AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Microsoft Azure Network Adapter (MANA) driver to add support for CQE 8-packet coalescing. MANA is a vendor-specific PCIe SmartNIC device that is not emulated in standard QEMU environments, so this code cannot be reached or tested by the fuzzer.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit d7a40100b73f7b0819edbeae84ed8c54b7f7b27f\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Aug 2 06:19:43 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c\nindex a80cf0bc462cf..a3c29077daf5f 100644\n--- a/drivers/net/ethernet/microsoft/mana/mana_en.c\n+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c\n@@ -1241,6 +1241,9 @@ int mana_gd_query_device_cfg(struct gdma_context *gc, u32 proto_major_ver,\n \t\treturn err;\n \t}\n \n+\tgc-\u003ecqe8_coalescing_sup = !!(resp.pf_cap_flags1 \u0026\n+\t\t\t\t     MANA_PF_FLAG_1_CQE_8_COALESCING_SUPPORTED);\n+\n \t*max_num_vports = resp.max_num_vports;\n \n \tif (resp.hdr.response.msg_version \u003e= GDMA_MESSAGE_V2) {\n@@ -1426,7 +1429,11 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,\n \tmana_gd_init_req_hdr(\u0026req-\u003ehdr, MANA_CONFIG_VPORT_RX, req_buf_size,\n \t\t\t     sizeof(resp));\n \n-\treq-\u003ehdr.req.msg_version = GDMA_MESSAGE_V2;\n+\t/* Request \u0026 response versions can be different.\n+\t * HW can handle newer msg versions, by skipping\n+\t * new fields.\n+\t */\n+\treq-\u003ehdr.req.msg_version = GDMA_MESSAGE_V5;\n \treq-\u003ehdr.resp.msg_version = GDMA_MESSAGE_V2;\n \n \treq-\u003evport = apc-\u003eport_handle;\n@@ -1440,8 +1447,13 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,\n \treq-\u003eupdate_indir_tab = update_tab;\n \treq-\u003edefault_rxobj = apc-\u003edefault_rxobj;\n \n-\tif (rx != TRI_STATE_FALSE)\n+\t/* Request-msg v5 requires this field */\n+\treq-\u003erss_hash_types = MANA_HASH_ENABLE_SUPPORTED;\n+\n+\tif (rx != TRI_STATE_FALSE) {\n \t\treq-\u003ecqe_coalescing_enable = apc-\u003ecqe_coalescing_enable;\n+\t\treq-\u003ecqe8_coalescing_enable = apc-\u003ecqe8_coalescing_enable;\n+\t}\n \n \tif (update_key)\n \t\tmemcpy(\u0026req-\u003ehashkey, apc-\u003ehashkey, MANA_HASH_KEY_SIZE);\n@@ -2046,16 +2058,14 @@ static struct sk_buff *mana_build_skb(struct mana_rxq *rxq, void *buf_va,\n \n static void mana_rx_skb(void *buf_va, bool from_pool,\n \t\t\tstruct mana_rxcomp_oob *cqe, struct mana_rxq *rxq,\n-\t\t\tint i)\n+\t\t\tu32 pkt_len, u32 pkt_hash)\n {\n \tstruct mana_stats_rx *rx_stats = \u0026rxq-\u003estats;\n \tstruct net_device *ndev = rxq-\u003endev;\n-\tuint pkt_len = cqe-\u003eppi[i].pkt_len;\n \tu16 rxq_idx = rxq-\u003erxq_idx;\n \tstruct napi_struct *napi;\n \tstruct xdp_buff xdp = {};\n \tstruct sk_buff *skb;\n-\tu32 hash_value;\n \tu32 act;\n \n \trxq-\u003erx_cq.work_done++;\n@@ -2094,12 +2104,10 @@ static void mana_rx_skb(void *buf_va, bool from_pool,\n \t}\n \n \tif (cqe-\u003erx_hashtype != 0 \u0026\u0026 (ndev-\u003efeatures \u0026 NETIF_F_RXHASH)) {\n-\t\thash_value = cqe-\u003eppi[i].pkt_hash;\n-\n \t\tif (cqe-\u003erx_hashtype \u0026 MANA_HASH_L4)\n-\t\t\tskb_set_hash(skb, hash_value, PKT_HASH_TYPE_L4);\n+\t\t\tskb_set_hash(skb, pkt_hash, PKT_HASH_TYPE_L4);\n \t\telse\n-\t\t\tskb_set_hash(skb, hash_value, PKT_HASH_TYPE_L3);\n+\t\t\tskb_set_hash(skb, pkt_hash, PKT_HASH_TYPE_L3);\n \t}\n \n \tif (cqe-\u003erx_vlantag_present) {\n@@ -2240,6 +2248,43 @@ static void mana_refill_rx_oob(struct device *dev, struct mana_rxq *rxq,\n \trxoob-\u003edma_sync_offset = dma_sync_offset;\n }\n \n+static void mana_process_one_rx_pkt(struct device *dev, struct mana_rxq *rxq,\n+\t\t\t\t    struct mana_rxcomp_oob *oob,\n+\t\t\t\t    u32 pktlen, u32 pkt_hash)\n+{\n+\tstruct mana_recv_buf_oob *rxbuf_oob;\n+\tstruct net_device *ndev = rxq-\u003endev;\n+\tvoid *old_buf = NULL;\n+\tbool old_fp;\n+\n+\trxbuf_oob = \u0026rxq-\u003erx_oobs[rxq-\u003ebuf_index];\n+\tWARN_ON_ONCE(rxbuf_oob-\u003ewqe_inf.wqe_size_in_bu != 1);\n+\n+\tif (unlikely(pktlen \u003e rxq-\u003edatasize)) {\n+\t\t/* Increase it even if mana_rx_skb() isn't called. */\n+\t\trxq-\u003erx_cq.work_done++;\n+\n+\t\t++ndev-\u003estats.rx_dropped;\n+\t\tnetdev_warn_once(ndev,\n+\t\t\t\t \"Dropped oversized RX packet: len=%u, datasize=%u\\n\",\n+\t\t\t\t pktlen, rxq-\u003edatasize);\n+\n+\t\t/* Reuse the RX buffer since rxbuf_oob is unchanged. */\n+\t} else {\n+\t\tmana_refill_rx_oob(dev, rxq, rxbuf_oob, pktlen,\n+\t\t\t\t   \u0026old_buf, \u0026old_fp);\n+\n+\t\t/* Unsuccessful refill will have old_buf == NULL.\n+\t\t * In this case, mana_rx_skb() will drop the packet.