/hw/mlx5/cmd.c-107-\t\t\t\t       u16 uid)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-114-\tMLX5_SET(dealloc_transport_domain_in, in, transport_domain, tdn);\ndrivers/infiniband/hw/mlx5/cmd.c:115:\tmlx5_cmd_exec_in(dev, dealloc_transport_domain, in);\ndrivers/infiniband/hw/mlx5/cmd.c-116-}\ndrivers/infiniband/hw/mlx5/cmd.c-117-\ndrivers/infiniband/hw/mlx5/cmd.c:118:int mlx5_cmd_dealloc_pd(struct mlx5_core_dev *dev, u32 pdn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-119-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-124-\tMLX5_SET(dealloc_pd_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:125:\treturn mlx5_cmd_exec_in(dev, dealloc_pd, in);\ndrivers/infiniband/hw/mlx5/cmd.c-126-}\ndrivers/infiniband/hw/mlx5/cmd.c-127-\ndrivers/infiniband/hw/mlx5/cmd.c:128:int mlx5_cmd_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid,\ndrivers/infiniband/hw/mlx5/cmd.c-129-\t\t\tu32 qpn, u16 uid)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-138-\tmemcpy(gid, mgid, sizeof(*mgid));\ndrivers/infiniband/hw/mlx5/cmd.c:139:\treturn mlx5_cmd_exec_in(dev, attach_to_mcg, in);\ndrivers/infiniband/hw/mlx5/cmd.c-140-}\ndrivers/infiniband/hw/mlx5/cmd.c-141-\ndrivers/infiniband/hw/mlx5/cmd.c:142:int mlx5_cmd_detach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid,\ndrivers/infiniband/hw/mlx5/cmd.c-143-\t\t\tu32 qpn, u16 uid)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-152-\tmemcpy(gid, mgid, sizeof(*mgid));\ndrivers/infiniband/hw/mlx5/cmd.c:153:\treturn mlx5_cmd_exec_in(dev, detach_from_mcg, in);\ndrivers/infiniband/hw/mlx5/cmd.c-154-}\ndrivers/infiniband/hw/mlx5/cmd.c-155-\ndrivers/infiniband/hw/mlx5/cmd.c:156:int mlx5_cmd_xrcd_alloc(struct mlx5_core_dev *dev, u32 *xrcdn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-157-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-163-\tMLX5_SET(alloc_xrcd_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:164:\terr = mlx5_cmd_exec_inout(dev, alloc_xrcd, in, out);\ndrivers/infiniband/hw/mlx5/cmd.c-165-\tif (!err)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-169-\ndrivers/infiniband/hw/mlx5/cmd.c:170:int mlx5_cmd_xrcd_dealloc(struct mlx5_core_dev *dev, u32 xrcdn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-171-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-176-\tMLX5_SET(dealloc_xrcd_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:177:\treturn mlx5_cmd_exec_in(dev, dealloc_xrcd, in);\ndrivers/infiniband/hw/mlx5/cmd.c-178-}\ndrivers/infiniband/hw/mlx5/cmd.c-179-\ndrivers/infiniband/hw/mlx5/cmd.c:180:int mlx5_cmd_mad_ifc(struct mlx5_ib_dev *dev, const void *inb, void *outb,\ndrivers/infiniband/hw/mlx5/cmd.c-181-\t\t     u16 opmod, u8 port)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-208-\ndrivers/infiniband/hw/mlx5/cmd.c:209:\terr = mlx5_cmd_exec_inout(dev-\u003emdev, mad_ifc, in, out);\ndrivers/infiniband/hw/mlx5/cmd.c-210-\tif (err)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-222-\ndrivers/infiniband/hw/mlx5/cmd.c:223:int mlx5_cmd_uar_alloc(struct mlx5_core_dev *dev, u32 *uarn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-224-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-230-\tMLX5_SET(alloc_uar_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:231:\terr = mlx5_cmd_exec_inout(dev, alloc_uar, in, out);\ndrivers/infiniband/hw/mlx5/cmd.c-232-\tif (err)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-238-\ndrivers/infiniband/hw/mlx5/cmd.c:239:int mlx5_cmd_uar_dealloc(struct mlx5_core_dev *dev, u32 uarn, u16 uid)\ndrivers/infiniband/hw/mlx5/cmd.c-240-{\n--\ndrivers/infiniband/hw/mlx5/cmd.c-245-\tMLX5_SET(dealloc_uar_in, in, uid, uid);\ndrivers/infiniband/hw/mlx5/cmd.c:246:\treturn mlx5_cmd_exec_in(dev, dealloc_uar, in);\ndrivers/infiniband/hw/mlx5/cmd.c-247-}\ndrivers/infiniband/hw/mlx5/cmd.c-248-\ndrivers/infiniband/hw/mlx5/cmd.c:249:int mlx5_cmd_query_vuid(struct mlx5_core_dev *dev, bool data_direct,\ndrivers/infiniband/hw/mlx5/cmd.c-250-\t\t\tchar *out_vuid)\n--\ndrivers/infiniband/hw/mlx5/cmd.c-260-\tMLX5_SET(query_vuid_in, in, data_direct, data_direct);\ndrivers/infiniband/hw/mlx5/cmd.c:261:\terr = mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));\ndrivers/infiniband/hw/mlx5/cmd.c-262-\tif (err)\n--\ndrivers/infiniband/hw/mlx5/cmd.h-35-\ndrivers/infiniband/hw/mlx5/cmd.h:36:#include \"mlx5_ib.h\"\ndrivers/infiniband/hw/mlx5/cmd.h-37-#include \u003clinux/kernel.h\u003e\ndrivers/infiniband/hw/mlx5/cmd.h:38:#include \u003clinux/mlx5/driver.h\u003e\ndrivers/infiniband/hw/mlx5/cmd.h-39-\ndrivers/infiniband/hw/mlx5/cmd.h:40:int mlx5r_cmd_query_special_mkeys(struct mlx5_ib_dev *dev);\ndrivers/infiniband/hw/mlx5/cmd.h:41:int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,\ndrivers/infiniband/hw/mlx5/cmd.h-42-\t\t\t       void *out);\ndrivers/infiniband/hw/mlx5/cmd.h:43:int mlx5_cmd_dealloc_pd(struct mlx5_core_dev *dev, u32 pdn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:44:void mlx5_cmd_destroy_tir(struct mlx5_core_dev *dev, u32 tirn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:45:void mlx5_cmd_destroy_tis(struct mlx5_core_dev *dev, u32 tisn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:46:int mlx5_cmd_destroy_rqt(struct mlx5_core_dev *dev, u32 rqtn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:47:int mlx5_cmd_alloc_transport_domain(struct mlx5_core_dev *dev, u32 *tdn,\ndrivers/infiniband/hw/mlx5/cmd.h-48-\t\t\t\t    u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:49:void mlx5_cmd_dealloc_transport_domain(struct mlx5_core_dev *dev, u32 tdn,\ndrivers/infiniband/hw/mlx5/cmd.h-50-\t\t\t\t       u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:51:int mlx5_cmd_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid,\ndrivers/infiniband/hw/mlx5/cmd.h-52-\t\t\tu32 qpn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:53:int mlx5_cmd_detach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid,\ndrivers/infiniband/hw/mlx5/cmd.h-54-\t\t\tu32 qpn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:55:int mlx5_cmd_xrcd_alloc(struct mlx5_core_dev *dev, u32 *xrcdn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:56:int mlx5_cmd_xrcd_dealloc(struct mlx5_core_dev *dev, u32 xrcdn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:57:int mlx5_cmd_mad_ifc(struct mlx5_ib_dev *dev, const void *inb, void *outb,\ndrivers/infiniband/hw/mlx5/cmd.h-58-\t\t     u16 opmod, u8 port);\ndrivers/infiniband/hw/mlx5/cmd.h:59:int mlx5_cmd_uar_alloc(struct mlx5_core_dev *dev, u32 *uarn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:60:int mlx5_cmd_uar_dealloc(struct mlx5_core_dev *dev, u32 uarn, u16 uid);\ndrivers/infiniband/hw/mlx5/cmd.h:61:int mlx5_cmd_query_vuid(struct mlx5_core_dev *dev, bool data_direct,\ndrivers/infiniband/hw/mlx5/cmd.h-62-\t\t\tchar *out_vuid);\n--\ndrivers/infiniband/hw/mlx5/cong.c-34-\ndrivers/infiniband/hw/mlx5/cong.c:35:#include \"mlx5_ib.h\"\ndrivers/infiniband/hw/mlx5/cong.c-36-#include \"cmd.h\"\ndrivers/infiniband/hw/mlx5/cong.c-37-\ndrivers/infiniband/hw/mlx5/cong.c:38:enum mlx5_ib_cong_node_type {\ndrivers/infiniband/hw/mlx5/cong.c-39-\tMLX5_IB_RROCE_ECN_RP = 1,\n--\ndrivers/infiniband/hw/mlx5/cong.c-43-\ndrivers/infiniband/hw/mlx5/cong.c:44:static const char * const mlx5_ib_dbg_cc_name[] = {\ndrivers/infiniband/hw/mlx5/cong.c-45-\t\"rp_clamp_tgt_rate\",\n--\ndrivers/infiniband/hw/mlx5/cong.c-91-\ndrivers/infiniband/hw/mlx5/cong.c:92:static enum mlx5_ib_cong_node_type\ndrivers/infiniband/hw/mlx5/cong.c:93:mlx5_ib_param_to_node(enum mlx5_ib_dbg_cc_types param_offset)\ndrivers/infiniband/hw/mlx5/cong.c-94-{\n--\ndrivers/infiniband/hw/mlx5/cong.c-103-\ndrivers/infiniband/hw/mlx5/cong.c:104:static u32 mlx5_get_cc_param_val(void *field, int offset)\ndrivers/infiniband/hw/mlx5/cong.c-105-{\n--\ndrivers/infiniband/hw/mlx5/cong.c-177-\ndrivers/infiniband/hw/mlx5/cong.c:178:static void mlx5_ib_set_cc_param_mask_val(void *field, int offset,\ndrivers/infiniband/hw/mlx5/cong.c-179-\t\t\t\t\t  u32 var, u32 *attr_mask)\n--\ndrivers/infiniband/hw/mlx5/cong.c-291-\ndrivers/infiniband/hw/mlx5/cong.c:292:static int mlx5_ib_get_cc_params(struct mlx5_ib_dev *dev, u32 port_num,\ndrivers/infiniband/hw/mlx5/cong.c-293-\t\t\t\t int offset, u32 *var)\n--\ndrivers/infiniband/hw/mlx5/cong.c-298-\tint err;\ndrivers/infiniband/hw/mlx5/cong.c:299:\tenum mlx5_ib_cong_node_type node;\ndrivers/infiniband/hw/mlx5/cong.c:300:\tstruct mlx5_core_dev *mdev;\ndrivers/infiniband/hw/mlx5/cong.c-301-\ndrivers/infiniband/hw/mlx5/cong.c-302-\t/* Takes a 1-based port number */\ndrivers/infiniband/hw/mlx5/cong.c:303:\tmdev = mlx5_ib_get_native_port_mdev(dev, port_num + 1, NULL);\ndrivers/infiniband/hw/mlx5/cong.c-304-\tif (!mdev)\n--\ndrivers/infiniband/hw/mlx5/cong.c-312-\ndrivers/infiniband/hw/mlx5/cong.c:313:\tnode = mlx5_ib_param_to_node(offset);\ndrivers/infiniband/hw/mlx5/cong.c-314-\ndrivers/infiniband/hw/mlx5/cong.c:315:\terr = mlx5_cmd_query_cong_params(mdev, node, out);\ndrivers/infiniband/hw/mlx5/cong.c-316-\tif (err)\n--\ndrivers/infiniband/hw/mlx5/cong.c-319-\tfield = MLX5_ADDR_OF(query_cong_params_out, out, congestion_parameters);\ndrivers/infiniband/hw/mlx5/cong.c:320:\t*var = mlx5_get_cc_param_val(field, offset);\ndrivers/infiniband/hw/mlx5/cong.c-321-\n--\ndrivers/infiniband/hw/mlx5/cong.c-324-alloc_err:\ndrivers/infiniband/hw/mlx5/cong.c:325:\tmlx5_ib_put_native_port_mdev(dev, port_num + 1);\ndrivers/infiniband/hw/mlx5/cong.c-326-\treturn err;\n--\ndrivers/infiniband/hw/mlx5/cong.c-328-\ndrivers/infiniband/hw/mlx5/cong.c:329:static int mlx5_ib_set_cc_params(struct mlx5_ib_dev *dev, u32 port_num,\ndrivers/infiniband/hw/mlx5/cong.c-330-\t\t\t\t int offset, u32 var)\n--\ndrivers/infiniband/hw/mlx5/cong.c-334-\tvoid *field;\ndrivers/infiniband/hw/mlx5/cong.c:335:\tenum mlx5_ib_cong_node_type node;\ndrivers/infiniband/hw/mlx5/cong.c:336:\tstruct mlx5_core_dev *mdev;\ndrivers/infiniband/hw/mlx5/cong.c-337-\tu32 attr_mask = 0;\n--\ndrivers/infiniband/hw/mlx5/cong.c-340-\t/* Takes a 1-based port number */\ndrivers/infiniband/hw/mlx5/cong.c:341:\tmdev = mlx5_ib_get_native_port_mdev(dev, port_num + 1, NULL);\ndrivers/infiniband/hw/mlx5/cong.c-342-\tif (!mdev)\n--\ndrivers/infiniband/hw/mlx5/cong.c-353-\ndrivers/infiniband/hw/mlx5/cong.c:354:\tnode = mlx5_ib_param_to_node(offset);\ndrivers/infiniband/hw/mlx5/cong.c-355-\tMLX5_SET(modify_cong_params_in, in, cong_protocol, node);\n--\ndrivers/infiniband/hw/mlx5/cong.c-357-\tfield = MLX5_ADDR_OF(modify_cong_params_in, in, congestion_parameters);\ndrivers/infiniband/hw/mlx5/cong.c:358:\tmlx5_ib_set_cc_param_mask_val(field, offset, var, \u0026attr_mask);\ndrivers/infiniband/hw/mlx5/cong.c-359-\n--\ndrivers/infiniband/hw/mlx5/cong.c-363-\ndrivers/infiniband/hw/mlx5/cong.c:364:\terr = mlx5_cmd_exec_in(dev-\u003emdev, modify_cong_params, in);\ndrivers/infiniband/hw/mlx5/cong.c-365-\tkvfree(in);\ndrivers/infiniband/hw/mlx5/cong.c-366-alloc_err:\ndrivers/infiniband/hw/mlx5/cong.c:367:\tmlx5_ib_put_native_port_mdev(dev, port_num + 1);\ndrivers/infiniband/hw/mlx5/cong.c-368-\treturn err;\n--\ndrivers/infiniband/hw/mlx5/cong.c=371=static ssize_t set_param(struct file *filp, const char __user *buf,\n--\ndrivers/infiniband/hw/mlx5/cong.c-373-{\ndrivers/infiniband/hw/mlx5/cong.c:374:\tstruct mlx5_ib_dbg_param *param = filp-\u003eprivate_data;\ndrivers/infiniband/hw/mlx5/cong.c-375-\tint offset = param-\u003eoffset;\n--\ndrivers/infiniband/hw/mlx5/cong.c-390-\ndrivers/infiniband/hw/mlx5/cong.c:391:\tret = mlx5_ib_set_cc_params(param-\u003edev, param-\u003eport_num, offset, var);\ndrivers/infiniband/hw/mlx5/cong.c-392-\treturn ret ? ret : count;\n--\ndrivers/infiniband/hw/mlx5/cong.c=395=static ssize_t get_param(struct file *filp, char __user *buf, size_t count,\n--\ndrivers/infiniband/hw/mlx5/cong.c-397-{\ndrivers/infiniband/hw/mlx5/cong.c:398:\tstruct mlx5_ib_dbg_param *param = filp-\u003eprivate_data;\ndrivers/infiniband/hw/mlx5/cong.c-399-\tint offset = param-\u003eoffset;\n--\ndrivers/infiniband/hw/mlx5/cong.c-403-\ndrivers/infiniband/hw/mlx5/cong.c:404:\tret = mlx5_ib_get_cc_params(param-\u003edev, param-\u003eport_num, offset, \u0026var);\ndrivers/infiniband/hw/mlx5/cong.c-405-\tif (ret)\n--\ndrivers/infiniband/hw/mlx5/cong.c=415=static const struct file_operations dbg_cc_fops = {\n--\ndrivers/infiniband/hw/mlx5/cong.c-421-\ndrivers/infiniband/hw/mlx5/cong.c:422:void mlx5_ib_cleanup_cong_debugfs(struct mlx5_ib_dev *dev, u32 port_num)\ndrivers/infiniband/hw/mlx5/cong.c-423-{\ndrivers/infiniband/hw/mlx5/cong.c:424:\tif (!mlx5_debugfs_root ||\ndrivers/infiniband/hw/mlx5/cong.c-425-\t    !dev-\u003eport[port_num].dbg_cc_params ||\n--\ndrivers/infiniband/hw/mlx5/cong.c-433-\ndrivers/infiniband/hw/mlx5/cong.c:434:void mlx5_ib_init_cong_debugfs(struct mlx5_ib_dev *dev, u32 port_num)\ndrivers/infiniband/hw/mlx5/cong.c-435-{\ndrivers/infiniband/hw/mlx5/cong.c:436:\tstruct mlx5_ib_dbg_cc_params *dbg_cc_params;\ndrivers/infiniband/hw/mlx5/cong.c:437:\tstruct mlx5_core_dev *mdev;\ndrivers/infiniband/hw/mlx5/cong.c-438-\tint i;\ndrivers/infiniband/hw/mlx5/cong.c-439-\ndrivers/infiniband/hw/mlx5/cong.c:440:\tif (!mlx5_debugfs_root)\ndrivers/infiniband/hw/mlx5/cong.c-441-\t\treturn;\n--\ndrivers/infiniband/hw/mlx5/cong.c-443-\t/* Takes a 1-based port number */\ndrivers/infiniband/hw/mlx5/cong.c:444:\tmdev = mlx5_ib_get_native_port_mdev(dev, port_num + 1, NULL);\ndrivers/infiniband/hw/mlx5/cong.c-445-\tif (!mdev)\n--\ndrivers/infiniband/hw/mlx5/cong.c-457-\ndrivers/infiniband/hw/mlx5/cong.c:458:\tdbg_cc_params-\u003eroot = debugfs_create_dir(\"cc_params\", mlx5_debugfs_get_dev_root(mdev));\ndrivers/infiniband/hw/mlx5/cong.c-459-\n--\ndrivers/infiniband/hw/mlx5/cong.c-470-\t\tdbg_cc_params-\u003eparams[i].dentry =\ndrivers/infiniband/hw/mlx5/cong.c:471:\t\t\tdebugfs_create_file(mlx5_ib_dbg_cc_name[i],\ndrivers/infiniband/hw/mlx5/cong.c-472-\t\t\t\t\t    0600, dbg_cc_params-\u003eroot,\n--\ndrivers/infiniband/hw/mlx5/cong.c-477-put_mdev:\ndrivers/infiniband/hw/mlx5/cong.c:478:\tmlx5_ib_put_native_port_mdev(dev, port_num + 1);\ndrivers/infiniband/hw/mlx5/cong.c-479-\treturn;\n--\ndrivers/infiniband/hw/mlx5/cong.c-481-err:\ndrivers/infiniband/hw/mlx5/cong.c:482:\tmlx5_ib_warn(dev, \"cong debugfs failure\\n\");\ndrivers/infiniband/hw/mlx5/cong.c:483:\tmlx5_ib_cleanup_cong_debugfs(dev, port_num);\ndrivers/infiniband/hw/mlx5/cong.c:484:\tmlx5_ib_put_native_port_mdev(dev, port_num + 1);\ndrivers/infiniband/hw/mlx5/cong.c-485-\n--\ndrivers/infiniband/hw/mlx5/counters.c-5-\ndrivers/infiniband/hw/mlx5/counters.c:6:#include \"mlx5_ib.h\"\ndrivers/infiniband/hw/mlx5/counters.c:7:#include \u003clinux/mlx5/eswitch.h\u003e\ndrivers/infiniband/hw/mlx5/counters.c:8:#include \u003clinux/mlx5/vport.h\u003e\ndrivers/infiniband/hw/mlx5/counters.c-9-#include \"counters.h\"\n--\ndrivers/infiniband/hw/mlx5/counters.c-12-\ndrivers/infiniband/hw/mlx5/counters.c:13:struct mlx5_ib_counter {\ndrivers/infiniband/hw/mlx5/counters.c-14-\tconst char *name;\n--\ndrivers/infiniband/hw/mlx5/counters.c-18-\ndrivers/infiniband/hw/mlx5/counters.c:19:struct mlx5_rdma_counter {\ndrivers/infiniband/hw/mlx5/counters.c-20-\tstruct rdma_counter rdma_counter;\ndrivers/infiniband/hw/mlx5/counters.c-21-\ndrivers/infiniband/hw/mlx5/counters.c:22:\tstruct mlx5_fc *fc[MLX5_IB_OPCOUNTER_MAX];\ndrivers/infiniband/hw/mlx5/counters.c-23-\tstruct xarray qpn_opfc_xa;\n--\ndrivers/infiniband/hw/mlx5/counters.c-25-\ndrivers/infiniband/hw/mlx5/counters.c:26:static struct mlx5_rdma_counter *to_mcounter(struct rdma_counter *counter)\ndrivers/infiniband/hw/mlx5/counters.c-27-{\ndrivers/infiniband/hw/mlx5/counters.c:28:\treturn container_of(counter, struct mlx5_rdma_counter, rdma_counter);\ndrivers/infiniband/hw/mlx5/counters.c-29-}\n--\ndrivers/infiniband/hw/mlx5/counters.c-37-\ndrivers/infiniband/hw/mlx5/counters.c:38:static const struct mlx5_ib_counter basic_q_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-39-\tINIT_Q_COUNTER(rx_write_requests),\n--\ndrivers/infiniband/hw/mlx5/counters.c-45-\ndrivers/infiniband/hw/mlx5/counters.c:46:static const struct mlx5_ib_counter out_of_seq_q_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-47-\tINIT_Q_COUNTER(out_of_sequence),\n--\ndrivers/infiniband/hw/mlx5/counters.c-49-\ndrivers/infiniband/hw/mlx5/counters.c:50:static const struct mlx5_ib_counter retrans_q_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-51-\tINIT_Q_COUNTER(duplicate_request),\n--\ndrivers/infiniband/hw/mlx5/counters.c-57-\ndrivers/infiniband/hw/mlx5/counters.c:58:static const struct mlx5_ib_counter vport_basic_q_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-59-\tINIT_VPORT_Q_COUNTER(rx_write_requests),\n--\ndrivers/infiniband/hw/mlx5/counters.c-65-\ndrivers/infiniband/hw/mlx5/counters.c:66:static const struct mlx5_ib_counter vport_out_of_seq_q_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-67-\tINIT_VPORT_Q_COUNTER(out_of_sequence),\n--\ndrivers/infiniband/hw/mlx5/counters.c-69-\ndrivers/infiniband/hw/mlx5/counters.c:70:static const struct mlx5_ib_counter vport_retrans_q_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-71-\tINIT_VPORT_Q_COUNTER(duplicate_request),\n--\ndrivers/infiniband/hw/mlx5/counters.c-81-\ndrivers/infiniband/hw/mlx5/counters.c:82:static const struct mlx5_ib_counter cong_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-83-\tINIT_CONG_COUNTER(rp_cnp_ignored),\n--\ndrivers/infiniband/hw/mlx5/counters.c-88-\ndrivers/infiniband/hw/mlx5/counters.c:89:static const struct mlx5_ib_counter extended_err_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-90-\tINIT_Q_COUNTER(resp_local_length_error),\n--\ndrivers/infiniband/hw/mlx5/counters.c-101-\ndrivers/infiniband/hw/mlx5/counters.c:102:static const struct mlx5_ib_counter roce_accl_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-103-\tINIT_Q_COUNTER(roce_adp_retrans),\n--\ndrivers/infiniband/hw/mlx5/counters.c-109-\ndrivers/infiniband/hw/mlx5/counters.c:110:static const struct mlx5_ib_counter vport_extended_err_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-111-\tINIT_VPORT_Q_COUNTER(resp_local_length_error),\n--\ndrivers/infiniband/hw/mlx5/counters.c-122-\ndrivers/infiniband/hw/mlx5/counters.c:123:static const struct mlx5_ib_counter vport_roce_accl_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-124-\tINIT_VPORT_Q_COUNTER(roce_adp_retrans),\n--\ndrivers/infiniband/hw/mlx5/counters.c-135-\ndrivers/infiniband/hw/mlx5/counters.c:136:static const struct mlx5_ib_counter ext_ppcnt_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-137-\tINIT_EXT_PPCNT_COUNTER(rx_icrc_encapsulated),\n--\ndrivers/infiniband/hw/mlx5/counters.c-142-\ndrivers/infiniband/hw/mlx5/counters.c:143:static const struct mlx5_ib_counter basic_op_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-144-\tINIT_OP_COUNTER(cc_rx_ce_pkts, CC_RX_CE_PKTS),\n--\ndrivers/infiniband/hw/mlx5/counters.c-146-\ndrivers/infiniband/hw/mlx5/counters.c:147:static const struct mlx5_ib_counter rdmarx_cnp_op_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-148-\tINIT_OP_COUNTER(cc_rx_cnp_pkts, CC_RX_CNP_PKTS),\n--\ndrivers/infiniband/hw/mlx5/counters.c-150-\ndrivers/infiniband/hw/mlx5/counters.c:151:static const struct mlx5_ib_counter rdmatx_cnp_op_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-152-\tINIT_OP_COUNTER(cc_tx_cnp_pkts, CC_TX_CNP_PKTS),\n--\ndrivers/infiniband/hw/mlx5/counters.c-154-\ndrivers/infiniband/hw/mlx5/counters.c:155:static const struct mlx5_ib_counter packets_op_cnts[] = {\ndrivers/infiniband/hw/mlx5/counters.c-156-\tINIT_OP_COUNTER(rdma_tx_packets, RDMA_TX_PACKETS),\n--\ndrivers/infiniband/hw/mlx5/counters.c-161-\ndrivers/infiniband/hw/mlx5/counters.c:162:static int mlx5_ib_read_counters(struct ib_counters *counters,\ndrivers/infiniband/hw/mlx5/counters.c-163-\t\t\t\t struct ib_counters_read_attr *read_attr,\n--\ndrivers/infiniband/hw/mlx5/counters.c-165-{\ndrivers/infiniband/hw/mlx5/counters.c:166:\tstruct mlx5_ib_mcounters *mcounters = to_mcounters(counters);\ndrivers/infiniband/hw/mlx5/counters.c:167:\tstruct mlx5_read_counters_attr mread_attr = {};\ndrivers/infiniband/hw/mlx5/counters.c:168:\tstruct mlx5_ib_flow_counters_desc *desc;\ndrivers/infiniband/hw/mlx5/counters.c-169-\tint ret, i;\n--\ndrivers/infiniband/hw/mlx5/counters.c-203-\ndrivers/infiniband/hw/mlx5/counters.c:204:static int mlx5_ib_destroy_counters(struct ib_counters *counters)\ndrivers/infiniband/hw/mlx5/counters.c-205-{\ndrivers/infiniband/hw/mlx5/counters.c:206:\tstruct mlx5_ib_mcounters *mcounters = to_mcounters(counters);\ndrivers/infiniband/hw/mlx5/counters.c-207-\ndrivers/infiniband/hw/mlx5/counters.c:208:\tmlx5_ib_counters_clear_description(counters);\ndrivers/infiniband/hw/mlx5/counters.c-209-\tif (mcounters-\u003ehw_cntrs_hndl)\ndrivers/infiniband/hw/mlx5/counters.c:210:\t\tmlx5_fc_destroy(to_mdev(counters-\u003edevice)-\u003emdev,\ndrivers/infiniband/hw/mlx5/counters.c-211-\t\t\t\tmcounters-\u003ehw_cntrs_hndl);\n--\ndrivers/infiniband/hw/mlx5/counters.c-214-\ndrivers/infiniband/hw/mlx5/counters.c:215:static int mlx5_ib_create_counters(struct ib_counters *counters,\ndrivers/infiniband/hw/mlx5/counters.c-216-\t\t\t\t   struct uverbs_attr_bundle *attrs)\ndrivers/infiniband/hw/mlx5/counters.c-217-{\ndrivers/infiniband/hw/mlx5/counters.c:218:\tstruct mlx5_ib_mcounters *mcounters = to_mcounters(counters);\ndrivers/infiniband/hw/mlx5/counters.c-219-\n--\ndrivers/infiniband/hw/mlx5/counters.c-223-\ndrivers/infiniband/hw/mlx5/counters.c:224:static bool vport_qcounters_supported(struct mlx5_ib_dev *dev)\ndrivers/infiniband/hw/mlx5/counters.c-225-{\n--\ndrivers/infiniband/hw/mlx5/counters.c-229-\ndrivers/infiniband/hw/mlx5/counters.c:230:static const struct mlx5_ib_counters *get_counters(struct mlx5_ib_dev *dev,\ndrivers/infiniband/hw/mlx5/counters.c-231-\t\t\t\t\t\t   u32 port_num)\n--\ndrivers/infiniband/hw/mlx5/counters.c-241-/**\ndrivers/infiniband/hw/mlx5/counters.c:242: * mlx5_ib_get_counters_id - Returns counters id to use for device+port\ndrivers/infiniband/hw/mlx5/counters.c:243: * @dev:\tPointer to mlx5 IB device\ndrivers/infiniband/hw/mlx5/counters.c-244- * @port_num:\tZero based port number\ndrivers/infiniband/hw/mlx5/counters.c-245- *\ndrivers/infiniband/hw/mlx5/counters.c:246: * mlx5_ib_get_counters_id() Returns counters set id to use for given\ndrivers/infiniband/hw/mlx5/counters.c-247- * device port combination in switchdev and non switchdev mode of the\n--\ndrivers/infiniband/hw/mlx5/counters.c-249- */\ndrivers/infiniband/hw/mlx5/counters.c:250:u16 mlx5_ib_get_counters_id(struct mlx5_ib_dev *dev, u32 port_num)\ndrivers/infiniband/hw/mlx5/counters.c-251-{\ndrivers/infiniband/hw/mlx5/counters.c:252:\tconst struct mlx5_ib_counters *cnts = get_counters(dev, port_num + 1);\ndrivers/infiniband/hw/mlx5/counters.c-253-\n--\ndrivers/infiniband/hw/mlx5/counters.c-256-\ndrivers/infiniband/hw/mlx5/counters.c:257:static struct rdma_hw_stats *do_alloc_stats(const struct mlx5_ib_counters *cnts)\ndrivers/infiniband/hw/mlx5/counters.c-258-{\n--\ndrivers/infiniband/hw/mlx5/counters.c=278=static struct rdma_hw_stats *\ndrivers/infiniband/hw/mlx5/counters.c:279:mlx5_ib_alloc_hw_device_stats(struct ib_device *ibdev)\ndrivers/infiniband/hw/mlx5/counters.c-280-{\ndrivers/infiniband/hw/mlx5/counters.c:281:\tstruct mlx5_ib_dev *dev = to_mdev(ibdev);\ndrivers/infiniband/hw/mlx5/counters.c:282:\tconst struct mlx5_ib_counters *cnts = \u0026dev-\u003eport[0].cnts;\ndrivers/infiniband/hw/mlx5/counters.c-283-\n--\ndrivers/infiniband/hw/mlx5/counters.c=287=static struct rdma_hw_stats *\ndrivers/infiniband/hw/mlx5/counters.c:288:mlx5_ib_alloc_hw_port_stats(struct ib_device *ibdev, u32 port_num)\ndrivers/infiniband/hw/mlx5/counters.c-289-{\ndrivers/infiniband/hw/mlx5/counters.c:290:\tstruct mlx5_ib_dev *dev = to_mdev(ibdev);\ndrivers/infiniband/hw/mlx5/counters.c:291:\tconst struct mlx5_ib_counters *cnts = get_counters(dev, port_num);\ndrivers/infiniband/hw/mlx5/counters.c-292-\n--\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 17550
							output: 24
							thoughts: 134
						

