AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/08/02 04:57 flow patch-triage
0m Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Broadcom NetXtreme-C/E (bnxt) Ethernet driver. This is a vendor-specific PCIe NIC driver that requires physical hardware not emulated in standard QEMU environments, making it unreachable for fuzzing in virtualized environments.",
  "WorthFuzzing": false
}
1/1 2026/08/02 04:57 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit 3f0cc151881c276d9ec44df2121a116d062440de\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Aug 2 04:57:43 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c\nindex 7513618793daf..a0ea8c994b320 100644\n--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c\n+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c\n@@ -4611,11 +4611,14 @@ static void bnxt_init_one_rx_agg_ring_rxbd(struct bnxt *bp,\n \t\ttype = ((u32)rxr-\u003erx_page_size \u003c\u003c RX_BD_LEN_SHIFT) |\n \t\t\tRX_BD_TYPE_RX_AGG_BD;\n \n-\t\t/* On P7, setting EOP will cause the chip to disable\n-\t\t * Relaxed Ordering (RO) for TPA data.  Disable EOP for\n-\t\t * potentially higher performance with RO.\n+\t\t/* Disable EOP if TPA is enabled to prevent overlapping zero\n+\t\t * padding with the next segment's data.  On P7_PLUS, EOP will\n+\t\t * automatically disable Relaxed Ordering (RO) to prevent\n+\t\t * potential data corruption (and may degrade performance).  On\n+\t\t * older chips, RO will not be automatically disabled and may\n+\t\t * cause corruption.\n \t\t */\n-\t\tif (BNXT_CHIP_P5_AND_MINUS(bp) || !(bp-\u003eflags \u0026 BNXT_FLAG_TPA))\n+\t\tif (!(bp-\u003eflags \u0026 BNXT_FLAG_TPA))\n \t\t\ttype |= RX_BD_FLAGS_AGG_EOP;\n \n \t\tbnxt_init_rxbd_pages(ring, type);\n@@ -6704,22 +6707,36 @@ int bnxt_get_nr_rss_ctxs(struct bnxt *bp, int rx_rings)\n static void bnxt_fill_hw_rss_tbl(struct bnxt *bp, struct bnxt_vnic_info *vnic)\n {\n \tbool no_rss = !(vnic-\u003eflags \u0026 BNXT_VNIC_RSS_FLAG);\n-\tu16 i, j;\n+\tu16 i, j, min_j = bp-\u003erx_nr_rings - 1;\n+\n+\tif (!vnic-\u003erss_table)\n+\t\tgoto skip_rss_tbl;\n \n \t/* Fill the RSS indirection table with ring group ids */\n \tfor (i = 0, j = 0; i \u003c HW_HASH_INDEX_SIZE; i++) {\n \t\tif (!no_rss)\n \t\t\tj = bp-\u003erss_indir_tbl[i];\n+\t\tmin_j = min(j, min_j);\n \t\tvnic-\u003erss_table[i] = cpu_to_le16(vnic-\u003efw_grp_ids[j]);\n \t}\n+\n+skip_rss_tbl:\n+\tif (vnic-\u003erss_table \u0026\u0026 !no_rss)\n+\t\tvnic-\u003edefault_rx_ring = min_j;\n+\telse if (vnic-\u003eflags \u0026 BNXT_VNIC_RFS_FLAG)\n+\t\tvnic-\u003edefault_rx_ring = vnic-\u003evnic_id - 1;\n+\telse if ((vnic-\u003evnic_id == 1) \u0026\u0026 BNXT_CHIP_TYPE_NITRO_A0(bp))\n+\t\tvnic-\u003edefault_rx_ring = bp-\u003erx_nr_rings - 1;\n+\telse\n+\t\tvnic-\u003edefault_rx_ring = 0;\n }\n \n static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp,\n \t\t\t\t    struct bnxt_vnic_info *vnic)\n {\n+\tu16 tbl_size, i, min_j = bp-\u003erx_nr_rings - 1;\n \t__le16 *ring_tbl = vnic-\u003erss_table;\n \tstruct bnxt_rx_ring_info *rxr;\n-\tu16 tbl_size, i;\n \n \ttbl_size = bnxt_get_rxfh_indir_size(bp-\u003edev);\n \n@@ -6732,6 +6749,7 @@ static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp,\n \t\t\tj = ethtool_rxfh_context_indir(vnic-\u003erss_ctx)[i];\n \t\telse\n \t\t\tj = bp-\u003erss_indir_tbl[i];\n+\t\tmin_j = min(j, min_j);\n \t\trxr = \u0026bp-\u003erx_ring[j];\n \n \t\tring_id = rxr-\u003erx_ring_struct.fw_ring_id;\n@@ -6739,19 +6757,15 @@ static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp,\n \t\tring_id = bnxt_cp_ring_for_rx(bp, rxr);\n \t\t*ring_tbl++ = cpu_to_le16(ring_id);\n \t}\n+\tvnic-\u003edefault_rx_ring = min_j;\n }\n \n static void\n __bnxt_hwrm_vnic_set_rss(struct bnxt *bp, struct hwrm_vnic_rss_cfg_input *req,\n \t\t\t struct bnxt_vnic_info *vnic)\n {\n-\tif (bp-\u003eflags \u0026 BNXT_FLAG_CHIP_P5_PLUS) {\n-\t\tbnxt_fill_hw_rss_tbl_p5(bp, vnic);\n-\t\tif (bp-\u003eflags \u0026 BNXT_FLAG_CHIP_P7)\n-\t\t\treq-\u003eflags |= VNIC_RSS_CFG_REQ_FLAGS_IPSEC_HASH_TYPE_CFG_SUPPORT;\n-\t} else {\n-\t\tbnxt_fill_hw_rss_tbl(bp, vnic);\n-\t}\n+\tif (bp-\u003eflags \u0026 BNXT_FLAG_CHIP_P7)\n+\t\treq-\u003eflags |= VNIC_RSS_CFG_REQ_FLAGS_IPSEC_HASH_TYPE_CFG_SUPPORT;\n \n \tif (bp-\u003erss_hash_delta) {\n \t\treq-\u003ehash_type = cpu_to_le32(bp-\u003erss_hash_delta);\n@@ -6803,6 +6817,7 @@ static int bnxt_hwrm_vnic_set_rss_p5(struct bnxt *bp,\n \tif (!set_rss)\n \t\treturn hwrm_req_send(bp, req);\n \n+\tbnxt_fill_hw_rss_tbl_p5(bp, vnic);\n \t__bnxt_hwrm_vnic_set_rss(bp, req, vnic);\n \tring_tbl_map = vnic-\u003erss_table_dma_addr;\n \tnr_ctxs = bnxt_get_nr_rss_ctxs(bp, bp-\u003erx_nr_rings);\n@@ -6939,8 +6954,9 @@ int bnxt_hwrm_vnic_cfg(struct bnxt *bp, struct bnxt_vnic_info *vnic)\n \t\treturn rc;\n \n \tif (bp-\u003eflags \u0026 BNXT_FLAG_CHIP_P5_PLUS) {\n-\t\tstruct bnxt_rx_ring_info *rxr = \u0026bp-\u003erx_ring[0];\n+\t\tstruct bnxt_rx_ring_info *rxr;\n \n+\t\trxr = \u0026bp-\u003erx_ring[vnic-\u003edefault_rx_ring];\n \t\treq-\u003edefault_rx_ring_id =\n \t\t\tcpu_to_le16(rxr-\u003erx_ring_struct.fw_ring_id);\n \t\treq-\u003edefault_cmpl_ring_id =\n@@ -6973,13 +6989,7 @@ int bnxt_hwrm_vnic_cfg(struct bnxt *bp, struct bnxt_vnic_info *vnic)\n \t\treq-\u003ecos_rule = cpu_to_le16(0xffff);\n \t}\n \n-\tif (vnic-\u003eflags \u0026 BNXT_VNIC_RSS_FLAG)\n-\t\tring = 0;\n-\telse if (vnic-\u003eflags \u0026 BNXT_VNIC_RFS_FLAG)\n-\t\tring = vnic-\u003evnic_id - 1;\n-\telse if ((vnic-\u003evnic_id == 1) \u0026\u0026 BNXT_CHIP_TYPE_NITRO_A0(bp))\n-\t\tring = bp-\u003erx_nr_rings - 1;\n-\n+\tring = vnic-\u003edefault_rx_ring;\n \tgrp_idx = bp-\u003erx_ring[ring].bnapi-\u003eindex;\n \treq-\u003edflt_ring_grp = cpu_to_le16(bp-\u003egrp_info[grp_idx].fw_grp_id);\n \treq-\u003elb_rule = cpu_to_le16(0xffff);\n@@ -10866,6 +10876,7 @@ static int __bnxt_setup_vnic(struct bnxt *bp, struct bnxt_vnic_info *vnic)\n \t}\n \n skip_rss_ctx:\n+\tbnxt_fill_hw_rss_tbl(bp, vnic);\n \t/* configure default vnic, ring grp */\n \trc = bnxt_hwrm_vnic_cfg(bp, vnic);\n \tif (rc) {\n@@ -11090,6 +11101,11 @@ static int bnxt_set_vnic_mru_p5(struct bnxt *bp, struct bnxt_vnic_info *vnic,\n \t\t\t\t   vnic-\u003evnic_id, rc);\n \t\t\treturn rc;\n \t\t}\n+\t\tif (rxr_id == vnic-\u003edefault_rx_ring) {\n+\t\t\trc = bnxt_hwrm_vnic_cfg(bp, vnic);\n+\t\t\tif (rc)\n+\t\t\t\treturn rc;\n+\t\t}\n \t}\n \tvnic-\u003emru = mru;\n \tbnxt_hwrm_vnic_update(bp, vnic,\n@@ -11171,6 +11187,9 @@ static int bnxt_setup_nitroa0_vnic(struct bnxt *bp)\n \t\treturn rc;\n \t}\n \n+\t/* Setup the proper default RX ring */\n+\tbnxt_fill_hw_rss_tbl(bp, vnic);\n+\n \trc = bnxt_hwrm_vnic_cfg(bp, vnic);\n \tif (rc) {\n \t\tnetdev_err(bp-\u003edev, \"Cannot allocate special vnic for NS2 A0: %x\\n\",\ndiff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h\nindex 6335dfc14c985..44ea8fc7b766d 100644\n--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h\n+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h\n@@ -1334,6 +1334,7 @@ struct bnxt_vnic_info {\n #define BNXT_VNIC_RSSCTX_FLAG\t\t0x40\n \tstruct ethtool_rxfh_context *rss_ctx;\n \tu32\t\tvnic_id;\n+\tu16\t\tdefault_rx_ring;\n };\n \n struct bnxt_rss_ctx {\ndiff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c\nindex 5d41dc1bc7820..b89293dfd2d1e 100644\n--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c\n+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c\n@@ -495,12 +495,15 @@ static int bnxt_ptp_enable(struct ptp_clock_info *ptp_info,\n \t\treturn rc;\n \tcase PTP_CLK_REQ_PPS:\n \t\t/* Configure PHC PPS IN */\n-\t\trc = bnxt_ptp_cfg_pin(bp, 0, BNXT_PPS_PIN_PPS_IN);\n+\t\tpin_id = 0;\n+\t\tif (!on)\n+\t\t\tbreak;\n+\t\trc = bnxt_ptp_cfg_pin(bp, pin_id, BNXT_PPS_PIN_PPS_IN);\n \t\tif (rc)\n \t\t\treturn rc;\n \t\trc = bnxt_ptp_cfg_event(bp, BNXT_PPS_EVENT_INTERNAL);\n \t\tif (!rc)\n-\t\t\tptp-\u003epps_info.pins[0].event = BNXT_PPS_EVENT_INTERNAL;\n+\t\t\tptp-\u003epps_info.pins[pin_id].event = BNXT_PPS_EVENT_INTERNAL;\n \t\treturn rc;\n \tdefault:\n \t\tnetdev_err(ptp-\u003ebp-\u003edev, \"Unrecognized PIN function\\n\");\n"
}
2/1 2026/08/02 04:57 agent patch-evaluator
0m Model: 
best-expensive

Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Broadcom NetXtreme-C/E (bnxt) Ethernet driver. This is a vendor-specific PCIe NIC driver that requires physical hardware not emulated in standard QEMU environments, making it unreachable for fuzzing in virtualized environments.",
  "WorthFuzzing": false
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit 3f0cc151881c276d9ec44df2121a116d062440de
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Aug 2 04:57:43 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 7513618793daf..a0ea8c994b320 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4611,11 +4611,14 @@ static void bnxt_init_one_rx_agg_ring_rxbd(struct bnxt *bp,
 		type = ((u32)rxr->rx_page_size << RX_BD_LEN_SHIFT) |
 			RX_BD_TYPE_RX_AGG_BD;
 
-		/* On P7, setting EOP will cause the chip to disable
-		 * Relaxed Ordering (RO) for TPA data.  Disable EOP for
-		 * potentially higher performance with RO.
+		/* Disable EOP if TPA is enabled to prevent overlapping zero
+		 * padding with the next segment's data.  On P7_PLUS, EOP will
+		 * automatically disable Relaxed Ordering (RO) to prevent
+		 * potential data corruption (and may degrade performance).  On
+		 * older chips, RO will not be automatically disabled and may
+		 * cause corruption.
 		 */
-		if (BNXT_CHIP_P5_AND_MINUS(bp) || !(bp->flags & BNXT_FLAG_TPA))
+		if (!(bp->flags & BNXT_FLAG_TPA))
 			type |= RX_BD_FLAGS_AGG_EOP;
 
