| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/02 11:14 | flow | patch-triage |
1mArgs:null Results: {
"EnableConfigs": [
"OCTEONTX2_AF"
],
"FocusSymbols": [
"rvu_mbox_handler_nix_set_rx_mode"
],
"Reasoning": "The patch modifies the logic for enabling/disabling multicast and promiscuous modes in the Marvell OcteonTX2 RVU Admin Function driver. It specifically changes the behavior for Virtual Functions (VFs). This is a functional change in a reachable PCI driver (via vhci emulation).",
"WorthFuzzing": true
} |
| 1/1 | 2026/07/02 11:14 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 2d681e0723dee3c1d6c96208c60b25b2690e0307\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jul 2 11:14:14 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c\nindex d8989395e875da..a7e0e0e05ad23b 100644\n--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c\n+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c\n@@ -4575,7 +4575,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,\n \t\trvu_npc_install_allmulti_entry(rvu, pcifunc, nixlf,\n \t\t\t\t\t pfvf-\u003erx_chan_base);\n \t} else {\n-\t\tif (!nix_rx_multicast)\n+\t\tif (!nix_rx_multicast \u0026\u0026 !is_vf(pcifunc))\n \t\t\trvu_npc_enable_allmulti_entry(rvu, pcifunc, nixlf, false);\n \t}\n \n@@ -4585,7 +4585,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,\n \t\t\t\t\t pfvf-\u003erx_chan_base,\n \t\t\t\t\t pfvf-\u003erx_chan_cnt);\n \telse\n-\t\tif (!nix_rx_multicast)\n+\t\tif (!nix_rx_multicast \u0026\u0026 !is_vf(pcifunc))\n \t\t\trvu_npc_enable_promisc_entry(rvu, pcifunc, nixlf, false);\n \n \treturn 0;\n"
} |
| 2/1 | 2026/07/02 11:14 | agent | patch-evaluator |
1mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"OCTEONTX2_AF"
],
"FocusSymbols": [
"rvu_mbox_handler_nix_set_rx_mode"
],
"Reasoning": "The patch modifies the logic for enabling/disabling multicast and promiscuous modes in the Marvell OcteonTX2 RVU Admin Function driver. It specifically changes the behavior for Virtual Functions (VFs). This is a functional change in a reachable PCI driver (via vhci emulation).",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 2d681e0723dee3c1d6c96208c60b25b2690e0307
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Jul 2 11:14:14 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
index d8989395e875da..a7e0e0e05ad23b 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
@@ -4575,7 +4575,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
rvu_npc_install_allmulti_entry(rvu, pcifunc, nixlf,
pfvf->rx_chan_base);
} else {
- if (!nix_rx_multicast)
+ if (!nix_rx_multicast && !is_vf(pcifunc))
rvu_npc_enable_allmulti_entry(rvu, pcifunc, nixlf, false);
}
@@ -4585,7 +4585,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
pfvf->rx_chan_base,
pfvf->rx_chan_cnt);
else
- if (!nix_rx_multicast)
+ if (!nix_rx_multicast && !is_vf(pcifunc))
rvu_npc_enable_promisc_entry(rvu, pcifunc, nixlf, false);
return 0;
|
| 3/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2090 output: 60 thoughts: 264 Thoughts: **Analyzing a Marvell OcteonTX2 RVU Driver Patch** Okay, so I'm looking at a patch that tweaks the `rvu_mbox_handler_nix_set_rx_mode` function in `drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c`. The core change is a small conditional modification: `!nix_rx_multicast` now includes a check for `!is_vf(pcifunc)`. Functionally, this seems straightforward enough within the context of the OcteonTX2 RVU driver. However, my expert instincts kick in immediately. The OcteonTX2 is a hardware-specific ethernet controller. My first thought is about reachability. Could this driver even be exercised in a virtualized environment like QEMU or Google Compute Engine? Generally, these hardware-specific drivers aren't accessible unless there's an emulator specifically for the OcteonTX2 or if it's operating as a generic driver. So, the next step is to investigate the possibility of emulation in QEMU. Is there an OcteonTX2 model available, or is it treated as a generic PCI device? Hold on, there is syzkaller, which might be able to fuzz the PCI device through the virtual PCI device (vhci) *if* it is enabled. But, if syzkaller is going to fuzz, it needs to know the PCI IDs. Therefore, I need to dig into the driver's Kconfig and identify the PCI IDs. Knowing the PCI IDs is going to be key to determining whether we can even trigger this change in a controlled testing environment, especially for fuzzing purposes. |
| 4/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "rvu_mbox_handler_nix_set_rx_mode",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c=4503=int rvu_mbox_handler_nix_get_mac_addr(struct rvu *rvu,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4519-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c:4520:int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4521-\t\t\t\t struct msg_rsp *rsp)\n"
} |
| 5/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2984 output: 44 thoughts: 11 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: **Analyzing the Kconfig Dependency** Alright, so I'm diving into this driver and, naturally, the first thing I need to understand is its build configuration. Let's get down to brass tacks: I need to figure out which Kconfig options actually enable this thing. It's crucial for understanding how the driver integrates into the larger system and, more importantly, how users are meant to control its inclusion. Knowing the dependencies directly informs any debugging, porting efforts or the understanding of how it fits in with the device tree. I'll need to trace back from the source code, ideally to the relevant Kconfig fragment, to see the precise dependencies and, ultimately, what triggers the inclusion of this driver in the kernel build. |
| 6/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "config OCTEONTX2",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/Kconfig"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/Kconfig-5-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:6:config OCTEONTX2_MBOX\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-7-\ttristate\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-8-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:9:config OCTEONTX2_AF\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-10-\ttristate \"Marvell OcteonTX2 RVU Admin Function driver\"\n--\ndrivers/net/ethernet/marvell/octeontx2/Kconfig=22=config NDC_DIS_DYNAMIC_CACHING\n--\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-30-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:31:config OCTEONTX2_PF\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-32-\ttristate \"Marvell OcteonTX2 NIC Physical Function driver\"\n--\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-44-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:45:config OCTEONTX2_VF\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-46-\ttristate \"Marvell OcteonTX2 NIC Virtual Function driver\"\n"
} |
