AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch adds a new device tree compatible string and minor probe-time configuration for the Altera SOCFPGA DWMAC driver. This is a vendor-specific hardware driver that is not emulated in standard virtualized environments (like QEMU/GCE) used for fuzzing. Furthermore, the changes are trivial assignments during device probe and do not introduce any complex or user-reachable logic.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 864ad44669f3a7b126d548feeaf9cf62ccda416b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Aug 17 03:20:21 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/Documentation/devicetree/bindings/arm/altera.yaml b/Documentation/devicetree/bindings/arm/altera.yaml\nindex 3030cf46fe74c..e431469a71753 100644\n--- a/Documentation/devicetree/bindings/arm/altera.yaml\n+++ b/Documentation/devicetree/bindings/arm/altera.yaml\n@@ -114,6 +114,7 @@ properties:\n               - intel,socfpga-agilex5-socdk-debug\n               - intel,socfpga-agilex5-socdk-modular\n               - intel,socfpga-agilex5-socdk-nand\n+              - intel,socfpga-agilex5-socdk-tsn-cfg2\n           - const: intel,socfpga-agilex5\n \n       - description: Agilex72 boards\ndiff --git a/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml b/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml\nindex 63084f7623738..7db6a71029943 100644\n--- a/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml\n+++ b/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml\n@@ -24,6 +24,7 @@ select:\n           - altr,socfpga-stmmac\n           - altr,socfpga-stmmac-a10-s10\n           - altr,socfpga-stmmac-agilex5\n+          - altr,socfpga-stmmac-agilex5-tsn\n \n   required:\n     - compatible\n@@ -46,6 +47,9 @@ properties:\n       - items:\n           - const: altr,socfpga-stmmac-agilex5\n           - const: snps,dwxgmac-2.10\n+      - items:\n+          - const: altr,socfpga-stmmac-agilex5-tsn\n+          - const: snps,dwxgmac-2.10\n \n   clocks:\n     minItems: 1\ndiff --git a/arch/arm64/boot/dts/intel/Makefile b/arch/arm64/boot/dts/intel/Makefile\nindex 270c70fdf084b..ce7cf3a632753 100644\n--- a/arch/arm64/boot/dts/intel/Makefile\n+++ b/arch/arm64/boot/dts/intel/Makefile\n@@ -8,6 +8,7 @@ dtb-$(CONFIG_ARCH_INTEL_SOCFPGA) += socfpga_agilex_n6000.dtb \\\n \t\t\t\tsocfpga_agilex5_socdk_013b.dtb \\\n \t\t\t\tsocfpga_agilex5_socdk_modular.dtb \\\n \t\t\t\tsocfpga_agilex5_socdk_nand.dtb \\\n+\t\t\t\tsocfpga_agilex5_socdk_tsn_cfg2.dtb \\\n \t\t\t\tsocfpga_agilex72_socdk.dtb \\\n \t\t\t\tsocfpga_agilex7m_socdk.dtb \\\n \t\t\t\tsocfpga_n5x_socdk.dtb\ndiff --git a/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts b/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts\nnew file mode 100644\nindex 0000000000000..9d39f843b4240\n--- /dev/null\n+++ b/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts\n@@ -0,0 +1,130 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+/*\n+ * Copyright (C) 2026, Altera Corporation\n+ */\n+#include \"socfpga_agilex5.dtsi\"\n+\n+/ {\n+\tmodel = \"SoCFPGA Agilex5 SoCDK TSN Config2\";\n+\tcompatible = \"intel,socfpga-agilex5-socdk-tsn-cfg2\", \"intel,socfpga-agilex5\";\n+\n+\taliases {\n+\t\tserial0 = \u0026uart0;\n+\t\tethernet1 = \u0026gmac1;\n+\t\tethernet2 = \u0026gmac2;\n+\t};\n+\n+\tchosen {\n+\t\tstdout-path = \"serial0:115200n8\";\n+\t};\n+\n+\tleds {\n+\t\tcompatible = \"gpio-leds\";\n+\n+\t\tled-0 {\n+\t\t\tlabel = \"hps_led0\";\n+\t\t\tgpios = \u003c\u0026porta 11 GPIO_ACTIVE_HIGH\u003e;\n+\t\t};\n+\n+\t};\n+\n+\tmemory@80000000 {\n+\t\tdevice_type = \"memory\";\n+\t\t/* We expect the bootloader to fill in the reg */\n+\t\treg = \u003c0x0 0x80000000 0x0 0x0\u003e;\n+\t};\n+};\n+\n+\u0026gpio0 {\n+\tstatus = \"okay\";\n+};\n+\n+\u0026gpio1 {\n+\tstatus = \"okay\";\n+};\n+\n+\u0026gmac1 {\n+\tstatus = \"okay\";\n+\tcompatible = \"altr,socfpga-stmmac-agilex5-tsn\",\n+\t\t     \"snps,dwxgmac-2.10\";\n+\tphy-mode = \"rgmii-id\";\n+\tphy-handle = \u003c\u0026emac1_phy0\u003e;\n+\tmax-frame-size = \u003c9000\u003e;\n+\n+\tmdio0 {\n+\t\t#address-cells = \u003c1\u003e;\n+\t\t#size-cells = \u003c0\u003e;\n+\t\tcompatible = \"snps,dwmac-mdio\";\n+\n+\t\temac1_phy0: ethernet-phy@0 {\n+\t\t\treg = \u003c0\u003e;\n+\t\t};\n+\t};\n+};\n+\n+\u0026gmac2 {\n+\tstatus = \"okay\";\n+\tphy-mode = \"rgmii-id\";\n+\tphy-handle = \u003c\u0026emac2_phy0\u003e;\n+\tmax-frame-size = \u003c9000\u003e;\n+\n+\tmdio0 {\n+\t\t#address-cells = \u003c1\u003e;\n+\t\t#size-cells = \u003c0\u003e;\n+\t\tcompatible = \"snps,dwmac-mdio\";\n+\n+\t\temac2_phy0: ethernet-phy@0 {\n+\t\t\treg = \u003c0\u003e;\n+\t\t};\n+\t};\n+};\n+\n+\u0026osc1 {\n+\tclock-frequency = \u003c25000000\u003e;\n+};\n+\n+\u0026qspi {\n+\tstatus = \"okay\";\n+\tflash@0 {\n+\t\tcompatible = \"micron,mt25qu02g\", \"jedec,spi-nor\";\n+\t\treg = \u003c0\u003e;\n+\t\tspi-max-frequency = \u003c100000000\u003e;\n+\t\tm25p,fast-read;\n+\t\tcdns,read-delay = \u003c2\u003e;\n+\t\tcdns,tshsl-ns = \u003c50\u003e;\n+\t\tcdns,tsd2d-ns = \u003c50\u003e;\n+\t\tcdns,tchsh-ns = \u003c4\u003e;\n+\t\tcdns,tslch-ns = \u003c4\u003e;\n+\t\tspi-tx-bus-width = \u003c4\u003e;\n+\t\tspi-rx-bus-width = \u003c4\u003e;\n+\n+\t\tpartitions {\n+\t\t\tcompatible = \"fixed-partitions\";\n+\t\t\t#address-cells = \u003c1\u003e;\n+\t\t\t#size-cells = \u003c1\u003e;\n+\n+\t\t\tqspi_boot: partition@0 {\n+\t\t\t\tlabel = \"u-boot\";\n+\t\t\t\treg = \u003c0x0 0x04200000\u003e;\n+\t\t\t};\n+\n+\t\t\troot: partition@4200000 {\n+\t\t\t\tlabel = \"root\";\n+\t\t\t\treg = \u003c0x04200000 0x0be00000\u003e;\n+\t\t\t};\n+\t\t};\n+\t};\n+};\n+\n+\u0026uart0 {\n+\tstatus = \"okay\";\n+};\n+\n+\u0026usb0 {\n+\tstatus = \"okay\";\n+\tdisable-over-current;\n+};\n+\n+\u0026watchdog0 {\n+\tstatus = \"okay\";\n+};\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c\nindex 1d7f0a57d2889..0632105b420f1 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c\n@@ -69,12 +69,13 @@ struct socfpga_dwmac {\n \tvoid __iomem *tse_pcs_base;\n \tvoid __iomem *sgmii_adapter_base;\n \tbool f2h_ptp_ref_clk;\n+\tphy_interface_t mac_interface;\n \tconst struct socfpga_dwmac_ops *ops;\n };\n \n static phy_interface_t socfpga_get_plat_phymode(struct socfpga_dwmac *dwmac)\n {\n-\treturn dwmac-\u003eplat_dat-\u003ephy_interface;\n+\treturn dwmac-\u003emac_interface;\n }\n \n static void socfpga_sgmii_config(struct socfpga_dwmac *dwmac, bool enable)\n@@ -650,6 +651,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)\n \tplat_dat-\u003epcs_exit = socfpga_dwmac_pcs_exit;\n \tplat_dat-\u003eselect_pcs = socfpga_dwmac_select_pcs;\n \n+\tdwmac-\u003emac_interface = plat_dat-\u003ephy_interface;\n+\n \tops-\u003esetup_plat_dat(dwmac);\n \n \treturn devm_stmmac_pltfr_probe(pdev, plat_dat, \u0026stmmac_res);\n@@ -670,10 +673,28 @@ static const struct socfpga_dwmac_ops socfpga_agilex5_ops = {\n \t.setup_plat_dat = socfpga_agilex5_setup_plat_dat,\n };\n \n+static void socfpga_agilex5_tsn_gmac_setup_plat_dat(struct socfpga_dwmac *dwmac)\n+{\n+\tstruct plat_stmmacenet_data *plat_dat = dwmac-\u003eplat_dat;\n+\n+\tsocfpga_agilex5_setup_plat_dat(dwmac);\n+\n+\t/* FPGA converter supplies RGMII delays; MAC uses GMII, PHY gets plain RGMII */\n+\tdwmac-\u003emac_interface = PHY_INTERFACE_MODE_GMII;\n+\tif (phy_interface_mode_is_rgmii(plat_dat-\u003ephy_interface))\n+\t\tplat_dat-\u003ephy_interface = PHY_INTERFACE_MODE_RGMII;\n+}\n+\n+static const struct socfpga_dwmac_ops socfpga_agilex5_tsn_gmac_ops = {\n+\t.set_phy_mode = socfpga_gen10_set_phy_mode,\n+\t.setup_plat_dat = socfpga_agilex5_tsn_gmac_setup_plat_dat,\n+};\n+\n static const struct of_device_id socfpga_dwmac_match[] = {\n \t{ .compatible = \"altr,socfpga-stmmac\", .data = \u0026socfpga_gen5_ops },\n \t{ .compatible = \"altr,socfpga-stmmac-a10-s10\", .data = \u0026socfpga_gen10_ops },\n \t{ .compatible = \"altr,socfpga-stmmac-agilex5\", .data = \u0026socfpga_agilex5_ops },\n+\t{ .compatible = \"altr,socfpga-stmmac-agilex5-tsn\", .data = \u0026socfpga_agilex5_tsn_gmac_ops },\n \t{ }\n };\n MODULE_DEVICE_TABLE(of, socfpga_dwmac_match);\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds a new device tree compatible string and minor probe-time configuration for the Altera SOCFPGA DWMAC driver. This is a vendor-specific hardware driver that is not emulated in standard virtualized environments (like QEMU/GCE) used for fuzzing. Furthermore, the changes are trivial assignments during device probe and do not introduce any complex or user-reachable logic.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 864ad44669f3a7b126d548feeaf9cf62ccda416b
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Aug 17 03:20:21 2026 +0000

