| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/31 06:12 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies userspace selftests in tools/testing/selftests/vfio/ and does not make any functional changes to the kernel code itself.",
"WorthFuzzing": false
} |
| 1/1 | 2026/07/31 06:12 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 027d1c47ed76e7e2040739531f080f5120edbbc4\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Jul 31 06:12:25 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/vfio/lib/drivers/igb/e1000_82575.h b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_82575.h\nnew file mode 120000\nindex 0000000000000..b84affdec5598\n--- /dev/null\n+++ b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_82575.h\n@@ -0,0 +1 @@\n+../../../../../../../drivers/net/ethernet/intel/igb/e1000_82575.h\n\\ No newline at end of file\ndiff --git a/tools/testing/selftests/vfio/lib/drivers/igb/e1000_defines.h b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_defines.h\nnew file mode 120000\nindex 0000000000000..9f97f43300866\n--- /dev/null\n+++ b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_defines.h\n@@ -0,0 +1 @@\n+../../../../../../../drivers/net/ethernet/intel/igb/e1000_defines.h\n\\ No newline at end of file\ndiff --git a/tools/testing/selftests/vfio/lib/drivers/igb/e1000_regs.h b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_regs.h\nnew file mode 120000\nindex 0000000000000..c733634171bb1\n--- /dev/null\n+++ b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_regs.h\n@@ -0,0 +1 @@\n+../../../../../../../drivers/net/ethernet/intel/igb/e1000_regs.h\n\\ No newline at end of file\ndiff --git a/tools/testing/selftests/vfio/lib/drivers/igb/igb.c b/tools/testing/selftests/vfio/lib/drivers/igb/igb.c\nnew file mode 100644\nindex 0000000000000..4adad15f16a0d\n--- /dev/null\n+++ b/tools/testing/selftests/vfio/lib/drivers/igb/igb.c\n@@ -0,0 +1,579 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+#include \u003cunistd.h\u003e\n+#include \u003cerrno.h\u003e\n+#include \u003cstdint.h\u003e\n+#include \u003clinux/io.h\u003e\n+#include \u003clinux/pci_regs.h\u003e\n+#include \u003clinux/pci_ids.h\u003e\n+#include \u003clinux/kernel.h\u003e\n+#include \u003clinux/compiler.h\u003e\n+#include \u003casm/barrier.h\u003e\n+#include \u003clinux/mii.h\u003e\n+#include \u003clibvfio/vfio_pci_device.h\u003e\n+\n+#include \"e1000_regs.h\"\n+#include \"e1000_defines.h\"\n+#include \"e1000_82575.h\"\n+\n+#define PCI_DEVICE_ID_INTEL_82576 0x10C9\n+#define IGB_MAX_CHUNK_SIZE 1024\n+#define MSIX_VECTOR 0\n+#define MSIX_VECTOR_MASK (1 \u003c\u003c MSIX_VECTOR)\n+#define RING_SIZE 4096 /* Number of descriptors in ring */\n+\n+struct igb_tx_desc {\n+\tunion {\n+\t\tstruct {\n+\t\t\tu64 buffer_addr; /* Address of descriptor's data buffer */\n+\t\t\tu32 cmd_type_len; /* Command/Type/Length */\n+\t\t\tu32 olinfo_status; /* Context/Buffer info */\n+\t\t} read;\n+\n+\t\tstruct {\n+\t\t\tu64 rsvd; /* Reserved */\n+\t\t\tu32 nxtseq_seed; /* Next sequence seed */\n+\t\t\tu32 status; /* Descriptor status */\n+\t\t} wb;\n+\t};\n+};\n+\n+struct igb_rx_desc {\n+\tunion {\n+\t\tstruct {\n+\t\t\tu64 pkt_addr; /* Packet buffer address */\n+\t\t\tu64 hdr_addr; /* Header buffer address */\n+\t\t} read;\n+\t\tstruct {\n+\t\t\tu16 pkt_info; /* RSS type, Packet type */\n+\t\t\tu16 hdr_info; /* Split Head, buf len */\n+\t\t\tu32 rss; /* RSS Hash */\n+\t\t\tu32 status_error; /* ext status/error */\n+\t\t\tu16 length; /* Packet length */\n+\t\t\tu16 vlan; /* VLAN tag */\n+\t\t} wb; /* writeback */\n+\t};\n+};\n+\n+struct igb {\n+\tvoid *bar0;\n+\tu32 tx_tail;\n+\tu32 rx_tail;\n+\tstruct igb_tx_desc tx_ring[RING_SIZE] __attribute__((aligned(128)));\n+\tstruct igb_rx_desc rx_ring[RING_SIZE] __attribute__((aligned(128)));\n+};\n+\n+static inline struct igb *to_igb_state(struct vfio_pci_device *device)\n+{\n+\treturn (struct igb *)device-\u003edriver.region.vaddr;\n+}\n+\n+static inline void igb_write32(struct igb *igb, u32 reg, u32 val)\n+{\n+\twritel(val, igb-\u003ebar0 + reg);\n+}\n+\n+static inline u32 igb_read32(struct igb *igb, u32 reg)\n+{\n+\treturn readl(igb-\u003ebar0 + reg);\n+}\n+\n+static int igb_write_phy(struct igb *igb, u32 offset, u16 data)\n+{\n+\tu32 mdic;\n+\tint i;\n+\n+\t/*\n+\t * Write a PHY register over MDIO.\n+\t *\n+\t * A production driver would hold the SW/FW semaphore (SWSM.SWESMBI + the\n+\t * SW_FW_SYNC PHY bit) across the MDIO transaction to serialize against the\n+\t * device's management firmware. The selftest owns the assigned function\n+\t * exclusively on a dedicated test device with no active manageability\n+\t * contending for the PHY, so the sync is omitted; it should be added here\n+\t * if this ever needs to run on a manageability-enabled NIC.\n+\t */\n+\tmdic = (((u32)data) |\n+\t\t(offset \u003c\u003c E1000_MDIC_REG_SHIFT) |\n+\t\t(1 \u003c\u003c E1000_MDIC_PHY_SHIFT) |\n+\t\tE1000_MDIC_OP_WRITE);\n+\n+\tigb_write32(igb, E1000_MDIC, mdic);\n+\n+\tfor (i = 0; i \u003c 1000; i++) {\n+\t\tusleep(50);\n+\t\tmdic = igb_read32(igb, E1000_MDIC);\n+\t\tif (mdic \u0026 E1000_MDIC_READY)\n+\t\t\tbreak;\n+\t}\n+\n+\tif (!(mdic \u0026 E1000_MDIC_READY))\n+\t\treturn -1;\n+\n+\tif (mdic \u0026 E1000_MDIC_ERROR)\n+\t\treturn -1;\n+\n+\treturn 0;\n+}\n+\n+/*\n+ * Configure the device for PHY internal loopback per 82576 datasheet\n+ * section 3.5.6.3.1. Force the PHY to 1Gb/s full duplex with loopback\n+ * enabled, then force the MAC link state to match. Internal loopback\n+ * wraps data at the end of the PHY datapath (section 3.5.6.3), so the\n+ * physical link state is irrelevant.\n+ *\n+ * Section 3.5.6.1 directs to \"Use PHY Loopback instead of MAC Loopback\n+ * on the 82576\", and section 3.5.6.2 states \"MAC Loopback is not used\n+ * on this device.\" RCTL.LBM_MAC is still set elsewhere as a QEMU-only\n+ * accommodation; see the RCTL programming in the caller for the\n+ * rationale.\n+ */\n+static void igb_setup_loopback(struct igb *igb)\n+{\n+\tu32 ctrl;\n+\tint ret;\n+\n+\t/*\n+\t * Kick the autoneg machinery solely to bring STATUS.LU up under\n+\t * QEMU's igb emulation: QEMU only updates STATUS.LU via its\n+\t * autoneg-done timer, and without LU set its receive path\n+\t * (e1000x_hw_rx_enabled) drops every loopback frame. On real\n+\t * hardware autoneg cannot complete before the next PHY write\n+\t * below clears the autoneg-enable bit, so this is effectively a\n+\t * no-op there.\n+\t */\n+\t(void)igb_write_phy(igb, MII_BMCR,\n+\t\t\t BMCR_ANENABLE | BMCR_ANRESTART);\n+\n+\t/* PHY control: loopback + 1Gb/s full duplex, autoneg disabled. */\n+\tret = igb_write_phy(igb, MII_BMCR,\n+\t\t\t BMCR_LOOPBACK |\n+\t\t\t BMCR_SPEED1000 |\n+\t\t\t BMCR_FULLDPLX);\n+\tVFIO_ASSERT_EQ(ret, 0, \"Failed to write PHY control register\");\n+\n+\t/*\n+\t * Brief delay before forcing the MAC, mirroring the kernel ethtool\n+\t * selftest in igb_integrated_phy_loopback(). Not specified by the\n+\t * datasheet, but empirically required by the kernel driver.