| 7/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3628 output: 46 thoughts: 73 Thoughts: Here's my summary, as the expert: **Navigating the OCTEONTX2 AF Codebase** Okay, so I'm looking at `drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c`. Right, that places me firmly within the `OCTEONTX2_AF` realm. My brain's already making the connection – this means we're dealing with the Advanced Function (AF) interface specific to the Octeon TX2 family. Now, I need to understand how this particular file fits into the overall build process. My next logical step is to quickly peek at the relevant `Makefile` in `drivers/net/ethernet/marvell/octeontx2/af/`. That should give me the crucial information about dependencies, compilation flags, and how `rvu_nix.c` is integrated into the larger driver module. Time to get a handle on the build environment for this section. |
| 8/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "rvu_nix.o",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/af/Makefile"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/Makefile=10=rvu_mbox-y := mbox.o rvu_trace.o\ndrivers/net/ethernet/marvell/octeontx2/af/Makefile:11:rvu_af-y := cgx.o rvu.o rvu_cgx.o rvu_npa.o rvu_nix.o \\\ndrivers/net/ethernet/marvell/octeontx2/af/Makefile-12-\t\t rvu_reg.o rvu_npc.o rvu_debugfs.o ptp.o rvu_npc_fs.o \\\n"
} |
| 9/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4129 output: 43 thoughts: 13 Thoughts: Okay, let's break this down. Here's how I'd approach this task, as if these were my internal thoughts: **Investigating the `rvu_af` Configuration** Alright, so the task at hand is to pinpoint *exactly* what configuration settings are enabling `rvu_af`. This is a classic debugging scenario, and the approach is pretty straightforward, but crucial for ensuring I understand the system's behavior. I can't just assume anything; I need to be precise. I need to know which configuration parameters, environmental variables, or other relevant settings are actively causing `rvu_af` to be enabled. Without this level of detail, I'm just guessing, and that’s a waste of my time, and likely will be an expensive waste of the system's time. I'll need to know this, so I will start looking into the configuration files. |
| 10/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "rvu_af",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/af/Makefile"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/Makefile=7=obj-$(CONFIG_OCTEONTX2_MBOX) += rvu_mbox.o\ndrivers/net/ethernet/marvell/octeontx2/af/Makefile:8:obj-$(CONFIG_OCTEONTX2_AF) += rvu_af.o\ndrivers/net/ethernet/marvell/octeontx2/af/Makefile-9-\ndrivers/net/ethernet/marvell/octeontx2/af/Makefile=10=rvu_mbox-y := mbox.o rvu_trace.o\ndrivers/net/ethernet/marvell/octeontx2/af/Makefile:11:rvu_af-y := cgx.o rvu.o rvu_cgx.o rvu_npa.o rvu_nix.o \\\ndrivers/net/ethernet/marvell/octeontx2/af/Makefile-12-\t\t rvu_reg.o rvu_npc.o rvu_debugfs.o ptp.o rvu_npc_fs.o \\\n"
} |
| 11/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4656 output: 53 thoughts: 172 Thoughts: **Reaching `CONFIG_OCTEONTX2_AF` through Fuzzing** Okay, so the key configuration option here seems to be `CONFIG_OCTEONTX2_AF`. The question is, can I reach it, and how? The function of interest, `rvu_mbox_handler_nix_set_rx_mode`, is a mailbox handler. That's a good starting point. Mailbox handlers are usually triggered by Virtual Function (VF) or Physical Function (PF) drivers sending messages to the Admin Function (AF). If syzkaller can somehow interact with the mailbox interface, I might have a path. The crucial question now is, *how* does syzkaller interact with this? Does this driver expose a character device, debugfs, netlink, or something similar for mailbox communication? Alternatively, can syzkaller fuzz the PCI VF driver directly, which in turn would send these mailbox messages? That's definitely worth investigating. I need to figure out the entry point for syzkaller. Right, time to check where `rvu_mbox_handler_nix_set_rx_mode` is used. That's the best way to get a solid grasp of how this is all connected. |
| 12/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "rvu_mbox_handler_nix_set_rx_mode",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/af/"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c=4503=int rvu_mbox_handler_nix_get_mac_addr(struct rvu *rvu,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4519-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c:4520:int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4521-\t\t\t\t struct msg_rsp *rsp)\n"
} |
| 13/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 5351 output: 51 thoughts: 56 Thoughts: Here's my thought process, as if I were considering this issue: **Investigating a Potential Code Location Anomaly** Okay, hold on a second. I'm looking at a file path, and something's just not sitting right. I'm specifically thinking about `drivers/net/ethernet/marvell/octeontx2/af/` and I can't find a corresponding reference to it anywhere else within this part of the driver tree. That seems odd, potentially incomplete, or maybe just poorly documented. Right, so to get a handle on this, I need to zoom out a bit. Instead of focusing just on that specific `af/` subdirectory, I need to broaden my search. I need to understand the wider context within the `drivers/net/ethernet/marvell/octeontx2/` directory structure. What's the general layout? How is this component integrated into the overall Marvell Octeon TX2 Ethernet driver framework? I'll start with a broader check of the `drivers/net/ethernet/marvell/octeontx2/` directory as a whole. |
| 14/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "rvu_mbox_handler_nix_set_rx_mode",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c=4503=int rvu_mbox_handler_nix_get_mac_addr(struct rvu *rvu,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4519-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c:4520:int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4521-\t\t\t\t struct msg_rsp *rsp)\n"
} |
| 15/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 5907 output: 44 thoughts: 24 Thoughts: Okay, here's my interpretation of those thoughts, crafted with the expectation that the user is a knowledgeable individual: **Debugging the Macro Mystery** Alright, so I'm trying to figure out the specific name of that macro, and it's nagging at me. It feels like a macro, somehow connected to this functionality. My first instinct, given what I'm dealing with, is to go digging through the header files – the core include files. Specifically, something like `mbox.h` or a related file should hold the answer. That seems like the most logical place to start looking, given my familiarity with the usual conventions. It's a targeted hunt, a common first step in this kind of investigation. |
| 16/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "nix_set_rx_mode",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/mbox.h=330=M(NIX_SET_MAC_ADDR,\t0x800a, nix_set_mac_addr, nix_set_mac_addr, msg_rsp) \\\ndrivers/net/ethernet/marvell/octeontx2/af/mbox.h:331:M(NIX_SET_RX_MODE,\t0x800b, nix_set_rx_mode, nix_rx_mode, msg_rsp)\t\\\ndrivers/net/ethernet/marvell/octeontx2/af/mbox.h-332-M(NIX_SET_HW_FRS,\t0x800c, nix_set_hw_frs, nix_frs_cfg, msg_rsp)\t\\\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c=4503=int rvu_mbox_handler_nix_get_mac_addr(struct rvu *rvu,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4519-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c:4520:int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c-4521-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c=1842=static void otx2_do_set_rx_mode(struct otx2_nic *pf)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-1860-\tmutex_lock(\u0026pf-\u003embox.lock);\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c:1861:\treq = otx2_mbox_alloc_msg_nix_set_rx_mode(\u0026pf-\u003embox);\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c-1862-\tif (!req) {\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c=456=static void otx2vf_do_set_rx_mode(struct work_struct *work)\n--\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-464-\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c:465:\treq = otx2_mbox_alloc_msg_nix_set_rx_mode(\u0026vf-\u003embox);\ndrivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c-466-\tif (!req) {\n"
