| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/10/04 20:53 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies the RX DMA descriptor processing, buffer recycling, and XDP packet handling logic in the STMicroelectronics / Synopsys DesignWare MAC (stmmac) ethernet driver (drivers/net/ethernet/stmicro/stmmac/). This driver targets physical ethernet controllers found on dedicated SoCs or specific PCI cards, none of which are emulated in standard virtualized environments (such as QEMU or GCE on amd64). Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/10/04 20:53 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit c8db0fc53e802a9623c4b39b39c0948e6aa5e507\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Oct 4 20:53:00 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h\nindex 4fc96b317d79c..0148891dbcb4f 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h\n@@ -132,7 +132,8 @@ struct stmmac_rx_queue {\n \tdma_addr_t dma_rx_phy;\n \tunsigned int state_saved;\n \tstruct {\n-\t\tstruct sk_buff *skb;\n+\t\tstruct xdp_buff xdp;\n+\t\tunsigned int frames;\n \t\tunsigned int len;\n \t\tunsigned int error;\n \t} state;\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\nindex 0c381ae0d0ffa..3098fd6df1582 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\n@@ -158,6 +158,9 @@ static void stmmac_flush_tx_descriptors(struct stmmac_priv *priv, int queue);\n static void stmmac_set_dma_operation_mode(struct stmmac_priv *priv, u32 txmode,\n \t\t\t\t\t u32 rxmode, u32 chan);\n static void stmmac_vlan_restore(struct stmmac_priv *priv);\n+static void stmmac_xdp_put_buff(struct stmmac_rx_queue *rx_q,\n+\t\t\t\tstruct xdp_buff *xdp, int sync_len,\n+\t\t\t\tbool allow_direct);\n \n #ifdef CONFIG_DEBUG_FS\n static const struct net_device_ops stmmac_netdev_ops;\n@@ -2180,6 +2183,11 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,\n \telse\n \t\tdma_free_rx_skbufs(priv, dma_conf, queue);\n \n+\tif (rx_q-\u003estate.frames \u0026\u0026 !rx_q-\u003exsk_pool) {\n+\t\tstmmac_xdp_put_buff(rx_q, \u0026rx_q-\u003estate.xdp, -1, false);\n+\t\trx_q-\u003estate.frames = 0;\n+\t}\n+\trx_q-\u003estate_saved = false;\n \trx_q-\u003ebuf_alloc_num = 0;\n \trx_q-\u003exsk_pool = NULL;\n \n@@ -5581,12 +5589,12 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)\n \tunsigned int count = 0, error = 0, len = 0;\n \tint dirty = stmmac_rx_dirty(priv, queue);\n \tunsigned int next_entry = rx_q-\u003ecur_rx;\n+\tbool in_progress = rx_q-\u003estate_saved;\n \tu32 rx_errors = 0, rx_dropped = 0;\n \tunsigned int desc_size;\n \tstruct bpf_prog *prog;\n \tbool failure = false;\n \tint xdp_status = 0;\n-\tint status = 0;\n \n \tif (netif_msg_rx_status(priv)) {\n \t\tvoid *rx_head = stmmac_get_rx_desc(priv, rx_q, 0);\n@@ -5597,23 +5605,25 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)\n \t\tstmmac_display_ring(priv, rx_head, priv-\u003edma_conf.dma_rx_size, true,\n \t\t\t\t rx_q-\u003edma_rx_phy, desc_size);\n \t}\n+\n+\tif (rx_q-\u003estate_saved) {\n+\t\terror = rx_q-\u003estate.error;\n+\t\tlen = rx_q-\u003estate.len;\n+\t\trx_q-\u003estate_saved = false;\n+\t}\n+\n \twhile (count \u003c limit) {\n \t\tstruct stmmac_rx_buffer *buf;\n \t\tstruct stmmac_xdp_buff *ctx;\n \t\tunsigned int buf1_len = 0;\n \t\tstruct dma_desc *np, *p;\n-\t\tint entry;\n+\t\tint entry, status;\n \t\tint res;\n \n-\t\tif (!count \u0026\u0026 rx_q-\u003estate_saved) {\n-\t\t\terror = rx_q-\u003estate.error;\n-\t\t\tlen = rx_q-\u003estate.len;\n-\t\t} else {\n-\t\t\trx_q-\u003estate_saved = false;\n+\t\tif (!in_progress) {\n \t\t\terror = 0;\n \t\t\tlen = 0;\n \t\t}\n-\n read_again:\n \t\tif (count \u003e= limit)\n \t\t\tbreak;\n@@ -5652,6 +5662,8 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)\n \t\tif (!buf-\u003exdp)\n \t\t\tbreak;\n \n+\t\tin_progress = status \u0026 rx_not_ls;\n+\n \t\tif (priv-\u003eextend_desc)\n \t\t\tstmmac_rx_extended_status(priv, \u0026priv-\u003exstats,\n \t\t\t\t\t\t rx_q-\u003edma_erx + entry);\n@@ -5724,7 +5736,7 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)\n \t\tcount++;\n \t}\n \n-\tif (status \u0026 rx_not_ls) {\n+\tif (in_progress) {\n \t\trx_q-\u003estate_saved = true;\n \t\trx_q-\u003estate.error = error;\n \t\trx_q-\u003estate.len = len;\n@@ -5751,6 +5763,118 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)\n \treturn failure ? limit : (int)count;\n }\n \n+static void\n+stmmac_xdp_put_buff(struct stmmac_rx_queue *rx_q, struct xdp_buff *xdp,\n+\t\t int sync_len, bool allow_direct)\n+{\n+\tstruct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp);\n+\tint i;\n+\n+\tif (likely(!xdp_buff_has_frags(xdp)))\n+\t\tgoto out;\n+\n+\tfor (i = 0; i \u003c sinfo-\u003enr_frags; i++)\n+\t\tpage_pool_put_full_page(rx_q-\u003epage_pool,\n+\t\t\t\t\tskb_frag_page(\u0026sinfo-\u003efrags[i]),\n+\t\t\t\t\tallow_direct);\n+out:\n+\tpage_pool_put_page(rx_q-\u003epage_pool, virt_to_head_page(xdp-\u003edata),\n+\t\t\t sync_len, allow_direct);\n+}\n+\n+static struct sk_buff *stmmac_build_skb(struct xdp_buff *xdp)\n+{\n+\tstruct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp);\n+\tu32 metasize = xdp-\u003edata - xdp-\u003edata_meta;\n+\tstruct sk_buff *skb;\n+\tu8 num_frags = 0;\n+\n+\tif (unlikely(xdp_buff_has_frags(xdp)))\n+\t\tnum_frags = sinfo-\u003enr_frags;\n+\n+\tskb = napi_build_skb(xdp-\u003edata_hard_start, xdp-\u003eframe_sz);\n+\tif (!skb)\n+\t\treturn NULL;\n+\n+\tskb_mark_for_recycle(skb);\n+\tskb_reserve(skb, xdp-\u003edata - xdp-\u003edata_hard_start);\n+\tskb_put(skb, xdp-\u003edata_end - xdp-\u003edata);\n+\tif (metasize)\n+\t\tskb_metadata_set(skb, metasize);\n+\n+\tif (unlikely(xdp_buff_has_frags(xdp)))\n+\t\txdp_update_skb_frags_info(skb, num_frags, sinfo-\u003exdp_frags_size,\n+\t\t\t\t\t num_frags * xdp-\u003eframe_sz,\n+\t\t\t\t\t xdp_buff_get_skb_flags(xdp));\n+\treturn skb;\n+}\n+\n+static bool stmmac_build_xdp_frags(struct stmmac_priv *priv,\n+\t\t\t\t struct stmmac_rx_queue *rx_q,\n+\t\t\t\t unsigned int len, struct page *page,\n+\t\t\t\t unsigned int offset,\n+\t\t\t\t enum dma_data_direction dma_dir,\n+\t\t\t\t struct xdp_buff *xdp)\n+{\n+\tdma_addr_t dma_addr = page_pool_get_dma_addr(page) + offset;\n+\n+\tdma_sync_single_for_cpu(priv-\u003edevice, dma_addr, len, dma_dir);\n+\tif (!xdp_buff_add_frag(xdp, page_to_netmem(page), offset, len,\n+\t\t\t xdp-\u003eframe_sz)) {\n+\t\tpage_pool_put_full_page(rx_q-\u003epage_pool, page, true);\n+\t\treturn false;\n+\t}\n+\n+\treturn true;\n+}\n+\n+static int stmmac_xdp_shrink_tail(struct stmmac_rx_queue *rx_q,\n+\t\t\t\t struct xdp_buff *xdp, int offset)\n+{\n+\tstruct skb_shared_info *sinfo;\n+\tint i;\n+\n+\tif (unlikely(offset \u003c 0 ||\n+\t\t offset \u003e (int)xdp_get_buff_len(xdp) - ETH_HLEN))\n+\t\treturn -EINVAL;\n+\n+\tif (likely(!xdp_buff_has_frags(xdp))) {\n+\t\txdp-\u003edata_end -= offset;\n+\t\treturn 0;\n+\t}\n+\n+\tsinfo = xdp_get_shared_info_from_buff(xdp);\n+\tfor (i = sinfo-\u003enr_frags - 1; i \u003e= 0 \u0026\u0026 offset \u003e 0; i--) {\n+\t\tskb_frag_t *frag = \u0026sinfo-\u003efrags[i];\n+\t\tint delta = min_t(int, offset, skb_frag_size(frag));\n+\n+\t\tif (delta == skb_frag_size(frag)) {\n+\t\t\t/* The whole frag is consumed by the strip: return it\n+\t\t\t * to the page pool right away. Its ring slot still\n+\t\t\t * carries the page DMA address until stmmac_rx_refill()\n+\t\t\t * re-arms it at the end of the NAPI poll. This is\n+\t\t\t * safe because HW cannot touch the slot until then.