| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/03 19:32 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies the STMicroelectronics / Synopsys DesignWare Ethernet MAC (stmmac) driver to handle EST (Enhancements for Scheduled Traffic / TAPRIO) setup and lifecycle. This driver controls physical SoC/PCI Ethernet MAC hardware that is not emulated in standard virtualized QEMU/GCE environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/03 19:32 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit c9f6f740a3f95d5cac8d6d449142541fef295203\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Sep 3 19:32:37 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h\nindex 04dafec021b4f..e5579166df1a5 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h\n+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h\n@@ -620,7 +620,7 @@ struct stmmac_mmc_ops {\n \n struct stmmac_est_ops {\n \tint (*configure)(struct stmmac_priv *priv, struct stmmac_est *cfg,\n-\t\t\t unsigned int ptp_rate);\n+\t\t\t unsigned int ptp_rate, bool enable);\n \tvoid (*irq_status)(struct stmmac_priv *priv, struct net_device *dev,\n \t\t\t struct stmmac_extra_stats *x, u32 txqcnt);\n };\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h\nindex 7582fca637419..a8c8be34ff814 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h\n@@ -298,7 +298,7 @@ struct stmmac_priv {\n \tstruct plat_stmmacenet_data *plat;\n \t/* Protect est parameters */\n \tstruct mutex est_lock;\n-\tstruct stmmac_est *est;\n+\tstruct stmmac_est est;\n \tstruct dma_features dma_cap;\n \tstruct stmmac_counters mmc;\n \tint hw_cap_support;\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c\nindex afc516059b897..49edfebbc39e0 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c\n@@ -26,7 +26,7 @@ static int est_write(void __iomem *est_addr, u32 reg, u32 val, bool gcl)\n }\n \n static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,\n-\t\t\t unsigned int ptp_rate)\n+\t\t\t unsigned int ptp_rate, bool enable)\n {\n \tvoid __iomem *est_addr = priv-\u003eestaddr;\n \tint i, ret = 0;\n@@ -62,7 +62,7 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,\n \t\tctrl |= ((NSEC_PER_SEC / ptp_rate) * EST_GMAC5_PTOV_MUL) \u003c\u003c\n \t\t\t EST_GMAC5_PTOV_SHIFT;\n \t}\n-\tif (cfg-\u003eenable)\n+\tif (enable)\n \t\tctrl |= EST_EEST | EST_SSWL | EST_DFBS;\n \telse\n \t\tctrl \u0026= ~EST_EEST;\n@@ -70,7 +70,7 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,\n \twritel(ctrl, est_addr + EST_CONTROL);\n \n \t/* Configure EST interrupt */\n-\tif (cfg-\u003eenable)\n+\tif (enable)\n \t\tctrl = EST_IECGCE | EST_IEHS | EST_IEHF | EST_IEBE | EST_IECC;\n \telse\n \t\tctrl = 0;\n@@ -80,6 +80,36 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,\n \treturn 0;\n }\n \n+int __stmmac_setup_est(struct stmmac_priv *priv)\n+{\n+\tstruct timespec64 current_time, time;\n+\tktime_t current_time_ns, basetime;\n+\tu64 cycle_time;\n+\tint err;\n+\n+\tlockdep_assert_held(\u0026priv-\u003eest_lock);\n+\n+\tpriv-\u003eptp_clock_ops.gettime64(\u0026priv-\u003eptp_clock_ops, \u0026current_time);\n+\tcurrent_time_ns = timespec64_to_ktime(current_time);\n+\n+\ttime.tv_nsec = priv-\u003eest.btr_reserve[0];\n+\ttime.tv_sec = priv-\u003eest.btr_reserve[1];\n+\tbasetime = timespec64_to_ktime(time);\n+\n+\tcycle_time = (u64)priv-\u003eest.ctr[1] * NSEC_PER_SEC + priv-\u003eest.ctr[0];\n+\n+\ttime = stmmac_calc_tas_basetime(basetime, current_time_ns, cycle_time);\n+\tpriv-\u003eest.btr[0] = (u32)time.tv_nsec;\n+\tpriv-\u003eest.btr[1] = (u32)time.tv_sec;\n+\n+\terr = stmmac_est_configure(priv, priv, \u0026priv-\u003eest,\n+\t\t\t\t priv-\u003eplat-\u003eclk_ptp_rate, true);\n+\tif (err)\n+\t\tnetdev_err(priv-\u003edev, \"failed to re-configure EST\\n\");\n+\n+\treturn err;\n+}\n+\n static void est_irq_status(struct stmmac_priv *priv, struct net_device *dev,\n \t\t\t struct stmmac_extra_stats *x, u32 txqcnt)\n {\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h\nindex f70221c9c84af..b4d1a1f04f108 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h\n@@ -65,3 +65,16 @@\n #define EST_GCL_DATA\t\t\t0x00000034\n \n extern const struct stmmac_est_ops dwmac510_est_ops;\n+\n+int __stmmac_setup_est(struct stmmac_priv *priv);\n+static inline int stmmac_setup_est(struct stmmac_priv *priv)\n+{\n+\tint ret = 0;\n+\n+\tmutex_lock(\u0026priv-\u003eest_lock);\n+\tif (priv-\u003eest.enable)\n+\t\tret = __stmmac_setup_est(priv);\n+\tmutex_unlock(\u0026priv-\u003eest_lock);\n+\n+\treturn ret;\n+}\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\nindex d576059c04df9..c4d3539483473 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\n@@ -48,6 +48,7 @@\n #include \"stmmac_ptp.h\"\n #include \"stmmac_fpe.h\"\n #include \"stmmac.h\"\n+#include \"stmmac_est.h\"\n #include \"stmmac_pcs.h\"\n #include \"stmmac_xdp.h\"\n #include \u003clinux/reset.h\u003e\n@@ -937,18 +938,27 @@ static int stmmac_init_timestamping(struct stmmac_priv *priv)\n \treturn 0;\n }\n \n-static void stmmac_setup_ptp(struct stmmac_priv *priv)\n+static int stmmac_setup_ptp(struct stmmac_priv *priv)\n {\n \tint ret;\n \n \tret = clk_prepare_enable(priv-\u003eplat-\u003eclk_ptp_ref);\n-\tif (ret \u003c 0)\n+\tif (ret \u003c 0) {\n \t\tnetdev_warn(priv-\u003edev,\n \t\t\t \"failed to enable PTP reference clock: %pe\\n\",\n \t\t\t ERR_PTR(ret));\n+\t\treturn ret;\n+\t}\n+\n+\tret = stmmac_init_timestamping(priv);\n+\tif (ret) {\n+\t\tclk_disable_unprepare(priv-\u003eplat-\u003eclk_ptp_ref);\n+\t\treturn ret;\n+\t}\n \n-\tif (stmmac_init_timestamping(priv) == 0)\n-\t\tstmmac_ptp_register(priv);\n+\tstmmac_ptp_register(priv);\n+\n+\treturn 0;\n }\n \n static void stmmac_release_ptp(struct stmmac_priv *priv)\n@@ -2714,9 +2724,8 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget)\n \t\tif (!xsk_tx_peek_desc(pool, \u0026xdp_desc))\n \t\t\tbreak;\n \n-\t\tif (priv-\u003eest \u0026\u0026 priv-\u003eest-\u003eenable \u0026\u0026\n-\t\t priv-\u003eest-\u003emax_sdu[queue] \u0026\u0026\n-\t\t xdp_desc.len \u003e priv-\u003eest-\u003emax_sdu[queue]) {\n+\t\tif (priv-\u003eest.enable \u0026\u0026 priv-\u003eest.max_sdu[queue] \u0026\u0026\n+\t\t xdp_desc.len \u003e priv-\u003eest.max_sdu[queue]) {\n \t\t\tpriv-\u003exstats.max_sdu_txq_drop[queue]++;\n \t\t\tcontinue;\n \t\t}\n@@ -4153,10 +4162,19 @@ static int __stmmac_open(struct net_device *dev,\n \tret = stmmac_hw_setup(dev);\n \tif (ret \u003c 0) {\n \t\tnetdev_err(priv-\u003edev, \"%s: Hw setup failed\\n\", __func__);\n-\t\tgoto init_error;\n+\t\treturn ret;\n \t}\n \n-\tstmmac_setup_ptp(priv);\n+\tret = stmmac_setup_ptp(priv);\n+\tif (ret)\n+\t\tgoto ptp_error;\n+\n+\t/* The core soft reset in stmmac_hw_setup() clears the MTL_EST\n+\t * registers, so re-apply the taprio offload after PTP is up.