 		bnxt_init_rxbd_pages(ring, type);
@@ -6704,22 +6707,36 @@ int bnxt_get_nr_rss_ctxs(struct bnxt *bp, int rx_rings)
 static void bnxt_fill_hw_rss_tbl(struct bnxt *bp, struct bnxt_vnic_info *vnic)
 {
 	bool no_rss = !(vnic->flags & BNXT_VNIC_RSS_FLAG);
-	u16 i, j;
+	u16 i, j, min_j = bp->rx_nr_rings - 1;
+
+	if (!vnic->rss_table)
+		goto skip_rss_tbl;
 
 	/* Fill the RSS indirection table with ring group ids */
 	for (i = 0, j = 0; i < HW_HASH_INDEX_SIZE; i++) {
 		if (!no_rss)
 			j = bp->rss_indir_tbl[i];
+		min_j = min(j, min_j);
 		vnic->rss_table[i] = cpu_to_le16(vnic->fw_grp_ids[j]);
 	}
+
+skip_rss_tbl:
+	if (vnic->rss_table && !no_rss)
+		vnic->default_rx_ring = min_j;
+	else if (vnic->flags & BNXT_VNIC_RFS_FLAG)
+		vnic->default_rx_ring = vnic->vnic_id - 1;
+	else if ((vnic->vnic_id == 1) && BNXT_CHIP_TYPE_NITRO_A0(bp))
+		vnic->default_rx_ring = bp->rx_nr_rings - 1;
+	else
+		vnic->default_rx_ring = 0;
 }
 
 static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp,
 				    struct bnxt_vnic_info *vnic)
 {
+	u16 tbl_size, i, min_j = bp->rx_nr_rings - 1;
 	__le16 *ring_tbl = vnic->rss_table;
 	struct bnxt_rx_ring_info *rxr;
-	u16 tbl_size, i;
 
 	tbl_size = bnxt_get_rxfh_indir_size(bp->dev);
 
@@ -6732,6 +6749,7 @@ static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp,
 			j = ethtool_rxfh_context_indir(vnic->rss_ctx)[i];
 		else
 			j = bp->rss_indir_tbl[i];
+		min_j = min(j, min_j);
 		rxr = &bp->rx_ring[j];
 
 		ring_id = rxr->rx_ring_struct.fw_ring_id;
@@ -6739,19 +6757,15 @@ static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp,
 		ring_id = bnxt_cp_ring_for_rx(bp, rxr);
 		*ring_tbl++ = cpu_to_le16(ring_id);
 	}
+	vnic->default_rx_ring = min_j;
 }
 