\n+\t\t\t */\n+\t\t\tpage_pool_put_full_page(rx_q-\u003epage_pool,\n+\t\t\t\t\t\tskb_frag_page(frag), true);\n+\t\t\tsinfo-\u003enr_frags--;\n+\t\t} else {\n+\t\t\tskb_frag_size_sub(frag, delta);\n+\t\t}\n+\n+\t\tsinfo-\u003exdp_frags_size -= delta;\n+\t\toffset -= delta;\n+\t}\n+\n+\tif (unlikely(!sinfo-\u003enr_frags)) {\n+\t\txdp_buff_clear_frags_flag(xdp);\n+\t\txdp_buff_clear_frag_pfmemalloc(xdp);\n+\t\txdp-\u003edata_end -= offset;\n+\t}\n+\n+\treturn 0;\n+}\n+\n /**\n * stmmac_rx - manage the receive process\n * @priv: driver private structure\n@@ -5764,20 +5888,20 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)\n \tu32 rx_errors = 0, rx_dropped = 0, rx_bytes = 0, rx_packets = 0;\n \tstruct stmmac_rxq_stats *rxq_stats = \u0026priv-\u003exstats.rxq_stats[queue];\n \tstruct stmmac_rx_queue *rx_q = \u0026priv-\u003edma_conf.rx_queue[queue];\n+\tunsigned int frames = 0, next_entry = rx_q-\u003ecur_rx;\n \tstruct stmmac_channel *ch = \u0026priv-\u003echannel[queue];\n \tunsigned int count = 0, error = 0, len = 0;\n-\tint status = 0, coe = priv-\u003ehw-\u003erx_csum;\n-\tunsigned int next_entry = rx_q-\u003ecur_rx;\n+\tbool in_progress = rx_q-\u003estate_saved;\n \tenum dma_data_direction dma_dir;\n-\tunsigned int desc_size;\n-\tstruct sk_buff *skb = NULL;\n+\tint coe = priv-\u003ehw-\u003erx_csum;\n \tstruct stmmac_xdp_buff ctx;\n-\tbool fcs_stripped = false;\n+\tunsigned int desc_size;\n \tint xdp_status = 0;\n \tint bufsz;\n \n \tdma_dir = page_pool_get_dma_dir(rx_q-\u003epage_pool);\n-\tbufsz = DIV_ROUND_UP(priv-\u003edma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;\n+\tbufsz = rx_q-\u003enapi_skb_frag_size;\n+\tctx.priv = priv;\n \n \tif (netif_msg_rx_status(priv)) {\n \t\tvoid *rx_head = stmmac_get_rx_desc(priv, rx_q, 0);\n@@ -5788,25 +5912,30 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)\n \t\tstmmac_display_ring(priv, rx_head, priv-\u003edma_conf.dma_rx_size, true,\n \t\t\t\t rx_q-\u003edma_rx_phy, desc_size);\n \t}\n+\n+\tif (rx_q-\u003estate_saved) {\n+\t\tctx.xdp = rx_q-\u003estate.xdp;\n+\t\terror = rx_q-\u003estate.error;\n+\t\tframes = rx_q-\u003estate.frames;\n+\t\tlen = rx_q-\u003estate.len;\n+\t\trx_q-\u003estate_saved = false;\n+\t\trx_q-\u003estate.frames = 0;\n+\t}\n+\n \twhile (count \u003c limit) {\n \t\tunsigned int buf1_len = 0, buf2_len = 0;\n+\t\tunsigned int pre_len, sync_len;\n \t\tenum pkt_hash_types hash_type;\n \t\tstruct stmmac_rx_buffer *buf;\n \t\tstruct dma_desc *np, *p;\n-\t\tint entry;\n+\t\tstruct sk_buff *skb;\n+\t\tint entry, status;\n \t\tu32 hash;\n \n-\t\tif (!count \u0026\u0026 rx_q-\u003estate_saved) {\n-\t\t\tskb = rx_q-\u003estate.skb;\n-\t\t\terror = rx_q-\u003estate.error;\n-\t\t\tlen = rx_q-\u003estate.len;\n-\t\t} else {\n-\t\t\trx_q-\u003estate_saved = false;\n-\t\t\tskb = NULL;\n+\t\tif (!in_progress) {\n \t\t\terror = 0;\n \t\t\tlen = 0;\n \t\t}\n-\n read_again:\n \t\tif (count \u003e= limit)\n \t\t\tbreak;\n@@ -5835,23 +5964,29 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)\n \n \t\tprefetch(np);\n \n+\t\tin_progress = status \u0026 rx_not_ls;\n+\n \t\tif (priv-\u003eextend_desc)\n \t\t\tstmmac_rx_extended_status(priv, \u0026priv-\u003exstats, rx_q-\u003edma_erx + entry);\n \t\tif (unlikely(status == discard_frame)) {\n-\t\t\tpage_pool_put_page(rx_q-\u003epage_pool, buf-\u003epage, 0, true);\n-\t\t\tbuf-\u003epage = NULL;\n \t\t\terror = 1;\n \t\t\tif (!priv-\u003ehwts_rx_en)\n \t\t\t\trx_errors++;\n \t\t}\n \n-\t\tif (unlikely(error \u0026\u0026 (status \u0026 rx_not_ls)))\n-\t\t\tgoto read_again;\n \t\tif (unlikely(error)) {\n-\t\t\tdev_kfree_skb(skb);\n-\t\t\tskb = NULL;\n-\t\t\tcount++;\n-\t\t\tcontinue;\n+\t\t\tpage_pool_put_page(rx_q-\u003epage_pool, buf-\u003epage, 0, true);\n+\t\t\tbuf-\u003epage = NULL;\n+\t\t\tif (buf-\u003esec_page) {\n+\t\t\t\tpage_pool_put_page(rx_q-\u003epage_pool,\n+\t\t\t\t\t\t buf-\u003esec_page, 0, true);\n+\t\t\t\tbuf-\u003esec_page = NULL;\n+\t\t\t}\n+\n+\t\t\tif (status \u0026 rx_not_ls)\n+\t\t\t\tgoto read_again;\n+\n+\t\t\tgoto error_free_frag;\n \t\t}\n \n \t\t/* Buffer is good. Go on. */\n@@ -5861,135 +5996,94 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)\n \t\tbuf2_len = stmmac_rx_buf2_len(priv, p, status, len);\n \t\tlen += buf2_len;\n \n-\t\t/* ACS is disabled; strip manually. */\n-\t\tif (likely(!(status \u0026 rx_not_ls)))\n-\t\t\tlen -= ETH_FCS_LEN;\n-\n-\t\tif (!skb) {\n-\t\t\tunsigned int pre_len, sync_len;\n-\n-\t\t\t/* Each frame starts here: reset the FCS handling */\n-\t\t\tfcs_stripped = false;\n-\n+\t\tif (!frames) {\n \t\t\tdma_sync_single_for_cpu(priv-\u003edevice, buf-\u003eaddr,\n \t\t\t\t\t\tbuf1_len, dma_dir);\n \t\t\tnet_prefetch(page_address(buf-\u003epage) +\n \t\t\t\t buf-\u003epage_offset);\n \n-\t\t\tif (stmmac_xdp_is_enabled(priv) \u0026\u0026 !buf2_len) {\n-\t\t\t\tbuf1_len -= ETH_FCS_LEN;\n-\t\t\t\tfcs_stripped = true;\n-\t\t\t}\n-\n \t\t\txdp_init_buff(\u0026ctx.xdp, bufsz, \u0026rx_q-\u003exdp_rxq);\n \t\t\txdp_prepare_buff(\u0026ctx.xdp, page_address(buf-\u003epage),\n \t\t\t\t\t buf-\u003epage_offset, buf1_len, true);\n-\n-\t\t\tpre_len = ctx.xdp.data_end - ctx.xdp.data_hard_start -\n-\t\t\t\t buf-\u003epage_offset;\n-\n-\t\t\tctx.priv = priv;\n-\t\t\tctx.desc = p;\n-\t\t\tctx.ndesc = np;\n-\n-\t\t\tskb = stmmac_xdp_run_prog(priv, \u0026ctx.xdp);\n-\t\t\t/* Due xdp_adjust_tail: DMA sync for_device\n-\t\t\t * cover max len CPU touch\n-\t\t\t */\n-\t\t\tsync_len = ctx.xdp.data_end - ctx.xdp.data_hard_start -\n-\t\t\t\t buf-\u003epage_offset;\n-\t\t\tsync_len = max(sync_len, pre_len);\n-\n-\t\t\t/* For Not XDP_PASS verdict */\n-\t\t\tif (IS_ERR(skb)) {\n-\t\t\t\tunsigned int xdp_res = -PTR_ERR(skb);\n-\n-\t\t\t\tif (xdp_res \u0026 STMMAC_XDP_CONSUMED) {\n-\t\t\t\t\tpage_pool_put_page(rx_q-\u003epage_pool,\n-\t\t\t\t\t\t\t virt_to_head_page(ctx.xdp.data),\n-\t\t\t\t\t\t\t sync_len, true);\n-\t\t\t\t\tbuf-\u003epage = NULL;\n-\t\t\t\t\trx_dropped++;\n-\n-\t\t\t\t\t/* Clear skb as it was set as\n-\t\t\t\t\t * status by XDP program.\n-\t\t\t\t\t */\n-\t\t\t\t\tskb = NULL;\n-\n-\t\t\t\t\tif (unlikely((status \u0026 rx_not_ls)))\n-\t\t\t\t\t\tgoto read_again;\n-\n-\t\t\t\t\tcount++;\n-\t\t\t\t\tcontinue;\n-\t\t\t\t} else if (xdp_res \u0026 (STMMAC_XDP_TX |\n-\t\t\t\t\t\t STMMAC_XDP_REDIRECT)) {\n-\t\t\t\t\txdp_status |= xdp_res;\n-\t\t\t\t\tbuf-\u003epage = NULL;\n-\t\t\t\t\tskb = NULL;\n-\t\t\t\t\tcount++;\n-\t\t\t\t\tcontinue;\n-\t\t\t\t}\n-\t\t\t}\n-\t\t}\n-\n-\t\tif (!skb) {\n-\t\t\tunsigned int head_pad_len;\n-\n-\t\t\t/* XDP program may expand or reduce tail */\n-\t\t\tbuf1_len = ctx.xdp.data_end - ctx.xdp.data;\n-\n-\t\t\tskb = napi_build_skb(page_address(buf-\u003epage),\n-\t\t\t\t\t rx_q-\u003enapi_skb_frag_size);\n-\t\t\tif (!skb) {\n-\t\t\t\tpage_pool_recycle_direct(rx_q-\u003epage_pool,\n-\t\t\t\t\t\t\t buf-\u003epage);\n-\t\t\t\tbuf-\u003epage = NULL;\n-\t\t\t\trx_dropped++;\n-\t\t\t\tcount++;\n-\t\t\t\tgoto drain_data;\n-\t\t\t}\n-\n-\t\t\t/* XDP program may adjust header */\n-\t\t\thead_pad_len = ctx.xdp.data - ctx.xdp.data_hard_start;\n-\t\t\tskb_reserve(skb, head_pad_len);\n-\t\t\tskb_put(skb, buf1_len);\n-\t\t\tskb_mark_for_recycle(skb);\n \t\t\tbuf-\u003epage = NULL;\n \t\t} else if (buf1_len) {\n-\t\t\tdma_sync_single_for_cpu(priv-\u003edevice, buf-\u003eaddr,\n-\t\t\t\t\t\tbuf1_len, dma_dir);\n-\t\t\tskb_add_rx_frag(skb, skb_shinfo(skb)-\u003enr_frags,\n-\t\t\t\t\tbuf-\u003epage, buf-\u003epage_offset, buf1_len,\n-\t\t\t\t\tpriv-\u003edma_conf.dma_buf_sz);\n+\t\t\tif (!stmmac_build_xdp_frags(priv, rx_q, buf1_len,\n+\t\t\t\t\t\t buf-\u003epage,\n+\t\t\t\t\t\t buf-\u003epage_offset,\n+\t\t\t\t\t\t dma_dir, \u0026ctx.xdp)) {\n+\t\t\t\tif (!error)\n+\t\t\t\t\trx_dropped++;\n+\t\t\t\terror = 1;\n+\t\t\t}\n \t\t\tbuf-\u003epage = NULL;\n \t\t}\n \n \t\tif (buf2_len) {\n-\t\t\tdma_sync_single_for_cpu(priv-\u003edevice, buf-\u003esec_addr,\n-\t\t\t\t\t\tbuf2_len, dma_dir);\n-\t\t\tskb_add_rx_frag(skb, skb_shinfo(skb)-\u003enr_frags,\n-\t\t\t\t\tbuf-\u003esec_page, 0, buf2_len,\n-\t\t\t\t\tpriv-\u003edma_conf.dma_buf_sz);\n+\t\t\tif (!stmmac_build_xdp_frags(priv, rx_q, buf2_len,\n+\t\t\t\t\t\t buf-\u003esec_page, 0,\n+\t\t\t\t\t\t dma_dir, \u0026ctx.xdp)) {\n+\t\t\t\tif (!error)\n+\t\t\t\t\trx_dropped++;\n+\t\t\t\terror = 1;\n+\t\t\t}\n \t\t\tbuf-\u003esec_page = NULL;\n \t\t}\n+\t\tframes++;\n \n-drain_data:\n \t\tif (likely(status \u0026 rx_not_ls))\n \t\t\tgoto read_again;\n-\t\tif (!skb)\n-\t\t\tcontinue;\n \n-\t\t/* Got entire packet into SKB. Finish it. */\n+\t\t/* ACS is disabled; strip manually. */\n+\t\tlen -= ETH_FCS_LEN;\n+\t\tif (stmmac_xdp_shrink_tail(rx_q, \u0026ctx.xdp, ETH_FCS_LEN)) {\n+\t\t\tif (!error)\n+\t\t\t\trx_dropped++;\n+\t\t\terror = 1;\n+\t\t}\n \n-\t\t/* Remove FCS if needed */\n-\t\tif (!fcs_stripped \u0026\u0026 pskb_trim(skb, len)) {\n-\t\t\tdev_kfree_skb_any(skb);\n-\t\t\tskb = NULL;\n-\t\t\trx_dropped++;\n+\t\tif (unlikely(error))\n+\t\t\tgoto error_free_frag;\n+\n+\t\tpre_len = ctx.xdp.data_end - ctx.xdp.data_hard_start;\n+\n+\t\tctx.desc = p;\n+\t\tctx.ndesc = np;\n+\n+\t\tskb = stmmac_xdp_run_prog(priv, \u0026ctx.xdp);\n+\t\t/* Due xdp_adjust_tail: DMA sync for_device\n+\t\t * cover max len CPU touch\n+\t\t */\n+\t\tsync_len = ctx.xdp.data_end - ctx.xdp.data_hard_start;\n+\t\tsync_len = max(sync_len, pre_len);\n+\n+\t\t/* For Not XDP_PASS verdict */\n+\t\tif (IS_ERR(skb)) {\n+\t\t\tunsigned int xdp_res = -PTR_ERR(skb);\n+\n+\t\t\tif (xdp_res \u0026 STMMAC_XDP_CONSUMED) {\n+\t\t\t\tstmmac_xdp_put_buff(rx_q, \u0026ctx.xdp, sync_len,\n+\t\t\t\t\t\t true);\n+\t\t\t\trx_dropped++;\n+\t\t\t} else if (xdp_res \u0026 (STMMAC_XDP_TX |\n+\t\t\t\t\t STMMAC_XDP_REDIRECT)) {\n+\t\t\t\txdp_status |= xdp_res;\n+\t\t\t}\n+\n+\t\t\t/* Clear skb as it was set as status by\n+\t\t\t * the XDP program\n+\t\t\t */\n+\t\t\tframes = 0;\n \t\t\tcount++;\n \t\t\tcontinue;\n \t\t}\n \n+\t\tskb = stmmac_build_skb(\u0026ctx.xdp);\n+\t\tif (!skb) {\n+\t\t\trx_dropped++;\n+\t\t\tgoto error_free_frag;\n+\t\t}\n+\n+\t\t/* Got entire packet into SKB. Finish it. */\n \t\tstmmac_get_rx_hwtstamp(priv, p, np, skb);\n \n \t\tif (priv-\u003ehw-\u003ehw_vlan_en)\n@@ -6012,18 +6106,24 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)\n \n \t\tskb_record_rx_queue(skb, queue);\n \t\tnapi_gro_receive(\u0026ch-\u003erx_napi, skb);\n-\t\tskb = NULL;\n-\n \t\trx_packets++;\n \t\trx_bytes += len;\n+\t\tframes = 0;\n+\t\tcount++;\n+\t\tcontinue;\n+error_free_frag:\n+\t\tif (frames)\n+\t\t\tstmmac_xdp_put_buff(rx_q, \u0026ctx.xdp, -1, true);\n+\t\tframes = 0;\n \t\tcount++;\n \t}\n \n-\tif (status \u0026 rx_not_ls || skb) {\n-\t\trx_q-\u003estate_saved = true;\n-\t\trx_q-\u003estate.skb = skb;\n+\tif (in_progress || frames) {\n+\t\trx_q-\u003estate.xdp = ctx.xdp;\n+\t\trx_q-\u003estate.frames = frames;\n \t\trx_q-\u003estate.error = error;\n \t\trx_q-\u003estate.len = len;\n+\t\trx_q-\u003estate_saved = true;\n \t}\n \n \tstmmac_finalize_xdp_rx(priv, xdp_status);\n@@ -8339,6 +8439,12 @@ static void stmmac_reset_rx_queue(struct stmmac_priv *priv, u32 queue)\n {\n \tstruct stmmac_rx_queue *rx_q = \u0026priv-\u003edma_conf.rx_queue[queue];\n \n+\tif (rx_q-\u003estate.frames \u0026\u0026 !rx_q-\u003exsk_pool) {\n+\t\tstmmac_xdp_put_buff(rx_q, \u0026rx_q-\u003estate.xdp, -1, false);\n+\t\trx_q-\u003estate.frames = 0;\n+\t}\n+\trx_q-\u003estate_saved = false;\n+\n \trx_q-\u003ecur_rx = 0;\n \trx_q-\u003edirty_rx = 0;\n }\n"
} |
| 2/1 | 2026/10/04 20:53 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the RX DMA descriptor processing, buffer recycling, and XDP packet handling logic in the STMicroelectronics / Synopsys DesignWare MAC (stmmac) ethernet driver (drivers/net/ethernet/stmicro/stmmac/). This driver targets physical ethernet controllers found on dedicated SoCs or specific PCI cards, none of which are emulated in standard virtualized environments (such as QEMU or GCE on amd64). Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit c8db0fc53e802a9623c4b39b39c0948e6aa5e507
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Oct 4 20:53:00 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 4fc96b317d79c..0148891dbcb4f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -132,7 +132,8 @@ struct stmmac_rx_queue {
dma_addr_t dma_rx_phy;
unsigned int state_saved;
struct {
- struct sk_buff *skb;
+ struct xdp_buff xdp;
+ unsigned int frames;
unsigned int len;
unsigned int error;
} state;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 0c381ae0d0ffa..3098fd6df1582 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -158,6 +158,9 @@ static void stmmac_flush_tx_descriptors(struct stmmac_priv *priv, int queue);
static void stmmac_set_dma_operation_mode(struct stmmac_priv *priv, u32 txmode,
u32 rxmode, u32 chan);
static void stmmac_vlan_restore(struct stmmac_priv *priv);
+static void stmmac_xdp_put_buff(struct stmmac_rx_queue *rx_q,
+ struct xdp_buff *xdp, int sync_len,
+ bool allow_direct);
#ifdef CONFIG_DEBUG_FS
static const struct net_device_ops stmmac_netdev_ops;
@@ -2180,6 +2183,11 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
else
dma_free_rx_skbufs(priv, dma_conf, queue);
+ if (rx_q->state.frames && !rx_q->xsk_pool) {
+ stmmac_xdp_put_buff(rx_q, &rx_q->state.xdp, -1, false);
+ rx_q->state.frames = 0;
+ }
+ rx_q->state_saved = false;
rx_q->buf_alloc_num = 0;
rx_q->xsk_pool = NULL;
@@ -5581,12 +5589,12 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
unsigned int count = 0, error = 0, len = 0;
int dirty = stmmac_rx_dirty(priv, queue);
unsigned int next_entry = rx_q->cur_rx;
+ bool in_progress = rx_q->state_saved;
u32 rx_errors = 0, rx_dropped = 0;
unsigned int desc_size;
struct bpf_prog *prog;
bool failure = false;
int xdp_status = 0;
- int status = 0;
if (netif_msg_rx_status(priv)) {
void *rx_head = stmmac_get_rx_desc(priv, rx_q, 0);
@@ -5597,23 +5605,25 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
stmmac_display_ring(priv, rx_head, priv->dma_conf.dma_rx_size, true,
rx_q->dma_rx_phy, desc_size);
}
+
+ if (rx_q->state_saved) {
+ error = rx_q->state.error;
+ len = rx_q->state.len;
+ rx_q->state_saved = false;
+ }
+
while (count < limit) {
struct stmmac_rx_buffer *buf;
struct stmmac_xdp_buff *ctx;
unsigned int buf1_len = 0;
struct dma_desc *np, *p;
- int entry;
+ int entry, status;
int res;
- if (!count && rx_q->state_saved) {
- error = rx_q->state.error;
- len = rx_q->state.len;
- } else {
- rx_q->state_saved = false;
+ if (!in_progress) {
error = 0;
len = 0;
}
-
read_again:
if (count >= limit)
break;
@@ -5652,6 +5662,8 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
if (!buf->xdp)
break;
+ in_progress = status & rx_not_ls;
+
if (priv->extend_desc)
stmmac_rx_extended_status(priv, &priv->xstats,
rx_q->dma_erx + entry);
@@ -5724,7 +5736,7 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
count++;
}
- if (status & rx_not_ls) {
+ if (in_progress) {
rx_q->state_saved = true;
rx_q->state.error = error;
rx_q->state.len = len;
@@ -5751,6 +5763,118 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
return failure ? limit : (int)count;
}
+static void
+stmmac_xdp_put_buff(struct stmmac_rx_queue *rx_q, struct xdp_buff *xdp,
+ int sync_len, bool allow_direct)
+{
+ struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp);
+ int i;
+
+ if (likely(!xdp_buff_has_frags(xdp)))
+ goto out;
+
+ for (i = 0; i < sinfo->nr_frags; i++)
+ page_pool_put_full_page(rx_q->page_pool,
+ skb_frag_page(&sinfo->frags[i]),
+ allow_direct);
+out:
+ page_pool_put_page(rx_q->page_pool, virt_to_head_page(xdp->data),
+ sync_len, allow_direct);
+}
+
+static struct sk_buff *stmmac_build_skb(struct xdp_buff *xdp)
+{
+ struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp);
+ u32 metasize = xdp->data - xdp->data_meta;
+ struct sk_buff *skb;
+ u8 num_frags = 0;
+
+ if (unlikely(xdp_buff_has_frags(xdp)))
+ num_frags = sinfo->nr_frags;
+
+ skb = napi_build_skb(xdp->data_hard_start, xdp->frame_sz);
+ if (!skb)
+ return NULL;
+
+ skb_mark_for_recycle(skb);
+ skb_reserve(skb, xdp->data - xdp->data_hard_start);
+ skb_put(skb, xdp->data_end - xdp->data);
+ if (metasize)
+ skb_metadata_set(skb, metasize);
+
+ if (unlikely(xdp_buff_has_frags(xdp)))
+ xdp_update_skb_frags_info(skb, num_frags, sinfo->xdp_frags_size,
+ num_frags * xdp->frame_sz,
+ xdp_buff_get_skb_flags(xdp));
+ return skb;
+}
+
+static bool stmmac_build_xdp_frags(struct stmmac_priv *priv,
+ struct stmmac_rx_queue *rx_q,
+ unsigned int len, struct page *page,
+ unsigned int offset,
+ enum dma_data_direction dma_dir,
+ struct xdp_buff *xdp)
+{
+ dma_addr_t dma_addr = page_pool_get_dma_addr(page) + offset;
+
+ dma_sync_single_for_cpu(priv->device, dma_addr, len, dma_dir);
+ if (!xdp_buff_add_frag(xdp, page_to_netmem(page), offset, len,
+ xdp->frame_sz)) {
+ page_pool_put_full_page(rx_q->page_pool, page, true);
+ return false;
+ }
+
+ return true;
+}
+
+static int stmmac_xdp_shrink_tail(struct stmmac_rx_queue *rx_q,
+ struct xdp_buff *xdp, int offset)
+{
+ struct skb_shared_info *sinfo;
+ int i;
+
+ if (unlikely(offset < 0 ||
+ offset > (int)xdp_get_buff_len(xdp) - ETH_HLEN))
+ return -EINVAL;
+
+ if (likely(!xdp_buff_has_frags(xdp))) {
+ xdp->data_end -= offset;
+ return 0;
+ }
+
+ sinfo = xdp_get_shared_info_from_buff(xdp);
+ for (i = sinfo->nr_frags - 1; i >= 0 && offset > 0; i--) {
+ skb_frag_t *frag = &sinfo->frags[i];
+ int delta = min_t(int, offset, skb_frag_size(frag));
+
+ if (delta == skb_frag_size(frag)) {
+ /* The whole frag is consumed by the strip: return it
+ * to the page pool right away. Its ring slot still
+ * carries the page DMA address until stmmac_rx_refill()
+ * re-arms it at the end of the NAPI poll. This is
+ * safe because HW cannot touch the slot until then.
