AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the Marvell OcteonTX2 RVU driver, which is a vendor-specific PCIe network driver that requires physical hardware not emulated in standard QEMU.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 14216d2e52c9ba26544aa3c5c6092d614f3bfdc8\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Aug 27 08:45:43 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c\nindex 74c041ab5280a..f484e362cf571 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c\n@@ -3716,6 +3716,10 @@ static void rvu_remove(struct pci_dev *pdev)\n \trvu_unregister_dl(rvu);\n \trvu_unregister_interrupts(rvu);\n \trvu_flr_wq_destroy(rvu);\n+\tif (rvu-\u003erep_evt_wq) {\n+\t\tdestroy_workqueue(rvu-\u003erep_evt_wq);\n+\t\trvu-\u003erep_evt_wq = NULL;\n+\t}\n \trvu_cgx_exit(rvu);\n \trvu_fwdata_exit(rvu);\n \trvu_mcs_exit(rvu);\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\nindex a2781e0f504e3..ef8d30eeeafd9 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\n@@ -44,6 +44,8 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)\n \tif (event-\u003eevent \u0026 RVU_EVENT_MAC_ADDR_CHANGE)\n \t\tether_addr_copy(pfvf-\u003emac_addr, event-\u003eevt_data.mac);\n \n+\tif (event-\u003eevent \u0026 RVU_EVENT_PFVF_STATE)\n+\t\tpf = rvu_get_pf(rvu-\u003epdev, event-\u003ehdr.pcifunc);\n \tmutex_lock(\u0026rvu-\u003embox_lock);\n \tmsg = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);\n \tif (!msg) {\n@@ -53,6 +55,10 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)\n \n \tmsg-\u003ehdr.pcifunc = event-\u003epcifunc;\n \tmsg-\u003eevent = event-\u003eevent;\n+\tmsg-\u003epcifunc = event-\u003epcifunc;\n+\n+\tif (event-\u003eevent \u0026 RVU_EVENT_PFVF_STATE)\n+\t\tmsg-\u003ehdr.pcifunc = event-\u003ehdr.pcifunc;\n \n \tmemcpy(\u0026msg-\u003eevt_data, \u0026event-\u003eevt_data, sizeof(struct rep_evt_data));\n \n@@ -97,6 +103,9 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,\n {\n \tstruct rep_evtq_ent *qentry;\n \n+\tif (!rvu-\u003erep_evt_wq)\n+\t\treturn -EINVAL;\n+\n \t/* The mailbox dispatcher normalises only the header pcifunc; the\n \t * nested struct rep_event::pcifunc body field is sender-controlled\n \t * and is later used by rvu_rep_up_notify() to index rvu-\u003epf[] /\n@@ -105,6 +114,10 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,\n \tif (!is_pf_func_valid(rvu, req-\u003epcifunc))\n \t\treturn -EINVAL;\n \n+\tif ((req-\u003eevent \u0026 RVU_EVENT_PFVF_STATE) \u0026\u0026\n+\t    rvu_get_pf(rvu-\u003epdev, req-\u003ehdr.pcifunc) \u003e= rvu-\u003ehw-\u003etotal_pfs)\n+\t\treturn -EINVAL;\n+\n \tqentry = kmalloc_obj(*qentry, GFP_ATOMIC);\n \tif (!qentry)\n \t\treturn -ENOMEM;\n@@ -119,31 +132,17 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,\n \n int