AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies sc16is7xx_handle_tx() in drivers/tty/serial/sc16is7xx.c, which is a serial driver for external NXP SC16IS7xx UART chips connected over I2C or SPI. This hardware is not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 3d534eb7f80f75130def7ff90446d1ae27e84758\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Sep 27 10:18:24 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c\nindex 7107a0fb1e7bb..fa7805d2cde23 100644\n--- a/drivers/tty/serial/sc16is7xx.c\n+++ b/drivers/tty/serial/sc16is7xx.c\n@@ -652,7 +652,6 @@ static void sc16is7xx_handle_tx(struct uart_port *port)\n \tstruct tty_port *tport = \u0026port-\u003estate-\u003eport;\n \tunsigned long flags;\n \tunsigned int txlen;\n-\tunsigned char *tail;\n \n \tif (unlikely(port-\u003ex_char)) {\n \t\tsc16is7xx_port_write(port, SC16IS7XX_THR_REG, port-\u003ex_char);\n@@ -677,9 +676,19 @@ static void sc16is7xx_handle_tx(struct uart_port *port)\n \t\ttxlen = 0;\n \t}\n \n-\ttxlen = kfifo_out_linear_ptr(\u0026tport-\u003exmit_fifo, \u0026tail, txlen);\n-\tsc16is7xx_fifo_write(port, tail, txlen);\n-\tuart_xmit_advance(port, txlen);\n+\t/* Handle circular buffer wrap-around by sending multiple segments */\n+\twhile (txlen \u003e 0 \u0026\u0026 !kfifo_is_empty(\u0026tport-\u003exmit_fifo)) {\n+\t\tunsigned char *tail;\n+\t\tunsigned int to_send;\n+\n+\t\tto_send = kfifo_out_linear_ptr(\u0026tport-\u003exmit_fifo, \u0026tail, txlen);\n+\t\tif (!to_send)\n+\t\t\tbreak;\n+\n+\t\tsc16is7xx_fifo_write(port, tail, to_send);\n+\t\tuart_xmit_advance(port, to_send);\n+\t\ttxlen -= to_send;\n+\t}\n \n \tuart_port_lock_irqsave(port, \u0026flags);\n \tif (kfifo_len(\u0026tport-\u003exmit_fifo) \u003c WAKEUP_CHARS)\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies sc16is7xx_handle_tx() in drivers/tty/serial/sc16is7xx.c, which is a serial driver for external NXP SC16IS7xx UART chips connected over I2C or SPI. This hardware is not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 3d534eb7f80f75130def7ff90446d1ae27e84758
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Sep 27 10:18:24 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 7107a0fb1e7bb..fa7805d2cde23 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -652,7 +652,6 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
 	struct tty_port *tport = &port->state->port;
 	unsigned long flags;
 	unsigned int txlen;
-	unsigned char *tail;
 
 	if (unlikely(port->x_char)) {
 		sc16is7xx_port_write(port, SC16IS7XX_THR_REG, port->x_char);
@@ -677,9 +676,19 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
 		txlen = 0;
 	}
 
-	txlen = kfifo_out_linear_ptr(&tport->xmit_fifo, &tail, txlen);
-	sc16is7xx_fifo_write(port, tail, txlen);
-	uart_xmit_advance(port, txlen);
+	/* Handle circular buffer wrap-around by sending multiple segments */
+	while (txlen > 0 && !kfifo_is_empty(&tport->xmit_fifo)) {
+		unsigned char *tail;
+		unsigned int to_send;
+
+		to_send = kfifo_out_linear_ptr(&tport->xmit_fifo, &tail, txlen);
+		if (!to_send)
+			break;
+
+		sc16is7xx_fifo_write(port, tail, to_send);
+		uart_xmit_advance(port, to_send);
+		txlen -= to_send;
+	}
 
 	uart_port_lock_irqsave(port, &flags);
 	if (kfifo_len(&tport->xmit_fifo) < WAKEUP_CHARS)

gemini-3.8-flash

null

null

							input: 3214
							output: 33
							thoughts: 67
						

Here's my analysis of the situation:

**Investigating a Serial Driver Patch**

Okay, so I see a patch touching `drivers/tty/serial/sc16is7xx.c`. Right away, my primary concern is to understand what this driver manages. Is it some niche hardware, or something more common? I need to quickly grasp the scope of the potential impact.

My immediate next step is to get my hands dirty with the code. I'll need to use either `grepper` or `read-file` to efficiently dissect `sc16is7xx.c` and also check the corresponding Kconfig file. This will give me crucial insights into the target hardware, the bus it's tied to (SPI, I2C, UART?), and any relevant configuration options. Understanding these relationships is the foundation for properly assessing the patch's significance.

{
  "Expression": "SERIAL_SC16IS7XX",
  "PathPrefix": "drivers/tty/serial"
}

{
  "Output": "drivers/tty/serial/Kconfig=1037=config SERIAL_SCCNXP_CONSOLE\n--\ndrivers/tty/serial/Kconfig-1043-\ndrivers/tty/serial/Kconfig:1044:config SERIAL_SC16IS7XX\ndrivers/tty/serial/Kconfig-1045-\ttristate \"NXP SC16IS7xx UART support\"\n--\ndrivers/tty/serial/Kconfig-1047-\tselect SERIAL_CORE\ndrivers/tty/serial/Kconfig:1048:\tselect SERIAL_SC16IS7XX_SPI if SPI_MASTER\ndrivers/tty/serial/Kconfig:1049:\tselect SERIAL_SC16IS7XX_I2C if I2C\ndrivers/tty/serial/Kconfig-1050-\thelp\n--\ndrivers/tty/serial/Kconfig-1062-\ndrivers/tty/serial/Kconfig:1063:config SERIAL_SC16IS7XX_I2C\ndrivers/tty/serial/Kconfig-1064-\ttristate\n--\ndrivers/tty/serial/Kconfig-1066-\ndrivers/tty/serial/Kconfig:1067:config SERIAL_SC16IS7XX_SPI\ndrivers/tty/serial/Kconfig-1068-\ttristate\n--\ndrivers/tty/serial/Makefile=76=obj-$(CONFIG_SERIAL_SCCNXP)\t\t+= sccnxp.o\ndrivers/tty/serial/Makefile:77:obj-$(CONFIG_SERIAL_SC16IS7XX)\t\t+= sc16is7xx.o\ndrivers/tty/serial/Makefile:78:obj-$(CONFIG_SERIAL_SC16IS7XX_SPI)\t+= sc16is7xx_spi.o\ndrivers/tty/serial/Makefile:79:obj-$(CONFIG_SERIAL_SC16IS7XX_I2C)\t+= sc16is7xx_i2c.o\ndrivers/tty/serial/Makefile-80-obj-$(CONFIG_SERIAL_SH_SCI)\t\t+= sh-sci.o\n"
}

gemini-3.8-flash

null

null

							input: 4016
							output: 37
							thoughts: 22
						

Here's a summary of my thought process, keeping in mind my expert understanding:

**Navigating the Kernel's Serial Driver Configuration**

Okay, time to dig into this. Based on my experience, the relevant configuration options for the serial drivers are often found within the `Kconfig` files. I'm going to head straight to `drivers/tty/serial/Kconfig`. That's where I expect to find the configuration options that define the core behavior and support for serial ports within the Linux kernel. I'm specifically targeting around line 1044 as a starting point. That general area usually hosts configuration options and likely dependencies, especially if there's any particular driver or module I'm interested in. The Kconfig files can be dense, but my expertise allows me to quickly navigate the structure and zero in on relevant features and their dependencies. This should get me where I need to be, so I can continue my troubleshooting or configuration.