} |
| 17/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6915 output: 46 thoughts: 258 Thoughts: **My Assessment of the Octeon TX2 Driver Fuzzing Potential** Okay, so I'm looking at how this `mbox.h` macro, `M(...)`, creates the handler array. The message itself comes from either the PF driver (`otx2_pf.c`) or the VF driver (`otx2_vf.c`). Specifically, the PF driver is named `OCTEONTX2_PF`, and the VF driver `OCTEONTX2_VF`. The question is, can syzkaller actually *fuzz* this functionality? The obvious route would be to leverage syzkaller's ability to manipulate the network interface's RX mode. I'm thinking about triggering `otx2_do_set_rx_mode` by sending commands like `SIOCSIFFLAGS` or `SIOCADDMULTI` to set things like promiscuous mode or the multicast list. It sounds straightforward, right? But a crucial hurdle: does syzkaller even *know* this specific hardware? Typically, syzkaller doesn't directly probe hardware-specific PCI drivers unless it's a generic device, or there's some kind of virtual device involved. I need to think about that. Hang on... Syzkaller has `vhci`! It can inject arbitrary PCI devices. If I can enable `vhci`, I *might* be able to emulate the PCI device sufficiently to allow syzkaller to probe and interact with the driver. That's the key. Now, I've got to confirm if `OCTEONTX2_AF` is actually a PCI driver. If it is, `vhci` becomes a very interesting possibility for fuzzing this. |
| 18/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "pci_driver",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/af/rvu.c"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/af/rvu.c=3733=static void rvu_shutdown(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3742-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3743:static struct pci_driver rvu_driver = {\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3744-\t.name = DRV_NAME,\n"
} |
| 19/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7746 output: 41 thoughts: 286 Thoughts: **Analyzing the Syzkaller Fuzzing Potential** Okay, so we're looking at a potential fuzzing target – a PCI driver, specifically. The initial thought is, can syzkaller be used to probe this driver? The key is that syzkaller *can* emulate a PCI device, which leads me to the `rvu_driver`. However, the code in question, `rvu_mbox_handler_nix_set_rx_mode`, resides within a mailbox handler inside the AF driver. This AF driver, as I recall, acts as a message relay, receiving communications from the PF or VF drivers. So, the challenge for syzkaller becomes clear: it needs to effectively emulate the PF/VF sending a valid message to the AF driver in order to even *reach* the vulnerable code. That implies the AF driver receives messages via the hardware mailbox, which involves shared memory and interrupts. Thus, to exploit this, syzkaller, by emulating the PCI device, must not only deal with the MMIO but also precisely emulate the mailbox memory and trigger the appropriate mailbox interrupt to signal the AF driver. But here's the rub. Syzkaller's `vhci` *can* inject PCI devices, but it's not designed to be hardware-specific. It doesn't inherently understand the particular semantics of the OcteonTX2 mailbox unless someone explicitly models it in syzkaller. Then the next thought is: syzkaller usually doesn't model every specific hardware detail. It's more of a general fuzzing framework, providing random data for memory-mapped I/O (MMIO) reads and generating interrupts. If syzkaller simply provides random data to the mailbox memory and then triggers the interrupt, there's a good chance that the AF driver will, at least, *attempt* to interpret that random data as a mailbox message. The AF driver could call `rvu_mbox_handler_nix_set_rx_mode`, which could reveal a vulnerability. Therefore, the next logical step is to analyze the interrupt handling within `rvu.c` to see how that mailbox interrupt is processed. That should offer clues as to how to best trigger it. |
| 20/2 | 2026/07/02 11:14 | tool | grepper |
0mArgs:{
"Expression": "mbox_handler",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/af/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 1030 lines.\nUse more precise expression if possible.\n\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/nix.c-13-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/nix.c:14:int rvu_mbox_handler_nix_cn20k_aq_enq(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/nix.c-15-\t\t\t\t struct nix_cn20k_aq_enq_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npa.c-13-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npa.c:14:int rvu_mbox_handler_npa_cn20k_aq_enq(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npa.c-15-\t\t\t\t struct npa_cn20k_aq_enq_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npa.c-20-}\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npa.c:21:EXPORT_SYMBOL(rvu_mbox_handler_npa_cn20k_aq_enq);\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c=1236=int npc_cn20k_read_mcam_entry(struct rvu *rvu, int blkaddr, u16 index,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1362-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:1363:int rvu_mbox_handler_npc_cn20k_mcam_write_entry(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1364-\t\t\t\t\t\tstruct npc_cn20k_mcam_write_entry_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1406-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:1407:int rvu_mbox_handler_npc_cn20k_mcam_read_entry(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1408-\t\t\t\t\t struct npc_mcam_read_entry_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1433-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:1434:int rvu_mbox_handler_npc_cn20k_mcam_alloc_and_write_entry(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1435-\t\t\t\t\t\t\t struct npc_cn20k_mcam_alloc_and_write_entry_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1462-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:1463:\trc = rvu_mbox_handler_npc_mcam_alloc_entry(rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1464-\t\t\t\t\t\t \u0026entry_req, \u0026entry_rsp);\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1489-\t\tfree_req.entry = entry_rsp.entry;\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:1490:\t\terr = rvu_mbox_handler_npc_mcam_free_entry(rvu, \u0026free_req, \u0026free_rsp);\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1491-\t\tif (err)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c=1502=static int rvu_npc_get_base_steer_rule_type(struct rvu *rvu, u16 pcifunc)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1509-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:1510:int rvu_mbox_handler_npc_cn20k_read_base_steer_rule(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-1511-\t\t\t\t\t\t struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c=3354=int\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:3355:rvu_mbox_handler_npc_cn20k_get_fcnt(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-3356-\t\t\t\t struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c=3364=int\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:3365:rvu_mbox_handler_npc_cn20k_get_kex_cfg(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-3366-\t\t\t\t struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c=4045=int npc_cn20k_defrag(struct rvu *rvu)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4154-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:4155:int rvu_mbox_handler_npc_defrag(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4156-\t\t\t\tstruct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c=4161=int npc_cn20k_dft_rules_idx_get(struct rvu *rvu, u16 pcifunc, u16 *bcast,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4239-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:4240:int rvu_mbox_handler_npc_get_pfl_info(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4241-\t\t\t\t struct npc_get_pfl_info_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4252-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:4253:int rvu_mbox_handler_npc_get_num_kws(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4254-\t\t\t\t struct npc_get_num_kws_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4297-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:4298:int rvu_mbox_handler_npc_get_dft_rl_idxs(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4299-\t\t\t\t\t struct npc_get_dft_rl_idxs_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c=4433=int npc_cn20k_dft_rules_alloc(struct rvu *rvu, u16 pcifunc)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4509-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:4510:\tret = rvu_mbox_handler_npc_mcam_alloc_entry(rvu, \u0026req, \u0026rsp);\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4511-\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4547-\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:4548:\tret = rvu_mbox_handler_npc_mcam_alloc_entry(rvu, \u0026req, \u0026rsp);\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4549-\tif (ret) {\n--\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4621-\tfree_req.all = 1;\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:4622:\tret = rvu_mbox_handler_npc_mcam_free_entry(rvu, \u0026free_req, \u0026free_rsp);\ndrivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c-4623-\tif (ret)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c=36=void rvu_mcs_ptp_cfg(struct rvu *rvu, u8 rpm_id, u8 lmac_id, bool ena)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-71-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:72:int rvu_mbox_handler_mcs_set_lmac_mode(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-73-\t\t\t\t struct mcs_set_lmac_mode *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c=153=static void mcs_intr_handler_task(struct work_struct *work)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-178-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:179:int rvu_mbox_handler_mcs_intr_cfg(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-180-\t\t\t\t struct mcs_intr_cfg *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-203-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:204:int rvu_mbox_handler_mcs_get_hw_info(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-205-\t\t\t\t struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-222-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:223:int rvu_mbox_handler_mcs_port_reset(struct rvu *rvu, struct mcs_port_reset_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-224-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-237-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:238:int rvu_mbox_handler_mcs_clear_stats(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-239-\t\t\t\t struct mcs_clear_stats *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-259-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:260:int rvu_mbox_handler_mcs_get_flowid_stats(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-261-\t\t\t\t\t struct mcs_stats_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-290-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:291:int rvu_mbox_handler_mcs_get_secy_stats(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-292-\t\t\t\t\tstruct mcs_stats_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-318-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:319:int rvu_mbox_handler_mcs_get_sc_stats(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-320-\t\t\t\t struct mcs_stats_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-342-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:343:int rvu_mbox_handler_mcs_get_sa_stats(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-344-\t\t\t\t struct mcs_stats_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-366-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:367:int rvu_mbox_handler_mcs_get_port_stats(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-368-\t\t\t\t\tstruct mcs_stats_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-390-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:391:int rvu_mbox_handler_mcs_set_active_lmac(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-392-\t\t\t\t\t struct mcs_set_active_lmac *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-408-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:409:int rvu_mbox_handler_mcs_port_cfg_set(struct rvu *rvu, struct mcs_port_cfg_set_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-410-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-426-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:427:int rvu_mbox_handler_mcs_port_cfg_get(struct rvu *rvu, struct mcs_port_cfg_get_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-428-\t\t\t\t struct mcs_port_cfg_get_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-444-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:445:int rvu_mbox_handler_mcs_custom_tag_cfg_get(struct rvu *rvu, struct mcs_custom_tag_cfg_get_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-446-\t\t\t\t\t struct mcs_custom_tag_cfg_get_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c=460=int rvu_mcs_flr_handler(struct rvu *rvu, u16 pcifunc)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-480-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:481:int rvu_mbox_handler_mcs_flowid_ena_entry(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-482-\t\t\t\t\t struct mcs_flowid_ena_dis_entry *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-494-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:495:int rvu_mbox_handler_mcs_pn_table_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-496-\t\t\t\t\tstruct mcs_pn_table_write_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-508-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:509:int rvu_mbox_handler_mcs_set_pn_threshold(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-510-\t\t\t\t\t struct mcs_set_pn_threshold *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-524-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:525:int