AI Trajectory

null

{
  "EnableConfigs": [
    "BNGE",
    "INFINIBAND_BNG_RE",
    "DCB"
  ],
  "FocusSymbols": [
    "bng_re_net_ring_free",
    "bng_re_net_ring_alloc",
    "hwrm_ring_free_send_msg",
    "hwrm_ring_alloc_send_msg",
    "bnge_hwrm_rx_agg_ring_alloc",
    "bnge_hwrm_rx_ring_alloc",
    "bnge_hwrm_ring_alloc",
    "bnge_hwrm_rx_ring_free",
    "bnge_hwrm_rx_agg_ring_free",
    "bnge_hwrm_tx_ring_free",
    "bnge_hwrm_cp_ring_free",
    "bnge_hwrm_ring_free"
  ],
  "Reasoning": "The patch modifies the Broadcom BNGE and BNG_RE drivers to support 32-bit firmware ring IDs instead of 16-bit. This is a functional change affecting the driver's interaction with the hardware/firmware during ring allocation and freeing. The driver can be tested via PCI emulation in virtualized environments.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 9966fa64ffb2cdd46036bd5dd2f6b903bd0a9d71\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Jun 30 15:00:05 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/infiniband/hw/bng_re/bng_dev.c b/drivers/infiniband/hw/bng_re/bng_dev.c\nindex 71a7ca2196ad88..311c8bc931603a 100644\n--- a/drivers/infiniband/hw/bng_re/bng_dev.c\n+++ b/drivers/infiniband/hw/bng_re/bng_dev.c\n@@ -113,7 +113,7 @@ static void bng_re_fill_fw_msg(struct bnge_fw_msg *fw_msg, void *msg,\n }\n \n static int bng_re_net_ring_free(struct bng_re_dev *rdev,\n-\t\t\t\tu16 fw_ring_id, int type)\n+\t\t\t\tu32 fw_ring_id, int type)\n {\n \tstruct bnge_auxr_dev *aux_dev = rdev-\u003eaux_dev;\n \tstruct hwrm_ring_free_input req = {};\n@@ -123,7 +123,7 @@ static int bng_re_net_ring_free(struct bng_re_dev *rdev,\n \n \tbng_re_init_hwrm_hdr((void *)\u0026req, HWRM_RING_FREE);\n \treq.ring_type = type;\n-\treq.ring_id = cpu_to_le16(fw_ring_id);\n+\treq.ring_id = cpu_to_le32(fw_ring_id);\n \tbng_re_fill_fw_msg(\u0026fw_msg, (void *)\u0026req, sizeof(req), (void *)\u0026resp,\n \t\t\t    sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);\n \trc = bnge_send_msg(aux_dev, \u0026fw_msg);\n@@ -161,7 +161,7 @@ static int bng_re_net_ring_alloc(struct bng_re_dev *rdev,\n \t\t\t   sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);\n \trc = bnge_send_msg(aux_dev, \u0026fw_msg);\n \tif (!rc)\n-\t\t*fw_ring_id = le16_to_cpu(resp.ring_id);\n+\t\t*fw_ring_id = (u16)le32_to_cpu(resp.ring_id);\n \n \treturn rc;\n }\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge.h b/drivers/net/ethernet/broadcom/bnge/bnge.h\nindex f21cff651fd44a..4479ccd071f532 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge.h\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge.h\n@@ -36,6 +36,7 @@ struct bnge_pf_info {\n };\n \n #define INVALID_HW_RING_ID      ((u16)-1)\n+#define INVALID_HW_RING_ID_32BIT\t(U32_MAX)\n \n enum {\n \tBNGE_FW_CAP_SHORT_CMD\t\t\t\t= BIT_ULL(0),\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c\nindex 1c9cfec1b633fc..651c5e783516cc 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c\n@@ -1283,7 +1283,7 @@ int bnge_hwrm_stat_ctx_alloc(struct bnge_net *bn)\n \n int hwrm_ring_free_send_msg(struct bnge_net *bn,\n \t\t\t    struct bnge_ring_struct *ring,\n-\t\t\t    u32 ring_type, int cmpl_ring_id)\n+\t\t\t    u32 ring_type, u32 cmpl_ring_id)\n {\n \tstruct hwrm_ring_free_input *req;\n \tstruct bnge_dev *bd = bn-\u003ebd;\n@@ -1295,7 +1295,7 @@ int hwrm_ring_free_send_msg(struct bnge_net *bn,\n \n \treq-\u003ecmpl_ring = cpu_to_le16(cmpl_ring_id);\n \treq-\u003ering_type = ring_type;\n-\treq-\u003ering_id = cpu_to_le16(ring-\u003efw_ring_id);\n+\treq-\u003ering_id = cpu_to_le32(ring-\u003efw_ring_id);\n \n \tbnge_hwrm_req_hold(bd, req);\n \trc = bnge_hwrm_req_send(bd, req);\n@@ -1317,7 +1317,7 @@ int hwrm_ring_alloc_send_msg(struct bnge_net *bn,\n \tstruct hwrm_ring_alloc_output *resp;\n \tstruct hwrm_ring_alloc_input *req;\n \tstruct bnge_dev *bd = bn-\u003ebd;\n-\tu16 ring_id, flags = 0;\n+\tu32 ring_id, flags = 0;\n \tint rc;\n \n \trc = bnge_hwrm_req_init(bd, req, HWRM_RING_ALLOC);\n@@ -1401,7 +1401,7 @@ int hwrm_ring_alloc_send_msg(struct bnge_net *bn,\n \n \tresp = bnge_hwrm_req_hold(bd, req);\n \trc = bnge_hwrm_req_send(bd, req);\n-\tring_id = le16_to_cpu(resp-\u003ering_id);\n+\tring_id = le32_to_cpu(resp-\u003ering_id);\n \tbnge_hwrm_req_drop(bd, req);\n \n exit:\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h\nindex 3501de7a89b919..bf452e390d5bd1 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h\n@@ -50,7 +50,7 @@ int bnge_hwrm_cfa_l2_set_rx_mask(struct bnge_dev *bd,\n void bnge_hwrm_stat_ctx_free(struct bnge_net *bn);\n int bnge_hwrm_stat_ctx_alloc(struct bnge_net *bn);\n int hwrm_ring_free_send_msg(struct bnge_net *bn, struct bnge_ring_struct *ring,\n-\t\t\t    u32 ring_type, int cmpl_ring_id);\n+\t\t\t    u32 ring_type, u32 cmpl_ring_id);\n int hwrm_ring_alloc_send_msg(struct bnge_net *bn,\n \t\t\t     struct bnge_ring_struct *ring,\n \t\t\t     u32 ring_type, u32 map_index);\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c\nindex 70768193004cb2..6f7ef506d4e18c 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c\n@@ -1327,12 +1327,12 @@ static int bnge_alloc_core(struct bnge_net *bn)\n \treturn rc;\n }\n \n-u16 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr)\n+u32 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr)\n {\n \treturn rxr-\u003erx_cpr-\u003ering_struct.fw_ring_id;\n }\n \n-u16 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr)\n+u32 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr)\n {\n \treturn txr-\u003etx_cpr-\u003ering_struct.fw_ring_id;\n }\n@@ -1375,12 +1375,12 @@ static void bnge_init_nq_tree(struct bnge_net *bn)\n \t\tstruct bnge_nq_ring_info *nqr = \u0026bn-\u003ebnapi[i]-\u003enq_ring;\n \t\tstruct bnge_ring_struct *ring = \u0026nqr-\u003ering_struct;\n \n-\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n \t\tfor (j = 0; j \u003c nqr-\u003ecp_ring_count; j++) {\n \t\t\tstruct bnge_cp_ring_info *cpr = \u0026nqr-\u003ecp_ring_arr[j];\n \n \t\t\tring = \u0026cpr-\u003ering_struct;\n-\t\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\t\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n \t\t}\n \t}\n }\n@@ -1637,7 +1637,7 @@ static void bnge_init_one_rx_ring_rxbd(struct bnge_net *bn,\n \n \tring = \u0026rxr-\u003erx_ring_struct;\n \tbnge_init_rxbd_pages(ring, type);\n-\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n }\n \n static void bnge_init_one_agg_ring_rxbd(struct bnge_net *bn,\n@@ -1647,7 +1647,7 @@ static void bnge_init_one_agg_ring_rxbd(struct bnge_net *bn,\n \tu32 type;\n \n \tring = \u0026rxr-\u003erx_agg_ring_struct;\n-\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n \tif (bnge_is_agg_reqd(bn-\u003ebd)) {\n \t\ttype = ((u32)BNGE_RX_PAGE_SIZE \u003c\u003c RX_BD_LEN_SHIFT) |\n \t\t\tRX_BD_TYPE_RX_AGG_BD | RX_BD_FLAGS_SOP;\n@@ -1708,7 +1708,7 @@ static void bnge_init_tx_rings(struct bnge_net *bn)\n \t\tstruct bnge_tx_ring_info *txr = \u0026bn-\u003etx_ring[i];\n \t\tstruct bnge_ring_struct *ring = \u0026txr-\u003etx_ring_struct;\n \n-\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n \n \t\tnetif_queue_set_napi(bn-\u003enetdev, i, NETDEV_QUEUE_TYPE_TX,\n \t\t\t\t     \u0026txr-\u003ebnapi-\u003enapi);\n@@ -1867,7 +1867,7 @@ static int bnge_hwrm_rx_agg_ring_alloc(struct bnge_net *bn,\n \t\t    ring-\u003efw_ring_id);\n \tbnge_db_write(bn-\u003ebd, \u0026rxr-\u003erx_agg_db, rxr-\u003erx_agg_prod);\n \tbnge_db_write(bn-\u003ebd, \u0026rxr-\u003erx_db, rxr-\u003erx_prod);\n-\tbn-\u003egrp_info[grp_idx].agg_fw_ring_id = ring-\u003efw_ring_id;\n+\tbn-\u003egrp_info[grp_idx].agg_fw_ring_id = (u16)ring-\u003efw_ring_id;\n \n \treturn 0;\n }\n@@ -1886,7 +1886,7 @@ static int bnge_hwrm_rx_ring_alloc(struct bnge_net *bn,\n \t\treturn rc;\n \n \tbnge_set_db(bn, \u0026rxr-\u003erx_db, type, map_idx, ring-\u003efw_ring_id);\n-\tbn-\u003egrp_info[map_idx].rx_fw_ring_id = ring-\u003efw_ring_id;\n+\tbn-\u003egrp_info[map_idx].rx_fw_ring_id = (u16)ring-\u003efw_ring_id;\n \n \treturn 0;\n }\n@@ -1916,7 +1916,7 @@ static int bnge_hwrm_ring_alloc(struct bnge_net *bn)\n \t\tbnge_set_db(bn, \u0026nqr-\u003enq_db, type, map_idx, ring-\u003efw_ring_id);\n \t\tbnge_db_nq(bn, \u0026nqr-\u003enq_db, nqr-\u003enq_raw_cons);\n \t\tenable_irq(vector);\n-\t\tbn-\u003egrp_info[i].nq_fw_ring_id = ring-\u003efw_ring_id;\n+\t\tbn-\u003egrp_info[i].nq_fw_ring_id = (u16)ring-\u003efw_ring_id;\n \n \t\tif (!i) {\n \t\t\trc = bnge_hwrm_set_async_event_cr(bd, ring-\u003efw_ring_id);\n@@ -1986,15 +1986,13 @@ void bnge_fill_hw_rss_tbl(struct bnge_net *bn, struct bnge_vnic_info *vnic)\n \ttbl_size = bnge_get_rxfh_indir_size(bd);\n \n \tfor (i = 0; i \u003c tbl_size; i++) {\n-\t\tu16 ring_id, j;\n+\t\tu32 j;\n \n \t\tj = bd-\u003erss_indir_tbl[i];\n \t\trxr = \u0026bn-\u003erx_ring[j];\n \n-\t\tring_id = rxr-\u003erx_ring_struct.fw_ring_id;\n-\t\t*ring_tbl++ = cpu_to_le16(ring_id);\n-\t\tring_id = bnge_cp_ring_for_rx(rxr);\n-\t\t*ring_tbl++ = cpu_to_le16(ring_id);\n+\t\t*ring_tbl++ = cpu_to_le16(rxr-\u003erx_ring_struct.fw_ring_id);\n+\t\t*ring_tbl++ = cpu_to_le16(bnge_cp_ring_for_rx(rxr));\n \t}\n }\n \n@@ -2285,7 +2283,7 @@ static void bnge_disable_int(struct bnge_net *bn)\n \t\tnqr = \u0026bnapi-\u003enq_ring;\n \t\tring = \u0026nqr-\u003ering_struct;\n \n-\t\tif (ring-\u003efw_ring_id != INVALID_HW_RING_ID)\n+\t\tif (ring-\u003efw_ring_id != INVALID_HW_RING_ID_32BIT)\n \t\t\tbnge_db_nq(bn, \u0026nqr-\u003enq_db, nqr-\u003enq_raw_cons);\n \t}\n }\n@@ -2401,7 +2399,7 @@ static void bnge_hwrm_rx_ring_free(struct bnge_net *bn,\n \tu32 grp_idx = rxr-\u003ebnapi-\u003eindex;\n \tu32 cmpl_ring_id;\n \n-\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID)\n+\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID_32BIT)\n \t\treturn;\n \n \tcmpl_ring_id = bnge_cp_ring_for_rx(rxr);\n@@ -2409,7 +2407,7 @@ static void bnge_hwrm_rx_ring_free(struct bnge_net *bn,\n \t\t\t\tRING_FREE_REQ_RING_TYPE_RX,\n \t\t\t\tclose_path ? cmpl_ring_id :\n \t\t\t\tINVALID_HW_RING_ID);\n-\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n \tbn-\u003egrp_info[grp_idx].rx_fw_ring_id = INVALID_HW_RING_ID;\n }\n \n@@ -2421,14 +2419,14 @@ static void bnge_hwrm_rx_agg_ring_free(struct bnge_net *bn,\n \tu32 grp_idx = rxr-\u003ebnapi-\u003eindex;\n \tu32 cmpl_ring_id;\n \n-\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID)\n+\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID_32BIT)\n \t\treturn;\n \n \tcmpl_ring_id = bnge_cp_ring_for_rx(rxr);\n \thwrm_ring_free_send_msg(bn, ring, RING_FREE_REQ_RING_TYPE_RX_AGG,\n \t\t\t\tclose_path ? cmpl_ring_id :\n \t\t\t\tINVALID_HW_RING_ID);\n-\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n \tbn-\u003egrp_info[grp_idx].agg_fw_ring_id = INVALID_HW_RING_ID;\n }\n \n@@ -2439,14 +2437,14 @@ static void bnge_hwrm_tx_ring_free(struct bnge_net *bn,\n \tstruct bnge_ring_struct *ring = \u0026txr-\u003etx_ring_struct;\n \tu32 cmpl_ring_id;\n \n-\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID)\n+\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID_32BIT)\n \t\treturn;\n \n \tcmpl_ring_id = close_path ? bnge_cp_ring_for_tx(txr) :\n \t\t       INVALID_HW_RING_ID;\n \thwrm_ring_free_send_msg(bn, ring, RING_FREE_REQ_RING_TYPE_TX,\n \t\t\t\tcmpl_ring_id);\n-\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n }\n \n static void bnge_hwrm_cp_ring_free(struct bnge_net *bn,\n@@ -2455,12 +2453,12 @@ static void bnge_hwrm_cp_ring_free(struct bnge_net *bn,\n \tstruct bnge_ring_struct *ring;\n \n \tring = \u0026cpr-\u003ering_struct;\n-\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID)\n+\tif (ring-\u003efw_ring_id == INVALID_HW_RING_ID_32BIT)\n \t\treturn;\n \n \thwrm_ring_free_send_msg(bn, ring, RING_FREE_REQ_RING_TYPE_L2_CMPL,\n \t\t\t\tINVALID_HW_RING_ID);\n-\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n }\n \n static void bnge_hwrm_ring_free(struct bnge_net *bn, bool close_path)\n@@ -2496,11 +2494,11 @@ static void bnge_hwrm_ring_free(struct bnge_net *bn, bool close_path)\n \t\t\tbnge_hwrm_cp_ring_free(bn, \u0026nqr-\u003ecp_ring_arr[j]);\n \n \t\tring = \u0026nqr-\u003ering_struct;\n-\t\tif (ring-\u003efw_ring_id != INVALID_HW_RING_ID) {\n+\t\tif (ring-\u003efw_ring_id != INVALID_HW_RING_ID_32BIT) {\n \t\t\thwrm_ring_free_send_msg(bn, ring,\n \t\t\t\t\t\tRING_FREE_REQ_RING_TYPE_NQ,\n \t\t\t\t\t\tINVALID_HW_RING_ID);\n-\t\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID;\n+\t\t\tring-\u003efw_ring_id = INVALID_HW_RING_ID_32BIT;\n \t\t\tbn-\u003egrp_info[i].nq_fw_ring_id = INVALID_HW_RING_ID;\n \t\t}\n \t}\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h\nindex f4636b5b0cf3f0..d177919c2e1170 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h\n@@ -630,8 +630,8 @@ struct bnge_l2_filter {\n \trefcount_t\t\trefcnt;\n };\n \n-u16 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr);\n-u16 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr);\n+u32 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr);\n+u32 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr);\n void bnge_fill_hw_rss_tbl(struct bnge_net *bn, struct bnge_vnic_info *vnic);\n int bnge_alloc_rx_data(struct bnge_net *bn, struct bnge_rx_ring_info *rxr,\n \t\t       u16 prod, gfp_t gfp);\ndiff --git a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h\nindex 341c7f81ed092b..bb0c79a1ee60f7 100644\n--- a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h\n+++ b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h\n@@ -184,7 +184,7 @@ struct bnge_ctx_mem_info {\n struct bnge_ring_struct {\n \tstruct bnge_ring_mem_info\tring_mem;\n \n-\tu16\t\t\tfw_ring_id;\n+\tu32\t\t\tfw_ring_id;\n \tunion {\n \t\tu16\t\tgrp_idx;\n \t\tu16\t\tmap_idx; /* Used by NQs */\ndiff --git a/include/linux/bnge/hsi.h b/include/linux/bnge/hsi.h\nindex 8ea13d5407eecd..1f7bd96415a527 100644\n--- a/include/linux/bnge/hsi.h\n+++ b/include/linux/bnge/hsi.h\n@@ -8317,8 +8317,7 @@ struct hwrm_ring_alloc_output {\n \t__le16\treq_type;\n \t__le16\tseq_id;\n \t__le16\tresp_len;\n-\t__le16\tring_id;\n-\t__le16\tlogical_ring_id;\n+\t__le32\tring_id;\n \tu8\tpush_buffer_index;\n \t#define RING_ALLOC_RESP_PUSH_BUFFER_INDEX_PING_BUFFER 0x0UL\n \t#define RING_ALLOC_RESP_PUSH_BUFFER_INDEX_PONG_BUFFER 0x1UL\n@@ -8345,10 +8344,10 @@ struct hwrm_ring_free_input {\n \tu8\tflags;\n \t#define RING_FREE_REQ_FLAGS_VIRTIO_RING_VALID 0x1UL\n \t#define RING_FREE_REQ_FLAGS_LAST             RING_FREE_REQ_FLAGS_VIRTIO_RING_VALID\n-\t__le16\tring_id;\n+\t__le16\tunused_1;\n \t__le32\tprod_idx;\n \t__le32\topaque;\n-\t__le32\tunused_1;\n+\t__le32\tring_id;\n };\n \n /* hwrm_ring_free_output (size:128b/16B) */\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "BNGE",
    "INFINIBAND_BNG_RE",
    "DCB"
  ],
  "FocusSymbols": [
    "bng_re_net_ring_free",
    "bng_re_net_ring_alloc",
    "hwrm_ring_free_send_msg",
    "hwrm_ring_alloc_send_msg",
    "bnge_hwrm_rx_agg_ring_alloc",
    "bnge_hwrm_rx_ring_alloc",
    "bnge_hwrm_ring_alloc",
    "bnge_hwrm_rx_ring_free",
    "bnge_hwrm_rx_agg_ring_free",
    "bnge_hwrm_tx_ring_free",
    "bnge_hwrm_cp_ring_free",
    "bnge_hwrm_ring_free"
  ],
  "Reasoning": "The patch modifies the Broadcom BNGE and BNG_RE drivers to support 32-bit firmware ring IDs instead of 16-bit. This is a functional change affecting the driver's interaction with the hardware/firmware during ring allocation and freeing. The driver can be tested via PCI emulation in virtualized environments.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 9966fa64ffb2cdd46036bd5dd2f6b903bd0a9d71
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Jun 30 15:00:05 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/infiniband/hw/bng_re/bng_dev.c b/drivers/infiniband/hw/bng_re/bng_dev.c
index 71a7ca2196ad88..311c8bc931603a 100644
--- a/drivers/infiniband/hw/bng_re/bng_dev.c
+++ b/drivers/infiniband/hw/bng_re/bng_dev.c
@@ -113,7 +113,7 @@ static void bng_re_fill_fw_msg(struct bnge_fw_msg *fw_msg, void *msg,
 }
 
