AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds CXL support to the Solarflare SFC9100-family network driver (sfc) and introduces a helper function in the CXL core for it. The sfc driver requires physical Solarflare PCI hardware which is not emulated in QEMU or other virtualized environments used by syzkaller. Therefore, the new code paths are impossible to reach and fuzz.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit aaa1416d9480e1425e487ca30f5b296374a1d628\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Jul 1 16:42:51 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/cxl/core/core.h b/drivers/cxl/core/core.h\nindex 07555ae6385940..f7cebb02655235 100644\n--- a/drivers/cxl/core/core.h\n+++ b/drivers/cxl/core/core.h\n@@ -101,6 +101,8 @@ void __iomem *devm_cxl_iomap_block(struct device *dev, resource_size_t addr,\n struct dentry *cxl_debugfs_create_dir(const char *dir);\n int cxl_dpa_set_part(struct cxl_endpoint_decoder *cxled,\n \t\t     enum cxl_partition_mode mode);\n+struct cxl_memdev_state;\n+int cxl_mem_get_partition_info(struct cxl_memdev_state *mds);\n int cxl_dpa_alloc(struct cxl_endpoint_decoder *cxled, u64 size);\n int cxl_dpa_free(struct cxl_endpoint_decoder *cxled);\n resource_size_t cxl_dpa_size(struct cxl_endpoint_decoder *cxled);\ndiff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c\nindex 7c6c5b7450a54a..97b1e61ad01877 100644\n--- a/drivers/cxl/core/mbox.c\n+++ b/drivers/cxl/core/mbox.c\n@@ -1152,7 +1152,7 @@ EXPORT_SYMBOL_NS_GPL(cxl_mem_get_event_records, \"CXL\");\n  *\n  * See CXL @8.2.9.5.2.1 Get Partition Info\n  */\n-static int cxl_mem_get_partition_info(struct cxl_memdev_state *mds)\n+int cxl_mem_get_partition_info(struct cxl_memdev_state *mds)\n {\n \tstruct cxl_mailbox *cxl_mbox = \u0026mds-\u003ecxlds.cxl_mbox;\n \tstruct cxl_mbox_get_partition_info pi;\n@@ -1308,55 +1308,6 @@ int cxl_mem_sanitize(struct cxl_memdev *cxlmd, u16 cmd)\n \treturn -EBUSY;\n }\n \n-static void add_part(struct cxl_dpa_info *info, u64 start, u64 size, enum cxl_partition_mode mode)\n-{\n-\tint i = info-\u003enr_partitions;\n-\n-\tif (size == 0)\n-\t\treturn;\n-\n-\tinfo-\u003epart[i].range = (struct range) {\n-\t\t.start = start,\n-\t\t.end = start + size - 1,\n-\t};\n-\tinfo-\u003epart[i].mode = mode;\n-\tinfo-\u003enr_partitions++;\n-}\n-\n-int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)\n-{\n-\tstruct cxl_dev_state *cxlds = \u0026mds-\u003ecxlds;\n-\tstruct device *dev = cxlds-\u003edev;\n-\tint rc;\n-\n-\tif (!cxlds-\u003emedia_ready) {\n-\t\tinfo-\u003esize = 0;\n-\t\treturn 0;\n-\t}\n-\n-\tinfo-\u003esize = mds-\u003etotal_bytes;\n-\n-\tif (mds-\u003epartition_align_bytes == 0) {\n-\t\tadd_part(info, 0, mds-\u003evolatile_only_bytes, CXL_PARTMODE_RAM);\n-\t\tadd_part(info, mds-\u003evolatile_only_bytes,\n-\t\t\t mds-\u003epersistent_only_bytes, CXL_PARTMODE_PMEM);\n-\t\treturn 0;\n-\t}\n-\n-\trc = cxl_mem_get_partition_info(mds);\n-\tif (rc) {\n-\t\tdev_err(dev, \"Failed to query partition information\\n\");\n-\t\treturn rc;\n-\t}\n-\n-\tadd_part(info, 0, mds-\u003eactive_volatile_bytes, CXL_PARTMODE_RAM);\n-\tadd_part(info, mds-\u003eactive_volatile_bytes, mds-\u003eactive_persistent_bytes,\n-\t\t CXL_PARTMODE_PMEM);\n-\n-\treturn 0;\n-}\n-EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, \"CXL\");\n-\n int cxl_get_dirty_count(struct cxl_memdev_state *mds, u32 *count)\n {\n \tstruct cxl_mailbox *cxl_mbox = \u0026mds-\u003ecxlds.cxl_mbox;\ndiff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c\nindex 33a3d2e7b13af9..2e457b1ebc7dfc 100644\n--- a/drivers/cxl/core/memdev.c\n+++ b/drivers/cxl/core/memdev.c\n@@ -594,6 +594,73 @@ bool is_cxl_memdev(const struct device *dev)\n }\n EXPORT_SYMBOL_NS_GPL(is_cxl_memdev, \"CXL\");\n \n+static void add_part(struct cxl_dpa_info *info, u64 start, u64 size, enum cxl_partition_mode mode)\n+{\n+\tint i = info-\u003enr_partitions;\n+\n+\tif (size == 0)\n+\t\treturn;\n+\n+\tinfo-\u003epart[i].range = (struct range) {\n+\t\t.start = start,\n+\t\t.end = start + size - 1,\n+\t};\n+\tinfo-\u003epart[i].mode = mode;\n+\tinfo-\u003enr_partitions++;\n+}\n+\n+int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)\n+{\n+\tstruct cxl_dev_state *cxlds = \u0026mds-\u003ecxlds;\n+\tstruct device *dev = cxlds-\u003edev;\n+\tint rc;\n+\n+\tif (!cxlds-\u003emedia_ready) {\n+\t\tinfo-\u003esize = 0;\n+\t\treturn 0;\n+\t}\n+\n+\tinfo-\u003esize = mds-\u003etotal_bytes;\n+\n+\tif (mds-\u003epartition_align_bytes == 0) {\n+\t\tadd_part(info, 0, mds-\u003evolatile_only_bytes, CXL_PARTMODE_RAM);\n+\t\tadd_part(info, mds-\u003evolatile_only_bytes,\n+\t\t\t mds-\u003epersistent_only_bytes, CXL_PARTMODE_PMEM);\n+\t\treturn 0;\n+\t}\n+\n+\trc = cxl_mem_get_partition_info(mds);\n+\tif (rc) {\n+\t\tdev_err(dev, \"Failed to query partition information\\n\");\n+\t\treturn rc;\n+\t}\n+\n+\tadd_part(info, 0, mds-\u003eactive_volatile_bytes, CXL_PARTMODE_RAM);\n+\tadd_part(info, mds-\u003eactive_volatile_bytes, mds-\u003eactive_persistent_bytes,\n+\t\t CXL_PARTMODE_PMEM);\n+\n+\treturn 0;\n+}\n+EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, \"CXL\");\n+\n+\n+/**\n+ * cxl_set_capacity: initialize dpa by a driver without a mailbox.\n+ *\n+ * @cxlds: pointer to cxl_dev_state\n+ * @capacity: device volatile memory size\n+ */\n+int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity)\n+{\n+\tstruct cxl_dpa_info range_info = {\n+\t\t.size = capacity,\n+\t};\n+\n+\tadd_part(\u0026range_info, 0, capacity, CXL_PARTMODE_RAM);\n+\treturn cxl_dpa_setup(cxlds, \u0026range_info);\n+}\n+EXPORT_SYMBOL_NS_GPL(cxl_set_capacity, \"CXL\");\n+\n /**\n  * set_exclusive_cxl_commands() - atomically disable user cxl commands\n  * @mds: The device state to operate on\ndiff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c\nindex e4338fd7e01b47..9d807c1a002ca9 100644\n--- a/drivers/cxl/core/pci.c\n+++ b/drivers/cxl/core/pci.c\n@@ -6,6 +6,7 @@\n #include \u003clinux/delay.h\u003e\n #include \u003clinux/pci.h\u003e\n #include \u003clinux/pci-doe.h\u003e\n+#include \u003ccxl/pci.h\u003e\n #include \u003clinux/aer.h\u003e\n #include \u003ccxlpci.h\u003e\n #include \u003ccxlmem.h\u003e\ndiff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c\nindex 1215ee4f40351b..cb633e19151b54 100644\n--- a/drivers/cxl/core/port.c\n+++ b/drivers/cxl/core/port.c\n@@ -11,6 +11,7 @@\n #include \u003clinux/idr.h\u003e\n #include \u003clinux/node.h\u003e\n #include \u003ccxl/einj.h\u003e\n+#include \u003ccxl/pci.h\u003e\n #include \u003ccxlmem.h\u003e\n #include \u003ccxlpci.h\u003e\n #include \u003ccxl.h\u003e\ndiff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c\nindex 93710cf4f0a697..20c2d9fbcfe7df 100644\n--- a/drivers/cxl/core/regs.c\n+++ b/drivers/cxl/core/regs.c\n@@ -4,6 +4,7 @@\n #include \u003clinux/device.h\u003e\n #include \u003clinux/slab.h\u003e\n #include \u003clinux/pci.h\u003e\n+#include \u003ccxl/pci.h\u003e\n #include \u003ccxlmem.h\u003e\n #include \u003ccxlpci.h\u003e\n #include \u003cpmu.h\u003e\ndiff --git a/drivers/cxl/cxlpci.h b/drivers/cxl/cxlpci.h\nindex b826eb53cf7bac..110ec9c44f09f1 100644\n--- a/drivers/cxl/cxlpci.h\n+++ b/drivers/cxl/cxlpci.h\n@@ -13,16 +13,6 @@\n  */\n #define CXL_PCI_DEFAULT_MAX_VECTORS 16\n \n-/* Register Block Identifier (RBI) */\n-enum cxl_regloc_type {\n-\tCXL_REGLOC_RBI_EMPTY = 0,\n-\tCXL_REGLOC_RBI_COMPONENT,\n-\tCXL_REGLOC_RBI_VIRT,\n-\tCXL_REGLOC_RBI_MEMDEV,\n-\tCXL_REGLOC_RBI_PMU,\n-\tCXL_REGLOC_RBI_TYPES\n-};\n-\n /*\n  * Table Access DOE, CDAT Read Entry Response\n  *\n@@ -112,6 +102,4 @@ static inline void devm_cxl_port_ras_setup(struct cxl_port *port)\n }\n #endif\n \n-int cxl_pci_setup_regs(struct pci_dev *pdev, enum cxl_regloc_type type,\n-\t\t       struct cxl_register_map *map);\n #endif /* __CXL_PCI_H__ */\ndiff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c\nindex 267c679b0b3c20..bb892dbfdd6d6f 100644\n--- a/drivers/cxl/pci.c\n+++ b/drivers/cxl/pci.c\n@@ -11,6 +11,7 @@\n #include \u003clinux/pci.h\u003e\n #include \u003clinux/aer.h\u003e\n #include \u003clinux/io.h\u003e\n+#include \u003ccxl/pci.h\u003e\n #include \u003ccxl/mailbox.h\u003e\n #include \"cxlmem.h\"\n #include \"cxlpci.h\"\ndiff --git a/drivers/net/ethernet/sfc/Kconfig b/drivers/net/ethernet/sfc/Kconfig\nindex c4c43434f31434..979f2801e2a8e3 100644\n--- a/drivers/net/ethernet/sfc/Kconfig\n+++ b/drivers/net/ethernet/sfc/Kconfig\n@@ -66,6 +66,15 @@ config SFC_MCDI_LOGGING\n \t  Driver-Interface) commands and responses, allowing debugging of\n \t  driver/firmware interaction.  The tracing is actually enabled by\n \t  a sysfs file 'mcdi_logging' under the PCI device.\n+config SFC_CXL\n+\tbool \"Solarflare SFC9100-family CXL support\"\n+\tdepends on SFC \u0026\u0026 CXL_BUS \u003e= SFC\n+\tdefault SFC\n+\thelp\n+\t  This enables SFC CXL support if the kernel is configuring CXL for\n+\t  using CTPIO with CXL.mem. The SFC device with CXL support and\n+\t  with a CXL-aware firmware can be used for minimizing latencies\n+\t  when sending through CTPIO.\n \n source \"drivers/net/ethernet/sfc/falcon/Kconfig\"\n source \"drivers/net/ethernet/sfc/siena/Kconfig\"\ndiff --git a/drivers/net/ethernet/sfc/Makefile b/drivers/net/ethernet/sfc/Makefile\nindex d99039ec468d67..bb0f1891cde653 100644\n--- a/drivers/net/ethernet/sfc/Makefile\n+++ b/drivers/net/ethernet/sfc/Makefile\n@@ -13,6 +13,7 @@ sfc-$(CONFIG_SFC_SRIOV)\t+= sriov.o ef10_sriov.o ef100_sriov.o ef100_rep.o \\\n                            mae.o tc.o tc_bindings.o tc_counters.o \\\n                            tc_encap_actions.o tc_conntrack.o\n \n+sfc-$(CONFIG_SFC_CXL)\t+= efx_cxl.o\n obj-$(CONFIG_SFC)\t+= sfc.o\n \n obj-$(CONFIG_SFC_FALCON) += falcon/\ndiff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c\nindex 7e04f115bbaaaf..73bc064929f639 100644\n--- a/drivers/net/ethernet/sfc/ef10.c\n+++ b/drivers/net/ethernet/sfc/ef10.c\n@@ -24,6 +24,7 @@\n #include \u003clinux/wait.h\u003e\n #include \u003clinux/workqueue.h\u003e\n #include \u003cnet/udp_tunnel.h\u003e\n+#include \"efx_cxl.h\"\n \n /* Hardware control for EF10 architecture including 'Huntington'. */\n \n@@ -106,7 +107,7 @@ static int efx_ef10_get_vf_index(struct efx_nic *efx)\n \n static int efx_ef10_init_datapath_caps(struct efx_nic *efx)\n {\n-\tMCDI_DECLARE_BUF(outbuf, MC_CMD_GET_CAPABILITIES_V4_OUT_LEN);\n+\tMCDI_DECLARE_BUF(outbuf, MC_CMD_GET_CAPABILITIES_V7_OUT_LEN);\n \tstruct efx_ef10_nic_data *nic_data = efx-\u003enic_data;\n \tsize_t outlen;\n \tint rc;\n@@ -177,6 +178,12 @@ static int efx_ef10_init_datapath_caps(struct efx_nic *efx)\n \t\t\t  efx-\u003enum_mac_stats);\n \t}\n \n+\tif (outlen \u003c MC_CMD_GET_CAPABILITIES_V7_OUT_LEN)\n+\t\tnic_data-\u003edatapath_caps3 = 0;\n+\telse\n+\t\tnic_data-\u003edatapath_caps3 = MCDI_DWORD(outbuf,\n+\t\t\t\t\t\t      GET_CAPABILITIES_V7_OUT_FLAGS3);\n+\n \treturn 0;\n }\n \n@@ -1140,6 +1147,9 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx)\n \tunsigned int channel_vis, pio_write_vi_base, max_vis;\n \tstruct efx_ef10_nic_data *nic_data = efx-\u003enic_data;\n \tunsigned int uc_mem_map_size, wc_mem_map_size;\n+#ifdef CONFIG_SFC_CXL\n+\tstruct efx_probe_data *probe_data;\n+#endif\n \tvoid __iomem *membase;\n \tint rc;\n \n@@ -1263,8 +1273,23 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx)\n \tiounmap(efx-\u003emembase);\n \tefx-\u003emembase = membase;\n \n-\t/* Set up the WC mapping if needed */\n-\tif (wc_mem_map_size) {\n+\tif (!wc_mem_map_size)\n+\t\tgoto skip_pio;\n+\n+\t/* Set up the WC mapping */\n+\n+#ifdef CONFIG_SFC_CXL\n+\tprobe_data = container_of(efx, struct efx_probe_data, efx);\n+\tif ((nic_data-\u003edatapath_caps3 \u0026\n+\t    (1 \u003c\u003c MC_CMD_GET_CAPABILITIES_V7_OUT_CXL_CONFIG_ENABLE_LBN)) \u0026\u0026\n+\t    probe_data-\u003ecxl_pio_initialised) {\n+\t\t/* Using PIO through CXL mapping */\n+\t\tnic_data-\u003epio_write_base = probe_data-\u003ecxl-\u003ectpio_cxl;\n+\t\tnic_data-\u003epio_write_vi_base = pio_write_vi_base;\n+\t} else\n+#endif\n+\t{\n+\t\t/* Using legacy PIO BAR mapping */\n \t\tnic_data-\u003ewc_membase = ioremap_wc(efx-\u003emembase_phys +\n \t\t\t\t\t\t  uc_mem_map_size,\n \t\t\t\t\t\t  wc_mem_map_size);\n@@ -1279,12 +1304,14 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx)\n \t\t\tnic_data-\u003ewc_membase +\n \t\t\t(pio_write_vi_base * efx-\u003evi_stride + ER_DZ_TX_PIOBUF -\n \t\t\t uc_mem_map_size);\n-\n-\t\trc = efx_ef10_link_piobufs(efx);\n-\t\tif (rc)\n-\t\t\tefx_ef10_free_piobufs(efx);\n \t}\n \n+\trc = efx_ef10_link_piobufs(efx);\n+\tif (rc)\n+\t\tefx_ef10_free_piobufs(efx);\n+\n+skip_pio:\n+\n \tnetif_dbg(efx, probe, efx-\u003enet_dev,\n \t\t  \"memory BAR at %pa (virtual %p+%x UC, %p+%x WC)\\n\",\n \t\t  \u0026efx-\u003emembase_phys, efx-\u003emembase, uc_mem_map_size,\ndiff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c\nindex 8f136a11d3968a..3806cd3dd7f485 100644\n--- a/drivers/net/ethernet/sfc/efx.c\n+++ b/drivers/net/ethernet/sfc/efx.c\n@@ -34,6 +34,7 @@\n #include \"selftest.h\"\n #include \"sriov.h\"\n #include \"efx_devlink.h\"\n+#include \"efx_cxl.h\"\n \n #include \"mcdi_port_common.h\"\n #include \"mcdi_pcol.h\"\n@@ -981,12 +982,15 @@ static void efx_pci_remove(struct pci_dev *pci_dev)\n \tefx_pci_remove_main(efx);\n \n \tefx_fini_io(efx);\n+\n+\tprobe_data = container_of(efx, struct efx_probe_data, efx);\n+\tefx_cxl_exit(probe_data);\n+\n \tpci_dbg(efx-\u003epci_dev, \"shutdown successful\\n\");\n \n \tefx_fini_devlink_and_unlock(efx);\n \tefx_fini_struct(efx);\n \tfree_netdev(efx-\u003enet_dev);\n-\tprobe_data = container_of(efx, struct efx_probe_data, efx);\n \tkfree(probe_data);\n };\n \n@@ -1190,6 +1194,17 @@ static int efx_pci_probe(struct pci_dev *pci_dev,\n \tif (rc)\n \t\tgoto fail2;\n \n+\t/* A successful cxl initialization implies a CXL region created to be\n+\t * used for PIO buffers. If there is no CXL support legacy PIO buffers\n+\t * defined at specific PCI BAR regions will be used. If there is CXL\n+\t * support and the cxl initialization fails, the driver probe fails.\n+\t */\n+\trc = efx_cxl_init(probe_data);\n+\tif (rc) {\n+\t\tpci_err(pci_dev, \"CXL initialization failed with error %d\\n\", rc);\n+\t\tgoto fail3;\n+\t}\n+\n \trc = efx_pci_probe_post_io(efx);\n \tif (rc) {\n \t\t/* On failure, retry once immediately.\n@@ -1228,6 +1243,7 @@ static int efx_pci_probe(struct pci_dev *pci_dev,\n \treturn 0;\n \n  fail3:\n+\tefx_cxl_exit(probe_data);\n \tefx_fini_io(efx);\n  fail2:\n \tefx_fini_struct(efx);\ndiff --git a/drivers/net/ethernet/sfc/efx_cxl.c b/drivers/net/ethernet/sfc/efx_cxl.c\nnew file mode 100644\nindex 00000000000000..348d7404cd7aad\n--- /dev/null\n+++ b/drivers/net/ethernet/sfc/efx_cxl.c\n@@ -0,0 +1,105 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+/****************************************************************************\n+ *\n+ * Driver for AMD network controllers and boards\n+ * Copyright (C) 2025, Advanced Micro Devices, Inc.\n+ */\n+\n+#include \u003clinux/pci.h\u003e\n+\n+#include \u003ccxl/cxl.h\u003e\n+#include \u003ccxl/pci.h\u003e\n+#include \"net_driver.h\"\n+#include \"efx_cxl.h\"\n+\n+#define EFX_CTPIO_BUFFER_SIZE\tSZ_256M\n+\n+int efx_cxl_init(struct efx_probe_data *probe_data)\n+{\n+\tstruct efx_nic *efx = \u0026probe_data-\u003eefx;\n+\tstruct pci_dev *pci_dev = efx-\u003epci_dev;\n+\tstruct range cxl_pio_range;\n+\tstruct efx_cxl *cxl;\n+\tu16 dvsec;\n+\tint rc;\n+\n+\t/* Is the device configured with and using CXL? */\n+\tif (!pcie_is_cxl(pci_dev))\n+\t\treturn 0;\n+\n+\tdvsec = pci_find_dvsec_capability(pci_dev, PCI_VENDOR_ID_CXL,\n+\t\t\t\t\t  PCI_DVSEC_CXL_DEVICE);\n+\tif (!dvsec) {\n+\t\tpci_info(pci_dev, \"CXL_DVSEC_PCIE_DEVICE capability not found\\n\");\n+\t\treturn 0;\n+\t}\n+\n+\tpci_dbg(pci_dev, \"CXL_DVSEC_PCIE_DEVICE capability found\\n\");\n+\n+\t/* Create a cxl_dev_state embedded in the cxl struct using cxl core api\n+\t * specifying no mbox available.\n+\t */\n+\tcxl = devm_cxl_dev_state_create(\u0026pci_dev-\u003edev, CXL_DEVTYPE_DEVMEM,\n+\t\t\t\t\tpci_get_dsn(pci_dev), dvsec,\n+\t\t\t\t\tstruct efx_cxl, cxlds, false);\n+\n+\tif (!cxl)\n+\t\treturn -ENOMEM;\n+\n+\trc = cxl_pci_setup_regs(pci_dev, CXL_REGLOC_RBI_COMPONENT,\n+\t\t\t\t\u0026cxl-\u003ecxlds.reg_map);\n+\tif (rc) {\n+\t\tpci_err(pci_dev, \"No component registers\\n\");\n+\t\treturn rc;\n+\t}\n+\n+\tif (!cxl-\u003ecxlds.reg_map.component_map.hdm_decoder.valid) {\n+\t\tpci_err(pci_dev, \"Expected HDM component register not found\\n\");\n+\t\treturn -ENODEV;\n+\t}\n+\n+\tif (!cxl-\u003ecxlds.reg_map.component_map.ras.valid) {\n+\t\tpci_err(pci_dev, \"Expected RAS component register not found\\n\");\n+\t\treturn -ENODEV;\n+\t}\n+\n+\t/* Set media ready explicitly as there are neither mailbox for checking\n+\t * this state nor the CXL register involved, both not mandatory for\n+\t * type2.\n+\t */\n+\tcxl-\u003ecxlds.media_ready = true;\n+\n+\tif (cxl_set_capacity(\u0026cxl-\u003ecxlds, EFX_CTPIO_BUFFER_SIZE)) {\n+\t\tpci_err(pci_dev, \"dpa capacity setup failed\\n\");\n+\t\treturn -ENODEV;\n+\t}\n+\n+\tcxl-\u003ecxlmd = devm_cxl_probe_mem(\u0026cxl-\u003ecxlds, \u0026cxl_pio_range);\n+\tif (IS_ERR(cxl-\u003ecxlmd)) {\n+\t\tpci_err(pci_dev, \"CXL accel memdev creation failed\\n\");\n+\t\treturn PTR_ERR(cxl-\u003ecxlmd);\n+\t}\n+\n+\tcxl-\u003ectpio_cxl = ioremap_wc(cxl_pio_range.start,\n+\t\t\t\t    range_len(\u0026cxl_pio_range));\n+\tif (!cxl-\u003ectpio_cxl) {\n+\t\tpci_err(pci_dev, \"CXL ioremap region (%pra) failed\\n\",\n+\t\t\t\u0026cxl_pio_range);\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\tprobe_data-\u003ecxl_pio_initialised = true;\n+\tprobe_data-\u003ecxl = cxl;\n+\n+\treturn 0;\n+}\n+\n+void efx_cxl_exit(struct efx_probe_data *probe_data)\n+{\n+\tif (!probe_data-\u003ecxl)\n+\t\treturn;\n+\n+\tiounmap(probe_data-\u003ecxl-\u003ectpio_cxl);\n+}\n+\n+MODULE_IMPORT_NS(\"CXL\");\ndiff --git a/drivers/net/ethernet/sfc/efx_cxl.h b/drivers/net/ethernet/sfc/efx_cxl.h\nnew file mode 100644\nindex 00000000000000..3e2705cb063f6a\n--- /dev/null\n+++ b/drivers/net/ethernet/sfc/efx_cxl.h\n@@ -0,0 +1,32 @@\n+/* SPDX-License-Identifier: GPL-2.0-only */\n+/****************************************************************************\n+ * Driver for AMD network controllers and boards\n+ * Copyright (C) 2025, Advanced Micro Devices, Inc.\n+ *\n+ * This program is free software; you can redistribute it and/or modify it\n+ * under the terms of the GNU General Public License version 2 as published\n+ * by the Free Software Foundation, incorporated herein by reference.\n+ */\n+\n+#ifndef EFX_CXL_H\n+#define EFX_CXL_H\n+\n+#ifdef CONFIG_SFC_CXL\n+\n+#include \u003ccxl/cxl.h\u003e\n+\n+struct efx_probe_data;\n+\n+struct efx_cxl {\n+\tstruct cxl_dev_state cxlds;\n+\tstruct cxl_memdev *cxlmd;\n+\tvoid __iomem *ctpio_cxl;\n+};\n+\n+int efx_cxl_init(struct efx_probe_data *probe_data);\n+void efx_cxl_exit(struct efx_probe_data *probe_data);\n+#else\n+static inline int efx_cxl_init(struct efx_probe_data *probe_data) { return 0; }\n+static inline void efx_cxl_exit(struct efx_probe_data *probe_data) {}\n+#endif\n+#endif\ndiff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h\nindex b98c259f672db5..3964b2c56609c4 100644\n--- a/drivers/net/ethernet/sfc/net_driver.h\n+++ b/drivers/net/ethernet/sfc/net_driver.h\n@@ -1197,14 +1197,24 @@ struct efx_nic {\n \tatomic_t n_rx_noskb_drops;\n };\n \n+#ifdef CONFIG_SFC_CXL\n+struct efx_cxl;\n+#endif\n+\n /**\n  * struct efx_probe_data - State after hardware probe\n  * @pci_dev: The PCI device\n  * @efx: Efx NIC details\n+ * @cxl: details of related cxl objects\n+ * @cxl_pio_initialised: cxl initialization outcome.\n  */\n struct efx_probe_data {\n \tstruct pci_dev *pci_dev;\n \tstruct efx_nic efx;\n+#ifdef CONFIG_SFC_CXL\n+\tstruct efx_cxl *cxl;\n+\tbool cxl_pio_initialised;\n+#endif\n };\n \n static inline struct efx_nic *efx_netdev_priv(struct net_device *dev)\ndiff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h\nindex ec3b2df43b68d9..7480f9995dfb8f 100644\n--- a/drivers/net/ethernet/sfc/nic.h\n+++ b/drivers/net/ethernet/sfc/nic.h\n@@ -152,6 +152,8 @@ enum {\n  *\t%MC_CMD_GET_CAPABILITIES response)\n  * @datapath_caps2: Further Capabilities of datapath firmware (FLAGS2 field of\n  * %MC_CMD_GET_CAPABILITIES response)\n+ * @datapath_caps3: Further Capabilities of datapath firmware (FLAGS3 field of\n+ * %MC_CMD_GET_CAPABILITIES response)\n  * @rx_dpcpu_fw_id: Firmware ID of the RxDPCPU\n  * @tx_dpcpu_fw_id: Firmware ID of the TxDPCPU\n  * @must_probe_vswitching: Flag: vswitching has yet to be setup after MC reboot\n@@ -187,6 +189,7 @@ struct efx_ef10_nic_data {\n \tbool must_check_datapath_caps;\n \tu32 datapath_caps;\n \tu32 datapath_caps2;\n+\tu32 datapath_caps3;\n \tunsigned int rx_dpcpu_fw_id;\n \tunsigned int tx_dpcpu_fw_id;\n \tbool must_probe_vswitching;\ndiff --git a/include/cxl/cxl.h b/include/cxl/cxl.h\nindex 016c74fb747cf6..802b143de83db5 100644\n--- a/include/cxl/cxl.h\n+++ b/include/cxl/cxl.h\n@@ -226,4 +226,6 @@ struct cxl_dev_state *_devm_cxl_dev_state_create(struct device *dev,\n \n struct cxl_memdev *devm_cxl_probe_mem(struct cxl_dev_state *cxlds,\n \t\t\t\t      struct range *range);\n+\n+int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);\n #endif /* __CXL_CXL_H__ */\ndiff --git a/include/cxl/pci.h b/include/cxl/pci.h\nnew file mode 100644\nindex 00000000000000..3e0000015871a2\n--- /dev/null\n+++ b/include/cxl/pci.h\n@@ -0,0 +1,22 @@\n+/* SPDX-License-Identifier: GPL-2.0-only */\n+/* Copyright(c) 2020 Intel Corporation. All rights reserved. */\n+\n+#ifndef __CXL_CXL_PCI_H__\n+#define __CXL_CXL_PCI_H__\n+\n+/* Register Block Identifier (RBI) */\n+enum cxl_regloc_type {\n+\tCXL_REGLOC_RBI_EMPTY = 0,\n+\tCXL_REGLOC_RBI_COMPONENT,\n+\tCXL_REGLOC_RBI_VIRT,\n+\tCXL_REGLOC_RBI_MEMDEV,\n+\tCXL_REGLOC_RBI_PMU,\n+\tCXL_REGLOC_RBI_TYPES\n+};\n+\n+struct cxl_register_map;\n+struct pci_dev;\n+\n+int cxl_pci_setup_regs(struct pci_dev *pdev, enum cxl_regloc_type type,\n+\t\t       struct cxl_register_map *map);\n+#endif\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds CXL support to the Solarflare SFC9100-family network driver (sfc) and introduces a helper function in the CXL core for it. The sfc driver requires physical Solarflare PCI hardware which is not emulated in QEMU or other virtualized environments used by syzkaller. Therefore, the new code paths are impossible to reach and fuzz.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit aaa1416d9480e1425e487ca30f5b296374a1d628
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Jul 1 16:42:51 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/cxl/core/core.h b/drivers/cxl/core/core.h
index 07555ae6385940..f7cebb02655235 100644
--- a/drivers/cxl/core/core.h
+++ b/drivers/cxl/core/core.h
@@ -101,6 +101,8 @@ void __iomem *devm_cxl_iomap_block(struct device *dev, resource_size_t addr,
 struct dentry *cxl_debugfs_create_dir(const char *dir);
 int cxl_dpa_set_part(struct cxl_endpoint_decoder *cxled,
 		     enum cxl_partition_mode mode);
+struct cxl_memdev_state;
+int cxl_mem_get_partition_info(struct cxl_memdev_state *mds);
 int cxl_dpa_alloc(struct cxl_endpoint_decoder *cxled, u64 size);
 int cxl_dpa_free(struct cxl_endpoint_decoder *cxled);
 resource_size_t cxl_dpa_size(struct cxl_endpoint_decoder *cxled);
diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 7c6c5b7450a54a..97b1e61ad01877 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -1152,7 +1152,7 @@ EXPORT_SYMBOL_NS_GPL(cxl_mem_get_event_records, "CXL");
  *
  * See CXL @8.2.9.5.2.1 Get Partition Info
  */
-static int cxl_mem_get_partition_info(struct cxl_memdev_state *mds)
+int cxl_mem_get_partition_info(struct cxl_memdev_state *mds)
 {
 	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
 	struct cxl_mbox_get_partition_info pi;
@@ -1308,55 +1308,6 @@ int cxl_mem_sanitize(struct cxl_memdev *cxlmd, u16 cmd)
 	return -EBUSY;
 }
 