{
  "File": "drivers/tty/serial/Kconfig",
  "FirstLine": 1040,
  "LineCount": 35
}

{
  "Contents": "1040:\t\tselect SERIAL_CORE_CONSOLE\n1041:\t\thelp\n1042:\t\t  Support for console on SCCNXP serial ports.\n1043:\t\n1044:\tconfig SERIAL_SC16IS7XX\n1045:\t\ttristate \"NXP SC16IS7xx UART support\"\n1046:\t\tdepends on SPI_MASTER || I2C || COMPILE_TEST\n1047:\t\tselect SERIAL_CORE\n1048:\t\tselect SERIAL_SC16IS7XX_SPI if SPI_MASTER\n1049:\t\tselect SERIAL_SC16IS7XX_I2C if I2C\n1050:\t\thelp\n1051:\t\t  Core driver for NXP SC16IS7xx UARTs.\n1052:\t\t  Supported ICs are:\n1053:\t\n1054:\t\t    SC16IS740\n1055:\t\t    SC16IS741\n1056:\t\t    SC16IS750\n1057:\t\t    SC16IS752\n1058:\t\t    SC16IS760\n1059:\t\t    SC16IS762\n1060:\t\n1061:\t\t  The driver supports both I2C and SPI interfaces.\n1062:\t\n1063:\tconfig SERIAL_SC16IS7XX_I2C\n1064:\t\ttristate\n1065:\t\tselect REGMAP_I2C\n1066:\t\n1067:\tconfig SERIAL_SC16IS7XX_SPI\n1068:\t\ttristate\n1069:\t\tselect REGMAP_SPI\n1070:\t\n1071:\tconfig SERIAL_TIMBERDALE\n1072:\t\ttristate \"Support for timberdale UART\"\n1073:\t\tselect SERIAL_CORE\n1074:\t\tdepends on X86_32 || COMPILE_TEST\n"
}

gemini-3.8-flash

null

null

							input: 4783
							output: 44
							thoughts: 134
						

**Probing the SC16IS7xx in a Virtualized Environment**

Okay, so the SC16IS7xx – that NXP I2C/SPI UART driver – I need to figure out how to interact with it, specifically within the context of syzkaller and virtual environments like QEMU or GCE. My initial question is can it even be probed or reached through these environments?

Now, hold on. Can I instantiate I2C devices from userspace using `i2c-dev`? I'm thinking, can I potentially use `i2c /dev/i2c-* new_device` or something similar for SPI?

Aha! If `i2c-dev` *can* instantiate devices, does that mean it can instantiate an `sc16is7xx_i2c` device? This could be a game changer.

Right, let's dive into the code. Time to verify this hypothesis; the place to start looking is `drivers/tty/serial/sc16is7xx_i2c.c`. That should tell me whether instantiating this device from user space is a possibility, and how that is done.

{
  "File": "drivers/tty/serial/sc16is7xx_i2c.c",
  "FirstLine": 1,
  "LineCount": 80
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: GPL-2.0+\n   2:\t/* SC16IS7xx I2C interface driver */\n   3:\t\n   4:\t#include \u003clinux/dev_printk.h\u003e\n   5:\t#include \u003clinux/i2c.h\u003e\n   6:\t#include \u003clinux/module.h\u003e\n   7:\t#include \u003clinux/regmap.h\u003e\n   8:\t#include \u003clinux/string.h\u003e\n   9:\t\n  10:\t#include \"sc16is7xx.h\"\n  11:\t\n  12:\tstatic int sc16is7xx_i2c_probe(struct i2c_client *i2c)\n  13:\t{\n  14:\t\tconst struct sc16is7xx_devtype *devtype;\n  15:\t\tstruct regmap *regmaps[SC16IS7XX_MAX_PORTS];\n  16:\t\tstruct regmap_config regcfg;\n  17:\t\tunsigned int i;\n  18:\t\n  19:\t\tdevtype = i2c_get_match_data(i2c);\n  20:\t\tif (!devtype)\n  21:\t\t\treturn dev_err_probe(\u0026i2c-\u003edev, -ENODEV, \"Failed to match device\\n\");\n  22:\t\n  23:\t\tmemcpy(\u0026regcfg, \u0026sc16is7xx_regcfg, sizeof(struct regmap_config));\n  24:\t\n  25:\t\tfor (i = 0; i \u003c devtype-\u003enr_uart; i++) {\n  26:\t\t\tregcfg.name = sc16is7xx_regmap_name(i);\n  27:\t\t\tregcfg.read_flag_mask = sc16is7xx_regmap_port_mask(i);\n  28:\t\t\tregcfg.write_flag_mask = sc16is7xx_regmap_port_mask(i);\n  29:\t\t\tregmaps[i] = devm_regmap_init_i2c(i2c, \u0026regcfg);\n  30:\t\t}\n  31:\t\n  32:\t\treturn sc16is7xx_probe(\u0026i2c-\u003edev, devtype, regmaps, i2c-\u003eirq);\n  33:\t}\n  34:\t\n  35:\tstatic void sc16is7xx_i2c_remove(struct i2c_client *client)\n  36:\t{\n  37:\t\tsc16is7xx_remove(\u0026client-\u003edev);\n  38:\t}\n  39:\t\n  40:\tstatic const struct i2c_device_id sc16is7xx_i2c_id_table[] = {\n  41:\t\t{ .name = \"sc16is74x\", .driver_data = (kernel_ulong_t)\u0026sc16is74x_devtype },\n  42:\t\t{ .name = \"sc16is740\", .driver_data = (kernel_ulong_t)\u0026sc16is74x_devtype },\n  43:\t\t{ .name = \"sc16is741\", .driver_data = (kernel_ulong_t)\u0026sc16is74x_devtype },\n  44:\t\t{ .name = \"sc16is750\", .driver_data = (kernel_ulong_t)\u0026sc16is750_devtype },\n  45:\t\t{ .name = \"sc16is752\", .driver_data = (kernel_ulong_t)\u0026sc16is752_devtype },\n  46:\t\t{ .name = \"sc16is760\", .driver_data = (kernel_ulong_t)\u0026sc16is760_devtype },\n  47:\t\t{ .name = \"sc16is762\", .driver_data = (kernel_ulong_t)\u0026sc16is762_devtype },\n  48:\t\t{ }\n  49:\t};\n  50:\tMODULE_DEVICE_TABLE(i2c, sc16is7xx_i2c_id_table);\n  51:\t\n  52:\tstatic struct i2c_driver sc16is7xx_i2c_driver = {\n  53:\t\t.driver = {\n  54:\t\t\t.name\t\t= KBUILD_MODNAME,\n  55:\t\t\t.of_match_table\t= sc16is7xx_dt_ids,\n  56:\t\t},\n  57:\t\t.probe\t\t= sc16is7xx_i2c_probe,\n  58:\t\t.remove\t\t= sc16is7xx_i2c_remove,\n  59:\t\t.id_table\t= sc16is7xx_i2c_id_table,\n  60:\t};\n  61:\t\n  62:\tmodule_i2c_driver(sc16is7xx_i2c_driver);\n  63:\t\n  64:\tMODULE_LICENSE(\"GPL\");\n  65:\tMODULE_DESCRIPTION(KBUILD_MODNAME \" interface driver\");\n  66:\tMODULE_IMPORT_NS(\"SERIAL_NXP_SC16IS7XX\");\n"
}