    syz-cluster: applied patch under review

diff --git a/Documentation/devicetree/bindings/arm/altera.yaml b/Documentation/devicetree/bindings/arm/altera.yaml
index 3030cf46fe74c..e431469a71753 100644
--- a/Documentation/devicetree/bindings/arm/altera.yaml
+++ b/Documentation/devicetree/bindings/arm/altera.yaml
@@ -114,6 +114,7 @@ properties:
               - intel,socfpga-agilex5-socdk-debug
               - intel,socfpga-agilex5-socdk-modular
               - intel,socfpga-agilex5-socdk-nand
+              - intel,socfpga-agilex5-socdk-tsn-cfg2
           - const: intel,socfpga-agilex5
 
       - description: Agilex72 boards
diff --git a/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml b/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml
index 63084f7623738..7db6a71029943 100644
--- a/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml
+++ b/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml
@@ -24,6 +24,7 @@ select:
           - altr,socfpga-stmmac
           - altr,socfpga-stmmac-a10-s10
           - altr,socfpga-stmmac-agilex5
+          - altr,socfpga-stmmac-agilex5-tsn
 
   required:
     - compatible
@@ -46,6 +47,9 @@ properties:
       - items:
           - const: altr,socfpga-stmmac-agilex5
           - const: snps,dwxgmac-2.10
+      - items:
+          - const: altr,socfpga-stmmac-agilex5-tsn
+          - const: snps,dwxgmac-2.10
 
   clocks:
     minItems: 1
diff --git a/arch/arm64/boot/dts/intel/Makefile b/arch/arm64/boot/dts/intel/Makefile
index 270c70fdf084b..ce7cf3a632753 100644
--- a/arch/arm64/boot/dts/intel/Makefile
+++ b/arch/arm64/boot/dts/intel/Makefile
@@ -8,6 +8,7 @@ dtb-$(CONFIG_ARCH_INTEL_SOCFPGA) += socfpga_agilex_n6000.dtb \
 				socfpga_agilex5_socdk_013b.dtb \
 				socfpga_agilex5_socdk_modular.dtb \
 				socfpga_agilex5_socdk_nand.dtb \
+				socfpga_agilex5_socdk_tsn_cfg2.dtb \
 				socfpga_agilex72_socdk.dtb \
 				socfpga_agilex7m_socdk.dtb \
 				socfpga_n5x_socdk.dtb
diff --git a/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts b/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts
new file mode 100644
index 0000000000000..9d39f843b4240
--- /dev/null
+++ b/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts
@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026, Altera Corporation
+ */
+#include "socfpga_agilex5.dtsi"
+
+/ {
+	model = "SoCFPGA Agilex5 SoCDK TSN Config2";
+	compatible = "intel,socfpga-agilex5-socdk-tsn-cfg2", "intel,socfpga-agilex5";
+
+	aliases {
+		serial0 = &uart0;
+		ethernet1 = &gmac1;
+		ethernet2 = &gmac2;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "hps_led0";
+			gpios = <&porta 11 GPIO_ACTIVE_HIGH>;
+		};
+
+	};
+
+	memory@80000000 {
+		device_type = "memory";
+		/* We expect the bootloader to fill in the reg */
+		reg = <0x0 0x80000000 0x0 0x0>;
+	};
+};
+
+&gpio0 {
+	status = "okay";
+};
+
+&gpio1 {
+	status = "okay";
+};
+
+&gmac1 {
+	status = "okay";
+	compatible = "altr,socfpga-stmmac-agilex5-tsn",
+		     "snps,dwxgmac-2.10";
+	phy-mode = "rgmii-id";
+	phy-handle = <&emac1_phy0>;
+	max-frame-size = <9000>;
+
+	mdio0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "snps,dwmac-mdio";
+
+		emac1_phy0: ethernet-phy@0 {
+			reg = <0>;
+		};
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "rgmii-id";
+	phy-handle = <&emac2_phy0>;
+	max-frame-size = <9000>;
+
+	mdio0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "snps,dwmac-mdio";
+
+		emac2_phy0: ethernet-phy@0 {
+			reg = <0>;
+		};
+	};
+};
+
+&osc1 {
+	clock-frequency = <25000000>;
+};
+
+&qspi {
+	status = "okay";
+	flash@0 {
+		compatible = "micron,mt25qu02g", "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <100000000>;
+		m25p,fast-read;
+		cdns,read-delay = <2>;
+		cdns,tshsl-ns = <50>;
+		cdns,tsd2d-ns = <50>;
+		cdns,tchsh-ns = <4>;
+		cdns,tslch-ns = <4>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qspi_boot: partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x04200000>;
+			};
+
+			root: partition@4200000 {
+				label = "root";
+				reg = <0x04200000 0x0be00000>;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb0 {
+	status = "okay";
+	disable-over-current;
+};
+
+&watchdog0 {
+	status = "okay";
+};
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
index 1d7f0a57d2889..0632105b420f1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -69,12 +69,13 @@ struct socfpga_dwmac {
 	void __iomem *tse_pcs_base;
 	void __iomem *sgmii_adapter_base;
 	bool f2h_ptp_ref_clk;
+	phy_interface_t mac_interface;
 	const struct socfpga_dwmac_ops *ops;
 };
 
 static phy_interface_t socfpga_get_plat_phymode(struct socfpga_dwmac *dwmac)
 {
-	return dwmac->plat_dat->phy_interface;
+	return dwmac->mac_interface;
 }
 
 static void socfpga_sgmii_config(struct socfpga_dwmac *dwmac, bool enable)
@@ -650,6 +651,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
 	plat_dat->pcs_exit = socfpga_dwmac_pcs_exit;
 	plat_dat->select_pcs = socfpga_dwmac_select_pcs;
 