\n+\t */\n+\tusleep(50000);\n+\n+\t/*\n+\t * Force the MAC to 1Gb/s full duplex with link up. Without forcing\n+\t * the link state the descriptor engine does not run, since the chip\n+\t * normally waits for a real negotiated link.\n+\t */\n+\tctrl = igb_read32(igb, E1000_CTRL);\n+\tctrl \u0026= ~E1000_CTRL_SPD_SEL;\n+\tctrl |= E1000_CTRL_FRCSPD |\n+\t\tE1000_CTRL_FRCDPX |\n+\t\tE1000_CTRL_SPD_1000 |\n+\t\tE1000_CTRL_FD |\n+\t\tE1000_CTRL_SLU;\n+\tigb_write32(igb, E1000_CTRL, ctrl);\n+\n+\t/*\n+\t * Settling delay matching the kernel ethtool selftest's msleep(500)\n+\t * at the tail of igb_integrated_phy_loopback(). Not specified by\n+\t * the datasheet; empirical, and inherited from the kernel driver.\n+\t */\n+\tusleep(500000);\n+}\n+\n+static int igb_probe(struct vfio_pci_device *device)\n+{\n+\tif (!vfio_pci_device_match(device, PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82576))\n+\t\treturn -EINVAL;\n+\n+\treturn 0;\n+}\n+\n+static void igb_reset(struct igb *igb)\n+{\n+\tint retries = 20;\n+\n+\tigb_write32(igb, E1000_CTRL, igb_read32(igb, E1000_CTRL) | E1000_CTRL_RST);\n+\t/*\n+\t * Must wait at least 1 millisecond after setting the reset bit before\n+\t * checking if this device is ready to be used (82576 datasheet section\n+\t * 4.2.1.6.1). The delay also ensures the reset has taken effect and\n+\t * cleared EECD.AUTO_RD before it is polled below.\n+\t */\n+\tusleep(1000);\n+\n+\t/*\n+\t * Poll NVM Auto Read Done rather than CTRL.RST, matching\n+\t * igb_get_auto_rd_done() in the igb driver: AUTO_RD implies both that\n+\t * the reset completed and that the device finished re-reading its\n+\t * configuration from NVM, which is what actually makes it usable.\n+\t */\n+\twhile (retries-- \u003e 0 \u0026\u0026 !(igb_read32(igb, E1000_EECD) \u0026 E1000_EECD_AUTO_RD))\n+\t\tusleep(1000);\n+\n+\t/*\n+\t * QEMU's igb emulation does not set E1000_EECD_AUTO_RD. If we timed out,\n+\t * check if CTRL.RST is cleared, which is what QEMU uses to signal reset\n+\t * completion.\n+\t */\n+\tif (retries \u003c 0) {\n+\t\tVFIO_ASSERT_EQ(igb_read32(igb, E1000_CTRL) \u0026 E1000_CTRL_RST, 0,\n+\t\t\t \"Device reset did not complete (CTRL.RST not cleared)\");\n+\t}\n+\n+\tigb_write32(igb, E1000_IMC, 0xFFFFFFFF);\n+}\n+\n+/*\n+ * Program the device into a usable state. Split out of igb_init() so it\n+ * can be reused after a device reset to re-program the registers that\n+ * CTRL.RST clears. Expects bar0 to be mapped and MSI-X already enabled\n+ * via VFIO.\n+ */\n+static void igb_hw_init(struct vfio_pci_device *device)\n+{\n+\tstruct igb *igb = to_igb_state(device);\n+\tu64 iova_tx, iova_rx;\n+\tu32 ctrl, rctl;\n+\tu16 cmd_reg;\n+\tint retries;\n+\n+\tiova_tx = to_iova(device, igb-\u003etx_ring);\n+\tiova_rx = to_iova(device, igb-\u003erx_ring);\n+\n+\n+\n+\t/* Signal that the driver is loaded */\n+\tctrl = igb_read32(igb, E1000_CTRL_EXT);\n+\tctrl |= E1000_CTRL_EXT_DRV_LOAD;\n+\tctrl \u0026= ~E1000_CTRL_EXT_LINK_MODE_MASK;\n+\tigb_write32(igb, E1000_CTRL_EXT, ctrl);\n+\n+\t/* Enable PCI Bus Master. */\n+\tcmd_reg = vfio_pci_config_readw(device, PCI_COMMAND);\n+\tif ((cmd_reg \u0026 (PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY)) !=\n+\t (PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY)) {\n+\t\tcmd_reg |= (PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY);\n+\t\tvfio_pci_config_writew(device, PCI_COMMAND, cmd_reg);\n+\t}\n+\n+\t/* Configure PHY internal loopback for testing. */\n+\tigb_setup_loopback(igb);\n+\n+\t/*\n+\t * Disable DMA re-send on PCIe completion timeout (82576 datasheet\n+\t * section 8.6.1, GCR.Completion_Timeout_Resend, bit 16). The\n+\t * mix_and_match test intentionally submits descriptors targeting\n+\t * unmapped IOVAs; with the default (set) value, the device keeps\n+\t * retrying the failed read indefinitely, which keeps PCIe AER and\n+\t * IOMMU error handling busy and interferes with reset recovery.\n+\t */\n+\tctrl = igb_read32(igb, E1000_GCR);\n+\tctrl \u0026= ~E1000_GCR_CMPL_TMOUT_RESEND;\n+\tigb_write32(igb, E1000_GCR, ctrl);\n+\n+\t/* Configure TX and RX descriptor rings */\n+\tigb_write32(igb, E1000_TDBAL(0), (u32)iova_tx);\n+\tigb_write32(igb, E1000_TDBAH(0), (u32)(iova_tx \u003e\u003e 32));\n+\tigb_write32(igb, E1000_TDLEN(0), RING_SIZE * sizeof(struct igb_tx_desc));\n+\tigb_write32(igb, E1000_TDH(0), 0);\n+\tigb_write32(igb, E1000_TDT(0), 0);\n+\tigb_write32(igb, E1000_TXDCTL(0), E1000_TXDCTL_QUEUE_ENABLE);\n+\n+\tigb_write32(igb, E1000_RDBAL(0), (u32)iova_rx);\n+\tigb_write32(igb, E1000_RDBAH(0), (u32)(iova_rx \u003e\u003e 32));\n+\tigb_write32(igb, E1000_RDLEN(0), RING_SIZE * sizeof(struct igb_rx_desc));\n+\tigb_write32(igb, E1000_RDH(0), 0);\n+\tigb_write32(igb, E1000_RDT(0), 0);\n+\n+\t/*\n+\t * Select the advanced one-buffer descriptor format. Per 82576\n+\t * datasheet section 7.1.5.2: \"SRRCTL[n].DESCTYPE must be set to a\n+\t * value other than 000b for the 82576 to write back the special\n+\t * descriptors.\" struct igb_rx_desc matches the advanced one-buffer\n+\t * writeback layout (section 7.1.5.2), so polling rx.wb.status_error\n+\t * requires this format. Section 8.10.2 specifies DESCTYPE[27:25].\n+\t *\n+\t * The direct write also zeroes SRRCTL.BSIZEPACKET, which is\n+\t * intentional: per section 7.1.3.1 a zero BSIZEPACKET falls back to\n+\t * the RCTL.BSIZE buffer size, whose reset default (00b) is 2048\n+\t * bytes -- ample for the loopback frames here.\n+\t */\n+\tigb_write32(igb, E1000_SRRCTL(0), E1000_SRRCTL_DESCTYPE_ADV_ONEBUF);\n+\n+\tigb_write32(igb, E1000_RXDCTL(0), E1000_RXDCTL_QUEUE_ENABLE);\n+\n+\t/* Wait for TX and RX queues to be enabled */\n+\tretries = 2000;\n+\twhile (retries-- \u003e 0) {\n+\t\tif ((igb_read32(igb, E1000_TXDCTL(0)) \u0026 E1000_TXDCTL_QUEUE_ENABLE) \u0026\u0026\n+\t\t (igb_read32(igb, E1000_RXDCTL(0)) \u0026 E1000_RXDCTL_QUEUE_ENABLE))\n+\t\t\tbreak;\n+\t\tusleep(10);\n+\t}\n+\tVFIO_ASSERT_GE(retries, 0);\n+\n+\t/*\n+\t * Enable Receiver and Transmitter. RCTL.LBM_MAC is set in addition\n+\t * to PHY loopback as a QEMU-only accommodation: QEMU's emulated igb\n+\t * does not honor PHY register 0 bit 14 (PHY internal loopback) and\n+\t * relies on RCTL.LBM_MAC to wrap TX descriptors back to the RX\n+\t * queue. Datasheet 8.10.1 (RCTL register) advises \"When using the\n+\t * internal PHY, LBM should remain set to 00b\", so setting LBM_MAC\n+\t * here deviates from datasheet guidance; empirically the bit has\n+\t * no observable effect on real 82576 hardware because MAC loopback\n+\t * is not implemented (datasheet 3.5.6.2). Setting both lets the\n+\t * selftest work on both real hardware and QEMU without conditional\n+\t * code paths.