gemini-3.8-flash

null

null

							input: 6506
							output: 42
							thoughts: 62
						

Here's my summary, as the thought process unfolds:

**Probing Deeper: Initializing the SC16IS7xx**

Hang on a minute! I need to double-check my assumptions here. My initial thought process is to look at the probe functions to see how the device is initialized. Specifically, I'm going to focus on how the driver handles initialization through `sc16is7xx_i2c_probe` and `sc16is7xx_probe` function calls. It's time to delve deeper and get specific. So, I need to check how the `sc16is7xx_probe` function works. Let's start with the source for the latter function, which should be in `drivers/tty/serial/sc16is7xx.c`. That's where the core initialization logic will likely reside. From this, I should have a better understanding of the driver's initialization and device matching process.

{
  "Expression": "sc16is7xx_probe",
  "PathPrefix": "drivers/tty/serial/sc16is7xx.c"
}

{
  "Output": "drivers/tty/serial/sc16is7xx.c=1482=static int sc16is7xx_setup_channel(struct sc16is7xx_one *one, int i,\n--\ndrivers/tty/serial/sc16is7xx.c-1543-\ndrivers/tty/serial/sc16is7xx.c:1544:int sc16is7xx_probe(struct device *dev, const struct sc16is7xx_devtype *devtype,\ndrivers/tty/serial/sc16is7xx.c-1545-\t\t    struct regmap *regmaps[], int irq)\n--\ndrivers/tty/serial/sc16is7xx.c-1694-}\ndrivers/tty/serial/sc16is7xx.c:1695:EXPORT_SYMBOL_GPL(sc16is7xx_probe);\ndrivers/tty/serial/sc16is7xx.c-1696-\n"
}

gemini-3.8-flash

null

null

							input: 7064
							output: 43
							thoughts: 38
						

Okay, let's dive into this. I'm going to pull up that `sc16is7xx_probe` function, specifically around line 1544 within `drivers/tty/serial/sc16is7xx.c`. I need to refresh my memory on how this driver handles device probing. I'm expecting to see how the kernel detects and initializes a connected SC16IS7xx device. It's crucial for understanding the overall device lifecycle and how it integrates with the serial subsystem. I'm particularly interested in any power-up or reset sequences and error handling. Let's see how the driver handles resource allocation and interaction with the I2C or SPI bus, depending on the device's connection. I'll be looking for any potential race conditions and how they're addressed, since this is a critical part of device stability.

{
  "File": "drivers/tty/serial/sc16is7xx.c",
  "FirstLine": 1544,
  "LineCount": 80
}

{
  "Contents": "1544:\tint sc16is7xx_probe(struct device *dev, const struct sc16is7xx_devtype *devtype,\n1545:\t\t\t    struct regmap *regmaps[], int irq)\n1546:\t{\n1547:\t\tunsigned long freq = 0, *pfreq = dev_get_platdata(dev);\n1548:\t\tunsigned int val;\n1549:\t\tu32 uartclk = 0;\n1550:\t\tint i, ret;\n1551:\t\tstruct sc16is7xx_port *s;\n1552:\t\tbool port_registered[SC16IS7XX_MAX_PORTS];\n1553:\t\n1554:\t\tfor (i = 0; i \u003c devtype-\u003enr_uart; i++)\n1555:\t\t\tif (IS_ERR(regmaps[i]))\n1556:\t\t\t\treturn PTR_ERR(regmaps[i]);\n1557:\t\n1558:\t\t/*\n1559:\t\t * This device does not have an identification register that would\n1560:\t\t * tell us if we are really connected to the correct device.\n1561:\t\t * The best we can do is to check if communication is at all possible.\n1562:\t\t *\n1563:\t\t * Note: regmap[0] is used in the probe function to access registers\n1564:\t\t * common to all channels/ports, as it is guaranteed to be present on\n1565:\t\t * all variants.\n1566:\t\t */\n1567:\t\tret = regmap_read(regmaps[0], SC16IS7XX_LSR_REG, \u0026val);\n1568:\t\tif (ret \u003c 0)\n1569:\t\t\treturn -EPROBE_DEFER;\n1570:\t\n1571:\t\t/* Alloc port structure */\n1572:\t\ts = devm_kzalloc(dev, struct_size(s, p, devtype-\u003enr_uart), GFP_KERNEL);\n1573:\t\tif (!s)\n1574:\t\t\treturn -ENOMEM;\n1575:\t\n1576:\t\t/* Always ask for fixed clock rate from a property. */\n1577:\t\tdevice_property_read_u32(dev, \"clock-frequency\", \u0026uartclk);\n1578:\t\n1579:\t\ts-\u003epolling = (irq \u003c= 0);\n1580:\t\tif (s-\u003epolling)\n1581:\t\t\tdev_dbg(dev,\n1582:\t\t\t\t\"No interrupt pin definition, falling back to polling mode\\n\");\n1583:\t\n1584:\t\ts-\u003eclk = devm_clk_get_optional(dev, NULL);\n1585:\t\tif (IS_ERR(s-\u003eclk))\n1586:\t\t\treturn PTR_ERR(s-\u003eclk);\n1587:\t\n1588:\t\tret = clk_prepare_enable(s-\u003eclk);\n1589:\t\tif (ret)\n1590:\t\t\treturn ret;\n1591:\t\n1592:\t\tfreq = clk_get_rate(s-\u003eclk);\n1593:\t\tif (freq == 0) {\n1594:\t\t\tif (uartclk)\n1595:\t\t\t\tfreq = uartclk;\n1596:\t\t\tif (pfreq)\n1597:\t\t\t\tfreq = *pfreq;\n1598:\t\t\tif (freq)\n1599:\t\t\t\tdev_dbg(dev, \"Clock frequency: %luHz\\n\", freq);\n1600:\t\t\telse\n1601:\t\t\t\treturn -EINVAL;\n1602:\t\t}\n1603:\t\n1604:\t\ts-\u003edevtype = devtype;\n1605:\t\tdev_set_drvdata(dev, s);\n1606:\t\n1607:\t\tkthread_init_worker(\u0026s-\u003ekworker);\n1608:\t\ts-\u003ekworker_task = kthread_run(kthread_worker_fn, \u0026s-\u003ekworker,\n1609:\t\t\t\t\t      \"sc16is7xx\");\n1610:\t\tif (IS_ERR(s-\u003ekworker_task)) {\n1611:\t\t\tret = PTR_ERR(s-\u003ekworker_task);\n1612:\t\t\tgoto out_clk;\n1613:\t\t}\n1614:\t\tsched_set_fifo(s-\u003ekworker_task);\n1615:\t\n1616:\t\tret = sc16is7xx_reset(dev, regmaps[0]);\n1617:\t\tif (ret)\n1618:\t\t\tgoto out_kthread;\n1619:\t\n1620:\t\t/* Mark each port line and status as uninitialised. */\n1621:\t\tfor (i = 0; i \u003c devtype-\u003enr_uart; ++i) {\n1622:\t\t\ts-\u003ep[i].port.line = SC16IS7XX_MAX_DEVS;\n1623:\t\t\tport_registered[i] = false;\n"
}