-static void add_part(struct cxl_dpa_info *info, u64 start, u64 size, enum cxl_partition_mode mode)
-{
-	int i = info->nr_partitions;
-
-	if (size == 0)
-		return;
-
-	info->part[i].range = (struct range) {
-		.start = start,
-		.end = start + size - 1,
-	};
-	info->part[i].mode = mode;
-	info->nr_partitions++;
-}
-
-int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
-{
-	struct cxl_dev_state *cxlds = &mds->cxlds;
-	struct device *dev = cxlds->dev;
-	int rc;
-
-	if (!cxlds->media_ready) {
-		info->size = 0;
-		return 0;
-	}
-
-	info->size = mds->total_bytes;
-
-	if (mds->partition_align_bytes == 0) {
-		add_part(info, 0, mds->volatile_only_bytes, CXL_PARTMODE_RAM);
-		add_part(info, mds->volatile_only_bytes,
-			 mds->persistent_only_bytes, CXL_PARTMODE_PMEM);
-		return 0;
-	}
-
-	rc = cxl_mem_get_partition_info(mds);
-	if (rc) {
-		dev_err(dev, "Failed to query partition information\n");
-		return rc;
-	}
-
-	add_part(info, 0, mds->active_volatile_bytes, CXL_PARTMODE_RAM);
-	add_part(info, mds->active_volatile_bytes, mds->active_persistent_bytes,
-		 CXL_PARTMODE_PMEM);
-
-	return 0;
-}
-EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, "CXL");
-
 int cxl_get_dirty_count(struct cxl_memdev_state *mds, u32 *count)
 {
 	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index 33a3d2e7b13af9..2e457b1ebc7dfc 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -594,6 +594,73 @@ bool is_cxl_memdev(const struct device *dev)
 }
 EXPORT_SYMBOL_NS_GPL(is_cxl_memdev, "CXL");
 