 static void
 __bnxt_hwrm_vnic_set_rss(struct bnxt *bp, struct hwrm_vnic_rss_cfg_input *req,
 			 struct bnxt_vnic_info *vnic)
 {
-	if (bp->flags & BNXT_FLAG_CHIP_P5_PLUS) {
-		bnxt_fill_hw_rss_tbl_p5(bp, vnic);
-		if (bp->flags & BNXT_FLAG_CHIP_P7)
-			req->flags |= VNIC_RSS_CFG_REQ_FLAGS_IPSEC_HASH_TYPE_CFG_SUPPORT;
-	} else {
-		bnxt_fill_hw_rss_tbl(bp, vnic);
-	}
+	if (bp->flags & BNXT_FLAG_CHIP_P7)
+		req->flags |= VNIC_RSS_CFG_REQ_FLAGS_IPSEC_HASH_TYPE_CFG_SUPPORT;
 
 	if (bp->rss_hash_delta) {
 		req->hash_type = cpu_to_le32(bp->rss_hash_delta);
@@ -6803,6 +6817,7 @@ static int bnxt_hwrm_vnic_set_rss_p5(struct bnxt *bp,
 	if (!set_rss)
 		return hwrm_req_send(bp, req);
 
+	bnxt_fill_hw_rss_tbl_p5(bp, vnic);
 	__bnxt_hwrm_vnic_set_rss(bp, req, vnic);
 	ring_tbl_map = vnic->rss_table_dma_addr;
 	nr_ctxs = bnxt_get_nr_rss_ctxs(bp, bp->rx_nr_rings);
@@ -6939,8 +6954,9 @@ int bnxt_hwrm_vnic_cfg(struct bnxt *bp, struct bnxt_vnic_info *vnic)
 		return rc;
 
 	if (bp->flags & BNXT_FLAG_CHIP_P5_PLUS) {
-		struct bnxt_rx_ring_info *rxr = &bp->rx_ring[0];
+		struct bnxt_rx_ring_info *rxr;
 
+		rxr = &bp->rx_ring[vnic->default_rx_ring];
 		req->default_rx_ring_id =
 			cpu_to_le16(rxr->rx_ring_struct.fw_ring_id);
 		req->default_cmpl_ring_id =
@@ -6973,13 +6989,7 @@ int bnxt_hwrm_vnic_cfg(struct bnxt *bp, struct bnxt_vnic_info *vnic)
 		req->cos_rule = cpu_to_le16(0xffff);
 	}
 
-	if (vnic->flags & BNXT_VNIC_RSS_FLAG)
-		ring = 0;
-	else if (vnic->flags & BNXT_VNIC_RFS_FLAG)
-		ring = vnic->vnic_id - 1;
-	else if ((vnic->vnic_id == 1) && BNXT_CHIP_TYPE_NITRO_A0(bp))
-		ring = bp->rx_nr_rings - 1;
-
+	ring = vnic->default_rx_ring;
 	grp_idx = bp->rx_ring[ring].bnapi->index;
 	req->dflt_ring_grp = cpu_to_le16(bp->grp_info[grp_idx].fw_grp_id);
 	req->lb_rule = cpu_to_le16(0xffff);
@@ -10866,6 +10876,7 @@ static int __bnxt_setup_vnic(struct bnxt *bp, struct bnxt_vnic_info *vnic)
 	}
 
 skip_rss_ctx:
+	bnxt_fill_hw_rss_tbl(bp, vnic);
 	/* configure default vnic, ring grp */
 	rc = bnxt_hwrm_vnic_cfg(bp, vnic);
 	if (rc) {
@@ -11090,6 +11101,11 @@ static int bnxt_set_vnic_mru_p5(struct bnxt *bp, struct bnxt_vnic_info *vnic,
 				   vnic->vnic_id, rc);
 			return rc;
 		}
+		if (rxr_id == vnic->default_rx_ring) {
+			rc = bnxt_hwrm_vnic_cfg(bp, vnic);
+			if (rc)
+				return rc;
+		}
 	}
 	vnic->mru = mru;
 	bnxt_hwrm_vnic_update(bp, vnic,
@@ -11171,6 +11187,9 @@ static int bnxt_setup_nitroa0_vnic(struct bnxt *bp)
 		return rc;
 	}
 