\n+\t */\n+\tret = stmmac_setup_est(priv);\n+\tif (ret \u003c 0)\n+\t\tgoto est_error;\n \n \tstmmac_init_coalesce(priv);\n \n@@ -4179,9 +4197,11 @@ static int __stmmac_open(struct net_device *dev,\n \n \tfor (chan = 0; chan \u003c priv-\u003eplat-\u003etx_queues_to_use; chan++)\n \t\thrtimer_cancel(\u0026priv-\u003edma_conf.tx_queue[chan].txtimer);\n-\n+est_error:\n \tstmmac_release_ptp(priv);\n-init_error:\n+ptp_error:\n+\tstmmac_stop_all_dma(priv);\n+\n \treturn ret;\n }\n \n@@ -4776,13 +4796,12 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)\n \tif (skb_is_gso(skb))\n \t\treturn stmmac_tso_xmit(skb, dev);\n \n-\tif (priv-\u003eest \u0026\u0026 priv-\u003eest-\u003eenable \u0026\u0026\n-\t priv-\u003eest-\u003emax_sdu[queue]) {\n+\tif (priv-\u003eest.enable \u0026\u0026 priv-\u003eest.max_sdu[queue]) {\n \t\tsdu_len = skb-\u003elen;\n \t\t/* Add VLAN tag length if VLAN tag insertion offload is requested */\n \t\tif (priv-\u003edma_cap.vlins \u0026\u0026 skb_vlan_tag_present(skb))\n \t\t\tsdu_len += VLAN_HLEN;\n-\t\tif (sdu_len \u003e priv-\u003eest-\u003emax_sdu[queue]) {\n+\t\tif (sdu_len \u003e priv-\u003eest.max_sdu[queue]) {\n \t\t\tpriv-\u003exstats.max_sdu_txq_drop[queue]++;\n \t\t\tgoto max_sdu_err;\n \t\t}\n@@ -5186,9 +5205,8 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,\n \tif (stmmac_tx_avail(priv, queue) \u003c STMMAC_TX_THRESH(priv))\n \t\treturn STMMAC_XDP_CONSUMED;\n \n-\tif (priv-\u003eest \u0026\u0026 priv-\u003eest-\u003eenable \u0026\u0026\n-\t priv-\u003eest-\u003emax_sdu[queue] \u0026\u0026\n-\t xdpf-\u003elen \u003e priv-\u003eest-\u003emax_sdu[queue]) {\n+\tif (priv-\u003eest.enable \u0026\u0026 priv-\u003eest.max_sdu[queue] \u0026\u0026\n+\t xdpf-\u003elen \u003e priv-\u003eest.max_sdu[queue]) {\n \t\tpriv-\u003exstats.max_sdu_txq_drop[queue]++;\n \t\treturn STMMAC_XDP_CONSUMED;\n \t}\n@@ -8017,6 +8035,7 @@ static int __stmmac_dvr_probe(struct device *device,\n \tstmmac_napi_add(ndev);\n \n \tmutex_init(\u0026priv-\u003elock);\n+\tmutex_init(\u0026priv-\u003eest_lock);\n \n \tstmmac_fpe_init(priv);\n \n@@ -8148,6 +8167,7 @@ void stmmac_dvr_remove(struct device *dev)\n \tstmmac_mdio_unregister(ndev);\n \n \tdestroy_workqueue(priv-\u003ewq);\n+\tmutex_destroy(\u0026priv-\u003eest_lock);\n \tmutex_destroy(\u0026priv-\u003elock);\n \tbitmap_free(priv-\u003eaf_xdp_zc_qps);\n \n@@ -8318,13 +8338,16 @@ int stmmac_resume(struct device *dev)\n \tret = stmmac_hw_setup(ndev);\n \tif (ret \u003c 0) {\n \t\tnetdev_err(priv-\u003edev, \"%s: Hw setup failed\\n\", __func__);\n-\t\tstmmac_legacy_serdes_power_down(priv);\n-\t\tmutex_unlock(\u0026priv-\u003elock);\n-\t\trtnl_unlock();\n-\t\treturn ret;\n+\t\tgoto error_unlock;\n \t}\n \n-\tstmmac_init_timestamping(priv);\n+\tret = stmmac_init_timestamping(priv);\n+\tif (ret)\n+\t\tgoto error_stop_dma;\n+\n+\tret = stmmac_setup_est(priv);\n+\tif (ret \u003c 0)\n+\t\tgoto error_stop_dma;\n \n \tstmmac_init_coalesce(priv);\n \tphylink_rx_clk_stop_block(priv-\u003ephylink);\n@@ -8348,6 +8371,15 @@ int stmmac_resume(struct device *dev)\n \tnetif_device_attach(ndev);\n \n \treturn 0;\n+\n+error_stop_dma:\n+\tstmmac_stop_all_dma(priv);\n+error_unlock:\n+\tstmmac_legacy_serdes_power_down(priv);\n+\tmutex_unlock(\u0026priv-\u003elock);\n+\trtnl_unlock();\n+\n+\treturn ret;\n }\n EXPORT_SYMBOL_GPL(stmmac_resume);\n \ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c\nindex 960249960004c..8f3a90df3178c 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c\n@@ -8,6 +8,7 @@\n Author: Rayagond Kokatanur \u003crayagond@vayavyalabs.com\u003e\n *******************************************************************************/\n #include \"stmmac.h\"\n+#include \"stmmac_est.h\"\n #include \"stmmac_ptp.h\"\n \n #define PTP_SAFE_TIME_OFFSET_NS\t500000\n@@ -55,7 +56,6 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)\n \tu32 quotient, reminder;\n \tint neg_adj = 0;\n \tbool xmac, est_rst = false;\n-\tint ret;\n \n \txmac = dwmac_is_xmac(priv-\u003eplat-\u003ecore_type);\n \n@@ -69,46 +69,21 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)\n \tnsec = reminder;\n \n \t/* If EST is enabled, disabled it before adjust ptp time. */\n-\tif (priv-\u003eest \u0026\u0026 priv-\u003eest-\u003eenable) {\n+\tmutex_lock(\u0026priv-\u003eest_lock);\n+\tif (priv-\u003eest.enable) {\n \t\test_rst = true;\n-\t\tmutex_lock(\u0026priv-\u003eest_lock);\n-\t\tpriv-\u003eest-\u003eenable = false;\n-\t\tstmmac_est_configure(priv, priv, priv-\u003eest,\n-\t\t\t\t priv-\u003eplat-\u003eclk_ptp_rate);\n-\t\tmutex_unlock(\u0026priv-\u003eest_lock);\n+\t\tstmmac_est_configure(priv, priv, \u0026priv-\u003eest,\n+\t\t\t\t priv-\u003eplat-\u003eclk_ptp_rate, false);\n \t}\n+\tmutex_unlock(\u0026priv-\u003eest_lock);\n \n \twrite_lock_irqsave(\u0026priv-\u003eptp_lock, flags);\n \tstmmac_adjust_systime(priv, priv-\u003eptpaddr, sec, nsec, neg_adj, xmac);\n \twrite_unlock_irqrestore(\u0026priv-\u003eptp_lock, flags);\n \n \t/* Calculate new basetime and re-configured EST after PTP time adjust. */\n-\tif (est_rst) {\n-\t\tstruct timespec64 current_time, time;\n-\t\tktime_t current_time_ns, basetime;\n-\t\tu64 cycle_time;\n-\n-\t\tmutex_lock(\u0026priv-\u003eest_lock);\n-\t\tpriv-\u003eptp_clock_ops.gettime64(\u0026priv-\u003eptp_clock_ops, \u0026current_time);\n-\t\tcurrent_time_ns = timespec64_to_ktime(current_time);\n-\t\ttime.tv_nsec = priv-\u003eest-\u003ebtr_reserve[0];\n-\t\ttime.tv_sec = priv-\u003eest-\u003ebtr_reserve[1];\n-\t\tbasetime = timespec64_to_ktime(time);\n-\t\tcycle_time = (u64)priv-\u003eest-\u003ectr[1] * NSEC_PER_SEC +\n-\t\t\t priv-\u003eest-\u003ectr[0];\n-\t\ttime = stmmac_calc_tas_basetime(basetime,\n-\t\t\t\t\t\tcurrent_time_ns,\n-\t\t\t\t\t\tcycle_time);\n-\n-\t\tpriv-\u003eest-\u003ebtr[0] = (u32)time.tv_nsec;\n-\t\tpriv-\u003eest-\u003ebtr[1] = (u32)time.tv_sec;\n-\t\tpriv-\u003eest-\u003eenable = true;\n-\t\tret = stmmac_est_configure(priv, priv, priv-\u003eest,\n-\t\t\t\t\t priv-\u003eplat-\u003eclk_ptp_rate);\n-\t\tmutex_unlock(\u0026priv-\u003eest_lock);\n-\t\tif (ret)\n-\t\t\tnetdev_err(priv-\u003edev, \"failed