+static void add_part(struct cxl_dpa_info *info, u64 start, u64 size, enum cxl_partition_mode mode)
+{
+	int i = info->nr_partitions;
+
+	if (size == 0)
+		return;
+
+	info->part[i].range = (struct range) {
+		.start = start,
+		.end = start + size - 1,
+	};
+	info->part[i].mode = mode;
+	info->nr_partitions++;
+}
+
+int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
+{
+	struct cxl_dev_state *cxlds = &mds->cxlds;
+	struct device *dev = cxlds->dev;
+	int rc;
+
+	if (!cxlds->media_ready) {
+		info->size = 0;
+		return 0;
+	}
+
+	info->size = mds->total_bytes;
+
+	if (mds->partition_align_bytes == 0) {
+		add_part(info, 0, mds->volatile_only_bytes, CXL_PARTMODE_RAM);
+		add_part(info, mds->volatile_only_bytes,
+			 mds->persistent_only_bytes, CXL_PARTMODE_PMEM);
+		return 0;
+	}
+
+	rc = cxl_mem_get_partition_info(mds);
+	if (rc) {
+		dev_err(dev, "Failed to query partition information\n");
+		return rc;
+	}
+
+	add_part(info, 0, mds->active_volatile_bytes, CXL_PARTMODE_RAM);
+	add_part(info, mds->active_volatile_bytes, mds->active_persistent_bytes,
+		 CXL_PARTMODE_PMEM);
+
+	return 0;
+}
+EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, "CXL");
+
+
+/**
+ * cxl_set_capacity: initialize dpa by a driver without a mailbox.
+ *
+ * @cxlds: pointer to cxl_dev_state
+ * @capacity: device volatile memory size
+ */
+int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity)
+{
+	struct cxl_dpa_info range_info = {
+		.size = capacity,
+	};
+
+	add_part(&range_info, 0, capacity, CXL_PARTMODE_RAM);
+	return cxl_dpa_setup(cxlds, &range_info);
+}
+EXPORT_SYMBOL_NS_GPL(cxl_set_capacity, "CXL");
+
 /**
  * set_exclusive_cxl_commands() - atomically disable user cxl commands
  * @mds: The device state to operate on
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index e4338fd7e01b47..9d807c1a002ca9 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -6,6 +6,7 @@
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/pci-doe.h>
+#include <cxl/pci.h>
 #include <linux/aer.h>
 #include <cxlpci.h>
 #include <cxlmem.h>
diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
index 1215ee4f40351b..cb633e19151b54 100644
--- a/drivers/cxl/core/port.c
+++ b/drivers/cxl/core/port.c
@@ -11,6 +11,7 @@
 #include <linux/idr.h>
 #include <linux/node.h>
 #include <cxl/einj.h>
+#include <cxl/pci.h>
 #include <cxlmem.h>
 #include <cxlpci.h>
 #include <cxl.h>
diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
index 93710cf4f0a697..20c2d9fbcfe7df 100644
--- a/drivers/cxl/core/regs.c
+++ b/drivers/cxl/core/regs.c
@@ -4,6 +4,7 @@
 #include <linux/device.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
+#include <cxl/pci.h>
 #include <cxlmem.h>
 #include <cxlpci.h>
 #include <pmu.h>
diff --git a/drivers/cxl/cxlpci.h b/drivers/cxl/cxlpci.h
index b826eb53cf7bac..110ec9c44f09f1 100644
--- a/drivers/cxl/cxlpci.h
+++ b/drivers/cxl/cxlpci.h
@@ -13,16 +13,6 @@
  */
 #define CXL_PCI_DEFAULT_MAX_VECTORS 16
 