\n+\t\t */\n+\t\tmana_rx_skb(old_buf, old_fp, oob, rxq, pktlen, pkt_hash);\n+\t}\n+\n+\tmana_move_wq_tail(rxq-\u003egdma_rq, rxbuf_oob-\u003ewqe_inf.wqe_size_in_bu);\n+\n+\tmana_post_pkt_rxq(rxq);\n+}\n+\n static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,\n \t\t\t\tstruct gdma_comp *cqe)\n {\n@@ -2249,10 +2294,10 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,\n \tstruct mana_recv_buf_oob *rxbuf_oob;\n \tstruct mana_port_context *apc;\n \tstruct device *dev = gc-\u003edev;\n+\tbool coalesced_8 = false;\n \tbool coalesced = false;\n-\tvoid *old_buf = NULL;\n-\tu32 curr, pktlen;\n-\tbool old_fp;\n+\tu32 pktlen;\n+\tint pkt_i;\n \tint i;\n \n \tapc = netdev_priv(ndev);\n@@ -2275,6 +2320,11 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,\n \t\tcoalesced = true;\n \t\tbreak;\n \n+\tcase CQE_RX_COALESCED_8:\n+\t\tcoalesced = true;\n+\t\tcoalesced_8 = true;\n+\t\tbreak;\n+\n \tcase CQE_RX_OBJECT_FENCE:\n \t\tcomplete(\u0026rxq-\u003efence_event);\n \t\treturn;\n@@ -2286,54 +2336,48 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,\n \t\treturn;\n \t}\n \n+\tpkt_i = 0;\n \tfor (i = 0; i \u003c MANA_RXCOMP_OOB_NUM_PPI; i++) {\n-\t\told_buf = NULL;\n-\t\tpktlen = oob-\u003eppi[i].pkt_len;\n-\t\tif (pktlen == 0)\n-\t\t\tbreak;\n-\n-\t\tcurr = rxq-\u003ebuf_index;\n-\t\trxbuf_oob = \u0026rxq-\u003erx_oobs[curr];\n-\t\tWARN_ON_ONCE(rxbuf_oob-\u003ewqe_inf.wqe_size_in_bu != 1);\n-\n-\t\tif (unlikely(pktlen \u003e rxq-\u003edatasize)) {\n-\t\t\t/* Increase it even if mana_rx_skb() isn't called. */\n-\t\t\trxq-\u003erx_cq.work_done++;\n+\t\tu32 pkt_hash;\n \n-\t\t\t++ndev-\u003estats.rx_dropped;\n-\t\t\tnetdev_warn_once(ndev,\n-\t\t\t\t\"Dropped oversized RX packet: len=%u, datasize=%u\\n\",\n-\t\t\t\tpktlen, rxq-\u003edatasize);\n-\n-\t\t\t/* Reuse the RX buffer since rxbuf_oob is unchanged. */\n+\t\tif (coalesced_8) {\n+\t\t\t/* 8-pkt mode: 2 packets per PPI entry */\n+\t\t\tpktlen = oob-\u003eppi[i].pkt_len0;\n+\t\t\tpkt_hash = oob-\u003eppi[i].pkt_hash0;\n \t\t} else {\n-\n-\t\t\tmana_refill_rx_oob(dev, rxq, rxbuf_oob, pktlen,\n-\t\t\t\t\t   \u0026old_buf, \u0026old_fp);\n-\n-\t\t\t/* Unsuccessful refill will have old_buf == NULL.\n-\t\t\t * In this case, mana_rx_skb() will drop the packet.\n-\t\t\t */\n-\t\t\tmana_rx_skb(old_buf, old_fp, oob, rxq, i);\n+\t\t\tpktlen = oob-\u003eppi[i].pkt_len;\n+\t\t\tpkt_hash = oob-\u003eppi[i].pkt_hash;\n \t\t}\n+\t\tif (pktlen == 0)\n+\t\t\tbreak;\n \n-\t\tmana_move_wq_tail(rxq-\u003egdma_rq,\n-\t\t\t\t  rxbuf_oob-\u003ewqe_inf.wqe_size_in_bu);\n-\n-\t\tmana_post_pkt_rxq(rxq);\n+\t\tmana_process_one_rx_pkt(dev, rxq, oob, pktlen, pkt_hash);\n+\t\tpkt_i++;\n \n \t\tif (!coalesced)\n \t\t\tbreak;\n+\n+\t\t/* Process 2nd packet from the same PPI in 8-pkt mode */\n+\t\tif (coalesced_8) {\n+\t\t\tpktlen = oob-\u003eppi[i].pkt_len1;\n+\t\t\tpkt_hash = oob-\u003eppi[i].pkt_hash1;\n+\t\t\tif (pktlen == 0)\n+\t\t\t\tbreak;\n+\n+\t\t\tmana_process_one_rx_pkt(dev, rxq, oob, pktlen,\n+\t\t\t\t\t\tpkt_hash);\n+\t\t\tpkt_i++;\n+\t\t}\n \t}\n \n \t/* Collect coalesced CQE count based on packets processed.\n-\t * Coalesced CQEs have at least 2 packets, so index is i - 2.\n+\t * Coalesced CQEs have at least 2 packets, so index is pkt_i - 2.\n \t */\n-\tif (i \u003e 1) {\n+\tif (pkt_i \u003e 1) {\n \t\tu64_stats_update_begin(\u0026rxq-\u003estats.syncp);\n-\t\trxq-\u003estats.coalesced_cqe[i - 2]++;\n+\t\trxq-\u003estats.coalesced_cqe[pkt_i - 2]++;\n \t\tu64_stats_update_end(\u0026rxq-\u003estats.syncp);\n-\t} else if (!i \u0026\u0026 !pktlen) {\n+\t} else if (!pkt_i \u0026\u0026 !pktlen) {\n \t\tu64_stats_update_begin(\u0026rxq-\u003estats.syncp);\n \t\trxq-\u003estats.pkt_len0_err++;\n \t\tu64_stats_update_end(\u0026rxq-\u003estats.syncp);\n@@ -3763,6 +3807,7 @@ static int mana_probe_port(struct mana_context *ac, int port_idx,\n \tapc-\u003eport_idx = port_idx;\n \tapc-\u003elink_cfg_error = 1;\n \tapc-\u003ecqe_coalescing_enable = 0;\n+\tapc-\u003ecqe8_coalescing_enable = 0;\n \n \t/* Initialize interrupt moderation settings if supported by HW */\n \tif (gc-\u003epf_cap_flags1 \u0026 GDMA_PF_CAP_FLAG_1_DYN_INTERRUPT_MODERATION) {\ndiff --git a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c\nindex 9e31e2595ae32..04f877707cc6a 100644\n--- a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c\n+++ b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c\n@@ -169,7 +169,7 @@ static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data)\n \t\tethtool_sprintf(\u0026data, \"rx_%d_xdp_tx\", i);\n \t\tethtool_sprintf(\u0026data, \"rx_%d_xdp_redirect\", i);\n \t\tethtool_sprintf(\u0026data, \"rx_%d_pkt_len0_err\", i);\n-\t\tfor (j = 0; j \u003c MANA_RXCOMP_OOB_NUM_PPI - 1; j++)\n+\t\tfor (j = 0; j \u003c MANA_CQE_COAL_PKTS_8 - 1; j++)\n \t\t\tethtool_sprintf(\u0026data, \"rx_%d_coalesced_cqe_%d\", i, j + 2);\n \t}\n \n@@ -205,7 +205,7 @@ static void mana_get_ethtool_stats(struct net_device *ndev,\n \tu64 xdp_drop;\n \tu64 xdp_tx;\n \tu64 pkt_len0_err;\n-\tu64 coalesced_cqe[MANA_RXCOMP_OOB_NUM_PPI - 1];\n+\tu64 coalesced_cqe[MANA_CQE_COAL_PKTS_8 - 1];\n \tu64 tso_packets;\n \tu64 tso_bytes;\n \tu64 tso_inner_packets;\n@@ -245,7 +245,7 @@ static void mana_get_ethtool_stats(struct net_device *ndev,\n \t\t\txdp_tx = rx_stats-\u003exdp_tx;\n \t\t\txdp_redirect = rx_stats-\u003exdp_redirect;\n \t\t\tpkt_len0_err = rx_stats-\u003epkt_len0_err;\n-\t\t\tfor (j = 0; j \u003c MANA_RXCOMP_OOB_NUM_PPI - 1; j++)\n+\t\t\tfor (j = 0; j \u003c MANA_CQE_COAL_PKTS_8 - 1; j++)\n \t\t\t\tcoalesced_cqe[j] = rx_stats-\u003ecoalesced_cqe[j];\n \t\t} while (u64_stats_fetch_retry(\u0026rx_stats-\u003esyncp, start));\n \n@@ -255,7 +255,7 @@ static void mana_get_ethtool_stats(struct net_device *ndev,\n \t\tdata[i++] = xdp_tx;\n \t\tdata[i++] = xdp_redirect;\n \t\tdata[i++] = pkt_len0_err;\n-\t\tfor (j = 0; j \u003c MANA_RXCOMP_OOB_NUM_PPI - 1; j++)\n+\t\tfor (j = 0; j \u003c MANA_CQE_COAL_PKTS_8 - 1; j++)\n \t\t\tdata[i++] = coalesced_cqe[j];\n \t}\n \n@@ -408,6 +408,7 @@ static int mana_get_coalesce(struct net_device *ndev,\n \tstruct mana_port_context *apc = netdev_priv(ndev);\n \n \tkernel_coal-\u003erx_cqe_frames =\n+\t\tapc-\u003ecqe8_coalescing_enable ? MANA_CQE_COAL_PKTS_8 :\n \t\tapc-\u003ecqe_coalescing_enable ? MANA_RXCOMP_OOB_NUM_PPI : 1;\n \n \tkernel_coal-\u003erx_cqe_nsecs = apc-\u003ecqe_coalescing_timeout_ns;\n@@ -443,15 +444,19 @@ static int mana_set_coalesce(struct net_device *ndev,\n \t\tu16 intr_modr_tx_usec;\n \t\tu16 intr_modr_tx_comp;\n \t\tu8 cqe_coalescing_enable;\n+\t\tu8 cqe8_coalescing_enable;\n \t\tbool rx_dim_enabled;\n \t\tbool tx_dim_enabled;\n \t} saved;\n \tbool modr_changed = false;\n \tbool dim_changed = false;\n \tstruct gdma_context *gc;\n+\tu32 max_cqe_frames;\n \tint err;\n \n \tgc = apc-\u003eac-\u003egdma_dev-\u003egdma_context;\n+\tmax_cqe_frames = gc-\u003ecqe8_coalescing_sup ? MANA_CQE_COAL_PKTS_8 :\n+\t\t\t\t\t\t   MANA_RXCOMP_OOB_NUM_PPI;\n \n \t/* Both static and dynamic interrupt moderation (DIM) rely on the\n \t * same HW capability advertised by the PF.\n@@ -466,10 +471,12 @@ static int mana_set_coalesce(struct net_device *ndev,\n \t}\n \n \tif (kernel_coal-\u003erx_cqe_frames != 1 \u0026\u0026\n-\t    kernel_coal-\u003erx_cqe_frames != MANA_RXCOMP_OOB_NUM_PPI) {\n+\t    kernel_coal-\u003erx_cqe_frames != MANA_RXCOMP_OOB_NUM_PPI \u0026\u0026\n+\t    kernel_coal-\u003erx_cqe_frames != max_cqe_frames) {\n \t\tNL_SET_ERR_MSG_FMT(extack,\n-\t\t\t\t   \"rx-frames must be 1 or %u, got %u\",\n+\t\t\t\t   \"rx-frames must be 1 or %u%s, got %u\",\n \t\t\t\t   MANA_RXCOMP_OOB_NUM_PPI,\n+\t\t\t\t   gc-\u003ecqe8_coalescing_sup ? \" or 8\" : \"\",\n \t\t\t\t   kernel_coal-\u003erx_cqe_frames);\n \t\treturn -EINVAL;\n \t}\n@@ -514,8 +521,11 @@ static int mana_set_coalesce(struct net_device *ndev,\n \tsaved.tx_dim_enabled = apc-\u003etx_dim_enabled;\n \n \tsaved.cqe_coalescing_enable = apc-\u003ecqe_coalescing_enable;\n+\tsaved.cqe8_coalescing_enable = apc-\u003ecqe8_coalescing_enable;\n \tapc-\u003ecqe_coalescing_enable =\n-\t\tkernel_coal-\u003erx_cqe_frames == MANA_RXCOMP_OOB_NUM_PPI;\n+\t\tkernel_coal-\u003erx_cqe_frames \u003e= MANA_RXCOMP_OOB_NUM_PPI;\n+\tapc-\u003ecqe8_coalescing_enable =\n+\t\tkernel_coal-\u003erx_cqe_frames == MANA_CQE_COAL_PKTS_8;\n \n \tif (!apc-\u003eport_is_up) {\n \t\tWRITE_ONCE(apc-\u003erx_dim_enabled, !!ec-\u003euse_adaptive_rx_coalesce);\n@@ -523,7 +533,8 @@ static int mana_set_coalesce(struct net_device *ndev,\n \t\treturn 0;\n \t}\n \n-\tif (apc-\u003ecqe_coalescing_enable != saved.cqe_coalescing_enable) {\n+\tif (apc-\u003ecqe_coalescing_enable != saved.cqe_coalescing_enable ||\n+\t    apc-\u003ecqe8_coalescing_enable != saved.cqe8_coalescing_enable) {\n \t\t/* CQE coalescing setting is applied via RSS configuration. */\n \t\terr = mana_config_rss(apc, TRI_STATE_TRUE, false, false);\n \t\tif (err) {\n@@ -531,6 +542,8 @@ static int mana_set_coalesce(struct net_device *ndev,\n \t\t\t\t   err);\n \t\t\tapc-\u003ecqe_coalescing_enable =\n \t\t\t\tsaved.cqe_coalescing_enable;\n+\t\t\tapc-\u003ecqe8_coalescing_enable =\n+\t\t\t\tsaved.cqe8_coalescing_enable;\n \t\t\tapc-\u003eintr_modr_rx_usec = saved.intr_modr_rx_usec;\n \t\t\tapc-\u003eintr_modr_rx_comp = saved.intr_modr_rx_comp;\n \t\t\tapc-\u003eintr_modr_tx_usec = saved.intr_modr_tx_usec;\ndiff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h\nindex 8529cef0d7c45..70a7f1fee5d3b 100644\n--- a/include/net/mana/gdma.h\n+++ b/include/net/mana/gdma.h\n@@ -182,6 +182,7 @@ struct gdma_general_req {\n #define