to configure EST\\n\");\n-\t}\n+\tif (est_rst)\n+\t\tstmmac_setup_est(priv);\n \n \treturn 0;\n }\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c\nindex 14cabe76e53ec..9745c9bae33c1 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c\n@@ -10,6 +10,7 @@\n #include \"dwmac4.h\"\n #include \"dwmac5.h\"\n #include \"stmmac.h\"\n+#include \"stmmac_est.h\"\n \n static void tc_fill_all_pass_entry(struct stmmac_tc_entry *entry)\n {\n@@ -959,7 +960,7 @@ static void tc_taprio_map_maxsdu_txq(struct stmmac_priv *priv,\n \t\tcount = qopt-\u003emqprio.qopt.count[i];\n \n \t\tfor (j = offset; j \u003c offset + count; j++)\n-\t\t\tpriv-\u003eest-\u003emax_sdu[j] = qopt-\u003emax_sdu[i] + ETH_HLEN - ETH_TLEN;\n+\t\t\tpriv-\u003eest.max_sdu[j] = qopt-\u003emax_sdu[i] + ETH_HLEN - ETH_TLEN;\n \t}\n }\n \n@@ -968,10 +969,10 @@ static int tc_taprio_configure(struct stmmac_priv *priv,\n {\n \tu32 size, wid = priv-\u003edma_cap.estwid, dep = priv-\u003edma_cap.estdep;\n \tstruct netlink_ext_ack *extack = qopt-\u003emqprio.extack;\n-\tstruct timespec64 time, current_time, qopt_time;\n-\tktime_t current_time_ns;\n+\tu64 ctr = qopt-\u003ecycle_time;\n+\tstruct timespec64 time;\n+\tu32 *gcl = NULL;\n \tint i, ret = 0;\n-\tu64 ctr;\n \n \tif (qopt-\u003ebase_time \u003c 0)\n \t\treturn -ERANGE;\n@@ -979,6 +980,9 @@ static int tc_taprio_configure(struct stmmac_priv *priv,\n \tif (!priv-\u003edma_cap.estsel)\n \t\treturn -EOPNOTSUPP;\n \n+\tif (ctr \u003e (u64)U32_MAX * NSEC_PER_SEC)\n+\t\treturn -ERANGE;\n+\n \tswitch (wid) {\n \tcase 0x1:\n \t\twid = 16;\n@@ -1013,44 +1017,45 @@ static int tc_taprio_configure(struct stmmac_priv *priv,\n \t\treturn -EOPNOTSUPP;\n \t}\n \n+\tmutex_lock(\u0026priv-\u003eest_lock);\n+\n \tif (qopt-\u003ecmd == TAPRIO_CMD_DESTROY)\n \t\tgoto disable;\n \n-\tif (qopt-\u003enum_entries \u003e dep)\n-\t\treturn -EINVAL;\n-\tif (!qopt-\u003ecycle_time)\n-\t\treturn -ERANGE;\n-\tif (qopt-\u003ecycle_time_extension \u003e= BIT(wid + 7))\n-\t\treturn -ERANGE;\n-\n-\tif (!priv-\u003eest) {\n-\t\tpriv-\u003eest = devm_kzalloc(priv-\u003edevice, sizeof(*priv-\u003eest),\n-\t\t\t\t\t GFP_KERNEL);\n-\t\tif (!priv-\u003eest)\n-\t\t\treturn -ENOMEM;\n+\tif (qopt-\u003enum_entries \u003e dep) {\n+\t\tret = -EINVAL;\n+\t\tgoto unlock;\n+\t}\n \n-\t\tmutex_init(\u0026priv-\u003eest_lock);\n-\t} else {\n-\t\tmutex_lock(\u0026priv-\u003eest_lock);\n-\t\tmemset(priv-\u003eest, 0, sizeof(*priv-\u003eest));\n-\t\tmutex_unlock(\u0026priv-\u003eest_lock);\n+\tif (!qopt-\u003ecycle_time) {\n+\t\tret = -ERANGE;\n+\t\tgoto unlock;\n \t}\n \n-\tsize = qopt-\u003enum_entries;\n+\tif (qopt-\u003ecycle_time_extension \u003e= BIT(wid + 7)) {\n+\t\tret = -ERANGE;\n+\t\tgoto unlock;\n+\t}\n \n-\tmutex_lock(\u0026priv-\u003eest_lock);\n-\tpriv-\u003eest-\u003egcl_size = size;\n-\tpriv-\u003eest-\u003eenable = qopt-\u003ecmd == TAPRIO_CMD_REPLACE;\n-\tmutex_unlock(\u0026priv-\u003eest_lock);\n+\tgcl = kzalloc(sizeof(*gcl) * EST_GCL, GFP_KERNEL);\n+\tif (!gcl) {\n+\t\tret = -ENOMEM;\n+\t\tgoto unlock;\n+\t}\n \n+\tsize = qopt-\u003enum_entries;\n \tfor (i = 0; i \u003c size; i++) {\n \t\ts64 delta_ns = qopt-\u003eentries[i].interval;\n \t\tu32 gates = qopt-\u003eentries[i].gate_mask;\n \n-\t\tif (delta_ns \u003e GENMASK(wid - 1, 0))\n-\t\t\treturn -ERANGE;\n-\t\tif (gates \u003e GENMASK(31 - wid, 0))\n-\t\t\treturn -ERANGE;\n+\t\tif (delta_ns \u003e GENMASK(wid - 1, 0)) {\n+\t\t\tret = -ERANGE;\n+\t\t\tgoto free_gcl;\n+\t\t}\n+\t\tif (gates \u003e GENMASK(31 - wid, 0)) {\n+\t\t\tret = -ERANGE;\n+\t\t\tgoto free_gcl;\n+\t\t}\n \n \t\tswitch (qopt-\u003eentries[i].command) {\n \t\tcase TC_TAPRIO_CMD_SET_GATES:\n@@ -1062,65 +1067,58 @@ static int tc_taprio_configure(struct stmmac_priv *priv,\n \t\t\tgates \u0026= ~BIT(0);\n \t\t\tbreak;\n \t\tdefault:\n-\t\t\treturn -EOPNOTSUPP;\n+\t\t\tret = -EOPNOTSUPP;\n+\t\t\tgoto free_gcl;\n \t\t}\n \n-\t\tpriv-\u003eest-\u003egcl[i] = delta_ns | (gates \u003c\u003c wid);\n+\t\tgcl[i] = delta_ns | (gates \u003c\u003c wid);\n \t}\n \n-\tmutex_lock(\u0026priv-\u003eest_lock);\n-\t/* Adjust for real system time */\n-\tpriv-\u003eptp_clock_ops.gettime64(\u0026priv-\u003eptp_clock_ops, \u0026current_time);\n-\tcurrent_time_ns = timespec64_to_ktime(current_time);\n-\ttime = stmmac_calc_tas_basetime(qopt-\u003ebase_time, current_time_ns,\n-\t\t\t\t\tqopt-\u003ecycle_time);\n-\n-\tpriv-\u003eest-\u003ebtr[0] = (u32)time.tv_nsec;\n-\tpriv-\u003eest-\u003ebtr[1] = (u32)time.tv_sec;\n+\tmemset(\u0026priv-\u003eest, 0, sizeof(priv-\u003eest));\n+\tmemcpy(priv-\u003eest.gcl, gcl, sizeof(priv-\u003eest.gcl));\n+\tpriv-\u003eest.gcl_size = size;\n \n-\tqopt_time = ktime_to_timespec64(qopt-\u003ebase_time);\n-\tpriv-\u003eest-\u003ebtr_reserve[0] = (u32)qopt_time.tv_nsec;\n-\tpriv-\u003eest-\u003ebtr_reserve[1] = (u32)qopt_time.tv_sec;\n+\ttime = ktime_to_timespec64(qopt-\u003ebase_time);\n+\tpriv-\u003eest.btr_reserve[0] = (u32)time.tv_nsec;\n+\tpriv-\u003eest.btr_reserve[1] = (u32)time.tv_sec;\n \n-\tctr = qopt-\u003ecycle_time;\n-\tpriv-\u003eest-\u003ectr[0] = do_div(ctr, NSEC_PER_SEC);\n-\tpriv-\u003eest-\u003ectr[1] = (u32)ctr;\n-\n-\tpriv-\u003eest-\u003eter = qopt-\u003ecycle_time_extension;\n+\tpriv-\u003eest.ctr[0] = do_div(ctr, NSEC_PER_SEC);\n+\tpriv-\u003eest.ctr[1] = (u32)ctr;\n \n+\tpriv-\u003eest.ter = qopt-\u003ecycle_time_extension;\n \ttc_taprio_map_maxsdu_txq(priv, qopt);\n \n-\tret = stmmac_est_configure(priv, priv, priv-\u003eest,\n-\t\t\t\t priv-\u003eplat-\u003eclk_ptp_rate);\n-\tmutex_unlock(\u0026priv-\u003eest_lock);\n-\tif (ret) {\n-\t\tnetdev_err(priv-\u003edev, \"failed to configure EST\\n\");\n+\tret = __stmmac_setup_est(priv);\n+\tif (ret)\n \t\tgoto disable;\n-\t}\n \n \tret = stmmac_fpe_map_preemption_class(priv, priv-\u003edev, extack,\n \t\t\t\t\t qopt-\u003emqprio.preemptible_tcs);\n \tif (ret)\n \t\tgoto disable;\n \n+\tpriv-\u003eest.enable = true;\n+\tkfree(gcl);\n+\n+\tmutex_unlock(\u0026priv-\u003eest_lock);\n+\n \treturn 0;\n \n disable:\n-\tif (priv-\u003eest) {\n-\t\tmutex_lock(\u0026priv-\u003eest_lock);\n-\t\tpriv-\u003eest-\u003eenable = false;\n-\t\tstmmac_est_configure(priv, priv, priv-\u003eest,\n-\t\t\t\t priv-\u003eplat-\u003eclk_ptp_rate);\n-\t\t/* Reset taprio status */\n-\t\tfor (i = 0; i \u003c priv-\u003eplat-\u003etx_queues_to_use; i++) {\n-\t\t\tpriv-\u003exstats.max_sdu_txq_drop[i] = 0;\n-\t\t\tpriv-\u003exstats.mtl_est_txq_hlbf[i] = 0;\n-\t\t\tpriv-\u003exstats.mtl_est_txq_hlbs[i] = 0;\n-\t\t}\n-\t\tmutex_unlock(\u0026priv-\u003eest_lock);\n+\tpriv-\u003eest.enable = false;\n+\tstmmac_est_configure(priv, priv, \u0026priv-\u003eest,\n+\t\t\t priv-\u003eplat-\u003eclk_ptp_rate, false);\n+\t/* Reset taprio status */\n+\tfor (i = 0; i \u003c priv-\u003eplat-\u003etx_queues_to_use; i++) {\n+\t\tpriv-\u003exstats.max_sdu_txq_drop[i] = 0;\n+\t\tpriv-\u003exstats.mtl_est_txq_hlbf[i] = 0;\n+\t\tpriv-\u003exstats.mtl_est_txq_hlbs[i] = 0;\n \t}\n-\n \tstmmac_fpe_map_preemption_class(priv, priv-\u003edev, extack, 0);\n+free_gcl:\n+\tkfree(gcl);\n+unlock:\n+\tmutex_unlock(\u0026priv-\u003eest_lock);\n \n \treturn ret;\n }\n"