\n+\t */\n+\trctl = E1000_RCTL_EN | /* Receiver Enable */\n+\t E1000_RCTL_UPE | /* Unicast Promiscuous (for dummy MAC) */\n+\t E1000_RCTL_MPE | /* Multicast Promiscuous */\n+\t E1000_RCTL_BAM | /* Broadcast Accept Mode */\n+\t E1000_RCTL_LBM_MAC | /* MAC Loopback - for QEMU emulation only */\n+\t E1000_RCTL_SECRC; /* Strip CRC (needed for memcmp) */\n+\tigb_write32(igb, E1000_RCTL, rctl);\n+\tigb_write32(igb, E1000_TCTL, E1000_TCTL_EN);\n+\n+\t/*\n+\t * Program MSI-X interrupt routing per 82576 datasheet:\n+\t *\n+\t * GPIE (section 7.3.2.11, Table 7-47): set Multiple_MSIX (bit 4) to\n+\t * route interrupt causes through IVAR mapping, and EIAME (bit 30)\n+\t * to apply EIAM on MSI-X assertion (without EIAME, EIAM only\n+\t * applies on EICR read/write).\n+\t *\n+\t * EIAC (section 8.8.5): enable auto-clear of EICR for vector 0.\n+\t * Without auto-clear the cause stays set after delivery and the\n+\t * test can see spurious interrupts on the next memcpy batch.\n+\t *\n+\t * EIAM (section 8.8.6): enable auto-mask of EIMS for vector 0 on\n+\t * MSI-X assertion (effective because EIAME is set), so a single\n+\t * interrupt is delivered per memcpy batch even if the cause\n+\t * re-asserts before software re-enables the mask.\n+\t *\n+\t * IVAR (section 7.3.1.2, register definition in 8.8.13): map RX\n+\t * cause 0 to MSI-X vector 0 and mark the entry valid.\n+\t */\n+\tigb_write32(igb, E1000_GPIE, E1000_GPIE_MSIX_MODE | E1000_GPIE_EIAME);\n+\tigb_write32(igb, E1000_EIAC, MSIX_VECTOR_MASK);\n+\tigb_write32(igb, E1000_EIAM, MSIX_VECTOR_MASK);\n+\n+\t/* Map vector 0 to interrupt cause 0 and mark it valid */\n+\tigb_write32(igb, E1000_IVAR0, E1000_IVAR_VALID);\n+\n+\t/* Enable interrupts on vector 0 */\n+\tigb_write32(igb, E1000_EIMS, MSIX_VECTOR_MASK);\n+\n+\t/* Initialize driver state and capability limits */\n+\tigb-\u003etx_tail = 0;\n+\tigb-\u003erx_tail = 0;\n+\n+\tdevice-\u003edriver.max_memcpy_size = IGB_MAX_CHUNK_SIZE;\n+\tdevice-\u003edriver.max_memcpy_count = RING_SIZE - 1;\n+\tdevice-\u003edriver.msi = MSIX_VECTOR;\n+}\n+\n+static void igb_init(struct vfio_pci_device *device)\n+{\n+\tstruct igb *igb = to_igb_state(device);\n+\n+\tVFIO_ASSERT_GE(device-\u003edriver.region.size, sizeof(struct igb));\n+\n+\tigb-\u003ebar0 = device-\u003ebars[0].vaddr;\n+\n+\tigb_reset(igb);\n+\n+\t/*\n+\t * Enable MSI-X via VFIO before device-side register programming.\n+\t * vfio_pci_msix_enable() only touches the VFIO IRQ machinery and the\n+\t * PCI MSI-X capability via config space; it has no ordering\n+\t * dependency on the device-side writes performed by igb_hw_init().\n+\t * Placing it here keeps igb_hw_init() reusable from the reset\n+\t * recovery path (which calls vfio_pci_irq_reenable() instead).\n+\t */\n+\tvfio_pci_msix_enable(device, MSIX_VECTOR, 1);\n+\n+\tigb_hw_init(device);\n+}\n+\n+static void igb_remove(struct vfio_pci_device *device)\n+{\n+\tstruct igb *igb = to_igb_state(device);\n+\n+\tigb_write32(igb, E1000_RCTL, 0);\n+\tigb_write32(igb, E1000_TCTL, 0);\n+\tigb_reset(igb);\n+\n+\tvfio_pci_msix_disable(device);\n+}\n+\n+static void igb_irq_disable(struct igb *igb)\n+{\n+\tigb_write32(igb, E1000_EIMC, MSIX_VECTOR_MASK);\n+}\n+\n+static void igb_irq_enable(struct igb *igb)\n+{\n+\tigb_write32(igb, E1000_EIMS, MSIX_VECTOR_MASK);\n+}\n+\n+static void igb_irq_clear(struct igb *igb)\n+{\n+\t/*\n+\t * Use write-to-clear (datasheet 7.3.4.2). In MSI-X mode with EIAC\n+\t * programmed, section 8.8.5 explicitly states \"If any bits are set\n+\t * in EIAC, the EICR register should not be read\", which rules out\n+\t * the read-to-clear path in 7.3.4.3. Bits not in EIAC are still\n+\t * cleared by writing 1.\n+\t */\n+\tigb_write32(igb, E1000_EICR, 0xFFFFFFFF);\n+}\n+\n+static void igb_memcpy_start(struct vfio_pci_device *device, iova_t src,\n+\t\t\t iova_t dst, u64 size, u64 count)\n+{\n+\tstruct igb *igb = to_igb_state(device);\n+\tstruct igb_rx_desc *rx;\n+\tstruct igb_tx_desc *tx;\n+\tu32 i;\n+\n+\tigb_irq_disable(igb);\n+\n+\tfor (i = 0; i \u003c count; i++) {\n+\t\ttx = \u0026igb-\u003etx_ring[igb-\u003etx_tail];\n+\t\trx = \u0026igb-\u003erx_ring[igb-\u003erx_tail];\n+\n+\t\tmemset(tx, 0, sizeof(struct igb_tx_desc));\n+\t\tmemset(rx, 0, sizeof(struct igb_rx_desc));\n+\n+\t\trx-\u003eread.pkt_addr = cpu_to_le64(dst);\n+\t\trx-\u003eread.hdr_addr = cpu_to_le64(0);\n+\n+\t\ttx-\u003eread.buffer_addr = cpu_to_le64(src);\n+\t\t/*\n+\t\t * Build an advanced data descriptor per 82576 datasheet\n+\t\t * section 7.2.2.3. DEXT marks the descriptor as advanced\n+\t\t * (required by hardware); DTYP=data selects the data\n+\t\t * descriptor; IFCS asks the MAC to append the Ethernet\n+\t\t * FCS (without it the frame is dropped as malformed);\n+\t\t * EOP marks end of packet. DTALEN is the buffer length\n+\t\t * in bits 15:0 of cmd_type_len.\n+\t\t */\n+\t\ttx-\u003eread.cmd_type_len = cpu_to_le32((uint32_t)size |\n+\t\t\tE1000_ADVTXD_DTYP_DATA |\n+\t\t\tE1000_ADVTXD_DCMD_DEXT |\n+\t\t\tE1000_ADVTXD_DCMD_IFCS |\n+\t\t\tE1000_ADVTXD_DCMD_EOP);\n+\t\t/*\n+\t\t * PAYLEN (section 7.2.2.3.11) is the total payload size\n+\t\t * in olinfo_status[31:14].\n+\t\t */\n+\t\ttx-\u003eread.olinfo_status =\n+\t\t\tcpu_to_le32((uint32_t)size \u003c\u003c E1000_ADVTXD_PAYLEN_SHIFT);\n+\n+\t\tigb-\u003etx_tail = (igb-\u003etx_tail + 1) % RING_SIZE;\n+\t\tigb-\u003erx_tail = (igb-\u003erx_tail + 1) % RING_SIZE;\n+\t}\n+\n+\tigb_write32(igb, E1000_RDT(0), igb-\u003erx_tail);\n+\tigb_write32(igb, E1000_TDT(0), igb-\u003etx_tail);\n+}\n+\n+/*\n+ * Reset the device via VFIO_DEVICE_RESET (PCIe FLR on the 82576) and\n+ * re-program it. VFIO_DEVICE_RESET tears down the kernel-side MSI-X\n+ * trigger but leaves user-side eventfds intact, so re-arm the trigger\n+ * via vfio_pci_irq_reenable() before reprogramming so any caller-cached\n+ * eventfd remains valid.\n+ *\n+ * FLR clears device-side state to power-on reset values (datasheet\n+ * 4.2.1.5.1: a PF FLR is \"equivalent to a D0-\u003eD3-\u003eD0 transition\"), so\n+ * EIMS and EICR come back as 0 from their register-defined initial\n+ * values, and igb_hw_init() resets tx_tail/rx_tail to 0. The next\n+ * igb_memcpy_start() will memset each descriptor it touches before\n+ * submission, so no explicit IMC/EICR writes or ring memsets are\n+ * needed here.\n+ */\n+static void igb_error_reset_and_reinit(struct vfio_pci_device *device)\n+{\n+\tvfio_pci_device_reset(device);\n+\tvfio_pci_msix_reenable(device, MSIX_VECTOR, 1);\n+\tigb_hw_init(device);\n+}\n+\n+static int igb_memcpy_wait(struct vfio_pci_device *device)\n+{\n+\tstruct igb *igb = to_igb_state(device);\n+\tstruct igb_rx_desc *rx;\n+\tu32 status = 0;\n+\tu32 prev_tail;\n+\tint retries;\n+\n+\tprev_tail = (igb-\u003erx_tail + RING_SIZE - 1) % RING_SIZE;\n+\trx = \u0026igb-\u003erx_ring[prev_tail];\n+\n+\t/*\n+\t * Real 82576 hardware processes the descriptor ring at line rate.\n+\t * max_memcpy_size = (RING_SIZE - 1) * IGB_MAX_CHUNK_SIZE ~= 4 MB,\n+\t * split into 4095 1 KB frames. At 1 Gb/s (~125 MB/s) the worst\n+\t * valid memcpy takes ~32 ms on the wire, plus per-frame preamble,\n+\t * SFD, IFG and FCS overhead (~3%) and descriptor fetch/writeback\n+\t * latency. Wait up to ~200 ms before declaring the device hung;\n+\t * ~6x the line-rate floor leaves comfortable headroom for host\n+\t * scheduling jitter while keeping the intentional invalid-DMA\n+\t * tests bounded.