rvu_rep_notify_pfvf_state(struct rvu *rvu, u16 pcifunc, bool enable)\n {\n-\tstruct rep_event *req;\n-\tint pf;\n+\tstruct rep_event req = { 0 };\n+\tstruct msg_rsp rsp;\n \n \tif (!is_pf_cgxmapped(rvu, rvu_get_pf(rvu-\u003epdev, pcifunc)))\n \t\treturn 0;\n \n-\tpf = rvu_get_pf(rvu-\u003epdev, rvu-\u003erep_pcifunc);\n-\n-\tmutex_lock(\u0026rvu-\u003embox_lock);\n-\treq = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);\n-\tif (!req) {\n-\t\tmutex_unlock(\u0026rvu-\u003embox_lock);\n-\t\treturn -ENOMEM;\n-\t}\n-\n-\treq-\u003ehdr.pcifunc = rvu-\u003erep_pcifunc;\n-\treq-\u003eevent |= RVU_EVENT_PFVF_STATE;\n-\treq-\u003epcifunc = pcifunc;\n-\treq-\u003eevt_data.vf_state = enable;\n-\n-\totx2_mbox_wait_for_zero(\u0026rvu-\u003eafpf_wq_info.mbox_up, pf);\n-\totx2_mbox_msg_send_up(\u0026rvu-\u003eafpf_wq_info.mbox_up, pf);\n-\n-\tmutex_unlock(\u0026rvu-\u003embox_lock);\n-\treturn 0;\n+\treq.hdr.pcifunc = rvu-\u003erep_pcifunc;\n+\treq.event = RVU_EVENT_PFVF_STATE;\n+\treq.pcifunc = pcifunc;\n+\treq.evt_data.vf_state = enable;\n+\treturn rvu_mbox_handler_rep_event_notify(rvu, \u0026req, \u0026rsp);\n }\n \n #define RVU_LF_RX_STATS(reg) \\\n@@ -325,6 +324,7 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \tu16 start = rswitch-\u003estart_entry;\n \tstruct rvu_hwinfo *hw = rvu-\u003ehw;\n \tu16 pcifunc, entry = 0;\n+\tstruct rvu_pfvf *pfvf;\n \tint pf, vf, numvfs;\n \tint err, nixlf, i;\n \tu8 rep;\n@@ -334,7 +334,10 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \t\t\tcontinue;\n \n \t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, 0);\n+\t\tpfvf = rvu_get_pfvf(rvu, pcifunc);\n \t\trvu_get_nix_blkaddr(rvu, pcifunc);\n+\t\tif (test_bit(NIXLF_INITIALIZED, \u0026pfvf-\u003eflags))\n+\t\t\trvu_switch_enable_lbk_link(rvu, pcifunc, true);\n \t\trep = true;\n \t\tfor (i = 0; i \u003c 2; i++) {\n \t\t\terr = rvu_rep_install_rx_rule(rvu, pcifunc,\n@@ -354,6 +357,9 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \t\trvu_get_pf_numvfs(rvu, pf, \u0026numvfs, NULL);\n \t\tfor (vf = 0; vf \u003c numvfs; vf++) {\n \t\t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, vf + 1);\n+\t\t\tpfvf = rvu_get_pfvf(rvu, pcifunc);\n+\t\t\tif (test_bit(NIXLF_INITIALIZED, \u0026pfvf-\u003eflags))\n+\t\t\t\trvu_switch_enable_lbk_link(rvu, pcifunc, true);\n \t\t\trvu_get_nix_blkaddr(rvu, pcifunc);\n \n \t\t\t/* Skip installimg rules if nixlf is not attached */\n@@ -379,16 +385,6 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)\n \t\t\t}\n \t\t}\n \t}\n-\n-\t/* Initialize the wq for handling REP events */\n-\tspin_lock_init(\u0026rvu-\u003erep_evtq_lock);\n-\tINIT_LIST_HEAD(\u0026rvu-\u003erep_evtq_head);\n-\tINIT_WORK(\u0026rvu-\u003erep_evt_work, rvu_rep_wq_handler);\n-\trvu-\u003erep_evt_wq = alloc_workqueue(\"rep_evt_wq\", WQ_PERCPU, 