 static int bng_re_net_ring_free(struct bng_re_dev *rdev,
-				u16 fw_ring_id, int type)
+				u32 fw_ring_id, int type)
 {
 	struct bnge_auxr_dev *aux_dev = rdev->aux_dev;
 	struct hwrm_ring_free_input req = {};
@@ -123,7 +123,7 @@ static int bng_re_net_ring_free(struct bng_re_dev *rdev,
 
 	bng_re_init_hwrm_hdr((void *)&req, HWRM_RING_FREE);
 	req.ring_type = type;
-	req.ring_id = cpu_to_le16(fw_ring_id);
+	req.ring_id = cpu_to_le32(fw_ring_id);
 	bng_re_fill_fw_msg(&fw_msg, (void *)&req, sizeof(req), (void *)&resp,
 			    sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);
 	rc = bnge_send_msg(aux_dev, &fw_msg);
@@ -161,7 +161,7 @@ static int bng_re_net_ring_alloc(struct bng_re_dev *rdev,
 			   sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);
 	rc = bnge_send_msg(aux_dev, &fw_msg);
 	if (!rc)
-		*fw_ring_id = le16_to_cpu(resp.ring_id);
+		*fw_ring_id = (u16)le32_to_cpu(resp.ring_id);
 
 	return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge.h b/drivers/net/ethernet/broadcom/bnge/bnge.h
index f21cff651fd44a..4479ccd071f532 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge.h
+++ b/drivers/net/ethernet/broadcom/bnge/bnge.h
@@ -36,6 +36,7 @@ struct bnge_pf_info {
 };
 
 #define INVALID_HW_RING_ID      ((u16)-1)
+#define INVALID_HW_RING_ID_32BIT	(U32_MAX)
 
 enum {
 	BNGE_FW_CAP_SHORT_CMD				= BIT_ULL(0),
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c
index 1c9cfec1b633fc..651c5e783516cc 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c
@@ -1283,7 +1283,7 @@ int bnge_hwrm_stat_ctx_alloc(struct bnge_net *bn)
 
 int hwrm_ring_free_send_msg(struct bnge_net *bn,
 			    struct bnge_ring_struct *ring,
-			    u32 ring_type, int cmpl_ring_id)
+			    u32 ring_type, u32 cmpl_ring_id)
 {
 	struct hwrm_ring_free_input *req;
 	struct bnge_dev *bd = bn->bd;
@@ -1295,7 +1295,7 @@ int hwrm_ring_free_send_msg(struct bnge_net *bn,
 
 	req->cmpl_ring = cpu_to_le16(cmpl_ring_id);
 	req->ring_type = ring_type;
-	req->ring_id = cpu_to_le16(ring->fw_ring_id);
+	req->ring_id = cpu_to_le32(ring->fw_ring_id);
 
 	bnge_hwrm_req_hold(bd, req);
 	rc = bnge_hwrm_req_send(bd, req);
@@ -1317,7 +1317,7 @@ int hwrm_ring_alloc_send_msg(struct bnge_net *bn,
 	struct hwrm_ring_alloc_output *resp;
 	struct hwrm_ring_alloc_input *req;
 	struct bnge_dev *bd = bn->bd;
-	u16 ring_id, flags = 0;
+	u32 ring_id, flags = 0;
 	int rc;
 
 	rc = bnge_hwrm_req_init(bd, req, HWRM_RING_ALLOC);
@@ -1401,7 +1401,7 @@ int hwrm_ring_alloc_send_msg(struct bnge_net *bn,
 
 	resp = bnge_hwrm_req_hold(bd, req);
 	rc = bnge_hwrm_req_send(bd, req);
-	ring_id = le16_to_cpu(resp->ring_id);
+	ring_id = le32_to_cpu(resp->ring_id);
 	bnge_hwrm_req_drop(bd, req);
 
 exit:
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h
index 3501de7a89b919..bf452e390d5bd1 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h
@@ -50,7 +50,7 @@ int bnge_hwrm_cfa_l2_set_rx_mask(struct bnge_dev *bd,
 void bnge_hwrm_stat_ctx_free(struct bnge_net *bn);
 int bnge_hwrm_stat_ctx_alloc(struct bnge_net *bn);
 int hwrm_ring_free_send_msg(struct bnge_net *bn, struct bnge_ring_struct *ring,
-			    u32 ring_type, int cmpl_ring_id);
+			    u32 ring_type, u32 cmpl_ring_id);
 int hwrm_ring_alloc_send_msg(struct bnge_net *bn,
 			     struct bnge_ring_struct *ring,
 			     u32 ring_type, u32 map_index);
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
index 70768193004cb2..6f7ef506d4e18c 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
@@ -1327,12 +1327,12 @@ static int bnge_alloc_core(struct bnge_net *bn)
 	return rc;
 }
 
-u16 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr)
+u32 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr)
 {
 	return rxr->rx_cpr->ring_struct.fw_ring_id;
 }
 
-u16 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr)
+u32 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr)
 {
 	return txr->tx_cpr->ring_struct.fw_ring_id;
 }
@@ -1375,12 +1375,12 @@ static void bnge_init_nq_tree(struct bnge_net *bn)
 		struct bnge_nq_ring_info *nqr = &bn->bnapi[i]->nq_ring;
 		struct bnge_ring_struct *ring = &nqr->ring_struct;
 
-		ring->fw_ring_id = INVALID_HW_RING_ID;
+		ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 		for (j = 0; j < nqr->cp_ring_count; j++) {
 			struct bnge_cp_ring_info *cpr = &nqr->cp_ring_arr[j];
 
 			ring = &cpr->ring_struct;
-			ring->fw_ring_id = INVALID_HW_RING_ID;
+			ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 		}
 	}
 }
@@ -1637,7 +1637,7 @@ static void bnge_init_one_rx_ring_rxbd(struct bnge_net *bn,
 
 	ring = &rxr->rx_ring_struct;
 	bnge_init_rxbd_pages(ring, type);
-	ring->fw_ring_id = INVALID_HW_RING_ID;
+	ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 }
 
 static void bnge_init_one_agg_ring_rxbd(struct bnge_net *bn,
@@ -1647,7 +1647,7 @@ static void bnge_init_one_agg_ring_rxbd(struct bnge_net *bn,
 	u32 type;
 
 	ring = &rxr->rx_agg_ring_struct;
-	ring->fw_ring_id = INVALID_HW_RING_ID;
+	ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 	if (bnge_is_agg_reqd(bn->bd)) {
 		type = ((u32)BNGE_RX_PAGE_SIZE << RX_BD_LEN_SHIFT) |
 			RX_BD_TYPE_RX_AGG_BD | RX_BD_FLAGS_SOP;
@@ -1708,7 +1708,7 @@ static void bnge_init_tx_rings(struct bnge_net *bn)
 		struct bnge_tx_ring_info *txr = &bn->tx_ring[i];
 		struct bnge_ring_struct *ring = &txr->tx_ring_struct;
 