} |
| 2/1 | 2026/09/03 19:32 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the STMicroelectronics / Synopsys DesignWare Ethernet MAC (stmmac) driver to handle EST (Enhancements for Scheduled Traffic / TAPRIO) setup and lifecycle. This driver controls physical SoC/PCI Ethernet MAC hardware that is not emulated in standard virtualized QEMU/GCE environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit c9f6f740a3f95d5cac8d6d449142541fef295203
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Sep 3 19:32:37 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index 04dafec021b4f..e5579166df1a5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -620,7 +620,7 @@ struct stmmac_mmc_ops {
struct stmmac_est_ops {
int (*configure)(struct stmmac_priv *priv, struct stmmac_est *cfg,
- unsigned int ptp_rate);
+ unsigned int ptp_rate, bool enable);
void (*irq_status)(struct stmmac_priv *priv, struct net_device *dev,
struct stmmac_extra_stats *x, u32 txqcnt);
};
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 7582fca637419..a8c8be34ff814 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -298,7 +298,7 @@ struct stmmac_priv {
struct plat_stmmacenet_data *plat;
/* Protect est parameters */
struct mutex est_lock;
- struct stmmac_est *est;
+ struct stmmac_est est;
struct dma_features dma_cap;
struct stmmac_counters mmc;
int hw_cap_support;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
index afc516059b897..49edfebbc39e0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
@@ -26,7 +26,7 @@ static int est_write(void __iomem *est_addr, u32 reg, u32 val, bool gcl)
}
static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,
- unsigned int ptp_rate)
+ unsigned int ptp_rate, bool enable)
{
void __iomem *est_addr = priv->estaddr;
int i, ret = 0;
@@ -62,7 +62,7 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,
ctrl |= ((NSEC_PER_SEC / ptp_rate) * EST_GMAC5_PTOV_MUL) <<
EST_GMAC5_PTOV_SHIFT;
}
- if (cfg->enable)
+ if (enable)
ctrl |= EST_EEST | EST_SSWL | EST_DFBS;
else
ctrl &= ~EST_EEST;
@@ -70,7 +70,7 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,
writel(ctrl, est_addr + EST_CONTROL);
/* Configure EST interrupt */
- if (cfg->enable)
+ if (enable)
ctrl = EST_IECGCE | EST_IEHS | EST_IEHF | EST_IEBE | EST_IECC;
else
ctrl = 0;
@@ -80,6 +80,36 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,
return 0;
}
+int __stmmac_setup_est(struct stmmac_priv *priv)
+{
+ struct timespec64 current_time, time;
+ ktime_t current_time_ns, basetime;
+ u64 cycle_time;
+ int err;
+
+ lockdep_assert_held(&priv->est_lock);
+
+ priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, ¤t_time);
+ current_time_ns = timespec64_to_ktime(current_time);
+
+ time.tv_nsec = priv->est.btr_reserve[0];
+ time.tv_sec = priv->est.btr_reserve[1];
+ basetime = timespec64_to_ktime(time);
+
+ cycle_time = (u64)priv->est.ctr[1] * NSEC_PER_SEC + priv->est.ctr[0];
+
+ time = stmmac_calc_tas_basetime(basetime, current_time_ns, cycle_time);
+ priv->est.btr[0] = (u32)time.tv_nsec;
+ priv->est.btr[1] = (u32)time.tv_sec;
+
+ err = stmmac_est_configure(priv, priv, &priv->est,
+ priv->plat->clk_ptp_rate, true);
+ if (err)
+ netdev_err(priv->dev, "failed to re-configure EST\n");
+
+ return err;
+}
+
static void est_irq_status(struct stmmac_priv *priv, struct net_device *dev,
struct stmmac_extra_stats *x, u32 txqcnt)
{
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
index f70221c9c84af..b4d1a1f04f108 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
@@ -65,3 +65,16 @@
#define EST_GCL_DATA 0x00000034
extern const struct stmmac_est_ops dwmac510_est_ops;
+
+int __stmmac_setup_est(struct stmmac_priv *priv);
+static inline int stmmac_setup_est(struct stmmac_priv *priv)
+{
+ int ret = 0;
+
+ mutex_lock(&priv->est_lock);
+ if (priv->est.enable)
+ ret = __stmmac_setup_est(priv);
+ mutex_unlock(&priv->est_lock);
+
+ return ret;
+}
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index d576059c04df9..c4d3539483473 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -48,6 +48,7 @@
#include "stmmac_ptp.h"
#include "stmmac_fpe.h"
#include "stmmac.h"
+#include "stmmac_est.h"
#include "stmmac_pcs.h"
#include "stmmac_xdp.h"
#include <linux/reset.h>
@@ -937,18 +938,27 @@ static int stmmac_init_timestamping(struct stmmac_priv *priv)
return 0;
}
-static void stmmac_setup_ptp(struct stmmac_priv *priv)
+static int stmmac_setup_ptp(struct stmmac_priv *priv)
{
int ret;
ret = clk_prepare_enable(priv->plat->clk_ptp_ref);
- if (ret < 0)
+ if (ret < 0) {
netdev_warn(priv->dev,
"failed to enable PTP reference clock: %pe\n",
ERR_PTR(ret));
+ return ret;
+ }
+
+ ret = stmmac_init_timestamping(priv);
+ if (ret) {
+ clk_disable_unprepare(priv->plat->clk_ptp_ref);
+ return ret;
+ }
- if (stmmac_init_timestamping(priv) == 0)
- stmmac_ptp_register(priv);
+ stmmac_ptp_register(priv);
+
+ return 0;
}
static void stmmac_release_ptp(struct stmmac_priv *priv)
@@ -2714,9 +2724,8 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget)
if (!xsk_tx_peek_desc(pool, &xdp_desc))
break;
- if (priv->est && priv->est->enable &&
- priv->est->max_sdu[queue] &&
- xdp_desc.len > priv->est->max_sdu[queue]) {
+ if (priv->est.enable && priv->est.max_sdu[queue] &&
+ xdp_desc.len > priv->est.max_sdu[queue]) {
priv->xstats.max_sdu_txq_drop[queue]++;
continue;
}
@@ -4153,10 +4162,19 @@ static int __stmmac_open(struct net_device *dev,
ret = stmmac_hw_setup(dev);
if (ret < 0) {
netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
- goto init_error;
+ return ret;
}
- stmmac_setup_ptp(priv);
+ ret = stmmac_setup_ptp(priv);
+ if (ret)
+ goto ptp_error;
+
+ /* The core soft reset in stmmac_hw_setup() clears the MTL_EST
+ * registers, so re-apply the taprio offload after PTP is up.