**Analyzing the Syzkaller Interaction with mlx5**

Okay, first things first. My initial thought is that `mlx5` is a hardware driver. That's a key piece of information. However, I know syzkaller *does* fuzz some hardware drivers, particularly if they are accessible via `netlink` or if there's a virtual device involved. Hmm, interesting.

Then I see the `syz-cluster` author tag. That tells me this patch *was* tested by syzkaller. Alright, that’s a pretty good indicator.

Now I need to remember that syzkaller isn't going to spend resources fuzzing `mlx5` unless it can actually *reach* it. It's not going to just randomly trigger code unless it's possible.

Okay, let's keep going. I'm seeing references to `mlx5_vdpa` and `mlx5_core`. So, it’s not just one monolith. This opens the door to potential interaction points.

The big question now is this: how can we *trigger* `mlx5` code through syzkaller? That's what I really need to understand.

Let's check if syzkaller has any specific descriptions or definitions for `mlx5`. That's the obvious next step – are there any defined syscalls, structures, or configurations related to `mlx5` within the syzkaller framework? That's where I need to start.

{
  "Expression": "mlx5",
  "PathPrefix": "net/"
}

{
  "Output": "net/smc/smc_ib.c=841=long smc_ib_setup_per_ibdev(struct smc_ib_device *smcibdev)\n--\nnet/smc/smc_ib.c-851-\t\tgoto out;\nnet/smc/smc_ib.c:852:\t/* the calculated number of cq entries fits to mlx5 cq allocation */\nnet/smc/smc_ib.c-853-\tcqe_size_order = cache_line_size() == 128 ? 7 : 6;\n"
}

gemini-3.1-pro-preview

null

null

							input: 18173
							output: 38
							thoughts: 155
						

**Analyzing the Impact of the Patch**

Okay, so syzkaller is potentially targeting the Infiniband subsystem, maybe through `rdma_rxe` (software RoCE) or `siw` (software iWARP). But this patch is touching `drivers/infiniband/hw/mlx5/main.c` and `drivers/infiniband/hw/mlx5/qp.c`. That's the mlx5 hardware driver, specifically. The crucial question is, can `rdma_rxe` or `siw` even *reach* those mlx5 hardware files? No, they're distinct drivers, handling different aspects of the Infiniband stack. So, there has to be an unusual way for syzkaller to reach these hardware drivers.

That then brings us to the question of if there is some kind of software emulation of mlx5 in the kernel. Could there be a software layer that *pretends* to be mlx5, and this is where the bug is? I'll need to check if there is an mlx5 emulator, as that might provide the link I'm looking for.