+ */
+ page_pool_put_full_page(rx_q->page_pool,
+ skb_frag_page(frag), true);
+ sinfo->nr_frags--;
+ } else {
+ skb_frag_size_sub(frag, delta);
+ }
+
+ sinfo->xdp_frags_size -= delta;
+ offset -= delta;
+ }
+
+ if (unlikely(!sinfo->nr_frags)) {
+ xdp_buff_clear_frags_flag(xdp);
+ xdp_buff_clear_frag_pfmemalloc(xdp);
+ xdp->data_end -= offset;
+ }
+
+ return 0;
+}
+
/**
* stmmac_rx - manage the receive process
* @priv: driver private structure
@@ -5764,20 +5888,20 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
u32 rx_errors = 0, rx_dropped = 0, rx_bytes = 0, rx_packets = 0;
struct stmmac_rxq_stats *rxq_stats = &priv->xstats.rxq_stats[queue];
struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ unsigned int frames = 0, next_entry = rx_q->cur_rx;
struct stmmac_channel *ch = &priv->channel[queue];
unsigned int count = 0, error = 0, len = 0;
- int status = 0, coe = priv->hw->rx_csum;
- unsigned int next_entry = rx_q->cur_rx;
+ bool in_progress = rx_q->state_saved;
enum dma_data_direction dma_dir;
- unsigned int desc_size;
- struct sk_buff *skb = NULL;
+ int coe = priv->hw->rx_csum;
struct stmmac_xdp_buff ctx;
- bool fcs_stripped = false;
+ unsigned int desc_size;
int xdp_status = 0;
int bufsz;
dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
- bufsz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
+ bufsz = rx_q->napi_skb_frag_size;
+ ctx.priv = priv;
if (netif_msg_rx_status(priv)) {
void *rx_head = stmmac_get_rx_desc(priv, rx_q, 0);
@@ -5788,25 +5912,30 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
stmmac_display_ring(priv, rx_head, priv->dma_conf.dma_rx_size, true,
rx_q->dma_rx_phy, desc_size);
}
+
+ if (rx_q->state_saved) {
+ ctx.xdp = rx_q->state.xdp;
+ error = rx_q->state.error;
+ frames = rx_q->state.frames;
+ len = rx_q->state.len;
+ rx_q->state_saved = false;
+ rx_q->state.frames = 0;
+ }
+
while (count < limit) {
unsigned int buf1_len = 0, buf2_len = 0;
+ unsigned int pre_len, sync_len;
enum pkt_hash_types hash_type;
struct stmmac_rx_buffer *buf;
struct dma_desc *np, *p;
- int entry;
+ struct sk_buff *skb;
+ int entry, status;
u32 hash;
- if (!count && rx_q->state_saved) {
- skb = rx_q->state.skb;
- error = rx_q->state.error;
- len = rx_q->state.len;
- } else {
- rx_q->state_saved = false;
- skb = NULL;
+ if (!in_progress) {
error = 0;
len = 0;
}
-
read_again:
if (count >= limit)
break;
@@ -5835,23 +5964,29 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
prefetch(np);
+ in_progress = status & rx_not_ls;
+
if (priv->extend_desc)
stmmac_rx_extended_status(priv, &priv->xstats, rx_q->dma_erx + entry);
if (unlikely(status == discard_frame)) {
- page_pool_put_page(rx_q->page_pool, buf->page, 0, true);
- buf->page = NULL;
error = 1;
if (!priv->hwts_rx_en)
rx_errors++;
}
- if (unlikely(error && (status & rx_not_ls)))
- goto read_again;
if (unlikely(error)) {
- dev_kfree_skb(skb);
- skb = NULL;
- count++;
- continue;
+ page_pool_put_page(rx_q->page_pool, buf->page, 0, true);
+ buf->page = NULL;
+ if (buf->sec_page) {
+ page_pool_put_page(rx_q->page_pool,
+ buf->sec_page, 0, true);
+ buf->sec_page = NULL;
+ }
+
+ if (status & rx_not_ls)
+ goto read_again;
+
+ goto error_free_frag;
}
/* Buffer is good. Go on. */
@@ -5861,135 +5996,94 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
buf2_len = stmmac_rx_buf2_len(priv, p, status, len);
len += buf2_len;
- /* ACS is disabled; strip manually. */
- if (likely(!(status & rx_not_ls)))
- len -= ETH_FCS_LEN;
-
- if (!skb) {
- unsigned int pre_len, sync_len;
-
- /* Each frame starts here: reset the FCS handling */
- fcs_stripped = false;
-
+ if (!frames) {
dma_sync_single_for_cpu(priv->device, buf->addr,
buf1_len, dma_dir);
net_prefetch(page_address(buf->page) +
buf->page_offset);
- if (stmmac_xdp_is_enabled(priv) && !buf2_len) {
- buf1_len -= ETH_FCS_LEN;
- fcs_stripped = true;
- }
-
xdp_init_buff(&ctx.xdp, bufsz, &rx_q->xdp_rxq);
xdp_prepare_buff(&ctx.xdp, page_address(buf->page),
buf->page_offset, buf1_len, true);
-
- pre_len = ctx.xdp.data_end - ctx.xdp.data_hard_start -
- buf->page_offset;
-
- ctx.priv = priv;
- ctx.desc = p;
- ctx.ndesc = np;
-
- skb = stmmac_xdp_run_prog(priv, &ctx.xdp);
- /* Due xdp_adjust_tail: DMA sync for_device
- * cover max len CPU touch
- */
- sync_len = ctx.xdp.data_end - ctx.xdp.data_hard_start -
- buf->page_offset;
- sync_len = max(sync_len, pre_len);
-
- /* For Not XDP_PASS verdict */
- if (IS_ERR(skb)) {
- unsigned int xdp_res = -PTR_ERR(skb);
-
- if (xdp_res & STMMAC_XDP_CONSUMED) {
- page_pool_put_page(rx_q->page_pool,
- virt_to_head_page(ctx.xdp.data),
- sync_len, true);
- buf->page = NULL;
- rx_dropped++;
-
- /* Clear skb as it was set as
- * status by XDP program.
- */
- skb = NULL;
-
- if (unlikely((status & rx_not_ls)))
- goto read_again;
-
- count++;
- continue;
- } else if (xdp_res & (STMMAC_XDP_TX |
- STMMAC_XDP_REDIRECT)) {
- xdp_status |= xdp_res;
- buf->page = NULL;
- skb = NULL;
- count++;
- continue;
- }
- }
- }
-
- if (!skb) {
- unsigned int head_pad_len;
-
- /* XDP program may expand or reduce tail */
- buf1_len = ctx.xdp.data_end - ctx.xdp.data;
-
- skb = napi_build_skb(page_address(buf->page),
- rx_q->napi_skb_frag_size);
- if (!skb) {
- page_pool_recycle_direct(rx_q->page_pool,
- buf->page);
- buf->page = NULL;
- rx_dropped++;
- count++;
- goto drain_data;
- }
-
- /* XDP program may adjust header */
- head_pad_len = ctx.xdp.data - ctx.xdp.data_hard_start;
- skb_reserve(skb, head_pad_len);
- skb_put(skb, buf1_len);
- skb_mark_for_recycle(skb);
buf->page = NULL;
} else if (buf1_len) {
- dma_sync_single_for_cpu(priv->device, buf->addr,
- buf1_len, dma_dir);
- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
- buf->page, buf->page_offset, buf1_len,
- priv->dma_conf.dma_buf_sz);
+ if (!stmmac_build_xdp_frags(priv, rx_q, buf1_len,
+ buf->page,
+ buf->page_offset,
+ dma_dir, &ctx.xdp)) {
+ if (!error)
+ rx_dropped++;
+ error = 1;
+ }
buf->page = NULL;
}
if (buf2_len) {
- dma_sync_single_for_cpu(priv->device, buf->sec_addr,
- buf2_len, dma_dir);
- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
- buf->sec_page, 0, buf2_len,
- priv->dma_conf.dma_buf_sz);
+ if (!stmmac_build_xdp_frags(priv, rx_q, buf2_len,
+ buf->sec_page, 0,
+ dma_dir, &ctx.xdp)) {
+ if (!error)
+ rx_dropped++;
+ error = 1;
+ }
buf->sec_page = NULL;
}
+ frames++;
-drain_data:
if (likely(status & rx_not_ls))
goto read_again;
- if (!skb)
- continue;
- /* Got entire packet into SKB. Finish it. */
+ /* ACS is disabled; strip manually. */
+ len -= ETH_FCS_LEN;
+ if (stmmac_xdp_shrink_tail(rx_q, &ctx.xdp, ETH_FCS_LEN)) {
+ if (!error)
+ rx_dropped++;
+ error = 1;
+ }
- /* Remove FCS if needed */
- if (!fcs_stripped && pskb_trim(skb, len)) {
- dev_kfree_skb_any(skb);
- skb = NULL;
- rx_dropped++;
+ if (unlikely(error))
+ goto error_free_frag;
+
+ pre_len = ctx.xdp.data_end - ctx.xdp.data_hard_start;
+
+ ctx.desc = p;
+ ctx.ndesc = np;
+
+ skb = stmmac_xdp_run_prog(priv, &ctx.xdp);
+ /* Due xdp_adjust_tail: DMA sync for_device
+ * cover max len CPU touch
+ */
+ sync_len = ctx.xdp.data_end - ctx.xdp.data_hard_start;
+ sync_len = max(sync_len, pre_len);
+
+ /* For Not XDP_PASS verdict */
+ if (IS_ERR(skb)) {
+ unsigned int xdp_res = -PTR_ERR(skb);
+
+ if (xdp_res & STMMAC_XDP_CONSUMED) {
+ stmmac_xdp_put_buff(rx_q, &ctx.xdp, sync_len,
+ true);
+ rx_dropped++;
+ } else if (xdp_res & (STMMAC_XDP_TX |
+ STMMAC_XDP_REDIRECT)) {
+ xdp_status |= xdp_res;
+ }
+
+ /* Clear skb as it was set as status by
+ * the XDP program
+ */
+ frames = 0;
count++;
continue;
}
+ skb = stmmac_build_skb(&ctx.xdp);
+ if (!skb) {
+ rx_dropped++;
+ goto error_free_frag;
+ }
+
+ /* Got entire packet into SKB. Finish it. */
stmmac_get_rx_hwtstamp(priv, p, np, skb);
if (priv->hw->hw_vlan_en)
@@ -6012,18 +6106,24 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
skb_record_rx_queue(skb, queue);
napi_gro_receive(&ch->rx_napi, skb);
- skb = NULL;
-
rx_packets++;
rx_bytes += len;
+ frames = 0;
+ count++;
+ continue;
+error_free_frag:
+ if (frames)
+ stmmac_xdp_put_buff(rx_q, &ctx.xdp, -1, true);
+ frames = 0;
count++;
}
- if (status & rx_not_ls || skb) {
- rx_q->state_saved = true;
- rx_q->state.skb = skb;
+ if (in_progress || frames) {
+ rx_q->state.xdp = ctx.xdp;
+ rx_q->state.frames = frames;
rx_q->state.error = error;
rx_q->state.len = len;
+ rx_q->state_saved = true;
}
stmmac_finalize_xdp_rx(priv, xdp_status);
@@ -8339,6 +8439,12 @@ static void stmmac_reset_rx_queue(struct stmmac_priv *priv, u32 queue)
{
struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
+ if (rx_q->state.frames && !rx_q->xsk_pool) {
+ stmmac_xdp_put_buff(rx_q, &rx_q->state.xdp, -1, false);
+ rx_q->state.frames = 0;
+ }
+ rx_q->state_saved = false;
+
rx_q->cur_rx = 0;
rx_q->dirty_rx = 0;
}
|
| 3/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 9915 output: 38 thoughts: 286 Thoughts: **Evaluating the Suitability of a Patch Series for Syzkaller Fuzzing** Okay, so I need to decide if this patch series is worth the effort of fuzzing with syzkaller. The initial instructions are pretty clear: reachability is king. Can the modified code *actually* run in a typical virtualized environment like QEMU or GCE with standard devices? That's the first hurdle. If it's something requiring specialized hardware, like a custom PCIe card or a vendor-specific ASIC, the answer is a quick "no." Unreachable code, or code that's not executable, like driver teardown callbacks? Not worth it. But if we're dealing with reachable, executable code that's been modified or refactored, then fuzzing is a *must*. Alright, let's see which driver this patch series is targeting: `drivers/net/ethernet/stmicro/stmmac/`. Ah, stmmac... Synopsys DesignWare Ethernet MAC, or STMicroelectronics. Now the question becomes: is stmmac emulated in QEMU? Or is it more of an embedded SoC or PCIe Ethernet device? That's the critical piece. I need to figure out where and how stmmac is used. Is it typically found in x86/amd64 virtualized environments or are we talking about something more specialized? Time to dig into the kernel source and see how stmmac is used. Let me use the available tools to get a better overview. |
| 4/2 | 2026/10/04 20:53 | tool | grepper |
0mArgs:{
"Expression": "CONFIG_STMMAC",
"PathPrefix": "drivers/net/ethernet/stmicro/stmmac"
}Results: {
"Output": "drivers/net/ethernet/stmicro/stmmac/Makefile-1-# SPDX-License-Identifier: GPL-2.0\ndrivers/net/ethernet/stmicro/stmmac/Makefile:2:obj-$(CONFIG_STMMAC_ETH) += stmmac.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile-3-stmmac-objs:= stmmac_main.o stmmac_ethtool.o stmmac_mdio.o ring_mode.o\t\\\n--\ndrivers/net/ethernet/stmicro/stmmac/Makefile-11-\ndrivers/net/ethernet/stmicro/stmmac/Makefile:12:stmmac-$(CONFIG_STMMAC_SELFTESTS) += stmmac_selftests.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile-13-\ndrivers/net/ethernet/stmicro/stmmac/Makefile-14-# Ordering matters. Generic driver must be last.\ndrivers/net/ethernet/stmicro/stmmac/Makefile:15:obj-$(CONFIG_STMMAC_PLATFORM)\t+= stmmac-platform.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile-16-obj-$(CONFIG_DWMAC_ANARION)\t+= dwmac-anarion.o\n--\ndrivers/net/ethernet/stmicro/stmmac/Makefile=48=dwmac-altr-socfpga-objs := dwmac-socfpga.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile-49-\ndrivers/net/ethernet/stmicro/stmmac/Makefile:50:obj-$(CONFIG_STMMAC_LIBPCI)\t+= stmmac_libpci.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile:51:obj-$(CONFIG_STMMAC_PCI)\t+= stmmac-pci.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile-52-obj-$(CONFIG_DWMAC_INTEL)\t+= dwmac-intel.o\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h=440=struct timespec64 stmmac_calc_tas_basetime(ktime_t old_base_time,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h-443-\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h:444:#if IS_ENABLED(CONFIG_STMMAC_SELFTESTS)\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h-445-void stmmac_selftest_run(struct net_device *dev,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h=460=static inline int stmmac_selftest_get_count(struct stmmac_priv *priv)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h-463-}\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h:464:#endif /* CONFIG_STMMAC_SELFTESTS */\ndrivers/net/ethernet/stmicro/stmmac/stmmac.h-465-\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c=381=int stmmac_mdio_reset(struct mii_bus *bus)\ndrivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c-382-{\ndrivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c:383:#if IS_ENABLED(CONFIG_STMMAC_PLATFORM)\ndrivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c-384-\tstruct stmmac_priv *priv = netdev_priv(bus-\u003epriv);\n"