\n+\t */\n+\tretries = 200;\n+\twhile (retries-- \u003e 0) {\n+\t\tstatus = le32_to_cpu(READ_ONCE(rx-\u003ewb.status_error));\n+\t\tif (status \u0026 1)\n+\t\t\tbreak;\n+\t\tusleep(1000);\n+\t}\n+\n+\tif (status \u0026 1)\n+\t\t/*\n+\t\t * Ensure the test code doesn't speculatively read the DMA\n+\t\t * destination buffer before we have verified that the\n+\t\t * descriptor writeback is complete.\n+\t\t */\n+\t\trmb();\n+\n+\tigb_irq_clear(igb);\n+\n+\tigb_irq_enable(igb);\n+\n+\tif (status \u0026 1)\n+\t\treturn 0;\n+\n+\t/*\n+\t * The descriptor never completed. On real 82576 hardware this\n+\t * typically follows a DMA-read fault from one of the intentional\n+\t * unmapped-IOVA tests; the fault leaves the descriptor engine\n+\t * unable to service subsequent valid descriptors. CTRL.RST alone\n+\t * reinitializes the queue registers but leaves the engine wedged\n+\t * for the current process, so a broader VFIO_DEVICE_RESET (FLR)\n+\t * is required.\n+\t */\n+\tigb_error_reset_and_reinit(device);\n+\n+\treturn -ETIMEDOUT;\n+}\n+\n+static void igb_send_msi(struct vfio_pci_device *device)\n+{\n+\tstruct igb *igb = to_igb_state(device);\n+\n+\tigb_write32(igb, E1000_EICS, MSIX_VECTOR_MASK);\n+}\n+\n+const struct vfio_pci_driver_ops igb_ops = {\n+\t.name = \"igb\",\n+\t.probe = igb_probe,\n+\t.init = igb_init,\n+\t.remove = igb_remove,\n+\t.memcpy_start = igb_memcpy_start,\n+\t.memcpy_wait = igb_memcpy_wait,\n+\t.send_msi = igb_send_msi,\n+};\ndiff --git a/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h b/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h\nindex 59acef381d056..e19bd94b8dd2a 100644\n--- a/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h\n+++ b/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h\n@@ -43,6 +43,7 @@ void vfio_pci_device_free(struct vfio_pci_device *device);\n struct vfio_pci_device *vfio_pci_device_init(const char *bdf, struct iommu *iommu);\n void vfio_pci_device_cleanup(struct vfio_pci_device *device);\n \n+int __vfio_pci_device_reset(struct vfio_pci_device *device);\n void vfio_pci_device_reset(struct vfio_pci_device *device);\n \n void vfio_pci_config_access(struct vfio_pci_device *device, bool write,\n@@ -84,6 +85,8 @@ static inline void vfio_pci_cmd_clear(struct vfio_pci_device *device, u16 bits)\n void vfio_pci_irq_enable(struct vfio_pci_device *device, u32 index,\n \t\t\t u32 vector, int count);\n void vfio_pci_irq_disable(struct vfio_pci_device *device, u32 index);\n+void vfio_pci_irq_reenable(struct vfio_pci_device *device, u32 index,\n+\t\t\t u32 vector, int count);\n void vfio_pci_irq_trigger(struct vfio_pci_device *device, u32 index, u32 vector);\n \n static inline void fcntl_set_nonblock(int fd)\n@@ -108,6 +111,12 @@ static inline void vfio_pci_msi_disable(struct vfio_pci_device *device)\n \tvfio_pci_irq_disable(device, VFIO_PCI_MSI_IRQ_INDEX);\n }\n \n+static inline void vfio_pci_msi_reenable(struct vfio_pci_device *device,\n+\t\t\t\t\t u32 vector, int count)\n+{\n+\tvfio_pci_irq_reenable(device, VFIO_PCI_MSI_IRQ_INDEX, vector, count);\n+}\n+\n static inline void vfio_pci_msix_enable(struct vfio_pci_device *device,\n \t\t\t\t\tu32 vector, int count)\n {\n@@ -119,6 +128,12 @@ static inline void vfio_pci_msix_disable(struct vfio_pci_device *device)\n \tvfio_pci_irq_disable(device, VFIO_PCI_MSIX_IRQ_INDEX);\n }\n \n+static inline void vfio_pci_msix_reenable(struct vfio_pci_device *device,\n+\t\t\t\t\t u32 vector, int count)\n+{\n+\tvfio_pci_irq_reenable(device, VFIO_PCI_MSIX_IRQ_INDEX, vector, count);\n+}\n+\n static inline int __to_iova(struct vfio_pci_device *device, void *vaddr, iova_t *iova)\n {\n \treturn __iommu_hva2iova(device-\u003eiommu, vaddr, iova);\ndiff --git a/tools/testing/selftests/vfio/lib/libvfio.mk b/tools/testing/selftests/vfio/lib/libvfio.mk\nindex 82132b648744b..bcfa74ae040e7 100644\n--- a/tools/testing/selftests/vfio/lib/libvfio.mk\n+++ b/tools/testing/selftests/vfio/lib/libvfio.mk\n@@ -16,6 +16,7 @@ LIBVFIO_C += drivers/dsa/dsa.c\n endif\n \n LIBVFIO_C += drivers/nv_falcon/nv_falcon.c\n+LIBVFIO_C += drivers/igb/igb.c\n \n LIBVFIO_OUTPUT := $(OUTPUT)/libvfio\n \ndiff --git a/tools/testing/selftests/vfio/lib/vfio_pci_device.c b/tools/testing/selftests/vfio/lib/vfio_pci_device.c\nindex 28868343f2ab5..4063a0e2b3df3 100644\n--- a/tools/testing/selftests/vfio/lib/vfio_pci_device.c\n+++ b/tools/testing/selftests/vfio/lib/vfio_pci_device.c\n@@ -1,5 +1,6 @@\n // SPDX-License-Identifier: GPL-2.0-only\n #include \u003cdirent.h\u003e\n+#include \u003cerrno.h\u003e\n #include \u003cfcntl.h\u003e\n #include \u003clibgen.h\u003e\n #include \u003cstdint.h\u003e\n@@ -105,6 +106,28 @@ void vfio_pci_irq_disable(struct vfio_pci_device *device, u32 index)\n \tvfio_pci_irq_set(device, index, 0, 0, NULL);\n }\n \n+/*\n+ * Re-issue VFIO_DEVICE_SET_IRQS for an already-enabled vector range using\n+ * the existing eventfds. Intended for drivers that need to re-arm device\n+ * interrupts after a VFIO_DEVICE_RESET, which tears down the kernel-side\n+ * IRQ trigger but leaves user-side eventfds intact. Recreating the\n+ * eventfds would invalidate any test-fixture cache of the fd, so this\n+ * helper deliberately preserves them.\n+ */\n+void vfio_pci_irq_reenable(struct vfio_pci_device *device, u32 index,\n+\t\t\t u32 vector, int count)\n+{\n+\tint i;\n+\n+\tcheck_supported_irq_index(index);\n+\n+\tfor (i = vector; i \u003c vector + count; i++)\n+\t\tVFIO_ASSERT_GE(device-\u003emsi_eventfds[i], 0,\n+\t\t\t \"vector %d eventfd not allocated\\n\", i);\n+\n+\tvfio_pci_irq_set(device, index, vector, count, device-\u003emsi_eventfds + vector);\n+}\n+\n static void vfio_pci_irq_get(struct vfio_pci_device *device, u32 index,\n \t\t\t struct vfio_irq_info *irq_info)\n {\n@@ -237,9 +260,26 @@ void vfio_pci_config_access(struct vfio_pci_device *device, bool write,\n \t\t write ? \"write to\" : \"read from\", config);\n }\n \n+int __vfio_pci_device_reset(struct vfio_pci_device *device)\n+{\n+\tif (ioctl(device-\u003efd, VFIO_DEVICE_RESET, NULL))\n+\t\treturn -errno;\n+\n+\treturn 0;\n+}\n+\n void vfio_pci_device_reset(struct vfio_pci_device *device)\n {\n-\tioctl_assert(device-\u003efd, VFIO_DEVICE_RESET, NULL);\n+\tint retries = 20;\n+\tint r;\n+\n+\tdo {\n+\t\tr = __vfio_pci_device_reset(device);\n+\t\tif (r == -EAGAIN)\n+\t\t\tusleep(10000);\n+\t} while (r == -EAGAIN \u0026\u0026 retries-- \u003e 0);\n+\n+\tVFIO_ASSERT_EQ(r, 0, \"ioctl(device-\u003efd, VFIO_DEVICE_RESET) failed\\n\");\n }\n \n void vfio_pci_group_setup(struct vfio_pci_device *device, const char *bdf)\ndiff --git a/tools/testing/selftests/vfio/lib/vfio_pci_driver.c b/tools/testing/selftests/vfio/lib/vfio_pci_driver.c\nindex 153bf4a7a19f9..5e65434d2318b 100644\n--- a/tools/testing/selftests/vfio/lib/vfio_pci_driver.c\n+++ b/tools/testing/selftests/vfio/lib/vfio_pci_driver.c\n@@ -6,8 +6,8 @@\n extern struct vfio_pci_driver_ops dsa_ops;\n extern struct vfio_pci_driver_ops ioat_ops;\n #endif\n-\n extern struct vfio_pci_driver_ops nv_falcon_ops;\n+extern struct vfio_pci_driver_ops igb_ops;\n \n static struct vfio_pci_driver_ops *driver_ops[] = {\n #ifdef __x86_64__\n@@ -15,6 +15,7 @@ static struct vfio_pci_driver_ops *driver_ops[] = {\n \t\u0026ioat_ops,\n #endif\n \t\u0026nv_falcon_ops,\n+\t\u0026igb_ops,\n };\n \n void vfio_pci_driver_probe(struct vfio_pci_device *device)\n"