+	dwmac->mac_interface = plat_dat->phy_interface;
+
 	ops->setup_plat_dat(dwmac);
 
 	return devm_stmmac_pltfr_probe(pdev, plat_dat, &stmmac_res);
@@ -670,10 +673,28 @@ static const struct socfpga_dwmac_ops socfpga_agilex5_ops = {
 	.setup_plat_dat = socfpga_agilex5_setup_plat_dat,
 };
 
+static void socfpga_agilex5_tsn_gmac_setup_plat_dat(struct socfpga_dwmac *dwmac)
+{
+	struct plat_stmmacenet_data *plat_dat = dwmac->plat_dat;
+
+	socfpga_agilex5_setup_plat_dat(dwmac);
+
+	/* FPGA converter supplies RGMII delays; MAC uses GMII, PHY gets plain RGMII */
+	dwmac->mac_interface = PHY_INTERFACE_MODE_GMII;
+	if (phy_interface_mode_is_rgmii(plat_dat->phy_interface))
+		plat_dat->phy_interface = PHY_INTERFACE_MODE_RGMII;
+}
+
+static const struct socfpga_dwmac_ops socfpga_agilex5_tsn_gmac_ops = {
+	.set_phy_mode = socfpga_gen10_set_phy_mode,
+	.setup_plat_dat = socfpga_agilex5_tsn_gmac_setup_plat_dat,
+};
+
 static const struct of_device_id socfpga_dwmac_match[] = {
 	{ .compatible = "altr,socfpga-stmmac", .data = &socfpga_gen5_ops },
 	{ .compatible = "altr,socfpga-stmmac-a10-s10", .data = &socfpga_gen10_ops },
 	{ .compatible = "altr,socfpga-stmmac-agilex5", .data = &socfpga_agilex5_ops },
+	{ .compatible = "altr,socfpga-stmmac-agilex5-tsn", .data = &socfpga_agilex5_tsn_gmac_ops },
 	{ }
 };
 MODULE_DEVICE_TABLE(of, socfpga_dwmac_match);

gemini-3.1-pro-preview

null

null

							input: 4998
							output: 21
							thoughts: 722
						

**Fuzzing Feasibility Assessment: Altera SOCFPGA Agilex5 TSN DWMAC Driver Patch**

Okay, so I've got this patch adding a new device tree binding and a compatible string, `altr,socfpga-stmmac-agilex5-tsn`, to the `stmmac` driver within `dwmac-socfpga.c`. The patch seems to be touching the `socfpga_get_plat_phymode` function and a new `socfpga_agilex5_tsn_gmac_setup_plat_dat` and also `socfpga_agilex5_tsn_gmac_ops`. The core of the driver seems to be the stmmac driver.

My initial thought is, is this even *worth* fuzzing? I mean, `dwmac-socfpga.c` is the target, so that's the area of interest. It's a platform driver, specifically for Altera SOCFPGA DWMAC. Platform drivers are generally tricky to fuzz directly because you usually need to instantiate them via the device tree.

The question is, can I instantiate this thing in QEMU? These SOC specific platform drivers are normally a pain in the ass to fuzz directly. Syzkaller *can* inject platform devices with `syz_dev_create`, but that usually needs specific hardware or QEMU support. Since this is a glue layer for `stmmac`, that also influences my thinking here.

Let's dive deeper into the changes themselves. It looks like the most significant change is in `socfpga_get_plat_phymode` where it's switching from using `dwmac->plat_dat->phy_interface` to `dwmac->mac_interface`. Then we have the `socfpga_agilex5_tsn_gmac_setup_plat_dat` which seems to be mostly setting up PHY interface modes during probe. The code looks like this:

```c
static phy_interface_t socfpga_get_plat_phymode(struct socfpga_dwmac *dwmac)
{
-	return dwmac->plat_dat->phy_interface;
+	return dwmac->mac_interface;
}

static void socfpga_agilex5_tsn_gmac_setup_plat_dat(struct socfpga_dwmac *dwmac)
{
	struct plat_stmmacenet_data *plat_dat = dwmac->plat_dat;

	socfpga_agilex5_setup_plat_dat(dwmac);

	/* FPGA converter supplies RGMII delays; MAC uses GMII, PHY gets plain RGMII */
	dwmac->mac_interface = PHY_INTERFACE_MODE_GMII;
	if (phy_interface_mode_is_rgmii(plat_dat->phy_interface))
		plat_dat->phy_interface = PHY_INTERFACE_MODE_RGMII;
}
```

The changes are incredibly minimal - mostly about setting up PHY interface modes at probe time. The new setup function modifies the PHY interface, but it's *specific* to the Altera SOCFPGA Agilex5 TSN.