+ */
+ ret = stmmac_setup_est(priv);
+ if (ret < 0)
+ goto est_error;
stmmac_init_coalesce(priv);
@@ -4179,9 +4197,11 @@ static int __stmmac_open(struct net_device *dev,
for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
-
+est_error:
stmmac_release_ptp(priv);
-init_error:
+ptp_error:
+ stmmac_stop_all_dma(priv);
+
return ret;
}
@@ -4776,13 +4796,12 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
if (skb_is_gso(skb))
return stmmac_tso_xmit(skb, dev);
- if (priv->est && priv->est->enable &&
- priv->est->max_sdu[queue]) {
+ if (priv->est.enable && priv->est.max_sdu[queue]) {
sdu_len = skb->len;
/* Add VLAN tag length if VLAN tag insertion offload is requested */
if (priv->dma_cap.vlins && skb_vlan_tag_present(skb))
sdu_len += VLAN_HLEN;
- if (sdu_len > priv->est->max_sdu[queue]) {
+ if (sdu_len > priv->est.max_sdu[queue]) {
priv->xstats.max_sdu_txq_drop[queue]++;
goto max_sdu_err;
}
@@ -5186,9 +5205,8 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,
if (stmmac_tx_avail(priv, queue) < STMMAC_TX_THRESH(priv))
return STMMAC_XDP_CONSUMED;
- if (priv->est && priv->est->enable &&
- priv->est->max_sdu[queue] &&
- xdpf->len > priv->est->max_sdu[queue]) {
+ if (priv->est.enable && priv->est.max_sdu[queue] &&
+ xdpf->len > priv->est.max_sdu[queue]) {
priv->xstats.max_sdu_txq_drop[queue]++;
return STMMAC_XDP_CONSUMED;
}
@@ -8017,6 +8035,7 @@ static int __stmmac_dvr_probe(struct device *device,
stmmac_napi_add(ndev);
mutex_init(&priv->lock);
+ mutex_init(&priv->est_lock);
stmmac_fpe_init(priv);
@@ -8148,6 +8167,7 @@ void stmmac_dvr_remove(struct device *dev)
stmmac_mdio_unregister(ndev);
destroy_workqueue(priv->wq);
+ mutex_destroy(&priv->est_lock);
mutex_destroy(&priv->lock);
bitmap_free(priv->af_xdp_zc_qps);
@@ -8318,13 +8338,16 @@ int stmmac_resume(struct device *dev)
ret = stmmac_hw_setup(ndev);
if (ret < 0) {
netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
- stmmac_legacy_serdes_power_down(priv);
- mutex_unlock(&priv->lock);
- rtnl_unlock();
- return ret;
+ goto error_unlock;
}
- stmmac_init_timestamping(priv);
+ ret = stmmac_init_timestamping(priv);
+ if (ret)
+ goto error_stop_dma;
+
+ ret = stmmac_setup_est(priv);
+ if (ret < 0)
+ goto error_stop_dma;
stmmac_init_coalesce(priv);
phylink_rx_clk_stop_block(priv->phylink);
@@ -8348,6 +8371,15 @@ int stmmac_resume(struct device *dev)
netif_device_attach(ndev);
return 0;
+
+error_stop_dma:
+ stmmac_stop_all_dma(priv);
+error_unlock:
+ stmmac_legacy_serdes_power_down(priv);
+ mutex_unlock(&priv->lock);
+ rtnl_unlock();
+
+ return ret;
}
EXPORT_SYMBOL_GPL(stmmac_resume);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index 960249960004c..8f3a90df3178c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -8,6 +8,7 @@
Author: Rayagond Kokatanur <rayagond@vayavyalabs.com>
*******************************************************************************/
#include "stmmac.h"
+#include "stmmac_est.h"
#include "stmmac_ptp.h"
#define PTP_SAFE_TIME_OFFSET_NS 500000
@@ -55,7 +56,6 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
u32 quotient, reminder;
int neg_adj = 0;
bool xmac, est_rst = false;
- int ret;
xmac = dwmac_is_xmac(priv->plat->core_type);
@@ -69,46 +69,21 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
nsec = reminder;
/* If EST is enabled, disabled it before adjust ptp time. */
- if (priv->est && priv->est->enable) {
+ mutex_lock(&priv->est_lock);
+ if (priv->est.enable) {
est_rst = true;
- mutex_lock(&priv->est_lock);
- priv->est->enable = false;
- stmmac_est_configure(priv, priv, priv->est,
- priv->plat->clk_ptp_rate);
- mutex_unlock(&priv->est_lock);
+ stmmac_est_configure(priv, priv, &priv->est,
+ priv->plat->clk_ptp_rate, false);
}
+ mutex_unlock(&priv->est_lock);
write_lock_irqsave(&priv->ptp_lock, flags);
stmmac_adjust_systime(priv, priv->ptpaddr, sec, nsec, neg_adj, xmac);
write_unlock_irqrestore(&priv->ptp_lock, flags);
/* Calculate new basetime and re-configured EST after PTP time adjust. */
- if (est_rst) {
- struct timespec64 current_time, time;
- ktime_t current_time_ns, basetime;
- u64 cycle_time;
-
- mutex_lock(&priv->est_lock);
- priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, ¤t_time);
- current_time_ns = timespec64_to_ktime(current_time);
- time.tv_nsec = priv->est->btr_reserve[0];
- time.tv_sec = priv->est->btr_reserve[1];
- basetime = timespec64_to_ktime(time);
- cycle_time = (u64)priv->est->ctr[1] * NSEC_PER_SEC +
- priv->est->ctr[0];
- time = stmmac_calc_tas_basetime(basetime,
- current_time_ns,
- cycle_time);
-
- priv->est->btr[0] = (u32)time.tv_nsec;
- priv->est->btr[1] = (u32)time.tv_sec;
- priv->est->enable = true;
- ret = stmmac_est_configure(priv, priv, priv->est,
- priv->plat->clk_ptp_rate);
- mutex_unlock(&priv->est_lock);
- if (ret)
- netdev_err(priv->dev, "failed to configure EST\n");
- }
+ if (est_rst)
+ stmmac_setup_est(priv);
return 0;
}
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 14cabe76e53ec..9745c9bae33c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -10,6 +10,7 @@
#include "dwmac4.h"
#include "dwmac5.h"
#include "stmmac.h"
+#include "stmmac_est.h"
static void tc_fill_all_pass_entry(struct stmmac_tc_entry *entry)
{
@@ -959,7 +960,7 @@ static void tc_taprio_map_maxsdu_txq(struct stmmac_priv *priv,
count = qopt->mqprio.qopt.count[i];
for (j = offset; j < offset + count; j++)
- priv->est->max_sdu[j] = qopt->max_sdu[i] + ETH_HLEN - ETH_TLEN;
+ priv->est.max_sdu[j] = qopt->max_sdu[i] + ETH_HLEN - ETH_TLEN;
}
}
@@ -968,10 +969,10 @@ static int tc_taprio_configure(struct stmmac_priv *priv,
{
u32 size, wid = priv->dma_cap.estwid, dep = priv->dma_cap.estdep;
struct netlink_ext_ack *extack = qopt->mqprio.extack;
- struct timespec64 time, current_time, qopt_time;
- ktime_t current_time_ns;
+ u64 ctr = qopt->cycle_time;
+ struct timespec64 time;
+ u32 *gcl = NULL;
int i, ret = 0;
- u64 ctr;
if (qopt->base_time < 0)
return -ERANGE;
@@ -979,6 +980,9 @@ static int tc_taprio_configure(struct stmmac_priv *priv,
if (!priv->dma_cap.estsel)
return -EOPNOTSUPP;
+ if (ctr > (u64)U32_MAX * NSEC_PER_SEC)
+ return -ERANGE;
+
switch (wid) {
case 0x1:
wid = 16;
@@ -1013,44 +1017,45 @@ static int tc_taprio_configure(struct stmmac_priv *priv,
return -EOPNOTSUPP;
}
+ mutex_lock(&priv->est_lock);
+
if (qopt->cmd == TAPRIO_CMD_DESTROY)
goto disable;
- if (qopt->num_entries > dep)
- return -EINVAL;
- if (!qopt->cycle_time)
- return -ERANGE;
- if (qopt->cycle_time_extension >= BIT(wid + 7))
- return -ERANGE;
-
- if (!priv->est) {
- priv->est = devm_kzalloc(priv->device, sizeof(*priv->est),
- GFP_KERNEL);
- if (!priv->est)
- return -ENOMEM;
+ if (qopt->num_entries > dep) {
+ ret = -EINVAL;
+ goto unlock;
+ }
- mutex_init(&priv->est_lock);
- } else {
- mutex_lock(&priv->est_lock);
- memset(priv->est, 0, sizeof(*priv->est));
- mutex_unlock(&priv->est_lock);
+ if (!qopt->cycle_time) {
+ ret = -ERANGE;
+ goto unlock;
}
- size = qopt->num_entries;
+ if (qopt->cycle_time_extension >= BIT(wid + 7)) {
+ ret = -ERANGE;
+ goto unlock;
+ }
- mutex_lock(&priv->est_lock);
- priv->est->gcl_size = size;
- priv->est->enable = qopt->cmd == TAPRIO_CMD_REPLACE;
- mutex_unlock(&priv->est_lock);
+ gcl = kzalloc(sizeof(*gcl) * EST_GCL, GFP_KERNEL);
+ if (!gcl) {
+ ret = -ENOMEM;
+ goto unlock;
+ }
+ size = qopt->num_entries;
for (i = 0; i < size; i++) {
s64 delta_ns = qopt->entries[i].interval;
u32 gates = qopt->entries[i].gate_mask;
- if (delta_ns > GENMASK(wid - 1, 0))
- return -ERANGE;
- if (gates > GENMASK(31 - wid, 0))
- return -ERANGE;
+ if (delta_ns > GENMASK(wid - 1, 0)) {
+ ret = -ERANGE;
+ goto free_gcl;
+ }
+ if (gates > GENMASK(31 - wid, 0)) {
+ ret = -ERANGE;
+ goto free_gcl;
+ }
switch (qopt->entries[i].command) {
case TC_TAPRIO_CMD_SET_GATES:
@@ -1062,65 +1067,58 @@ static int tc_taprio_configure(struct stmmac_priv *priv,
gates &= ~BIT(0);
break;
default:
- return -EOPNOTSUPP;
+ ret = -EOPNOTSUPP;
+ goto free_gcl;
}
- priv->est->gcl[i] = delta_ns | (gates << wid);
+ gcl[i] = delta_ns | (gates << wid);
}
- mutex_lock(&priv->est_lock);
- /* Adjust for real system time */
- priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, ¤t_time);
- current_time_ns = timespec64_to_ktime(current_time);
- time = stmmac_calc_tas_basetime(qopt->base_time, current_time_ns,
- qopt->cycle_time);
-
- priv->est->btr[0] = (u32)time.tv_nsec;
- priv->est->btr[1] = (u32)time.tv_sec;
+ memset(&priv->est, 0, sizeof(priv->est));
+ memcpy(priv->est.gcl, gcl, sizeof(priv->est.gcl));
+ priv->est.gcl_size = size;
- qopt_time = ktime_to_timespec64(qopt->base_time);
- priv->est->btr_reserve[0] = (u32)qopt_time.tv_nsec;
- priv->est->btr_reserve[1] = (u32)qopt_time.tv_sec;
+ time = ktime_to_timespec64(qopt->base_time);
+ priv->est.btr_reserve[0] = (u32)time.tv_nsec;
+ priv->est.btr_reserve[1] = (u32)time.tv_sec;
- ctr = qopt->cycle_time;
- priv->est->ctr[0] = do_div(ctr, NSEC_PER_SEC);
- priv->est->ctr[1] = (u32)ctr;
-
- priv->est->ter = qopt->cycle_time_extension;
+ priv->est.ctr[0] = do_div(ctr, NSEC_PER_SEC);
+ priv->est.ctr[1] = (u32)ctr;
+ priv->est.ter = qopt->cycle_time_extension;
tc_taprio_map_maxsdu_txq(priv, qopt);
- ret = stmmac_est_configure(priv, priv, priv->est,
- priv->plat->clk_ptp_rate);
- mutex_unlock(&priv->est_lock);
- if (ret) {
- netdev_err(priv->dev, "failed to configure EST\n");
+ ret = __stmmac_setup_est(priv);
+ if (ret)
goto disable;
- }
ret = stmmac_fpe_map_preemption_class(priv, priv->dev, extack,
qopt->mqprio.preemptible_tcs);
if (ret)
goto disable;
+ priv->est.enable = true;
+ kfree(gcl);
+
+ mutex_unlock(&priv->est_lock);
+
return 0;
disable:
- if (priv->est) {
- mutex_lock(&priv->est_lock);
- priv->est->enable = false;
- stmmac_est_configure(priv, priv, priv->est,
- priv->plat->clk_ptp_rate);
- /* Reset taprio status */
- for (i = 0; i < priv->plat->tx_queues_to_use; i++) {
- priv->xstats.max_sdu_txq_drop[i] = 0;
- priv->xstats.mtl_est_txq_hlbf[i] = 0;
- priv->xstats.mtl_est_txq_hlbs[i] = 0;
- }
- mutex_unlock(&priv->est_lock);
+ priv->est.enable = false;
+ stmmac_est_configure(priv, priv, &priv->est,
+ priv->plat->clk_ptp_rate, false);
+ /* Reset taprio status */
+ for (i = 0; i < priv->plat->tx_queues_to_use; i++) {
+ priv->xstats.max_sdu_txq_drop[i] = 0;
+ priv->xstats.mtl_est_txq_hlbf[i] = 0;
+ priv->xstats.mtl_est_txq_hlbs[i] = 0;
}
-
stmmac_fpe_map_preemption_class(priv, priv->dev, extack, 0);
+free_gcl:
+ kfree(gcl);
+unlock:
+ mutex_unlock(&priv->est_lock);
return ret;
}
|