rvu_mbox_handler_mcs_rx_sc_sa_map_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-526-\t\t\t\t\t struct mcs_rx_sc_sa_map *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-538-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:539:int rvu_mbox_handler_mcs_tx_sc_sa_map_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-540-\t\t\t\t\t struct mcs_tx_sc_sa_map *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-554-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:555:int rvu_mbox_handler_mcs_sa_plcy_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-556-\t\t\t\t struct mcs_sa_plcy_write_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-572-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:573:int rvu_mbox_handler_mcs_rx_sc_cam_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-574-\t\t\t\t\t struct mcs_rx_sc_cam_write_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-586-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:587:int rvu_mbox_handler_mcs_secy_plcy_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-588-\t\t\t\t\t struct mcs_secy_plcy_write_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-601-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:602:int rvu_mbox_handler_mcs_flowid_entry_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-603-\t\t\t\t\t struct mcs_flowid_entry_write_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-628-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:629:int rvu_mbox_handler_mcs_free_resources(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-630-\t\t\t\t\tstruct mcs_free_rsrc_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-678-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:679:int rvu_mbox_handler_mcs_alloc_resources(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-680-\t\t\t\t\t struct mcs_alloc_rsrc_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-760-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:761:int rvu_mbox_handler_mcs_alloc_ctrl_pkt_rule(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-762-\t\t\t\t\t struct mcs_alloc_ctrl_pkt_rule_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-817-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:818:int rvu_mbox_handler_mcs_free_ctrl_pkt_rule(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-819-\t\t\t\t\t struct mcs_free_ctrl_pkt_rule_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-838-\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c:839:int rvu_mbox_handler_mcs_ctrl_pkt_rule_write(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c-840-\t\t\t\t\t struct mcs_ctrl_pkt_rule_write_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c=612=struct pci_driver ptp_driver = {\n--\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-618-\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c:619:int rvu_mbox_handler_ptp_op(struct rvu *rvu, struct ptp_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-620-\t\t\t struct ptp_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-663-\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c:664:int rvu_mbox_handler_ptp_get_cap(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/ptp.c-665-\t\t\t\t struct ptp_get_cap_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=36=static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-37-\t\t\t int type, int num,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:38:\t\t\t void (mbox_handler)(struct work_struct *),\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-39-\t\t\t void (mbox_up_handler)(struct work_struct *));\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=1236=int rvu_aq_alloc(struct rvu *rvu, struct admin_queue **ad_queue,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1264-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:1265:int rvu_mbox_handler_ready(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1266-\t\t\t struct ready_msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=1455=static int rvu_detach_rsrcs(struct rvu *rvu, struct rsrc_detach *detach,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1507-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:1508:int rvu_mbox_handler_detach_resources(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1509-\t\t\t\t struct rsrc_detach *detach,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=1736=static bool rvu_attach_from_same_block(struct rvu *rvu, int blktype,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1751-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:1752:int rvu_mbox_handler_attach_resources(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1753-\t\t\t\t struct rsrc_attach *attach,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=1906=static void rvu_clear_msix_offset(struct rvu *rvu, struct rvu_pfvf *pfvf,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1929-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:1930:int rvu_mbox_handler_msix_offset(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1931-\t\t\t\t struct msix_offset_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1992-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:1993:int rvu_mbox_handler_free_rsrc_cnt(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-1994-\t\t\t\t struct free_rsrcs_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2085-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2086:int rvu_mbox_handler_vf_flr(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2087-\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=2106=int rvu_ndc_sync(struct rvu *rvu, int lfblkaddr, int lfidx, u64 lfoffset)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2112-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2113:int rvu_mbox_handler_get_hw_cap(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2114-\t\t\t\tstruct get_hw_cap_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2127-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2128:int rvu_mbox_handler_set_vf_perm(struct rvu *rvu, struct set_vf_perm *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2129-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2169-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2170:int rvu_mbox_handler_ndc_sync_op(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2171-\t\t\t\t struct ndc_sync_op *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=2256=static int rvu_process_mbox_msg(struct otx2_mbox *mbox, int devid,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2287-\t\t\t\t\t\t\t\t\t\\\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2288:\t\terr = rvu_mbox_handler_ ## _fn_name(rvu,\t\t\\\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2289-\t\t\t\t\t\t (struct _req_type *)req, \\\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=2297=MBOX_MESSAGES\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2306-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2307:static void __rvu_mbox_handler(struct rvu_work *mwork, int type, bool poll)\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2308-{\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2397-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2398:static inline void rvu_afpf_mbox_handler(struct work_struct *work)\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2399-{\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2403-\tmutex_lock(\u0026rvu-\u003embox_lock);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2404:\t__rvu_mbox_handler(mwork, TYPE_AFPF, true);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2405-\tmutex_unlock(\u0026rvu-\u003embox_lock);\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2407-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2408:static inline void rvu_afvf_mbox_handler(struct work_struct *work)\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2409-{\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2411-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2412:\t__rvu_mbox_handler(mwork, TYPE_AFVF, false);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2413-}\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=2570=static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2571-\t\t\t int type, int num,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2572:\t\t\t void (mbox_handler)(struct work_struct *),\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2573-\t\t\t void (mbox_up_handler)(struct work_struct *))\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2684-\t\tmwork-\u003ervu = rvu;\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2685:\t\tINIT_WORK(\u0026mwork-\u003ework, mbox_handler);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2686-\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=2734=void rvu_queue_work(struct mbox_wq_info *mw, int first,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2753-\t\t * when the interrupt handler is called.\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:2754:\t\t * pf-\u003embox.num_msgs holds the data for use in pfaf_mbox_handler\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-2755-\t\t * pf\u003embox.up_num_msgs holds the data for use in\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=3466=static int rvu_enable_sriov(struct rvu *rvu)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3509-\terr = rvu_mbox_init(rvu, \u0026rvu-\u003eafvf_wq_info, TYPE_AFVF, vfs,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3510:\t\t\t rvu_afvf_mbox_handler, rvu_afvf_mbox_up_handler);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3511-\tif (err)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c=3547=static int rvu_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3627-\terr = rvu_mbox_init(rvu, \u0026rvu-\u003eafpf_wq_info, TYPE_AFPF,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c:3628:\t\t\t rvu-\u003ehw-\u003etotal_pfs, rvu_afpf_mbox_handler,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.c-3629-\t\t\t rvu_afpf_mbox_up_handler);\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.h=983=static inline bool is_cgx_vf(struct rvu *rvu, u16 pcifunc)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.h-989-#define M(_name, _id, fn_name, req, rsp)\t\t\t\t\\\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.h:990:int rvu_mbox_handler_ ## fn_name(struct rvu *, struct req *, struct rsp *);\ndrivers/net/ethernet/marvell/octeontx2/af/rvu.h-991-MBOX_MESSAGES\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=527=void rvu_cgx_disable_dmac_entries(struct rvu *rvu, u16 pcifunc)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-562-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:563:int rvu_mbox_handler_cgx_start_rxtx(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-564-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-569-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:570:int rvu_mbox_handler_cgx_stop_rxtx(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-571-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=577=static int rvu_lmac_get_stats(struct rvu *rvu, struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-620-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:621:int rvu_mbox_handler_cgx_stats(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-622-\t\t\t struct cgx_stats_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-626-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:627:int rvu_mbox_handler_rpm_stats(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-628-\t\t\t struct rpm_stats_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-632-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:633:int rvu_mbox_handler_cgx_stats_rst(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-634-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-661-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:662:int rvu_mbox_handler_cgx_fec_stats(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-663-\t\t\t\t struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-679-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:680:int rvu_mbox_handler_cgx_mac_addr_set(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-681-\t\t\t\t struct cgx_mac_addr_set_or_get *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-702-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:703:int rvu_mbox_handler_cgx_mac_addr_add(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-704-\t\t\t\t struct cgx_mac_addr_add_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-726-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:727:int rvu_mbox_handler_cgx_mac_addr_del(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-728-\t\t\t\t struct cgx_mac_addr_del_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-743-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:744:int rvu_mbox_handler_cgx_mac_max_entries_get(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-745-\t\t\t\t\t struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-770-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:771:int rvu_mbox_handler_cgx_mac_addr_get(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-772-\t\t\t\t struct cgx_mac_addr_set_or_get *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-783-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:784:int rvu_mbox_handler_cgx_promisc_enable(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-785-\t\t\t\t\tstruct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-803-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:804:int rvu_mbox_handler_cgx_promisc_disable(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-805-\t\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=823=static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-858-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:859:int rvu_mbox_handler_cgx_ptp_rx_enable(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-860-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-867-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:868:int rvu_mbox_handler_cgx_ptp_rx_disable(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-869-\t\t\t\t\tstruct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=874=static int rvu_cgx_config_linkevents(struct rvu *rvu, u16 pcifunc, bool en)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-894-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:895:int rvu_mbox_handler_cgx_start_linkevents(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-896-\t\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-901-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:902:int rvu_mbox_handler_cgx_stop_linkevents(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-903-\t\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-908-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:909:int