-		ring->fw_ring_id = INVALID_HW_RING_ID;
+		ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 
 		netif_queue_set_napi(bn->netdev, i, NETDEV_QUEUE_TYPE_TX,
 				     &txr->bnapi->napi);
@@ -1867,7 +1867,7 @@ static int bnge_hwrm_rx_agg_ring_alloc(struct bnge_net *bn,
 		    ring->fw_ring_id);
 	bnge_db_write(bn->bd, &rxr->rx_agg_db, rxr->rx_agg_prod);
 	bnge_db_write(bn->bd, &rxr->rx_db, rxr->rx_prod);
-	bn->grp_info[grp_idx].agg_fw_ring_id = ring->fw_ring_id;
+	bn->grp_info[grp_idx].agg_fw_ring_id = (u16)ring->fw_ring_id;
 
 	return 0;
 }
@@ -1886,7 +1886,7 @@ static int bnge_hwrm_rx_ring_alloc(struct bnge_net *bn,
 		return rc;
 
 	bnge_set_db(bn, &rxr->rx_db, type, map_idx, ring->fw_ring_id);
-	bn->grp_info[map_idx].rx_fw_ring_id = ring->fw_ring_id;
+	bn->grp_info[map_idx].rx_fw_ring_id = (u16)ring->fw_ring_id;
 
 	return 0;
 }
@@ -1916,7 +1916,7 @@ static int bnge_hwrm_ring_alloc(struct bnge_net *bn)
 		bnge_set_db(bn, &nqr->nq_db, type, map_idx, ring->fw_ring_id);
 		bnge_db_nq(bn, &nqr->nq_db, nqr->nq_raw_cons);
 		enable_irq(vector);
-		bn->grp_info[i].nq_fw_ring_id = ring->fw_ring_id;
+		bn->grp_info[i].nq_fw_ring_id = (u16)ring->fw_ring_id;
 
 		if (!i) {
 			rc = bnge_hwrm_set_async_event_cr(bd, ring->fw_ring_id);
@@ -1986,15 +1986,13 @@ void bnge_fill_hw_rss_tbl(struct bnge_net *bn, struct bnge_vnic_info *vnic)
 	tbl_size = bnge_get_rxfh_indir_size(bd);
 
 	for (i = 0; i < tbl_size; i++) {
-		u16 ring_id, j;
+		u32 j;
 
 		j = bd->rss_indir_tbl[i];
 		rxr = &bn->rx_ring[j];
 
-		ring_id = rxr->rx_ring_struct.fw_ring_id;
-		*ring_tbl++ = cpu_to_le16(ring_id);
-		ring_id = bnge_cp_ring_for_rx(rxr);
-		*ring_tbl++ = cpu_to_le16(ring_id);
+		*ring_tbl++ = cpu_to_le16(rxr->rx_ring_struct.fw_ring_id);
+		*ring_tbl++ = cpu_to_le16(bnge_cp_ring_for_rx(rxr));
 	}
 }
 
@@ -2285,7 +2283,7 @@ static void bnge_disable_int(struct bnge_net *bn)
 		nqr = &bnapi->nq_ring;
 		ring = &nqr->ring_struct;
 
-		if (ring->fw_ring_id != INVALID_HW_RING_ID)
+		if (ring->fw_ring_id != INVALID_HW_RING_ID_32BIT)
 			bnge_db_nq(bn, &nqr->nq_db, nqr->nq_raw_cons);
 	}
 }
@@ -2401,7 +2399,7 @@ static void bnge_hwrm_rx_ring_free(struct bnge_net *bn,
 	u32 grp_idx = rxr->bnapi->index;
 	u32 cmpl_ring_id;
 
-	if (ring->fw_ring_id == INVALID_HW_RING_ID)
+	if (ring->fw_ring_id == INVALID_HW_RING_ID_32BIT)
 		return;
 
 	cmpl_ring_id = bnge_cp_ring_for_rx(rxr);
@@ -2409,7 +2407,7 @@ static void bnge_hwrm_rx_ring_free(struct bnge_net *bn,
 				RING_FREE_REQ_RING_TYPE_RX,
 				close_path ? cmpl_ring_id :
 				INVALID_HW_RING_ID);
-	ring->fw_ring_id = INVALID_HW_RING_ID;
+	ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 	bn->grp_info[grp_idx].rx_fw_ring_id = INVALID_HW_RING_ID;
 }
 
@@ -2421,14 +2419,14 @@ static void bnge_hwrm_rx_agg_ring_free(struct bnge_net *bn,
 	u32 grp_idx = rxr->bnapi->index;
 	u32 cmpl_ring_id;
 
-	if (ring->fw_ring_id == INVALID_HW_RING_ID)
+	if (ring->fw_ring_id == INVALID_HW_RING_ID_32BIT)
 		return;
 
 	cmpl_ring_id = bnge_cp_ring_for_rx(rxr);
 	hwrm_ring_free_send_msg(bn, ring, RING_FREE_REQ_RING_TYPE_RX_AGG,
 				close_path ? cmpl_ring_id :
 				INVALID_HW_RING_ID);
-	ring->fw_ring_id = INVALID_HW_RING_ID;
+	ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 	bn->grp_info[grp_idx].agg_fw_ring_id = INVALID_HW_RING_ID;
 }
 
@@ -2439,14 +2437,14 @@ static void bnge_hwrm_tx_ring_free(struct bnge_net *bn,
 	struct bnge_ring_struct *ring = &txr->tx_ring_struct;
 	u32 cmpl_ring_id;
 
-	if (ring->fw_ring_id == INVALID_HW_RING_ID)
+	if (ring->fw_ring_id == INVALID_HW_RING_ID_32BIT)
 		return;
 
 	cmpl_ring_id = close_path ? bnge_cp_ring_for_tx(txr) :
 		       INVALID_HW_RING_ID;
 	hwrm_ring_free_send_msg(bn, ring, RING_FREE_REQ_RING_TYPE_TX,
 				cmpl_ring_id);
-	ring->fw_ring_id = INVALID_HW_RING_ID;
+	ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 }
 
 static void bnge_hwrm_cp_ring_free(struct bnge_net *bn,
@@ -2455,12 +2453,12 @@ static void bnge_hwrm_cp_ring_free(struct bnge_net *bn,
 	struct bnge_ring_struct *ring;
 
 	ring = &cpr->ring_struct;
-	if (ring->fw_ring_id == INVALID_HW_RING_ID)
+	if (ring->fw_ring_id == INVALID_HW_RING_ID_32BIT)
 		return;
 
 	hwrm_ring_free_send_msg(bn, ring, RING_FREE_REQ_RING_TYPE_L2_CMPL,
 				INVALID_HW_RING_ID);
-	ring->fw_ring_id = INVALID_HW_RING_ID;
+	ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 }
 
 static void bnge_hwrm_ring_free(struct bnge_net *bn, bool close_path)
@@ -2496,11 +2494,11 @@ static void bnge_hwrm_ring_free(struct bnge_net *bn, bool close_path)
 			bnge_hwrm_cp_ring_free(bn, &nqr->cp_ring_arr[j]);
 
 		ring = &nqr->ring_struct;
-		if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+		if (ring->fw_ring_id != INVALID_HW_RING_ID_32BIT) {
 			hwrm_ring_free_send_msg(bn, ring,
 						RING_FREE_REQ_RING_TYPE_NQ,
 						INVALID_HW_RING_ID);
-			ring->fw_ring_id = INVALID_HW_RING_ID;
+			ring->fw_ring_id = INVALID_HW_RING_ID_32BIT;
 			bn->grp_info[i].nq_fw_ring_id = INVALID_HW_RING_ID;
 		}
 	}
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h
index f4636b5b0cf3f0..d177919c2e1170 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.h
@@ -630,8 +630,8 @@ struct bnge_l2_filter {
 	refcount_t		refcnt;
 };
 
-u16 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr);
-u16 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr);
+u32 bnge_cp_ring_for_rx(struct bnge_rx_ring_info *rxr);
+u32 bnge_cp_ring_for_tx(struct bnge_tx_ring_info *txr);
 void bnge_fill_hw_rss_tbl(struct bnge_net *bn, struct bnge_vnic_info *vnic);
 int bnge_alloc_rx_data(struct bnge_net *bn, struct bnge_rx_ring_info *rxr,
 		       u16 prod, gfp_t gfp);
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h
index 341c7f81ed092b..bb0c79a1ee60f7 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h
@@ -184,7 +184,7 @@ struct bnge_ctx_mem_info {
 struct bnge_ring_struct {
 	struct bnge_ring_mem_info	ring_mem;
 
-	u16			fw_ring_id;
+	u32			fw_ring_id;
 	union {
 		u16		grp_idx;
 		u16		map_idx; /* Used by NQs */
diff --git a/include/linux/bnge/hsi.h b/include/linux/bnge/hsi.h
index 8ea13d5407eecd..1f7bd96415a527 100644
--- a/include/linux/bnge/hsi.h
+++ b/include/linux/bnge/hsi.h
@@ -8317,8 +8317,7 @@ struct hwrm_ring_alloc_output {
 	__le16	req_type;
 	__le16	seq_id;
 	__le16	resp_len;
-	__le16	ring_id;
-	__le16	logical_ring_id;
+	__le32	ring_id;
 	u8	push_buffer_index;
 	#define RING_ALLOC_RESP_PUSH_BUFFER_INDEX_PING_BUFFER 0x0UL
 	#define RING_ALLOC_RESP_PUSH_BUFFER_INDEX_PONG_BUFFER 0x1UL
@@ -8345,10 +8344,10 @@ struct hwrm_ring_free_input {
 	u8	flags;
 	#define RING_FREE_REQ_FLAGS_VIRTIO_RING_VALID 0x1UL
 	#define RING_FREE_REQ_FLAGS_LAST             RING_FREE_REQ_FLAGS_VIRTIO_RING_VALID
-	__le16	ring_id;
+	__le16	unused_1;
 	__le32	prod_idx;
 	__le32	opaque;
-	__le32	unused_1;
+	__le32	ring_id;
 };
 
 /* hwrm_ring_free_output (size:128b/16B) */

gemini-3.1-pro-preview

null

null

							input: 8074
							output: 32
							thoughts: 261
						

**Analyzing a Broadcom Driver Patch**

Okay, so I'm looking at this patch. It seems like we're expanding the `fw_ring_id` field from a `u16` to a `u32` within the Broadcom BNGE driver. That's a significant change, potentially indicating we're dealing with a much larger number of rings being allocated. The target directories are `drivers/net/ethernet/broadcom/bnge/` and `drivers/infiniband/hw/bng_re/`, so that's where the core modifications are. It's touching the `bnge_ring_struct` structure and the invalid ID definitions. Also, it's modifying the `hwrm_ring_alloc_output` and `hwrm_ring_free_input` structures, which are critical for the hardware resource management.

But wait a minute... `bnge`? That doesn't immediately ring a bell. My experience with Broadcom network drivers usually involves `bnxt` for NetXtreme-C/E, or the older `bnx2` and `bnx2x`. `bnge` feels unusual. I need to verify that this is an actual driver. I'm going to quickly search the kernel tree to confirm that `bnge` is, indeed, a legitimate Broadcom driver. This is a crucial first step; I don't want to waste time analyzing something that doesn't even exist or is mislabeled. Let's see...