} |
| 2/1 | 2026/07/31 06:12 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies userspace selftests in tools/testing/selftests/vfio/ and does not make any functional changes to the kernel code itself.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 027d1c47ed76e7e2040739531f080f5120edbbc4
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Jul 31 06:12:25 2026 +0000
syz-cluster: applied patch under review
diff --git a/tools/testing/selftests/vfio/lib/drivers/igb/e1000_82575.h b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_82575.h
new file mode 120000
index 0000000000000..b84affdec5598
--- /dev/null
+++ b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_82575.h
@@ -0,0 +1 @@
+../../../../../../../drivers/net/ethernet/intel/igb/e1000_82575.h
\ No newline at end of file
diff --git a/tools/testing/selftests/vfio/lib/drivers/igb/e1000_defines.h b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_defines.h
new file mode 120000
index 0000000000000..9f97f43300866
--- /dev/null
+++ b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_defines.h
@@ -0,0 +1 @@
+../../../../../../../drivers/net/ethernet/intel/igb/e1000_defines.h
\ No newline at end of file
diff --git a/tools/testing/selftests/vfio/lib/drivers/igb/e1000_regs.h b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_regs.h
new file mode 120000
index 0000000000000..c733634171bb1
--- /dev/null
+++ b/tools/testing/selftests/vfio/lib/drivers/igb/e1000_regs.h
@@ -0,0 +1 @@
+../../../../../../../drivers/net/ethernet/intel/igb/e1000_regs.h
\ No newline at end of file
diff --git a/tools/testing/selftests/vfio/lib/drivers/igb/igb.c b/tools/testing/selftests/vfio/lib/drivers/igb/igb.c
new file mode 100644
index 0000000000000..4adad15f16a0d
--- /dev/null
+++ b/tools/testing/selftests/vfio/lib/drivers/igb/igb.c
@@ -0,0 +1,579 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <unistd.h>
+#include <errno.h>
+#include <stdint.h>
+#include <linux/io.h>
+#include <linux/pci_regs.h>
+#include <linux/pci_ids.h>
+#include <linux/kernel.h>
+#include <linux/compiler.h>
+#include <asm/barrier.h>
+#include <linux/mii.h>
+#include <libvfio/vfio_pci_device.h>
+
+#include "e1000_regs.h"
+#include "e1000_defines.h"
+#include "e1000_82575.h"
+
+#define PCI_DEVICE_ID_INTEL_82576 0x10C9
+#define IGB_MAX_CHUNK_SIZE 1024
+#define MSIX_VECTOR 0
+#define MSIX_VECTOR_MASK (1 << MSIX_VECTOR)
+#define RING_SIZE 4096 /* Number of descriptors in ring */
+
+struct igb_tx_desc {
+ union {
+ struct {
+ u64 buffer_addr; /* Address of descriptor's data buffer */
+ u32 cmd_type_len; /* Command/Type/Length */
+ u32 olinfo_status; /* Context/Buffer info */
+ } read;
+
+ struct {
+ u64 rsvd; /* Reserved */
+ u32 nxtseq_seed; /* Next sequence seed */
+ u32 status; /* Descriptor status */
+ } wb;
+ };
+};
+
+struct igb_rx_desc {
+ union {
+ struct {
+ u64 pkt_addr; /* Packet buffer address */
+ u64 hdr_addr; /* Header buffer address */
+ } read;
+ struct {
+ u16 pkt_info; /* RSS type, Packet type */
+ u16 hdr_info; /* Split Head, buf len */
+ u32 rss; /* RSS Hash */
+ u32 status_error; /* ext status/error */
+ u16 length; /* Packet length */
+ u16 vlan; /* VLAN tag */
+ } wb; /* writeback */
+ };
+};
+
+struct igb {
+ void *bar0;
+ u32 tx_tail;
+ u32 rx_tail;
+ struct igb_tx_desc tx_ring[RING_SIZE] __attribute__((aligned(128)));
+ struct igb_rx_desc rx_ring[RING_SIZE] __attribute__((aligned(128)));
+};
+
+static inline struct igb *to_igb_state(struct vfio_pci_device *device)
+{
+ return (struct igb *)device->driver.region.vaddr;
+}
+
+static inline void igb_write32(struct igb *igb, u32 reg, u32 val)
+{
+ writel(val, igb->bar0 + reg);
+}
+
+static inline u32 igb_read32(struct igb *igb, u32 reg)
+{
+ return readl(igb->bar0 + reg);
+}
+
+static int igb_write_phy(struct igb *igb, u32 offset, u16 data)
+{
+ u32 mdic;
+ int i;
+
+ /*
+ * Write a PHY register over MDIO.
+ *
+ * A production driver would hold the SW/FW semaphore (SWSM.SWESMBI + the
+ * SW_FW_SYNC PHY bit) across the MDIO transaction to serialize against the
+ * device's management firmware. The selftest owns the assigned function
+ * exclusively on a dedicated test device with no active manageability
+ * contending for the PHY, so the sync is omitted; it should be added here
+ * if this ever needs to run on a manageability-enabled NIC.
+ */
+ mdic = (((u32)data) |
+ (offset << E1000_MDIC_REG_SHIFT) |
+ (1 << E1000_MDIC_PHY_SHIFT) |
+ E1000_MDIC_OP_WRITE);
+
+ igb_write32(igb, E1000_MDIC, mdic);
+
+ for (i = 0; i < 1000; i++) {
+ usleep(50);
+ mdic = igb_read32(igb, E1000_MDIC);
+ if (mdic & E1000_MDIC_READY)
+ break;
+ }
+
+ if (!(mdic & E1000_MDIC_READY))
+ return -1;
+
+ if (mdic & E1000_MDIC_ERROR)
+ return -1;
+
+ return 0;
+}
+
+/*
+ * Configure the device for PHY internal loopback per 82576 datasheet
+ * section 3.5.6.3.1. Force the PHY to 1Gb/s full duplex with loopback
+ * enabled, then force the MAC link state to match. Internal loopback
+ * wraps data at the end of the PHY datapath (section 3.5.6.3), so the
+ * physical link state is irrelevant.
+ *
+ * Section 3.5.6.1 directs to "Use PHY Loopback instead of MAC Loopback
+ * on the 82576", and section 3.5.6.2 states "MAC Loopback is not used
+ * on this device." RCTL.LBM_MAC is still set elsewhere as a QEMU-only
+ * accommodation; see the RCTL programming in the caller for the
+ * rationale.
+ */
+static void igb_setup_loopback(struct igb *igb)
+{
+ u32 ctrl;
+ int ret;
+
+ /*
+ * Kick the autoneg machinery solely to bring STATUS.LU up under
+ * QEMU's igb emulation: QEMU only updates STATUS.LU via its
+ * autoneg-done timer, and without LU set its receive path
+ * (e1000x_hw_rx_enabled) drops every loopback frame. On real
+ * hardware autoneg cannot complete before the next PHY write
+ * below clears the autoneg-enable bit, so this is effectively a
+ * no-op there.
+ */
+ (void)igb_write_phy(igb, MII_BMCR,
+ BMCR_ANENABLE | BMCR_ANRESTART);
+
+ /* PHY control: loopback + 1Gb/s full duplex, autoneg disabled. */
+ ret = igb_write_phy(igb, MII_BMCR,
+ BMCR_LOOPBACK |
+ BMCR_SPEED1000 |
+ BMCR_FULLDPLX);
+ VFIO_ASSERT_EQ(ret, 0, "Failed to write PHY control register");
+
+ /*
+ * Brief delay before forcing the MAC, mirroring the kernel ethtool
+ * selftest in igb_integrated_phy_loopback(). Not specified by the
+ * datasheet, but empirically required by the kernel driver.
+ */
+ usleep(50000);
+
+ /*
+ * Force the MAC to 1Gb/s full duplex with link up. Without forcing
+ * the link state the descriptor engine does not run, since the chip
+ * normally waits for a real negotiated link.