GDMA_MESSAGE_V2 2\n #define GDMA_MESSAGE_V3 3\n #define GDMA_MESSAGE_V4 4\n+#define GDMA_MESSAGE_V5 5\n \n struct gdma_general_resp {\n \tstruct gdma_resp_hdr hdr;\n@@ -428,6 +429,9 @@ struct gdma_context {\n \t/* L2 MTU */\n \tu16 adapter_mtu;\n \n+\t/* NIC supports CQE x8 coalescing */\n+\tbool cqe8_coalescing_sup;\n+\n \t/* This maps a CQ index to the queue structure. */\n \tunsigned int\t\tmax_num_cqs;\n \tstruct gdma_queue\t**cq_table;\ndiff --git a/include/net/mana/mana.h b/include/net/mana/mana.h\nindex 4d041fb8437f5..50acb6bf8f125 100644\n--- a/include/net/mana/mana.h\n+++ b/include/net/mana/mana.h\n@@ -62,9 +62,12 @@ enum TRI_STATE {\n \n #define MAX_PORTS_IN_MANA_DEV 256\n \n-/* Maximum number of packets per coalesced CQE */\n+/* Maximum number of PPIs per coalesced CQE */\n #define MANA_RXCOMP_OOB_NUM_PPI 4\n \n+/* 8-pkt mode packs up to 2 packets per PPI entry */\n+#define MANA_CQE_COAL_PKTS_8 8\n+\n /* Default/max interrupt moderation settings */\n #define MANA_INTR_MODR_USEC_DEF 0\n #define MANA_INTR_MODR_COMP_DEF 0\n@@ -79,7 +82,7 @@ enum TRI_STATE {\n #define MANA_INTR_MODR_COMP_MASK   GENMASK(23, 16)\n \n /* Update this count whenever the respective structures are changed */\n-#define MANA_STATS_RX_COUNT (6 + MANA_RXCOMP_OOB_NUM_PPI - 1)\n+#define MANA_STATS_RX_COUNT (6 + MANA_CQE_COAL_PKTS_8 - 1)\n #define MANA_STATS_TX_COUNT 11\n \n #define MANA_RX_FRAG_ALIGNMENT 64\n@@ -91,7 +94,7 @@ struct mana_stats_rx {\n \tu64 xdp_tx;\n \tu64 xdp_redirect;\n \tu64 pkt_len0_err;\n-\tu64 coalesced_cqe[MANA_RXCOMP_OOB_NUM_PPI - 1];\n+\tu64 coalesced_cqe[MANA_CQE_COAL_PKTS_8 - 1];\n \tstruct u64_stats_sync syncp;\n };\n \n@@ -202,6 +205,7 @@ enum mana_cqe_type {\n \tCQE_RX_COALESCED_4\t\t= 2,\n \tCQE_RX_OBJECT_FENCE\t\t= 3,\n \tCQE_RX_TRUNCATED\t\t= 4,\n+\tCQE_RX_COALESCED_8\t\t= 7,\n \n \tCQE_TX_OKAY\t\t\t= 32,\n \tCQE_TX_SA_DROP\t\t\t= 33,\n@@ -238,12 +242,26 @@ struct mana_cqe_header {\n #define MANA_HASH_L4                                                         \\\n \t(NDIS_HASH_TCP_IPV4 | NDIS_HASH_UDP_IPV4 | NDIS_HASH_TCP_IPV6 |      \\\n \t NDIS_HASH_UDP_IPV6 | NDIS_HASH_TCP_IPV6_EX | NDIS_HASH_UDP_IPV6_EX)\n+#define MANA_HASH_ENABLE_SUPPORTED \\\n+\t(NDIS_HASH_IPV4 | NDIS_HASH_TCP_IPV4 | NDIS_HASH_UDP_IPV4 | \\\n+\t NDIS_HASH_IPV6 | NDIS_HASH_TCP_IPV6 | NDIS_HASH_UDP_IPV6)\n+\n+/* Read PPI in two different layouts based on cqe_type */\n+union mana_rxcomp_perpkt_info {\n+\tstruct {\n+\t\tu32 pkt_len : 16;\n+\t\tu32 reserved1 : 16;\n+\t\tu32 reserved2;\n+\t\tu32 pkt_hash;\n+\t};\n \n-struct mana_rxcomp_perpkt_info {\n-\tu32 pkt_len\t: 16;\n-\tu32 reserved1\t: 16;\n-\tu32 reserved2;\n-\tu32 pkt_hash;\n+\t/* Up to two pkts per PPI entry */\n+\tstruct {\n+\t\tu32 pkt_hash0;\n+\t\tu16 pkt_len0;\n+\t\tu16 pkt_len1;\n+\t\tu32 pkt_hash1;\n+\t};\n }; /* HW DATA */\n \n /* Receive completion OOB */\n@@ -264,7 +282,7 @@ struct mana_rxcomp_oob {\n \tu32 rx_udp_csum_fail\t\t: 1;\n \tu32 reserved2\t\t\t: 1;\n \n-\tstruct mana_rxcomp_perpkt_info ppi[MANA_RXCOMP_OOB_NUM_PPI];\n+\tunion mana_rxcomp_perpkt_info ppi[MANA_RXCOMP_OOB_NUM_PPI];\n \n \tu32 rx_wqe_offset;\n }; /* HW DATA */\n@@ -607,6 +625,7 @@ struct mana_port_context {\n \tbool port_st_save; /* Saved port state */\n \n \tu8 cqe_coalescing_enable;\n+\tu8 cqe8_coalescing_enable;\n \tu32 cqe_coalescing_timeout_ns;\n \n \t/* Interrupt moderation settings */\n@@ -751,6 +770,8 @@ struct mana_query_device_cfg_req {\n \tu32 reserved;\n }; /* HW DATA */\n \n+#define MANA_PF_FLAG_1_CQE_8_COALESCING_SUPPORTED BIT(5)\n+\n struct mana_query_device_cfg_resp {\n \tstruct gdma_resp_hdr hdr;\n \n@@ -986,7 +1007,10 @@ struct mana_cfg_rx_steer_req_v2 {\n \tmana_handle_t default_rxobj;\n \tu8 hashkey[MANA_HASH_KEY_SIZE];\n \tu8 cqe_coalescing_enable;\n-\tu8 reserved2[7];\n+\tu8 reserved2[3];\n+\tu16 rss_hash_types;\n+\tu8 cqe8_coalescing_enable; /* v5 message */\n+\tu8 reserved3;\n \tmana_handle_t indir_tab[] __counted_by(num_indir_entries);\n }; /* HW DATA */\n \n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Microsoft Azure Network Adapter (MANA) driver to add support for CQE 8-packet coalescing. MANA is a vendor-specific PCIe SmartNIC device that is not emulated in standard QEMU environments, so this code cannot be reached or tested by the fuzzer.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit d7a40100b73f7b0819edbeae84ed8c54b7f7b27f
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Aug 2 06:19:43 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index a80cf0bc462cf..a3c29077daf5f 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -1241,6 +1241,9 @@ int mana_gd_query_device_cfg(struct gdma_context *gc, u32 proto_major_ver,
 		return err;
 	}
 