{
  "Expression": "bnge",
  "PathPrefix": "drivers/net/ethernet/broadcom/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 6120 lines.\nUse more precise expression if possible.\n\ndrivers/net/ethernet/broadcom/Makefile=20=obj-$(CONFIG_BCMASP) += asp2/\ndrivers/net/ethernet/broadcom/Makefile:21:obj-$(CONFIG_BNGE) += bnge/\n--\ndrivers/net/ethernet/broadcom/bnge/Makefile=3=obj-$(CONFIG_BNGE) += bng_en.o\ndrivers/net/ethernet/broadcom/bnge/Makefile-4-\ndrivers/net/ethernet/broadcom/bnge/Makefile:5:bng_en-y := bnge_core.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:6:\t    bnge_devlink.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:7:\t    bnge_hwrm.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:8:\t    bnge_hwrm_lib.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:9:\t    bnge_rmem.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:10:\t    bnge_resc.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:11:\t    bnge_netdev.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:12:\t    bnge_ethtool.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:13:\t    bnge_auxr.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:14:\t    bnge_txrx.o \\\ndrivers/net/ethernet/broadcom/bnge/Makefile:15:\t    bnge_link.o\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-10-#include \u003clinux/etherdevice.h\u003e\ndrivers/net/ethernet/broadcom/bnge/bnge.h:11:#include \u003clinux/bnge/hsi.h\u003e\ndrivers/net/ethernet/broadcom/bnge/bnge.h:12:#include \"bnge_rmem.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge.h:13:#include \"bnge_resc.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge.h:14:#include \"bnge_auxr.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge.h-15-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-19-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:20:extern char bnge_driver_name[];\ndrivers/net/ethernet/broadcom/bnge/bnge.h-21-\ndrivers/net/ethernet/broadcom/bnge/bnge.h=22=enum board_idx {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-25-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:26:struct bnge_auxr_priv {\ndrivers/net/ethernet/broadcom/bnge/bnge.h-27-\tstruct auxiliary_device aux_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge.h:28:\tstruct bnge_auxr_dev *auxr_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-29-\tint id;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-31-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:32:struct bnge_pf_info {\ndrivers/net/ethernet/broadcom/bnge/bnge.h-33-\tu16\tfw_fid;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h=81=enum {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-92-#define BNGE_MAX_QUEUE\t\t8\ndrivers/net/ethernet/broadcom/bnge/bnge.h:93:struct bnge_queue_info {\ndrivers/net/ethernet/broadcom/bnge/bnge.h-94-\tu8      queue_id;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-102-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:103:struct bnge_dev {\ndrivers/net/ethernet/broadcom/bnge/bnge.h-104-\tstruct device\t*dev;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-144-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:145:\tstruct bnge_pf_info\tpf;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-146-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-153-\t/* Backing stores */\ndrivers/net/ethernet/broadcom/bnge/bnge.h:154:\tstruct bnge_ctx_mem_info\t*ctx;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-155-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-157-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:158:\tstruct bnge_hw_resc\thw_resc;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-159-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-204-\tu8\t\t\tmax_lltc;\t/* lossless TCs */\ndrivers/net/ethernet/broadcom/bnge/bnge.h:205:\tstruct bnge_queue_info\tq_info[BNGE_MAX_QUEUE];\ndrivers/net/ethernet/broadcom/bnge/bnge.h-206-\tu8\t\t\ttc_to_qidx[BNGE_MAX_QUEUE];\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-210-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:211:\tstruct bnge_irq\t\t*irq_tbl;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-212-\tu16\t\t\tirqs_acquired;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-213-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:214:\tstruct bnge_auxr_priv\t*aux_priv;\ndrivers/net/ethernet/broadcom/bnge/bnge.h:215:\tstruct bnge_auxr_dev\t*auxr_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-216-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:217:\tstruct bnge_link_info\tlink_info;\ndrivers/net/ethernet/broadcom/bnge/bnge.h-218-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-222-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:223:static inline bool bnge_is_roce_en(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge.h-224-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-227-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:228:static inline bool bnge_is_agg_reqd(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge.h-229-{\ndrivers/net/ethernet/broadcom/bnge/bnge.h-230-\tif (bd-\u003enetdev) {\ndrivers/net/ethernet/broadcom/bnge/bnge.h:231:\t\tstruct bnge_net *bn = netdev_priv(bd-\u003enetdev);\ndrivers/net/ethernet/broadcom/bnge/bnge.h-232-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-242-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:243:static inline void bnge_writeq(struct bnge_dev *bd, u64 val,\ndrivers/net/ethernet/broadcom/bnge/bnge.h-244-\t\t\t       void __iomem *addr)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-255-/* For TX and RX ring doorbells */\ndrivers/net/ethernet/broadcom/bnge/bnge.h:256:static inline void bnge_db_write(struct bnge_dev *bd, struct bnge_db_info *db,\ndrivers/net/ethernet/broadcom/bnge/bnge.h-257-\t\t\t\t u32 idx)\ndrivers/net/ethernet/broadcom/bnge/bnge.h-258-{\ndrivers/net/ethernet/broadcom/bnge/bnge.h:259:\tbnge_writeq(bd, db-\u003edb_key64 | DB_RING_IDX(db, idx),\ndrivers/net/ethernet/broadcom/bnge/bnge.h-260-\t\t    db-\u003edoorbell);\n--\ndrivers/net/ethernet/broadcom/bnge/bnge.h-262-\ndrivers/net/ethernet/broadcom/bnge/bnge.h:263:bool bnge_aux_registered(struct bnge_dev *bd);\ndrivers/net/ethernet/broadcom/bnge/bnge.h:264:u16 bnge_aux_get_msix(struct bnge_dev *bd);\ndrivers/net/ethernet/broadcom/bnge/bnge.h-265-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-16-#include \u003clinux/auxiliary_bus.h\u003e\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:17:#include \u003clinux/bnge/hsi.h\u003e\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-18-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:19:#include \"bnge.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:20:#include \"bnge_hwrm.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:21:#include \"bnge_auxr.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-22-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:23:static DEFINE_IDA(bnge_aux_dev_ids);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-24-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:25:static void bnge_fill_msix_vecs(struct bnge_dev *bd,\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:26:\t\t\t\tstruct bnge_msix_info *info)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-27-{\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:28:\tstruct bnge_auxr_dev *auxr_dev = bd-\u003eauxr_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-29-\tint num_msix, i;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-42-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:43:int bnge_register_dev(struct bnge_auxr_dev *auxr_dev,\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-44-\t\t      void *handle)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-45-{\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:46:\tstruct bnge_dev *bd = pci_get_drvdata(auxr_dev-\u003epdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:47:\tstruct bnge_auxr_info *auxr_info;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-48-\tint rc = 0;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-56-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:57:\tif (!bnge_aux_has_enough_resources(bd)) {\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-58-\t\trc = -ENOMEM;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-66-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:67:\tbnge_fill_msix_vecs(bd, bd-\u003eauxr_dev-\u003emsix_info);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-68-\tauxr_dev-\u003eflags |= BNGE_ARDEV_MSIX_ALLOC;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-74-}\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:75:EXPORT_SYMBOL(bnge_register_dev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-76-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:77:void bnge_unregister_dev(struct bnge_auxr_dev *auxr_dev)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-78-{\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:79:\tstruct bnge_dev *bd = pci_get_drvdata(auxr_dev-\u003epdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:80:\tstruct bnge_auxr_info *auxr_info;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-81-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-91-}\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:92:EXPORT_SYMBOL(bnge_unregister_dev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-93-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:94:int bnge_send_msg(struct bnge_auxr_dev *auxr_dev, struct bnge_fw_msg *fw_msg)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-95-{\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:96:\tstruct bnge_dev *bd = pci_get_drvdata(auxr_dev-\u003epdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-97-\tstruct output *resp;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-101-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:102:\trc = bnge_hwrm_req_init(bd, req, 0 /* don't care */);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-103-\tif (rc)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-105-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:106:\trc = bnge_hwrm_req_replace(bd, req, fw_msg-\u003emsg, fw_msg-\u003emsg_len);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-107-\tif (rc)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-109-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:110:\tbnge_hwrm_req_timeout(bd, req, fw_msg-\u003etimeout);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:111:\tresp = bnge_hwrm_req_hold(bd, req);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:112:\trc = bnge_hwrm_req_send(bd, req);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-113-\tresp_len = le16_to_cpu(resp-\u003eresp_len);\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-120-drop_req:\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:121:\tbnge_hwrm_req_drop(bd, req);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-122-\treturn rc;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-123-}\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:124:EXPORT_SYMBOL(bnge_send_msg);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-125-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:126:void bnge_rdma_aux_device_uninit(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-127-{\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:128:\tstruct bnge_auxr_priv *aux_priv;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-129-\tstruct auxiliary_device *adev;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-139-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:140:static void bnge_aux_dev_release(struct device *dev)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-141-{\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:142:\tstruct bnge_auxr_priv *aux_priv =\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:143:\t\t\tcontainer_of(dev, struct bnge_auxr_priv, aux_dev.dev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:144:\tstruct bnge_dev *bd = pci_get_drvdata(aux_priv-\u003eauxr_dev-\u003epdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-145-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:146:\tida_free(\u0026bnge_aux_dev_ids, aux_priv-\u003eid);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-147-\tkfree(aux_priv-\u003eauxr_dev-\u003eauxr_info);\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-153-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:154:void bnge_rdma_aux_device_del(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-155-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-161-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:162:static void bnge_set_auxr_dev_info(struct bnge_auxr_dev *auxr_dev,\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:163:\t\t\t\t   struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-164-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-182-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:183:void bnge_rdma_aux_device_add(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-184-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-202-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:203:void bnge_rdma_aux_device_init(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-204-{\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-205-\tstruct auxiliary_device *aux_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:206:\tstruct bnge_auxr_info *auxr_info;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:207:\tstruct bnge_auxr_priv *aux_priv;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:208:\tstruct bnge_auxr_dev *auxr_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-209-\tint rc;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-210-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:211:\tif (!bnge_is_roce_en(bd))\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-212-\t\treturn;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-217-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:218:\taux_priv-\u003eid = ida_alloc(\u0026bnge_aux_dev_ids, GFP_KERNEL);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-219-\tif (aux_priv-\u003eid \u003c 0) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-228-\taux_dev-\u003edev.parent = \u0026bd-\u003epdev-\u003edev;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:229:\taux_dev-\u003edev.release = bnge_aux_dev_release;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-230-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-232-\tif (rc) {\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:233:\t\tida_free(\u0026bnge_aux_dev_ids, aux_priv-\u003eid);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-234-\t\tkfree(aux_priv);\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-250-\tbd-\u003eauxr_dev = auxr_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c:251:\tbnge_set_auxr_dev_info(auxr_dev, bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.c-252-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h=14=struct hwrm_async_event_cmpl;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:15:struct bnge;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-16-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:17:struct bnge_msix_info {\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-18-\tu32\tvector;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-22-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:23:struct bnge_fw_msg {\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-24-\tvoid\t*msg;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-30-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:31:struct bnge_auxr_info {\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-32-\tvoid\t\t*handle;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h=36=enum {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-44-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:45:struct bnge_auxr_dev {\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-46-\tstruct net_device\t*net;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-49-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:50:\tstruct bnge_msix_info\tmsix_info[BNGE_MAX_ROCE_MSIX];\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-51-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-53-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:54:\tstruct bnge_auxr_info\t*auxr_info;\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-55-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-74-\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:75:void bnge_rdma_aux_device_uninit(struct bnge_dev *bdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:76:void bnge_rdma_aux_device_del(struct bnge_dev *bdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:77:void bnge_rdma_aux_device_add(struct bnge_dev *bdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:78:void bnge_rdma_aux_device_init(struct bnge_dev *bdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:79:int bnge_register_dev(struct bnge_auxr_dev *adev,\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-80-\t\t      void *handle);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:81:void bnge_unregister_dev(struct bnge_auxr_dev *adev);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h:82:int bnge_send_msg(struct bnge_auxr_dev *adev, struct bnge_fw_msg *fw_msg);\ndrivers/net/ethernet/broadcom/bnge/bnge_auxr.h-83-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-8-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:9:#include \"bnge.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:10:#include \"bnge_devlink.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:11:#include \"bnge_hwrm.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:12:#include \"bnge_hwrm_lib.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:13:#include \"bnge_link.h\"\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-14-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=16=MODULE_DESCRIPTION(DRV_SUMMARY);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-17-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:18:char bnge_driver_name[] = DRV_NAME;\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-19-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c=20=static const struct {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-25-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:26:static const struct pci_device_id bnge_pci_tbl[] = {\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-27-\t{ PCI_VDEVICE(BROADCOM, 0x1780), .driver_data = BCM57708 },\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-30-};\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:31:MODULE_DEVICE_TABLE(pci, bnge_pci_tbl);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-32-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:33:static void bnge_print_device_info(struct pci_dev *pdev, enum board_idx idx)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-34-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-42-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:43:bool bnge_aux_registered(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-44-{\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:45:\tstruct bnge_auxr_dev *ba_dev = bd-\u003eauxr_dev;\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-46-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-52-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:53:static void bnge_nvm_cfg_ver_get(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-54-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-56-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:57:\tif (!bnge_hwrm_nvm_dev_info(bd, \u0026nvm_info))\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-58-\t\tsnprintf(bd-\u003envm_cfg_ver, FW_VER_STR_LEN, \"%d.%d.%d\",\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-62-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:63:static int bnge_func_qcaps(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-64-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-66-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:67:\trc = bnge_hwrm_func_qcaps(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-68-\tif (rc)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-70-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:71:\trc = bnge_hwrm_queue_qportcfg(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-72-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-79-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:80:static int bnge_func_qrcaps_qcfg(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-81-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-83-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:84:\trc = bnge_hwrm_func_resc_qcaps(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-85-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-89-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:90:\trc = bnge_hwrm_func_qcfg(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-91-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-95-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:96:\trc = bnge_hwrm_vnic_qcaps(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-97-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-104-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:105:static void bnge_fw_unregister_dev(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-106-{\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-107-\t/* ctx mem free after unrgtr only */\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:108:\tbnge_hwrm_func_drv_unrgtr(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:109:\tbnge_free_ctx_mem(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-110-}\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-111-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:112:static void bnge_set_dflt_rss_hash_type(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-113-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-121-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:122:static int bnge_fw_register_dev(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-123-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-126-\tbd-\u003efw_cap = 0;\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:127:\trc = bnge_hwrm_ver_get(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-128-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-132-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:133:\tbnge_nvm_cfg_ver_get(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-134-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:135:\trc = bnge_hwrm_func_reset(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-136-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-140-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:141:\tbnge_hwrm_fw_set_time(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-142-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-143-\t/* Get the resources and configuration from firmware */\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:144:\trc = bnge_func_qcaps(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-145-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-149-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:150:\trc = bnge_alloc_ctx_mem(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-151-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-155-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:156:\trc = bnge_hwrm_func_drv_rgtr(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-157-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-161-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:162:\trc = bnge_func_qrcaps_qcfg(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-163-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-167-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:168:\tbnge_set_dflt_rss_hash_type(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-169-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-172-err_func_unrgtr:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:173:\tbnge_hwrm_func_drv_unrgtr(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-174-err_free_ctx_mem:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:175:\tbnge_free_ctx_mem(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-176-\treturn rc;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-178-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:179:static void bnge_pci_disable(struct pci_dev *pdev)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-180-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-185-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:186:static int bnge_pci_enable(struct pci_dev *pdev)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-187-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-202-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:203:\trc = pci_request_regions(pdev, bnge_driver_name);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-204-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-219-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:220:static void bnge_unmap_bars(struct pci_dev *pdev)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-221-{\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:222:\tstruct bnge_dev *bd = pci_get_drvdata(pdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-223-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-234-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:235:static void bnge_set_max_func_irqs(struct bnge_dev *bd,\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-236-\t\t\t\t   unsigned int max_irqs)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-240-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:241:static int bnge_get_max_irq(struct pci_dev *pdev)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-242-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-248-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:249:static int bnge_map_db_bar(struct bnge_dev *bd)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-250-{\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-260-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:261:static int bnge_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-262-{\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-263-\tunsigned int max_irqs;\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:264:\tstruct bnge_dev *bd;\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-265-\tint rc;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-279-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:280:\trc = bnge_pci_enable(pdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-281-\tif (rc)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-283-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:284:\tbnge_print_device_info(pdev, ent-\u003edriver_data);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-285-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:286:\tbd = bnge_devlink_alloc(pdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-287-\tif (!bd) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-299-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:300:\trc = bnge_init_hwrm_resources(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-301-\tif (rc)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-303-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:304:\trc = bnge_fw_register_dev(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-305-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-309-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:310:\tbnge_devlink_register(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-311-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:312:\tmax_irqs = bnge_get_max_irq(pdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:313:\tbnge_set_max_func_irqs(bd, max_irqs);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-314-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:315:\tbnge_aux_init_dflt_config(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-316-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:317:\trc = bnge_net_init_dflt_config(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-318-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-323-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:324:\trc = bnge_map_db_bar(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-325-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-334-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:335:\tbnge_rdma_aux_device_init(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-336-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:337:\trc = bnge_alloc_irqs(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-338-\tif (rc) {\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-342-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:343:\trc = bnge_netdev_alloc(bd, max_irqs);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-344-\tif (rc)\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-346-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:347:\tbnge_rdma_aux_device_add(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-348-\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-353-err_free_irq:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:354:\tbnge_free_irqs(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-355-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-356-err_uninit_auxr:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:357:\tbnge_rdma_aux_device_uninit(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-358-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-359-err_config_uninit:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:360:\tbnge_net_uninit_dflt_config(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-361-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-362-err_fw_reg:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:363:\tbnge_devlink_unregister(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:364:\tbnge_fw_unregister_dev(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-365-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-366-err_hwrm_cleanup:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:367:\tbnge_cleanup_hwrm_resources(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-368-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-369-err_bar_unmap:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:370:\tbnge_unmap_bars(pdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-371-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-372-err_devl_free:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:373:\tbnge_devlink_free(bd);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-374-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-375-err_pci_disable:\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:376:\tbnge_pci_disable(pdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-377-\treturn rc;\n--\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-379-\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:380:static void bnge_remove_one(struct pci_dev *pdev)\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-381-{\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c:382:\tstruct bnge_dev *bd = pci_get_drvdata(pdev);\ndrivers/net/ethernet/broadcom/bnge/bnge_core.c-383-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 22510
							output: 33
							thoughts: 239
						

**Analyzing the Driver's Presence**

Okay, so I'm looking at this driver, `bnge`. First thought is, "Where does this even fit? Is it a standard driver in the mainline kernel, perhaps a mock or a test driver, or something specific?" Then I realize, "Hang on, `bnge` doesn't immediately ring any bells from upstream Linux." That triggers a thought: "Could this be something added by syz-cluster for fuzzing, or maybe it's specific to a particular development branch?"