| 3/2 | 2026/09/03 19:32 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10706 output: 39 thoughts: 303 Thoughts: **Analyzing a Driver Patch for Fuzzing Potential** Okay, let's dive into this patch and figure out if it's a good target for fuzzing. My initial thought process is to quickly assess its fuzzing potential, considering reachability, configuration options, and whether any specific symbols look promising. First, I need to know *what* the patch actually touches. Looks like it modifies a significant chunk of the `stmmac` driver: `hwif.h`, `stmmac.h`, `stmmac_est.c`, `stmmac_est.h`, `stmmac_main.c`, `stmmac_ptp.c`, and `stmmac_tc.c`. That's a good start; it's spread across various parts of the driver, which suggests more surface area for potential vulnerabilities. Next, I need to understand if `stmmac` is even reachable in a typical fuzzing environment. Does it work with the standard QEMU setup I use? I have to consider its platform dependencies. What buses does `stmmac` utilize? I'll probably reach for `grepper` or `read-file` to check the `Kconfig` file in the driver directory (`drivers/net/ethernet/stmicro/stmmac/Kconfig`), as well as any glue layer code related to PCI, platform devices, or whatever else it relies on. That should give me a good picture of its configuration options and hardware dependencies. This will help me build a fuzzing setup that can actually hit this code. |
| 4/2 | 2026/09/03 19:32 | tool | grepper |
0mArgs:{
"Expression": "STMMAC",
"PathPrefix": "drivers/net/ethernet/stmicro/stmmac/Kconfig"
}Results: {
"Output": "drivers/net/ethernet/stmicro/stmmac/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:2:config STMMAC_ETH\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-3-\ttristate \"STMicroelectronics Multi-Gigabit Ethernet driver\"\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-17-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:18:if STMMAC_ETH\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-19-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:20:config STMMAC_SELFTESTS\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:21:\tbool \"Support for STMMAC Selftests\"\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-22-\tdepends on INET\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-24-\thelp\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:25:\t This adds support for STMMAC Selftests using ethtool. Enable this\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-26-\t feature if you are facing problems with your HW and submit the test\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-28-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:29:config STMMAC_PLATFORM\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:30:\ttristate \"STMMAC Platform bus support\"\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-31-\tselect MFD_SYSCON\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-41-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:42:if STMMAC_PLATFORM\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-43-\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig=52=config DWMAC_GENERIC\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-53-\ttristate \"Generic driver for DWMAC\"\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:54:\tdefault STMMAC_PLATFORM\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-55-\thelp\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig=364=config DWMAC_VISCONTI\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-370-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:371:endif # STMMAC_PLATFORM\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-372-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:373:config STMMAC_LIBPCI\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-374-\ttristate\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig=388=config DWMAC_LOONGSON\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-392-\tdepends on COMMON_CLK\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:393:\tselect STMMAC_LIBPCI\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-394-\thelp\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig=398=config DWMAC_MOTORCOMM\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-401-\tselect MOTORCOMM_PHY\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:402:\tselect STMMAC_LIBPCI\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-403-\thelp\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-406-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:407:config STMMAC_PCI\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:408:\ttristate \"STMMAC PCI bus support\"\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-409-\tdepends on PCI\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-410-\tdepends on COMMON_CLK\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:411:\tselect STMMAC_LIBPCI\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-412-\thelp\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-419-\t If unsure, say N.\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:420:endif # STMMAC_ETH\n"
} |
| 5/2 | 2026/09/03 19:32 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12695 output: 39 thoughts: 75 Thoughts: **Investigating STMMAC PCI ID Support** Okay, so I need to figure out the specifics of how the `STMMAC_PCI` driver is handled. Is this something that's natively supported within a standard QEMU environment, or is it more complex, perhaps tied to physical hardware? I'm going to need to dig into the driver code itself to get a clear picture. My initial plan is to grep through the relevant source files – specifically, I'll start with `drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c`, and `stmmac_pci.c`, and any other likely candidates. This should reveal the PCI ID definitions and the overall implementation strategy for `STMMAC_PCI`, allowing me to determine its behavior and how it relates to emulated versus physical network interfaces. |
| 6/2 | 2026/09/03 19:32 | tool | grepper |
0mArgs:{
"Expression": "MODULE_DEVICE_TABLE",
"PathPrefix": "drivers/net/ethernet/stmicro/stmmac/"
}Results: {
"Output": "drivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c=119=static const struct of_device_id anarion_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-122-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c:123:MODULE_DEVICE_TABLE(of, anarion_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-124-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c=353=static const struct of_device_id dwc_eth_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-358-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c:359:MODULE_DEVICE_TABLE(of, dwc_eth_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-360-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c=350=static const struct of_device_id eic7700_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-359-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c:360:MODULE_DEVICE_TABLE(of, eic7700_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-361-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c=52=static const struct of_device_id dwmac_generic_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-66-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c:67:MODULE_DEVICE_TABLE(of, dwmac_generic_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-68-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c=384=static const struct of_device_id imx_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-389-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c:390:MODULE_DEVICE_TABLE(of, imx_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-391-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c=262=static const struct of_device_id ingenic_mac_of_matches[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-269-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c:270:MODULE_DEVICE_TABLE(of, ingenic_mac_of_matches);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-271-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c=36=static const struct of_device_id intel_eth_plat_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-39-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c:40:MODULE_DEVICE_TABLE(of, intel_eth_plat_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-41-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c=1395=static const struct pci_device_id intel_eth_pci_id_table[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1414-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c:1415:MODULE_DEVICE_TABLE(pci, intel_eth_pci_id_table);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1416-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c=491=static const struct of_device_id ipq806x_gmac_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-494-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c:495:MODULE_DEVICE_TABLE(of, ipq806x_gmac_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-496-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c=596=static const struct pci_device_id loongson_dwmac_id_table[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-601-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c:602:MODULE_DEVICE_TABLE(pci, loongson_dwmac_id_table);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-603-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c=216=static const struct of_device_id ls1x_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-226-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c:227:MODULE_DEVICE_TABLE(of, ls1x_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-228-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c=71=static const struct of_device_id lpc18xx_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-74-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c:75:MODULE_DEVICE_TABLE(of, lpc18xx_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-76-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c=662=static const struct of_device_id mediatek_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-669-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c:670:MODULE_DEVICE_TABLE(of, mediatek_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-671-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c=76=static const struct of_device_id meson6_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-79-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c:80:MODULE_DEVICE_TABLE(of, meson6_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-81-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c=482=static const struct of_device_id meson8b_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-504-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c:505:MODULE_DEVICE_TABLE(of, meson8b_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-506-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c=367=static const struct pci_device_id