-/* Register Block Identifier (RBI) */
-enum cxl_regloc_type {
-	CXL_REGLOC_RBI_EMPTY = 0,
-	CXL_REGLOC_RBI_COMPONENT,
-	CXL_REGLOC_RBI_VIRT,
-	CXL_REGLOC_RBI_MEMDEV,
-	CXL_REGLOC_RBI_PMU,
-	CXL_REGLOC_RBI_TYPES
-};
-
 /*
  * Table Access DOE, CDAT Read Entry Response
  *
@@ -112,6 +102,4 @@ static inline void devm_cxl_port_ras_setup(struct cxl_port *port)
 }
 #endif
 
-int cxl_pci_setup_regs(struct pci_dev *pdev, enum cxl_regloc_type type,
-		       struct cxl_register_map *map);
 #endif /* __CXL_PCI_H__ */
diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c
index 267c679b0b3c20..bb892dbfdd6d6f 100644
--- a/drivers/cxl/pci.c
+++ b/drivers/cxl/pci.c
@@ -11,6 +11,7 @@
 #include <linux/pci.h>
 #include <linux/aer.h>
 #include <linux/io.h>
+#include <cxl/pci.h>
 #include <cxl/mailbox.h>
 #include "cxlmem.h"
 #include "cxlpci.h"
diff --git a/drivers/net/ethernet/sfc/Kconfig b/drivers/net/ethernet/sfc/Kconfig
index c4c43434f31434..979f2801e2a8e3 100644
--- a/drivers/net/ethernet/sfc/Kconfig
+++ b/drivers/net/ethernet/sfc/Kconfig
@@ -66,6 +66,15 @@ config SFC_MCDI_LOGGING
 	  Driver-Interface) commands and responses, allowing debugging of
 	  driver/firmware interaction.  The tracing is actually enabled by
 	  a sysfs file 'mcdi_logging' under the PCI device.
+config SFC_CXL
+	bool "Solarflare SFC9100-family CXL support"
+	depends on SFC && CXL_BUS >= SFC
+	default SFC
+	help
+	  This enables SFC CXL support if the kernel is configuring CXL for
+	  using CTPIO with CXL.mem. The SFC device with CXL support and
+	  with a CXL-aware firmware can be used for minimizing latencies
+	  when sending through CTPIO.
 
 source "drivers/net/ethernet/sfc/falcon/Kconfig"
 source "drivers/net/ethernet/sfc/siena/Kconfig"
diff --git a/drivers/net/ethernet/sfc/Makefile b/drivers/net/ethernet/sfc/Makefile
index d99039ec468d67..bb0f1891cde653 100644
--- a/drivers/net/ethernet/sfc/Makefile
+++ b/drivers/net/ethernet/sfc/Makefile
@@ -13,6 +13,7 @@ sfc-$(CONFIG_SFC_SRIOV)	+= sriov.o ef10_sriov.o ef100_sriov.o ef100_rep.o \
                            mae.o tc.o tc_bindings.o tc_counters.o \
                            tc_encap_actions.o tc_conntrack.o
 