} |
| 5/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 11541 output: 42 thoughts: 13 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience and presented in the first person: **Kconfig Review for STMMAC_ETH** Alright, let's get down to brass tacks. My initial thought process is to immediately zero in on the `Kconfig` files and specifically the `STMMAC_ETH` option. We all know that the `Kconfig` system is the beating heart of these kernel configurations, and so it is the starting point for finding the information and clues to support our process. I am going to determine if the relevant definitions, dependencies, and potential conflicts are where they should be. This is the bedrock before I can move on to looking at the device tree or the driver itself. This also includes any related configuration options, dependencies, and default values. I'll need to understand if this is a standalone driver, or if it depends on any other drivers or core functionalities, I will begin to analyze the relationships. My goal is a comprehensive overview of how `STMMAC_ETH` is defined, what it impacts, and any potential issues it might introduce. |
| 6/2 | 2026/10/04 20:53 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/stmicro/stmmac/Kconfig",
"FirstLine": 1,
"LineCount": 70
}Results: {
"Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\tconfig STMMAC_ETH\n 3:\t\ttristate \"STMicroelectronics Multi-Gigabit Ethernet driver\"\n 4:\t\tdepends on HAS_IOMEM \u0026\u0026 HAS_DMA\n 5:\t\tdepends on PTP_1588_CLOCK_OPTIONAL\n 6:\t\tdepends on ETHTOOL_NETLINK\n 7:\t\tselect MII\n 8:\t\tselect PCS_XPCS\n 9:\t\tselect PAGE_POOL\n 10:\t\tselect PHYLINK\n 11:\t\tselect CRC32\n 12:\t\tselect RESET_CONTROLLER\n 13:\t\tselect NET_DEVLINK\n 14:\t\thelp\n 15:\t\t This is the driver for the Ethernet IPs built around a\n 16:\t\t Synopsys IP Core.\n 17:\t\n 18:\tif STMMAC_ETH\n 19:\t\n 20:\tconfig STMMAC_SELFTESTS\n 21:\t\tbool \"Support for STMMAC Selftests\"\n 22:\t\tdepends on INET\n 23:\t\tdefault n\n 24:\t\thelp\n 25:\t\t This adds support for STMMAC Selftests using ethtool. Enable this\n 26:\t\t feature if you are facing problems with your HW and submit the test\n 27:\t\t results to the netdev Mailing List.\n 28:\t\n 29:\tconfig STMMAC_PLATFORM\n 30:\t\ttristate \"STMMAC Platform bus support\"\n 31:\t\tselect MFD_SYSCON\n 32:\t\tdefault y\n 33:\t\thelp\n 34:\t\t This selects the platform specific bus support for the stmmac driver.\n 35:\t\t This is the driver used on several SoCs:\n 36:\t\t STi, Allwinner, Amlogic Meson, Altera SOCFPGA.\n 37:\t\n 38:\t\t If you have a controller with this interface, say Y or M here.\n 39:\t\n 40:\t\t If unsure, say N.\n 41:\t\n 42:\tif STMMAC_PLATFORM\n 43:\t\n 44:\tconfig DWMAC_DWC_QOS_ETH\n 45:\t\ttristate \"Support for snps,dwc-qos-ethernet.txt DT binding.\"\n 46:\t\tselect CRC32\n 47:\t\tselect MII\n 48:\t\tdepends on OF \u0026\u0026 HAS_DMA\n 49:\t\thelp\n 50:\t\t Support for chips using the snps,dwc-qos-ethernet.txt DT binding.\n 51:\t\n 52:\tconfig DWMAC_GENERIC\n 53:\t\ttristate \"Generic driver for DWMAC\"\n 54:\t\tdefault STMMAC_PLATFORM\n 55:\t\thelp\n 56:\t\t Generic DWMAC driver for platforms that don't require any\n 57:\t\t platform specific code to function or is using platform\n 58:\t\t data for setup.\n 59:\t\n 60:\tconfig DWMAC_ANARION\n 61:\t\ttristate \"Adaptrum Anarion GMAC support\"\n 62:\t\tdefault ARC\n 63:\t\tdepends on OF \u0026\u0026 (ARC || COMPILE_TEST)\n 64:\t\thelp\n 65:\t\t Support for Adaptrum Anarion GMAC Ethernet controller.\n 66:\t\n 67:\t\t This selects the Anarion SoC glue layer support for the stmmac driver.\n 68:\t\n 69:\tconfig DWMAC_EIC7700\n 70:\t\ttristate \"Support for Eswin eic7700 ethernet driver\"\n"
} |
| 7/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 12766 output: 43 thoughts: 15 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Diving Deeper into the Kconfig Landscape** Okay, so I've gotten a good handle on the basics, but I need to dig deeper. PCI support... that's a cornerstone for a lot of hardware interactions, and other platforms likely have their own specific quirks in how they integrate. My immediate thought is to jump back into the Kconfig files. I'm going to leverage my existing knowledge of the configuration system to efficiently trace the relevant dependencies and options. I'm thinking specifically about how PCI devices are configured and how that impacts overall system behavior. I want to expand the breadth of my knowledge and understanding of other platforms, as well. Let's see what Kconfig has to offer. |
| 8/2 | 2026/10/04 20:53 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/stmicro/stmmac/Kconfig",
"FirstLine": 71,
"LineCount": 80
}Results: {
"Contents": " 71:\t\tdepends on OF \u0026\u0026 HAS_DMA \u0026\u0026 ARCH_ESWIN || COMPILE_TEST\n 72:\t\thelp\n 73:\t\t This driver supports the Eswin EIC7700 Ethernet controller,\n 74:\t\t which integrates Synopsys DesignWare QoS features. It enables\n 75:\t\t high-speed networking with DMA acceleration and is optimized\n 76:\t\t for embedded systems.\n 77:\t\n 78:\tconfig DWMAC_INGENIC\n 79:\t\ttristate \"Ingenic MAC support\"\n 80:\t\tdefault MACH_INGENIC\n 81:\t\tdepends on OF \u0026\u0026 HAS_IOMEM \u0026\u0026 (MACH_INGENIC || COMPILE_TEST)\n 82:\t\tselect MFD_SYSCON\n 83:\t\thelp\n 84:\t\t Support for ethernet controller on Ingenic SoCs.\n 85:\t\n 86:\t\t This selects Ingenic SoCs glue layer support for the stmmac\n 87:\t\t device driver. This driver is used on for the Ingenic SoCs\n 88:\t\t MAC ethernet controller.\n 89:\t\n 90:\tconfig DWMAC_IPQ806X\n 91:\t\ttristate \"QCA IPQ806x DWMAC support\"\n 92:\t\tdefault ARCH_QCOM\n 93:\t\tdepends on OF \u0026\u0026 (ARCH_QCOM || COMPILE_TEST)\n 94:\t\tselect MFD_SYSCON\n 95:\t\thelp\n 96:\t\t Support for QCA IPQ806X DWMAC Ethernet.\n 97:\t\n 98:\t\t This selects the IPQ806x SoC glue layer support for the stmmac\n 99:\t\t device driver. This driver does not use any of the hardware\n 100:\t\t acceleration features available on this SoC. Network devices\n 101:\t\t will behave like standard non-accelerated ethernet interfaces.\n 102:\t\n 103:\t\t Select the QCOM_SOCINFO config flag to enable specific dwmac\n 104:\t\t fixup based on the ipq806x SoC revision.\n 105:\t\n 106:\tconfig DWMAC_LPC18XX\n 107:\t\ttristate \"NXP LPC18xx/43xx DWMAC support\"\n 108:\t\tdefault ARCH_LPC18XX\n 109:\t\tdepends on OF \u0026\u0026 (ARCH_LPC18XX || COMPILE_TEST)\n 110:\t\tselect MFD_SYSCON\n 111:\t\thelp\n 112:\t\t Support for NXP LPC18xx/43xx DWMAC Ethernet.\n 113:\t\n 114:\tconfig DWMAC_MEDIATEK\n 115:\t\ttristate \"MediaTek MT27xx GMAC support\"\n 116:\t\tdepends on OF \u0026\u0026 (ARCH_MEDIATEK || COMPILE_TEST)\n 117:\t\thelp\n 118:\t\t Support for MediaTek GMAC Ethernet controller.\n 119:\t\n 120:\t\t This selects the MT2712 SoC support for the stmmac driver.\n 121:\t\n 122:\tconfig DWMAC_MESON\n 123:\t\ttristate \"Amlogic Meson dwmac support\"\n 124:\t\tdefault ARCH_MESON\n 125:\t\tdepends on OF \u0026\u0026 COMMON_CLK \u0026\u0026 (ARCH_MESON || COMPILE_TEST)\n 126:\t\thelp\n 127:\t\t Support for Ethernet controller on Amlogic Meson SoCs.\n 128:\t\n 129:\t\t This selects the Amlogic Meson SoC glue layer support for\n 130:\t\t the stmmac device driver. This driver is used for Meson6,\n 131:\t\t Meson8, Meson8b and GXBB SoCs.\n 132:\t\n 133:\tconfig DWMAC_NUVOTON\n 134:\t\ttristate \"Nuvoton MA35 dwmac support\"\n 135:\t\tdefault ARCH_MA35\n 136:\t\tdepends on OF \u0026\u0026 (ARCH_MA35 || COMPILE_TEST)\n 137:\t\tselect MFD_SYSCON\n 138:\t\thelp\n 139:\t\t Support for Ethernet controller on Nuvoton MA35 series SoC.\n 140:\t\n 141:\t\t This selects the Nuvoton MA35 series SoC glue layer support\n 142:\t\t for the stmmac device driver. The nuvoton-dwmac driver is\n 143:\t\t used for MA35 series SoCs.\n 144:\t\n 145:\tconfig DWMAC_QCOM_ETHQOS\n 146:\t\ttristate \"Qualcomm ETHQOS support\"\n 147:\t\tdefault ARCH_QCOM\n 148:\t\tdepends on OF \u0026\u0026 (ARCH_QCOM || COMPILE_TEST)\n 149:\t\thelp\n 150:\t\t Support for the Qualcomm ETHQOS core.\n"
} |
| 9/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14267 output: 44 thoughts: 12 Thoughts: Okay, here's my attempt at summarizing that thought process, tailored for an expert audience: **Diving into the PCI Kconfig Context** Alright, let's get down to it. We need to understand the full scope of this Kconfig file, particularly as it relates to PCI. I'm not going to approach this with any preconceptions. Instead, I'll examine the interactions and relationships, the dependencies defined, and any conditional build options. My goal is to grasp the comprehensive configuration space within this context, noting the interdependencies of various parts. I will specifically identify any relevant nuances that affect performance or functionality. I need a clear mental model of how this PCI configuration is constructed. |
| 10/2 | 2026/10/04 20:53 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/stmicro/stmmac/Kconfig",
"FirstLine": 151,
"LineCount": 80
}Results: {
"Contents": " 151:\t\n 152:\t\t This selects the Qualcomm ETHQOS glue layer support for the\n 153:\t\t stmmac device driver.\n 154:\t\n 155:\tconfig DWMAC_RENESAS_GBETH\n 156:\t\ttristate \"Renesas RZ/V2H(P) GBETH and RZ/T2H, RZ/N2H GMAC support\"\n 157:\t\tdefault ARCH_RENESAS\n 158:\t\tdepends on OF \u0026\u0026 (ARCH_RENESAS || COMPILE_TEST)\n 159:\t\tselect PCS_RZN1_MIIC\n 160:\t\thelp\n 161:\t\t Support for Gigabit Ethernet Interface (GBETH)/ Ethernet MAC (GMAC)\n 162:\t\t on Renesas SoCs.\n 163:\t\n 164:\t\t This selects Renesas SoC glue layer support for the stmmac device\n 165:\t\t driver. This driver is used for the RZ/V2H(P) family, RZ/T2H and\n 166:\t\t RZ/N2H SoCs.\n 167:\t\n 168:\tconfig DWMAC_ROCKCHIP\n 169:\t\ttristate \"Rockchip dwmac support\"\n 170:\t\tdefault ARCH_ROCKCHIP\n 171:\t\tdepends on OF \u0026\u0026 (ARCH_ROCKCHIP || COMPILE_TEST)\n 172:\t\tselect MFD_SYSCON\n 173:\t\thelp\n 174:\t\t Support for Ethernet controller on Rockchip RK3288 SoC.\n 175:\t\n 176:\t\t This selects the Rockchip RK3288 SoC glue layer support for\n 177:\t\t the stmmac device driver.\n 178:\t\n 179:\tconfig DWMAC_RZN1\n 180:\t\ttristate \"Renesas RZ/N1 dwmac support\"\n 181:\t\tdefault ARCH_RZN1\n 182:\t\tdepends on OF \u0026\u0026 (ARCH_RZN1 || COMPILE_TEST)\n 183:\t\tselect PCS_RZN1_MIIC\n 184:\t\thelp\n 185:\t\t Support for Ethernet controller on Renesas RZ/N1 SoC family.\n 186:\t\n 187:\t\t This selects the Renesas RZ/N1 SoC glue layer support for\n 188:\t\t the stmmac device driver. This support can make use of a custom MII\n 189:\t\t converter PCS device.\n 190:\t\n 191:\tconfig DWMAC_S32\n 192:\t\ttristate \"NXP S32G/S32R GMAC support\"\n 193:\t\tdefault ARCH_S32\n 194:\t\tdepends on OF \u0026\u0026 (ARCH_S32 || COMPILE_TEST)\n 195:\t\thelp\n 196:\t\t Support for ethernet controller on NXP S32CC SOCs.\n 197:\t\n 198:\t\t This selects NXP SoC glue layer support for the stmmac\n 199:\t\t device driver. This driver is used for the S32CC series\n 200:\t\t SOCs GMAC ethernet controller, ie. S32G2xx, S32G3xx and\n 201:\t\t S32R45.\n 202:\t\n 203:\tconfig DWMAC_SOCFPGA\n 204:\t\ttristate \"SOCFPGA dwmac support\"\n 205:\t\tdefault ARCH_INTEL_SOCFPGA\n 206:\t\tdepends on OF \u0026\u0026 (ARCH_INTEL_SOCFPGA || COMPILE_TEST)\n 207:\t\tselect MFD_SYSCON\n 208:\t\tselect MDIO_REGMAP\n 209:\t\tselect REGMAP_MMIO\n 210:\t\tselect PCS_LYNX\n 211:\t\thelp\n 212:\t\t Support for ethernet controller on Altera SOCFPGA\n 213:\t\n 214:\t\t This selects the Altera SOCFPGA SoC glue layer support\n 215:\t\t for the stmmac device driver. This driver is used for\n 216:\t\t arria5 and cyclone5 FPGA SoCs.\n 217:\t\n 218:\tconfig DWMAC_SOPHGO\n 219:\t\ttristate \"Sophgo dwmac support\"\n 220:\t\tdepends on OF \u0026\u0026 (ARCH_SOPHGO || COMPILE_TEST)\n 221:\t\tdefault m if ARCH_SOPHGO\n 222:\t\thelp\n 223:\t\t Support for ethernet controllers on Sophgo RISC-V SoCs\n 224:\t\n 225:\t\t This selects the Sophgo SoC specific glue layer support\n 226:\t\t for the stmmac device driver. This driver is used for the\n 227:\t\t ethernet controllers on various Sophgo SoCs.\n 228:\t\n 229:\tconfig DWMAC_SPACEMIT\n 230:\t\ttristate \"Spacemit dwmac support\"\n"