0);\n-\tif (!rvu-\u003erep_evt_wq) {\n-\t\tdev_err(rvu-\u003edev, \"REP workqueue allocation failed\\n\");\n-\t\treturn -ENOMEM;\n-\t}\n \treturn 0;\n }\n \n@@ -443,35 +439,74 @@ int rvu_mbox_handler_esw_cfg(struct rvu *rvu, struct esw_cfg_req *req,\n \treturn 0;\n }\n \n+static int rvu_rep_get_rep_map(struct rvu *rvu, struct msg_req *req,\n+\t\t\t       struct get_rep_cnt_rsp *rsp)\n+{\n+\tint rep;\n+\n+\trvu-\u003erep_pcifunc = req-\u003ehdr.pcifunc;\n+\trsp-\u003erep_cnt = rvu-\u003erep_cnt;\n+\tfor (rep = 0; rep \u003c rvu-\u003erep_cnt; rep++)\n+\t\trsp-\u003erep_pf_map[rep] = rvu-\u003erep2pfvf_map[rep];\n+\n+\treturn 0;\n+}\n+\n int rvu_mbox_handler_get_rep_cnt(struct rvu *rvu, struct msg_req *req,\n \t\t\t\t struct get_rep_cnt_rsp *rsp)\n {\n \tint pf, vf, numvfs, hwvf, rep = 0;\n \tu16 pcifunc;\n+\tu16 *map;\n+\n+\tif (rvu-\u003erep2pfvf_map)\n+\t\treturn rvu_rep_get_rep_map(rvu, req, rsp);\n \n \trvu-\u003erep_pcifunc = req-\u003ehdr.pcifunc;\n \trsp-\u003erep_cnt = rvu-\u003ecgx_mapped_pfs + rvu-\u003ecgx_mapped_vfs;\n-\trvu-\u003erep_cnt = rsp-\u003erep_cnt;\n \n-\trvu-\u003erep2pfvf_map = devm_kzalloc(rvu-\u003edev, rvu-\u003erep_cnt *\n-\t\t\t\t\t sizeof(u16), GFP_KERNEL);\n-\tif (!rvu-\u003erep2pfvf_map)\n+\t/* Allocate at least one element so the map pointer is always non-NULL\n+\t * once published, making the above guard unconditionally reliable.\n+\t */\n+\tmap = devm_kzalloc(rvu-\u003edev, (rsp-\u003erep_cnt ?: 1) * sizeof(u16),\n+\t\t\t   GFP_KERNEL);\n+\tif (!map)\n \t\treturn -ENOMEM;\n \n+\trvu-\u003erep_cnt = rsp-\u003erep_cnt;\n+\n \tfor (pf = 0; pf \u003c rvu-\u003ehw-\u003etotal_pfs; pf++) {\n \t\tif (!is_pf_cgxmapped(rvu, pf))\n \t\t\tcontinue;\n \t\tpcifunc = rvu_make_pcifunc(rvu-\u003epdev, pf, 0);\n-\t\trvu-\u003erep2pfvf_map[rep] = pcifunc;\n+\t\tmap[rep] = pcifunc;\n \t\trsp-\u003erep_pf_map[rep] = pcifunc;\n \t\trep++;\n \t\trvu_get_pf_numvfs(rvu, pf, \u0026numvfs, \u0026hwvf);\n \t\tfor (vf = 0; vf \u003c numvfs; vf++) {\n-\t\t\trvu-\u003erep2pfvf_map[rep] = pcifunc |\n-\t\t\t\t((vf + 1) \u0026 RVU_PFVF_FUNC_MASK);\n-\t\t\trsp-\u003erep_pf_map[rep] = rvu-\u003erep2pfvf_map[rep];\n+\t\t\tmap[rep] = pcifunc | ((vf + 1) \u0026 RVU_PFVF_FUNC_MASK);\n+\t\t\trsp-\u003erep_pf_map[rep] = map[rep];\n \t\t\trep++;\n \t\t}\n \t}\n+\n+\tif (!rvu-\u003erep_cnt) {\n+\t\trvu-\u003erep2pfvf_map = map;\n+\t\treturn 0;\n+\t}\n+\n+\t/* Initialize the wq for handling REP events */\n+\tspin_lock_init(\u0026rvu-\u003erep_evtq_lock);\n+\tINIT_LIST_HEAD(\u0026rvu-\u003erep_evtq_head);\n+\tINIT_WORK(\u0026rvu-\u003erep_evt_work, rvu_rep_wq_handler);\n+\trvu-\u003erep_evt_wq = alloc_workqueue(\"rep_evt_wq\", WQ_UNBOUND, 0);\n+\tif (!rvu-\u003erep_evt_wq) {\n+\t\tdev_err(rvu-\u003edev, \"REP workqueue allocation