gemini-3.8-flash

null

null

							input: 8616
							output: 20
							thoughts: 765
						

**Analyzing the Probing Feasibility of the SC16IS7xx UART**

Okay, let's break this down. Line 1567 is calling `regmap_read` on the SC16IS7XX_LSR_REG, and if that fails, we get `-EPROBE_DEFER`. Then, on line 1592, the clock frequency is checked and if it's zero, we get `-EINVAL`. This immediately screams "probing issues". The core of the problem here seems to be dependent on either a real or emulated I2C read.

My first thought is, can this hardware be realistically probed or emulated in a standard QEMU or GCE environment? I know QEMU doesn't directly emulate the SC16IS7xx chip itself. So, can we instantiate it through I2C via `/dev/new_device`? If we *could* instantiate an I2C device on an I2C bus in QEMU (or even a dummy bus), we're still left with this I2C read issue: `regmap_read(regmaps[0], SC16IS7XX_LSR_REG, &val)`. If there's no physical or emulated chip *acknowledging* the I2C address, the I2C transfer is going to fail with something like -ENXIO, -EIO, or -ETIMEDOUT, effectively triggering that `-EPROBE_DEFER` error on line 1568. And, of course, without proper device tree or platform data, line 1601 will return `-EINVAL`.

So, the real question is, is there any way to get the I2C read to succeed? I need to check syzkaller. I'll look into syzkaller's syzlang descriptions or the git repo to see if `sc16is7xx` is even mentioned, or if any I2C UARTs are being fuzzed.

Looking at syz-cluster instructions, the biggest hurdle is REACHABILITY: Fuzzing only discovers bugs in code reachable in standard virtualized environments. I'm thinking about those "structurally unreachable" hardware examples, like vendor-specific PCIe stuff. That's a red flag. I2C devices *might* be better. I need to figure out if there are mock or virtual I2C or SPI buses available, or perhaps even a USB-to-I2C bridge or similar construct in the kernel. Maybe I can find a way to fake the device. I need to search the kernel for `sc16is7xx`.