+sfc-$(CONFIG_SFC_CXL)	+= efx_cxl.o
 obj-$(CONFIG_SFC)	+= sfc.o
 
 obj-$(CONFIG_SFC_FALCON) += falcon/
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 7e04f115bbaaaf..73bc064929f639 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -24,6 +24,7 @@
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <net/udp_tunnel.h>
+#include "efx_cxl.h"
 
 /* Hardware control for EF10 architecture including 'Huntington'. */
 
@@ -106,7 +107,7 @@ static int efx_ef10_get_vf_index(struct efx_nic *efx)
 
 static int efx_ef10_init_datapath_caps(struct efx_nic *efx)
 {
-	MCDI_DECLARE_BUF(outbuf, MC_CMD_GET_CAPABILITIES_V4_OUT_LEN);
+	MCDI_DECLARE_BUF(outbuf, MC_CMD_GET_CAPABILITIES_V7_OUT_LEN);
 	struct efx_ef10_nic_data *nic_data = efx->nic_data;
 	size_t outlen;
 	int rc;
@@ -177,6 +178,12 @@ static int efx_ef10_init_datapath_caps(struct efx_nic *efx)
 			  efx->num_mac_stats);
 	}
 
+	if (outlen < MC_CMD_GET_CAPABILITIES_V7_OUT_LEN)
+		nic_data->datapath_caps3 = 0;
+	else
+		nic_data->datapath_caps3 = MCDI_DWORD(outbuf,
+						      GET_CAPABILITIES_V7_OUT_FLAGS3);
+
 	return 0;
 }
 
@@ -1140,6 +1147,9 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx)
 	unsigned int channel_vis, pio_write_vi_base, max_vis;
 	struct efx_ef10_nic_data *nic_data = efx->nic_data;
 	unsigned int uc_mem_map_size, wc_mem_map_size;
+#ifdef CONFIG_SFC_CXL
+	struct efx_probe_data *probe_data;
+#endif
 	void __iomem *membase;
 	int rc;
 
@@ -1263,8 +1273,23 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx)
 	iounmap(efx->membase);
 	efx->membase = membase;
 
-	/* Set up the WC mapping if needed */
-	if (wc_mem_map_size) {
+	if (!wc_mem_map_size)
+		goto skip_pio;
+
+	/* Set up the WC mapping */
+
+#ifdef CONFIG_SFC_CXL
+	probe_data = container_of(efx, struct efx_probe_data, efx);
+	if ((nic_data->datapath_caps3 &
+	    (1 << MC_CMD_GET_CAPABILITIES_V7_OUT_CXL_CONFIG_ENABLE_LBN)) &&
+	    probe_data->cxl_pio_initialised) {
+		/* Using PIO through CXL mapping */
+		nic_data->pio_write_base = probe_data->cxl->ctpio_cxl;
+		nic_data->pio_write_vi_base = pio_write_vi_base;
+	} else
+#endif
+	{
+		/* Using legacy PIO BAR mapping */
 		nic_data->wc_membase = ioremap_wc(efx->membase_phys +
 						  uc_mem_map_size,
 						  wc_mem_map_size);
@@ -1279,12 +1304,14 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx)
 			nic_data->wc_membase +
 			(pio_write_vi_base * efx->vi_stride + ER_DZ_TX_PIOBUF -
 			 uc_mem_map_size);
-
-		rc = efx_ef10_link_piobufs(efx);
-		if (rc)
-			efx_ef10_free_piobufs(efx);
 	}
 
+	rc = efx_ef10_link_piobufs(efx);
+	if (rc)
+		efx_ef10_free_piobufs(efx);
+
+skip_pio:
+
 	netif_dbg(efx, probe, efx->net_dev,
 		  "memory BAR at %pa (virtual %p+%x UC, %p+%x WC)\n",
 		  &efx->membase_phys, efx->membase, uc_mem_map_size,
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 8f136a11d3968a..3806cd3dd7f485 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -34,6 +34,7 @@
 #include "selftest.h"
 #include "sriov.h"
 #include "efx_devlink.h"
+#include "efx_cxl.h"
 
 #include "mcdi_port_common.h"
 #include "mcdi_pcol.h"
@@ -981,12 +982,15 @@ static void efx_pci_remove(struct pci_dev *pci_dev)
 	efx_pci_remove_main(efx);
 
 	efx_fini_io(efx);
+
+	probe_data = container_of(efx, struct efx_probe_data, efx);
+	efx_cxl_exit(probe_data);
+
 	pci_dbg(efx->pci_dev, "shutdown successful\n");
 
 	efx_fini_devlink_and_unlock(efx);
 	efx_fini_struct(efx);
 	free_netdev(efx->net_dev);
-	probe_data = container_of(efx, struct efx_probe_data, efx);
 	kfree(probe_data);
 };
 
@@ -1190,6 +1194,17 @@ static int efx_pci_probe(struct pci_dev *pci_dev,
 	if (rc)
 		goto fail2;
 
+	/* A successful cxl initialization implies a CXL region created to be
+	 * used for PIO buffers. If there is no CXL support legacy PIO buffers
+	 * defined at specific PCI BAR regions will be used. If there is CXL
+	 * support and the cxl initialization fails, the driver probe fails.
+	 */
+	rc = efx_cxl_init(probe_data);
+	if (rc) {
+		pci_err(pci_dev, "CXL initialization failed with error %d\n", rc);
+		goto fail3;
+	}
+
 	rc = efx_pci_probe_post_io(efx);
 	if (rc) {
 		/* On failure, retry once immediately.
@@ -1228,6 +1243,7 @@ static int efx_pci_probe(struct pci_dev *pci_dev,
 	return 0;
 
  fail3:
+	efx_cxl_exit(probe_data);
 	efx_fini_io(efx);
  fail2:
 	efx_fini_struct(efx);
diff --git a/drivers/net/ethernet/sfc/efx_cxl.c b/drivers/net/ethernet/sfc/efx_cxl.c
new file mode 100644
index 00000000000000..348d7404cd7aad
--- /dev/null
+++ b/drivers/net/ethernet/sfc/efx_cxl.c
@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/****************************************************************************
+ *
+ * Driver for AMD network controllers and boards
+ * Copyright (C) 2025, Advanced Micro Devices, Inc.
+ */
+
+#include <linux/pci.h>
+
+#include <cxl/cxl.h>
+#include <cxl/pci.h>
+#include "net_driver.h"
+#include "efx_cxl.h"
+
+#define EFX_CTPIO_BUFFER_SIZE	SZ_256M
+
+int efx_cxl_init(struct efx_probe_data *probe_data)
+{
+	struct efx_nic *efx = &probe_data->efx;
+	struct pci_dev *pci_dev = efx->pci_dev;
+	struct range cxl_pio_range;
+	struct efx_cxl *cxl;
+	u16 dvsec;
+	int rc;
+
+	/* Is the device configured with and using CXL? */
+	if (!pcie_is_cxl(pci_dev))
+		return 0;
+
+	dvsec = pci_find_dvsec_capability(pci_dev, PCI_VENDOR_ID_CXL,
+					  PCI_DVSEC_CXL_DEVICE);
+	if (!dvsec) {
+		pci_info(pci_dev, "CXL_DVSEC_PCIE_DEVICE capability not found\n");
+		return 0;
+	}
+
+	pci_dbg(pci_dev, "CXL_DVSEC_PCIE_DEVICE capability found\n");
+
+	/* Create a cxl_dev_state embedded in the cxl struct using cxl core api
+	 * specifying no mbox available.
+	 */
+	cxl = devm_cxl_dev_state_create(&pci_dev->dev, CXL_DEVTYPE_DEVMEM,
+					pci_get_dsn(pci_dev), dvsec,
+					struct efx_cxl, cxlds, false);
+
+	if (!cxl)
+		return -ENOMEM;
+
+	rc = cxl_pci_setup_regs(pci_dev, CXL_REGLOC_RBI_COMPONENT,
+				&cxl->cxlds.reg_map);
+	if (rc) {
+		pci_err(pci_dev, "No component registers\n");
+		return rc;
+	}
+
+	if (!cxl->cxlds.reg_map.component_map.hdm_decoder.valid) {
+		pci_err(pci_dev, "Expected HDM component register not found\n");
+		return -ENODEV;
+	}
+
+	if (!cxl->cxlds.reg_map.component_map.ras.valid) {
+		pci_err(pci_dev, "Expected RAS component register not found\n");
+		return -ENODEV;
+	}
+
+	/* Set media ready explicitly as there are neither mailbox for checking
+	 * this state nor the CXL register involved, both not mandatory for
+	 * type2.
+	 */
+	cxl->cxlds.media_ready = true;
+
+	if (cxl_set_capacity(&cxl->cxlds, EFX_CTPIO_BUFFER_SIZE)) {
+		pci_err(pci_dev, "dpa capacity setup failed\n");
+		return -ENODEV;
+	}
+
+	cxl->cxlmd = devm_cxl_probe_mem(&cxl->cxlds, &cxl_pio_range);
+	if (IS_ERR(cxl->cxlmd)) {
+		pci_err(pci_dev, "CXL accel memdev creation failed\n");
+		return PTR_ERR(cxl->cxlmd);
+	}
+
+	cxl->ctpio_cxl = ioremap_wc(cxl_pio_range.start,
+				    range_len(&cxl_pio_range));
+	if (!cxl->ctpio_cxl) {
+		pci_err(pci_dev, "CXL ioremap region (%pra) failed\n",
+			&cxl_pio_range);
+		return -ENOMEM;
+	}
+
+	probe_data->cxl_pio_initialised = true;
+	probe_data->cxl = cxl;
+
+	return 0;
+}
+
+void efx_cxl_exit(struct efx_probe_data *probe_data)
+{
+	if (!probe_data->cxl)
+		return;
+
+	iounmap(probe_data->cxl->ctpio_cxl);
+}
+
+MODULE_IMPORT_NS("CXL");
diff --git a/drivers/net/ethernet/sfc/efx_cxl.h b/drivers/net/ethernet/sfc/efx_cxl.h
new file mode 100644
index 00000000000000..3e2705cb063f6a
--- /dev/null
+++ b/drivers/net/ethernet/sfc/efx_cxl.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/****************************************************************************
+ * Driver for AMD network controllers and boards
+ * Copyright (C) 2025, Advanced Micro Devices, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+#ifndef EFX_CXL_H
+#define EFX_CXL_H
+
+#ifdef CONFIG_SFC_CXL
+
+#include <cxl/cxl.h>
+
+struct efx_probe_data;
+
+struct efx_cxl {
+	struct cxl_dev_state cxlds;
+	struct cxl_memdev *cxlmd;
+	void __iomem *ctpio_cxl;
+};
+
+int efx_cxl_init(struct efx_probe_data *probe_data);
+void efx_cxl_exit(struct efx_probe_data *probe_data);
+#else
+static inline int efx_cxl_init(struct efx_probe_data *probe_data) { return 0; }
+static inline void efx_cxl_exit(struct efx_probe_data *probe_data) {}
+#endif
+#endif
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index b98c259f672db5..3964b2c56609c4 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -1197,14 +1197,24 @@ struct efx_nic {
 	atomic_t n_rx_noskb_drops;
 };
 