{
  "Expression": "mlx5",
  "PathPrefix": "drivers/net/ethernet/mellanox/mlx5/core/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 99056 lines.\nUse more precise expression if possible.\n\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=19=config MLX5_FPGA\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-25-\t  and an FPGA chip on one board. If you select this option, the\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:26:\t  mlx5_core driver will include the Innova FPGA core and allow building\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-27-\t  sandbox-specific client drivers.\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=77=config MLX5_BRIDGE\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-81-\thelp\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:82:\t  mlx5 ConnectX offloads support for Ethernet Bridging (BRIDGE).\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-83-\t  Enable offloading FDB rules from a bridge device containing\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:84:\t  representors of mlx5 uplink and VF ports. Supports VLANs (trunk and\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-85-\t  access modes).\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=87=config MLX5_CLS_ACT\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-91-\thelp\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:92:\t  mlx5 ConnectX offloads support for TC classifier action (NET_CLS_ACT),\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-93-\t  works in both native NIC mode and Switchdev SRIOV mode.\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=210=config MLX5_EN_PSP\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-215-\thelp\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:216:\t  mlx5 device offload support for Google PSP Security Protocol offload.\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-217-\t  Adds support for PSP encryption offload and for SPI and key generation\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile=7=subdir-ccflags-y += -I$(src)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-8-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:9:obj-$(CONFIG_MLX5_CORE) += mlx5_core.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-10-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-11-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:12:# mlx5 core basic\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-13-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:14:mlx5_core-y :=\tmain.o cmd.o debugfs.o fw.o eq.o uar.o pagealloc.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-15-\t\thealth.o mcg.o cq.o alloc.o port.o mr.o pd.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-25-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:26:mlx5_core-$(CONFIG_MLX5_CORE_EN) += en/rqt.o en/tir.o en/rss.o en/rx_res.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-27-\t\ten/channels.o en_main.o en_common.o en_fs.o en_ethtool.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-37-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:38:mlx5_core-$(CONFIG_MLX5_EN_ARFS)     += en_arfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:39:mlx5_core-$(CONFIG_MLX5_EN_RXNFC)    += en_fs_ethtool.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:40:mlx5_core-$(CONFIG_MLX5_CORE_EN_DCB) += en_dcbnl.o en/port_buffer.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:41:mlx5_core-$(CONFIG_PCI_HYPERV_INTERFACE) += en/hv_vhca_stats.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:42:mlx5_core-$(CONFIG_MLX5_ESWITCH)     += lag/mp.o lag/port_sel.o lib/geneve.o lib/port_tun.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-43-\t\t\t\t\ten_rep.o en/rep/bond.o en/mod_hdr.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-44-\t\t\t\t\ten/mapping.o lag/mpesw.o lag/shared_fdb.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:45:mlx5_core-$(CONFIG_MLX5_CLS_ACT)     += en_tc.o en/rep/tc.o en/rep/neigh.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-46-\t\t\t\t\tlib/fs_chains.o en/tc_tun.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-52-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:53:mlx5_core-$(CONFIG_MLX5_CLS_ACT)     += en/tc/act/act.o en/tc/act/drop.o en/tc/act/trap.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-54-\t\t\t\t\ten/tc/act/accept.o en/tc/act/mark.o en/tc/act/goto.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile=61=ifneq ($(CONFIG_MLX5_TC_CT),)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:62:\tmlx5_core-y\t\t\t     += en/tc_ct.o en/tc/ct_fs_dmfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:63:\tmlx5_core-$(CONFIG_MLX5_SW_STEERING) += en/tc/ct_fs_smfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:64:\tmlx5_core-$(CONFIG_MLX5_HW_STEERING) += en/tc/ct_fs_hmfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-65-endif\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-66-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:67:mlx5_core-$(CONFIG_MLX5_TC_SAMPLE)   += en/tc/sample.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-68-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-71-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:72:mlx5_core-$(CONFIG_MLX5_ESWITCH)   += eswitch.o eswitch_offloads.o eswitch_offloads_termtbl.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-73-\t\t\t\t      ecpf.o rdma.o esw/legacy.o esw/adj_vport.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-75-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:76:mlx5_core-$(CONFIG_MLX5_ESWITCH)   += esw/acl/helper.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-77-\t\t\t\t      esw/acl/egress_lgcy.o esw/acl/egress_ofld.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile=80=ifneq ($(CONFIG_MLX5_EN_IPSEC),)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:81:\tmlx5_core-$(CONFIG_MLX5_ESWITCH)   += esw/ipsec_fs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-82-endif\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-83-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:84:mlx5_core-$(CONFIG_MLX5_BRIDGE)    += esw/bridge.o esw/bridge_mcast.o esw/bridge_debugfs.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-85-\t\t\t\t      en/rep/bridge.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-86-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:87:mlx5_core-$(CONFIG_HWMON)          += hwmon.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:88:mlx5_core-$(CONFIG_MLX5_MPFS)      += lib/mpfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-89-ifneq ($(CONFIG_VXLAN),)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:90:\tmlx5_core-y\t\t   += lib/vxlan.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-91-endif\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:92:mlx5_core-$(CONFIG_PTP_1588_CLOCK) += lib/clock.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:93:mlx5_core-$(CONFIG_PCI_HYPERV_INTERFACE) += lib/hv.o lib/hv_vhca.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-94-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-97-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:98:mlx5_core-$(CONFIG_MLX5_CORE_IPOIB) += ipoib/ipoib.o ipoib/ethtool.o ipoib/ipoib_vlan.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-99-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-102-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:103:mlx5_core-$(CONFIG_MLX5_FPGA) += fpga/cmd.o fpga/core.o fpga/conn.o fpga/sdk.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-104-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:105:mlx5_core-$(CONFIG_MLX5_MACSEC) += en_accel/macsec.o lib/macsec_fs.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-106-\t\t\t\t      en_accel/macsec_stats.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-107-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:108:mlx5_core-$(CONFIG_MLX5_EN_IPSEC) += en_accel/ipsec.o en_accel/ipsec_rxtx.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-109-\t\t\t\t     en_accel/ipsec_stats.o en_accel/ipsec_fs.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-111-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:112:mlx5_core-$(CONFIG_MLX5_EN_TLS) += en_accel/ktls_stats.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-113-\t\t\t\t   en_accel/fs_tcp.o en_accel/ktls.o en_accel/ktls_txrx.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-115-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:116:mlx5_core-$(CONFIG_MLX5_EN_PSP) += en_accel/psp.o en_accel/psp_rxtx.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-117-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-120-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:121:mlx5_core-$(CONFIG_MLX5_SW_STEERING) += steering/sws/dr_domain.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-122-\t\t\t\t\tsteering/sws/dr_table.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-145-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:146:mlx5_core-$(CONFIG_MLX5_HW_STEERING) += steering/hws/cmd.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-147-\t\t\t\t\tsteering/hws/context.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-167-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:168:mlx5_core-$(CONFIG_MLX5_SF) += sf/vhca_event.o sf/dev/dev.o sf/dev/driver.o irq_affinity.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-169-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-172-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:173:mlx5_core-$(CONFIG_MLX5_SF_MANAGER) += sf/cmd.o sf/hw_table.o sf/devlink.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-174-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-177-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:178:mlx5_core-$(CONFIG_PCIE_TPH) += lib/st.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-179-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:180:obj-$(CONFIG_MLX5_DPLL) += mlx5_dpll.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:181:mlx5_dpll-y :=\tdpll.o\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-42-#include \u003clinux/seq_file.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:43:#include \u003clinux/mlx5/driver.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-44-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:45:#include \"mlx5_core.h\"\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-46-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-50-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:51:struct mlx5_db_pgdir {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-52-\tstruct list_head\tlist;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-57-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:58:struct mlx5_dma_pool {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-59-\t/* Protects page_list and per-page allocation bitmaps. */\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-61-\tstruct list_head page_list;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:62:\tstruct mlx5_core_dev *dev;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-63-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-66-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:67:struct mlx5_dma_pool_page {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:68:\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-69-\tstruct list_head pool_link;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-74-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:75:struct mlx5_frag_buf_node_pools {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:76:\tstruct mlx5_dma_pool *pools[MLX5_FRAG_BUF_POOLS_NUM];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-77-};\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-78-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:79:struct mlx5_dma_pool_stats {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-80-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-89-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:90:static void *mlx5_dma_zalloc_coherent_node(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-91-\t\t\t\t\t   size_t size, dma_addr_t *dma_handle,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-93-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:94:\tstruct device *device = mlx5_core_dma_dev(dev);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:95:\tstruct mlx5_priv *priv = \u0026dev-\u003epriv;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-96-\tint original_node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-108-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:109:static void mlx5_dma_pool_destroy(struct mlx5_dma_pool *pool)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-110-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-114-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:115:static struct mlx5_dma_pool *mlx5_dma_pool_create(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-116-\t\t\t\t\t\t  int node, u8 block_shift)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-117-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:118:\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-119-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-131-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:132:static struct mlx5_dma_pool_page *\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:133:mlx5_dma_pool_page_alloc(struct mlx5_dma_pool *pool)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-134-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-135-\tint blocks_per_page = BIT(PAGE_SHIFT - pool-\u003eblock_shift);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:136:\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-137-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-147-\tbitmap_fill(page-\u003ebitmap, blocks_per_page);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:148:\tpage-\u003ebuf = mlx5_dma_zalloc_coherent_node(pool-\u003edev, PAGE_SIZE,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-149-\t\t\t\t\t\t  \u0026page-\u003edma, pool-\u003enode);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-162-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:163:static void mlx5_dma_pool_page_free(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:164:\t\t\t\t    struct mlx5_dma_pool_page *page)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-165-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:166:\tdma_free_coherent(mlx5_core_dma_dev(dev), PAGE_SIZE, page-\u003ebuf,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-167-\t\t\t  page-\u003edma);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-171-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:172:static int mlx5_dma_pool_alloc_from_page(struct mlx5_dma_pool *pool,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:173:\t\t\t\t\t struct mlx5_dma_pool_page *page,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-174-\t\t\t\t\t unsigned long *idx_out)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-189-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:190:static struct mlx5_dma_pool_page *\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:191:mlx5_dma_pool_alloc(struct mlx5_dma_pool *pool, unsigned long *idx_out)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-192-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:193:\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-194-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-197-\tpage = list_first_entry_or_null(\u0026pool-\u003epage_list,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:198:\t\t\t\t\tstruct mlx5_dma_pool_page, pool_link);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:199:\tif (page \u0026\u0026 !mlx5_dma_pool_alloc_from_page(pool, page, idx_out))\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-200-\t\tgoto unlock; /* successfully allocated from existing page */\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-201-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:202:\tpage = mlx5_dma_pool_page_alloc(pool);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-203-\tif (!page)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-206-\tlist_add(\u0026page-\u003epool_link, \u0026pool-\u003epage_list);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:207:\tmlx5_dma_pool_alloc_from_page(pool, page, idx_out);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-208-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-213-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:214:static void mlx5_dma_pool_free(struct mlx5_dma_pool *pool,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:215:\t\t\t       struct mlx5_dma_pool_page *page,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-216-\t\t\t       unsigned long idx)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-226-\t\tlist_del(\u0026page-\u003epool_link);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:227:\t\tmlx5_dma_pool_page_free(pool-\u003edev, page);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-228-\t} else {\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-236-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:237:static void mlx5_dma_pool_debugfs_get_stats(struct mlx5_dma_pool *pool,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:238:\t\t\t\t\t    struct mlx5_dma_pool_stats *stats)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-239-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-240-\tint blocks_per_page = BIT(PAGE_SHIFT - pool-\u003eblock_shift);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:241:\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-242-\tsize_t free_blocks = 0;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-257-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:258:static void mlx5_dma_pool_debugfs_stats_print(struct seq_file *file,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:259:\t\t\t\t\t      struct mlx5_dma_pool *pool)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-260-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:261:\tstruct mlx5_dma_pool_stats stats = {};\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-262-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:263:\tmlx5_dma_pool_debugfs_get_stats(pool, \u0026stats);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-264-\tseq_printf(file, \"%4d       %5zu      %7zu           %7zu\\n\",\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-268-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:269:static void mlx5_dma_pools_debugfs_print_header(struct seq_file *file)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-270-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c=274=static void\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:275:mlx5_frag_buf_node_pools_destroy(struct mlx5_frag_buf_node_pools *node_pools)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-276-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-278-\t\tif (node_pools-\u003epools[i])\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:279:\t\t\tmlx5_dma_pool_destroy(node_pools-\u003epools[i]);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-280-\tkfree(node_pools);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-282-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:283:static struct mlx5_frag_buf_node_pools *\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:284:mlx5_frag_buf_node_pools_create(struct mlx5_core_dev *dev, int node)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-285-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:286:\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-287-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-294-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:295:\t\tnode_pools-\u003epools[i] = mlx5_dma_pool_create(dev, node,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-296-\t\t\t\t\t\t\t    block_shift);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-297-\t\tif (!node_pools-\u003epools[i]) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:298:\t\t\tmlx5_frag_buf_node_pools_destroy(node_pools);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-299-\t\t\treturn NULL;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c=306=static int\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:307:mlx5_frag_buf_dma_pools_debugfs_show(struct seq_file *file, void *priv)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-308-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:309:\tstruct mlx5_core_dev *dev = file-\u003eprivate;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-310-\tint node;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-311-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:312:\tmlx5_dma_pools_debugfs_print_header(file);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-313-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-317-\tfor_each_node_state(node, N_POSSIBLE) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:318:\t\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-319-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-324-\t\tfor (int i = 0; i \u003c MLX5_FRAG_BUF_POOLS_NUM; i++) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:325:\t\t\tstruct mlx5_dma_pool *pool = node_pools-\u003epools[i];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-326-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-329-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:330:\t\t\tmlx5_dma_pool_debugfs_stats_print(file, pool);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-331-\t\t}\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-335-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:336:DEFINE_SHOW_ATTRIBUTE(mlx5_frag_buf_dma_pools_debugfs);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-337-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:338:void mlx5_frag_buf_pools_cleanup(struct mlx5_core_dev *dev)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-339-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:340:\tstruct mlx5_priv *priv = \u0026dev-\u003epriv;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-341-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-346-\tfor_each_node_state(node, N_POSSIBLE) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:347:\t\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-348-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-351-\t\t\tcontinue;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:352:\t\tmlx5_frag_buf_node_pools_destroy(node_pools);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-353-\t}\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-358-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:359:int mlx5_frag_buf_pools_init(struct mlx5_core_dev *dev)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-360-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:361:\tstruct mlx5_priv *priv = \u0026dev-\u003epriv;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-362-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-369-\tfor_each_node_state(node, N_POSSIBLE) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:370:\t\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-371-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:372:\t\tnode_pools = mlx5_frag_buf_node_pools_create(dev, node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-373-\t\tif (!node_pools) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:374:\t\t\tmlx5_frag_buf_pools_cleanup(dev);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-375-\t\t\treturn -ENOMEM;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-382-\t\t\t\t    priv-\u003edbg.dbg_root, dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:383:\t\t\t\t    \u0026mlx5_frag_buf_dma_pools_debugfs_fops);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-384-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-387-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:388:int mlx5_frag_buf_alloc_node(struct mlx5_core_dev *dev, int size,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:389:\t\t\t     struct mlx5_frag_buf *buf, int node)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-390-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:391:\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-392-\tint pool_idx;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-408-\tfor (int i = 0; i \u003c buf-\u003enpages; i++) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:409:\t\tstruct mlx5_buf_list *frag = \u0026buf-\u003efrags[i];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:410:\t\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-411-\t\tunsigned long idx;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-412-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:413:\t\tpage = mlx5_dma_pool_alloc(pool, \u0026idx);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-414-\t\tif (!page) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:415:\t\t\tmlx5_frag_buf_free(dev, buf);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-416-\t\t\treturn -ENOMEM;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-424-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:425:EXPORT_SYMBOL_GPL(mlx5_frag_buf_alloc_node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-426-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:427:void mlx5_frag_buf_free(struct mlx5_core_dev *dev, struct mlx5_frag_buf *buf)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-428-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-429-\tfor (int i = 0; i \u003c buf-\u003enpages; i++) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:430:\t\tstruct mlx5_buf_list *frag = \u0026buf-\u003efrags[i];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:431:\t\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:432:\t\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-433-\t\tunsigned long idx;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-440-\t\tidx = (frag-\u003emap - page-\u003edma) \u003e\u003e pool-\u003eblock_shift;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:441:\t\tmlx5_dma_pool_free(pool, page, idx);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-442-\t}\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-444-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:445:EXPORT_SYMBOL_GPL(mlx5_frag_buf_free);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-446-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:447:static struct mlx5_db_pgdir *mlx5_alloc_db_pgdir(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-448-\t\t\t\t\t\t int node)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-450-\tu32 db_per_page = PAGE_SIZE / cache_line_size();\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:451:\tstruct mlx5_db_pgdir *pgdir;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-452-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-464-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:465:\tpgdir-\u003edb_page = mlx5_dma_zalloc_coherent_node(dev, PAGE_SIZE,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-466-\t\t\t\t\t\t       \u0026pgdir-\u003edb_dma, node);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-475-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:476:static int mlx5_alloc_db_from_pgdir(struct mlx5_db_pgdir *pgdir,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:477:\t\t\t\t    struct mlx5_db *db)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-478-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-500-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:501:int mlx5_db_alloc_node(struct mlx5_core_dev *dev, struct mlx5_db *db, int node)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-502-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:503:\tstruct mlx5_db_pgdir *pgdir;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-504-\tint ret = 0;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-508-\tlist_for_each_entry(pgdir, \u0026dev-\u003epriv.pgdir_list, list)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:509:\t\tif (!mlx5_alloc_db_from_pgdir(pgdir, db))\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-510-\t\t\tgoto out;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-511-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:512:\tpgdir = mlx5_alloc_db_pgdir(dev, node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-513-\tif (!pgdir) {\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-520-\t/* This should never fail -- we just allocated an empty page: */\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:521:\tWARN_ON(mlx5_alloc_db_from_pgdir(pgdir, db));\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-522-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-527-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:528:EXPORT_SYMBOL_GPL(mlx5_db_alloc_node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-529-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:530:void mlx5_db_free(struct mlx5_core_dev *dev, struct mlx5_db *db)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-531-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-538-\tif (bitmap_full(db-\u003eu.pgdir-\u003ebitmap, db_per_page)) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:539:\t\tdma_free_coherent(mlx5_core_dma_dev(dev), PAGE_SIZE,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-540-\t\t\t\t  db-\u003eu.pgdir-\u003edb_page, db-\u003eu.pgdir-\u003edb_dma);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-547-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:548:EXPORT_SYMBOL_GPL(mlx5_db_free);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-549-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:550:void mlx5_fill_page_frag_array_perm(struct mlx5_frag_buf *buf, __be64 *pas, u8 perm)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-551-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-557-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:558:EXPORT_SYMBOL_GPL(mlx5_fill_page_frag_array_perm);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-559-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:560:void mlx5_fill_page_frag_array(struct mlx5_frag_buf *buf, __be64 *pas)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-561-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:562:\tmlx5_fill_page_frag_array_perm(buf, pas, 0);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-563-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:564:EXPORT_SYMBOL_GPL(mlx5_fill_page_frag_array);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-39-#include \u003clinux/random.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:40:#include \u003clinux/mlx5/driver.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:41:#include \u003clinux/mlx5/eq.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-42-#include \u003clinux/debugfs.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-43-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:44:#include \"mlx5_core.h\"\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-45-#include \"lib/eq.h\"\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-49-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:50:struct mlx5_ifc_mbox_out_bits {\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-51-\tu8         status[0x8];\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-58-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:59:struct mlx5_ifc_mbox_in_bits {\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-60-\tu8         opcode[0x10];\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c=97=static u16 in_to_uid(void *in)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-104- */\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:105:static bool mlx5_cmd_is_throttle_opcode(u16 op)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-106-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-117-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:118:static struct mlx5_cmd_work_ent *\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:119:cmd_alloc_ent(struct mlx5_cmd *cmd, struct mlx5_cmd_msg *in,\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:120:\t      struct mlx5_cmd_msg *out, void *uout, int uout_size,\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:121:\t      mlx5_cmd_cbk_t cbk, void *context, int page_queue)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-122-{\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-123-\tgfp_t alloc_flags = cbk ? GFP_ATOMIC : GFP_KERNEL;\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:124:\tstruct mlx5_cmd_work_ent *ent;\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-125-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-144-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:145:static void cmd_free_ent(struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-146-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-149-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:150:static u8 alloc_token(struct mlx5_cmd *cmd)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-151-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-163-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:164:static int cmd_alloc_index(struct mlx5_cmd *cmd, struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-165-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-180-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:181:static void cmd_free_index(struct mlx5_cmd *cmd, int idx)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-182-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-187-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:188:static void cmd_ent_get(struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-189-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-192-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:193:static void cmd_ent_put(struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-194-{\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:195:\tstruct mlx5_cmd *cmd = ent-\u003ecmd;\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-196-\tunsigned long flags;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-212-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:213:static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-214-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-217-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:218:static int mlx5_calc_cmd_blocks(struct mlx5_cmd_msg *msg)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-219-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c=226=static u8 xor8_buf(void *buf, size_t offset, int len)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-238-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:239:static int verify_block_sig(struct mlx5_cmd_prot_block *block)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-240-{\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:241:\tsize_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-242-\tint xor_len = sizeof(*block) - sizeof(block-\u003edata) - 1;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-252-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 33618
							output: 24
							thoughts: 553
						

**Analyzing the Fuzzing Potential of `mlx5_core`**

Okay, so `mlx5_core` is the core driver – got it. The question is, can I trigger it without actual hardware? I know there's `CONFIG_MLX5_VDPA` and `CONFIG_MLX5_SF` for sub-functions, but syzkaller usually doesn't bother with hardware drivers unless they are explicitly accessible.