failed\\n\");\n+\t\tdevm_kfree(rvu-\u003edev, map);\n+\t\trvu-\u003erep_cnt = 0;\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\trvu-\u003erep2pfvf_map = map;\n \treturn 0;\n }\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c\nindex 49ce38685a7e6..6f1330ae8d900 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c\n@@ -15,8 +15,10 @@ void rvu_switch_enable_lbk_link(struct rvu *rvu, u16 pcifunc, bool enable)\n \n \tnix_hw = get_nix_hw(rvu-\u003ehw, pfvf-\u003enix_blkaddr);\n \t/* Enable LBK links with channel 63 for TX MCAM rule */\n+\tmutex_lock(\u0026rvu-\u003ersrc_lock);\n \trvu_nix_tx_tl2_cfg(rvu, pfvf-\u003enix_blkaddr, pcifunc,\n \t\t\t   \u0026nix_hw-\u003etxsch[NIX_TXSCH_LVL_TL2], enable);\n+\tmutex_unlock(\u0026rvu-\u003ersrc_lock);\n }\n \n static int rvu_switch_install_rx_rule(struct rvu *rvu, u16 pcifunc,\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c\nindex 0f5d5642d3f7a..3f89a2c04b2b5 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c\n@@ -459,6 +459,9 @@ static int rvu_rep_open(struct net_device *dev)\n \tnetif_carrier_on(dev);\n \tnetif_tx_start_all_queues(dev);\n \n+\tif (rep-\u003epcifunc \u0026 RVU_PFVF_FUNC_MASK)\n+\t\treturn 0;\n+\n \tevt.event = RVU_EVENT_PORT_STATE;\n \tevt.evt_data.port_state = 1;\n \tevt.pcifunc = rep-\u003epcifunc;\n@@ -478,6 +481,9 @@ static int rvu_rep_stop(struct net_device *dev)\n \tnetif_carrier_off(dev);\n \tnetif_tx_disable(dev);\n \n+\tif (rep-\u003epcifunc \u0026 RVU_PFVF_FUNC_MASK)\n+\t\treturn 0;\n+\n \tevt.event = RVU_EVENT_PORT_STATE;\n \tevt.pcifunc = rep-\u003epcifunc;\n \trvu_rep_notify_pfvf(priv, RVU_EVENT_PORT_STATE, \u0026evt);\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Marvell OcteonTX2 RVU driver, which is a vendor-specific PCIe network driver that requires physical hardware not emulated in standard QEMU.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 14216d2e52c9ba26544aa3c5c6092d614f3bfdc8
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Aug 27 08:45:43 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
index 74c041ab5280a..f484e362cf571 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -3716,6 +3716,10 @@ static void rvu_remove(struct pci_dev *pdev)
 	rvu_unregister_dl(rvu);
 	rvu_unregister_interrupts(rvu);
 	rvu_flr_wq_destroy(rvu);
+	if (rvu->rep_evt_wq) {
+		destroy_workqueue(rvu->rep_evt_wq);
+		rvu->rep_evt_wq = NULL;
+	}
 	rvu_cgx_exit(rvu);
 	rvu_fwdata_exit(rvu);
 	rvu_mcs_exit(rvu);
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c
index a2781e0f504e3..ef8d30eeeafd9 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c
@@ -44,6 +44,8 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)
 	if (event->event & RVU_EVENT_MAC_ADDR_CHANGE)
 		ether_addr_copy(pfvf->mac_addr, event->evt_data.mac);
 