} |
| 11/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 15772 output: 44 thoughts: 14 Thoughts: Okay, here's my interpretation of what's going through my mind, presented as a first-person summary, keeping in mind the expert audience and the prompt's direction: **Diving Back into Kconfig After Line 230** Alright, back to Kconfig. We've just finished up to line 230, and now it's time to dive deeper. I'm mentally parsing where we left off. I'm expecting to encounter some more complex dependency structures. My focus is going to be on the interplay of symbols and how they're being used within the configuration space. I'm looking for potential areas of interest, edge cases, and areas where there may be a performance bottleneck. I'll need to check for anything that may be problematic to upstream. The goal is to fully understand any potential changes. I’m anticipating some intricate relationships between different configurations. My mind is already mapping out the potential implications, and I am ready to dig deeper. |
| 12/2 | 2026/10/04 20:53 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/stmicro/stmmac/Kconfig",
"FirstLine": 231,
"LineCount": 80
}Results: {
"Contents": " 231:\t\tdepends on OF \u0026\u0026 (ARCH_SPACEMIT || COMPILE_TEST)\n 232:\t\tselect MFD_SYSCON\n 233:\t\tdefault m if ARCH_SPACEMIT\n 234:\t\thelp\n 235:\t\t Support for ethernet controllers on Spacemit RISC-V SoCs\n 236:\t\n 237:\t\t This selects the Spacemit platform specific glue layer support\n 238:\t\t for the stmmac device driver. This driver is used for the\n 239:\t\t Spacemit K3 ethernet controllers.\n 240:\t\n 241:\tconfig DWMAC_STARFIVE\n 242:\t\ttristate \"StarFive dwmac support\"\n 243:\t\tdepends on OF \u0026\u0026 (ARCH_STARFIVE || COMPILE_TEST)\n 244:\t\tselect MFD_SYSCON\n 245:\t\tdefault m if ARCH_STARFIVE\n 246:\t\thelp\n 247:\t\t Support for ethernet controllers on StarFive RISC-V SoCs\n 248:\t\n 249:\t\t This selects the StarFive platform specific glue layer support\n 250:\t\t for the stmmac device driver. This driver is used for the\n 251:\t\t StarFive JH7100 and JH7110 ethernet controllers.\n 252:\t\n 253:\tconfig DWMAC_STI\n 254:\t\ttristate \"STi GMAC support\"\n 255:\t\tdefault ARCH_STI\n 256:\t\tdepends on OF \u0026\u0026 (ARCH_STI || COMPILE_TEST)\n 257:\t\tselect MFD_SYSCON\n 258:\t\thelp\n 259:\t\t Support for ethernet controller on STi SOCs.\n 260:\t\n 261:\t\t This selects STi SoC glue layer support for the stmmac\n 262:\t\t device driver. This driver is used on for the STi series\n 263:\t\t SOCs GMAC ethernet controller.\n 264:\t\n 265:\tconfig DWMAC_STM32\n 266:\t\ttristate \"STM32 DWMAC support\"\n 267:\t\tdefault ARCH_STM32\n 268:\t\tdepends on OF \u0026\u0026 HAS_IOMEM \u0026\u0026 (ARCH_STM32 || COMPILE_TEST)\n 269:\t\tselect MFD_SYSCON\n 270:\t\thelp\n 271:\t\t Support for ethernet controller on STM32 SOCs.\n 272:\t\n 273:\t\t This selects STM32 SoC glue layer support for the stmmac\n 274:\t\t device driver. This driver is used on for the STM32 series\n 275:\t\t SOCs GMAC ethernet controller.\n 276:\t\n 277:\tconfig DWMAC_SUNXI\n 278:\t\ttristate \"Allwinner GMAC support\"\n 279:\t\tdefault ARCH_SUNXI\n 280:\t\tdepends on OF \u0026\u0026 (ARCH_SUNXI || COMPILE_TEST)\n 281:\t\thelp\n 282:\t\t Support for Allwinner A20/A31 GMAC ethernet controllers.\n 283:\t\n 284:\t\t This selects Allwinner SoC glue layer support for the\n 285:\t\t stmmac device driver. This driver is used for A20/A31\n 286:\t\t GMAC ethernet controller.\n 287:\t\n 288:\tconfig DWMAC_SUN8I\n 289:\t\ttristate \"Allwinner sun8i GMAC support\"\n 290:\t\tdefault ARCH_SUNXI\n 291:\t\tdepends on OF \u0026\u0026 (ARCH_SUNXI || COMPILE_TEST)\n 292:\t\tselect MDIO_BUS_MUX\n 293:\t\thelp\n 294:\t\t Support for Allwinner H3 A83T A64 EMAC ethernet controllers.\n 295:\t\n 296:\t\t This selects Allwinner SoC glue layer support for the\n 297:\t\t stmmac device driver. This driver is used for H3/A83T/A64\n 298:\t\t EMAC ethernet controller.\n 299:\t\n 300:\tconfig DWMAC_SUN55I\n 301:\t\ttristate \"Allwinner sun55i GMAC200 support\"\n 302:\t\tdefault ARCH_SUNXI\n 303:\t\tdepends on OF \u0026\u0026 (ARCH_SUNXI || COMPILE_TEST)\n 304:\t\tselect MDIO_BUS_MUX\n 305:\t\thelp\n 306:\t\t Support for Allwinner A523/T527 GMAC200 ethernet controllers.\n 307:\t\n 308:\t\t This selects Allwinner SoC glue layer support for the\n 309:\t\t stmmac device driver. This driver is used for A523/T527\n 310:\t\t GMAC200 ethernet controller.\n"
} |
| 13/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 17305 output: 44 thoughts: 13 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: **Diving into Kconfig and PCI Configuration** Alright, let's keep moving. Time to drill down into the Kconfig files, specifically focusing on how PCI is configured within this system. I'm keen to see the granularity of options available – the sheer level of control we have over enabling, disabling, and customizing PCI behavior. I expect to see the typical suspects: device driver selection, interrupt handling choices, maybe some power management settings if we're lucky, and potentially vendor-specific options if this is a platform with particularly nuanced PCI requirements. I'm anticipating a clean, well-structured layout, ideally with good dependency tracking between the different PCI configuration elements. Let's dig in and see what goodies we can uncover. |
| 14/2 | 2026/10/04 20:53 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/stmicro/stmmac/Kconfig",
"FirstLine": 311,
"LineCount": 80
}Results: {
"Contents": " 311:\t\n 312:\tconfig DWMAC_THEAD\n 313:\t\ttristate \"T-HEAD dwmac support\"\n 314:\t\tdepends on OF \u0026\u0026 (ARCH_THEAD || COMPILE_TEST)\n 315:\t\thelp\n 316:\t\t Support for ethernet controllers on T-HEAD RISC-V SoCs\n 317:\t\n 318:\t\t This selects the T-HEAD platform specific glue layer support for\n 319:\t\t the stmmac device driver. This driver is used for T-HEAD TH1520\n 320:\t\t ethernet controller.\n 321:\t\n 322:\tconfig DWMAC_ULTRARISC\n 323:\t\ttristate \"UltraRISC DWMAC support\"\n 324:\t\tdefault ARCH_ULTRARISC\n 325:\t\tdepends on OF \u0026\u0026 (ARCH_ULTRARISC || COMPILE_TEST)\n 326:\t\thelp\n 327:\t\t Support for the Ethernet controller on the UltraRISC DP1000 SoC.\n 328:\t\n 329:\t\t This selects the UltraRISC platform specific glue layer support\n 330:\t\t for the stmmac device driver. This driver is used for the DP1000\n 331:\t\t GMAC Ethernet controller.\n 332:\t\n 333:\tconfig DWMAC_IMX8\n 334:\t\ttristate \"NXP IMX8 DWMAC support\"\n 335:\t\tdefault ARCH_MXC\n 336:\t\tdepends on OF \u0026\u0026 (ARCH_MXC || COMPILE_TEST)\n 337:\t\tselect MFD_SYSCON\n 338:\t\thelp\n 339:\t\t Support for ethernet controller on NXP i.MX8 SOCs.\n 340:\t\n 341:\t\t This selects NXP SoC glue layer support for the stmmac\n 342:\t\t device driver. This driver is used for i.MX8 series like\n 343:\t\t iMX8MP/iMX8DXL GMAC ethernet controller.\n 344:\t\n 345:\tconfig DWMAC_INTEL_PLAT\n 346:\t\ttristate \"Intel dwmac support\"\n 347:\t\tdepends on OF \u0026\u0026 COMMON_CLK\n 348:\t\thelp\n 349:\t\t Support for ethernet controllers on Intel SoCs\n 350:\t\n 351:\t\t This selects the Intel platform specific glue layer support for\n 352:\t\t the stmmac device driver. This driver is used for the Intel Keem Bay\n 353:\t\t SoC.\n 354:\t\n 355:\tconfig DWMAC_LOONGSON1\n 356:\t\ttristate \"Loongson1 GMAC support\"\n 357:\t\tdefault MACH_LOONGSON32\n 358:\t\tdepends on OF \u0026\u0026 (MACH_LOONGSON32 || COMPILE_TEST)\n 359:\t\thelp\n 360:\t\t Support for ethernet controller on Loongson1 SoC.\n 361:\t\n 362:\t\t This selects Loongson1 SoC glue layer support for the stmmac\n 363:\t\t device driver. This driver is used for Loongson1-based boards\n 364:\t\t like Loongson LS1B/LS1C.\n 365:\t\n 366:\tconfig DWMAC_TEGRA\n 367:\t\ttristate \"NVIDIA Tegra MGBE support\"\n 368:\t\tdepends on ARCH_TEGRA || COMPILE_TEST\n 369:\t\thelp\n 370:\t\t This selects the Multi-GigaBit Ethernet (MGBE) Controller that is\n 371:\t\t found on the NVIDIA Tegra SoC devices. This driver provides the glue\n 372:\t\t layer on top of the stmmac driver required for these NVIDIA Tegra SoC\n 373:\t\t devices.\n 374:\t\n 375:\tconfig DWMAC_VISCONTI\n 376:\t\ttristate \"Toshiba Visconti DWMAC support\"\n 377:\t\tdefault ARCH_VISCONTI\n 378:\t\tdepends on OF \u0026\u0026 COMMON_CLK \u0026\u0026 (ARCH_VISCONTI || COMPILE_TEST)\n 379:\t\thelp\n 380:\t\t Support for ethernet controller on Visconti SoCs.\n 381:\t\n 382:\tendif # STMMAC_PLATFORM\n 383:\t\n 384:\tconfig STMMAC_LIBPCI\n 385:\t\ttristate\n 386:\t\thelp\n 387:\t\t This option enables the PCI bus helpers for the stmmac driver.\n 388:\t\n 389:\tconfig DWMAC_INTEL\n 390:\t\ttristate \"Intel GMAC support\"\n"
} |
| 15/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 18768 output: 44 thoughts: 18 Thoughts: Okay, let's dive into this Kconfig file, picking up where we left off. I need to get a complete picture of the remaining configurations from line 390 onward. I need to understand the relationships, dependencies, and implications of these settings. What's the context? What are the key features being configured here? I need to analyze how these settings interact with the rest of the project. I'll need to look for any hidden dependencies, potential conflicts, or clever conditional logic that might be present. Let's get to it. |
| 16/2 | 2026/10/04 20:53 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/stmicro/stmmac/Kconfig",
"FirstLine": 390,
"LineCount": 50
}Results: {
"Contents": " 390:\t\ttristate \"Intel GMAC support\"\n 391:\t\tdefault X86\n 392:\t\tdepends on X86 \u0026\u0026 PCI\n 393:\t\tdepends on COMMON_CLK\n 394:\t\tdepends on ACPI\n 395:\t\thelp\n 396:\t\t This selects the Intel platform specific bus support for the\n 397:\t\t stmmac driver. This driver is used for Intel Quark/EHL/TGL.\n 398:\t\n 399:\tconfig DWMAC_LOONGSON\n 400:\t\ttristate \"Loongson PCI DWMAC support\"\n 401:\t\tdefault MACH_LOONGSON64\n 402:\t\tdepends on (MACH_LOONGSON64 || COMPILE_TEST) \u0026\u0026 PCI\n 403:\t\tdepends on COMMON_CLK\n 404:\t\tselect STMMAC_LIBPCI\n 405:\t\thelp\n 406:\t\t This selects the LOONGSON PCI bus support for the stmmac driver,\n 407:\t\t Support for ethernet controller on Loongson-2K1000 SoC and LS7A1000 bridge.\n 408:\t\n 409:\tconfig DWMAC_MOTORCOMM\n 410:\t\ttristate \"Motorcomm PCI DWMAC support\"\n 411:\t\tdepends on PCI\n 412:\t\tselect MOTORCOMM_PHY\n 413:\t\tselect STMMAC_LIBPCI\n 414:\t\thelp\n 415:\t\t This enables glue driver for Motorcomm DWMAC-based PCI Ethernet\n 416:\t\t controllers. Currently only YT6801 is supported.\n 417:\t\n 418:\tconfig STMMAC_PCI\n 419:\t\ttristate \"STMMAC PCI bus support\"\n 420:\t\tdepends on PCI\n 421:\t\tdepends on COMMON_CLK\n 422:\t\tselect STMMAC_LIBPCI\n 423:\t\thelp\n 424:\t\t This selects the platform specific bus support for the stmmac driver.\n 425:\t\t This driver was tested on XLINX XC2V3000 FF1152AMT0221\n 426:\t\t D1215994A VIRTEX FPGA board and SNPS QoS IPK Prototyping Kit.\n 427:\t\n 428:\t\t If you have a controller with this interface, say Y or M here.\n 429:\t\n 430:\t\t If unsure, say N.\n 431:\tendif # STMMAC_ETH\n"