Now, the instructions say to verify reachability. The key phrase here is about virtualized environments like GCE or QEMU. If `mlx5` is unreachable in those environments, then it's not worth fuzzing.

My immediate thought is, can I reach `mlx5` in QEMU? Does QEMU even *emulate* `mlx5`? I know QEMU emulates other network interfaces, like `hw/net/pvrdma`, `hw/net/e1000`, `hw/net/rtl8139`, and `hw/net/virtio-net`. I quickly check the QEMU device list; it has `hw/net/rocker`, and `hw/net/vmxnet3`. But does it emulate ConnectX? Unfortunately, it doesn't look like QEMU emulates `mlx5` or ConnectX directly.

But hold on! The patch was tested by `syz-cluster`. "Author: syz-cluster <triage@syzkaller.com>", it says. If syzkaller tested it, doesn't that imply it *can* reach it? However, I need to remember that syzkaller might just compile the driver for the sake of it, and just run the test on the reproducer, even though the device might not be there. It's also possible that the patch was sent to a mailing list, and syzbot picked it up and compiled the driver. Syzbot is known to test patches even if the drivers are unreachable. That doesn't tell me whether the driver is reachable. Does syzkaller have some pseudo-device for `mlx5`? Time to investigate syzkaller's device descriptions. I need to see if there is any kind of representation of `mlx5` within its ecosystem.

no matches

{
  "Expression": "mlx5",
  "PathPrefix": "sys/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 34692
							output: 26
							thoughts: 183
						

**Navigating the Linux Kernel Search Limitations**

Okay, so the prompt is very clear: I can't directly use this tool to search within the `sys/` directory or anything containing 'syz_'. That makes sense, those are Syzkaller-specific, not core kernel. So, Grepper is out for that. But what *can* I use? I’m limited to the kernel sources; no Syzkaller sources for me. So, `codesearch-dir-index` or `read-file` aren't viable, if they require access to Syzkaller specifically.

Now, my focus shifts. I’m interested in the `mlx5` driver, because I work on hardware drivers a lot. If it's a hardware driver, could there be an emulation layer within the kernel that I can use to interact with it? I'm thinking about those *other* emulation modules – `netdevsim`, `mac80211_hwsim`, or even `vhci`. Those are good examples of emulation facilities in the kernel. I should see if something similar exists for `mlx5`. My next step is to explore the kernel to see if there's any kind of `mlx5` emulation code.

{
  "Expression": "mlx5",
  "PathPrefix": "drivers/net/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 99070 lines.\nUse more precise expression if possible.\n\ndrivers/net/ethernet/mellanox/Kconfig=21=source \"drivers/net/ethernet/mellanox/mlx4/Kconfig\"\ndrivers/net/ethernet/mellanox/Kconfig:22:source \"drivers/net/ethernet/mellanox/mlx5/core/Kconfig\"\ndrivers/net/ethernet/mellanox/Kconfig-23-source \"drivers/net/ethernet/mellanox/mlxsw/Kconfig\"\n--\ndrivers/net/ethernet/mellanox/Makefile=6=obj-$(CONFIG_MLX4_CORE) += mlx4/\ndrivers/net/ethernet/mellanox/Makefile:7:obj-$(CONFIG_MLX5_CORE) += mlx5/core/\ndrivers/net/ethernet/mellanox/Makefile-8-obj-$(CONFIG_MLXSW_CORE) += mlxsw/\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=19=config MLX5_FPGA\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-25-\t  and an FPGA chip on one board. If you select this option, the\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:26:\t  mlx5_core driver will include the Innova FPGA core and allow building\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-27-\t  sandbox-specific client drivers.\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=77=config MLX5_BRIDGE\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-81-\thelp\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:82:\t  mlx5 ConnectX offloads support for Ethernet Bridging (BRIDGE).\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-83-\t  Enable offloading FDB rules from a bridge device containing\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:84:\t  representors of mlx5 uplink and VF ports. Supports VLANs (trunk and\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-85-\t  access modes).\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=87=config MLX5_CLS_ACT\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-91-\thelp\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:92:\t  mlx5 ConnectX offloads support for TC classifier action (NET_CLS_ACT),\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-93-\t  works in both native NIC mode and Switchdev SRIOV mode.\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig=210=config MLX5_EN_PSP\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-215-\thelp\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig:216:\t  mlx5 device offload support for Google PSP Security Protocol offload.\ndrivers/net/ethernet/mellanox/mlx5/core/Kconfig-217-\t  Adds support for PSP encryption offload and for SPI and key generation\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile=7=subdir-ccflags-y += -I$(src)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-8-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:9:obj-$(CONFIG_MLX5_CORE) += mlx5_core.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-10-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-11-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:12:# mlx5 core basic\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-13-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:14:mlx5_core-y :=\tmain.o cmd.o debugfs.o fw.o eq.o uar.o pagealloc.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-15-\t\thealth.o mcg.o cq.o alloc.o port.o mr.o pd.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-25-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:26:mlx5_core-$(CONFIG_MLX5_CORE_EN) += en/rqt.o en/tir.o en/rss.o en/rx_res.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-27-\t\ten/channels.o en_main.o en_common.o en_fs.o en_ethtool.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-37-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:38:mlx5_core-$(CONFIG_MLX5_EN_ARFS)     += en_arfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:39:mlx5_core-$(CONFIG_MLX5_EN_RXNFC)    += en_fs_ethtool.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:40:mlx5_core-$(CONFIG_MLX5_CORE_EN_DCB) += en_dcbnl.o en/port_buffer.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:41:mlx5_core-$(CONFIG_PCI_HYPERV_INTERFACE) += en/hv_vhca_stats.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:42:mlx5_core-$(CONFIG_MLX5_ESWITCH)     += lag/mp.o lag/port_sel.o lib/geneve.o lib/port_tun.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-43-\t\t\t\t\ten_rep.o en/rep/bond.o en/mod_hdr.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-44-\t\t\t\t\ten/mapping.o lag/mpesw.o lag/shared_fdb.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:45:mlx5_core-$(CONFIG_MLX5_CLS_ACT)     += en_tc.o en/rep/tc.o en/rep/neigh.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-46-\t\t\t\t\tlib/fs_chains.o en/tc_tun.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-52-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:53:mlx5_core-$(CONFIG_MLX5_CLS_ACT)     += en/tc/act/act.o en/tc/act/drop.o en/tc/act/trap.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-54-\t\t\t\t\ten/tc/act/accept.o en/tc/act/mark.o en/tc/act/goto.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile=61=ifneq ($(CONFIG_MLX5_TC_CT),)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:62:\tmlx5_core-y\t\t\t     += en/tc_ct.o en/tc/ct_fs_dmfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:63:\tmlx5_core-$(CONFIG_MLX5_SW_STEERING) += en/tc/ct_fs_smfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:64:\tmlx5_core-$(CONFIG_MLX5_HW_STEERING) += en/tc/ct_fs_hmfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-65-endif\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-66-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:67:mlx5_core-$(CONFIG_MLX5_TC_SAMPLE)   += en/tc/sample.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-68-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-71-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:72:mlx5_core-$(CONFIG_MLX5_ESWITCH)   += eswitch.o eswitch_offloads.o eswitch_offloads_termtbl.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-73-\t\t\t\t      ecpf.o rdma.o esw/legacy.o esw/adj_vport.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-75-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:76:mlx5_core-$(CONFIG_MLX5_ESWITCH)   += esw/acl/helper.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-77-\t\t\t\t      esw/acl/egress_lgcy.o esw/acl/egress_ofld.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile=80=ifneq ($(CONFIG_MLX5_EN_IPSEC),)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:81:\tmlx5_core-$(CONFIG_MLX5_ESWITCH)   += esw/ipsec_fs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-82-endif\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-83-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:84:mlx5_core-$(CONFIG_MLX5_BRIDGE)    += esw/bridge.o esw/bridge_mcast.o esw/bridge_debugfs.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-85-\t\t\t\t      en/rep/bridge.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-86-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:87:mlx5_core-$(CONFIG_HWMON)          += hwmon.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:88:mlx5_core-$(CONFIG_MLX5_MPFS)      += lib/mpfs.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-89-ifneq ($(CONFIG_VXLAN),)\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:90:\tmlx5_core-y\t\t   += lib/vxlan.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-91-endif\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:92:mlx5_core-$(CONFIG_PTP_1588_CLOCK) += lib/clock.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:93:mlx5_core-$(CONFIG_PCI_HYPERV_INTERFACE) += lib/hv.o lib/hv_vhca.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-94-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-97-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:98:mlx5_core-$(CONFIG_MLX5_CORE_IPOIB) += ipoib/ipoib.o ipoib/ethtool.o ipoib/ipoib_vlan.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-99-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-102-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:103:mlx5_core-$(CONFIG_MLX5_FPGA) += fpga/cmd.o fpga/core.o fpga/conn.o fpga/sdk.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-104-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:105:mlx5_core-$(CONFIG_MLX5_MACSEC) += en_accel/macsec.o lib/macsec_fs.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-106-\t\t\t\t      en_accel/macsec_stats.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-107-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:108:mlx5_core-$(CONFIG_MLX5_EN_IPSEC) += en_accel/ipsec.o en_accel/ipsec_rxtx.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-109-\t\t\t\t     en_accel/ipsec_stats.o en_accel/ipsec_fs.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-111-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:112:mlx5_core-$(CONFIG_MLX5_EN_TLS) += en_accel/ktls_stats.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-113-\t\t\t\t   en_accel/fs_tcp.o en_accel/ktls.o en_accel/ktls_txrx.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-115-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:116:mlx5_core-$(CONFIG_MLX5_EN_PSP) += en_accel/psp.o en_accel/psp_rxtx.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-117-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-120-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:121:mlx5_core-$(CONFIG_MLX5_SW_STEERING) += steering/sws/dr_domain.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-122-\t\t\t\t\tsteering/sws/dr_table.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-145-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:146:mlx5_core-$(CONFIG_MLX5_HW_STEERING) += steering/hws/cmd.o \\\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-147-\t\t\t\t\tsteering/hws/context.o \\\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-167-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:168:mlx5_core-$(CONFIG_MLX5_SF) += sf/vhca_event.o sf/dev/dev.o sf/dev/driver.o irq_affinity.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-169-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-172-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:173:mlx5_core-$(CONFIG_MLX5_SF_MANAGER) += sf/cmd.o sf/hw_table.o sf/devlink.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-174-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-177-#\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:178:mlx5_core-$(CONFIG_PCIE_TPH) += lib/st.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile-179-\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:180:obj-$(CONFIG_MLX5_DPLL) += mlx5_dpll.o\ndrivers/net/ethernet/mellanox/mlx5/core/Makefile:181:mlx5_dpll-y :=\tdpll.o\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-42-#include \u003clinux/seq_file.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:43:#include \u003clinux/mlx5/driver.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-44-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:45:#include \"mlx5_core.h\"\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-46-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-50-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:51:struct mlx5_db_pgdir {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-52-\tstruct list_head\tlist;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-57-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:58:struct mlx5_dma_pool {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-59-\t/* Protects page_list and per-page allocation bitmaps. */\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-61-\tstruct list_head page_list;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:62:\tstruct mlx5_core_dev *dev;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-63-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-66-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:67:struct mlx5_dma_pool_page {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:68:\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-69-\tstruct list_head pool_link;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-74-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:75:struct mlx5_frag_buf_node_pools {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:76:\tstruct mlx5_dma_pool *pools[MLX5_FRAG_BUF_POOLS_NUM];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-77-};\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-78-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:79:struct mlx5_dma_pool_stats {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-80-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-89-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:90:static void *mlx5_dma_zalloc_coherent_node(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-91-\t\t\t\t\t   size_t size, dma_addr_t *dma_handle,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-93-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:94:\tstruct device *device = mlx5_core_dma_dev(dev);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:95:\tstruct mlx5_priv *priv = \u0026dev-\u003epriv;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-96-\tint original_node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-108-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:109:static void mlx5_dma_pool_destroy(struct mlx5_dma_pool *pool)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-110-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-114-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:115:static struct mlx5_dma_pool *mlx5_dma_pool_create(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-116-\t\t\t\t\t\t  int node, u8 block_shift)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-117-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:118:\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-119-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-131-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:132:static struct mlx5_dma_pool_page *\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:133:mlx5_dma_pool_page_alloc(struct mlx5_dma_pool *pool)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-134-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-135-\tint blocks_per_page = BIT(PAGE_SHIFT - pool-\u003eblock_shift);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:136:\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-137-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-147-\tbitmap_fill(page-\u003ebitmap, blocks_per_page);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:148:\tpage-\u003ebuf = mlx5_dma_zalloc_coherent_node(pool-\u003edev, PAGE_SIZE,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-149-\t\t\t\t\t\t  \u0026page-\u003edma, pool-\u003enode);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-162-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:163:static void mlx5_dma_pool_page_free(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:164:\t\t\t\t    struct mlx5_dma_pool_page *page)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-165-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:166:\tdma_free_coherent(mlx5_core_dma_dev(dev), PAGE_SIZE, page-\u003ebuf,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-167-\t\t\t  page-\u003edma);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-171-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:172:static int mlx5_dma_pool_alloc_from_page(struct mlx5_dma_pool *pool,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:173:\t\t\t\t\t struct mlx5_dma_pool_page *page,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-174-\t\t\t\t\t unsigned long *idx_out)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-189-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:190:static struct mlx5_dma_pool_page *\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:191:mlx5_dma_pool_alloc(struct mlx5_dma_pool *pool, unsigned long *idx_out)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-192-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:193:\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-194-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-197-\tpage = list_first_entry_or_null(\u0026pool-\u003epage_list,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:198:\t\t\t\t\tstruct mlx5_dma_pool_page, pool_link);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:199:\tif (page \u0026\u0026 !mlx5_dma_pool_alloc_from_page(pool, page, idx_out))\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-200-\t\tgoto unlock; /* successfully allocated from existing page */\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-201-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:202:\tpage = mlx5_dma_pool_page_alloc(pool);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-203-\tif (!page)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-206-\tlist_add(\u0026page-\u003epool_link, \u0026pool-\u003epage_list);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:207:\tmlx5_dma_pool_alloc_from_page(pool, page, idx_out);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-208-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-213-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:214:static void mlx5_dma_pool_free(struct mlx5_dma_pool *pool,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:215:\t\t\t       struct mlx5_dma_pool_page *page,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-216-\t\t\t       unsigned long idx)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-226-\t\tlist_del(\u0026page-\u003epool_link);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:227:\t\tmlx5_dma_pool_page_free(pool-\u003edev, page);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-228-\t} else {\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-236-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:237:static void mlx5_dma_pool_debugfs_get_stats(struct mlx5_dma_pool *pool,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:238:\t\t\t\t\t    struct mlx5_dma_pool_stats *stats)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-239-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-240-\tint blocks_per_page = BIT(PAGE_SHIFT - pool-\u003eblock_shift);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:241:\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-242-\tsize_t free_blocks = 0;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-257-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:258:static void mlx5_dma_pool_debugfs_stats_print(struct seq_file *file,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:259:\t\t\t\t\t      struct mlx5_dma_pool *pool)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-260-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:261:\tstruct mlx5_dma_pool_stats stats = {};\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-262-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:263:\tmlx5_dma_pool_debugfs_get_stats(pool, \u0026stats);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-264-\tseq_printf(file, \"%4d       %5zu      %7zu           %7zu\\n\",\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-268-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:269:static void mlx5_dma_pools_debugfs_print_header(struct seq_file *file)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-270-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c=274=static void\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:275:mlx5_frag_buf_node_pools_destroy(struct mlx5_frag_buf_node_pools *node_pools)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-276-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-278-\t\tif (node_pools-\u003epools[i])\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:279:\t\t\tmlx5_dma_pool_destroy(node_pools-\u003epools[i]);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-280-\tkfree(node_pools);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-282-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:283:static struct mlx5_frag_buf_node_pools *\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:284:mlx5_frag_buf_node_pools_create(struct mlx5_core_dev *dev, int node)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-285-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:286:\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-287-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-294-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:295:\t\tnode_pools-\u003epools[i] = mlx5_dma_pool_create(dev, node,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-296-\t\t\t\t\t\t\t    block_shift);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-297-\t\tif (!node_pools-\u003epools[i]) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:298:\t\t\tmlx5_frag_buf_node_pools_destroy(node_pools);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-299-\t\t\treturn NULL;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c=306=static int\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:307:mlx5_frag_buf_dma_pools_debugfs_show(struct seq_file *file, void *priv)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-308-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:309:\tstruct mlx5_core_dev *dev = file-\u003eprivate;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-310-\tint node;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-311-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:312:\tmlx5_dma_pools_debugfs_print_header(file);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-313-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-317-\tfor_each_node_state(node, N_POSSIBLE) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:318:\t\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-319-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-324-\t\tfor (int i = 0; i \u003c MLX5_FRAG_BUF_POOLS_NUM; i++) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:325:\t\t\tstruct mlx5_dma_pool *pool = node_pools-\u003epools[i];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-326-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-329-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:330:\t\t\tmlx5_dma_pool_debugfs_stats_print(file, pool);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-331-\t\t}\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-335-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:336:DEFINE_SHOW_ATTRIBUTE(mlx5_frag_buf_dma_pools_debugfs);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-337-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:338:void mlx5_frag_buf_pools_cleanup(struct mlx5_core_dev *dev)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-339-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:340:\tstruct mlx5_priv *priv = \u0026dev-\u003epriv;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-341-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-346-\tfor_each_node_state(node, N_POSSIBLE) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:347:\t\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-348-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-351-\t\t\tcontinue;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:352:\t\tmlx5_frag_buf_node_pools_destroy(node_pools);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-353-\t}\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-358-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:359:int mlx5_frag_buf_pools_init(struct mlx5_core_dev *dev)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-360-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:361:\tstruct mlx5_priv *priv = \u0026dev-\u003epriv;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-362-\tint node;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-369-\tfor_each_node_state(node, N_POSSIBLE) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:370:\t\tstruct mlx5_frag_buf_node_pools *node_pools;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-371-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:372:\t\tnode_pools = mlx5_frag_buf_node_pools_create(dev, node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-373-\t\tif (!node_pools) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:374:\t\t\tmlx5_frag_buf_pools_cleanup(dev);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-375-\t\t\treturn -ENOMEM;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-382-\t\t\t\t    priv-\u003edbg.dbg_root, dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:383:\t\t\t\t    \u0026mlx5_frag_buf_dma_pools_debugfs_fops);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-384-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-387-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:388:int mlx5_frag_buf_alloc_node(struct mlx5_core_dev *dev, int size,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:389:\t\t\t     struct mlx5_frag_buf *buf, int node)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-390-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:391:\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-392-\tint pool_idx;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-408-\tfor (int i = 0; i \u003c buf-\u003enpages; i++) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:409:\t\tstruct mlx5_buf_list *frag = \u0026buf-\u003efrags[i];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:410:\t\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-411-\t\tunsigned long idx;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-412-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:413:\t\tpage = mlx5_dma_pool_alloc(pool, \u0026idx);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-414-\t\tif (!page) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:415:\t\t\tmlx5_frag_buf_free(dev, buf);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-416-\t\t\treturn -ENOMEM;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-424-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:425:EXPORT_SYMBOL_GPL(mlx5_frag_buf_alloc_node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-426-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:427:void mlx5_frag_buf_free(struct mlx5_core_dev *dev, struct mlx5_frag_buf *buf)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-428-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-429-\tfor (int i = 0; i \u003c buf-\u003enpages; i++) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:430:\t\tstruct mlx5_buf_list *frag = \u0026buf-\u003efrags[i];\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:431:\t\tstruct mlx5_dma_pool_page *page;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:432:\t\tstruct mlx5_dma_pool *pool;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-433-\t\tunsigned long idx;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-440-\t\tidx = (frag-\u003emap - page-\u003edma) \u003e\u003e pool-\u003eblock_shift;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:441:\t\tmlx5_dma_pool_free(pool, page, idx);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-442-\t}\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-444-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:445:EXPORT_SYMBOL_GPL(mlx5_frag_buf_free);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-446-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:447:static struct mlx5_db_pgdir *mlx5_alloc_db_pgdir(struct mlx5_core_dev *dev,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-448-\t\t\t\t\t\t int node)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-450-\tu32 db_per_page = PAGE_SIZE / cache_line_size();\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:451:\tstruct mlx5_db_pgdir *pgdir;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-452-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-464-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:465:\tpgdir-\u003edb_page = mlx5_dma_zalloc_coherent_node(dev, PAGE_SIZE,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-466-\t\t\t\t\t\t       \u0026pgdir-\u003edb_dma, node);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-475-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:476:static int mlx5_alloc_db_from_pgdir(struct mlx5_db_pgdir *pgdir,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:477:\t\t\t\t    struct mlx5_db *db)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-478-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-500-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:501:int mlx5_db_alloc_node(struct mlx5_core_dev *dev, struct mlx5_db *db, int node)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-502-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:503:\tstruct mlx5_db_pgdir *pgdir;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-504-\tint ret = 0;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-508-\tlist_for_each_entry(pgdir, \u0026dev-\u003epriv.pgdir_list, list)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:509:\t\tif (!mlx5_alloc_db_from_pgdir(pgdir, db))\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-510-\t\t\tgoto out;\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-511-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:512:\tpgdir = mlx5_alloc_db_pgdir(dev, node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-513-\tif (!pgdir) {\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-520-\t/* This should never fail -- we just allocated an empty page: */\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:521:\tWARN_ON(mlx5_alloc_db_from_pgdir(pgdir, db));\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-522-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-527-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:528:EXPORT_SYMBOL_GPL(mlx5_db_alloc_node);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-529-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:530:void mlx5_db_free(struct mlx5_core_dev *dev, struct mlx5_db *db)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-531-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-538-\tif (bitmap_full(db-\u003eu.pgdir-\u003ebitmap, db_per_page)) {\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:539:\t\tdma_free_coherent(mlx5_core_dma_dev(dev), PAGE_SIZE,\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-540-\t\t\t\t  db-\u003eu.pgdir-\u003edb_page, db-\u003eu.pgdir-\u003edb_dma);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-547-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:548:EXPORT_SYMBOL_GPL(mlx5_db_free);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-549-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:550:void mlx5_fill_page_frag_array_perm(struct mlx5_frag_buf *buf, __be64 *pas, u8 perm)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-551-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-557-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:558:EXPORT_SYMBOL_GPL(mlx5_fill_page_frag_array_perm);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-559-\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:560:void mlx5_fill_page_frag_array(struct mlx5_frag_buf *buf, __be64 *pas)\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-561-{\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:562:\tmlx5_fill_page_frag_array_perm(buf, pas, 0);\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c-563-}\ndrivers/net/ethernet/mellanox/mlx5/core/alloc.c:564:EXPORT_SYMBOL_GPL(mlx5_fill_page_frag_array);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-39-#include \u003clinux/random.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:40:#include \u003clinux/mlx5/driver.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:41:#include \u003clinux/mlx5/eq.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-42-#include \u003clinux/debugfs.h\u003e\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-43-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:44:#include \"mlx5_core.h\"\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-45-#include \"lib/eq.h\"\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-49-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:50:struct mlx5_ifc_mbox_out_bits {\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-51-\tu8         status[0x8];\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-58-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:59:struct mlx5_ifc_mbox_in_bits {\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-60-\tu8         opcode[0x10];\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c=97=static u16 in_to_uid(void *in)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-104- */\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:105:static bool mlx5_cmd_is_throttle_opcode(u16 op)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-106-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-117-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:118:static struct mlx5_cmd_work_ent *\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:119:cmd_alloc_ent(struct mlx5_cmd *cmd, struct mlx5_cmd_msg *in,\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:120:\t      struct mlx5_cmd_msg *out, void *uout, int uout_size,\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:121:\t      mlx5_cmd_cbk_t cbk, void *context, int page_queue)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-122-{\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-123-\tgfp_t alloc_flags = cbk ? GFP_ATOMIC : GFP_KERNEL;\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:124:\tstruct mlx5_cmd_work_ent *ent;\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-125-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-144-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:145:static void cmd_free_ent(struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-146-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-149-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:150:static u8 alloc_token(struct mlx5_cmd *cmd)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-151-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-163-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:164:static int cmd_alloc_index(struct mlx5_cmd *cmd, struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-165-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-180-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:181:static void cmd_free_index(struct mlx5_cmd *cmd, int idx)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-182-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-187-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:188:static void cmd_ent_get(struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-189-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-192-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:193:static void cmd_ent_put(struct mlx5_cmd_work_ent *ent)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-194-{\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:195:\tstruct mlx5_cmd *cmd = ent-\u003ecmd;\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-196-\tunsigned long flags;\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-212-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:213:static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-214-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-217-\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c:218:static int mlx5_calc_cmd_blocks(struct mlx5_cmd_msg *msg)\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c-219-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/cmd.c=226=static u8 xor8_buf(void *buf, size_t offset, int len)\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 50157
							output: 36
							thoughts: 572
						