rvu_mbox_handler_cgx_get_linkinfo(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-910-\t\t\t\t struct cgx_link_info_msg *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-926-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:927:int rvu_mbox_handler_cgx_features_get(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-928-\t\t\t\t struct msg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=971=static int rvu_cgx_config_intlbk(struct rvu *rvu, u16 pcifunc, bool en)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-986-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:987:int rvu_mbox_handler_cgx_intlbk_enable(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-988-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-993-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:994:int rvu_mbox_handler_cgx_intlbk_disable(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-995-\t\t\t\t\tstruct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=1001=int rvu_cgx_cfg_pause_frm(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1039-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1040:int rvu_mbox_handler_cgx_cfg_pause_frm(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1041-\t\t\t\t struct cgx_pause_frm_cfg *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1067-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1068:int rvu_mbox_handler_cgx_get_phy_fec_stats(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1069-\t\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=1126=int rvu_cgx_start_stop_io(struct rvu *rvu, u16 pcifunc, bool start)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1172-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1173:int rvu_mbox_handler_cgx_set_fec_param(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1174-\t\t\t\t struct fec_mode *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1189-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1190:int rvu_mbox_handler_cgx_get_aux_link_info(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1191-\t\t\t\t\t struct cgx_fw_data *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1215-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1216:int rvu_mbox_handler_cgx_set_link_mode(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1217-\t\t\t\t struct cgx_set_link_mode_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1242-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1243:int rvu_mbox_handler_cgx_mac_addr_reset(struct rvu *rvu, struct cgx_mac_addr_reset_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1244-\t\t\t\t\tstruct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1259-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1260:int rvu_mbox_handler_cgx_mac_addr_update(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1261-\t\t\t\t\t struct cgx_mac_addr_update_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c=1277=int rvu_cgx_prio_flow_ctrl_cfg(struct rvu *rvu, u16 pcifunc, u8 tx_pause,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1313-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c:1314:int rvu_mbox_handler_cgx_prio_flow_ctrl_cfg(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c-1315-\t\t\t\t\t struct cgx_pfc_cfg *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c=113=static int rvu_update_lmtaddr(struct rvu *rvu, u16 pcifunc, u64 lmt_addr)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c-147-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c:148:int rvu_mbox_handler_lmtst_tbl_setup(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c-149-\t\t\t\t struct lmtst_tbl_setup_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c=433=static int validate_and_get_cpt_blkaddr(int req_blkaddr)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-443-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c:444:int rvu_mbox_handler_cpt_lf_alloc(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-445-\t\t\t\t struct cpt_lf_alloc_req_msg *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c=514=static int cpt_lf_free(struct rvu *rvu, struct msg_req *req, int blkaddr)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-544-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c:545:int rvu_mbox_handler_cpt_lf_free(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-546-\t\t\t\t struct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c=614=static int cpt_inline_ipsec_cfg_outbound(struct rvu *rvu, int blkaddr, u8 cptlf,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-658-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c:659:int rvu_mbox_handler_cpt_inline_ipsec_cfg(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-660-\t\t\t\t\t struct cpt_inline_ipsec_cfg_msg *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c=695=static bool validate_and_update_reg_offset(struct rvu *rvu,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-762-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c:763:int rvu_mbox_handler_cpt_rd_wr_register(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-764-\t\t\t\t\tstruct cpt_rd_wr_reg_msg *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c=833=static void get_eng_sts(struct rvu *rvu, struct cpt_sts_rsp *rsp, int blkaddr)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-857-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c:858:int rvu_mbox_handler_cpt_sts(struct rvu *rvu, struct cpt_sts_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-859-\t\t\t struct cpt_sts_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c=899=static void cpt_rxc_time_cfg(struct rvu *rvu, struct cpt_rxc_time_cfg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-923-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c:924:int rvu_mbox_handler_cpt_rxc_time_cfg(struct rvu *rvu,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-925-\t\t\t\t struct cpt_rxc_time_cfg_req *req,\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-943-\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c:944:int rvu_mbox_handler_cpt_ctx_cache_sync(struct rvu *rvu, struct msg_req *req,\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-945-\t\t\t\t\tstruct msg_rsp *rsp)\n--\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c-949-\n\n"
} |