} |
| 17/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 19610 output: 39 thoughts: 634 Thoughts: **My Assessment of `stmmac` Fuzzing Feasibility** Okay, let's break this down. My initial thought is about the `stmmac` driver – it's a Synopsys DWMAC Ethernet MAC driver, used across various architectures. But is it emulated in a standard QEMU environment? That's the key question. I need to be sure. I'm thinking, in QEMU, what Ethernet NICs are actually emulated by default? We've got the usual suspects – `e1000`, `igb`, `virtio-net` – a whole list. But where does `dwmac` or `stmmac` fit in? Are they even *there* in a generic x86 QEMU setup, especially considering the `Target architecture: amd64` constraint? I need to verify whether QEMU emulates it, or whether it requires specific ARM board emulation, potentially with `dwmac` on some board configurations. And since my target is amd64, are those relevant? This leads me to the core principle: "REACHABILITY IS THE PRIMARY GATE." I can only fuzz code that *actually* executes in these virtualized environments. If the code is unreachable due to hardware requirements or architectural constraints, it's a dead end. We have to consider Sections 1 and 2 here. Section 2 is the most relevant. It describes *negative* criteria – conditions under which I should *not* fuzz. I need to avoid: vendor-specific PCIe devices and their drivers that require physical hardware (like some SmartNICs or GPUs), and unreachable execution paths. This includes driver teardown callbacks or code that's exclusive to architectures other than amd64. So, the critical question: Can `stmmac` be instantiated and probed in QEMU on amd64 via a platform device, PCI, or some other mechanism? Or does it *always* require specific hardware that is not emulated? I need to examine the relevant source code – specifically `stmmac-pci.c`, `dwmac-intel.c`, and similar files. If it relies on hardware not accessible or emulated in a standard amd64 QEMU environment, then it’s likely not worth the effort. |
| 18/2 | 2026/10/04 20:53 | tool | grepper |
0mArgs:{
"Expression": "pci_device_id",
"PathPrefix": "drivers/net/ethernet/stmicro/stmmac"
}Results: {
"Output": "drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c=1263=static int intel_eth_pci_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c:1264:\t\t\t const struct pci_device_id *id)\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1265-{\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c=1362=static void intel_eth_pci_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1394-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c:1395:static const struct pci_device_id intel_eth_pci_id_table[] = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1396-\t{ PCI_DEVICE_DATA(INTEL, QUARK, \u0026quark_info) },\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c=479=static int loongson_dwmac_fix_reset(struct stmmac_priv *priv)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-497-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c:498:static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-499-{\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c=578=static void loongson_dwmac_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-595-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c:596:static const struct pci_device_id loongson_dwmac_id_table[] = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c-597-\t{ PCI_DEVICE_DATA(LOONGSON, GMAC1, \u0026loongson_gmac_pci_info) },\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c=264=static int motorcomm_setup_irq(struct pci_dev *pdev,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-292-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c:293:static int motorcomm_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-294-{\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c=362=static void motorcomm_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-366-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c:367:static const struct pci_device_id dwmac_motorcomm_pci_id_table[] = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-motorcomm.c-368-\t{ PCI_DEVICE(PCI_VENDOR_ID_MOTORCOMM, 0x6801) },\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c=118=static int stmmac_pci_probe(struct pci_dev *pdev,\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:119:\t\t\t const struct pci_device_id *id)\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-120-{\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c=192=static void stmmac_pci_remove(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-202-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:203:static const struct pci_device_id stmmac_id_table[] = {\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-204-\t{ PCI_DEVICE_DATA(STMMAC, STMMAC, \u0026stmmac_pci_info) },\n"
} |
| 19/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 22060 output: 40 thoughts: 1375 Thoughts: **Analyzing the Reachability of STMMAC for Fuzzing** Okay, let's break this down. My initial thought is about the PCI IDs associated with `stmmac`: dwmac-intel, dwmac-loongson, dwmac-motorcomm, and the standard `stmmac_pci`. My immediate question is whether any of these are emulated within standard QEMU or Google Compute Engine (GCE). The answer is a hard "no." Neither platform emulates the specific hardware associated with those drivers, which rules out direct probing and device instantiation. My focus shifts to the functions modified by this patch: `__free_dma_rx_desc_resources`, `stmmac_rx_zc`, `stmmac_xdp_put_buff`, `stmmac_build_skb`, `stmmac_build_xdp_frags`, `stmmac_xdp_shrink_tail`, `stmmac_rx`, and `stmmac_reset_rx_queue`. Even if some unusual circumstance allowed device probing, how could core receive functions like `stmmac_rx()` or `stmmac_rx_zc()` *ever* be executed? They're tied directly to the NAPI poll handler for receiving packets, which requires the physical hardware (or its emulation) to actually receive and DMA the data. If the hardware isn't present, the execution path is blocked from the start. This leads me to the critical question: is `stmmac` structurally unreachable hardware? The documentation explicitly mentions that vendor-specific PCIe switches, SmartNICs, and GPU drivers—like the ones requiring physical ASIC/PCIe cards—are not emulated in QEMU. This seems to apply directly to the `stmmac` family. I need to confirm this. I check if syzkaller or standard QEMU ever run or support stmmac. I can't search using grepper since it shouldn't have any syzkaller descriptions. I know that syzkaller doesn't have stmmac descriptions. What does syzkaller *actually* emulate on x86_64 in a QEMU setup? I know it's things like e1000 and virtio-net for NICs, USB raw gadget and dummy_hcd for USB, and virtual buses like loopback, veth, vxlan, tun/tap, macvtap, dummy, and so on. Almost all physical NIC drivers in `/drivers/net/ethernet/` *require* physical hardware, except the ones specifically emulated by QEMU. Does QEMU even have *any* stmmac emulation *anywhere*? My knowledge suggests the presence of `cadence_gem`, `imx_fec`, and `allwinner-sun8i-emac`. However, the last one is suspicious. Looking at the `allwinner-sun8i-emac.c` source in QEMU, the Allwinner EMAC is for ARM machines like the Cubieboard or Orangepi-pc! Even if that uses `dwmac-sun8i`, it is 32-bit ARM! And our target architecture is **amd64**, so it is irrelevant. This brings me back to the core principles: "Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments. If the modified code is structurally unreachable, it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic." The text specifically reiterates that structurally unreachable hardware includes vendor-specific devices requiring physical hardware not present in standard QEMU. Finally, can `stmmac` be reached in GCE or QEMU on amd64? No. It's a driver for a Synopsys DesignWare Ethernet MAC and it is not emulated in either of those on our target architecture, so it's not a virtual device that can be instantiated by userspace via platform device, configfs, or dynamic device creation. This is a dead end for fuzzing. |
| 20/2 | 2026/10/04 20:53 | tool | grepper |
0mError:no matches Args: {
"Expression": "platform_driver.*stmmac",
"PathPrefix": "drivers/net/ethernet/stmicro/stmmac"
}Results: {
"error": "no matches"
} |
| 21/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 24354 output: 38 thoughts: 13 Thoughts: Okay, let's dive into this. Here's my thought process on dissecting the `stmmac` platform driver registration: **Examining the stmmac Platform Driver Registration** Right, so I need to understand how the `stmmac` driver gets initialized within the system. I'll need to go through the kernel code to find where this happens. Where is the core registration function? Typically, I'd expect to find a `module_platform_driver()` macro invocation somewhere, or maybe a direct call to `platform_driver_register()`. Let's hunt for that. I wonder if there's a specific probe function defined for this, or if it handles multiple device types. Is there a defined driver structure, and if so, what's it named? And what devices does it claim to support? |
| 22/2 | 2026/10/04 20:53 | tool | grepper |
0mArgs:{
"Expression": "module_platform_driver",
"PathPrefix": "drivers/net/ethernet/stmicro/stmmac"
}Results: {
"Output": "drivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c=125=static struct platform_driver anarion_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-132-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c:133:module_platform_driver(anarion_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-134-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c=361=static struct platform_driver dwc_eth_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-369-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c:370:module_platform_driver(dwc_eth_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-371-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c=353=static struct platform_driver eic7700_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-360-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c:361:module_platform_driver(eic7700_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-362-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c=69=static struct platform_driver dwmac_generic_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-76-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c:77:module_platform_driver(dwmac_generic_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-78-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c=392=static struct platform_driver imx_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-400-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c:401:module_platform_driver(imx_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-402-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c=272=static struct platform_driver ingenic_mac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-279-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c:280:module_platform_driver(ingenic_mac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-281-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c=139=static