{
  "Expression": "sc16is7xx"
}

{
  "Output": "\nFull output is too long, showing 500 out of 921 lines.\nUse more precise expression if possible.\n\nDocumentation/devicetree/bindings/serial/nxp,sc16is7xx.yaml-3----\nDocumentation/devicetree/bindings/serial/nxp,sc16is7xx.yaml:4:$id: http://devicetree.org/schemas/serial/nxp,sc16is7xx.yaml#\nDocumentation/devicetree/bindings/serial/nxp,sc16is7xx.yaml-5-$schema: http://devicetree.org/meta-schemas/core.yaml#\n--\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts=17=\tsys_mclk: clock-mclk {\n--\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts-22-\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts:23:\tsc16is7xx_clk: clock-sc16is7xx {\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts-24-\t\tcompatible = \"fixed-clock\";\n--\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts=71=\tserial@0 {\n--\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts-74-\t\tspi-max-frequency = \u003c4000000\u003e;\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts:75:\t\tclocks = \u003c\u0026sc16is7xx_clk\u003e;\narch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dts-76-\t\tinterrupt-parent = \u003c\u0026gpio1\u003e;\n--\ndrivers/tty/serial/Makefile=76=obj-$(CONFIG_SERIAL_SCCNXP)\t\t+= sccnxp.o\ndrivers/tty/serial/Makefile:77:obj-$(CONFIG_SERIAL_SC16IS7XX)\t\t+= sc16is7xx.o\ndrivers/tty/serial/Makefile:78:obj-$(CONFIG_SERIAL_SC16IS7XX_SPI)\t+= sc16is7xx_spi.o\ndrivers/tty/serial/Makefile:79:obj-$(CONFIG_SERIAL_SC16IS7XX_I2C)\t+= sc16is7xx_i2c.o\ndrivers/tty/serial/Makefile-80-obj-$(CONFIG_SERIAL_SH_SCI)\t\t+= sh-sci.o\n--\ndrivers/tty/serial/sc16is7xx.c-34-\ndrivers/tty/serial/sc16is7xx.c:35:#include \"sc16is7xx.h\"\ndrivers/tty/serial/sc16is7xx.c-36-\n--\ndrivers/tty/serial/sc16is7xx.c-280-\ndrivers/tty/serial/sc16is7xx.c:281:struct sc16is7xx_one_config {\ndrivers/tty/serial/sc16is7xx.c-282-\tunsigned int\t\t\tflags;\n--\ndrivers/tty/serial/sc16is7xx.c-286-\ndrivers/tty/serial/sc16is7xx.c:287:struct sc16is7xx_one {\ndrivers/tty/serial/sc16is7xx.c-288-\tstruct uart_port\t\tport;\n--\ndrivers/tty/serial/sc16is7xx.c-293-\tstruct kthread_delayed_work\tms_work;\ndrivers/tty/serial/sc16is7xx.c:294:\tstruct sc16is7xx_one_config\tconfig;\ndrivers/tty/serial/sc16is7xx.c-295-\tunsigned char\t\t\tbuf[SC16IS7XX_FIFO_SIZE]; /* Rx buffer. */\n--\ndrivers/tty/serial/sc16is7xx.c-300-\ndrivers/tty/serial/sc16is7xx.c:301:struct sc16is7xx_port {\ndrivers/tty/serial/sc16is7xx.c:302:\tconst struct sc16is7xx_devtype\t*devtype;\ndrivers/tty/serial/sc16is7xx.c-303-\tstruct clk\t\t\t*clk;\n--\ndrivers/tty/serial/sc16is7xx.c-312-\tbool\t\t\t\tpolling;\ndrivers/tty/serial/sc16is7xx.c:313:\tstruct sc16is7xx_one\t\tp[];\ndrivers/tty/serial/sc16is7xx.c-314-};\ndrivers/tty/serial/sc16is7xx.c-315-\ndrivers/tty/serial/sc16is7xx.c:316:static DEFINE_IDA(sc16is7xx_lines);\ndrivers/tty/serial/sc16is7xx.c-317-\ndrivers/tty/serial/sc16is7xx.c:318:static struct uart_driver sc16is7xx_uart = {\ndrivers/tty/serial/sc16is7xx.c-319-\t.owner\t\t= THIS_MODULE,\n--\ndrivers/tty/serial/sc16is7xx.c-324-\ndrivers/tty/serial/sc16is7xx.c:325:#define to_sc16is7xx_one(p)\tcontainer_of((p), struct sc16is7xx_one, port)\ndrivers/tty/serial/sc16is7xx.c-326-\ndrivers/tty/serial/sc16is7xx.c:327:static u8 sc16is7xx_port_read(struct uart_port *port, u8 reg)\ndrivers/tty/serial/sc16is7xx.c-328-{\ndrivers/tty/serial/sc16is7xx.c:329:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-330-\tunsigned int val = 0;\n--\ndrivers/tty/serial/sc16is7xx.c-336-\ndrivers/tty/serial/sc16is7xx.c:337:static void sc16is7xx_port_write(struct uart_port *port, u8 reg, u8 val)\ndrivers/tty/serial/sc16is7xx.c-338-{\ndrivers/tty/serial/sc16is7xx.c:339:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-340-\n--\ndrivers/tty/serial/sc16is7xx.c-343-\ndrivers/tty/serial/sc16is7xx.c:344:static void sc16is7xx_fifo_read(struct uart_port *port, u8 *rxbuf, unsigned int rxlen)\ndrivers/tty/serial/sc16is7xx.c-345-{\ndrivers/tty/serial/sc16is7xx.c:346:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-347-\n--\ndrivers/tty/serial/sc16is7xx.c-350-\ndrivers/tty/serial/sc16is7xx.c:351:static void sc16is7xx_fifo_write(struct uart_port *port, u8 *txbuf, u8 to_send)\ndrivers/tty/serial/sc16is7xx.c-352-{\ndrivers/tty/serial/sc16is7xx.c:353:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-354-\n--\ndrivers/tty/serial/sc16is7xx.c-364-\ndrivers/tty/serial/sc16is7xx.c:365:static void sc16is7xx_port_update(struct uart_port *port, u8 reg,\ndrivers/tty/serial/sc16is7xx.c-366-\t\t\t\t  u8 mask, u8 val)\ndrivers/tty/serial/sc16is7xx.c-367-{\ndrivers/tty/serial/sc16is7xx.c:368:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-369-\n--\ndrivers/tty/serial/sc16is7xx.c-372-\ndrivers/tty/serial/sc16is7xx.c:373:static void sc16is7xx_power(struct uart_port *port, int on)\ndrivers/tty/serial/sc16is7xx.c-374-{\ndrivers/tty/serial/sc16is7xx.c:375:\tsc16is7xx_port_update(port, SC16IS7XX_IER_REG,\ndrivers/tty/serial/sc16is7xx.c-376-\t\t\t      SC16IS7XX_IER_SLEEP_BIT,\n--\ndrivers/tty/serial/sc16is7xx.c-397- */\ndrivers/tty/serial/sc16is7xx.c:398:static void sc16is7xx_regs_lock(struct uart_port *port, u8 register_set)\ndrivers/tty/serial/sc16is7xx.c-399-{\ndrivers/tty/serial/sc16is7xx.c:400:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-401-\n--\ndrivers/tty/serial/sc16is7xx.c-404-\t/* Backup content of LCR. */\ndrivers/tty/serial/sc16is7xx.c:405:\tone-\u003eold_lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);\ndrivers/tty/serial/sc16is7xx.c-406-\ndrivers/tty/serial/sc16is7xx.c-407-\t/* Enable