+	if (event->event & RVU_EVENT_PFVF_STATE)
+		pf = rvu_get_pf(rvu->pdev, event->hdr.pcifunc);
 	mutex_lock(&rvu->mbox_lock);
 	msg = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);
 	if (!msg) {
@@ -53,6 +55,10 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)
 
 	msg->hdr.pcifunc = event->pcifunc;
 	msg->event = event->event;
+	msg->pcifunc = event->pcifunc;
+
+	if (event->event & RVU_EVENT_PFVF_STATE)
+		msg->hdr.pcifunc = event->hdr.pcifunc;
 
 	memcpy(&msg->evt_data, &event->evt_data, sizeof(struct rep_evt_data));
 
@@ -97,6 +103,9 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,
 {
 	struct rep_evtq_ent *qentry;
 
+	if (!rvu->rep_evt_wq)
+		return -EINVAL;
+
 	/* The mailbox dispatcher normalises only the header pcifunc; the
 	 * nested struct rep_event::pcifunc body field is sender-controlled
 	 * and is later used by rvu_rep_up_notify() to index rvu->pf[] /
@@ -105,6 +114,10 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,
 	if (!is_pf_func_valid(rvu, req->pcifunc))
 		return -EINVAL;
 
+	if ((req->event & RVU_EVENT_PFVF_STATE) &&
+	    rvu_get_pf(rvu->pdev, req->hdr.pcifunc) >= rvu->hw->total_pfs)
+		return -EINVAL;
+
 	qentry = kmalloc_obj(*qentry, GFP_ATOMIC);
 	if (!qentry)
 		return -ENOMEM;
@@ -119,31 +132,17 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, struct rep_event *req,
 
 int rvu_rep_notify_pfvf_state(struct rvu *rvu, u16 pcifunc, bool enable)
 {
-	struct rep_event *req;
-	int pf;
+	struct rep_event req = { 0 };
+	struct msg_rsp rsp;
 
 	if (!is_pf_cgxmapped(rvu, rvu_get_pf(rvu->pdev, pcifunc)))
 		return 0;
 
-	pf = rvu_get_pf(rvu->pdev, rvu->rep_pcifunc);
-
-	mutex_lock(&rvu->mbox_lock);
-	req = otx2_mbox_alloc_msg_rep_event_up_notify(rvu, pf);
-	if (!req) {
-		mutex_unlock(&rvu->mbox_lock);
-		return -ENOMEM;
-	}
-
-	req->hdr.pcifunc = rvu->rep_pcifunc;
-	req->event |= RVU_EVENT_PFVF_STATE;
-	req->pcifunc = pcifunc;
-	req->evt_data.vf_state = enable;
-
-	otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, pf);
-	otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, pf);
-
-	mutex_unlock(&rvu->mbox_lock);
-	return 0;
+	req.hdr.pcifunc = rvu->rep_pcifunc;
+	req.event = RVU_EVENT_PFVF_STATE;
+	req.pcifunc = pcifunc;
+	req.evt_data.vf_state = enable;
+	return rvu_mbox_handler_rep_event_notify(rvu, &req, &rsp);
 }
 
 #define RVU_LF_RX_STATS(reg) \
@@ -325,6 +324,7 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
 	u16 start = rswitch->start_entry;
 	struct rvu_hwinfo *hw = rvu->hw;
 	u16 pcifunc, entry = 0;
+	struct rvu_pfvf *pfvf;
 	int pf, vf, numvfs;
 	int err, nixlf, i;
 	u8 rep;
@@ -334,7 +334,10 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
 			continue;
 
 		pcifunc = rvu_make_pcifunc(rvu->pdev, pf, 0);
+		pfvf = rvu_get_pfvf(rvu, pcifunc);
 		rvu_get_nix_blkaddr(rvu, pcifunc);
+		if (test_bit(NIXLF_INITIALIZED, &pfvf->flags))
+			rvu_switch_enable_lbk_link(rvu, pcifunc, true);
 		rep = true;
 		for (i = 0; i < 2; i++) {
 			err = rvu_rep_install_rx_rule(rvu, pcifunc,
@@ -354,6 +357,9 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
 		rvu_get_pf_numvfs(rvu, pf, &numvfs, NULL);
 		for (vf = 0; vf < numvfs; vf++) {
 			pcifunc = rvu_make_pcifunc(rvu->pdev, pf, vf + 1);
+			pfvf = rvu_get_pfvf(rvu, pcifunc);
+			if (test_bit(NIXLF_INITIALIZED, &pfvf->flags))
+				rvu_switch_enable_lbk_link(rvu, pcifunc, true);
 			rvu_get_nix_blkaddr(rvu, pcifunc);
 