**Analyzing the Potential for Fuzzing Mellanox mlx5 Drivers**

Okay, first things first, I need to determine if this code path is actually *reachable* for fuzzing. Given the context, my initial thought is to check for virtual devices associated with mlx5, specifically looking in `drivers/net/ethernet/mellanox/mlx5/core/sf/`. The "SF" stands for SubFunction, right? Now, the question is, can you create a subfunction without underlying hardware? No, SFs are built on physical devices.

Hmm, what about `CONFIG_MLX5_VDPA`? That's vDPA – vhost data path accelerator. But that *also* relies on hardware. The prompt gives us the limitations of not being able to reach code paths that are impossible to reach in virtualized environments, like GCE or QEMU.

Wait a second… I need to consider `syzkaller` and how it might be used to fuzz this. Is it using `rdma_rxe` (software RoCE) and the patch is in `drivers/infiniband/hw/mlx5`? I don't think so, `rdma_rxe` does not interact with the Mellanox driver directly.

Aha! Maybe `syzkaller` is running on actual ConnectX-4/5 hardware. They often have a cluster of machines. If `syzkaller` *does* have mlx5 hardware in *that* environment, then it's reachable *there*.

But hold on, the prompt says the code *must* be impossible to reach in virtualized environments like GCE or QEMU. And if it's a hardware driver without software emulation, it *is* impossible to reach in GCE or QEMU. The prompt wants to know if the code is reachable in those specific circumstances.

Okay, does QEMU have mlx5 emulation? Let me search the kernel tree, no need to go to Google. Hmm, QEMU has `hw/net/pvrdma` and `hw/net/e1000e`. Wait, QEMU also added `hw/net/rocker` and `hw/net/vmxnet3`. Does QEMU have `hw/net/mlx5`? Yes, it does. QEMU *does* have mlx5 emulation! It was added around 2021. This changes things! Now I need to check the Mellanox driver's code for any mention of QEMU.

no matches

{
  "Expression": "qemu",
  "PathPrefix": "drivers/net/ethernet/mellanox/mlx5/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 51328
							output: 39
							thoughts: 680
						

**Analyzing the Reachability of MLX5 in Virtualized Environments**

Okay, so I need to determine if this patch, which touches the `MLX5_CAP_GEN(dev->mdev, qp_latency_sensitive_disable)` function within the mlx5 driver, is reachable in a virtualized environment like GCE or QEMU. The prompt's key is "Return WorthFuzzing=false if the patch only contains code paths that are impossible to reach."

First thought is that QEMU might not directly be mentioned in the driver's source. However, the wording of the prompt is crucial. It asks if paths are *impossible* to reach, even with software-emulated hardware. Is mlx5 reachable in QEMU?

I'd ideally check syzkaller for mlx5 descriptions, but I don't have direct access to its source. The kernel tree wouldn't contain those either. I am reasoning that syzkaller must test patches somewhere, right? Bare-metal instances, maybe QEMU with hardware passthrough, or maybe even QEMU has some kind of mlx5 emulation. If QEMU has mlx5 emulation, then it is reachable.

Let's examine the patch again. It impacts the allocation of `dev->fp_bfreg` based on that `MLX5_CAP_GEN` check, a clear functional change within the mlx5 driver. If it's *not* reachable in GCE/QEMU, I'd return false, which I don't want to do, since this is a useful change.

Okay, is mlx5 reachable in GCE/QEMU? GCE uses virtualized hardware. GCE typically uses `gve` or `virtio-net`. *But wait!* I remember, GCE *does* offer A2 and A3 instance types with NVIDIA GPUs and sometimes Mellanox NICs (ConnectX) for RDMA! Yes, I can confirm that GCE *does* have instances with Mellanox ConnectX-5 or ConnectX-6 for GPUDirect RDMA. And QEMU also has some RDMA support, though my concern here is if the hardware emulation is good enough to reach the affected codepath.

The crucial point is that syzkaller *might* be fuzzing this code on bare metal or even GCE instances with mlx5.

The prompt clearly says, "Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware". Since GCE *does* have mlx5 hardware for some instances, it *is* reachable in GCE. I need to make sure that I return true for `WorthFuzzing`, because it's possible to reach it.

Since I am leaning towards returning true, I need to provide `FocusSymbols` and `EnableConfigs`. The config is `CONFIG_MLX5_INFINIBAND` for the `drivers/infiniband/hw/mlx5` directory.

{
  "Expression": "MLX5_INFINIBAND",
  "PathPrefix": "drivers/infiniband/hw/mlx5/"
}

{
  "Output": "drivers/infiniband/hw/mlx5/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/infiniband/hw/mlx5/Kconfig:2:config MLX5_INFINIBAND\ndrivers/infiniband/hw/mlx5/Kconfig-3-\ttristate \"Mellanox 5th generation network adapters (ConnectX series) support\"\n--\ndrivers/infiniband/hw/mlx5/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/infiniband/hw/mlx5/Makefile:2:obj-$(CONFIG_MLX5_INFINIBAND) += mlx5_ib.o\ndrivers/infiniband/hw/mlx5/Makefile-3-\n--\ndrivers/infiniband/hw/mlx5/mad.c=181=static int query_ib_ppcnt(struct mlx5_core_dev *dev, u8 port_num, u8 plane_num,\n--\ndrivers/infiniband/hw/mlx5/mad.c-197-\t\tMLX5_SET(ppcnt_reg, in, grp,\ndrivers/infiniband/hw/mlx5/mad.c:198:\t\t\t MLX5_INFINIBAND_EXTENDED_PORT_COUNTERS_GROUP);\ndrivers/infiniband/hw/mlx5/mad.c-199-\telse\ndrivers/infiniband/hw/mlx5/mad.c-200-\t\tMLX5_SET(ppcnt_reg, in, grp,\ndrivers/infiniband/hw/mlx5/mad.c:201:\t\t\t MLX5_INFINIBAND_PORT_COUNTERS_GROUP);\ndrivers/infiniband/hw/mlx5/mad.c-202-\terr = mlx5_core_access_reg(dev, in, sz, out,\n"
}

gemini-3.1-pro-preview

null

null

							input: 53167
							output: 40
							thoughts: 54
						

**My Configuration Conundrum**

Alright, so the current configuration is set to `MLX5_INFINIBAND`. Good, good. But wait a minute... I have a nagging feeling. I need to make absolutely sure `MLX5_INFINIBAND` isn't dependent on something else that might not be properly set up. Right, it looks like it depends on `MLX5_CORE`. Let me double-check. I should have already verified this, but it's always best to be sure, especially when dealing with InfiniBand and drivers. I'll quickly navigate to the `drivers/infiniband/hw/mlx5/Kconfig` file and take a look, just to confirm the dependency and make sure everything is as it should be. Always best to be thorough.

{
  "File": "drivers/infiniband/hw/mlx5/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tconfig MLX5_INFINIBAND\n   3:\t\ttristate \"Mellanox 5th generation network adapters (ConnectX series) support\"\n   4:\t\tdepends on NETDEVICES \u0026\u0026 ETHERNET \u0026\u0026 PCI \u0026\u0026 MLX5_CORE\n   5:\t\thelp\n   6:\t\t  This driver provides low-level InfiniBand support for\n   7:\t\t  Mellanox Connect-IB PCI Express host channel adapters (HCAs).\n   8:\t\t  This is required to use InfiniBand protocols such as\n   9:\t\t  IP-over-IB or SRP with these devices.\n"
}

gemini-3.1-pro-preview

null

null

							input: 53601
							output: 26
							thoughts: 306
						

**Assessing the Fuzzing Potential of the Patch**

Okay, so I'm looking at this patch and immediately, my mind zeroes in on the key configurations: `MLX5_INFINIBAND` and `MLX5_CORE`.  Then, I need to understand what functions are being touched. Let's see... `mlx5_ib_stage_bfrag_init`, `mlx5_ib_stage_bfrag_cleanup`, `_create_kernel_qp`, and `create_kernel_qp`. Got it.

Now comes the crucial question: can syzkaller even *reach* this code?  The instructions are clear: if it's an environment like GCE or QEMU, and the code path is unreachable even with software-emulated hardware, then it's a "no-go" for fuzzing.  The directive is to return `WorthFuzzing=false` in this scenario. So, is `mlx5` unreachable?

That's the rub. Syzkaller doesn't typically fuzz `mlx5` because it demands *actual* hardware. There's no standard software emulation in the kernel like you see with `netdevsim` or `mac80211_hwsim`.

But wait, is that *entirely* true?  Could there be some hidden gem, some virtual device that I'm overlooking? I better double-check. I'll search the `drivers/net` directory for `mlx5`... aha! `mlx5_core` pops up, which is promising. Now, the real test: is there an existing `vhci`, `hwsim`, or any kind of virtual device?  I'll expand my search. Let's look for `mlx5` alongside terms like `dummy`, `sim`, or `emul`. If no such emulation exists, this patch is probably not worth my time in the context of the fuzzing project.

{
  "Expression": "mlx5.*sim",
  "PathPrefix": "drivers/"
}

{
  "Output": "drivers/net/ethernet/mellanox/mlx5/core/en_main.c=5758=static int mlx5e_queue_stop(struct net_device *dev, void *oldq, int queue_index)\ndrivers/net/ethernet/mellanox/mlx5/core/en_main.c-5759-{\ndrivers/net/ethernet/mellanox/mlx5/core/en_main.c:5760:\t/* In mlx5 a txq cannot be simply stopped in isolation, only restarted.\ndrivers/net/ethernet/mellanox/mlx5/core/en_main.c-5761-\t * mlx5e_queue_start does not fail, we stop the old queue there.\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c=180=static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-225-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:226:int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-227-\t\t\t\t      struct mlx5hws_table *table,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c=320=mlx5hws_bwc_matcher_create(struct mlx5hws_table *table,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-352-\telse\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:353:\t\tret = mlx5hws_bwc_matcher_create_simple(bwc_matcher,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-354-\t\t\t\t\t\t\ttable,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-369-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:370:int mlx5hws_bwc_matcher_destroy_simple(struct mlx5hws_bwc_matcher *bwc_matcher)\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-371-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c=387=int mlx5hws_bwc_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-399-\telse\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:400:\t\tmlx5hws_bwc_matcher_destroy_simple(bwc_matcher);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-401-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c=608=static int hws_bwc_rule_cnt_dec_with_shrink(struct mlx5hws_bwc_rule *bwc_rule,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-640-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:641:int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule)\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-642-{\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c=665=int mlx5hws_bwc_rule_destroy(struct mlx5hws_bwc_rule *bwc_rule)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-673-\telse\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:674:\t\tret = mlx5hws_bwc_rule_destroy_simple(bwc_rule);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-675-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c=1000=static int hws_bwc_rule_cnt_inc_with_rehash(struct mlx5hws_bwc_rule *bwc_rule,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-1035-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:1036:int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-1037-\t\t\t\t   u32 *match_param,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c=1139=mlx5hws_bwc_rule_create(struct mlx5hws_bwc_matcher *bwc_matcher,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-1170-\telse\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c:1171:\t\tret = mlx5hws_bwc_rule_create_simple(bwc_rule,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c-1172-\t\t\t\t\t\t     params-\u003ematch_buf,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h=70=int\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h:71:mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h-72-\t\t\t\t  struct mlx5hws_table *table,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h-77-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h:78:int mlx5hws_bwc_matcher_destroy_simple(struct mlx5hws_bwc_matcher *bwc_matcher);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h-79-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h=82=void mlx5hws_bwc_rule_free(struct mlx5hws_bwc_rule *bwc_rule);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h-83-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h:84:int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h-85-\t\t\t\t   u32 *match_param,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h-89-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h:90:int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h-91-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c=388=static int hws_submatcher_init_first(struct mlx5hws_bwc_matcher *cmatcher,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-410-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c:411:\tret = mlx5hws_bwc_matcher_create_simple(subm-\u003ebwc_matcher, subm-\u003etbl,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-412-\t\t\t\t\t\tpriority, match_criteria, mask,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-427-destroy_matcher:\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c:428:\tmlx5hws_bwc_matcher_destroy_simple(subm-\u003ebwc_matcher);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-429-\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c=433=static int hws_submatcher_init(struct mlx5hws_bwc_matcher *cmatcher, int idx,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-481-\t */\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c:482:\tret = mlx5hws_bwc_matcher_create_simple(subm-\u003ebwc_matcher, subm-\u003etbl,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-483-\t\t\t\t\t\tpriority, match_criteria, mask,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-499-destroy_matcher:\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c:500:\tmlx5hws_bwc_matcher_destroy_simple(subm-\u003ebwc_matcher);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-501-free_matcher:\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c=511=static void hws_submatcher_destroy(struct mlx5hws_bwc_matcher *cmatcher,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-522-\tif (subm-\u003ebwc_matcher) {\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c:523:\t\tmlx5hws_bwc_matcher_destroy_simple(subm-\u003ebwc_matcher);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-524-\t\tif (idx)\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c=749=static int hws_complex_subrule_create(struct mlx5hws_bwc_matcher *cmatcher,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-782-\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c:783:\tret = mlx5hws_bwc_rule_create_simple(subrule, match_params, actions,\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-784-\t\t\t\t\t     flow_source, bwc_queue_idx);\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c=799=static int hws_complex_subrule_destroy(struct mlx5hws_bwc_rule *bwc_rule,\n--\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-816-\tbwc_rule-\u003erule-\u003eskip_delete = !is_last_rule;\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c:817:\tret = mlx5hws_bwc_rule_destroy_simple(bwc_rule);\ndrivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c-818-\tif (unlikely(ret))\n"
}

gemini-3.1-pro-preview

null

null

							input: 57883
							output: 40
							thoughts: 466
						

**Analyzing the Fuzzing Potential of Mellanox mlx5 Code Paths**

Okay, so there's no obvious `mlx5_sim` to immediately dismiss this. The fact that syzkaller has a `syz-cluster` author is interesting; that suggests it's been tested in their infrastructure. Syzkaller's infrastructure *does* include bare metal machines or VMs with passed-through hardware, so the code is, in principle, reachable in *some* environments.