access to the desired register set */\ndrivers/tty/serial/sc16is7xx.c:408:\tsc16is7xx_port_write(port, SC16IS7XX_LCR_REG, register_set);\ndrivers/tty/serial/sc16is7xx.c-409-\n--\ndrivers/tty/serial/sc16is7xx.c-413-\ndrivers/tty/serial/sc16is7xx.c:414:static void sc16is7xx_regs_unlock(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-415-{\ndrivers/tty/serial/sc16is7xx.c:416:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-417-\n--\ndrivers/tty/serial/sc16is7xx.c-421-\t/* Restore original content of LCR */\ndrivers/tty/serial/sc16is7xx.c:422:\tsc16is7xx_port_write(port, SC16IS7XX_LCR_REG, one-\u003eold_lcr);\ndrivers/tty/serial/sc16is7xx.c-423-\n--\ndrivers/tty/serial/sc16is7xx.c-426-\ndrivers/tty/serial/sc16is7xx.c:427:static void sc16is7xx_ier_clear(struct uart_port *port, u8 bit)\ndrivers/tty/serial/sc16is7xx.c-428-{\ndrivers/tty/serial/sc16is7xx.c:429:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c:430:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-431-\n--\ndrivers/tty/serial/sc16is7xx.c-439-\ndrivers/tty/serial/sc16is7xx.c:440:static void sc16is7xx_ier_set(struct uart_port *port, u8 bit)\ndrivers/tty/serial/sc16is7xx.c-441-{\ndrivers/tty/serial/sc16is7xx.c:442:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c:443:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-444-\n--\ndrivers/tty/serial/sc16is7xx.c-452-\ndrivers/tty/serial/sc16is7xx.c:453:static void sc16is7xx_stop_tx(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-454-{\ndrivers/tty/serial/sc16is7xx.c:455:\tsc16is7xx_ier_clear(port, SC16IS7XX_IER_THRI_BIT);\ndrivers/tty/serial/sc16is7xx.c-456-}\ndrivers/tty/serial/sc16is7xx.c-457-\ndrivers/tty/serial/sc16is7xx.c:458:static void sc16is7xx_stop_rx(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-459-{\ndrivers/tty/serial/sc16is7xx.c:460:\tsc16is7xx_ier_clear(port, SC16IS7XX_IER_RDI_BIT);\ndrivers/tty/serial/sc16is7xx.c-461-}\ndrivers/tty/serial/sc16is7xx.c-462-\ndrivers/tty/serial/sc16is7xx.c:463:const struct sc16is7xx_devtype sc16is74x_devtype = {\ndrivers/tty/serial/sc16is7xx.c-464-\t.name\t\t= \"SC16IS74X\",\n--\ndrivers/tty/serial/sc16is7xx.c=468=EXPORT_SYMBOL_GPL(sc16is74x_devtype);\ndrivers/tty/serial/sc16is7xx.c-469-\ndrivers/tty/serial/sc16is7xx.c:470:const struct sc16is7xx_devtype sc16is750_devtype = {\ndrivers/tty/serial/sc16is7xx.c-471-\t.name\t\t= \"SC16IS750\",\n--\ndrivers/tty/serial/sc16is7xx.c=475=EXPORT_SYMBOL_GPL(sc16is750_devtype);\ndrivers/tty/serial/sc16is7xx.c-476-\ndrivers/tty/serial/sc16is7xx.c:477:const struct sc16is7xx_devtype sc16is752_devtype = {\ndrivers/tty/serial/sc16is7xx.c-478-\t.name\t\t= \"SC16IS752\",\n--\ndrivers/tty/serial/sc16is7xx.c=482=EXPORT_SYMBOL_GPL(sc16is752_devtype);\ndrivers/tty/serial/sc16is7xx.c-483-\ndrivers/tty/serial/sc16is7xx.c:484:const struct sc16is7xx_devtype sc16is760_devtype = {\ndrivers/tty/serial/sc16is7xx.c-485-\t.name\t\t= \"SC16IS760\",\n--\ndrivers/tty/serial/sc16is7xx.c=489=EXPORT_SYMBOL_GPL(sc16is760_devtype);\ndrivers/tty/serial/sc16is7xx.c-490-\ndrivers/tty/serial/sc16is7xx.c:491:const struct sc16is7xx_devtype sc16is762_devtype = {\ndrivers/tty/serial/sc16is7xx.c-492-\t.name\t\t= \"SC16IS762\",\n--\ndrivers/tty/serial/sc16is7xx.c=496=EXPORT_SYMBOL_GPL(sc16is762_devtype);\ndrivers/tty/serial/sc16is7xx.c-497-\ndrivers/tty/serial/sc16is7xx.c:498:static bool sc16is7xx_regmap_volatile(struct device *dev, unsigned int reg)\ndrivers/tty/serial/sc16is7xx.c-499-{\n--\ndrivers/tty/serial/sc16is7xx.c-515-\ndrivers/tty/serial/sc16is7xx.c:516:static bool sc16is7xx_regmap_precious(struct device *dev, unsigned int reg)\ndrivers/tty/serial/sc16is7xx.c-517-{\n--\ndrivers/tty/serial/sc16is7xx.c-525-\ndrivers/tty/serial/sc16is7xx.c:526:static bool sc16is7xx_regmap_noinc(struct device *dev, unsigned int reg)\ndrivers/tty/serial/sc16is7xx.c-527-{\n--\ndrivers/tty/serial/sc16is7xx.c-542- */\ndrivers/tty/serial/sc16is7xx.c:543:static int sc16is7xx_set_baud(struct uart_port *port, int baud)\ndrivers/tty/serial/sc16is7xx.c-544-{\n--\ndrivers/tty/serial/sc16is7xx.c-553-\t/* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */\ndrivers/tty/serial/sc16is7xx.c:554:\tsc16is7xx_port_update(port, SC16IS7XX_MCR_REG,\ndrivers/tty/serial/sc16is7xx.c-555-\t\t\t      SC16IS7XX_MCR_CLKSEL_BIT,\n--\ndrivers/tty/serial/sc16is7xx.c-558-\t/* Access special register set (DLL/DLH) */\ndrivers/tty/serial/sc16is7xx.c:559:\tsc16is7xx_regs_lock(port, SC16IS7XX_LCR_REG_SET_SPECIAL);\ndrivers/tty/serial/sc16is7xx.c-560-\ndrivers/tty/serial/sc16is7xx.c-561-\t/* Write the new divisor */\ndrivers/tty/serial/sc16is7xx.c:562:\tsc16is7xx_port_write(port, SC16IS7XX_DLH_REG, div / 256);\ndrivers/tty/serial/sc16is7xx.c:563:\tsc16is7xx_port_write(port, SC16IS7XX_DLL_REG, div % 256);\ndrivers/tty/serial/sc16is7xx.c-564-\ndrivers/tty/serial/sc16is7xx.c-565-\t/* Restore access to general register set */\ndrivers/tty/serial/sc16is7xx.c:566:\tsc16is7xx_regs_unlock(port);\ndrivers/tty/serial/sc16is7xx.c-567-\n--\ndrivers/tty/serial/sc16is7xx.c-570-\ndrivers/tty/serial/sc16is7xx.c:571:static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,\ndrivers/tty/serial/sc16is7xx.c-572-\t\t\t\tunsigned int iir)\ndrivers/tty/serial/sc16is7xx.c-573-{\ndrivers/tty/serial/sc16is7xx.c:574:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-575-\tunsigned int lsr = 0, bytes_read, i;\n--\ndrivers/tty/serial/sc16is7xx.c-590-\t\tif (read_lsr) {\ndrivers/tty/serial/sc16is7xx.c:591:\t\t\tlsr = sc16is7xx_port_read(port, SC16IS7XX_LSR_REG);\ndrivers/tty/serial/sc16is7xx.c-592-\t\t\tif (!