+#ifdef CONFIG_SFC_CXL
+struct efx_cxl;
+#endif
+
 /**
  * struct efx_probe_data - State after hardware probe
  * @pci_dev: The PCI device
  * @efx: Efx NIC details
+ * @cxl: details of related cxl objects
+ * @cxl_pio_initialised: cxl initialization outcome.
  */
 struct efx_probe_data {
 	struct pci_dev *pci_dev;
 	struct efx_nic efx;
+#ifdef CONFIG_SFC_CXL
+	struct efx_cxl *cxl;
+	bool cxl_pio_initialised;
+#endif
 };
 
 static inline struct efx_nic *efx_netdev_priv(struct net_device *dev)
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index ec3b2df43b68d9..7480f9995dfb8f 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -152,6 +152,8 @@ enum {
  *	%MC_CMD_GET_CAPABILITIES response)
  * @datapath_caps2: Further Capabilities of datapath firmware (FLAGS2 field of
  * %MC_CMD_GET_CAPABILITIES response)
+ * @datapath_caps3: Further Capabilities of datapath firmware (FLAGS3 field of
+ * %MC_CMD_GET_CAPABILITIES response)
  * @rx_dpcpu_fw_id: Firmware ID of the RxDPCPU
  * @tx_dpcpu_fw_id: Firmware ID of the TxDPCPU
  * @must_probe_vswitching: Flag: vswitching has yet to be setup after MC reboot
@@ -187,6 +189,7 @@ struct efx_ef10_nic_data {
 	bool must_check_datapath_caps;
 	u32 datapath_caps;
 	u32 datapath_caps2;
+	u32 datapath_caps3;
 	unsigned int rx_dpcpu_fw_id;
 	unsigned int tx_dpcpu_fw_id;
 	bool must_probe_vswitching;
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 016c74fb747cf6..802b143de83db5 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -226,4 +226,6 @@ struct cxl_dev_state *_devm_cxl_dev_state_create(struct device *dev,
 
 struct cxl_memdev *devm_cxl_probe_mem(struct cxl_dev_state *cxlds,
 				      struct range *range);
+
+int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);
 #endif /* __CXL_CXL_H__ */
diff --git a/include/cxl/pci.h b/include/cxl/pci.h
new file mode 100644
index 00000000000000..3e0000015871a2
--- /dev/null
+++ b/include/cxl/pci.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright(c) 2020 Intel Corporation. All rights reserved. */
+
+#ifndef __CXL_CXL_PCI_H__
+#define __CXL_CXL_PCI_H__
+
+/* Register Block Identifier (RBI) */
+enum cxl_regloc_type {
+	CXL_REGLOC_RBI_EMPTY = 0,
+	CXL_REGLOC_RBI_COMPONENT,
+	CXL_REGLOC_RBI_VIRT,
+	CXL_REGLOC_RBI_MEMDEV,
+	CXL_REGLOC_RBI_PMU,
+	CXL_REGLOC_RBI_TYPES
+};
+
+struct cxl_register_map;
+struct pci_dev;
+
+int cxl_pci_setup_regs(struct pci_dev *pdev, enum cxl_regloc_type type,
+		       struct cxl_register_map *map);
+#endif

gemini-3.1-pro-preview

null

null

							input: 10546
							output: 26
							thoughts: 843
						

**Fuzzing the SFC9100 with CXL Support**

Okay, so we've got this patch adding CXL support to the Solarflare SFC9100 network driver, introducing `CONFIG_SFC_CXL`. It modifies some core CXL files, which is interesting, exporting some functions. My immediate thought is, can we even fuzz this? We need to figure out if it's reachable.

The SFC driver is a PCI network driver. PCI drivers *should* be fuzzable, right? Syzkaller can do pseudo-PCI devices or VFIO if it's supported. But I remember there's no magic "generic" PCI fuzzer that *just works* unless specifically targeted. It's usually dependent on special support or if it's USB or virtual. The prompt reminds me of the limitations: "Code paths that are impossible to reach in virtualized environments".

The real question is, does QEMU emulate the SFC9100? No, that's a dead end. QEMU handles the usual suspects but not the SFC9100, so `efx_pci_probe` isn't going to be called in a standard QEMU setup. So that means no probe, no fuzz.

I'm racking my brain. Syzkaller... does it have some magic `syz_pci_device` function that injects a virtual PCI device? I know about `syz_kvm_setup_cpu`, but for PCI devices? Does it use `vhci` for PCI? Or, Does syzkaller have a general PCI emulator in the kernel that can emulate arbitrary PCI devices? No! Wait, actually, I recall that syzkaller uses `vfio` or relies on QEMU, so that's the only real option. No, Syzkaller does have a `vhci` for USB, but that won't work here.

Let me see if I can find some PCI emulation within Syzkaller. It looks like it does have stuff like `syz_genetlink_get_family_id`. Oh, wait, did they recently add something with `vfio` or a dummy PCI controller? No, Syzkaller still uses `qemu` with the standard devices.

This driver isn't reachable because the hardware isn't present, that makes fuzzing a waste of time. I need to be able to probe `sfc` to even start. Is there a virtual device for this? No, that's not the case. I would check syzkaller for `sfc` but I don't have that source.

I need to confirm if the driver can be probed *without* the hardware. Normally PCI drivers require a matching vendor/device ID from a real PCI device. Without QEMU emulation, the probe function is never called.

Okay, let me just double-check one more thing: is there *any* software emulation for SFC in the kernel?

{
  "Expression": "SFC9100",
  "PathPrefix": ""
}

{
  "Output": "drivers/net/ethernet/sfc/Kconfig=19=config SFC\ndrivers/net/ethernet/sfc/Kconfig:20:\ttristate \"Solarflare SFC9100/EF100-family support\"\ndrivers/net/ethernet/sfc/Kconfig-21-\tdepends on PCI\n--\ndrivers/net/ethernet/sfc/Kconfig-27-\t  This driver supports 10/40-gigabit Ethernet cards based on\ndrivers/net/ethernet/sfc/Kconfig:28:\t  the Solarflare SFC9100-family controllers.\ndrivers/net/ethernet/sfc/Kconfig-29-\n--\ndrivers/net/ethernet/sfc/Kconfig=35=config SFC_MTD\ndrivers/net/ethernet/sfc/Kconfig:36:\tbool \"Solarflare SFC9100-family MTD support\"\ndrivers/net/ethernet/sfc/Kconfig-37-\tdepends on SFC \u0026\u0026 MTD \u0026\u0026 !(SFC=y \u0026\u0026 MTD=m)\n--\ndrivers/net/ethernet/sfc/Kconfig=44=config SFC_MCDI_MON\ndrivers/net/ethernet/sfc/Kconfig:45:\tbool \"Solarflare SFC9100-family hwmon support\"\ndrivers/net/ethernet/sfc/Kconfig-46-\tdepends on SFC \u0026\u0026 HWMON \u0026\u0026 !(SFC=y \u0026\u0026 HWMON=m)\n--\ndrivers/net/ethernet/sfc/Kconfig=51=config SFC_SRIOV\ndrivers/net/ethernet/sfc/Kconfig:52:\tbool \"Solarflare SFC9100-family SR-IOV support\"\ndrivers/net/ethernet/sfc/Kconfig-53-\tdepends on SFC \u0026\u0026 PCI_IOV\n--\ndrivers/net/ethernet/sfc/Kconfig=60=config SFC_MCDI_LOGGING\ndrivers/net/ethernet/sfc/Kconfig:61:\tbool \"Solarflare SFC9100-family MCDI logging support\"\ndrivers/net/ethernet/sfc/Kconfig-62-\tdepends on SFC\n--\ndrivers/net/ethernet/sfc/Kconfig=69=config SFC_CXL\ndrivers/net/ethernet/sfc/Kconfig:70:\tbool \"Solarflare SFC9100-family CXL support\"\ndrivers/net/ethernet/sfc/Kconfig-71-\tdepends on SFC \u0026\u0026 CXL_BUS \u003e= SFC\n--\ndrivers/net/ethernet/sfc/nic.h=26=enum {\n--\ndrivers/net/ethernet/sfc/nic.h-124-/* Maximum number of TX PIO buffers we may allocate to a function.\ndrivers/net/ethernet/sfc/nic.h:125: * This matches the total number of buffers on each SFC9100-family\ndrivers/net/ethernet/sfc/nic.h-126- * controller.\n"
}

gemini-3.1-pro-preview

null

null

							input: 12782
							output: 27
							thoughts: 288
						

**Analyzing the EFX Driver in a Virtualized Context**

Okay, so I'm looking at this Solarflare SFC9100/EF100-family driver, and it's clear the primary driver is designed for physical hardware. There's no kernel-level emulation of this specific hardware, and QEMU doesn't seem to have its own. This means the `efx_pci_probe` function, which is the key entry point for the driver, will never get triggered in a virtualized setting. That much is obvious.

But wait, hold on. The patch mentions CXL support, specifically for the SFC driver. Now, *that* complicates things. Does QEMU even emulate CXL? Yes, it does! QEMU has added some CXL emulation, focusing on, for instance, CXL type 3 devices. But the crucial question is: does QEMU emulate a Solarflare NIC *with* CXL? And the answer, as far as I can tell, is no. So, the original problem remains; the driver's probe isn't getting called.

Okay, let's step back. Does syzkaller offer some sort of magic? Maybe it has a `syz_pci_device` or similar? Does that give us an alternative route in? Ah, no, it's not that simple. Syzkaller doesn't provide a way to fuzz entirely arbitrary PCI drivers unless they have associated virtual devices. Examples would be something like `mac80211_hwsim`, `vkms`, or `snd-dummy`, or if it can inject devices into the system.