dwmac_motorcomm_pci_id_table[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-370-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c:371:MODULE_DEVICE_TABLE(pci, dwmac_motorcomm_pci_id_table);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-372-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c=118=static const struct of_device_id nvt_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-121-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c:122:MODULE_DEVICE_TABLE(of, nvt_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-123-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c=800=static const struct of_device_id qcom_ethqos_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-806-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c:807:MODULE_DEVICE_TABLE(of, qcom_ethqos_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-808-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c=216=static const struct of_device_id renesas_gbeth_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-221-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c:222:MODULE_DEVICE_TABLE(of, renesas_gbeth_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-223-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c=1616=static const struct of_device_id rk_gmac_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1634-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c:1635:MODULE_DEVICE_TABLE(of, rk_gmac_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1636-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c=75=static const struct of_device_id rzn1_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-78-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c:79:MODULE_DEVICE_TABLE(of, rzn1_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-80-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c=216=static const struct of_device_id s32_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-219-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c:220:MODULE_DEVICE_TABLE(of, s32_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-221-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c=673=static const struct of_device_id socfpga_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-678-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c:679:MODULE_DEVICE_TABLE(of, socfpga_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-680-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c=72=static const struct of_device_id sophgo_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-76-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c:77:MODULE_DEVICE_TABLE(of, sophgo_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-78-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c=210=static const struct of_device_id spacemit_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-213-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c:214:MODULE_DEVICE_TABLE(of, spacemit_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-215-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c=160=static const struct of_device_id starfive_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-164-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c:165:MODULE_DEVICE_TABLE(of, starfive_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-166-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c=296=static const struct of_device_id sti_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-299-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c:300:MODULE_DEVICE_TABLE(of, sti_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-301-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c=662=static const struct of_device_id stm32_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-668-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c:669:MODULE_DEVICE_TABLE(of, stm32_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-670-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c=141=static const struct of_device_id sun55i_gmac200_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-144-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c:145:MODULE_DEVICE_TABLE(of, sun55i_gmac200_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-146-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c=1268=static const struct of_device_id sun8i_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1282-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:1283:MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1284-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c=150=static const struct of_device_id sun7i_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-153-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c:154:MODULE_DEVICE_TABLE(of, sun7i_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-155-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c=397=static const struct of_device_id tegra_mgbe_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-400-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c:401:MODULE_DEVICE_TABLE(of, tegra_mgbe_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-402-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c=267=static const struct of_device_id thead_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-270-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c:271:MODULE_DEVICE_TABLE(of, thead_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-272-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c=255=static const struct of_device_id visconti_eth_dwmac_match[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-258-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c:259:MODULE_DEVICE_TABLE(of, visconti_eth_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-260-\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c=203=static const struct pci_device_id stmmac_id_table[] = {\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-209-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:210:MODULE_DEVICE_TABLE(pci, stmmac_id_table);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-211-\n"
} |
| 7/2 | 2026/09/03 19:32 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18351 output: 50 thoughts: 59 Thoughts: **Examining Network Driver Instantiation** Okay, let's dive in. My immediate focus is on understanding the interaction between the driver and the hardware. I need to confirm whether `stmmac_pci.c` and `dwmac-intel.c` are properly identifying the device IDs, and crucially, if `stmmac` is being correctly instantiated or if we're dealing with a physical hardware setup. I have to make sure the driver is attaching correctly. My next step is to examine the contents of `stmmac_pci.c`, because that will immediately tell me what device IDs it handles, and if it's correctly identifying the hardware and instantiating the stmmac driver. |
| 8/2 | 2026/09/03 19:32 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c",
"FirstLine": 190,
"LineCount": 40
}Results: {
"Contents": " 190:\t * Description: this function calls the main to free the net resources.\n 191:\t */\n 192:\tstatic void stmmac_pci_remove(struct pci_dev *pdev)\n 193:\t{\n 194:\t\tstmmac_dvr_remove(\u0026pdev-\u003edev);\n 195:\t}\n 196:\t\n 197:\t/* synthetic ID, no official vendor */\n 198:\t#define PCI_VENDOR_ID_STMMAC\t\t0x0700\n 199:\t\n 200:\t#define PCI_DEVICE_ID_STMMAC_STMMAC\t\t0x1108\n 201:\t#define PCI_DEVICE_ID_SYNOPSYS_GMAC5_ID\t\t0x7102\n 202:\t\n 203:\tstatic const struct pci_device_id stmmac_id_table[] = {\n 204:\t\t{ PCI_DEVICE_DATA(STMMAC, STMMAC, \u0026stmmac_pci_info) },\n 205:\t\t{ PCI_DEVICE_DATA(STMICRO, MAC, \u0026stmmac_pci_info) },\n 206:\t\t{ PCI_DEVICE_DATA(SYNOPSYS, GMAC5_ID, \u0026snps_gmac5_pci_info) },\n 207:\t\t{}\n 208:\t};\n 209:\t\n 210:\tMODULE_DEVICE_TABLE(pci, stmmac_id_table);\n 211:\t\n 212:\tstatic struct pci_driver stmmac_pci_driver = {\n 213:\t\t.name = STMMAC_RESOURCE_NAME,\n 214:\t\t.id_table = stmmac_id_table,\n 215:\t\t.probe = stmmac_pci_probe,\n 216:\t\t.remove = stmmac_pci_remove,\n 217:\t\t.driver = {\n 218:\t\t\t.pm = \u0026stmmac_simple_pm_ops,\n 219:\t\t},\n 220:\t};\n 221:\t\n 222:\tmodule_pci_driver(stmmac_pci_driver);\n 223:\t\n 224:\tMODULE_DESCRIPTION(\"STMMAC 10/100/1000 Ethernet PCI driver\");\n 225:\tMODULE_AUTHOR(\"Rayagond Kokatanur \u003crayagond.kokatanur@vayavyalabs.com\u003e\");\n 226:\tMODULE_AUTHOR(\"Giuseppe Cavallaro \u003cpeppe.cavallaro@st.com\u003e\");\n 227:\tMODULE_LICENSE(\"GPL\");\n"
} |
| 9/2 | 2026/09/03 19:32 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 19313 output: 22 thoughts: 670 Thoughts: **My QEMU/STMMAC Investigation** Okay, so I'm trying to figure out if I can even *reach* this `stmmac` code with standard fuzzing techniques. First, is QEMU even emulating `STMMAC` or `DWMAC`? And if so, is it for ARM or x86? The target is `amd64`, so that's the focus. I need to know if I can instantiate it in a standard QEMU environment, or even on Google Compute Engine (GCE). My initial thought is that I remember `allwinner-emac` or `sunxi` for ARM/RISC-V, but for x86_64, which is the platform of interest, the answer might be different. I recalled that the documentation says "structurally unreachable hardware" like vendor-specific PCIe switches and NICs requiring physical cards aren't emulated. So, what *is* emulated? I know about `e1000`, `e1000e`, `rtl8139`, etc. But is `stmmac` one of those? No, `stmmac` is a Synopsys DesignWare Ethernet MAC (DWMAC) IP core, used in SoCs like STM32, Rockchip, Allwinner, Intel's Alder Lake PSE, and others. That makes me think it's more deeply tied to the hardware and might be a problem. Let me review the prompt again, specifically Section 2. It explicitly mentions "structurally unreachable hardware" and gives examples like those specific PCIe cards. Also, the prompt discusses things like driver teardown callbacks and architecture-specific code as "unreachable execution paths" in a virtualized setting. Then, Section 1 reinforces the point: reachability is the primary gate. If the code is structurally unreachable *because* it depends on hardware not available in QEMU (or GCE) then it shouldn't be fuzzed. Therefore, I need to figure out if `stmmac` is reachable through any software-emulated devices. Is there any way to mock it, or connect to it through a `netdev`, or use a `tun/tap` device? I'll search for `stmmac` references in the kernel tree. I need to determine if any virtual device drivers utilize this. Maybe there's a platform device or mock or netdev associated with it. This is the crux of whether I can even proceed with fuzzing this code. |
| 10/2 | 2026/09/03 19:32 | tool | grepper |
0mArgs:{
"Expression": "stmmac_dvr_probe"
}Results: {