(lsr \u0026 SC16IS7XX_LSR_FIFOE_BIT))\n--\ndrivers/tty/serial/sc16is7xx.c-597-\t\tif (read_lsr) {\ndrivers/tty/serial/sc16is7xx.c:598:\t\t\tone-\u003ebuf[0] = sc16is7xx_port_read(port, SC16IS7XX_RHR_REG);\ndrivers/tty/serial/sc16is7xx.c-599-\t\t\tbytes_read = 1;\ndrivers/tty/serial/sc16is7xx.c-600-\t\t} else {\ndrivers/tty/serial/sc16is7xx.c:601:\t\t\tsc16is7xx_fifo_read(port, one-\u003ebuf, rxlen);\ndrivers/tty/serial/sc16is7xx.c-602-\t\t\tbytes_read = rxlen;\n--\ndrivers/tty/serial/sc16is7xx.c-649-\ndrivers/tty/serial/sc16is7xx.c:650:static void sc16is7xx_handle_tx(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-651-{\n--\ndrivers/tty/serial/sc16is7xx.c-656-\tif (unlikely(port-\u003ex_char)) {\ndrivers/tty/serial/sc16is7xx.c:657:\t\tsc16is7xx_port_write(port, SC16IS7XX_THR_REG, port-\u003ex_char);\ndrivers/tty/serial/sc16is7xx.c-658-\t\tport-\u003eicount.tx++;\n--\ndrivers/tty/serial/sc16is7xx.c-664-\t\tuart_port_lock_irqsave(port, \u0026flags);\ndrivers/tty/serial/sc16is7xx.c:665:\t\tsc16is7xx_stop_tx(port);\ndrivers/tty/serial/sc16is7xx.c-666-\t\tuart_port_unlock_irqrestore(port, flags);\n--\ndrivers/tty/serial/sc16is7xx.c-670-\t/* Limit to space available in TX FIFO */\ndrivers/tty/serial/sc16is7xx.c:671:\ttxlen = sc16is7xx_port_read(port, SC16IS7XX_TXLVL_REG);\ndrivers/tty/serial/sc16is7xx.c-672-\tif (txlen \u003e SC16IS7XX_FIFO_SIZE) {\n--\ndrivers/tty/serial/sc16is7xx.c-687-\ndrivers/tty/serial/sc16is7xx.c:688:\t\tsc16is7xx_fifo_write(port, tail, to_send);\ndrivers/tty/serial/sc16is7xx.c-689-\t\tuart_xmit_advance(port, to_send);\n--\ndrivers/tty/serial/sc16is7xx.c-697-\tif (kfifo_is_empty(\u0026tport-\u003exmit_fifo))\ndrivers/tty/serial/sc16is7xx.c:698:\t\tsc16is7xx_stop_tx(port);\ndrivers/tty/serial/sc16is7xx.c-699-\telse\ndrivers/tty/serial/sc16is7xx.c:700:\t\tsc16is7xx_ier_set(port, SC16IS7XX_IER_THRI_BIT);\ndrivers/tty/serial/sc16is7xx.c-701-\tuart_port_unlock_irqrestore(port, flags);\n--\ndrivers/tty/serial/sc16is7xx.c-703-\ndrivers/tty/serial/sc16is7xx.c:704:static unsigned int sc16is7xx_get_hwmctrl(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-705-{\ndrivers/tty/serial/sc16is7xx.c:706:\tu8 msr = sc16is7xx_port_read(port, SC16IS7XX_MSR_REG);\ndrivers/tty/serial/sc16is7xx.c-707-\tunsigned int mctrl = 0;\n--\ndrivers/tty/serial/sc16is7xx.c-715-\ndrivers/tty/serial/sc16is7xx.c:716:static void sc16is7xx_update_mlines(struct sc16is7xx_one *one)\ndrivers/tty/serial/sc16is7xx.c-717-{\n--\ndrivers/tty/serial/sc16is7xx.c-724-\ndrivers/tty/serial/sc16is7xx.c:725:\tstatus = sc16is7xx_get_hwmctrl(port);\ndrivers/tty/serial/sc16is7xx.c-726-\tchanged = status ^ one-\u003eold_mctrl;\n--\ndrivers/tty/serial/sc16is7xx.c-746-\ndrivers/tty/serial/sc16is7xx.c:747:static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)\ndrivers/tty/serial/sc16is7xx.c-748-{\n--\ndrivers/tty/serial/sc16is7xx.c-750-\tstruct uart_port *port = \u0026s-\u003ep[portno].port;\ndrivers/tty/serial/sc16is7xx.c:751:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-752-\n--\ndrivers/tty/serial/sc16is7xx.c-754-\ndrivers/tty/serial/sc16is7xx.c:755:\tiir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG);\ndrivers/tty/serial/sc16is7xx.c-756-\tif (iir \u0026 SC16IS7XX_IIR_NO_INT_BIT)\n--\ndrivers/tty/serial/sc16is7xx.c-765-\tcase SC16IS7XX_IIR_XOFFI_SRC:\ndrivers/tty/serial/sc16is7xx.c:766:\t\trxlen = sc16is7xx_port_read(port, SC16IS7XX_RXLVL_REG);\ndrivers/tty/serial/sc16is7xx.c-767-\n--\ndrivers/tty/serial/sc16is7xx.c-779-\t\tif (rxlen)\ndrivers/tty/serial/sc16is7xx.c:780:\t\t\tsc16is7xx_handle_rx(port, rxlen, iir);\ndrivers/tty/serial/sc16is7xx.c-781-\t\tbreak;\n--\ndrivers/tty/serial/sc16is7xx.c-784-\tcase SC16IS7XX_IIR_MSI_SRC:\ndrivers/tty/serial/sc16is7xx.c:785:\t\tsc16is7xx_update_mlines(one);\ndrivers/tty/serial/sc16is7xx.c-786-\t\tbreak;\ndrivers/tty/serial/sc16is7xx.c-787-\tcase SC16IS7XX_IIR_THRI_SRC:\ndrivers/tty/serial/sc16is7xx.c:788:\t\tsc16is7xx_handle_tx(port);\ndrivers/tty/serial/sc16is7xx.c-789-\t\tbreak;\n--\ndrivers/tty/serial/sc16is7xx.c-799-\ndrivers/tty/serial/sc16is7xx.c:800:static irqreturn_t sc16is7xx_irq(int irq, void *dev_id)\ndrivers/tty/serial/sc16is7xx.c-801-{\ndrivers/tty/serial/sc16is7xx.c:802:\tstruct sc16is7xx_port *s = dev_id;\ndrivers/tty/serial/sc16is7xx.c-803-\tbool keep_polling;\n--\ndrivers/tty/serial/sc16is7xx.c-810-\t\tfor (i = 0; i \u003c s-\u003edevtype-\u003enr_uart; ++i)\ndrivers/tty/serial/sc16is7xx.c:811:\t\t\tkeep_polling |= sc16is7xx_port_irq(s, i);\ndrivers/tty/serial/sc16is7xx.c-812-\t} while (keep_polling);\n--\ndrivers/tty/serial/sc16is7xx.c-816-\ndrivers/tty/serial/sc16is7xx.c:817:static void sc16is7xx_poll_proc(struct kthread_work *ws)\ndrivers/tty/serial/sc16is7xx.c-818-{\ndrivers/tty/serial/sc16is7xx.c:819:\tstruct sc16is7xx_port *s = container_of(ws, struct sc16is7xx_port, poll_work.work);\ndrivers/tty/serial/sc16is7xx.c-820-\ndrivers/tty/serial/sc16is7xx.c-821-\t/* Reuse standard IRQ handler. Interrupt ID is unused in this context. */\ndrivers/tty/serial/sc16is7xx.c:822:\tsc16is7xx_irq(0, s);\ndrivers/tty/serial/sc16is7xx.c-823-\n--\ndrivers/tty/serial/sc16is7xx.c-828-\ndrivers/tty/serial/sc16is7xx.c:829:static void sc16is7xx_tx_proc(struct kthread_work *ws)\ndrivers/tty/serial/sc16is7xx.c-830-{\ndrivers/tty/serial/sc16is7xx.c:831:\tstruct sc16is7xx_one *one = container_of(ws, struct sc16is7xx_one, tx_work);\ndrivers/tty/serial/sc16is7xx.c-832-\tstruct uart_port *port = \u0026one-\u003eport;\n--\ndrivers/tty/serial/sc16is7xx.c-838-\tguard(mutex)(\u0026one-\u003elock);\ndrivers/tty/serial/sc16is7xx.c:839:\tsc16is7xx_port_update(port, SC16IS7XX_IER_REG,\ndrivers/tty/serial/sc16is7xx.c-840-\t\t\t      