+	gc->cqe8_coalescing_sup = !!(resp.pf_cap_flags1 &
+				     MANA_PF_FLAG_1_CQE_8_COALESCING_SUPPORTED);
+
 	*max_num_vports = resp.max_num_vports;
 
 	if (resp.hdr.response.msg_version >= GDMA_MESSAGE_V2) {
@@ -1426,7 +1429,11 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
 	mana_gd_init_req_hdr(&req->hdr, MANA_CONFIG_VPORT_RX, req_buf_size,
 			     sizeof(resp));
 
-	req->hdr.req.msg_version = GDMA_MESSAGE_V2;
+	/* Request & response versions can be different.
+	 * HW can handle newer msg versions, by skipping
+	 * new fields.
+	 */
+	req->hdr.req.msg_version = GDMA_MESSAGE_V5;
 	req->hdr.resp.msg_version = GDMA_MESSAGE_V2;
 
 	req->vport = apc->port_handle;
@@ -1440,8 +1447,13 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
 	req->update_indir_tab = update_tab;
 	req->default_rxobj = apc->default_rxobj;
 
-	if (rx != TRI_STATE_FALSE)
+	/* Request-msg v5 requires this field */
+	req->rss_hash_types = MANA_HASH_ENABLE_SUPPORTED;
+
+	if (rx != TRI_STATE_FALSE) {
 		req->cqe_coalescing_enable = apc->cqe_coalescing_enable;
+		req->cqe8_coalescing_enable = apc->cqe8_coalescing_enable;
+	}
 
 	if (update_key)
 		memcpy(&req->hashkey, apc->hashkey, MANA_HASH_KEY_SIZE);
@@ -2046,16 +2058,14 @@ static struct sk_buff *mana_build_skb(struct mana_rxq *rxq, void *buf_va,
 
 static void mana_rx_skb(void *buf_va, bool from_pool,
 			struct mana_rxcomp_oob *cqe, struct mana_rxq *rxq,
-			int i)
+			u32 pkt_len, u32 pkt_hash)
 {
 	struct mana_stats_rx *rx_stats = &rxq->stats;
 	struct net_device *ndev = rxq->ndev;
-	uint pkt_len = cqe->ppi[i].pkt_len;
 	u16 rxq_idx = rxq->rxq_idx;
 	struct napi_struct *napi;
 	struct xdp_buff xdp = {};
 	struct sk_buff *skb;
-	u32 hash_value;
 	u32 act;
 
 	rxq->rx_cq.work_done++;
@@ -2094,12 +2104,10 @@ static void mana_rx_skb(void *buf_va, bool from_pool,
 	}
 
 	if (cqe->rx_hashtype != 0 && (ndev->features & NETIF_F_RXHASH)) {
-		hash_value = cqe->ppi[i].pkt_hash;
-
 		if (cqe->rx_hashtype & MANA_HASH_L4)
-			skb_set_hash(skb, hash_value, PKT_HASH_TYPE_L4);
+			skb_set_hash(skb, pkt_hash, PKT_HASH_TYPE_L4);
 		else
-			skb_set_hash(skb, hash_value, PKT_HASH_TYPE_L3);
+			skb_set_hash(skb, pkt_hash, PKT_HASH_TYPE_L3);
 	}
 
 	if (cqe->rx_vlantag_present) {
@@ -2240,6 +2248,43 @@ static void mana_refill_rx_oob(struct device *dev, struct mana_rxq *rxq,
 	rxoob->dma_sync_offset = dma_sync_offset;
 }
 
+static void mana_process_one_rx_pkt(struct device *dev, struct mana_rxq *rxq,
+				    struct mana_rxcomp_oob *oob,
+				    u32 pktlen, u32 pkt_hash)
+{
+	struct mana_recv_buf_oob *rxbuf_oob;
+	struct net_device *ndev = rxq->ndev;
+	void *old_buf = NULL;
+	bool old_fp;
+
+	rxbuf_oob = &rxq->rx_oobs[rxq->buf_index];
+	WARN_ON_ONCE(rxbuf_oob->wqe_inf.wqe_size_in_bu != 1);
+
+	if (unlikely(pktlen > rxq->datasize)) {
+		/* Increase it even if mana_rx_skb() isn't called. */
+		rxq->rx_cq.work_done++;
+
+		++ndev->stats.rx_dropped;
+		netdev_warn_once(ndev,
+				 "Dropped oversized RX packet: len=%u, datasize=%u\n",
+				 pktlen, rxq->datasize);
+
+		/* Reuse the RX buffer since rxbuf_oob is unchanged. */
+	} else {
+		mana_refill_rx_oob(dev, rxq, rxbuf_oob, pktlen,
+				   &old_buf, &old_fp);
+
+		/* Unsuccessful refill will have old_buf == NULL.
+		 * In this case, mana_rx_skb() will drop the packet.
+		 */
+		mana_rx_skb(old_buf, old_fp, oob, rxq, pktlen, pkt_hash);
+	}
+
+	mana_move_wq_tail(rxq->gdma_rq, rxbuf_oob->wqe_inf.wqe_size_in_bu);
+
+	mana_post_pkt_rxq(rxq);
+}
+
 static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,
 				struct gdma_comp *cqe)
 {
@@ -2249,10 +2294,10 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,
 	struct mana_recv_buf_oob *rxbuf_oob;
 	struct mana_port_context *apc;
 	struct device *dev = gc->dev;
+	bool coalesced_8 = false;
 	bool coalesced = false;
-	void *old_buf = NULL;
-	u32 curr, pktlen;
-	bool old_fp;
+	u32 pktlen;
+	int pkt_i;
 	int i;
 
 	apc = netdev_priv(ndev);
@@ -2275,6 +2320,11 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,
 		coalesced = true;
 		break;
 
+	case CQE_RX_COALESCED_8:
+		coalesced = true;
+		coalesced_8 = true;
+		break;
+
 	case CQE_RX_OBJECT_FENCE:
 		complete(&rxq->fence_event);
 		return;
@@ -2286,54 +2336,48 @@ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,
 		return;
 	}
 