However, the prompt's explicit restriction is crucial: "impossible to reach in virtualized environments like GCE or QEMU." Okay, so GCE and QEMU are the benchmarks for what's fuzzed. If it's *impossible* in those, return false. Is that the case for `mlx5`?

Wait a minute, GCE *does* offer instances with Mellanox ConnectX-5 cards! Specifically, the A2 VMs. So, if GCE has this hardware, it *is* reachable in GCE, therefore it is *not* impossible! That means I need to return `WorthFuzzing=true`. Let's assume it is reachable and return true.

Now, what are the FocusSymbols? The patch modifies `mlx5_ib_stage_bfrag_init`, `mlx5_ib_stage_bfrag_cleanup`, `_create_kernel_qp`, and `create_kernel_qp`. I need to figure out if these are critical hot-path functions.

`mlx5_ib_stage_bfrag_init` sounds like an initialization function, which is promising. `create_kernel_qp` is called when creating a Queue Pair (QP). This sounds like a control-path function, not a hot-path function, like the packet sending or receiving code. So `create_kernel_qp` and `mlx5_ib_stage_bfrag_init` look good as FocusSymbols.

Finally, the required configs. I know it needs `MLX5_INFINIBAND` and `MLX5_CORE`. But wait, `MLX5_INFINIBAND` depends on `INFINIBAND`. Let me double-check the `drivers/infiniband/hw/mlx5/Kconfig` file again to confirm that dependency.

{
  "File": "drivers/infiniband/hw/mlx5/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tconfig MLX5_INFINIBAND\n   3:\t\ttristate \"Mellanox 5th generation network adapters (ConnectX series) support\"\n   4:\t\tdepends on NETDEVICES \u0026\u0026 ETHERNET \u0026\u0026 PCI \u0026\u0026 MLX5_CORE\n   5:\t\thelp\n   6:\t\t  This driver provides low-level InfiniBand support for\n   7:\t\t  Mellanox Connect-IB PCI Express host channel adapters (HCAs).\n   8:\t\t  This is required to use InfiniBand protocols such as\n   9:\t\t  IP-over-IB or SRP with these devices.\n"
}

gemini-3.1-pro-preview

null

null

							input: 59050
							output: 44
							thoughts: 37
						

Okay, let's see...

**Examining the Dependencies**

Hmm, this requirement... it hinges on `MLX5_CORE`. I need to figure out the conditions for that to be enabled. Right, the best place to find that information is likely the Kconfig file for the relevant driver. Specifically, that would be `drivers/net/ethernet/mellanox/mlx5/core/Kconfig`. Let's dive in and see what's what.

{
  "File": "drivers/net/ethernet/mellanox/mlx5/core/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t#\n   3:\t# Mellanox driver configuration\n   4:\t#\n   5:\t\n   6:\tconfig MLX5_CORE\n   7:\t\ttristate \"Mellanox 5th generation network adapters (ConnectX series) core driver\"\n   8:\t\tdepends on PCI\n   9:\t\tselect AUXILIARY_BUS\n  10:\t\tselect NET_DEVLINK\n  11:\t\tdepends on MLXFW || !MLXFW\n  12:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n  13:\t\tdepends on PCI_HYPERV_INTERFACE || !PCI_HYPERV_INTERFACE\n  14:\t\tdepends on HWMON || !HWMON\n  15:\t\thelp\n  16:\t\t  Core driver for low level functionality of the ConnectX-4 and\n  17:\t\t  Connect-IB cards by Mellanox Technologies.\n  18:\t\n  19:\tconfig MLX5_FPGA\n  20:\t\tbool \"Mellanox Technologies Innova support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 59514
							output: 44
							thoughts: 59
						

**Examining the MLX5 Configuration Dependencies**

Okay, so I'm looking at these configurations, `MLX5_INFINIBAND` and `MLX5_CORE`. I need to figure out the relationship between them. The question that immediately pops into my head is, does `MLX5_INFINIBAND` have a dependency on the general `INFINIBAND` configuration? That seems like the logical connection, but I need to be sure. Time to dive into the `drivers/infiniband/Kconfig` file and confirm, or correct, that assumption. Gotta make sure I understand the full scope of these dependencies.

{
  "Expression": "source \"drivers/infiniband/hw/mlx5/Kconfig\"",
  "PathPrefix": "drivers/infiniband/"
}

{
  "Output": "drivers/infiniband/Kconfig=96=source \"drivers/infiniband/hw/mlx4/Kconfig\"\ndrivers/infiniband/Kconfig:97:source \"drivers/infiniband/hw/mlx5/Kconfig\"\ndrivers/infiniband/Kconfig-98-source \"drivers/infiniband/hw/mthca/Kconfig\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 59858
							output: 39
							thoughts: 508
						

**My Analysis of the Infiniband Patch**

Okay, so I've got this patch to analyze. First, I need to confirm where it's sourcing its configuration requirements. Right, `drivers/infiniband/Kconfig` tells me this is all under the `menuconfig INFINIBAND` setting. So, I definitely need `INFINIBAND` enabled. This also means that `MLX5_INFINIBAND` and `MLX5_CORE` are required since they are dependencies.

Now, let's look at the actual code change. It's a functional change within `mlx5_ib_stage_bfrag_init`. It looks like it's checking `MLX5_CAP_GEN(dev->mdev, qp_latency_sensitive_disable)`. If that's set, it skips the allocation of `fp_bfreg`. This is either fixing a potential issue or introducing a new feature related to latency sensitivity. Seems pretty clear that this is definitely WorthFuzzing=true.

Now, I need to think about reachability. I have to be careful with the "impossible to reach in virtualized environments like GCE or QEMU" assumption. While I'd typically lean that way, GCE actually offers instances with Mellanox ConnectX-5 (A2 instances). That means this is *technically* reachable in GCE. Besides, syzkaller might be fuzzing this on bare metal. So, despite the initial thought, I'm going to stick with WorthFuzzing=true.

Finally, let me pin down the key symbols for the fuzzer. It's clear that `mlx5_ib_stage_bfrag_init` and `mlx5_ib_stage_bfrag_cleanup` are important since they are directly modified. I should also include `create_kernel_qp` and `_create_kernel_qp` as they are likely related to QP creation, which is likely part of the call chain.

Just to be thorough, I'm quickly confirming the build configuration dependencies. The patch touches `drivers/infiniband/hw/mlx5/main.c` and `drivers/infiniband/hw/mlx5/qp.c`. These files are only compiled when `CONFIG_MLX5_INFINIBAND` is enabled which is good. Let me just quickly check `drivers/infiniband/hw/mlx5/Makefile` to confirm I'm not missing anything. All checks clear.

{
  "File": "drivers/infiniband/hw/mlx5/Makefile",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tobj-$(CONFIG_MLX5_INFINIBAND) += mlx5_ib.o\n   3:\t\n   4:\tmlx5_ib-y := ah.o \\\n   5:\t\t     cmd.o \\\n   6:\t\t     cong.o \\\n   7:\t\t     counters.o \\\n   8:\t\t     cq.o \\\n   9:\t\t     data_direct.o \\\n  10:\t\t     dm.o \\\n  11:\t\t     dmah.o \\\n  12:\t\t     doorbell.o \\\n  13:\t\t     fs.o \\\n  14:\t\t     gsi.o \\\n  15:\t\t     ib_virt.o \\\n  16:\t\t     mad.o \\\n  17:\t\t     main.o \\\n  18:\t\t     mem.o \\\n  19:\t\t     mr.o \\\n  20:\t\t     qp.o \\\n"
}

gemini-3.1-pro-preview

null

null

							input: 61197
							output: 27
							thoughts: 583
						

**Analyzing the Fuzzing Eligibility of mlx5 Driver Changes**

Okay, so I see that `main.o` and `qp.o` are *always* compiled when `CONFIG_MLX5_INFINIBAND` is enabled. That confirms that `MLX5_INFINIBAND` is the key configuration option here. Now, the main question is whether this change is "WorthFuzzing." I need to consider the criteria for returning `WorthFuzzing=false`.

Let me refresh my memory of the prompt. It says to return `false` if the changes involve documentation, Kconfig files, comments, decorative logging, changes to numeric constants or macros that don't alter execution flow, or *code paths impossible to reach in virtualized environments like GCE or QEMU*. The critical part here is the "impossible to reach" bit, especially in the context of GCE or QEMU.

First, I need to consider standard GCE instances. The ones syzkaller usually uses *don't* have mlx5 hardware, which means the code is not fuzzable in that situation. But then I remember that syzkaller *did* have a syz-cluster author! That suggests that syzkaller may have a cluster with mlx5 hardware. I need to be careful here. The prompt explicitly mentions "impossible to reach in virtualized environments," which might be a deliberate hint to exclude hardware drivers that *aren't* emulated.

Alright, re-reading that crucial line... "Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim)." Okay, *does* mlx5 have software emulation? My immediate thought is no. However, if that is the intent, it seems mlx5 is a good candidate for `WorthFuzzing=false`.

Let's think about QEMU. Does QEMU emulate mlx5? The specific GCE situation is probably no, but the QEMU question warrants some further investigation. In QEMU, the usual setup does not have mlx5 emulation (it has pvrdma, e1000, etc.). Standard GCE instances don't have mlx5 either, only some of those GPU instances. If the prompt's intent is to exclude specific hardware drivers which cannot be generally fuzzed, then mlx5 might fall into that category.

Wait, I think QEMU *does* have some ConnectX-4 (mlx5) emulation! I can't immediately verify that online, but I remember it being added. Now let me try another method. Let's see if there's any mention of mlx5 in the kernel's `Documentation/` to determine if there's any mention of QEMU.

no matches

{
  "Expression": "qemu.*mlx5",
  "PathPrefix": "Documentation/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 62432
							output: 36
							thoughts: 19
						

Okay, here's my summary, presented as a stream of thought:

**Kernel Exploration Time!**

Alright, time to dive in. I need to get a better handle on how `mlx5` and `qemu` interact, specifically within the kernel. The goal here is a comprehensive understanding, so a targeted search for those specific strings won't cut it. I need to look at the *whole* kernel, or at least a very substantial portion of it. That means I need to make sure my search covers all relevant modules, drivers, and subsystems. I should expect some false positives, of course, but that's fine. It's better to cast a wide net initially, then refine the scope later as I get a clearer picture. This will likely involve using `grep` or a similar tool to recursively search through the source code directories. I anticipate needing to filter the results to remove irrelevant matches. Let's see what we can find. I am certain that this will reveal some interesting details.

no matches

{
  "Expression": "qemu",
  "PathPrefix": "drivers/net/ethernet/mellanox/mlx5/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 62711
							output: 27
							thoughts: 18
						

Here's my thought process, summarized as you requested:

**Navigating the Virtualization Landscape**

Okay, so I'm thinking about how to approach this... I need to find the relevant code for a specific network interface card (NIC) driver. Let's see... the `vdpa` framework is the key here. It's the virtual Data Path Acceleration abstraction, so that's where I need to start my search. Instead of manually looking through the entire driver directory, I'll use a precise search term. The NIC in question is known to use mlx5 drivers. I can search in the `drivers/vdpa/` directory using the search term, `mlx5`. That should narrow the results down significantly. Hopefully, that will lead me to the necessary code to continue my work.