Aha! Wait, my memory serves me well. There *is* a PCI fuzzing subsystem in syzkaller. I've seen it! Syzkaller has the `syz_pci_device` mechanism! That allows syzkaller to actually emulate PCI devices! Now, this is promising. We might have a way in after all. Right, so now the key question: Does `syz_pci_device` exist in the kernel? Time to go hunting.

no matches

{
  "Expression": "syz_pci_device",
  "PathPrefix": ""
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 13562
							output: 27
							thoughts: 181
						

**My Reasoning on SFC Device Emulation**

Okay, so I'm trying to figure out how to interact with this `sfc` device through syzkaller. The first thing that comes to mind is `syz_pci_device`, but then I remember that's not actually in the kernel itself; it's a syzkaller construct. And syzkaller doesn't directly emulate arbitrary PCI devices within the kernel space, it uses QEMU or relies on existing kernel modules. So, if there isn't a kernel module to stand in for the SFC device, I'm out of luck. It's not reachable directly.

Alright, a new plan. I need to find a way to interact with `efx_cxl_init` or `cxl_set_capacity`. Let's see... Ah, `cxl_set_capacity` is exported, and `efx_cxl_init` makes use of it. That’s promising. Looking further, `efx_cxl_init` is called from `efx_pci_probe`, which is the probe function for the `sfc` driver. So, I have a path here! Now I need to check the PCI IDs associated with the `sfc` driver.

{
  "Expression": "efx_pci_probe",
  "PathPrefix": ""
}

{
  "Output": "drivers/net/ethernet/sfc/efx.c=1001=static void efx_probe_vpd_strings(struct efx_nic *efx)\n--\ndrivers/net/ethernet/sfc/efx.c-1034- */\ndrivers/net/ethernet/sfc/efx.c:1035:static int efx_pci_probe_main(struct efx_nic *efx)\ndrivers/net/ethernet/sfc/efx.c-1036-{\n--\ndrivers/net/ethernet/sfc/efx.c-1085-\ndrivers/net/ethernet/sfc/efx.c:1086:static int efx_pci_probe_post_io(struct efx_nic *efx)\ndrivers/net/ethernet/sfc/efx.c-1087-{\ndrivers/net/ethernet/sfc/efx.c-1088-\tstruct net_device *net_dev = efx-\u003enet_dev;\ndrivers/net/ethernet/sfc/efx.c:1089:\tint rc = efx_pci_probe_main(efx);\ndrivers/net/ethernet/sfc/efx.c-1090-\n--\ndrivers/net/ethernet/sfc/efx.c-1152- */\ndrivers/net/ethernet/sfc/efx.c:1153:static int efx_pci_probe(struct pci_dev *pci_dev,\ndrivers/net/ethernet/sfc/efx.c-1154-\t\t\t const struct pci_device_id *entry)\n--\ndrivers/net/ethernet/sfc/efx.c-1207-\ndrivers/net/ethernet/sfc/efx.c:1208:\trc = efx_pci_probe_post_io(efx);\ndrivers/net/ethernet/sfc/efx.c-1209-\tif (rc) {\n--\ndrivers/net/ethernet/sfc/efx.c-1213-\t\tefx-\u003ereset_pending = 0;\ndrivers/net/ethernet/sfc/efx.c:1214:\t\trc = efx_pci_probe_post_io(efx);\ndrivers/net/ethernet/sfc/efx.c-1215-\t\tif (rc) {\n--\ndrivers/net/ethernet/sfc/efx.c-1223-\t\t\tefx-\u003ereset_pending = 0;\ndrivers/net/ethernet/sfc/efx.c:1224:\t\t\trc = efx_pci_probe_post_io(efx);\ndrivers/net/ethernet/sfc/efx.c-1225-\t\t}\n--\ndrivers/net/ethernet/sfc/efx.c=1408=static struct pci_driver efx_pci_driver = {\n--\ndrivers/net/ethernet/sfc/efx.c-1410-\t.id_table\t= efx_pci_table,\ndrivers/net/ethernet/sfc/efx.c:1411:\t.probe\t\t= efx_pci_probe,\ndrivers/net/ethernet/sfc/efx.c-1412-\t.remove\t\t= efx_pci_remove,\n--\ndrivers/net/ethernet/sfc/siena/efx.c=896=static void efx_probe_vpd_strings(struct efx_nic *efx)\n--\ndrivers/net/ethernet/sfc/siena/efx.c-929- */\ndrivers/net/ethernet/sfc/siena/efx.c:930:static int efx_pci_probe_main(struct efx_nic *efx)\ndrivers/net/ethernet/sfc/siena/efx.c-931-{\n--\ndrivers/net/ethernet/sfc/siena/efx.c-980-\ndrivers/net/ethernet/sfc/siena/efx.c:981:static int efx_pci_probe_post_io(struct efx_nic *efx)\ndrivers/net/ethernet/sfc/siena/efx.c-982-{\ndrivers/net/ethernet/sfc/siena/efx.c-983-\tstruct net_device *net_dev = efx-\u003enet_dev;\ndrivers/net/ethernet/sfc/siena/efx.c:984:\tint rc = efx_pci_probe_main(efx);\ndrivers/net/ethernet/sfc/siena/efx.c-985-\n--\ndrivers/net/ethernet/sfc/siena/efx.c-1041- */\ndrivers/net/ethernet/sfc/siena/efx.c:1042:static int efx_pci_probe(struct pci_dev *pci_dev,\ndrivers/net/ethernet/sfc/siena/efx.c-1043-\t\t\t const struct pci_device_id *entry)\n--\ndrivers/net/ethernet/sfc/siena/efx.c-1075-\ndrivers/net/ethernet/sfc/siena/efx.c:1076:\trc = efx_pci_probe_post_io(efx);\ndrivers/net/ethernet/sfc/siena/efx.c-1077-\tif (rc) {\n--\ndrivers/net/ethernet/sfc/siena/efx.c-1081-\t\tefx-\u003ereset_pending = 0;\ndrivers/net/ethernet/sfc/siena/efx.c:1082:\t\trc = efx_pci_probe_post_io(efx);\ndrivers/net/ethernet/sfc/siena/efx.c-1083-\t\tif (rc) {\n--\ndrivers/net/ethernet/sfc/siena/efx.c-1091-\t\t\tefx-\u003ereset_pending = 0;\ndrivers/net/ethernet/sfc/siena/efx.c:1092:\t\t\trc = efx_pci_probe_post_io(efx);\ndrivers/net/ethernet/sfc/siena/efx.c-1093-\t\t}\n--\ndrivers/net/ethernet/sfc/siena/efx.c=1273=static struct pci_driver efx_pci_driver = {\n--\ndrivers/net/ethernet/sfc/siena/efx.c-1275-\t.id_table\t= efx_pci_table,\ndrivers/net/ethernet/sfc/siena/efx.c:1276:\t.probe\t\t= efx_pci_probe,\ndrivers/net/ethernet/sfc/siena/efx.c-1277-\t.remove\t\t= efx_pci_remove,\n"
}

gemini-3.1-pro-preview

null

null

							input: 15805
							output: 26
							thoughts: 97
						

**Fuzzing the SFC Driver and Exploring CXL Opportunities**

Okay, so Syzkaller can't directly target the `sfc` driver. The frustrating thing is, it needs that specific PCI hardware, and we don't have good emulation. But hold on... let's shift gears. What about exploring potential entry points within the CXL subsystem? I'm thinking specifically about `cxl_set_capacity` and `cxl_mem_get_partition_info`. Are they reachable and worth investigating?

`cxl_set_capacity`, as I recall, is a relatively recent addition, residing in `drivers/cxl/core/memdev.c`. I need to verify its usage. The critical step now is to track down all the call sites and see where it's being used within the kernel. If we can reach that, it might be a new place to attack.

{
  "Expression": "cxl_set_capacity",
  "PathPrefix": ""
}

{
  "Output": "drivers/cxl/core/memdev.c=644=EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, \"CXL\");\n--\ndrivers/cxl/core/memdev.c-647-/**\ndrivers/cxl/core/memdev.c:648: * cxl_set_capacity: initialize dpa by a driver without a mailbox.\ndrivers/cxl/core/memdev.c-649- *\n--\ndrivers/cxl/core/memdev.c-652- */\ndrivers/cxl/core/memdev.c:653:int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity)\ndrivers/cxl/core/memdev.c-654-{\n--\ndrivers/cxl/core/memdev.c-661-}\ndrivers/cxl/core/memdev.c:662:EXPORT_SYMBOL_NS_GPL(cxl_set_capacity, \"CXL\");\ndrivers/cxl/core/memdev.c-663-\n--\ndrivers/net/ethernet/sfc/efx_cxl.c=17=int efx_cxl_init(struct efx_probe_data *probe_data)\n--\ndrivers/net/ethernet/sfc/efx_cxl.c-71-\ndrivers/net/ethernet/sfc/efx_cxl.c:72:\tif (cxl_set_capacity(\u0026cxl-\u003ecxlds, EFX_CTPIO_BUFFER_SIZE)) {\ndrivers/net/ethernet/sfc/efx_cxl.c-73-\t\tpci_err(pci_dev, \"dpa capacity setup failed\\n\");\n--\ninclude/cxl/cxl.h=227=struct cxl_memdev *devm_cxl_probe_mem(struct cxl_dev_state *cxlds,\n--\ninclude/cxl/cxl.h-229-\ninclude/cxl/cxl.h:230:int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);\ninclude/cxl/cxl.h-231-#endif /* __CXL_CXL_H__ */\n"
}

gemini-3.1-pro-preview

null

null

							input: 16682
							output: 30
							thoughts: 30
						

Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person:

**Initial Assessment of Symbol Usage**

Okay, so I'm looking at this particular symbol, and my initial scan suggests it's only being used within `efx_cxl.c`. That's a pretty limited scope, which generally simplifies things, but I need to be precise. One thing that always springs to mind in these kinds of investigations is to be exhaustive in cross-referencing and verification.

However, a nagging question is already bubbling up: what about `cxl_mem_get_partition_info`? While I need to verify that it *isn't* used there, this function's scope, or similarity, has caused me to pause, and I need to investigate any potential interactions to build a complete picture. Even if the symbol isn't directly *used* within that function, there could be subtle indirect dependencies I'm missing at first glance.