+	pkt_i = 0;
 	for (i = 0; i < MANA_RXCOMP_OOB_NUM_PPI; i++) {
-		old_buf = NULL;
-		pktlen = oob->ppi[i].pkt_len;
-		if (pktlen == 0)
-			break;
-
-		curr = rxq->buf_index;
-		rxbuf_oob = &rxq->rx_oobs[curr];
-		WARN_ON_ONCE(rxbuf_oob->wqe_inf.wqe_size_in_bu != 1);
-
-		if (unlikely(pktlen > rxq->datasize)) {
-			/* Increase it even if mana_rx_skb() isn't called. */
-			rxq->rx_cq.work_done++;
+		u32 pkt_hash;
 
-			++ndev->stats.rx_dropped;
-			netdev_warn_once(ndev,
-				"Dropped oversized RX packet: len=%u, datasize=%u\n",
-				pktlen, rxq->datasize);
-
-			/* Reuse the RX buffer since rxbuf_oob is unchanged. */
+		if (coalesced_8) {
+			/* 8-pkt mode: 2 packets per PPI entry */
+			pktlen = oob->ppi[i].pkt_len0;
+			pkt_hash = oob->ppi[i].pkt_hash0;
 		} else {
-
-			mana_refill_rx_oob(dev, rxq, rxbuf_oob, pktlen,
-					   &old_buf, &old_fp);
-
-			/* Unsuccessful refill will have old_buf == NULL.
-			 * In this case, mana_rx_skb() will drop the packet.
-			 */
-			mana_rx_skb(old_buf, old_fp, oob, rxq, i);
+			pktlen = oob->ppi[i].pkt_len;
+			pkt_hash = oob->ppi[i].pkt_hash;
 		}
+		if (pktlen == 0)
+			break;
 
-		mana_move_wq_tail(rxq->gdma_rq,
-				  rxbuf_oob->wqe_inf.wqe_size_in_bu);
-
-		mana_post_pkt_rxq(rxq);
+		mana_process_one_rx_pkt(dev, rxq, oob, pktlen, pkt_hash);
+		pkt_i++;
 
 		if (!coalesced)
 			break;
+
+		/* Process 2nd packet from the same PPI in 8-pkt mode */
+		if (coalesced_8) {
+			pktlen = oob->ppi[i].pkt_len1;
+			pkt_hash = oob->ppi[i].pkt_hash1;
+			if (pktlen == 0)
+				break;
+
+			mana_process_one_rx_pkt(dev, rxq, oob, pktlen,
+						pkt_hash);
+			pkt_i++;
+		}
 	}
 
 	/* Collect coalesced CQE count based on packets processed.
-	 * Coalesced CQEs have at least 2 packets, so index is i - 2.
+	 * Coalesced CQEs have at least 2 packets, so index is pkt_i - 2.
 	 */
-	if (i > 1) {
+	if (pkt_i > 1) {
 		u64_stats_update_begin(&rxq->stats.syncp);
-		rxq->stats.coalesced_cqe[i - 2]++;
+		rxq->stats.coalesced_cqe[pkt_i - 2]++;
 		u64_stats_update_end(&rxq->stats.syncp);
-	} else if (!i && !pktlen) {
+	} else if (!pkt_i && !pktlen) {
 		u64_stats_update_begin(&rxq->stats.syncp);
 		rxq->stats.pkt_len0_err++;
 		u64_stats_update_end(&rxq->stats.syncp);
@@ -3763,6 +3807,7 @@ static int mana_probe_port(struct mana_context *ac, int port_idx,
 	apc->port_idx = port_idx;
 	apc->link_cfg_error = 1;
 	apc->cqe_coalescing_enable = 0;
+	apc->cqe8_coalescing_enable = 0;
 
 	/* Initialize interrupt moderation settings if supported by HW */
 	if (gc->pf_cap_flags1 & GDMA_PF_CAP_FLAG_1_DYN_INTERRUPT_MODERATION) {
diff --git a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
index 9e31e2595ae32..04f877707cc6a 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_ethtool.c
@@ -169,7 +169,7 @@ static void mana_get_strings(struct net_device *ndev, u32 stringset, u8 *data)
 		ethtool_sprintf(&data, "rx_%d_xdp_tx", i);
 		ethtool_sprintf(&data, "rx_%d_xdp_redirect", i);
 		ethtool_sprintf(&data, "rx_%d_pkt_len0_err", i);
-		for (j = 0; j < MANA_RXCOMP_OOB_NUM_PPI - 1; j++)
+		for (j = 0; j < MANA_CQE_COAL_PKTS_8 - 1; j++)
 			ethtool_sprintf(&data, "rx_%d_coalesced_cqe_%d", i, j + 2);
 	}
 
@@ -205,7 +205,7 @@ static void mana_get_ethtool_stats(struct net_device *ndev,
 	u64 xdp_drop;
 	u64 xdp_tx;
 	u64 pkt_len0_err;
-	u64 coalesced_cqe[MANA_RXCOMP_OOB_NUM_PPI - 1];
+	u64 coalesced_cqe[MANA_CQE_COAL_PKTS_8 - 1];
 	u64 tso_packets;
 	u64 tso_bytes;
 	u64 tso_inner_packets;
@@ -245,7 +245,7 @@ static void mana_get_ethtool_stats(struct net_device *ndev,
 			xdp_tx = rx_stats->xdp_tx;
 			xdp_redirect = rx_stats->xdp_redirect;
 			pkt_len0_err = rx_stats->pkt_len0_err;
-			for (j = 0; j < MANA_RXCOMP_OOB_NUM_PPI - 1; j++)
+			for (j = 0; j < MANA_CQE_COAL_PKTS_8 - 1; j++)
 				coalesced_cqe[j] = rx_stats->coalesced_cqe[j];
 		} while (u64_stats_fetch_retry(&rx_stats->syncp, start));
 
@@ -255,7 +255,7 @@ static void mana_get_ethtool_stats(struct net_device *ndev,
 		data[i++] = xdp_tx;
 		data[i++] = xdp_redirect;
 		data[i++] = pkt_len0_err;
-		for (j = 0; j < MANA_RXCOMP_OOB_NUM_PPI - 1; j++)
+		for (j = 0; j < MANA_CQE_COAL_PKTS_8 - 1; j++)
 			data[i++] = coalesced_cqe[j];
 	}
 