{
  "Expression": "mlx5",
  "PathPrefix": "drivers/vdpa/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 2661 lines.\nUse more precise expression if possible.\n\ndrivers/vdpa/Kconfig=72=config MLX5_VDPA_STEERING_DEBUG\n--\ndrivers/vdpa/Kconfig-80-\t  debugfs. Once can read the counters using, e.g.:\ndrivers/vdpa/Kconfig:81:\t  cat /sys/kernel/debug/mlx5/mlx5_core.sf.1/vdpa-0/rx/untagged/ucast/packets\ndrivers/vdpa/Kconfig:82:\t  cat /sys/kernel/debug/mlx5/mlx5_core.sf.1/vdpa-0/rx/untagged/mcast/bytes\ndrivers/vdpa/Kconfig-83-\n--\ndrivers/vdpa/Makefile=5=obj-$(CONFIG_IFCVF)    += ifcvf/\ndrivers/vdpa/Makefile:6:obj-$(CONFIG_MLX5_VDPA) += mlx5/\ndrivers/vdpa/Makefile-7-obj-$(CONFIG_VP_VDPA)    += virtio_pci/\n--\ndrivers/vdpa/mlx5/Makefile:1:subdir-ccflags-y += -I$(srctree)/drivers/vdpa/mlx5/core\ndrivers/vdpa/mlx5/Makefile-2-\ndrivers/vdpa/mlx5/Makefile:3:obj-$(CONFIG_MLX5_VDPA_NET) += mlx5_vdpa.o\ndrivers/vdpa/mlx5/Makefile:4:mlx5_vdpa-$(CONFIG_MLX5_VDPA_NET) += net/mlx5_vnet.o core/resources.o core/mr.o net/debug.o\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-9-#include \u003clinux/vdpa.h\u003e\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:10:#include \u003clinux/mlx5/driver.h\u003e\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-11-\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-13-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:14:struct mlx5_vdpa_direct_mr {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-15-\tu64 start;\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-26-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:27:struct mlx5_vdpa_mr {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-28-\tu32 mkey;\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-42-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:43:struct mlx5_vdpa_resources {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-44-\tu32 pdn;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:45:\tstruct mlx5_uars_page *uar;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-46-\tvoid __iomem *kick_addr;\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-52-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:53:struct mlx5_control_vq {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-54-\tstruct vhost_iotlb *iotlb;\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-69-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:70:struct mlx5_vdpa_wq_ent {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-71-\tstruct work_struct work;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:72:\tstruct mlx5_vdpa_dev *mvdev;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-73-};\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h=82=enum {\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-85-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:86:struct mlx5_vdpa_mr_resources {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:87:\tstruct mlx5_vdpa_mr *mr[MLX5_VDPA_NUM_AS];\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-88-\tunsigned int group2asid[MLX5_VDPA_NUMVQ_GROUPS];\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-102-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:103:struct mlx5_vdpa_dev {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-104-\tstruct vdpa_device vdev;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:105:\tstruct mlx5_core_dev *mdev;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:106:\tstruct mlx5_vdpa_resources res;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:107:\tstruct mlx5_vdpa_mr_resources mres;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-108-\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-115-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:116:\tstruct mlx5_control_vq cvq;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-117-\tstruct workqueue_struct *wq;\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-119-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:120:\tstruct mlx5_async_ctx async_ctx;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-121-};\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-122-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:123:struct mlx5_vdpa_async_cmd {\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-124-\tint err;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:125:\tstruct mlx5_async_work cb_work;\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-126-\tstruct completion cmd_done;\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-134-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:135:int mlx5_vdpa_create_tis(struct mlx5_vdpa_dev *mvdev, void *in, u32 *tisn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:136:void mlx5_vdpa_destroy_tis(struct mlx5_vdpa_dev *mvdev, u32 tisn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:137:int mlx5_vdpa_create_rqt(struct mlx5_vdpa_dev *mvdev, void *in, int inlen, u32 *rqtn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:138:int mlx5_vdpa_modify_rqt(struct mlx5_vdpa_dev *mvdev, void *in, int inlen, u32 rqtn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:139:void mlx5_vdpa_destroy_rqt(struct mlx5_vdpa_dev *mvdev, u32 rqtn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:140:int mlx5_vdpa_create_tir(struct mlx5_vdpa_dev *mvdev, void *in, u32 *tirn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:141:void mlx5_vdpa_destroy_tir(struct mlx5_vdpa_dev *mvdev, u32 tirn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:142:int mlx5_vdpa_alloc_transport_domain(struct mlx5_vdpa_dev *mvdev, u32 *tdn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:143:void mlx5_vdpa_dealloc_transport_domain(struct mlx5_vdpa_dev *mvdev, u32 tdn);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:144:int mlx5_vdpa_alloc_resources(struct mlx5_vdpa_dev *mvdev);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:145:void mlx5_vdpa_free_resources(struct mlx5_vdpa_dev *mvdev);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:146:int mlx5_vdpa_create_mkey(struct mlx5_vdpa_dev *mvdev, u32 *mkey, u32 *in,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-147-\t\t\t  int inlen);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:148:int mlx5_vdpa_destroy_mkey(struct mlx5_vdpa_dev *mvdev, u32 mkey);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:149:struct mlx5_vdpa_mr *mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-150-\t\t\t\t\t struct vhost_iotlb *iotlb);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:151:int mlx5_vdpa_init_mr_resources(struct mlx5_vdpa_dev *mvdev);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:152:void mlx5_vdpa_destroy_mr_resources(struct mlx5_vdpa_dev *mvdev);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:153:void mlx5_vdpa_clean_mrs(struct mlx5_vdpa_dev *mvdev);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:154:void mlx5_vdpa_get_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:155:\t\t      struct mlx5_vdpa_mr *mr);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:156:void mlx5_vdpa_put_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:157:\t\t      struct mlx5_vdpa_mr *mr);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:158:void mlx5_vdpa_update_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:159:\t\t\t struct mlx5_vdpa_mr *mr,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-160-\t\t\t unsigned int asid);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:161:int mlx5_vdpa_update_cvq_iotlb(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-162-\t\t\t\tstruct vhost_iotlb *iotlb,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-163-\t\t\t\tunsigned int asid);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:164:int mlx5_vdpa_create_dma_mr(struct mlx5_vdpa_dev *mvdev);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:165:int mlx5_vdpa_reset_mr(struct mlx5_vdpa_dev *mvdev, unsigned int asid);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:166:int mlx5_vdpa_exec_async_cmds(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:167:\t\t\t      struct mlx5_vdpa_async_cmd *cmds,\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-168-\t\t\t      int num_cmds);\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-169-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:170:#define mlx5_vdpa_err(__dev, format, ...)                                                          \\\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-171-\tdev_err((__dev)-\u003emdev-\u003edevice, \"%s:%d:(pid %d) error: \" format, __func__, __LINE__,        \\\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-174-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:175:#define mlx5_vdpa_warn(__dev, format, ...)                                                         \\\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-176-\tdev_warn((__dev)-\u003emdev-\u003edevice, \"%s:%d:(pid %d) warning: \" format, __func__, __LINE__,     \\\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-178-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:179:#define mlx5_vdpa_info(__dev, format, ...)                                                         \\\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-180-\tdev_info((__dev)-\u003emdev-\u003edevice, \"%s:%d:(pid %d): \" format, __func__, __LINE__,             \\\n--\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-182-\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h:183:#define mlx5_vdpa_dbg(__dev, format, ...)                                                          \\\ndrivers/vdpa/mlx5/core/mlx5_vdpa.h-184-\tdev_debug((__dev)-\u003emdev-\u003edevice, \"%s:%d:(pid %d): \" format, __func__, __LINE__,            \\\n--\ndrivers/vdpa/mlx5/core/mr.c-7-#include \u003clinux/string.h\u003e\ndrivers/vdpa/mlx5/core/mr.c:8:#include \u003clinux/mlx5/qp.h\u003e\ndrivers/vdpa/mlx5/core/mr.c:9:#include \"mlx5_vdpa.h\"\ndrivers/vdpa/mlx5/core/mr.c-10-\n--\ndrivers/vdpa/mlx5/core/mr.c=20=static int get_octo_len(u64 len, int page_shift)\n--\ndrivers/vdpa/mlx5/core/mr.c-28-\ndrivers/vdpa/mlx5/core/mr.c:29:static void mlx5_set_access_mode(void *mkc, int mode)\ndrivers/vdpa/mlx5/core/mr.c-30-{\n--\ndrivers/vdpa/mlx5/core/mr.c-34-\ndrivers/vdpa/mlx5/core/mr.c:35:static void populate_mtts(struct mlx5_vdpa_direct_mr *mr, __be64 *mtt)\ndrivers/vdpa/mlx5/core/mr.c-36-{\n--\ndrivers/vdpa/mlx5/core/mr.c-51-\ndrivers/vdpa/mlx5/core/mr.c:52:struct mlx5_create_mkey_mem {\ndrivers/vdpa/mlx5/core/mr.c-53-\tu8 out[MLX5_ST_SZ_BYTES(create_mkey_out)];\n--\ndrivers/vdpa/mlx5/core/mr.c-57-\ndrivers/vdpa/mlx5/core/mr.c:58:struct mlx5_destroy_mkey_mem {\ndrivers/vdpa/mlx5/core/mr.c-59-\tu8 out[MLX5_ST_SZ_BYTES(destroy_mkey_out)];\n--\ndrivers/vdpa/mlx5/core/mr.c-62-\ndrivers/vdpa/mlx5/core/mr.c:63:static void fill_create_direct_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:64:\t\t\t\t  struct mlx5_vdpa_direct_mr *mr,\ndrivers/vdpa/mlx5/core/mr.c:65:\t\t\t\t  struct mlx5_create_mkey_mem *mem)\ndrivers/vdpa/mlx5/core/mr.c-66-{\n--\ndrivers/vdpa/mlx5/core/mr.c-73-\tMLX5_SET(mkc, mkc, lr, !!(mr-\u003eperm \u0026 VHOST_MAP_RO));\ndrivers/vdpa/mlx5/core/mr.c:74:\tmlx5_set_access_mode(mkc, MLX5_MKC_ACCESS_MODE_MTT);\ndrivers/vdpa/mlx5/core/mr.c-75-\tMLX5_SET(mkc, mkc, qpn, 0xffffff);\n--\ndrivers/vdpa/mlx5/core/mr.c-89-\ndrivers/vdpa/mlx5/core/mr.c:90:static void create_direct_mr_end(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:91:\t\t\t\t struct mlx5_vdpa_direct_mr *mr,\ndrivers/vdpa/mlx5/core/mr.c:92:\t\t\t\t struct mlx5_create_mkey_mem *mem)\ndrivers/vdpa/mlx5/core/mr.c-93-{\n--\ndrivers/vdpa/mlx5/core/mr.c-95-\ndrivers/vdpa/mlx5/core/mr.c:96:\tmr-\u003emr = mlx5_idx_to_mkey(mkey_index);\ndrivers/vdpa/mlx5/core/mr.c-97-}\ndrivers/vdpa/mlx5/core/mr.c-98-\ndrivers/vdpa/mlx5/core/mr.c:99:static void fill_destroy_direct_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:100:\t\t\t\t   struct mlx5_vdpa_direct_mr *mr,\ndrivers/vdpa/mlx5/core/mr.c:101:\t\t\t\t   struct mlx5_destroy_mkey_mem *mem)\ndrivers/vdpa/mlx5/core/mr.c-102-{\n--\ndrivers/vdpa/mlx5/core/mr.c-106-\tMLX5_SET(destroy_mkey_in, in, opcode, MLX5_CMD_OP_DESTROY_MKEY);\ndrivers/vdpa/mlx5/core/mr.c:107:\tMLX5_SET(destroy_mkey_in, in, mkey_index, mlx5_mkey_to_idx(mr-\u003emr));\ndrivers/vdpa/mlx5/core/mr.c-108-}\ndrivers/vdpa/mlx5/core/mr.c-109-\ndrivers/vdpa/mlx5/core/mr.c:110:static void destroy_direct_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_direct_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-111-{\n--\ndrivers/vdpa/mlx5/core/mr.c-114-\ndrivers/vdpa/mlx5/core/mr.c:115:\tmlx5_vdpa_destroy_mkey(mvdev, mr-\u003emr);\ndrivers/vdpa/mlx5/core/mr.c-116-}\ndrivers/vdpa/mlx5/core/mr.c-117-\ndrivers/vdpa/mlx5/core/mr.c:118:static u64 map_start(struct vhost_iotlb_map *map, struct mlx5_vdpa_direct_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-119-{\n--\ndrivers/vdpa/mlx5/core/mr.c-122-\ndrivers/vdpa/mlx5/core/mr.c:123:static u64 map_end(struct vhost_iotlb_map *map, struct mlx5_vdpa_direct_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-124-{\n--\ndrivers/vdpa/mlx5/core/mr.c-127-\ndrivers/vdpa/mlx5/core/mr.c:128:static u64 maplen(struct vhost_iotlb_map *map, struct mlx5_vdpa_direct_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-129-{\n--\ndrivers/vdpa/mlx5/core/mr.c-135-\ndrivers/vdpa/mlx5/core/mr.c:136:static u64 indir_start_addr(struct mlx5_vdpa_mr *mkey)\ndrivers/vdpa/mlx5/core/mr.c-137-{\ndrivers/vdpa/mlx5/core/mr.c:138:\tstruct mlx5_vdpa_direct_mr *s;\ndrivers/vdpa/mlx5/core/mr.c-139-\ndrivers/vdpa/mlx5/core/mr.c:140:\ts = list_first_entry_or_null(\u0026mkey-\u003ehead, struct mlx5_vdpa_direct_mr, list);\ndrivers/vdpa/mlx5/core/mr.c-141-\tif (!s)\n--\ndrivers/vdpa/mlx5/core/mr.c-146-\ndrivers/vdpa/mlx5/core/mr.c:147:static u64 indir_len(struct mlx5_vdpa_mr *mkey)\ndrivers/vdpa/mlx5/core/mr.c-148-{\ndrivers/vdpa/mlx5/core/mr.c:149:\tstruct mlx5_vdpa_direct_mr *s;\ndrivers/vdpa/mlx5/core/mr.c:150:\tstruct mlx5_vdpa_direct_mr *e;\ndrivers/vdpa/mlx5/core/mr.c-151-\ndrivers/vdpa/mlx5/core/mr.c:152:\ts = list_first_entry_or_null(\u0026mkey-\u003ehead, struct mlx5_vdpa_direct_mr, list);\ndrivers/vdpa/mlx5/core/mr.c-153-\tif (!s)\n--\ndrivers/vdpa/mlx5/core/mr.c-155-\ndrivers/vdpa/mlx5/core/mr.c:156:\te = list_last_entry(\u0026mkey-\u003ehead, struct mlx5_vdpa_direct_mr, list);\ndrivers/vdpa/mlx5/core/mr.c-157-\n--\ndrivers/vdpa/mlx5/core/mr.c=164=static u32 klm_bcount(u64 size)\n--\ndrivers/vdpa/mlx5/core/mr.c-168-\ndrivers/vdpa/mlx5/core/mr.c:169:static void fill_indir(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mkey, void *in)\ndrivers/vdpa/mlx5/core/mr.c-170-{\ndrivers/vdpa/mlx5/core/mr.c:171:\tstruct mlx5_vdpa_direct_mr *dmr;\ndrivers/vdpa/mlx5/core/mr.c:172:\tstruct mlx5_klm *klmarr;\ndrivers/vdpa/mlx5/core/mr.c:173:\tstruct mlx5_klm *klm;\ndrivers/vdpa/mlx5/core/mr.c-174-\tbool first = true;\n--\ndrivers/vdpa/mlx5/core/mr.c=204=static int klm_byte_size(int nklms)\n--\ndrivers/vdpa/mlx5/core/mr.c-210-\ndrivers/vdpa/mlx5/core/mr.c:211:static int create_direct_keys(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-212-{\ndrivers/vdpa/mlx5/core/mr.c:213:\tstruct mlx5_vdpa_async_cmd *cmds;\ndrivers/vdpa/mlx5/core/mr.c:214:\tstruct mlx5_vdpa_direct_mr *dmr;\ndrivers/vdpa/mlx5/core/mr.c-215-\tint err = 0;\n--\ndrivers/vdpa/mlx5/core/mr.c-222-\tlist_for_each_entry(dmr, \u0026mr-\u003ehead, list) {\ndrivers/vdpa/mlx5/core/mr.c:223:\t\tstruct mlx5_create_mkey_mem *cmd_mem;\ndrivers/vdpa/mlx5/core/mr.c-224-\t\tint mttcount;\n--\ndrivers/vdpa/mlx5/core/mr.c-242-\ndrivers/vdpa/mlx5/core/mr.c:243:\terr = mlx5_vdpa_exec_async_cmds(mvdev, cmds, mr-\u003enum_directs);\ndrivers/vdpa/mlx5/core/mr.c-244-\tif (err) {\ndrivers/vdpa/mlx5/core/mr.c-245-\ndrivers/vdpa/mlx5/core/mr.c:246:\t\tmlx5_vdpa_err(mvdev, \"error issuing MTT mkey creation for direct mrs: %d\\n\", err);\ndrivers/vdpa/mlx5/core/mr.c-247-\t\tgoto done;\n--\ndrivers/vdpa/mlx5/core/mr.c-251-\tlist_for_each_entry(dmr, \u0026mr-\u003ehead, list) {\ndrivers/vdpa/mlx5/core/mr.c:252:\t\tstruct mlx5_vdpa_async_cmd *cmd = \u0026cmds[i++];\ndrivers/vdpa/mlx5/core/mr.c:253:\t\tstruct mlx5_create_mkey_mem *cmd_mem;\ndrivers/vdpa/mlx5/core/mr.c-254-\ndrivers/vdpa/mlx5/core/mr.c:255:\t\tcmd_mem = container_of(cmd-\u003eout, struct mlx5_create_mkey_mem, out);\ndrivers/vdpa/mlx5/core/mr.c-256-\n--\ndrivers/vdpa/mlx5/core/mr.c-260-\t\t\terr = err ? err : cmd-\u003eerr;\ndrivers/vdpa/mlx5/core/mr.c:261:\t\t\tmlx5_vdpa_err(mvdev, \"error creating MTT mkey [0x%llx, 0x%llx]: %d\\n\",\ndrivers/vdpa/mlx5/core/mr.c-262-\t\t\t\tdmr-\u003estart, dmr-\u003eend, cmd-\u003eerr);\n--\ndrivers/vdpa/mlx5/core/mr.c-267-\tfor (i = i-1; i \u003e= 0; i--) {\ndrivers/vdpa/mlx5/core/mr.c:268:\t\tstruct mlx5_create_mkey_mem *cmd_mem;\ndrivers/vdpa/mlx5/core/mr.c-269-\ndrivers/vdpa/mlx5/core/mr.c:270:\t\tcmd_mem = container_of(cmds[i].out, struct mlx5_create_mkey_mem, out);\ndrivers/vdpa/mlx5/core/mr.c-271-\t\tkvfree(cmd_mem);\n--\ndrivers/vdpa/mlx5/core/mr.c-277-\ndrivers/vdpa/mlx5/core/mr.c:278:DEFINE_FREE(free_cmds, struct mlx5_vdpa_async_cmd *, kvfree(_T))\ndrivers/vdpa/mlx5/core/mr.c:279:DEFINE_FREE(free_cmd_mem, struct mlx5_destroy_mkey_mem *, kvfree(_T))\ndrivers/vdpa/mlx5/core/mr.c-280-\ndrivers/vdpa/mlx5/core/mr.c:281:static int destroy_direct_keys(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-282-{\ndrivers/vdpa/mlx5/core/mr.c:283:\tstruct mlx5_destroy_mkey_mem *cmd_mem __free(free_cmd_mem) = NULL;\ndrivers/vdpa/mlx5/core/mr.c:284:\tstruct mlx5_vdpa_async_cmd *cmds __free(free_cmds) = NULL;\ndrivers/vdpa/mlx5/core/mr.c:285:\tstruct mlx5_vdpa_direct_mr *dmr;\ndrivers/vdpa/mlx5/core/mr.c-286-\tint err = 0;\n--\ndrivers/vdpa/mlx5/core/mr.c-302-\ndrivers/vdpa/mlx5/core/mr.c:303:\terr = mlx5_vdpa_exec_async_cmds(mvdev, cmds, mr-\u003enum_directs);\ndrivers/vdpa/mlx5/core/mr.c-304-\tif (err) {\ndrivers/vdpa/mlx5/core/mr.c-305-\ndrivers/vdpa/mlx5/core/mr.c:306:\t\tmlx5_vdpa_err(mvdev, \"error issuing MTT mkey deletion for direct mrs: %d\\n\", err);\ndrivers/vdpa/mlx5/core/mr.c-307-\t\treturn err;\n--\ndrivers/vdpa/mlx5/core/mr.c-311-\tlist_for_each_entry(dmr, \u0026mr-\u003ehead, list) {\ndrivers/vdpa/mlx5/core/mr.c:312:\t\tstruct mlx5_vdpa_async_cmd *cmd = \u0026cmds[i++];\ndrivers/vdpa/mlx5/core/mr.c-313-\n--\ndrivers/vdpa/mlx5/core/mr.c-316-\t\t\terr = err ? err : cmd-\u003eerr;\ndrivers/vdpa/mlx5/core/mr.c:317:\t\t\tmlx5_vdpa_err(mvdev, \"error deleting MTT mkey [0x%llx, 0x%llx]: %d\\n\",\ndrivers/vdpa/mlx5/core/mr.c-318-\t\t\t\tdmr-\u003estart, dmr-\u003eend, cmd-\u003eerr);\n--\ndrivers/vdpa/mlx5/core/mr.c-324-\ndrivers/vdpa/mlx5/core/mr.c:325:static int create_indirect_key(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-326-{\n--\ndrivers/vdpa/mlx5/core/mr.c-347-\tMLX5_SET(mkc, mkc, lr, 1);\ndrivers/vdpa/mlx5/core/mr.c:348:\tmlx5_set_access_mode(mkc, MLX5_MKC_ACCESS_MODE_KLMS);\ndrivers/vdpa/mlx5/core/mr.c-349-\tMLX5_SET(mkc, mkc, qpn, 0xffffff);\n--\ndrivers/vdpa/mlx5/core/mr.c-355-\tfill_indir(mvdev, mr, in);\ndrivers/vdpa/mlx5/core/mr.c:356:\terr = mlx5_vdpa_create_mkey(mvdev, \u0026mr-\u003emkey, in, inlen);\ndrivers/vdpa/mlx5/core/mr.c-357-\tkfree(in);\n--\ndrivers/vdpa/mlx5/core/mr.c-360-\ndrivers/vdpa/mlx5/core/mr.c:361:static void destroy_indirect_key(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mkey)\ndrivers/vdpa/mlx5/core/mr.c-362-{\ndrivers/vdpa/mlx5/core/mr.c:363:\tmlx5_vdpa_destroy_mkey(mvdev, mkey-\u003emkey);\ndrivers/vdpa/mlx5/core/mr.c-364-}\ndrivers/vdpa/mlx5/core/mr.c-365-\ndrivers/vdpa/mlx5/core/mr.c:366:static int map_direct_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_direct_mr *mr,\ndrivers/vdpa/mlx5/core/mr.c-367-\t\t\t struct vhost_iotlb *iotlb)\n--\ndrivers/vdpa/mlx5/core/mr.c-404-\t\t\tif (!sg) {\ndrivers/vdpa/mlx5/core/mr.c:405:\t\t\t\tmlx5_vdpa_warn(mvdev, \"sg null. start 0x%llx, end 0x%llx\\n\",\ndrivers/vdpa/mlx5/core/mr.c-406-\t\t\t\t\t       map-\u003estart, map-\u003elast + 1);\n--\ndrivers/vdpa/mlx5/core/mr.c-431-\ndrivers/vdpa/mlx5/core/mr.c:432:static void unmap_direct_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_direct_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-433-{\n--\ndrivers/vdpa/mlx5/core/mr.c-440-\ndrivers/vdpa/mlx5/core/mr.c:441:static int add_direct_chain(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:442:\t\t\t    struct mlx5_vdpa_mr *mr,\ndrivers/vdpa/mlx5/core/mr.c-443-\t\t\t    u64 start,\n--\ndrivers/vdpa/mlx5/core/mr.c-447-{\ndrivers/vdpa/mlx5/core/mr.c:448:\tstruct mlx5_vdpa_direct_mr *dmr;\ndrivers/vdpa/mlx5/core/mr.c:449:\tstruct mlx5_vdpa_direct_mr *n;\ndrivers/vdpa/mlx5/core/mr.c-450-\tLIST_HEAD(tmp);\n--\ndrivers/vdpa/mlx5/core/mr.c-496- */\ndrivers/vdpa/mlx5/core/mr.c:497:static int create_user_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:498:\t\t\t  struct mlx5_vdpa_mr *mr,\ndrivers/vdpa/mlx5/core/mr.c-499-\t\t\t  struct vhost_iotlb *iotlb)\ndrivers/vdpa/mlx5/core/mr.c-500-{\ndrivers/vdpa/mlx5/core/mr.c:501:\tstruct mlx5_vdpa_direct_mr *dmr;\ndrivers/vdpa/mlx5/core/mr.c:502:\tstruct mlx5_vdpa_direct_mr *n;\ndrivers/vdpa/mlx5/core/mr.c-503-\tstruct vhost_iotlb_map *map;\n--\ndrivers/vdpa/mlx5/core/mr.c-564-\ndrivers/vdpa/mlx5/core/mr.c:565:static int create_dma_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-566-{\n--\ndrivers/vdpa/mlx5/core/mr.c-584-\ndrivers/vdpa/mlx5/core/mr.c:585:\terr = mlx5_vdpa_create_mkey(mvdev, \u0026mr-\u003emkey, in, inlen);\ndrivers/vdpa/mlx5/core/mr.c-586-\tif (!err)\n--\ndrivers/vdpa/mlx5/core/mr.c-592-\ndrivers/vdpa/mlx5/core/mr.c:593:static void destroy_dma_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-594-{\ndrivers/vdpa/mlx5/core/mr.c:595:\tmlx5_vdpa_destroy_mkey(mvdev, mr-\u003emkey);\ndrivers/vdpa/mlx5/core/mr.c-596-}\n--\ndrivers/vdpa/mlx5/core/mr.c=622=static void prune_iotlb(struct vhost_iotlb *iotlb)\n--\ndrivers/vdpa/mlx5/core/mr.c-626-\ndrivers/vdpa/mlx5/core/mr.c:627:static void destroy_user_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-628-{\ndrivers/vdpa/mlx5/core/mr.c:629:\tstruct mlx5_vdpa_direct_mr *dmr;\ndrivers/vdpa/mlx5/core/mr.c:630:\tstruct mlx5_vdpa_direct_mr *n;\ndrivers/vdpa/mlx5/core/mr.c-631-\n--\ndrivers/vdpa/mlx5/core/mr.c-640-\ndrivers/vdpa/mlx5/core/mr.c:641:static void _mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-642-{\n--\ndrivers/vdpa/mlx5/core/mr.c-663-\ndrivers/vdpa/mlx5/core/mr.c:664:static void mlx5_vdpa_mr_gc_handler(struct work_struct *work)\ndrivers/vdpa/mlx5/core/mr.c-665-{\ndrivers/vdpa/mlx5/core/mr.c:666:\tstruct mlx5_vdpa_mr_resources *mres;\ndrivers/vdpa/mlx5/core/mr.c:667:\tstruct mlx5_vdpa_mr *mr, *tmp;\ndrivers/vdpa/mlx5/core/mr.c:668:\tstruct mlx5_vdpa_dev *mvdev;\ndrivers/vdpa/mlx5/core/mr.c-669-\ndrivers/vdpa/mlx5/core/mr.c:670:\tmres = container_of(work, struct mlx5_vdpa_mr_resources, gc_dwork_ent.work);\ndrivers/vdpa/mlx5/core/mr.c-671-\n--\ndrivers/vdpa/mlx5/core/mr.c-679-\ndrivers/vdpa/mlx5/core/mr.c:680:\tmvdev = container_of(mres, struct mlx5_vdpa_dev, mres);\ndrivers/vdpa/mlx5/core/mr.c-681-\ndrivers/vdpa/mlx5/core/mr.c-682-\tlist_for_each_entry_safe(mr, tmp, \u0026mres-\u003emr_gc_list_head, mr_list) {\ndrivers/vdpa/mlx5/core/mr.c:683:\t\t_mlx5_vdpa_destroy_mr(mvdev, mr);\ndrivers/vdpa/mlx5/core/mr.c-684-\t}\n--\ndrivers/vdpa/mlx5/core/mr.c-688-\ndrivers/vdpa/mlx5/core/mr.c:689:static void _mlx5_vdpa_put_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:690:\t\t\t      struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-691-{\ndrivers/vdpa/mlx5/core/mr.c:692:\tstruct mlx5_vdpa_mr_resources *mres = \u0026mvdev-\u003emres;\ndrivers/vdpa/mlx5/core/mr.c-693-\n--\ndrivers/vdpa/mlx5/core/mr.c-703-\ndrivers/vdpa/mlx5/core/mr.c:704:void mlx5_vdpa_put_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:705:\t\t      struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-706-{\ndrivers/vdpa/mlx5/core/mr.c-707-\tmutex_lock(\u0026mvdev-\u003emres.lock);\ndrivers/vdpa/mlx5/core/mr.c:708:\t_mlx5_vdpa_put_mr(mvdev, mr);\ndrivers/vdpa/mlx5/core/mr.c-709-\tmutex_unlock(\u0026mvdev-\u003emres.lock);\n--\ndrivers/vdpa/mlx5/core/mr.c-711-\ndrivers/vdpa/mlx5/core/mr.c:712:static void _mlx5_vdpa_get_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:713:\t\t\t      struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-714-{\n--\ndrivers/vdpa/mlx5/core/mr.c-720-\ndrivers/vdpa/mlx5/core/mr.c:721:void mlx5_vdpa_get_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:722:\t\t      struct mlx5_vdpa_mr *mr)\ndrivers/vdpa/mlx5/core/mr.c-723-{\ndrivers/vdpa/mlx5/core/mr.c-724-\tmutex_lock(\u0026mvdev-\u003emres.lock);\ndrivers/vdpa/mlx5/core/mr.c:725:\t_mlx5_vdpa_get_mr(mvdev, mr);\ndrivers/vdpa/mlx5/core/mr.c-726-\tmutex_unlock(\u0026mvdev-\u003emres.lock);\n--\ndrivers/vdpa/mlx5/core/mr.c-728-\ndrivers/vdpa/mlx5/core/mr.c:729:void mlx5_vdpa_update_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:730:\t\t\t struct mlx5_vdpa_mr *new_mr,\ndrivers/vdpa/mlx5/core/mr.c-731-\t\t\t unsigned int asid)\ndrivers/vdpa/mlx5/core/mr.c-732-{\ndrivers/vdpa/mlx5/core/mr.c:733:\tstruct mlx5_vdpa_mr *old_mr = mvdev-\u003emres.mr[asid];\ndrivers/vdpa/mlx5/core/mr.c-734-\n--\ndrivers/vdpa/mlx5/core/mr.c-736-\ndrivers/vdpa/mlx5/core/mr.c:737:\t_mlx5_vdpa_put_mr(mvdev, old_mr);\ndrivers/vdpa/mlx5/core/mr.c-738-\tmvdev-\u003emres.mr[asid] = new_mr;\n--\ndrivers/vdpa/mlx5/core/mr.c-742-\ndrivers/vdpa/mlx5/core/mr.c:743:static void mlx5_vdpa_show_mr_leaks(struct mlx5_vdpa_dev *mvdev)\ndrivers/vdpa/mlx5/core/mr.c-744-{\ndrivers/vdpa/mlx5/core/mr.c:745:\tstruct mlx5_vdpa_mr *mr;\ndrivers/vdpa/mlx5/core/mr.c-746-\n--\ndrivers/vdpa/mlx5/core/mr.c-750-\ndrivers/vdpa/mlx5/core/mr.c:751:\t\tmlx5_vdpa_warn(mvdev, \"mkey still alive after resource delete: \"\ndrivers/vdpa/mlx5/core/mr.c-752-\t\t\t\t      \"mr: %p, mkey: 0x%x, refcount: %u\\n\",\n--\ndrivers/vdpa/mlx5/core/mr.c-759-\ndrivers/vdpa/mlx5/core/mr.c:760:void mlx5_vdpa_clean_mrs(struct mlx5_vdpa_dev *mvdev)\ndrivers/vdpa/mlx5/core/mr.c-761-{\n--\ndrivers/vdpa/mlx5/core/mr.c-765-\tfor (int i = 0; i \u003c MLX5_VDPA_NUM_AS; i++)\ndrivers/vdpa/mlx5/core/mr.c:766:\t\tmlx5_vdpa_update_mr(mvdev, NULL, i);\ndrivers/vdpa/mlx5/core/mr.c-767-\n--\ndrivers/vdpa/mlx5/core/mr.c-769-\ndrivers/vdpa/mlx5/core/mr.c:770:\tmlx5_vdpa_show_mr_leaks(mvdev);\ndrivers/vdpa/mlx5/core/mr.c-771-}\ndrivers/vdpa/mlx5/core/mr.c-772-\ndrivers/vdpa/mlx5/core/mr.c:773:static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c:774:\t\t\t\tstruct mlx5_vdpa_mr *mr,\ndrivers/vdpa/mlx5/core/mr.c-775-\t\t\t\tstruct vhost_iotlb *iotlb)\n--\ndrivers/vdpa/mlx5/core/mr.c-812-\ndrivers/vdpa/mlx5/core/mr.c:813:struct mlx5_vdpa_mr *mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c-814-\t\t\t\t\t struct vhost_iotlb *iotlb)\ndrivers/vdpa/mlx5/core/mr.c-815-{\ndrivers/vdpa/mlx5/core/mr.c:816:\tstruct mlx5_vdpa_mr *mr;\ndrivers/vdpa/mlx5/core/mr.c-817-\tint err;\n--\ndrivers/vdpa/mlx5/core/mr.c-823-\tmutex_lock(\u0026mvdev-\u003emres.lock);\ndrivers/vdpa/mlx5/core/mr.c:824:\terr = _mlx5_vdpa_create_mr(mvdev, mr, iotlb);\ndrivers/vdpa/mlx5/core/mr.c-825-\tmutex_unlock(\u0026mvdev-\u003emres.lock);\n--\ndrivers/vdpa/mlx5/core/mr.c-838-\ndrivers/vdpa/mlx5/core/mr.c:839:int mlx5_vdpa_update_cvq_iotlb(struct mlx5_vdpa_dev *mvdev,\ndrivers/vdpa/mlx5/core/mr.c-840-\t\t\t\tstruct vhost_iotlb *iotlb,\n--\ndrivers/vdpa/mlx5/core/mr.c-857-\ndrivers/vdpa/mlx5/core/mr.c:858:int mlx5_vdpa_create_dma_mr(struct mlx5_vdpa_dev *mvdev)\ndrivers/vdpa/mlx5/core/mr.c-859-{\ndrivers/vdpa/mlx5/core/mr.c:860:\tstruct mlx5_vdpa_mr *mr;\ndrivers/vdpa/mlx5/core/mr.c-861-\ndrivers/vdpa/mlx5/core/mr.c:862:\tmr = mlx5_vdpa_create_mr(mvdev, NULL);\ndrivers/vdpa/mlx5/core/mr.c-863-\tif (IS_ERR(mr))\n--\ndrivers/vdpa/mlx5/core/mr.c-865-\ndrivers/vdpa/mlx5/core/mr.c:866:\tmlx5_vdpa_update_mr(mvdev, mr, 0);\ndrivers/vdpa/mlx5/core/mr.c-867-\ndrivers/vdpa/mlx5/core/mr.c:868:\treturn mlx5_vdpa_update_cvq_iotlb(mvdev, NULL, 0);\ndrivers/vdpa/mlx5/core/mr.c-869-}\ndrivers/vdpa/mlx5/core/mr.c-870-\ndrivers/vdpa/mlx5/core/mr.c:871:int mlx5_vdpa_reset_mr(struct mlx5_vdpa_dev *mvdev, unsigned int asid)\ndrivers/vdpa/mlx5/core/mr.c-872-{\n--\ndrivers/vdpa/mlx5/core/mr.c-875-\ndrivers/vdpa/mlx5/core/mr.c:876:\tmlx5_vdpa_update_mr(mvdev, NULL, asid);\ndrivers/vdpa/mlx5/core/mr.c-877-\ndrivers/vdpa/mlx5/core/mr.c-878-\tif (asid == 0 \u0026\u0026 MLX5_CAP_GEN(mvdev-\u003emdev, umem_uid_0)) {\ndrivers/vdpa/mlx5/core/mr.c:879:\t\tif (mlx5_vdpa_create_dma_mr(mvdev))\ndrivers/vdpa/mlx5/core/mr.c:880:\t\t\tmlx5_vdpa_warn(mvdev, \"create DMA MR failed\\n\");\ndrivers/vdpa/mlx5/core/mr.c-881-\t} else {\ndrivers/vdpa/mlx5/core/mr.c:882:\t\tmlx5_vdpa_update_cvq_iotlb(mvdev, NULL, asid);\ndrivers/vdpa/mlx5/core/mr.c-883-\t}\n--\ndrivers/vdpa/mlx5/core/mr.c-887-\ndrivers/vdpa/mlx5/core/mr.c:888:int mlx5_vdpa_init_mr_resources(struct mlx5_vdpa_dev *mvdev)\ndrivers/vdpa/mlx5/core/mr.c-889-{\ndrivers/vdpa/mlx5/core/mr.c:890:\tstruct mlx5_vdpa_mr_resources *mres = \u0026mvdev-\u003emres;\ndrivers/vdpa/mlx5/core/mr.c-891-\ndrivers/vdpa/mlx5/core/mr.c:892:\tmres-\u003ewq_gc = create_singlethread_workqueue(\"mlx5_vdpa_mr_gc\");\ndrivers/vdpa/mlx5/core/mr.c-893-\tif (!mres-\u003ewq_gc)\n--\ndrivers/vdpa/mlx5/core/mr.c-895-\ndrivers/vdpa/mlx5/core/mr.c:896:\tINIT_DELAYED_WORK(\u0026mres-\u003egc_dwork_ent, mlx5_vdpa_mr_gc_handler);\ndrivers/vdpa/mlx5/core/mr.c-897-\n--\ndrivers/vdpa/mlx5/core/mr.c-905-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 76593
							output: 39
							thoughts: 301
						