{
  "Expression": "cxl_mem_get_partition_info",
  "PathPrefix": ""
}

{
  "Output": "drivers/cxl/core/core.h=104=struct cxl_memdev_state;\ndrivers/cxl/core/core.h:105:int cxl_mem_get_partition_info(struct cxl_memdev_state *mds);\ndrivers/cxl/core/core.h-106-int cxl_dpa_alloc(struct cxl_endpoint_decoder *cxled, u64 size);\n--\ndrivers/cxl/core/mbox.c=1141=EXPORT_SYMBOL_NS_GPL(cxl_mem_get_event_records, \"CXL\");\n--\ndrivers/cxl/core/mbox.c-1143-/**\ndrivers/cxl/core/mbox.c:1144: * cxl_mem_get_partition_info - Get partition info\ndrivers/cxl/core/mbox.c-1145- * @mds: The driver data for the operation\n--\ndrivers/cxl/core/mbox.c-1154- */\ndrivers/cxl/core/mbox.c:1155:int cxl_mem_get_partition_info(struct cxl_memdev_state *mds)\ndrivers/cxl/core/mbox.c-1156-{\n--\ndrivers/cxl/core/memdev.c=612=int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)\n--\ndrivers/cxl/core/memdev.c-631-\ndrivers/cxl/core/memdev.c:632:\trc = cxl_mem_get_partition_info(mds);\ndrivers/cxl/core/memdev.c-633-\tif (rc) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 17399
							output: 26
							thoughts: 558
						

**Assessing the Fuzzing Worthiness of a CXL Core Patch**

Okay, so I'm looking at this patch and my initial thought is that `cxl_mem_get_partition_info` is used in `cxl_mem_dpa_fetch`, which the CXL core exports, and I see that `cxl_mem_dpa_fetch` was moved – it looks like it went from `mbox.c` to `memdev.c`. Let's take a look at that diff, shall we?

Alright, so the files I see are:

*   In `drivers/cxl/core/mbox.c`, `cxl_mem_dpa_fetch` and `add_part` were removed.
*   And in `drivers/cxl/core/memdev.c`, they've been added.

So this is a straightforward code move of `cxl_mem_dpa_fetch`, and the associated `add_part` function, from `mbox.c` to `memdev.c`. This appears to be primarily refactoring; it doesn't seem to fundamentally alter the CXL core's functionality itself. It looks like the main reason for the move is to allow `cxl_set_capacity` to use `add_part`, which is now static within `memdev.c`.

Aha, `cxl_set_capacity` *does* use `add_part`. So it seems the core added functionality is `cxl_set_capacity` and also `efx_cxl_init` in the `sfc` driver.

Now, here's where it gets interesting: the `sfc` driver, as I recall, is for physical hardware, specifically the Solarflare SFC9100-family. There's no effective software emulation for *that*! And the prompt specifically says "Return WorthFuzzing=false if the patch only contains: ... Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim)." Since the `sfc` driver is tied to physical hardware and there's no software emulation, the new code paths are unreachable in a virtualized environment. The changes in the CXL core are essentially refactoring, with the `cxl_mem_dpa_fetch` and `add_part` movement, and then adding `cxl_set_capacity` which *only* is called by that `sfc` driver.

Therefore, since the functional changes are dependent on the `sfc` driver, which *only* works on physical hardware, this is essentially un-fuzzable in a virtualized environment.

Now, let me just double check real quick if `cxl_set_capacity` is called anywhere else.

{
  "Expression": "cxl_set_capacity",
  "PathPrefix": ""
}

{
  "Output": "drivers/cxl/core/memdev.c=644=EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, \"CXL\");\n--\ndrivers/cxl/core/memdev.c-647-/**\ndrivers/cxl/core/memdev.c:648: * cxl_set_capacity: initialize dpa by a driver without a mailbox.\ndrivers/cxl/core/memdev.c-649- *\n--\ndrivers/cxl/core/memdev.c-652- */\ndrivers/cxl/core/memdev.c:653:int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity)\ndrivers/cxl/core/memdev.c-654-{\n--\ndrivers/cxl/core/memdev.c-661-}\ndrivers/cxl/core/memdev.c:662:EXPORT_SYMBOL_NS_GPL(cxl_set_capacity, \"CXL\");\ndrivers/cxl/core/memdev.c-663-\n--\ndrivers/net/ethernet/sfc/efx_cxl.c=17=int efx_cxl_init(struct efx_probe_data *probe_data)\n--\ndrivers/net/ethernet/sfc/efx_cxl.c-71-\ndrivers/net/ethernet/sfc/efx_cxl.c:72:\tif (cxl_set_capacity(\u0026cxl-\u003ecxlds, EFX_CTPIO_BUFFER_SIZE)) {\ndrivers/net/ethernet/sfc/efx_cxl.c-73-\t\tpci_err(pci_dev, \"dpa capacity setup failed\\n\");\n--\ninclude/cxl/cxl.h=227=struct cxl_memdev *devm_cxl_probe_mem(struct cxl_dev_state *cxlds,\n--\ninclude/cxl/cxl.h-229-\ninclude/cxl/cxl.h:230:int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);\ninclude/cxl/cxl.h-231-#endif /* __CXL_CXL_H__ */\n"
}

gemini-3.1-pro-preview

null

null

							input: 19165
							output: 27
							thoughts: 105
						

**Analyzing the Potential for CXL Emulation in the sfc Driver**

Okay, so I've identified the call in `efx_cxl.c`, and I know that this file is part of the `sfc` driver. My initial thought is: could we potentially probe or interact with the `sfc` driver using some form of generic CXL emulation? It's a long shot, but worth considering the possibilities.

The `sfc` driver, as I recall, ties itself to specific PCI vendor and device IDs. This means a direct, unmediated emulation might be tricky. Let me double-check the PCI ID table, `efx_pci_table`, which should reside in `drivers/net/ethernet/sfc/efx.c`. Seeing this table will confirm the PCI IDs and the level of direct interaction that is possible. It will help me evaluate whether the CXL interaction is solely dependent on PCI IDs or if there are other access methods. This is a critical step in assessing the feasibility of any emulation approach.

{
  "Expression": "efx_pci_table",
  "PathPrefix": ""
}

{
  "Output": "drivers/net/ethernet/sfc/efx.c=863=static void efx_unregister_netdev(struct efx_nic *efx)\n--\ndrivers/net/ethernet/sfc/efx.c-885-/* PCI device ID table */\ndrivers/net/ethernet/sfc/efx.c:886:static const struct pci_device_id efx_pci_table[] = {\ndrivers/net/ethernet/sfc/efx.c-887-\t{PCI_DEVICE(PCI_VENDOR_ID_SOLARFLARE, 0x0903),  /* SFC9120 PF */\n--\ndrivers/net/ethernet/sfc/efx.c=1408=static struct pci_driver efx_pci_driver = {\ndrivers/net/ethernet/sfc/efx.c-1409-\t.name\t\t= KBUILD_MODNAME,\ndrivers/net/ethernet/sfc/efx.c:1410:\t.id_table\t= efx_pci_table,\ndrivers/net/ethernet/sfc/efx.c-1411-\t.probe\t\t= efx_pci_probe,\n--\ndrivers/net/ethernet/sfc/efx.c=1478=MODULE_LICENSE(\"GPL\");\ndrivers/net/ethernet/sfc/efx.c:1479:MODULE_DEVICE_TABLE(pci, efx_pci_table);\n--\ndrivers/net/ethernet/sfc/siena/efx.c=783=static void efx_unregister_netdev(struct efx_nic *efx)\n--\ndrivers/net/ethernet/sfc/siena/efx.c-804-/* PCI device ID table */\ndrivers/net/ethernet/sfc/siena/efx.c:805:static const struct pci_device_id efx_pci_table[] = {\ndrivers/net/ethernet/sfc/siena/efx.c-806-\t{PCI_DEVICE(PCI_VENDOR_ID_SOLARFLARE, 0x0803),\t/* SFC9020 */\n--\ndrivers/net/ethernet/sfc/siena/efx.c=1273=static struct pci_driver efx_pci_driver = {\ndrivers/net/ethernet/sfc/siena/efx.c-1274-\t.name\t\t= KBUILD_MODNAME,\ndrivers/net/ethernet/sfc/siena/efx.c:1275:\t.id_table\t= efx_pci_table,\ndrivers/net/ethernet/sfc/siena/efx.c-1276-\t.probe\t\t= efx_pci_probe,\n--\ndrivers/net/ethernet/sfc/siena/efx.c=1349=MODULE_LICENSE(\"GPL\");\ndrivers/net/ethernet/sfc/siena/efx.c:1350:MODULE_DEVICE_TABLE(pci, efx_pci_table);\n"
}

gemini-3.1-pro-preview

null

null

							input: 20297
							output: 110
							thoughts: 256
						

**WorthFuzzing=false: Solarflare-Specific Hardware Dependencies**

Okay, so looking at this patch, it's pretty clear. The code being introduced here is all tied directly to the Solarflare SFC9100 network driver. I remember those PCI IDs, `PCI_VENDOR_ID_SOLARFLARE, 0x0903`, they're specific to their hardware. And QEMU, the environment we're working with for fuzzing, doesn't emulate that. There's no generic PCI device emulator in syzkaller to just whip up a mock of that hardware either.

Therefore, since the driver *requires* actual physical Solarflare hardware, the new CXL support code, which this patch introduces, is simply unreachable in a virtualized QEMU setup. It doesn't matter that some of the changes are just refactoring in the CXL core, or that they are general, this CXL core refactoring is not triggered, accessible or reached without the SFC driver first.

This confirms what I expected; this patch falls squarely into the "impossible to reach in virtualized environments" category. No need to waste time fuzzing this one. WorthFuzzing=false it is.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch adds CXL support to the Solarflare SFC9100-family network driver (sfc) and introduces a helper function in the CXL core for it. The sfc driver requires physical Solarflare PCI hardware which is not emulated in QEMU or other virtualized environments used by syzkaller. Therefore, the new code paths are impossible to reach and fuzz.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds CXL support to the Solarflare SFC9100-family network driver (sfc) and introduces a helper function in the CXL core for it. The sfc driver requires physical Solarflare PCI hardware which is not emulated in QEMU or other virtualized environments used by syzkaller. Therefore, the new code paths are impossible to reach and fuzz.",
  "WorthFuzzing": false
}