@@ -408,6 +408,7 @@ static int mana_get_coalesce(struct net_device *ndev,
 	struct mana_port_context *apc = netdev_priv(ndev);
 
 	kernel_coal->rx_cqe_frames =
+		apc->cqe8_coalescing_enable ? MANA_CQE_COAL_PKTS_8 :
 		apc->cqe_coalescing_enable ? MANA_RXCOMP_OOB_NUM_PPI : 1;
 
 	kernel_coal->rx_cqe_nsecs = apc->cqe_coalescing_timeout_ns;
@@ -443,15 +444,19 @@ static int mana_set_coalesce(struct net_device *ndev,
 		u16 intr_modr_tx_usec;
 		u16 intr_modr_tx_comp;
 		u8 cqe_coalescing_enable;
+		u8 cqe8_coalescing_enable;
 		bool rx_dim_enabled;
 		bool tx_dim_enabled;
 	} saved;
 	bool modr_changed = false;
 	bool dim_changed = false;
 	struct gdma_context *gc;
+	u32 max_cqe_frames;
 	int err;
 
 	gc = apc->ac->gdma_dev->gdma_context;
+	max_cqe_frames = gc->cqe8_coalescing_sup ? MANA_CQE_COAL_PKTS_8 :
+						   MANA_RXCOMP_OOB_NUM_PPI;
 
 	/* Both static and dynamic interrupt moderation (DIM) rely on the
 	 * same HW capability advertised by the PF.
@@ -466,10 +471,12 @@ static int mana_set_coalesce(struct net_device *ndev,
 	}
 
 	if (kernel_coal->rx_cqe_frames != 1 &&
-	    kernel_coal->rx_cqe_frames != MANA_RXCOMP_OOB_NUM_PPI) {
+	    kernel_coal->rx_cqe_frames != MANA_RXCOMP_OOB_NUM_PPI &&
+	    kernel_coal->rx_cqe_frames != max_cqe_frames) {
 		NL_SET_ERR_MSG_FMT(extack,
-				   "rx-frames must be 1 or %u, got %u",
+				   "rx-frames must be 1 or %u%s, got %u",
 				   MANA_RXCOMP_OOB_NUM_PPI,
+				   gc->cqe8_coalescing_sup ? " or 8" : "",
 				   kernel_coal->rx_cqe_frames);
 		return -EINVAL;
 	}
@@ -514,8 +521,11 @@ static int mana_set_coalesce(struct net_device *ndev,
 	saved.tx_dim_enabled = apc->tx_dim_enabled;
 
 	saved.cqe_coalescing_enable = apc->cqe_coalescing_enable;
+	saved.cqe8_coalescing_enable = apc->cqe8_coalescing_enable;
 	apc->cqe_coalescing_enable =
-		kernel_coal->rx_cqe_frames == MANA_RXCOMP_OOB_NUM_PPI;
+		kernel_coal->rx_cqe_frames >= MANA_RXCOMP_OOB_NUM_PPI;
+	apc->cqe8_coalescing_enable =
+		kernel_coal->rx_cqe_frames == MANA_CQE_COAL_PKTS_8;
 
 	if (!apc->port_is_up) {
 		WRITE_ONCE(apc->rx_dim_enabled, !!ec->use_adaptive_rx_coalesce);
@@ -523,7 +533,8 @@ static int mana_set_coalesce(struct net_device *ndev,
 		return 0;
 	}
 
-	if (apc->cqe_coalescing_enable != saved.cqe_coalescing_enable) {
+	if (apc->cqe_coalescing_enable != saved.cqe_coalescing_enable ||
+	    apc->cqe8_coalescing_enable != saved.cqe8_coalescing_enable) {
 		/* CQE coalescing setting is applied via RSS configuration. */
 		err = mana_config_rss(apc, TRI_STATE_TRUE, false, false);
 		if (err) {
@@ -531,6 +542,8 @@ static int mana_set_coalesce(struct net_device *ndev,
 				   err);
 			apc->cqe_coalescing_enable =
 				saved.cqe_coalescing_enable;
+			apc->cqe8_coalescing_enable =
+				saved.cqe8_coalescing_enable;
 			apc->intr_modr_rx_usec = saved.intr_modr_rx_usec;
 			apc->intr_modr_rx_comp = saved.intr_modr_rx_comp;
 			apc->intr_modr_tx_usec = saved.intr_modr_tx_usec;
diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h
index 8529cef0d7c45..70a7f1fee5d3b 100644
--- a/include/net/mana/gdma.h
+++ b/include/net/mana/gdma.h
@@ -182,6 +182,7 @@ struct gdma_general_req {
 #define GDMA_MESSAGE_V2 2
 #define GDMA_MESSAGE_V3 3
 #define GDMA_MESSAGE_V4 4
+#define GDMA_MESSAGE_V5 5
 
 struct gdma_general_resp {
 	struct gdma_resp_hdr hdr;
@@ -428,6 +429,9 @@ struct gdma_context {
 	/* L2 MTU */
 	u16 adapter_mtu;
 
+	/* NIC supports CQE x8 coalescing */
+	bool cqe8_coalescing_sup;
+
 	/* This maps a CQ index to the queue structure. */
 	unsigned int		max_num_cqs;
 	struct gdma_queue	**cq_table;
diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h
index 4d041fb8437f5..50acb6bf8f125 100644
--- a/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -62,9 +62,12 @@ enum TRI_STATE {
 
 #define MAX_PORTS_IN_MANA_DEV 256
 
-/* Maximum number of packets per coalesced CQE */
+/* Maximum number of PPIs per coalesced CQE */
 #define MANA_RXCOMP_OOB_NUM_PPI 4
 
+/* 8-pkt mode packs up to 2 packets per PPI entry */
+#define MANA_CQE_COAL_PKTS_8 8
+
 /* Default/max interrupt moderation settings */
 #define MANA_INTR_MODR_USEC_DEF 0
 #define MANA_INTR_MODR_COMP_DEF 0
@@ -79,7 +82,7 @@ enum TRI_STATE {
 #define MANA_INTR_MODR_COMP_MASK   GENMASK(23, 16)
 
 /* Update this count whenever the respective structures are changed */
-#define MANA_STATS_RX_COUNT (6 + MANA_RXCOMP_OOB_NUM_PPI - 1)
+#define MANA_STATS_RX_COUNT (6 + MANA_CQE_COAL_PKTS_8 - 1)
 #define MANA_STATS_TX_COUNT 11
 
 #define MANA_RX_FRAG_ALIGNMENT 64
@@ -91,7 +94,7 @@ struct mana_stats_rx {
 	u64 xdp_tx;
 	u64 xdp_redirect;
 	u64 pkt_len0_err;
-	u64 coalesced_cqe[MANA_RXCOMP_OOB_NUM_PPI - 1];
+	u64 coalesced_cqe[MANA_CQE_COAL_PKTS_8 - 1];
 	struct u64_stats_sync syncp;
 };
 
@@ -202,6 +205,7 @@ enum mana_cqe_type {
 	CQE_RX_COALESCED_4		= 2,
 	CQE_RX_OBJECT_FENCE		= 3,
 	CQE_RX_TRUNCATED		= 4,
+	CQE_RX_COALESCED_8		= 7,
 