+ */
+ ctrl = igb_read32(igb, E1000_CTRL);
+ ctrl &= ~E1000_CTRL_SPD_SEL;
+ ctrl |= E1000_CTRL_FRCSPD |
+ E1000_CTRL_FRCDPX |
+ E1000_CTRL_SPD_1000 |
+ E1000_CTRL_FD |
+ E1000_CTRL_SLU;
+ igb_write32(igb, E1000_CTRL, ctrl);
+
+ /*
+ * Settling delay matching the kernel ethtool selftest's msleep(500)
+ * at the tail of igb_integrated_phy_loopback(). Not specified by
+ * the datasheet; empirical, and inherited from the kernel driver.
+ */
+ usleep(500000);
+}
+
+static int igb_probe(struct vfio_pci_device *device)
+{
+ if (!vfio_pci_device_match(device, PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82576))
+ return -EINVAL;
+
+ return 0;
+}
+
+static void igb_reset(struct igb *igb)
+{
+ int retries = 20;
+
+ igb_write32(igb, E1000_CTRL, igb_read32(igb, E1000_CTRL) | E1000_CTRL_RST);
+ /*
+ * Must wait at least 1 millisecond after setting the reset bit before
+ * checking if this device is ready to be used (82576 datasheet section
+ * 4.2.1.6.1). The delay also ensures the reset has taken effect and
+ * cleared EECD.AUTO_RD before it is polled below.
+ */
+ usleep(1000);
+
+ /*
+ * Poll NVM Auto Read Done rather than CTRL.RST, matching
+ * igb_get_auto_rd_done() in the igb driver: AUTO_RD implies both that
+ * the reset completed and that the device finished re-reading its
+ * configuration from NVM, which is what actually makes it usable.
+ */
+ while (retries-- > 0 && !(igb_read32(igb, E1000_EECD) & E1000_EECD_AUTO_RD))
+ usleep(1000);
+
+ /*
+ * QEMU's igb emulation does not set E1000_EECD_AUTO_RD. If we timed out,
+ * check if CTRL.RST is cleared, which is what QEMU uses to signal reset
+ * completion.
+ */
+ if (retries < 0) {
+ VFIO_ASSERT_EQ(igb_read32(igb, E1000_CTRL) & E1000_CTRL_RST, 0,
+ "Device reset did not complete (CTRL.RST not cleared)");
+ }
+
+ igb_write32(igb, E1000_IMC, 0xFFFFFFFF);
+}
+
+/*
+ * Program the device into a usable state. Split out of igb_init() so it
+ * can be reused after a device reset to re-program the registers that
+ * CTRL.RST clears. Expects bar0 to be mapped and MSI-X already enabled
+ * via VFIO.
+ */
+static void igb_hw_init(struct vfio_pci_device *device)
+{
+ struct igb *igb = to_igb_state(device);
+ u64 iova_tx, iova_rx;
+ u32 ctrl, rctl;
+ u16 cmd_reg;
+ int retries;
+
+ iova_tx = to_iova(device, igb->tx_ring);
+ iova_rx = to_iova(device, igb->rx_ring);
+
+
+
+ /* Signal that the driver is loaded */
+ ctrl = igb_read32(igb, E1000_CTRL_EXT);
+ ctrl |= E1000_CTRL_EXT_DRV_LOAD;
+ ctrl &= ~E1000_CTRL_EXT_LINK_MODE_MASK;
+ igb_write32(igb, E1000_CTRL_EXT, ctrl);
+
+ /* Enable PCI Bus Master. */
+ cmd_reg = vfio_pci_config_readw(device, PCI_COMMAND);
+ if ((cmd_reg & (PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY)) !=
+ (PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY)) {
+ cmd_reg |= (PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY);
+ vfio_pci_config_writew(device, PCI_COMMAND, cmd_reg);
+ }
+
+ /* Configure PHY internal loopback for testing. */
+ igb_setup_loopback(igb);
+
+ /*
+ * Disable DMA re-send on PCIe completion timeout (82576 datasheet
+ * section 8.6.1, GCR.Completion_Timeout_Resend, bit 16). The
+ * mix_and_match test intentionally submits descriptors targeting
+ * unmapped IOVAs; with the default (set) value, the device keeps
+ * retrying the failed read indefinitely, which keeps PCIe AER and
+ * IOMMU error handling busy and interferes with reset recovery.
+ */
+ ctrl = igb_read32(igb, E1000_GCR);
+ ctrl &= ~E1000_GCR_CMPL_TMOUT_RESEND;
+ igb_write32(igb, E1000_GCR, ctrl);
+
+ /* Configure TX and RX descriptor rings */
+ igb_write32(igb, E1000_TDBAL(0), (u32)iova_tx);
+ igb_write32(igb, E1000_TDBAH(0), (u32)(iova_tx >> 32));
+ igb_write32(igb, E1000_TDLEN(0), RING_SIZE * sizeof(struct igb_tx_desc));
+ igb_write32(igb, E1000_TDH(0), 0);
+ igb_write32(igb, E1000_TDT(0), 0);
+ igb_write32(igb, E1000_TXDCTL(0), E1000_TXDCTL_QUEUE_ENABLE);
+
+ igb_write32(igb, E1000_RDBAL(0), (u32)iova_rx);
+ igb_write32(igb, E1000_RDBAH(0), (u32)(iova_rx >> 32));
+ igb_write32(igb, E1000_RDLEN(0), RING_SIZE * sizeof(struct igb_rx_desc));
+ igb_write32(igb, E1000_RDH(0), 0);
+ igb_write32(igb, E1000_RDT(0), 0);
+
+ /*
+ * Select the advanced one-buffer descriptor format. Per 82576
+ * datasheet section 7.1.5.2: "SRRCTL[n].DESCTYPE must be set to a
+ * value other than 000b for the 82576 to write back the special
+ * descriptors." struct igb_rx_desc matches the advanced one-buffer
+ * writeback layout (section 7.1.5.2), so polling rx.wb.status_error
+ * requires this format. Section 8.10.2 specifies DESCTYPE[27:25].
+ *
+ * The direct write also zeroes SRRCTL.BSIZEPACKET, which is
+ * intentional: per section 7.1.3.1 a zero BSIZEPACKET falls back to
+ * the RCTL.BSIZE buffer size, whose reset default (00b) is 2048
+ * bytes -- ample for the loopback frames here.
+ */
+ igb_write32(igb, E1000_SRRCTL(0), E1000_SRRCTL_DESCTYPE_ADV_ONEBUF);
+
+ igb_write32(igb, E1000_RXDCTL(0), E1000_RXDCTL_QUEUE_ENABLE);
+
+ /* Wait for TX and RX queues to be enabled */
+ retries = 2000;
+ while (retries-- > 0) {
+ if ((igb_read32(igb, E1000_TXDCTL(0)) & E1000_TXDCTL_QUEUE_ENABLE) &&
+ (igb_read32(igb, E1000_RXDCTL(0)) & E1000_RXDCTL_QUEUE_ENABLE))
+ break;
+ usleep(10);
+ }
+ VFIO_ASSERT_GE(retries, 0);
+
+ /*
+ * Enable Receiver and Transmitter. RCTL.LBM_MAC is set in addition
+ * to PHY loopback as a QEMU-only accommodation: QEMU's emulated igb
+ * does not honor PHY register 0 bit 14 (PHY internal loopback) and
+ * relies on RCTL.LBM_MAC to wrap TX descriptors back to the RX
+ * queue. Datasheet 8.10.1 (RCTL register) advises "When using the
+ * internal PHY, LBM should remain set to 00b", so setting LBM_MAC
+ * here deviates from datasheet guidance; empirically the bit has
+ * no observable effect on real 82576 hardware because MAC loopback
+ * is not implemented (datasheet 3.5.6.2). Setting both lets the
+ * selftest work on both real hardware and QEMU without conditional
+ * code paths.
+ */
+ rctl = E1000_RCTL_EN | /* Receiver Enable */
+ E1000_RCTL_UPE | /* Unicast Promiscuous (for dummy MAC) */
+ E1000_RCTL_MPE | /* Multicast Promiscuous */
+ E1000_RCTL_BAM | /* Broadcast Accept Mode */
+ E1000_RCTL_LBM_MAC | /* MAC Loopback - for QEMU emulation only */
+ E1000_RCTL_SECRC; /* Strip CRC (needed for memcmp) */
+ igb_write32(igb, E1000_RCTL, rctl);
+ igb_write32(igb, E1000_TCTL, E1000_TCTL_EN);
+
+ /*
+ * Program MSI-X interrupt routing per 82576 datasheet:
+ *
+ * GPIE (section 7.3.2.11, Table 7-47): set Multiple_MSIX (bit 4) to
+ * route interrupt causes through IVAR mapping, and EIAME (bit 30)
+ * to apply EIAM on MSI-X assertion (without EIAME, EIAM only
+ * applies on EICR read/write).
+ *
+ * EIAC (section 8.8.5): enable auto-clear of EICR for vector 0.
+ * Without auto-clear the cause stays set after delivery and the
+ * test can see spurious interrupts on the next memcpy batch.
+ *
+ * EIAM (section 8.8.6): enable auto-mask of EIMS for vector 0 on
+ * MSI-X assertion (effective because EIAME is set), so a single
+ * interrupt is delivered per memcpy batch even if the cause
+ * re-asserts before software re-enables the mask.