struct platform_driver intel_eth_plat_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-147-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c:148:module_platform_driver(intel_eth_plat_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-149-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c=497=static struct platform_driver ipq806x_gmac_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-505-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c:506:module_platform_driver(ipq806x_gmac_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-507-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c=229=static struct platform_driver ls1x_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-235-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c:236:module_platform_driver(ls1x_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-237-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c=77=static struct platform_driver lpc18xx_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-85-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c:86:module_platform_driver(lpc18xx_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-87-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c=672=static struct platform_driver mediatek_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-680-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c:681:module_platform_driver(mediatek_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-682-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c=82=static struct platform_driver meson6_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-90-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c:91:module_platform_driver(meson6_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-92-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c=507=static struct platform_driver meson8b_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-515-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c:516:module_platform_driver(meson8b_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-517-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c=124=static struct platform_driver nvt_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-132-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c:133:module_platform_driver(nvt_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-134-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c=809=static struct platform_driver qcom_ethqos_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-816-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c:817:module_platform_driver(qcom_ethqos_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-818-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c=224=static struct platform_driver renesas_gbeth_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-231-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c:232:module_platform_driver(renesas_gbeth_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-233-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c=1640=static struct platform_driver rk_gmac_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1647-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c:1648:module_platform_driver(rk_gmac_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1649-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c=81=static struct platform_driver rzn1_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-88-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c:89:module_platform_driver(rzn1_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-90-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c=222=static struct platform_driver s32_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-230-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c:231:module_platform_driver(s32_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-232-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c=681=static struct platform_driver socfpga_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-688-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c:689:module_platform_driver(socfpga_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-690-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c=75=static struct platform_driver sophgo_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-83-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c:84:module_platform_driver(sophgo_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-85-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c=216=static struct platform_driver spacemit_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-224-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c:225:module_platform_driver(spacemit_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-226-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c=167=static struct platform_driver starfive_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-175-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c:176:module_platform_driver(starfive_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-177-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c=302=static struct platform_driver sti_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-309-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c:310:module_platform_driver(sti_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-311-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c=671=static struct platform_driver stm32_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-679-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c:680:module_platform_driver(stm32_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-681-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c=147=static struct platform_driver sun55i_gmac200_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-154-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c:155:module_platform_driver(sun55i_gmac200_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-156-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c=1304=static struct platform_driver sun8i_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1313-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:1314:module_platform_driver(sun8i_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1315-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c=156=static struct platform_driver sun7i_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-163-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c:164:module_platform_driver(sun7i_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-165-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c=405=static struct platform_driver tegra_mgbe_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-413-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c:414:module_platform_driver(tegra_mgbe_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-415-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c=273=static struct platform_driver thead_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-280-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c:281:module_platform_driver(thead_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-282-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ultrarisc.c=41=static struct platform_driver ultrarisc_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ultrarisc.c-48-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ultrarisc.c:49:module_platform_driver(ultrarisc_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ultrarisc.c-50-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c=261=static struct platform_driver visconti_eth_dwmac_driver = {\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-268-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c:269:module_platform_driver(visconti_eth_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-270-\n"
} |
| 23/2 | 2026/10/04 20:53 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 29272 output: 135 thoughts: 862 Thoughts: **Analysis of Unfuzzable Code: STMMAC Ethernet Driver** Okay, let's break this down. My initial assessment is that this code change is *not* fuzzable. Looking at the modified files and their context, I see a clear pattern: this revolves around the STMMAC driver, specifically the low-level DMA RX ring processing. The specific functions I'm seeing touched (`stmmac_rx`, `stmmac_rx_zc`, `__free_dma_rx_desc_resources`, and the helpers `stmmac_xdp_put_buff`, `stmmac_build_skb`, `stmmac_build_xdp_frags`, `stmmac_xdp_shrink_tail`) scream DMA and packet handling. This code is triggered during NAPI polling when the hardware receives packets from the physical Ethernet wire and prepares DMA descriptors, or during queue reset/freeing. Now, the crucial point: all the SoCs listed (Anarion, dwc-qos, EIC7700, etc., etc.) are SoC platforms, and none of these are present or emulated in standard QEMU or GCE x86/amd64 VMs. The same applies to those PCI devices like `dwmac-intel.c`, `dwmac-loongson.c`, etc. They need the *actual* hardware, and not a standard virtual environment. Therefore, the only conclusion is that this work falls under Section 2 of my analysis criteria: "Structurally unreachable hardware." Specifically, this falls under the category of drivers requiring physical ASIC/PCIe cards that are not emulated in standard QEMU. The Synopsys DesignWare Ethernet MAC controllers the STMMAC driver is meant to work with, whether on embedded SoCs or specific PCI hardware, are simply not accessible to fuzzing within QEMU. I've double-checked my work. There are only two other files modified by the commit. `drivers/net/ethernet/stmicro/stmmac/stmmac.h` and `drivers/net/ethernet/stmicro/stmmac/stmmac_main.c`. Both of these files are part of the `stmmac` driver, so there are no other potential areas to consider. The architecture is `amd64`, which confirms that no specialized configuration applies. So, *WorthFuzzing* is unequivocally false. The *EnableConfigs* and *FocusSymbols* should be empty, given that no specific configuration is required, and there's no specific symbol to isolate. The reasoning is clear: the STMMAC driver handles Ethernet MACs found on specialized SoCs and physical PCI controllers, both of which are not emulated in standard QEMU / GCE virtualized environments, making this RX DMA ring processing logic structurally unreachable. Let's confirm the parameters before I proceed. I'm going to set *WorthFuzzing* to false, *EnableConfigs* to an empty array, *FocusSymbols* to an empty array, and provide the clear reasoning I've outlined. Everything checks out. Let's call `set-results`. |
| 24/2 | 2026/10/04 20:54 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the RX DMA descriptor processing, buffer recycling, and XDP packet handling logic in the STMicroelectronics / Synopsys DesignWare MAC (stmmac) ethernet driver (drivers/net/ethernet/stmicro/stmmac/). This driver targets physical ethernet controllers found on dedicated SoCs or specific PCI cards, none of which are emulated in standard virtualized environments (such as QEMU or GCE on amd64). Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the RX DMA descriptor processing, buffer recycling, and XDP packet handling logic in the STMicroelectronics / Synopsys DesignWare MAC (stmmac) ethernet driver (drivers/net/ethernet/stmicro/stmmac/). This driver targets physical ethernet controllers found on dedicated SoCs or specific PCI cards, none of which are emulated in standard virtualized environments (such as QEMU or GCE on amd64). Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 25/1 | 2026/10/04 20:54 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|