 	CQE_TX_OKAY			= 32,
 	CQE_TX_SA_DROP			= 33,
@@ -238,12 +242,26 @@ struct mana_cqe_header {
 #define MANA_HASH_L4                                                         \
 	(NDIS_HASH_TCP_IPV4 | NDIS_HASH_UDP_IPV4 | NDIS_HASH_TCP_IPV6 |      \
 	 NDIS_HASH_UDP_IPV6 | NDIS_HASH_TCP_IPV6_EX | NDIS_HASH_UDP_IPV6_EX)
+#define MANA_HASH_ENABLE_SUPPORTED \
+	(NDIS_HASH_IPV4 | NDIS_HASH_TCP_IPV4 | NDIS_HASH_UDP_IPV4 | \
+	 NDIS_HASH_IPV6 | NDIS_HASH_TCP_IPV6 | NDIS_HASH_UDP_IPV6)
+
+/* Read PPI in two different layouts based on cqe_type */
+union mana_rxcomp_perpkt_info {
+	struct {
+		u32 pkt_len : 16;
+		u32 reserved1 : 16;
+		u32 reserved2;
+		u32 pkt_hash;
+	};
 
-struct mana_rxcomp_perpkt_info {
-	u32 pkt_len	: 16;
-	u32 reserved1	: 16;
-	u32 reserved2;
-	u32 pkt_hash;
+	/* Up to two pkts per PPI entry */
+	struct {
+		u32 pkt_hash0;
+		u16 pkt_len0;
+		u16 pkt_len1;
+		u32 pkt_hash1;
+	};
 }; /* HW DATA */
 
 /* Receive completion OOB */
@@ -264,7 +282,7 @@ struct mana_rxcomp_oob {
 	u32 rx_udp_csum_fail		: 1;
 	u32 reserved2			: 1;
 
-	struct mana_rxcomp_perpkt_info ppi[MANA_RXCOMP_OOB_NUM_PPI];
+	union mana_rxcomp_perpkt_info ppi[MANA_RXCOMP_OOB_NUM_PPI];
 
 	u32 rx_wqe_offset;
 }; /* HW DATA */
@@ -607,6 +625,7 @@ struct mana_port_context {
 	bool port_st_save; /* Saved port state */
 
 	u8 cqe_coalescing_enable;
+	u8 cqe8_coalescing_enable;
 	u32 cqe_coalescing_timeout_ns;
 
 	/* Interrupt moderation settings */
@@ -751,6 +770,8 @@ struct mana_query_device_cfg_req {
 	u32 reserved;
 }; /* HW DATA */
 
+#define MANA_PF_FLAG_1_CQE_8_COALESCING_SUPPORTED BIT(5)
+
 struct mana_query_device_cfg_resp {
 	struct gdma_resp_hdr hdr;
 
@@ -986,7 +1007,10 @@ struct mana_cfg_rx_steer_req_v2 {
 	mana_handle_t default_rxobj;
 	u8 hashkey[MANA_HASH_KEY_SIZE];
 	u8 cqe_coalescing_enable;
-	u8 reserved2[7];
+	u8 reserved2[3];
+	u16 rss_hash_types;
+	u8 cqe8_coalescing_enable; /* v5 message */
+	u8 reserved3;
 	mana_handle_t indir_tab[] __counted_by(num_indir_entries);
 }; /* HW DATA */
 

gemini-3.1-pro-preview

null

null

							input: 9303
							output: 37
							thoughts: 368
						

**Analyzing the MANA Driver Patch**

Okay, so I've got this patch for the Microsoft Azure Network Adapter (MANA) driver. It's adding support for 8-packet coalescing in the Completion Queue Entry (CQE), which is interesting. The changes are spread across `mana_en.c`, `mana_ethtool.c`, `gdma.h`, and `mana.h`. I need to figure out how viable this is to test.

First, the driver's located in `drivers/net/ethernet/microsoft/mana/`. My immediate thought is, can I even *reach* this in a standard QEMU environment? MANA is usually a SmartNIC, specific to Microsoft Azure, which suggests it might rely on physical hardware. I can't recall seeing any emulation for it in vanilla QEMU. That's a critical first hurdle.

Let me clarify – is there any software emulation of MANA at all, or is it strictly a physical or Azure-specific device? Right, it’s the Microsoft Azure Network Adapter, a PCI device, so if there's no emulation, the standard QEMU environment won't work. The fact it's a PCI device that's not emulated means fuzzing is unlikely to work in the standard environment.

Let me verify that MANA is a vendor-specific PCIe device, not emulated by QEMU. The documentation mentions that code in drivers like `mlxsw`, `pds_core`, `qed`, `ionic`, and `amdgpu` which require physical PCIe hardware cards isn't emulated. That seems like the case here.

So, either I need to start digging through the QEMU source code to explicitly confirm it's not emulated, or I'm just going to have to make the educated assumption that it isn't. The driver itself is in `drivers/net/ethernet/microsoft/mana/` which means it's a PCI driver. Specifically, I'll need to focus on `mana_en.c`. This means I need to find a workaround to test the patch.

{
  "Expression": "pci_register_driver",
  "PathPrefix": "drivers/net/ethernet/microsoft/mana/"
}

{
  "Output": "drivers/net/ethernet/microsoft/mana/gdma_main.c=2569=static int __init mana_driver_init(void)\n--\ndrivers/net/ethernet/microsoft/mana/gdma_main.c-2578-\ndrivers/net/ethernet/microsoft/mana/gdma_main.c:2579:\terr = pci_register_driver(\u0026mana_driver);\ndrivers/net/ethernet/microsoft/mana/gdma_main.c-2580-\tif (err) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 10300
							output: 94
							thoughts: 141
						

**WorthFuzzing Assessment: MANA Driver**

Okay, so this is definitely a PCI driver. My initial instinct is to assess its fuzzability. Is this something that's emulated within QEMU, since that's our typical fuzzing environment? No, it's not. This is a vendor-specific SmartNIC – specifically, the Microsoft Azure Network Adapter, or MANA.  That immediately flags a concern.  We are going to need physical PCIe hardware cards or Azure VMs to interact with this, and we don't typically run Azure VMs within standard QEMU for fuzzing.

Given that restriction, I should quickly double-check – is there any other possible path to this that bypasses the hardware dependency? Nope. It's a hardware driver for MANA, and that's the only way to get at it.

Therefore, my conclusion is clear: `WorthFuzzing=false`. I'll return that value. My reasoning is solid – it's a vendor-specific hardware driver (Microsoft Azure Network Adapter) and it's not emulated in the standard QEMU setup that we use for fuzzing.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Microsoft Azure Network Adapter (MANA) driver to add support for CQE 8-packet coalescing. MANA is a vendor-specific PCIe SmartNIC device that is not emulated in standard QEMU environments, so this code cannot be reached or tested by the fuzzer.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Microsoft Azure Network Adapter (MANA) driver to add support for CQE 8-packet coalescing. MANA is a vendor-specific PCIe SmartNIC device that is not emulated in standard QEMU environments, so this code cannot be reached or tested by the fuzzer.",
  "WorthFuzzing": false
}