+ *
+ * IVAR (section 7.3.1.2, register definition in 8.8.13): map RX
+ * cause 0 to MSI-X vector 0 and mark the entry valid.
+ */
+ igb_write32(igb, E1000_GPIE, E1000_GPIE_MSIX_MODE | E1000_GPIE_EIAME);
+ igb_write32(igb, E1000_EIAC, MSIX_VECTOR_MASK);
+ igb_write32(igb, E1000_EIAM, MSIX_VECTOR_MASK);
+
+ /* Map vector 0 to interrupt cause 0 and mark it valid */
+ igb_write32(igb, E1000_IVAR0, E1000_IVAR_VALID);
+
+ /* Enable interrupts on vector 0 */
+ igb_write32(igb, E1000_EIMS, MSIX_VECTOR_MASK);
+
+ /* Initialize driver state and capability limits */
+ igb->tx_tail = 0;
+ igb->rx_tail = 0;
+
+ device->driver.max_memcpy_size = IGB_MAX_CHUNK_SIZE;
+ device->driver.max_memcpy_count = RING_SIZE - 1;
+ device->driver.msi = MSIX_VECTOR;
+}
+
+static void igb_init(struct vfio_pci_device *device)
+{
+ struct igb *igb = to_igb_state(device);
+
+ VFIO_ASSERT_GE(device->driver.region.size, sizeof(struct igb));
+
+ igb->bar0 = device->bars[0].vaddr;
+
+ igb_reset(igb);
+
+ /*
+ * Enable MSI-X via VFIO before device-side register programming.
+ * vfio_pci_msix_enable() only touches the VFIO IRQ machinery and the
+ * PCI MSI-X capability via config space; it has no ordering
+ * dependency on the device-side writes performed by igb_hw_init().
+ * Placing it here keeps igb_hw_init() reusable from the reset
+ * recovery path (which calls vfio_pci_irq_reenable() instead).
+ */
+ vfio_pci_msix_enable(device, MSIX_VECTOR, 1);
+
+ igb_hw_init(device);
+}
+
+static void igb_remove(struct vfio_pci_device *device)
+{
+ struct igb *igb = to_igb_state(device);
+
+ igb_write32(igb, E1000_RCTL, 0);
+ igb_write32(igb, E1000_TCTL, 0);
+ igb_reset(igb);
+
+ vfio_pci_msix_disable(device);
+}
+
+static void igb_irq_disable(struct igb *igb)
+{
+ igb_write32(igb, E1000_EIMC, MSIX_VECTOR_MASK);
+}
+
+static void igb_irq_enable(struct igb *igb)
+{
+ igb_write32(igb, E1000_EIMS, MSIX_VECTOR_MASK);
+}
+
+static void igb_irq_clear(struct igb *igb)
+{
+ /*
+ * Use write-to-clear (datasheet 7.3.4.2). In MSI-X mode with EIAC
+ * programmed, section 8.8.5 explicitly states "If any bits are set
+ * in EIAC, the EICR register should not be read", which rules out
+ * the read-to-clear path in 7.3.4.3. Bits not in EIAC are still
+ * cleared by writing 1.
+ */
+ igb_write32(igb, E1000_EICR, 0xFFFFFFFF);
+}
+
+static void igb_memcpy_start(struct vfio_pci_device *device, iova_t src,
+ iova_t dst, u64 size, u64 count)
+{
+ struct igb *igb = to_igb_state(device);
+ struct igb_rx_desc *rx;
+ struct igb_tx_desc *tx;
+ u32 i;
+
+ igb_irq_disable(igb);
+
+ for (i = 0; i < count; i++) {
+ tx = &igb->tx_ring[igb->tx_tail];
+ rx = &igb->rx_ring[igb->rx_tail];
+
+ memset(tx, 0, sizeof(struct igb_tx_desc));
+ memset(rx, 0, sizeof(struct igb_rx_desc));
+
+ rx->read.pkt_addr = cpu_to_le64(dst);
+ rx->read.hdr_addr = cpu_to_le64(0);
+
+ tx->read.buffer_addr = cpu_to_le64(src);
+ /*
+ * Build an advanced data descriptor per 82576 datasheet
+ * section 7.2.2.3. DEXT marks the descriptor as advanced
+ * (required by hardware); DTYP=data selects the data
+ * descriptor; IFCS asks the MAC to append the Ethernet
+ * FCS (without it the frame is dropped as malformed);
+ * EOP marks end of packet. DTALEN is the buffer length
+ * in bits 15:0 of cmd_type_len.
+ */
+ tx->read.cmd_type_len = cpu_to_le32((uint32_t)size |
+ E1000_ADVTXD_DTYP_DATA |
+ E1000_ADVTXD_DCMD_DEXT |
+ E1000_ADVTXD_DCMD_IFCS |
+ E1000_ADVTXD_DCMD_EOP);
+ /*
+ * PAYLEN (section 7.2.2.3.11) is the total payload size
+ * in olinfo_status[31:14].
+ */
+ tx->read.olinfo_status =
+ cpu_to_le32((uint32_t)size << E1000_ADVTXD_PAYLEN_SHIFT);
+
+ igb->tx_tail = (igb->tx_tail + 1) % RING_SIZE;
+ igb->rx_tail = (igb->rx_tail + 1) % RING_SIZE;
+ }
+
+ igb_write32(igb, E1000_RDT(0), igb->rx_tail);
+ igb_write32(igb, E1000_TDT(0), igb->tx_tail);
+}
+
+/*
+ * Reset the device via VFIO_DEVICE_RESET (PCIe FLR on the 82576) and
+ * re-program it. VFIO_DEVICE_RESET tears down the kernel-side MSI-X
+ * trigger but leaves user-side eventfds intact, so re-arm the trigger
+ * via vfio_pci_irq_reenable() before reprogramming so any caller-cached
+ * eventfd remains valid.
+ *
+ * FLR clears device-side state to power-on reset values (datasheet
+ * 4.2.1.5.1: a PF FLR is "equivalent to a D0->D3->D0 transition"), so
+ * EIMS and EICR come back as 0 from their register-defined initial
+ * values, and igb_hw_init() resets tx_tail/rx_tail to 0. The next
+ * igb_memcpy_start() will memset each descriptor it touches before
+ * submission, so no explicit IMC/EICR writes or ring memsets are
+ * needed here.
+ */
+static void igb_error_reset_and_reinit(struct vfio_pci_device *device)
+{
+ vfio_pci_device_reset(device);
+ vfio_pci_msix_reenable(device, MSIX_VECTOR, 1);
+ igb_hw_init(device);
+}
+
+static int igb_memcpy_wait(struct vfio_pci_device *device)
+{
+ struct igb *igb = to_igb_state(device);
+ struct igb_rx_desc *rx;
+ u32 status = 0;
+ u32 prev_tail;
+ int retries;
+
+ prev_tail = (igb->rx_tail + RING_SIZE - 1) % RING_SIZE;
+ rx = &igb->rx_ring[prev_tail];
+
+ /*
+ * Real 82576 hardware processes the descriptor ring at line rate.
+ * max_memcpy_size = (RING_SIZE - 1) * IGB_MAX_CHUNK_SIZE ~= 4 MB,
+ * split into 4095 1 KB frames. At 1 Gb/s (~125 MB/s) the worst
+ * valid memcpy takes ~32 ms on the wire, plus per-frame preamble,
+ * SFD, IFG and FCS overhead (~3%) and descriptor fetch/writeback
+ * latency. Wait up to ~200 ms before declaring the device hung;
+ * ~6x the line-rate floor leaves comfortable headroom for host
+ * scheduling jitter while keeping the intentional invalid-DMA
+ * tests bounded.
+ */
+ retries = 200;
+ while (retries-- > 0) {
+ status = le32_to_cpu(READ_ONCE(rx->wb.status_error));
+ if (status & 1)
+ break;
+ usleep(1000);
+ }
+
+ if (status & 1)
+ /*
+ * Ensure the test code doesn't speculatively read the DMA
+ * destination buffer before we have verified that the
+ * descriptor writeback is complete.
+ */
+ rmb();
+
+ igb_irq_clear(igb);
+
+ igb_irq_enable(igb);
+
+ if (status & 1)
+ return 0;
+
+ /*
+ * The descriptor never completed. On real 82576 hardware this
+ * typically follows a DMA-read fault from one of the intentional
+ * unmapped-IOVA tests; the fault leaves the descriptor engine
+ * unable to service subsequent valid descriptors. CTRL.RST alone
+ * reinitializes the queue registers but leaves the engine wedged
+ * for the current process, so a broader VFIO_DEVICE_RESET (FLR)
+ * is required.