 			/* Skip installimg rules if nixlf is not attached */
@@ -379,16 +385,6 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)
 			}
 		}
 	}
-
-	/* Initialize the wq for handling REP events */
-	spin_lock_init(&rvu->rep_evtq_lock);
-	INIT_LIST_HEAD(&rvu->rep_evtq_head);
-	INIT_WORK(&rvu->rep_evt_work, rvu_rep_wq_handler);
-	rvu->rep_evt_wq = alloc_workqueue("rep_evt_wq", WQ_PERCPU, 0);
-	if (!rvu->rep_evt_wq) {
-		dev_err(rvu->dev, "REP workqueue allocation failed\n");
-		return -ENOMEM;
-	}
 	return 0;
 }
 
@@ -443,35 +439,74 @@ int rvu_mbox_handler_esw_cfg(struct rvu *rvu, struct esw_cfg_req *req,
 	return 0;
 }
 
+static int rvu_rep_get_rep_map(struct rvu *rvu, struct msg_req *req,
+			       struct get_rep_cnt_rsp *rsp)
+{
+	int rep;
+
+	rvu->rep_pcifunc = req->hdr.pcifunc;
+	rsp->rep_cnt = rvu->rep_cnt;
+	for (rep = 0; rep < rvu->rep_cnt; rep++)
+		rsp->rep_pf_map[rep] = rvu->rep2pfvf_map[rep];
+
+	return 0;
+}
+
 int rvu_mbox_handler_get_rep_cnt(struct rvu *rvu, struct msg_req *req,
 				 struct get_rep_cnt_rsp *rsp)
 {
 	int pf, vf, numvfs, hwvf, rep = 0;
 	u16 pcifunc;
+	u16 *map;
+
+	if (rvu->rep2pfvf_map)
+		return rvu_rep_get_rep_map(rvu, req, rsp);
 
 	rvu->rep_pcifunc = req->hdr.pcifunc;
 	rsp->rep_cnt = rvu->cgx_mapped_pfs + rvu->cgx_mapped_vfs;
-	rvu->rep_cnt = rsp->rep_cnt;
 
-	rvu->rep2pfvf_map = devm_kzalloc(rvu->dev, rvu->rep_cnt *
-					 sizeof(u16), GFP_KERNEL);
-	if (!rvu->rep2pfvf_map)
+	/* Allocate at least one element so the map pointer is always non-NULL
+	 * once published, making the above guard unconditionally reliable.
+	 */
+	map = devm_kzalloc(rvu->dev, (rsp->rep_cnt ?: 1) * sizeof(u16),
+			   GFP_KERNEL);
+	if (!map)
 		return -ENOMEM;
 
+	rvu->rep_cnt = rsp->rep_cnt;
+
 	for (pf = 0; pf < rvu->hw->total_pfs; pf++) {
 		if (!is_pf_cgxmapped(rvu, pf))
 			continue;
 		pcifunc = rvu_make_pcifunc(rvu->pdev, pf, 0);
-		rvu->rep2pfvf_map[rep] = pcifunc;
+		map[rep] = pcifunc;
 		rsp->rep_pf_map[rep] = pcifunc;
 		rep++;
 		rvu_get_pf_numvfs(rvu, pf, &numvfs, &hwvf);
 		for (vf = 0; vf < numvfs; vf++) {
-			rvu->rep2pfvf_map[rep] = pcifunc |
-				((vf + 1) & RVU_PFVF_FUNC_MASK);
-			rsp->rep_pf_map[rep] = rvu->rep2pfvf_map[rep];
+			map[rep] = pcifunc | ((vf + 1) & RVU_PFVF_FUNC_MASK);
+			rsp->rep_pf_map[rep] = map[rep];
 			rep++;
 		}
 	}
+
+	if (!rvu->rep_cnt) {
+		rvu->rep2pfvf_map = map;
+		return 0;
+	}
+
+	/* Initialize the wq for handling REP events */
+	spin_lock_init(&rvu->rep_evtq_lock);
+	INIT_LIST_HEAD(&rvu->rep_evtq_head);
+	INIT_WORK(&rvu->rep_evt_work, rvu_rep_wq_handler);
+	rvu->rep_evt_wq = alloc_workqueue("rep_evt_wq", WQ_UNBOUND, 0);
+	if (!rvu->rep_evt_wq) {
+		dev_err(rvu->dev, "REP workqueue allocation failed\n");
+		devm_kfree(rvu->dev, map);
+		rvu->rep_cnt = 0;
+		return -ENOMEM;
+	}
+
+	rvu->rep2pfvf_map = map;
 	return 0;
 }
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c
index 49ce38685a7e6..6f1330ae8d900 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c
@@ -15,8 +15,10 @@ void rvu_switch_enable_lbk_link(struct rvu *rvu, u16 pcifunc, bool enable)
 