| 21/2 | 2026/07/02 11:14 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25176 output: 46 thoughts: 563 Thoughts: **My Fuzzing Strategy: Targeting the Mailbox Handler in `rvu.c`** Okay, let's break this down. The core of the issue, and therefore my target, is the `rvu_process_mbox_msg` function in `rvu.c`. This is where the mailbox messages are handled. The structure is pretty clear: it uses a macro to define the message cases, and each case calls a handler function. Specifically, I'm interested in how this is triggered. I see that `rvu_process_mbox_msg` is called by `__rvu_mbox_handler`, which is a workqueue function. This work is queued by `rvu_queue_work`, which is itself called from the interrupt handler `rvu_mbox_intr_handler`. And *that* handler is registered for the mailbox interrupts. Aha! This is where the vulnerability exists. The key is that syzkaller, through its vhci interface, can inject interrupts for the PCI device. So, by crafting data to be written into the BARs, I can manipulate the mailbox memory, trigger an interrupt via syzkaller, and thus cause `rvu_mbox_intr_handler` to run, which in turn queues a mailbox work item that will, in the end, call the mailbox handlers. The mailbox memory, mapped via PCI BARs, provides the perfect attack surface. Syzkaller can provide the memory for the BARs and I can populate it with random data. This opens the door to fuzzing the mailbox handler function, `rvu_mbox_handler_nix_set_rx_mode` in the OcteonTX2 AF driver. Now, let me think about the functional implications. This code modifies the behavior of the device depending on whether the function is running for a Virtual Function (VF). The `is_vf(pcifunc)` check determines whether some functions are called, and those functions, in turn, modify the core logic of the OcteonTX2 AF driver's mailbox handler, meaning this code is absolutely worth fuzzing! To ensure I'm targeting the correct configuration, I need to verify a few things. First and foremost, `CONFIG_OCTEONTX2_AF` is the critical setting. Now, let me double-check the Kconfig file in `drivers/net/ethernet/marvell/octeontx2/Kconfig` to be sure there aren't any other dependencies or related configurations. |
| 22/2 | 2026/07/02 11:15 | tool | grepper |
0mArgs:{
"Expression": "config OCTEONTX2_AF",
"PathPrefix": "drivers/net/ethernet/marvell/octeontx2/Kconfig"
}Results: {
"Output": "drivers/net/ethernet/marvell/octeontx2/Kconfig=6=config OCTEONTX2_MBOX\n--\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-8-\ndrivers/net/ethernet/marvell/octeontx2/Kconfig:9:config OCTEONTX2_AF\ndrivers/net/ethernet/marvell/octeontx2/Kconfig-10-\ttristate \"Marvell OcteonTX2 RVU Admin Function driver\"\n"
} |
| 23/2 | 2026/07/02 11:15 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26448 output: 44 thoughts: 16 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Analyzing the Dependencies of OCTEONTX2_AF** Okay, so I'm looking at `OCTEONTX2_AF`. The first thing that pops into my head is, "What other components or modules rely on *this* piece?" I need to understand its relationships within the broader system, ideally within the Linux kernel or a specific networking framework. I'm thinking about dependency trees; a quick scan of the code or configuration files would be the ideal place to begin this analysis. Am I dealing with a module, a driver, some hardware abstraction layer, or an entirely different entity? The context is key here. What's the goal? Are we trying to understand how `OCTEONTX2_AF` affects other parts of the system for optimization, troubleshooting, or migration, maybe even security? The use case drives the depth I'll go into. Do I want to understand what would break if I changed this? Or what might be affected when a change happens in some other subsystem? Or am I trying to figure out which other modules should be considered during future modifications to this subsystem? I'm mentally preparing for a chain of command, a hierarchy. I'm thinking of tracing back the include files, configuration options that would pull this module into the build, or even runtime dependencies that could call its routines. I'm going to start with the obvious places: makefiles, Kconfig files, and any device tree entries, and then move on to the code itself, starting with any clearly marked entry points or initialization routines. I want to see which APIs it exports and how other components interact with it. Function calls, data structures, and the broader control flow are all fair game. I am hoping the system is well-documented, so I can find its overall purpose and function. |
| 24/2 | 2026/07/02 11:15 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/marvell/octeontx2/Kconfig",
"FirstLine": 1,
"LineCount": 20
}Results: {
"Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\t#\n 3:\t# Marvell RVU Network drivers configuration\n 4:\t#\n 5:\t\n 6:\tconfig OCTEONTX2_MBOX\n 7:\t\ttristate\n 8:\t\n 9:\tconfig OCTEONTX2_AF\n 10:\t\ttristate \"Marvell OcteonTX2 RVU Admin Function driver\"\n 11:\t\tselect OCTEONTX2_MBOX\n 12:\t\tselect NET_DEVLINK\n 13:\t\tdepends on (64BIT \u0026\u0026 COMPILE_TEST) || ARM64\n 14:\t\tdepends on PCI\n 15:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n 16:\t\thelp\n 17:\t\t This driver supports Marvell's OcteonTX2 Resource Virtualization\n 18:\t\t Unit's admin function manager which manages all RVU HW resources\n 19:\t\t and provides a medium to other PF/VFs to configure HW. Should be\n 20:\t\t enabled for other RVU device drivers to work.\n"
} |
| 25/2 | 2026/07/02 11:15 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27190 output: 115 thoughts: 571 Thoughts: **Analyzing Configuration and Scope for Fuzzing the AF Driver**
Okay, so I'm looking at how best to configure this system for fuzzing the AF driver. My initial thought is it hinges on a few key factors: `PCI` and either `(64BIT && COMPILE_TEST)` or `ARM64`. With those in mind, `OCTEONTX2_AF` looks like the right config to start with.
I have to consider whether to enable `OCTEONTX2_PF` and `OCTEONTX2_VF`. While they might not be *strictly* necessary if syzkaller is directly targeting the AF driver's PCI interface, enabling them could be beneficial. If syzkaller ends up fuzzing the PF/VF drivers, which then send messages to the AF, I'll need them. So, let's include `OCTEONTX2_AF` for now, it's the most conservative approach.
Next, I need to pinpoint the focus symbols – the functions this is actually touching. After looking, the primary one is `rvu_mbox_handler_nix_set_rx_mode`. Are there any others? Nope, just this one. So, that's the focus.
Just to be absolutely certain, I'll double check the config requirements again. `OCTEONTX2_AF` should be sufficient on its own.
Now, wait... there's the patch itself.
```c
@@ -4575,7 +4575,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
rvu_npc_install_allmulti_entry(rvu, pcifunc, nixlf,
pfvf->rx_chan_base);
} else {
- if (!nix_rx_multicast)
+ if (!nix_rx_multicast && !is_vf(pcifunc))
rvu_npc_enable_allmulti_entry(rvu, pcifunc, nixlf, false);
}
@@ -4585,7 +4585,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
pfvf->rx_chan_base,
pfvf->rx_chan_cnt);
else
- if (!nix_rx_multicast)
+ if (!nix_rx_multicast && !is_vf(pcifunc))
rvu_npc_enable_promisc_entry(rvu, pcifunc, nixlf, false);
return 0;
```
Right, it's changing the behavior of the driver. Functionally, this is a change to how RX mode is handled.
Okay, with the context set, it's time to set-results.
|
| 26/2 | 2026/07/02 11:15 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"OCTEONTX2_AF"
],
"FocusSymbols": [
"rvu_mbox_handler_nix_set_rx_mode"
],
"Reasoning": "The patch modifies the logic for enabling/disabling multicast and promiscuous modes in the Marvell OcteonTX2 RVU Admin Function driver. It specifically changes the behavior for Virtual Functions (VFs). This is a functional change in a reachable PCI driver (via vhci emulation).",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"OCTEONTX2_AF"
],
"FocusSymbols": [
"rvu_mbox_handler_nix_set_rx_mode"
],
"Reasoning": "The patch modifies the logic for enabling/disabling multicast and promiscuous modes in the Marvell OcteonTX2 RVU Admin Function driver. It specifically changes the behavior for Virtual Functions (VFs). This is a functional change in a reachable PCI driver (via vhci emulation).",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|