+ */
+ igb_error_reset_and_reinit(device);
+
+ return -ETIMEDOUT;
+}
+
+static void igb_send_msi(struct vfio_pci_device *device)
+{
+ struct igb *igb = to_igb_state(device);
+
+ igb_write32(igb, E1000_EICS, MSIX_VECTOR_MASK);
+}
+
+const struct vfio_pci_driver_ops igb_ops = {
+ .name = "igb",
+ .probe = igb_probe,
+ .init = igb_init,
+ .remove = igb_remove,
+ .memcpy_start = igb_memcpy_start,
+ .memcpy_wait = igb_memcpy_wait,
+ .send_msi = igb_send_msi,
+};
diff --git a/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h b/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h
index 59acef381d056..e19bd94b8dd2a 100644
--- a/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h
+++ b/tools/testing/selftests/vfio/lib/include/libvfio/vfio_pci_device.h
@@ -43,6 +43,7 @@ void vfio_pci_device_free(struct vfio_pci_device *device);
struct vfio_pci_device *vfio_pci_device_init(const char *bdf, struct iommu *iommu);
void vfio_pci_device_cleanup(struct vfio_pci_device *device);
+int __vfio_pci_device_reset(struct vfio_pci_device *device);
void vfio_pci_device_reset(struct vfio_pci_device *device);
void vfio_pci_config_access(struct vfio_pci_device *device, bool write,
@@ -84,6 +85,8 @@ static inline void vfio_pci_cmd_clear(struct vfio_pci_device *device, u16 bits)
void vfio_pci_irq_enable(struct vfio_pci_device *device, u32 index,
u32 vector, int count);
void vfio_pci_irq_disable(struct vfio_pci_device *device, u32 index);
+void vfio_pci_irq_reenable(struct vfio_pci_device *device, u32 index,
+ u32 vector, int count);
void vfio_pci_irq_trigger(struct vfio_pci_device *device, u32 index, u32 vector);
static inline void fcntl_set_nonblock(int fd)
@@ -108,6 +111,12 @@ static inline void vfio_pci_msi_disable(struct vfio_pci_device *device)
vfio_pci_irq_disable(device, VFIO_PCI_MSI_IRQ_INDEX);
}
+static inline void vfio_pci_msi_reenable(struct vfio_pci_device *device,
+ u32 vector, int count)
+{
+ vfio_pci_irq_reenable(device, VFIO_PCI_MSI_IRQ_INDEX, vector, count);
+}
+
static inline void vfio_pci_msix_enable(struct vfio_pci_device *device,
u32 vector, int count)
{
@@ -119,6 +128,12 @@ static inline void vfio_pci_msix_disable(struct vfio_pci_device *device)
vfio_pci_irq_disable(device, VFIO_PCI_MSIX_IRQ_INDEX);
}
+static inline void vfio_pci_msix_reenable(struct vfio_pci_device *device,
+ u32 vector, int count)
+{
+ vfio_pci_irq_reenable(device, VFIO_PCI_MSIX_IRQ_INDEX, vector, count);
+}
+
static inline int __to_iova(struct vfio_pci_device *device, void *vaddr, iova_t *iova)
{
return __iommu_hva2iova(device->iommu, vaddr, iova);
diff --git a/tools/testing/selftests/vfio/lib/libvfio.mk b/tools/testing/selftests/vfio/lib/libvfio.mk
index 82132b648744b..bcfa74ae040e7 100644
--- a/tools/testing/selftests/vfio/lib/libvfio.mk
+++ b/tools/testing/selftests/vfio/lib/libvfio.mk
@@ -16,6 +16,7 @@ LIBVFIO_C += drivers/dsa/dsa.c
endif
LIBVFIO_C += drivers/nv_falcon/nv_falcon.c
+LIBVFIO_C += drivers/igb/igb.c
LIBVFIO_OUTPUT := $(OUTPUT)/libvfio
diff --git a/tools/testing/selftests/vfio/lib/vfio_pci_device.c b/tools/testing/selftests/vfio/lib/vfio_pci_device.c
index 28868343f2ab5..4063a0e2b3df3 100644
--- a/tools/testing/selftests/vfio/lib/vfio_pci_device.c
+++ b/tools/testing/selftests/vfio/lib/vfio_pci_device.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
#include <dirent.h>
+#include <errno.h>
#include <fcntl.h>
#include <libgen.h>
#include <stdint.h>
@@ -105,6 +106,28 @@ void vfio_pci_irq_disable(struct vfio_pci_device *device, u32 index)
vfio_pci_irq_set(device, index, 0, 0, NULL);
}
+/*
+ * Re-issue VFIO_DEVICE_SET_IRQS for an already-enabled vector range using
+ * the existing eventfds. Intended for drivers that need to re-arm device
+ * interrupts after a VFIO_DEVICE_RESET, which tears down the kernel-side
+ * IRQ trigger but leaves user-side eventfds intact. Recreating the
+ * eventfds would invalidate any test-fixture cache of the fd, so this
+ * helper deliberately preserves them.
+ */
+void vfio_pci_irq_reenable(struct vfio_pci_device *device, u32 index,
+ u32 vector, int count)
+{
+ int i;
+
+ check_supported_irq_index(index);
+
+ for (i = vector; i < vector + count; i++)
+ VFIO_ASSERT_GE(device->msi_eventfds[i], 0,
+ "vector %d eventfd not allocated\n", i);
+
+ vfio_pci_irq_set(device, index, vector, count, device->msi_eventfds + vector);
+}
+
static void vfio_pci_irq_get(struct vfio_pci_device *device, u32 index,
struct vfio_irq_info *irq_info)
{
@@ -237,9 +260,26 @@ void vfio_pci_config_access(struct vfio_pci_device *device, bool write,
write ? "write to" : "read from", config);
}
+int __vfio_pci_device_reset(struct vfio_pci_device *device)
+{
+ if (ioctl(device->fd, VFIO_DEVICE_RESET, NULL))
+ return -errno;
+
+ return 0;
+}
+
void vfio_pci_device_reset(struct vfio_pci_device *device)
{
- ioctl_assert(device->fd, VFIO_DEVICE_RESET, NULL);
+ int retries = 20;
+ int r;
+
+ do {
+ r = __vfio_pci_device_reset(device);
+ if (r == -EAGAIN)
+ usleep(10000);
+ } while (r == -EAGAIN && retries-- > 0);
+
+ VFIO_ASSERT_EQ(r, 0, "ioctl(device->fd, VFIO_DEVICE_RESET) failed\n");
}
void vfio_pci_group_setup(struct vfio_pci_device *device, const char *bdf)
diff --git a/tools/testing/selftests/vfio/lib/vfio_pci_driver.c b/tools/testing/selftests/vfio/lib/vfio_pci_driver.c
index 153bf4a7a19f9..5e65434d2318b 100644
--- a/tools/testing/selftests/vfio/lib/vfio_pci_driver.c
+++ b/tools/testing/selftests/vfio/lib/vfio_pci_driver.c
@@ -6,8 +6,8 @@
extern struct vfio_pci_driver_ops dsa_ops;
extern struct vfio_pci_driver_ops ioat_ops;
#endif
-
extern struct vfio_pci_driver_ops nv_falcon_ops;
+extern struct vfio_pci_driver_ops igb_ops;
static struct vfio_pci_driver_ops *driver_ops[] = {
#ifdef __x86_64__
@@ -15,6 +15,7 @@ static struct vfio_pci_driver_ops *driver_ops[] = {
&ioat_ops,
#endif
&nv_falcon_ops,
+ &igb_ops,
};
void vfio_pci_driver_probe(struct vfio_pci_device *device)
|
| 3/2 | 2026/07/31 06:12 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 12984 output: 65 thoughts: 1016 Thoughts: **Analysis of the VFIO Selftest Patch for Fuzzing Eligibility** Okay, so I've got this patch adding an `igb` driver to VFIO selftests. Initially, I see changes in `tools/testing/selftests/vfio/lib/drivers/igb/` and `tools/testing/selftests/vfio/lib/`, specifically adding `igb.c` which implements a VFIO driver to test the Intel 82576 Gigabit Ethernet Controller. The patch also touches `vfio_pci_device.c`. Now, the prompt gives me specific criteria for determining if a patch is "WorthFuzzing=false". I need to carefully evaluate this. The key is to understand if this patch impacts the code that syzkaller, our primary fuzzer, targets. A quick review of the prompt's criteria reveals a list of modifications that don't warrant fuzzing. Crucially, this patch *only* modifies code within the `tools/testing/selftests/vfio/` directory. These are *selftests*, userspace programs designed to test the kernel's VFIO functionality. My understanding is that syzkaller directly fuzzes the *kernel* itself, not the userspace test tools. Syzkaller is focused on the core kernel logic and drivers, and not user-space tests. Let me make sure I'm not missing anything. I check the diff of the patch again and confirm. The patch adds `igb.c`, modifies several other files and headers within the `tools/testing/selftests/vfio/lib/` directory. Since the patch's changes are solely contained within the selftests directory, and it doesn't touch any core kernel code, drivers, or architectures, I'm confident that it does *not* warrant fuzzing. Although the prompt doesn't explicitly mention `tools/` or `selftests/`, it does say to return WorthFuzzing=false if it *only* contains modifications that don't affect kernel logic. I re-read the prompt, just to be completely certain. It does mention modifications to kernel logic, drivers or architectures should be fuzzed, but this patch only modifies userspace code. Therefore, my final determination is **WorthFuzzing=false** because the patch only modifies userspace selftests in `tools/testing/selftests/vfio/` and does not make any functional changes to the kernel code itself. |
| 4/2 | 2026/07/31 06:12 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch only modifies userspace selftests in tools/testing/selftests/vfio/ and does not make any functional changes to the kernel code itself.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies userspace selftests in tools/testing/selftests/vfio/ and does not make any functional changes to the kernel code itself.",
"WorthFuzzing": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|