+	/* Setup the proper default RX ring */
+	bnxt_fill_hw_rss_tbl(bp, vnic);
+
 	rc = bnxt_hwrm_vnic_cfg(bp, vnic);
 	if (rc) {
 		netdev_err(bp->dev, "Cannot allocate special vnic for NS2 A0: %x\n",
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 6335dfc14c985..44ea8fc7b766d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1334,6 +1334,7 @@ struct bnxt_vnic_info {
 #define BNXT_VNIC_RSSCTX_FLAG		0x40
 	struct ethtool_rxfh_context *rss_ctx;
 	u32		vnic_id;
+	u16		default_rx_ring;
 };
 
 struct bnxt_rss_ctx {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
index 5d41dc1bc7820..b89293dfd2d1e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
@@ -495,12 +495,15 @@ static int bnxt_ptp_enable(struct ptp_clock_info *ptp_info,
 		return rc;
 	case PTP_CLK_REQ_PPS:
 		/* Configure PHC PPS IN */
-		rc = bnxt_ptp_cfg_pin(bp, 0, BNXT_PPS_PIN_PPS_IN);
+		pin_id = 0;
+		if (!on)
+			break;
+		rc = bnxt_ptp_cfg_pin(bp, pin_id, BNXT_PPS_PIN_PPS_IN);
 		if (rc)
 			return rc;
 		rc = bnxt_ptp_cfg_event(bp, BNXT_PPS_EVENT_INTERNAL);
 		if (!rc)
-			ptp->pps_info.pins[0].event = BNXT_PPS_EVENT_INTERNAL;
+			ptp->pps_info.pins[pin_id].event = BNXT_PPS_EVENT_INTERNAL;
 		return rc;
 	default:
 		netdev_err(ptp->bp->dev, "Unrecognized PIN function\n");

3/2 2026/08/02 04:57 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 5101
							output: 85
							thoughts: 475

Thoughts: 
**WorthFuzzing Assessment: bnxt Driver**

Okay, so I've got this patch affecting `drivers/net/ethernet/broadcom/bnxt/bnxt.c` and `drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c`. My initial thought is, "bnxt... that rings a bell." Right, Broadcom NetXtreme-C/E, 10/25/40/50 gigabit Ethernet cards. That's *physical* hardware. Specifically, a PCIe network card driver.

My first instinct is to ask, "Can this even *be* reached in QEMU?" I know from experience that standard QEMU usually doesn't emulate these types of physical PCIe network cards. These are the kinds of NICs that require the actual hardware to function. So, I need to confirm if there is any form of bnxt emulation in QEMU.

I'll quickly search the kernel source to confirm. Yep, the path `drivers/net/ethernet/broadcom/bnxt/` screams "physical hardware driver." Case closed, it's a *real* device. Now, I have to remember the prompt:

"Return WorthFuzzing=false if the patch only contains:
...
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU."

Bingo. `bnxt` is *precisely* a vendor-specific PCIe NIC driver, requiring Broadcom hardware. It's not going to run in standard QEMU. I should return `WorthFuzzing=false`.

Let me double-check my work. I'm positive, there's no software emulation I'm missing. Nope, `bnxt` is firmly in the Broadcom NetXtreme-C/E camp.

Alright, I'm confident. I can return `WorthFuzzing=false` with the reasoning that it's a vendor-specific PCIe NIC driver reliant on physical hardware unavailable in QEMU.

Just to be absolutely certain, let me re-read the prompt one last time... "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU."

Yup, `bnxt` hits that nail squarely on the head. Time to call `set-results`.

4/2 2026/08/02 04:57 tool set-results
0m Args: 
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Broadcom NetXtreme-C/E (bnxt) Ethernet driver. This is a vendor-specific PCIe NIC driver that requires physical hardware not emulated in standard QEMU environments, making it unreachable for fuzzing in virtualized environments.",
  "WorthFuzzing": false
}

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Broadcom NetXtreme-C/E (bnxt) Ethernet driver. This is a vendor-specific PCIe NIC driver that requires physical hardware not emulated in standard QEMU environments, making it unreachable for fuzzing in virtualized environments.",
  "WorthFuzzing": false
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)