So, *is* it reachable? I need to figure out what config option enables `dwmac-socfpga.c`. I'll search for `CONFIG_DWMAC_SOCFPGA`. Let's see if this is even compiled by default. If it isn't, the chances of this being easily reachable via fuzzing are low.

{
  "Expression": "DWMAC_SOCFPGA"
}

{
  "Output": "drivers/net/ethernet/stmicro/stmmac/Kconfig=191=config DWMAC_S32\n--\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-202-\ndrivers/net/ethernet/stmicro/stmmac/Kconfig:203:config DWMAC_SOCFPGA\ndrivers/net/ethernet/stmicro/stmmac/Kconfig-204-\ttristate \"SOCFPGA dwmac support\"\n--\ndrivers/net/ethernet/stmicro/stmmac/Makefile=28=obj-$(CONFIG_DWMAC_S32)\t\t+= dwmac-s32.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile:29:obj-$(CONFIG_DWMAC_SOCFPGA)\t+= dwmac-altr-socfpga.o\ndrivers/net/ethernet/stmicro/stmmac/Makefile-30-obj-$(CONFIG_DWMAC_SOPHGO)\t+= dwmac-sophgo.o\n"
}

gemini-3.1-pro-preview

null

null

							input: 6785
							output: 112
							thoughts: 499
						

**My Assessment: Not Worth Fuzzing**

Okay, so the config is `DWMAC_SOCFPGA`. The changes are isolated to the probe path of the Altera SOCFPGA hardware driver. My initial thought is that these kinds of hardware-specific probe paths, especially those just setting up constants and not exposing new syscalls or complex logic, aren't typically fruitful for fuzzing. They usually depend on very specific hardware or device tree nodes that you won't find in generic x86 VMs.

I did recall that syzkaller *can* handle some platform driver fuzzing with device tree overlay injection, but even then, this is still just the probe function, and it is a trivial setup.

Let me break down the changes: we are setting a single variable:
- `socfpga_get_plat_phymode` changed to return `dwmac->mac_interface`.
- `socfpga_dwmac_probe` sets `dwmac->mac_interface = plat_dat->phy_interface`.
- `socfpga_agilex5_tsn_gmac_setup_plat_dat` sets `dwmac->mac_interface = PHY_INTERFACE_MODE_GMII` and changes `plat_dat->phy_interface`.

It's a really simple configuration change specific to a particular hardware platform. No complex logic, state machines, or anything user-accessible is introduced here.

Initially, I'd mark this as `WorthFuzzing=false` due to its nature.

However, let me quickly re-read the instructions... Okay, the criteria are pretty clear:

*   Code paths unreachable in virtualized environments like GCE or QEMU, even with software-emulated hardware.
*   Vendor-specific PCIe switch, SmartNIC, or GPU drivers that need physical hardware.

This is a vendor-specific SoC Ethernet MAC driver – Altera SOCFPGA. It relies on the device tree. I'm pretty sure standard QEMU doesn't emulate Agilex5, and even with DT injection, these are trivial probe-time assignments.

Yep, still *not* worth fuzzing. I'll return `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch adds a new device tree compatible string and minor probe-time configuration for the Altera SOCFPGA DWMAC driver. This is a vendor-specific hardware driver that is not emulated in standard virtualized environments (like QEMU/GCE) used for fuzzing. Furthermore, the changes are trivial assignments during device probe and do not introduce any complex or user-reachable logic.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds a new device tree compatible string and minor probe-time configuration for the Altera SOCFPGA DWMAC driver. This is a vendor-specific hardware driver that is not emulated in standard virtualized environments (like QEMU/GCE) used for fuzzing. Furthermore, the changes are trivial assignments during device probe and do not introduce any complex or user-reachable logic.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null