Ah, now the confusion kicks in. The text lists *different* paths that are changed: `drivers/net/ethernet/broadcom/bnge/bnge_dev.c` *and* `drivers/infiniband/hw/bng_re/bng_dev.c` and `drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c`. Something seems inconsistent about this, but... wait, the prompt says the changes *have already* been committed to the HEAD. Okay, so that means this driver *does* exist somewhere in the tree.

Now, I need to verify that this is indeed reachable through configuration. First, let's start with `CONFIG_BNGE`. That should be a standard config option. Let's see... Yup, and the build system uses it: `obj-$(CONFIG_BNGE) += bnge/`. Okay, so `bnge` *can* be built if `CONFIG_BNGE` is enabled. Now, let's check the other one, `CONFIG_INFINIBAND_BNG_RE`. That's the next step.

{
  "Expression": "bng_re",
  "PathPrefix": "drivers/infiniband/hw/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 992 lines.\nUse more precise expression if possible.\n\ndrivers/infiniband/hw/Makefile=15=obj-$(CONFIG_INFINIBAND_BNXT_RE)\t+= bnxt_re/\ndrivers/infiniband/hw/Makefile:16:obj-$(CONFIG_INFINIBAND_BNG_RE)\t\t+= bng_re/\ndrivers/infiniband/hw/Makefile-17-obj-$(CONFIG_INFINIBAND_ERDMA)\t\t+= erdma/\n--\ndrivers/infiniband/hw/bng_re/Kconfig=2=config INFINIBAND_BNG_RE\n--\ndrivers/infiniband/hw/bng_re/Kconfig-8-\t  50/100/200/400/800 gigabit RoCE HCAs. The module\ndrivers/infiniband/hw/bng_re/Kconfig:9:\t  will be called bng_re. To compile this driver\ndrivers/infiniband/hw/bng_re/Kconfig-10-\t  as a module, choose M here.\n--\ndrivers/infiniband/hw/bng_re/Makefile=2=ccflags-y := -I $(srctree)/drivers/net/ethernet/broadcom/bnge\ndrivers/infiniband/hw/bng_re/Makefile-3-\ndrivers/infiniband/hw/bng_re/Makefile:4:obj-$(CONFIG_INFINIBAND_BNG_RE) += bng_re.o\ndrivers/infiniband/hw/bng_re/Makefile-5-\ndrivers/infiniband/hw/bng_re/Makefile:6:bng_re-y := bng_dev.o bng_fw.o \\\ndrivers/infiniband/hw/bng_re/Makefile:7:\t    bng_res.o bng_sp.o \\\ndrivers/infiniband/hw/bng_re/Makefile-8-\t    bng_debugfs.o\n--\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-7-\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:8:#include \"bng_res.h\"\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-9-#include \"bng_fw.h\"\n--\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-11-#include \"bnge_auxr.h\"\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:12:#include \"bng_re.h\"\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-13-#include \"bng_debugfs.h\"\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-14-\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:15:static struct dentry *bng_re_debugfs_root;\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-16-\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:17:void bng_re_debugfs_add_pdev(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-18-{\n--\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-21-\trdev-\u003edbg_root =\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:22:\t\tdebugfs_create_dir(dev_name(\u0026pdev-\u003edev), bng_re_debugfs_root);\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-23-}\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-24-\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:25:void bng_re_debugfs_rem_pdev(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-26-{\n--\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-30-\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:31:void bng_re_register_debugfs(void)\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-32-{\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:33:\tbng_re_debugfs_root = debugfs_create_dir(\"bng_re\", NULL);\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-34-}\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-35-\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:36:void bng_re_unregister_debugfs(void)\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-37-{\ndrivers/infiniband/hw/bng_re/bng_debugfs.c:38:\tdebugfs_remove(bng_re_debugfs_root);\ndrivers/infiniband/hw/bng_re/bng_debugfs.c-39-}\n--\ndrivers/infiniband/hw/bng_re/bng_debugfs.h-6-\ndrivers/infiniband/hw/bng_re/bng_debugfs.h:7:void bng_re_debugfs_add_pdev(struct bng_re_dev *rdev);\ndrivers/infiniband/hw/bng_re/bng_debugfs.h:8:void bng_re_debugfs_rem_pdev(struct bng_re_dev *rdev);\ndrivers/infiniband/hw/bng_re/bng_debugfs.h-9-\ndrivers/infiniband/hw/bng_re/bng_debugfs.h:10:void bng_re_register_debugfs(void);\ndrivers/infiniband/hw/bng_re/bng_debugfs.h:11:void bng_re_unregister_debugfs(void);\ndrivers/infiniband/hw/bng_re/bng_debugfs.h-12-#endif\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-9-\ndrivers/infiniband/hw/bng_re/bng_dev.c:10:#include \"bng_res.h\"\ndrivers/infiniband/hw/bng_re/bng_dev.c-11-#include \"bng_sp.h\"\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-14-#include \"bnge_auxr.h\"\ndrivers/infiniband/hw/bng_re/bng_dev.c:15:#include \"bng_re.h\"\ndrivers/infiniband/hw/bng_re/bng_dev.c-16-#include \"bnge_hwrm.h\"\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c=21=MODULE_LICENSE(\"Dual BSD/GPL\");\ndrivers/infiniband/hw/bng_re/bng_dev.c-22-\ndrivers/infiniband/hw/bng_re/bng_dev.c:23:static struct bng_re_dev *bng_re_dev_add(struct auxiliary_device *adev,\ndrivers/infiniband/hw/bng_re/bng_dev.c-24-\t\t\t\t\t struct bnge_auxr_dev *aux_dev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-25-{\ndrivers/infiniband/hw/bng_re/bng_dev.c:26:\tstruct bng_re_dev *rdev;\ndrivers/infiniband/hw/bng_re/bng_dev.c-27-\ndrivers/infiniband/hw/bng_re/bng_dev.c:28:\t/* Allocate bng_re_dev instance */\ndrivers/infiniband/hw/bng_re/bng_dev.c:29:\trdev = ib_alloc_device(bng_re_dev, ibdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-30-\tif (!rdev) {\ndrivers/infiniband/hw/bng_re/bng_dev.c:31:\t\tpr_err(\"%s: bng_re_dev allocation failure!\", KBUILD_MODNAME);\ndrivers/infiniband/hw/bng_re/bng_dev.c-32-\t\treturn NULL;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-44-\ndrivers/infiniband/hw/bng_re/bng_dev.c:45:static int bng_re_register_netdev(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-46-{\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-52-\ndrivers/infiniband/hw/bng_re/bng_dev.c:53:static void bng_re_destroy_chip_ctx(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-54-{\ndrivers/infiniband/hw/bng_re/bng_dev.c:55:\tstruct bng_re_chip_ctx *chip_ctx;\ndrivers/infiniband/hw/bng_re/bng_dev.c-56-\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-62-\trdev-\u003ercfw.res = NULL;\ndrivers/infiniband/hw/bng_re/bng_dev.c:63:\trdev-\u003ebng_res.cctx = NULL;\ndrivers/infiniband/hw/bng_re/bng_dev.c:64:\trdev-\u003ebng_res.pdev = NULL;\ndrivers/infiniband/hw/bng_re/bng_dev.c-65-\tkfree(chip_ctx);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-67-\ndrivers/infiniband/hw/bng_re/bng_dev.c:68:static int bng_re_setup_chip_ctx(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-69-{\ndrivers/infiniband/hw/bng_re/bng_dev.c:70:\tstruct bng_re_chip_ctx *chip_ctx;\ndrivers/infiniband/hw/bng_re/bng_dev.c-71-\tstruct bnge_auxr_dev *aux_dev;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-74-\taux_dev = rdev-\u003eaux_dev;\ndrivers/infiniband/hw/bng_re/bng_dev.c:75:\trdev-\u003ebng_res.pdev = aux_dev-\u003epdev;\ndrivers/infiniband/hw/bng_re/bng_dev.c:76:\trdev-\u003ercfw.res = \u0026rdev-\u003ebng_res;\ndrivers/infiniband/hw/bng_re/bng_dev.c-77-\tchip_ctx = kzalloc_obj(*chip_ctx);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-83-\trdev-\u003echip_ctx = chip_ctx;\ndrivers/infiniband/hw/bng_re/bng_dev.c:84:\trdev-\u003ebng_res.cctx = rdev-\u003echip_ctx;\ndrivers/infiniband/hw/bng_re/bng_dev.c-85-\trdev-\u003edev_attr = kzalloc_obj(*rdev-\u003edev_attr);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-87-\t\tgoto free_chip_ctx;\ndrivers/infiniband/hw/bng_re/bng_dev.c:88:\trdev-\u003ebng_res.dattr = rdev-\u003edev_attr;\ndrivers/infiniband/hw/bng_re/bng_dev.c-89-\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-96-\ndrivers/infiniband/hw/bng_re/bng_dev.c:97:static void bng_re_init_hwrm_hdr(struct input *hdr, u16 opcd)\ndrivers/infiniband/hw/bng_re/bng_dev.c-98-{\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-103-\ndrivers/infiniband/hw/bng_re/bng_dev.c:104:static void bng_re_fill_fw_msg(struct bnge_fw_msg *fw_msg, void *msg,\ndrivers/infiniband/hw/bng_re/bng_dev.c-105-\t\t\t       int msg_len, void *resp, int resp_max_len,\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-114-\ndrivers/infiniband/hw/bng_re/bng_dev.c:115:static int bng_re_net_ring_free(struct bng_re_dev *rdev,\ndrivers/infiniband/hw/bng_re/bng_dev.c-116-\t\t\t\tu32 fw_ring_id, int type)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-123-\ndrivers/infiniband/hw/bng_re/bng_dev.c:124:\tbng_re_init_hwrm_hdr((void *)\u0026req, HWRM_RING_FREE);\ndrivers/infiniband/hw/bng_re/bng_dev.c-125-\treq.ring_type = type;\ndrivers/infiniband/hw/bng_re/bng_dev.c-126-\treq.ring_id = cpu_to_le32(fw_ring_id);\ndrivers/infiniband/hw/bng_re/bng_dev.c:127:\tbng_re_fill_fw_msg(\u0026fw_msg, (void *)\u0026req, sizeof(req), (void *)\u0026resp,\ndrivers/infiniband/hw/bng_re/bng_dev.c-128-\t\t\t    sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-135-\ndrivers/infiniband/hw/bng_re/bng_dev.c:136:static int bng_re_net_ring_alloc(struct bng_re_dev *rdev,\ndrivers/infiniband/hw/bng_re/bng_dev.c:137:\t\t\t\t struct bng_re_ring_attr *ring_attr,\ndrivers/infiniband/hw/bng_re/bng_dev.c-138-\t\t\t\t u16 *fw_ring_id)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-145-\ndrivers/infiniband/hw/bng_re/bng_dev.c:146:\tbng_re_init_hwrm_hdr((void *)\u0026req, HWRM_RING_ALLOC);\ndrivers/infiniband/hw/bng_re/bng_dev.c-147-\treq.enables = 0;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-159-\treq.int_mode = ring_attr-\u003emode;\ndrivers/infiniband/hw/bng_re/bng_dev.c:160:\tbng_re_fill_fw_msg(\u0026fw_msg, (void *)\u0026req, sizeof(req), (void *)\u0026resp,\ndrivers/infiniband/hw/bng_re/bng_dev.c-161-\t\t\t   sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-168-\ndrivers/infiniband/hw/bng_re/bng_dev.c:169:static int bng_re_stats_ctx_free(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-170-{\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-176-\ndrivers/infiniband/hw/bng_re/bng_dev.c:177:\tbng_re_init_hwrm_hdr((void *)\u0026req, HWRM_STAT_CTX_FREE);\ndrivers/infiniband/hw/bng_re/bng_dev.c-178-\treq.stat_ctx_id = cpu_to_le32(rdev-\u003estats_ctx.fw_id);\ndrivers/infiniband/hw/bng_re/bng_dev.c:179:\tbng_re_fill_fw_msg(\u0026fw_msg, (void *)\u0026req, sizeof(req), (void *)\u0026resp,\ndrivers/infiniband/hw/bng_re/bng_dev.c-180-\t\t\t   sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-188-\ndrivers/infiniband/hw/bng_re/bng_dev.c:189:static int bng_re_stats_ctx_alloc(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-190-{\ndrivers/infiniband/hw/bng_re/bng_dev.c-191-\tstruct bnge_auxr_dev *aux_dev = rdev-\u003eaux_dev;\ndrivers/infiniband/hw/bng_re/bng_dev.c:192:\tstruct bng_re_stats *stats = \u0026rdev-\u003estats_ctx;\ndrivers/infiniband/hw/bng_re/bng_dev.c-193-\tstruct hwrm_stat_ctx_alloc_output resp = {};\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-199-\ndrivers/infiniband/hw/bng_re/bng_dev.c:200:\tbng_re_init_hwrm_hdr((void *)\u0026req, HWRM_STAT_CTX_ALLOC);\ndrivers/infiniband/hw/bng_re/bng_dev.c-201-\treq.update_period_ms = cpu_to_le32(1000);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-204-\treq.stat_ctx_flags = STAT_CTX_ALLOC_REQ_STAT_CTX_FLAGS_ROCE;\ndrivers/infiniband/hw/bng_re/bng_dev.c:205:\tbng_re_fill_fw_msg(\u0026fw_msg, (void *)\u0026req, sizeof(req), (void *)\u0026resp,\ndrivers/infiniband/hw/bng_re/bng_dev.c-206-\t\t\t   sizeof(resp), BNGE_DFLT_HWRM_CMD_TIMEOUT);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-212-\ndrivers/infiniband/hw/bng_re/bng_dev.c:213:static int bng_re_query_hwrm_version(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-214-{\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-217-\tstruct hwrm_ver_get_input ver_get_req = {};\ndrivers/infiniband/hw/bng_re/bng_dev.c:218:\tstruct bng_re_chip_ctx *cctx;\ndrivers/infiniband/hw/bng_re/bng_dev.c-219-\tstruct bnge_fw_msg fw_msg = {};\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-221-\ndrivers/infiniband/hw/bng_re/bng_dev.c:222:\tbng_re_init_hwrm_hdr((void *)\u0026ver_get_req, HWRM_VER_GET);\ndrivers/infiniband/hw/bng_re/bng_dev.c-223-\tver_get_req.hwrm_intf_maj = HWRM_VERSION_MAJOR;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-225-\tver_get_req.hwrm_intf_upd = HWRM_VERSION_UPDATE;\ndrivers/infiniband/hw/bng_re/bng_dev.c:226:\tbng_re_fill_fw_msg(\u0026fw_msg, (void *)\u0026ver_get_req, sizeof(ver_get_req),\ndrivers/infiniband/hw/bng_re/bng_dev.c-227-\t\t\t    (void *)\u0026ver_get_resp, sizeof(ver_get_resp),\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-250-\ndrivers/infiniband/hw/bng_re/bng_dev.c:251:static void bng_re_dev_uninit(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-252-{\ndrivers/infiniband/hw/bng_re/bng_dev.c-253-\tint rc;\ndrivers/infiniband/hw/bng_re/bng_dev.c:254:\tbng_re_debugfs_rem_pdev(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-255-\ndrivers/infiniband/hw/bng_re/bng_dev.c-256-\tif (test_and_clear_bit(BNG_RE_FLAG_RCFW_CHANNEL_EN, \u0026rdev-\u003eflags)) {\ndrivers/infiniband/hw/bng_re/bng_dev.c:257:\t\trc = bng_re_deinit_rcfw(\u0026rdev-\u003ercfw);\ndrivers/infiniband/hw/bng_re/bng_dev.c-258-\t\tif (rc)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-260-\t\t\t\t   \"Failed to deinitialize RCFW: %#x\", rc);\ndrivers/infiniband/hw/bng_re/bng_dev.c:261:\t\tbng_re_stats_ctx_free(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c:262:\t\tbng_re_free_stats_ctx_mem(rdev-\u003ebng_res.pdev, \u0026rdev-\u003estats_ctx);\ndrivers/infiniband/hw/bng_re/bng_dev.c:263:\t\tbng_re_disable_rcfw_channel(\u0026rdev-\u003ercfw);\ndrivers/infiniband/hw/bng_re/bng_dev.c:264:\t\tbng_re_net_ring_free(rdev, rdev-\u003ercfw.creq.ring_id,\ndrivers/infiniband/hw/bng_re/bng_dev.c-265-\t\t\t     RING_ALLOC_REQ_RING_TYPE_NQ);\ndrivers/infiniband/hw/bng_re/bng_dev.c:266:\t\tbng_re_free_rcfw_channel(\u0026rdev-\u003ercfw);\ndrivers/infiniband/hw/bng_re/bng_dev.c-267-\t}\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-270-\trdev-\u003enqr = NULL;\ndrivers/infiniband/hw/bng_re/bng_dev.c:271:\tbng_re_destroy_chip_ctx(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-272-\tif (test_and_clear_bit(BNG_RE_FLAG_NETDEV_REGISTERED, \u0026rdev-\u003eflags))\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-275-\ndrivers/infiniband/hw/bng_re/bng_dev.c:276:static int bng_re_dev_init(struct bng_re_dev *rdev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-277-{\ndrivers/infiniband/hw/bng_re/bng_dev.c:278:\tstruct bng_re_ring_attr rattr = {};\ndrivers/infiniband/hw/bng_re/bng_dev.c:279:\tstruct bng_re_creq_ctx *creq;\ndrivers/infiniband/hw/bng_re/bng_dev.c-280-\tu32 db_offt;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-285-\t/* Registered a new RoCE device instance to netdev */\ndrivers/infiniband/hw/bng_re/bng_dev.c:286:\trc = bng_re_register_netdev(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-287-\tif (rc) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-304-\ndrivers/infiniband/hw/bng_re/bng_dev.c:305:\trc = bng_re_setup_chip_ctx(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-306-\tif (rc) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-310-\ndrivers/infiniband/hw/bng_re/bng_dev.c:311:\trc = bng_re_query_hwrm_version(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-312-\tif (rc)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-314-\ndrivers/infiniband/hw/bng_re/bng_dev.c:315:\trc = bng_re_alloc_fw_channel(\u0026rdev-\u003ebng_res, \u0026rdev-\u003ercfw);\ndrivers/infiniband/hw/bng_re/bng_dev.c-316-\tif (rc) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-340-\trattr.lrid = rdev-\u003enqr-\u003emsix_entries[BNG_RE_CREQ_NQ_IDX].ring_idx;\ndrivers/infiniband/hw/bng_re/bng_dev.c:341:\trc = bng_re_net_ring_alloc(rdev, \u0026rattr, \u0026creq-\u003ering_id);\ndrivers/infiniband/hw/bng_re/bng_dev.c-342-\tif (rc) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-348-\ndrivers/infiniband/hw/bng_re/bng_dev.c:349:\trc = bng_re_enable_fw_channel(\u0026rdev-\u003ercfw,\ndrivers/infiniband/hw/bng_re/bng_dev.c-350-\t\t\t\t\tvid, db_offt);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-356-\ndrivers/infiniband/hw/bng_re/bng_dev.c:357:\trc = bng_re_get_dev_attr(\u0026rdev-\u003ercfw);\ndrivers/infiniband/hw/bng_re/bng_dev.c-358-\tif (rc)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-360-\ndrivers/infiniband/hw/bng_re/bng_dev.c:361:\tbng_re_debugfs_add_pdev(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c:362:\trc = bng_re_alloc_stats_ctx_mem(rdev-\u003ebng_res.pdev, rdev-\u003echip_ctx,\ndrivers/infiniband/hw/bng_re/bng_dev.c-363-\t\t\t\t\t\u0026rdev-\u003estats_ctx);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-369-\ndrivers/infiniband/hw/bng_re/bng_dev.c:370:\trc = bng_re_stats_ctx_alloc(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-371-\tif (rc) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-376-\ndrivers/infiniband/hw/bng_re/bng_dev.c:377:\trc = bng_re_init_rcfw(\u0026rdev-\u003ercfw, \u0026rdev-\u003estats_ctx);\ndrivers/infiniband/hw/bng_re/bng_dev.c-378-\tif (rc) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-386-free_sctx:\ndrivers/infiniband/hw/bng_re/bng_dev.c:387:\tbng_re_stats_ctx_free(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-388-free_stats_ctx:\ndrivers/infiniband/hw/bng_re/bng_dev.c:389:\tbng_re_free_stats_ctx_mem(rdev-\u003ebng_res.pdev, \u0026rdev-\u003estats_ctx);\ndrivers/infiniband/hw/bng_re/bng_dev.c-390-disable_rcfw:\ndrivers/infiniband/hw/bng_re/bng_dev.c:391:\tbng_re_disable_rcfw_channel(\u0026rdev-\u003ercfw);\ndrivers/infiniband/hw/bng_re/bng_dev.c-392-free_ring:\ndrivers/infiniband/hw/bng_re/bng_dev.c:393:\tbng_re_net_ring_free(rdev, rdev-\u003ercfw.creq.ring_id, type);\ndrivers/infiniband/hw/bng_re/bng_dev.c-394-free_rcfw:\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-396-nq_alloc_fail:\ndrivers/infiniband/hw/bng_re/bng_dev.c:397:\tbng_re_free_rcfw_channel(\u0026rdev-\u003ercfw);\ndrivers/infiniband/hw/bng_re/bng_dev.c-398-destroy_chip_ctx:\ndrivers/infiniband/hw/bng_re/bng_dev.c:399:\tbng_re_destroy_chip_ctx(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-400-msix_ctx_fail:\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-406-\ndrivers/infiniband/hw/bng_re/bng_dev.c:407:static int bng_re_add_device(struct auxiliary_device *adev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-408-{\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-410-\t\tcontainer_of(adev, struct bnge_auxr_priv, aux_dev);\ndrivers/infiniband/hw/bng_re/bng_dev.c:411:\tstruct bng_re_en_dev_info *dev_info;\ndrivers/infiniband/hw/bng_re/bng_dev.c:412:\tstruct bng_re_dev *rdev;\ndrivers/infiniband/hw/bng_re/bng_dev.c-413-\tint rc;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-416-\ndrivers/infiniband/hw/bng_re/bng_dev.c:417:\trdev = bng_re_dev_add(adev, auxr_priv-\u003eauxr_dev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-418-\tif (!rdev) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-424-\ndrivers/infiniband/hw/bng_re/bng_dev.c:425:\trc = bng_re_dev_init(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-426-\tif (rc)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-437-\ndrivers/infiniband/hw/bng_re/bng_dev.c:438:static void bng_re_remove_device(struct bng_re_dev *rdev,\ndrivers/infiniband/hw/bng_re/bng_dev.c-439-\t\t\t\t struct auxiliary_device *aux_dev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-440-{\ndrivers/infiniband/hw/bng_re/bng_dev.c:441:\tbng_re_dev_uninit(rdev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-442-\tib_dealloc_device(\u0026rdev-\u003eibdev);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-445-\ndrivers/infiniband/hw/bng_re/bng_dev.c:446:static int bng_re_probe(struct auxiliary_device *adev,\ndrivers/infiniband/hw/bng_re/bng_dev.c-447-\t\t\tconst struct auxiliary_device_id *id)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-450-\t\tcontainer_of(adev, struct bnge_auxr_priv, aux_dev);\ndrivers/infiniband/hw/bng_re/bng_dev.c:451:\tstruct bng_re_en_dev_info *en_info;\ndrivers/infiniband/hw/bng_re/bng_dev.c-452-\tint rc;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-461-\ndrivers/infiniband/hw/bng_re/bng_dev.c:462:\trc = bng_re_add_device(adev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-463-\tif (rc)\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-468-\ndrivers/infiniband/hw/bng_re/bng_dev.c:469:static void bng_re_remove(struct auxiliary_device *adev)\ndrivers/infiniband/hw/bng_re/bng_dev.c-470-{\ndrivers/infiniband/hw/bng_re/bng_dev.c:471:\tstruct bng_re_en_dev_info *dev_info = auxiliary_get_drvdata(adev);\ndrivers/infiniband/hw/bng_re/bng_dev.c:472:\tstruct bng_re_dev *rdev;\ndrivers/infiniband/hw/bng_re/bng_dev.c-473-\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-475-\ndrivers/infiniband/hw/bng_re/bng_dev.c:476:\tbng_re_remove_device(rdev, adev);\ndrivers/infiniband/hw/bng_re/bng_dev.c-477-\tkfree(dev_info);\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-479-\ndrivers/infiniband/hw/bng_re/bng_dev.c:480:static const struct auxiliary_device_id bng_re_id_table[] = {\ndrivers/infiniband/hw/bng_re/bng_dev.c-481-\t{ .name = BNG_RE_ADEV_NAME \".rdma\", },\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-484-\ndrivers/infiniband/hw/bng_re/bng_dev.c:485:MODULE_DEVICE_TABLE(auxiliary, bng_re_id_table);\ndrivers/infiniband/hw/bng_re/bng_dev.c-486-\ndrivers/infiniband/hw/bng_re/bng_dev.c:487:static struct auxiliary_driver bng_re_driver = {\ndrivers/infiniband/hw/bng_re/bng_dev.c-488-\t.name = \"rdma\",\ndrivers/infiniband/hw/bng_re/bng_dev.c:489:\t.probe = bng_re_probe,\ndrivers/infiniband/hw/bng_re/bng_dev.c:490:\t.remove = bng_re_remove,\ndrivers/infiniband/hw/bng_re/bng_dev.c:491:\t.id_table = bng_re_id_table,\ndrivers/infiniband/hw/bng_re/bng_dev.c-492-};\ndrivers/infiniband/hw/bng_re/bng_dev.c-493-\ndrivers/infiniband/hw/bng_re/bng_dev.c:494:static int __init bng_re_mod_init(void)\ndrivers/infiniband/hw/bng_re/bng_dev.c-495-{\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-498-\ndrivers/infiniband/hw/bng_re/bng_dev.c:499:\tbng_re_register_debugfs();\ndrivers/infiniband/hw/bng_re/bng_dev.c-500-\ndrivers/infiniband/hw/bng_re/bng_dev.c:501:\trc = auxiliary_driver_register(\u0026bng_re_driver);\ndrivers/infiniband/hw/bng_re/bng_dev.c-502-\tif (rc) {\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-508-unreg_debugfs:\ndrivers/infiniband/hw/bng_re/bng_dev.c:509:\tbng_re_unregister_debugfs();\ndrivers/infiniband/hw/bng_re/bng_dev.c-510-\treturn rc;\n--\ndrivers/infiniband/hw/bng_re/bng_dev.c-512-\ndrivers/infiniband/hw/bng_re/bng_dev.c:513:static void __exit bng_re_mod_exit(void)\ndrivers/infiniband/hw/bng_re/bng_dev.c-514-{\ndrivers/infiniband/hw/bng_re/bng_dev.c:515:\tauxiliary_driver_unregister(\u0026bng_re_driver);\ndrivers/infiniband/hw/bng_re/bng_dev.c:516:\tbng_re_unregister_debugfs();\ndrivers/infiniband/hw/bng_re/bng_dev.c-517-}\ndrivers/infiniband/hw/bng_re/bng_dev.c-518-\ndrivers/infiniband/hw/bng_re/bng_dev.c:519:module_init(bng_re_mod_init);\ndrivers/infiniband/hw/bng_re/bng_dev.c:520:module_exit(bng_re_mod_exit);\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-5-#include \"bng_roce_hsi.h\"\ndrivers/infiniband/hw/bng_re/bng_fw.c:6:#include \"bng_res.h\"\ndrivers/infiniband/hw/bng_re/bng_fw.c-7-#include \"bng_fw.h\"\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-10-/**\ndrivers/infiniband/hw/bng_re/bng_fw.c:11: * bng_re_map_rc  -  map return type based on opcode\ndrivers/infiniband/hw/bng_re/bng_fw.c-12- * @opcode:  roce slow path opcode\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-32- */\ndrivers/infiniband/hw/bng_re/bng_fw.c:33:static int bng_re_map_rc(u8 opcode)\ndrivers/infiniband/hw/bng_re/bng_fw.c-34-{\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-52-\ndrivers/infiniband/hw/bng_re/bng_fw.c:53:void bng_re_free_rcfw_channel(struct bng_re_rcfw *rcfw)\ndrivers/infiniband/hw/bng_re/bng_fw.c-54-{\ndrivers/infiniband/hw/bng_re/bng_fw.c-55-\tkfree(rcfw-\u003ecrsqe_tbl);\ndrivers/infiniband/hw/bng_re/bng_fw.c:56:\tbng_re_free_hwq(rcfw-\u003eres, \u0026rcfw-\u003ecmdq.hwq);\ndrivers/infiniband/hw/bng_re/bng_fw.c:57:\tbng_re_free_hwq(rcfw-\u003eres, \u0026rcfw-\u003ecreq.hwq);\ndrivers/infiniband/hw/bng_re/bng_fw.c-58-\trcfw-\u003epdev = NULL;\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-60-\ndrivers/infiniband/hw/bng_re/bng_fw.c:61:int bng_re_alloc_fw_channel(struct bng_re_res *res,\ndrivers/infiniband/hw/bng_re/bng_fw.c:62:\t\t\t    struct bng_re_rcfw *rcfw)\ndrivers/infiniband/hw/bng_re/bng_fw.c-63-{\ndrivers/infiniband/hw/bng_re/bng_fw.c:64:\tstruct bng_re_hwq_attr hwq_attr = {};\ndrivers/infiniband/hw/bng_re/bng_fw.c:65:\tstruct bng_re_sg_info sginfo = {};\ndrivers/infiniband/hw/bng_re/bng_fw.c:66:\tstruct bng_re_cmdq_ctx *cmdq;\ndrivers/infiniband/hw/bng_re/bng_fw.c:67:\tstruct bng_re_creq_ctx *creq;\ndrivers/infiniband/hw/bng_re/bng_fw.c-68-\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-82-\ndrivers/infiniband/hw/bng_re/bng_fw.c:83:\tif (bng_re_alloc_init_hwq(\u0026creq-\u003ehwq, \u0026hwq_attr)) {\ndrivers/infiniband/hw/bng_re/bng_fw.c-84-\t\tdev_err(\u0026rcfw-\u003epdev-\u003edev,\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-94-\thwq_attr.type = BNG_HWQ_TYPE_CTX;\ndrivers/infiniband/hw/bng_re/bng_fw.c:95:\tif (bng_re_alloc_init_hwq(\u0026cmdq-\u003ehwq, \u0026hwq_attr)) {\ndrivers/infiniband/hw/bng_re/bng_fw.c-96-\t\tdev_err(\u0026rcfw-\u003epdev-\u003edev,\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-110-fail:\ndrivers/infiniband/hw/bng_re/bng_fw.c:111:\tbng_re_free_rcfw_channel(rcfw);\ndrivers/infiniband/hw/bng_re/bng_fw.c-112-\treturn -ENOMEM;\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-114-\ndrivers/infiniband/hw/bng_re/bng_fw.c:115:static int bng_re_process_qp_event(struct bng_re_rcfw *rcfw,\ndrivers/infiniband/hw/bng_re/bng_fw.c-116-\t\t\t\t   struct creq_qp_event *qp_event,\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-118-{\ndrivers/infiniband/hw/bng_re/bng_fw.c:119:\tstruct bng_re_hwq *hwq = \u0026rcfw-\u003ecmdq.hwq;\ndrivers/infiniband/hw/bng_re/bng_fw.c:120:\tstruct bng_re_crsqe *crsqe;\ndrivers/infiniband/hw/bng_re/bng_fw.c-121-\tu32 req_size;\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-187-/* function events */\ndrivers/infiniband/hw/bng_re/bng_fw.c:188:static int bng_re_process_func_event(struct bng_re_rcfw *rcfw,\ndrivers/infiniband/hw/bng_re/bng_fw.c-189-\t\t\t\t     struct creq_func_event *func_event)\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-213-/* CREQ Completion handlers */\ndrivers/infiniband/hw/bng_re/bng_fw.c:214:static void bng_re_service_creq(struct tasklet_struct *t)\ndrivers/infiniband/hw/bng_re/bng_fw.c-215-{\ndrivers/infiniband/hw/bng_re/bng_fw.c:216:\tstruct bng_re_rcfw *rcfw = from_tasklet(rcfw, t, creq.creq_tasklet);\ndrivers/infiniband/hw/bng_re/bng_fw.c:217:\tstruct bng_re_creq_ctx *creq = \u0026rcfw-\u003ecreq;\ndrivers/infiniband/hw/bng_re/bng_fw.c-218-\tu32 type, budget = BNG_FW_CREQ_ENTRY_POLL_BUDGET;\ndrivers/infiniband/hw/bng_re/bng_fw.c:219:\tstruct bng_re_hwq *hwq = \u0026creq-\u003ehwq;\ndrivers/infiniband/hw/bng_re/bng_fw.c-220-\tstruct creq_base *creqe;\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-226-\twhile (budget \u003e 0) {\ndrivers/infiniband/hw/bng_re/bng_fw.c:227:\t\tcreqe = bng_re_get_qe(hwq, hwq-\u003econs, NULL);\ndrivers/infiniband/hw/bng_re/bng_fw.c-228-\t\tif (!BNG_FW_CREQ_CMP_VALID(creqe, creq-\u003ecreq_db.dbinfo.flags))\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-237-\t\tcase CREQ_BASE_TYPE_QP_EVENT:\ndrivers/infiniband/hw/bng_re/bng_fw.c:238:\t\t\tbng_re_process_qp_event\ndrivers/infiniband/hw/bng_re/bng_fw.c-239-\t\t\t\t(rcfw, (struct creq_qp_event *)creqe,\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-243-\t\tcase CREQ_BASE_TYPE_FUNC_EVENT:\ndrivers/infiniband/hw/bng_re/bng_fw.c:244:\t\t\tif (!bng_re_process_func_event\ndrivers/infiniband/hw/bng_re/bng_fw.c-245-\t\t\t    (rcfw, (struct creq_func_event *)creqe))\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-259-\t\thw_polled++;\ndrivers/infiniband/hw/bng_re/bng_fw.c:260:\t\tbng_re_hwq_incr_cons(hwq-\u003emax_elements, \u0026hwq-\u003econs,\ndrivers/infiniband/hw/bng_re/bng_fw.c-261-\t\t\t\t     1, \u0026creq-\u003ecreq_db.dbinfo.flags);\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-264-\tif (hw_polled)\ndrivers/infiniband/hw/bng_re/bng_fw.c:265:\t\tbng_re_ring_nq_db(\u0026creq-\u003ecreq_db.dbinfo,\ndrivers/infiniband/hw/bng_re/bng_fw.c-266-\t\t\t\t  rcfw-\u003eres-\u003ecctx, true);\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-271-\ndrivers/infiniband/hw/bng_re/bng_fw.c:272:static int __send_message_basic_sanity(struct bng_re_rcfw *rcfw,\ndrivers/infiniband/hw/bng_re/bng_fw.c:273:\t\t\t\t       struct bng_re_cmdqmsg *msg,\ndrivers/infiniband/hw/bng_re/bng_fw.c-274-\t\t\t\t       u8 opcode)\ndrivers/infiniband/hw/bng_re/bng_fw.c-275-{\ndrivers/infiniband/hw/bng_re/bng_fw.c:276:\tstruct bng_re_cmdq_ctx *cmdq;\ndrivers/infiniband/hw/bng_re/bng_fw.c-277-\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-301-\ndrivers/infiniband/hw/bng_re/bng_fw.c:302:static int __send_message(struct bng_re_rcfw *rcfw,\ndrivers/infiniband/hw/bng_re/bng_fw.c:303:\t\t\t  struct bng_re_cmdqmsg *msg, u8 opcode)\ndrivers/infiniband/hw/bng_re/bng_fw.c-304-{\ndrivers/infiniband/hw/bng_re/bng_fw.c-305-\tu32 bsize, free_slots, required_slots;\ndrivers/infiniband/hw/bng_re/bng_fw.c:306:\tstruct bng_re_cmdq_ctx *cmdq;\ndrivers/infiniband/hw/bng_re/bng_fw.c:307:\tstruct bng_re_crsqe *crsqe;\ndrivers/infiniband/hw/bng_re/bng_fw.c-308-\tstruct bng_fw_cmdqe *cmdqe;\ndrivers/infiniband/hw/bng_re/bng_fw.c:309:\tstruct bng_re_hwq *hwq;\ndrivers/infiniband/hw/bng_re/bng_fw.c-310-\tu32 sw_prod, cmdq_prod;\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-322-\tspin_lock_bh(\u0026hwq-\u003elock);\ndrivers/infiniband/hw/bng_re/bng_fw.c:323:\trequired_slots = bng_re_get_cmd_slots(msg-\u003ereq);\ndrivers/infiniband/hw/bng_re/bng_fw.c-324-\tfree_slots = HWQ_FREE_SLOTS(hwq);\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-336-\ndrivers/infiniband/hw/bng_re/bng_fw.c:337:\tbsize = bng_re_set_cmd_slots(msg-\u003ereq);\ndrivers/infiniband/hw/bng_re/bng_fw.c-338-\tcrsqe-\u003efree_slots = free_slots;\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-345-\tif (__get_cmdq_base_resp_size(msg-\u003ereq, msg-\u003ereq_sz) \u0026\u0026 msg-\u003esb) {\ndrivers/infiniband/hw/bng_re/bng_fw.c:346:\t\tstruct bng_re_rcfw_sbuf *sbuf = msg-\u003esb;\ndrivers/infiniband/hw/bng_re/bng_fw.c-347-\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-359-\t\tsw_prod = HWQ_CMP(hwq-\u003eprod, hwq);\ndrivers/infiniband/hw/bng_re/bng_fw.c:360:\t\tcmdqe = bng_re_get_qe(hwq, sw_prod, NULL);\ndrivers/infiniband/hw/bng_re/bng_fw.c-361-\t\t/* Copy a segment of the req cmd to the cmdq */\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-399- */\ndrivers/infiniband/hw/bng_re/bng_fw.c:400:static int __wait_for_resp(struct bng_re_rcfw *rcfw, u16 cookie)\ndrivers/infiniband/hw/bng_re/bng_fw.c-401-{\ndrivers/infiniband/hw/bng_re/bng_fw.c:402:\tstruct bng_re_cmdq_ctx *cmdq;\ndrivers/infiniband/hw/bng_re/bng_fw.c:403:\tstruct bng_re_crsqe *crsqe;\ndrivers/infiniband/hw/bng_re/bng_fw.c-404-\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-415-\ndrivers/infiniband/hw/bng_re/bng_fw.c:416:\t\tbng_re_service_creq(\u0026rcfw-\u003ecreq.creq_tasklet);\ndrivers/infiniband/hw/bng_re/bng_fw.c-417-\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-423-/**\ndrivers/infiniband/hw/bng_re/bng_fw.c:424: * bng_re_rcfw_send_message   -\tinterface to send\ndrivers/infiniband/hw/bng_re/bng_fw.c-425- * and complete rcfw command.\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-435- */\ndrivers/infiniband/hw/bng_re/bng_fw.c:436:int bng_re_rcfw_send_message(struct bng_re_rcfw *rcfw,\ndrivers/infiniband/hw/bng_re/bng_fw.c:437:\t\t\t     struct bng_re_cmdqmsg *msg)\ndrivers/infiniband/hw/bng_re/bng_fw.c-438-{\ndrivers/infiniband/hw/bng_re/bng_fw.c-439-\tstruct creq_qp_event *evnt = (struct creq_qp_event *)msg-\u003eresp;\ndrivers/infiniband/hw/bng_re/bng_fw.c:440:\tstruct bng_re_crsqe *crsqe;\ndrivers/infiniband/hw/bng_re/bng_fw.c-441-\tu16 cookie;\n--\ndrivers/infiniband/hw/bng_re/bng_fw.c-448-\tif (rc)\ndrivers/infiniband/hw/bng_re/bng_fw.c:449:\t\treturn rc == -ENXIO ? bng_re_map_rc(opcode) : rc;\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 38596
							output: 33
							thoughts: 2766
						