"Output": "drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c=283=static int dwc_eth_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-329-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c:330:\tret = stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-331-\tif (ret)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c=42=static int intel_eth_plat_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-117-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c:118:\tret = stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-119-\tif (ret)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c=1263=static int intel_eth_pci_probe(struct pci_dev *pdev,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1340-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c:1341:\tret = stmmac_dvr_probe(\u0026pdev-\u003edev, plat, \u0026res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1342-\tif (ret) {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c=374=static int ipq806x_gmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-482-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c:483:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-484-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c=498=static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-561-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c:562:\tret = stmmac_dvr_probe(\u0026pdev-\u003edev, plat, \u0026res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-563-\tif (ret)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c=42=static int lpc18xx_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-67-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c:68:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-69-}\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c=599=static int mediatek_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-641-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c:642:\tret = stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-643-\tif (ret)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c=47=static int meson6_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-72-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c:73:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-74-}\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c=382=static int meson8b_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-463-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c:464:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-465-}\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c=293=static int motorcomm_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-358-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c:359:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat, \u0026res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-360-}\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c=48=static int rzn1_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-67-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c:68:\tret = stmmac_dvr_probe(dev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-69-\tif (ret)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c=35=static int sophgo_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-64-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c:65:\treturn stmmac_dvr_probe(dev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-66-}\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c=147=static int spacemit_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-206-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c:207:\treturn stmmac_dvr_probe(dev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-208-}\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c=90=static int starfive_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-152-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c:153:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-154-}\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c=525=static int stm32_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-578-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c:579:\tret = stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-580-\tif (ret)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c=1105=static int sun8i_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1201-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:1202:\t/* the MAC is runtime suspended after stmmac_dvr_probe(), so we\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1203-\t * need to ensure the MAC resume back before other operations such\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1208-\t/* The mux must be registered after parent MDIO\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:1209:\t * so after stmmac_dvr_probe()\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1210-\t */\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c=214=static int tegra_mgbe_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-375-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c:376:\terr = stmmac_dvr_probe(\u0026pdev-\u003edev, plat, \u0026res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-377-\tif (err \u003c 0)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c=205=static int visconti_eth_dwmac_probe(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-236-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c:237:\tret = stmmac_dvr_probe(\u0026pdev-\u003edev, plat_dat, \u0026stmmac_res);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-238-\tif (ret)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h=411=void stmmac_dvr_remove(struct device *dev);\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h:412:int stmmac_dvr_probe(struct device *device,\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h-413-\t\t struct plat_stmmacenet_data *plat_dat,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c=7805=EXPORT_SYMBOL_GPL(stmmac_plat_dat_alloc);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-7806-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c:7807:static int __stmmac_dvr_probe(struct device *device,\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-7808-\t\t\t struct plat_stmmacenet_data *plat_dat,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8110-/**\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c:8111: * stmmac_dvr_probe\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8112- * @dev: device pointer\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8119- */\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c:8120:int stmmac_dvr_probe(struct device *dev, struct plat_stmmacenet_data *plat_dat,\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8121-\t\t struct stmmac_resources *res)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8130-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c:8131:\tret = __stmmac_dvr_probe(dev, plat_dat, res);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8132-\tif (ret \u0026\u0026 plat_dat-\u003eexit)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8136-}\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c:8137:EXPORT_SYMBOL_GPL(stmmac_dvr_probe);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_main.c-8138-\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c=118=static int stmmac_pci_probe(struct pci_dev *pdev,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-182-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:183:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat, \u0026res);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-184-}\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_platform.c=846=int stmmac_pltfr_probe(struct platform_device *pdev,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_platform.c-854-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_platform.c:855:\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat, res);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_platform.c-856-}\n"
} |
| 11/2 | 2026/09/03 19:32 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 24658 output: 108 thoughts: 787 Thoughts: **My Assessment: Structurally Unreachable Code in stmmac Driver** Okay, so I've gone through the code and my conclusion is that this `stmmac` driver modification is *not* worth fuzzing, based on the criteria. Here's my thought process: First, I identified that all the probe functions calling `stmmac_dvr_probe` are specifically for physical hardware devices, either PCI-based (like `stmmac_pci_probe`, `intel_eth_pci_probe`) or integrated into SoCs. None of these are standard devices available in the QEMU or GCE environments commonly used for fuzzing, and certainly not on amd64. I even double-checked for virtual `stmmac` devices, USB gadgets, or loopback interfaces that might offer a path, but found none. Next, I referenced the fuzzing guidelines. Section 2 clearly defines "structurally unreachable hardware" as a negative criterion, specifically mentioning NIC drivers requiring physical hardware not emulated in standard QEMU. That's `stmmac` to a tee: a Synopsys DesignWare MAC (DWMAC) IP driver, whether on an STMicroelectronics SoC or a PCI add-in board. Section 3 outlines positive criteria, but none of those apply here. There's no virtual bus access, no loopback, no common socket usage – nothing that gives a path into this code in a standard fuzzing setup. Therefore, the fix, being focused on EST (Scheduled Traffic / TAPRIO) lifecycle and configuration within the `stmmac` driver, is structurally unreachable. It needs physical hardware, which means it can't be reached by standard fuzzing. My final verification confirms all modified files are indeed within the `drivers/net/ethernet/stmicro/stmmac/` directory. So, I'm confident in setting the results: `WorthFuzzing=false`, `EnableConfigs=[]`, `FocusSymbols=[]`. The reasoning is clear: the `stmmac` driver is structurally unreachable hardware in the context of standard QEMU/GCE environments. We're done here, let's call `set-results`. |
| 12/2 | 2026/09/03 19:33 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the STMicroelectronics / Synopsys DesignWare Ethernet MAC (stmmac) driver to handle EST (Enhancements for Scheduled Traffic / TAPRIO) setup and lifecycle. This driver controls physical SoC/PCI Ethernet MAC hardware that is not emulated in standard virtualized QEMU/GCE environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the STMicroelectronics / Synopsys DesignWare Ethernet MAC (stmmac) driver to handle EST (Enhancements for Scheduled Traffic / TAPRIO) setup and lifecycle. This driver controls physical SoC/PCI Ethernet MAC hardware that is not emulated in standard virtualized QEMU/GCE environments, making the modified code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 13/1 | 2026/09/03 19:33 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|