**Fuzzing mlx5_vdpa: A Promising Target**

Okay, so `mlx5_vdpa`... right, that's the vDPA driver specifically for the mlx5 hardware. That clicks. vDPA essentially provides a virtio interface to hardware, which means QEMU can use `vhost-vdpa` to expose the mlx5 device to a guest VM as if it were a virtio device. Neat! The host, of course, *must* have the mlx5 hardware. If syzkaller is running on a host equipped with an mlx5 device, then bingo, we can potentially fuzz it. The fact that syzkaller has a `syz-cluster` author indicates it's likely been tested on existing syzkaller infrastructure, which is a good sign. Yes, this is worth exploring, so I'll return WorthFuzzing=true.

Now, let's look at the focus symbols: `mlx5_ib_stage_bfrag_init`, `mlx5_ib_stage_bfrag_cleanup`, `create_kernel_qp`, and `_create_kernel_qp`. These look like potential areas where bugs might be lurking.

The enable configs are equally important: `MLX5_INFINIBAND`, `MLX5_CORE`, and `INFINIBAND`. Ah, `MLX5_INFINIBAND` seems to be the most critical one. Now, are there any other related configurations we should be aware of? Let me think... if we want to create QPs from userspace, we might also need `CONFIG_INFINIBAND_USER_ACCESS`. Time to check `drivers/infiniband/hw/mlx5/Kconfig` again to make sure we haven't missed anything.

{
  "Expression": "INFINIBAND_USER_ACCESS",
  "PathPrefix": "drivers/infiniband/hw/mlx5/"
}

{
  "Output": "drivers/infiniband/hw/mlx5/Makefile=29=mlx5_ib-$(CONFIG_MLX5_ESWITCH) += ib_rep.o\ndrivers/infiniband/hw/mlx5/Makefile:30:mlx5_ib-$(CONFIG_INFINIBAND_USER_ACCESS) += devx.o \\\ndrivers/infiniband/hw/mlx5/Makefile-31-\t\t\t\t\t    qos.o \\\n--\ndrivers/infiniband/hw/mlx5/devx.h=12=struct devx_obj {\n--\ndrivers/infiniband/hw/mlx5/devx.h-25-};\ndrivers/infiniband/hw/mlx5/devx.h:26:#if IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS)\ndrivers/infiniband/hw/mlx5/devx.h-27-int mlx5_ib_devx_create(struct mlx5_ib_dev *dev, bool is_user, u64 req_ucaps);\n--\ndrivers/infiniband/hw/mlx5/main.c=4781=static int mlx5_ib_stage_caps_init(struct mlx5_ib_dev *dev)\n--\ndrivers/infiniband/hw/mlx5/main.c-4811-\ndrivers/infiniband/hw/mlx5/main.c:4812:\tif (IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS))\ndrivers/infiniband/hw/mlx5/main.c-4813-\t\tdev-\u003eib_dev.driver_def = mlx5_ib_defs;\n"
}

gemini-3.1-pro-preview

null

null

							input: 77730
							output: 181
							thoughts: 223
						

**My Assessment of the Patch's Fuzzing Impact**

Okay, so this patch looks promising for userspace fuzzing. The key here is `INFINIBAND_USER_ACCESS`. It seems directly relevant, so I'll definitely add it to the `EnableConfigs`.

Let me break down what I'm seeing:

First, the `FocusSymbols` are: `mlx5_ib_stage_bfrag_init`, `mlx5_ib_stage_bfrag_cleanup`, `create_kernel_qp`, and `_create_kernel_qp`. These functions are clearly the points of interest within the Mellanox Infiniband driver, touching on buffer fragment staging and kernel queue pair creation.

The `EnableConfigs` list is crucial. I'm adding `MLX5_INFINIBAND`, `MLX5_CORE`, `INFINIBAND`, and, of course, the pivotal `INFINIBAND_USER_ACCESS`.

My reasoning is straightforward: this patch is changing the core logic of the mlx5 infiniband driver. Specifically, it's modifying the QP (Queue Pair) creation and initialization process, specifically when the `qp_latency_sensitive_disable` capability is in place. It's skipping the allocation of `fp_bfreg` and setting `latency_sensitive` in the driver, so this affects the fundamental behavior of the hardware driver. Syzkaller testing also implies this code path is reachable in a fuzzing context. Given that this is a functional change within a hardware driver, and it's been exposed by fuzzing, it's definitely something I want to include in my analysis.

Alright, I'm satisfied. Let's call `set-results`.

{
  "EnableConfigs": [
    "MLX5_INFINIBAND",
    "MLX5_CORE",
    "INFINIBAND",
    "INFINIBAND_USER_ACCESS"
  ],
  "FocusSymbols": [
    "mlx5_ib_stage_bfrag_init",
    "mlx5_ib_stage_bfrag_cleanup",
    "create_kernel_qp",
    "_create_kernel_qp"
  ],
  "Reasoning": "The patch modifies the mlx5 infiniband driver to skip allocating fp_bfreg and setting latency_sensitive when the qp_latency_sensitive_disable capability is set. This is a functional change in the hardware driver's queue pair creation and initialization logic. Since it was tested by syzkaller, it is reachable in the fuzzing environment.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MLX5_INFINIBAND",
    "MLX5_CORE",
    "INFINIBAND",
    "INFINIBAND_USER_ACCESS"
  ],
  "FocusSymbols": [
    "mlx5_ib_stage_bfrag_init",
    "mlx5_ib_stage_bfrag_cleanup",
    "create_kernel_qp",
    "_create_kernel_qp"
  ],
  "Reasoning": "The patch modifies the mlx5 infiniband driver to skip allocating fp_bfreg and setting latency_sensitive when the qp_latency_sensitive_disable capability is set. This is a functional change in the hardware driver's queue pair creation and initialization logic. Since it was tested by syzkaller, it is reachable in the fuzzing environment.",
  "WorthFuzzing": true
}