 	nix_hw = get_nix_hw(rvu->hw, pfvf->nix_blkaddr);
 	/* Enable LBK links with channel 63 for TX MCAM rule */
+	mutex_lock(&rvu->rsrc_lock);
 	rvu_nix_tx_tl2_cfg(rvu, pfvf->nix_blkaddr, pcifunc,
 			   &nix_hw->txsch[NIX_TXSCH_LVL_TL2], enable);
+	mutex_unlock(&rvu->rsrc_lock);
 }
 
 static int rvu_switch_install_rx_rule(struct rvu *rvu, u16 pcifunc,
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
index 0f5d5642d3f7a..3f89a2c04b2b5 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
@@ -459,6 +459,9 @@ static int rvu_rep_open(struct net_device *dev)
 	netif_carrier_on(dev);
 	netif_tx_start_all_queues(dev);
 
+	if (rep->pcifunc & RVU_PFVF_FUNC_MASK)
+		return 0;
+
 	evt.event = RVU_EVENT_PORT_STATE;
 	evt.evt_data.port_state = 1;
 	evt.pcifunc = rep->pcifunc;
@@ -478,6 +481,9 @@ static int rvu_rep_stop(struct net_device *dev)
 	netif_carrier_off(dev);
 	netif_tx_disable(dev);
 
+	if (rep->pcifunc & RVU_PFVF_FUNC_MASK)
+		return 0;
+
 	evt.event = RVU_EVENT_PORT_STATE;
 	evt.pcifunc = rep->pcifunc;
 	rvu_rep_notify_pfvf(priv, RVU_EVENT_PORT_STATE, &evt);

gemini-3.1-pro-preview

null

null

							input: 6098
							output: 68
							thoughts: 534
						

**WorthFuzzing Decision: No**

Okay, let's break this down. My initial thought was to determine if this patch introduces functional changes that warrant fuzzing. The files impacted are all within the Marvell OcteonTX2 RVU driver (`drivers/net/ethernet/marvell/octeontx2/`), specifically `rvu.c`, `rvu_rep.c`, `rvu_switch.c`, and `nic/rep.c`. This suggests it's a SmartNIC or network-focused driver, and the patch fixes things related to the representor workqueue, locking, and message handling. Functionally important fixes, possibly, but the instructions are pretty clear.

The key here is that the instructions explicitly say to return `WorthFuzzing=false` for code within "vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU." Marvell OcteonTX2 definitely falls into that category of vendor-specific SmartNIC drivers. I've seen it enough times.

To confirm, I double-checked. Yep, `drivers/net/ethernet/marvell/octeontx2/` is explicitly for the Marvell OcteonTX2 RVU Admin Function Driver. It's not something you can just spin up in a standard QEMU environment. Looking at the code itself, `rvu_driver` is a PCI driver, using `PCI_VENDOR_ID_CAVIUM` (0x177d) and `PCI_DEVICE_ID_RVU_AF` (0xa065) device IDs. This confirms it needs physical PCIe hardware or specialized emulation. It's not standard.

Therefore, because this patch modifies vendor-specific Marvell OcteonTX2 network driver code that requires physical hardware not emulated in a standard QEMU environment, the decision is `WorthFuzzing=false`. It's a clear case.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Marvell OcteonTX2 RVU driver, which is a vendor-specific PCIe network driver that requires physical hardware not emulated in standard QEMU.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Marvell OcteonTX2 RVU driver, which is a vendor-specific PCIe network driver that requires physical hardware not emulated in standard QEMU.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null