**Analysis of Potential Fuzzing Reachability for Broadcom BNGE Driver Changes**

Okay, I'm looking at a patch that modifies the Broadcom `BNGE` driver, specifically focusing on the `CONFIG_INFINIBAND_BNG_RE` configuration. The changes involve modifying how ring IDs are handled (from `u16` to `u32`) in ring allocation and freeing functions, both within the `bnge_dev.c` and `bnge_hwrm_lib.c` files. I need to determine if these code paths are reachable within a fuzzing context like QEMU.

Initially, I identified `CONFIG_INFINIBAND_BNG_RE` as the relevant config and the patch changes. My first instinct was to check whether this is a real config.

The crucial point here is whether the driver, `bnge`, which seems to be a real PCI driver (confirmed by the `bnge_pci_tbl` entries with a real PCI device ID) can be fuzzed. It's not a standard practice to fuzz PCI drivers without some form of device emulation. The question is whether syzkaller's capabilities are sufficient, given the prompt. Syzkaller has PCI device emulation, so it seems like I *can* reach these code paths.

I also considered whether it is a syzkaller's mock driver, but confirmed with the commit author that this is an existing driver in the kernel source.

Focusing on the changed functions, namely `bng_re_net_ring_free`, `bng_re_net_ring_alloc`, `hwrm_ring_free_send_msg`, and `hwrm_ring_alloc_send_msg`, and several more functions related to ring allocation and deallocation in `bnge_netdev.c`, I determined that these all relate to ring allocation and release and HWRM messaging in the driver.

Therefore, since syzkaller *does* have PCI fuzzing support with software-emulated PCI devices, which would involve injection of PCI config space, MMIO, and the like, and the fact that `bnge` seems to be a real PCI driver that can potentially be reached with syzkaller, I would conclude that the code paths are reachable in QEMU with syzkaller. The necessary configuration options are `BNGE` and `INFINIBAND_BNG_RE`.

{
  "Expression": "config BNGE",
  "PathPrefix": "drivers/net/ethernet/broadcom/"
}

{
  "Output": "drivers/net/ethernet/broadcom/Kconfig=250=config BNXT_HWMON\n--\ndrivers/net/ethernet/broadcom/Kconfig-257-\ndrivers/net/ethernet/broadcom/Kconfig:258:config BNGE\ndrivers/net/ethernet/broadcom/Kconfig-259-\ttristate \"Broadcom ThorUltra Ethernet device support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 42013
							output: 35
							thoughts: 45
						

Okay, here's my quick assessment of this configuration scenario:

**Initial Configuration Assessment**

Alright, so `BNGE` is definitely a valid configuration item, and `INFINIBAND_BNG_RE` is also present. Seems straightforward enough at first glance. The next logical step, before I go any further, is to determine if `BNGE` has any specific dependencies. Knowing what `BNGE` relies upon is crucial for understanding its role and potential impact within the overall system. Time to dig a bit deeper.

{
  "Expression": "config BNGE",
  "PathPrefix": "drivers/net/ethernet/broadcom/Kconfig"
}

{
  "Output": "drivers/net/ethernet/broadcom/Kconfig=250=config BNXT_HWMON\n--\ndrivers/net/ethernet/broadcom/Kconfig-257-\ndrivers/net/ethernet/broadcom/Kconfig:258:config BNGE\ndrivers/net/ethernet/broadcom/Kconfig-259-\ttristate \"Broadcom ThorUltra Ethernet device support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 42312
							output: 35
							thoughts: 11
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the `BNGE` Dependencies**

Alright, let's dive in. My immediate thought is, "What's hooked into `BNGE`?" I need to understand its dependencies, its upstream and downstream relationships. I'm not just looking for a simple list; I want to see the *nature* of those dependencies. Are we talking direct function calls, shared data structures, message queues, external APIs, configuration files, or something else entirely? The type of dependency dictates the impact of any change to `BNGE`.

I need to understand what pieces of the system rely on it and, conversely, what it needs to function correctly. This is critical for impact analysis. I'm thinking about potential bottlenecks, single points of failure, and the implications of refactoring or, heaven forbid, removing `BNGE`. Are we dealing with a tight, potentially fragile coupling, or something more loosely coupled and robust?

My mental checklist is running: source code, documentation, any architectural diagrams... I'll need to use my usual tools to trace the calls, check for shared resources, and look for any unusual configurations that might indicate a hidden or complex dependency. Understanding the dependencies is the foundation for any further analysis or modification of this component. Time to roll up my sleeves and get to work.

{
  "Expression": "config BNGE",
  "PathPrefix": "drivers/net/ethernet/broadcom/Kconfig"
}

{
  "Output": "drivers/net/ethernet/broadcom/Kconfig=250=config BNXT_HWMON\n--\ndrivers/net/ethernet/broadcom/Kconfig-257-\ndrivers/net/ethernet/broadcom/Kconfig:258:config BNGE\ndrivers/net/ethernet/broadcom/Kconfig-259-\ttristate \"Broadcom ThorUltra Ethernet device support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 42752
							output: 35
							thoughts: 14
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing Configuration Dependencies**

Okay, hold on a minute. My initial assessment is incomplete. I jumped to a conclusion too quickly. The phrase `config BNGE` is a clear indicator that I'm dealing with a configuration setting related to a "BNGE" component or module. But that's just the starting point. To truly understand the implication, and to formulate a truly accurate assessment of the significance of this line within the broader context, I absolutely need to examine the subsequent lines of the configuration file or relevant code block. The dependency of `BNGE` on whatever comes after it is paramount. I need to understand the relationship between the `BNGE` configuration and its associated parameters, dependencies, or conditions. Is it a default setting? An override? An enabling flag? Without seeing what follows, I'm missing critical context and potentially overlooking subtle, yet vital, design decisions or potential configuration conflicts. The behavior of whatever "BNGE" is would be affected by the next line.

{
  "Expression": "config BNGE",
  "PathPrefix": "drivers/net/ethernet/broadcom/Kconfig"
}

{
  "Output": "drivers/net/ethernet/broadcom/Kconfig=250=config BNXT_HWMON\n--\ndrivers/net/ethernet/broadcom/Kconfig-257-\ndrivers/net/ethernet/broadcom/Kconfig:258:config BNGE\ndrivers/net/ethernet/broadcom/Kconfig-259-\ttristate \"Broadcom ThorUltra Ethernet device support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 43131
							output: 40
							thoughts: 17
						

Here's your summary:

**Considering File Analysis Options**

Okay, so I'm looking at this situation and my initial thought is, "Do I really need the full `grep` analysis here, or can I get away with a simpler method?" The `-A 10` option for `grep` is tempting, as it would provide some context around each match, but it's probably overkill for what I'm trying to achieve. I'm already pretty familiar with the data and, honestly, just reading the file itself might be the most efficient approach, especially if I can quickly identify the key sections I'm interested in without a lot of extra output cluttering things up. I'll need to weigh speed against completeness; given my expertise, a direct read is probably the smart move.

{
  "File": "drivers/net/ethernet/broadcom/Kconfig",
  "FirstLine": 250,
  "LineCount": 20
}

{
  "Contents": " 250:\tconfig BNXT_HWMON\n 251:\t\tbool \"Broadcom NetXtreme-C/E HWMON support\"\n 252:\t\tdefault y\n 253:\t\tdepends on BNXT \u0026\u0026 HWMON \u0026\u0026 !(BNXT=y \u0026\u0026 HWMON=m)\n 254:\t\thelp\n 255:\t\t  Say Y if you want to expose the thermal sensor data on NetXtreme-C/E\n 256:\t\t  devices, via the hwmon sysfs interface.\n 257:\t\n 258:\tconfig BNGE\n 259:\t\ttristate \"Broadcom ThorUltra Ethernet device support\"\n 260:\t\tdepends on PCI\n 261:\t\tselect NET_DEVLINK\n 262:\t\tselect PAGE_POOL\n 263:\t\tselect AUXILIARY_BUS\n 264:\t\thelp\n 265:\t\t  This driver supports Broadcom ThorUltra 50/100/200/400/800 gigabit\n 266:\t\t  Ethernet cards. The module will be called bng_en. To compile this\n 267:\t\t  driver as a module, choose M here.\n 268:\t\n 269:\tconfig BCMASP\n"
}

gemini-3.1-pro-preview

null

null

							input: 43681
							output: 42
							thoughts: 51
						

Here's my thought process, distilled:

**Dependency Deep Dive**

Alright, I need to understand this module's dependencies. The crucial point seems to be that `BNGE` relies on `PCI`. That makes sense; it's likely a hardware abstraction. And now, I see that `INFINIBAND_BNG_RE` is built on top of `BNGE`. Given the Infiniband context, that's not surprising. To understand the whole picture, I should check the Kconfig file for the bng_re driver – specifically, let's look at `drivers/infiniband/hw/bng_re/Kconfig`. That's where the conditional compilation and dependencies will be clearly spelled out.

{
  "File": "drivers/infiniband/hw/bng_re/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tconfig INFINIBAND_BNG_RE\n   3:\t\ttristate \"Broadcom Next generation RoCE HCA support\"\n   4:\t\tdepends on 64BIT\n   5:\t\tdepends on INET \u0026\u0026 DCB \u0026\u0026 BNGE\n   6:\t\thelp\n   7:\t\t  This driver supports Broadcom Next generation\n   8:\t\t  50/100/200/400/800 gigabit RoCE HCAs. The module\n   9:\t\t  will be called bng_re. To compile this driver\n  10:\t\t  as a module, choose M here.\n"
}

gemini-3.1-pro-preview

null

null

							input: 44106
							output: 282
							thoughts: 1002
						

**Analyzing the Infiniband BNG RE Driver for Fuzzing**

Okay, so `INFINIBAND_BNG_RE` has a few dependencies: `64BIT`, `INET`, `DCB`, and `BNGE`.  I need to make sure `BNGE` and `INFINIBAND_BNG_RE` are enabled.

Now, I need to pinpoint the critical functions.  Let's see: I've got `bng_re_net_ring_free`, `bng_re_net_ring_alloc`, `hwrm_ring_free_send_msg`, `hwrm_ring_alloc_send_msg`, `bnge_hwrm_rx_agg_ring_alloc`, `bnge_hwrm_rx_ring_alloc`, `bnge_hwrm_ring_alloc`, `bnge_hwrm_rx_ring_free`, `bnge_hwrm_rx_agg_ring_free`, `bnge_hwrm_tx_ring_free`, `bnge_hwrm_cp_ring_free`, and `bnge_hwrm_ring_free`. Those are the core functions to focus on.

I should also note the other functions I spotted: `bnge_cp_ring_for_rx` and `bnge_cp_ring_for_tx`, which are just simple getters. Then there's the initialization routines: `bnge_init_nq_tree`, `bnge_init_one_rx_ring_rxbd`, `bnge_init_one_agg_ring_rxbd`, `bnge_init_tx_rings`, and `bnge_fill_hw_rss_tbl`.  Finally, there's `bnge_disable_int`, which is teardown. So, I don't need to focus on those, it is just those core functions.

Alright, so the key symbols are those allocation and free functions. Now, let's see where they're defined. Wait. `bnge_hwrm_ring_free` is static within `bnge_netdev.c`. I need to check if these symbols are static or exported to see if they can be fuzzed. `bng_re_net_ring_free` and `bng_re_net_ring_alloc` are static in `bng_dev.c`.  `hwrm_ring_free_send_msg` and `hwrm_ring_alloc_send_msg` are global in `bnge_hwrm_lib.c`.  `bnge_hwrm_rx_agg_ring_alloc`, `bnge_hwrm_rx_ring_alloc`, `bnge_hwrm_ring_alloc` are static in `bnge_netdev.c`. And `bnge_hwrm_rx_ring_free`, `bnge_hwrm_rx_agg_ring_free`, `bnge_hwrm_tx_ring_free`, `bnge_hwrm_cp_ring_free`, `bnge_hwrm_ring_free` are static within `bnge_netdev.c`.

Now, the question is, is this a worthwhile target for fuzzing? Absolutely.  This is a functional change within a driver, and drivers are prime targets.  Since the driver can be fuzzed using syzkaller's PCI emulation. I remember syzkaller *does* have PCI emulation.  The prompt mentions reaching code paths that are impossible in virtualized environments, but syzkaller's PCI emulation should bypass that constraint.

Let's quickly double-check the configuration requirements: `BNGE` and `INFINIBAND_BNG_RE` are definite, and I should also add `DCB` to the list because it's a dependency of `INFINIBAND_BNG_RE`.

Finally, let's look at the patch itself again. The patch changes the `fw_ring_id` from a `u16` to a `u32`. This is a *functional* change because it alters the ring ID size and how it's passed to the firmware. That's good, that's what I want.

Okay, I'm ready to set the results.

{
  "EnableConfigs": [
    "BNGE",
    "INFINIBAND_BNG_RE",
    "DCB"
  ],
  "FocusSymbols": [
    "bng_re_net_ring_free",
    "bng_re_net_ring_alloc",
    "hwrm_ring_free_send_msg",
    "hwrm_ring_alloc_send_msg",
    "bnge_hwrm_rx_agg_ring_alloc",
    "bnge_hwrm_rx_ring_alloc",
    "bnge_hwrm_ring_alloc",
    "bnge_hwrm_rx_ring_free",
    "bnge_hwrm_rx_agg_ring_free",
    "bnge_hwrm_tx_ring_free",
    "bnge_hwrm_cp_ring_free",
    "bnge_hwrm_ring_free"
  ],
  "Reasoning": "The patch modifies the Broadcom BNGE and BNG_RE drivers to support 32-bit firmware ring IDs instead of 16-bit. This is a functional change affecting the driver's interaction with the hardware/firmware during ring allocation and freeing. The driver can be tested via PCI emulation in virtualized environments.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BNGE",
    "INFINIBAND_BNG_RE",
    "DCB"
  ],
  "FocusSymbols": [
    "bng_re_net_ring_free",
    "bng_re_net_ring_alloc",
    "hwrm_ring_free_send_msg",
    "hwrm_ring_alloc_send_msg",
    "bnge_hwrm_rx_agg_ring_alloc",
    "bnge_hwrm_rx_ring_alloc",
    "bnge_hwrm_ring_alloc",
    "bnge_hwrm_rx_ring_free",
    "bnge_hwrm_rx_agg_ring_free",
    "bnge_hwrm_tx_ring_free",
    "bnge_hwrm_cp_ring_free",
    "bnge_hwrm_ring_free"
  ],
  "Reasoning": "The patch modifies the Broadcom BNGE and BNG_RE drivers to support 32-bit firmware ring IDs instead of 16-bit. This is a functional change affecting the driver's interaction with the hardware/firmware during ring allocation and freeing. The driver can be tested via PCI emulation in virtualized environments.",
  "WorthFuzzing": true
}