SC16IS7XX_IER_THRI_BIT,\ndrivers/tty/serial/sc16is7xx.c-841-\t\t\t      SC16IS7XX_IER_THRI_BIT);\ndrivers/tty/serial/sc16is7xx.c:842:\tsc16is7xx_handle_tx(port);\ndrivers/tty/serial/sc16is7xx.c-843-}\ndrivers/tty/serial/sc16is7xx.c-844-\ndrivers/tty/serial/sc16is7xx.c:845:static void sc16is7xx_reconf_rs485(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-846-{\n--\ndrivers/tty/serial/sc16is7xx.c-861-\ndrivers/tty/serial/sc16is7xx.c:862:\tsc16is7xx_port_update(port, SC16IS7XX_EFCR_REG, mask, efcr);\ndrivers/tty/serial/sc16is7xx.c-863-}\ndrivers/tty/serial/sc16is7xx.c-864-\ndrivers/tty/serial/sc16is7xx.c:865:static void sc16is7xx_reg_proc(struct kthread_work *ws)\ndrivers/tty/serial/sc16is7xx.c-866-{\ndrivers/tty/serial/sc16is7xx.c:867:\tstruct sc16is7xx_one *one = container_of(ws, struct sc16is7xx_one, reg_work);\ndrivers/tty/serial/sc16is7xx.c:868:\tstruct sc16is7xx_one_config config;\ndrivers/tty/serial/sc16is7xx.c-869-\tunsigned long irqflags;\n--\ndrivers/tty/serial/sc16is7xx.c-887-\t\t\tmcr |= SC16IS7XX_MCR_LOOP_BIT;\ndrivers/tty/serial/sc16is7xx.c:888:\t\tsc16is7xx_port_update(\u0026one-\u003eport, SC16IS7XX_MCR_REG,\ndrivers/tty/serial/sc16is7xx.c-889-\t\t\t\t      SC16IS7XX_MCR_RTS_BIT |\n--\ndrivers/tty/serial/sc16is7xx.c-895-\tif (config.flags \u0026 SC16IS7XX_RECONF_IER)\ndrivers/tty/serial/sc16is7xx.c:896:\t\tsc16is7xx_port_update(\u0026one-\u003eport, SC16IS7XX_IER_REG,\ndrivers/tty/serial/sc16is7xx.c-897-\t\t\t\t      config.ier_mask, config.ier_val);\n--\ndrivers/tty/serial/sc16is7xx.c-899-\tif (config.flags \u0026 SC16IS7XX_RECONF_RS485)\ndrivers/tty/serial/sc16is7xx.c:900:\t\tsc16is7xx_reconf_rs485(\u0026one-\u003eport);\ndrivers/tty/serial/sc16is7xx.c-901-}\ndrivers/tty/serial/sc16is7xx.c-902-\ndrivers/tty/serial/sc16is7xx.c:903:static void sc16is7xx_ms_proc(struct kthread_work *ws)\ndrivers/tty/serial/sc16is7xx.c-904-{\ndrivers/tty/serial/sc16is7xx.c:905:\tstruct sc16is7xx_one *one = container_of(ws, struct sc16is7xx_one, ms_work.work);\ndrivers/tty/serial/sc16is7xx.c:906:\tstruct sc16is7xx_port *s = dev_get_drvdata(one-\u003eport.dev);\ndrivers/tty/serial/sc16is7xx.c-907-\n--\ndrivers/tty/serial/sc16is7xx.c-909-\t\tscoped_guard(mutex, \u0026one-\u003elock)\ndrivers/tty/serial/sc16is7xx.c:910:\t\t\tsc16is7xx_update_mlines(one);\ndrivers/tty/serial/sc16is7xx.c-911-\n--\ndrivers/tty/serial/sc16is7xx.c-915-\ndrivers/tty/serial/sc16is7xx.c:916:static void sc16is7xx_enable_ms(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-917-{\ndrivers/tty/serial/sc16is7xx.c:918:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c:919:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c-920-\n--\ndrivers/tty/serial/sc16is7xx.c-925-\ndrivers/tty/serial/sc16is7xx.c:926:static void sc16is7xx_start_tx(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-927-{\ndrivers/tty/serial/sc16is7xx.c:928:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c:929:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-930-\n--\ndrivers/tty/serial/sc16is7xx.c-933-\ndrivers/tty/serial/sc16is7xx.c:934:static void sc16is7xx_throttle(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-935-{\n--\ndrivers/tty/serial/sc16is7xx.c-943-\tuart_port_lock_irqsave(port, \u0026flags);\ndrivers/tty/serial/sc16is7xx.c:944:\tsc16is7xx_ier_clear(port, SC16IS7XX_IER_RDI_BIT);\ndrivers/tty/serial/sc16is7xx.c-945-\tuart_port_unlock_irqrestore(port, flags);\n--\ndrivers/tty/serial/sc16is7xx.c-947-\ndrivers/tty/serial/sc16is7xx.c:948:static void sc16is7xx_unthrottle(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-949-{\n--\ndrivers/tty/serial/sc16is7xx.c-952-\tuart_port_lock_irqsave(port, \u0026flags);\ndrivers/tty/serial/sc16is7xx.c:953:\tsc16is7xx_ier_set(port, SC16IS7XX_IER_RDI_BIT);\ndrivers/tty/serial/sc16is7xx.c-954-\tuart_port_unlock_irqrestore(port, flags);\n--\ndrivers/tty/serial/sc16is7xx.c-956-\ndrivers/tty/serial/sc16is7xx.c:957:static unsigned int sc16is7xx_tx_empty(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-958-{\n--\ndrivers/tty/serial/sc16is7xx.c-960-\ndrivers/tty/serial/sc16is7xx.c:961:\tlsr = sc16is7xx_port_read(port, SC16IS7XX_LSR_REG);\ndrivers/tty/serial/sc16is7xx.c-962-\n--\ndrivers/tty/serial/sc16is7xx.c-965-\ndrivers/tty/serial/sc16is7xx.c:966:static unsigned int sc16is7xx_get_mctrl(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-967-{\ndrivers/tty/serial/sc16is7xx.c:968:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-969-\n--\ndrivers/tty/serial/sc16is7xx.c-973-\ndrivers/tty/serial/sc16is7xx.c:974:static void sc16is7xx_set_mctrl(struct uart_port *port, unsigned int mctrl)\ndrivers/tty/serial/sc16is7xx.c-975-{\ndrivers/tty/serial/sc16is7xx.c:976:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c:977:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-978-\n--\ndrivers/tty/serial/sc16is7xx.c-982-\ndrivers/tty/serial/sc16is7xx.c:983:static void sc16is7xx_break_ctl(struct uart_port *port, int break_state)\ndrivers/tty/serial/sc16is7xx.c-984-{\ndrivers/tty/serial/sc16is7xx.c:985:\tsc16is7xx_port_update(port, SC16IS7XX_LCR_REG,\ndrivers/tty/serial/sc16is7xx.c-986-\t\t\t      SC16IS7XX_LCR_TXBREAK_BIT,\n--\ndrivers/tty/serial/sc16is7xx.c-989-\ndrivers/tty/serial/sc16is7xx.c:990:static void sc16is7xx_set_termios(struct uart_port *port,\ndrivers/tty/serial/sc16is7xx.c-991-\t\t\t\t  struct ktermios *termios,\n--\ndrivers/tty/serial/sc16is7xx.c-993-{\ndrivers/tty/serial/sc16is7xx.c:994:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-995-\tunsigned int lcr, flow = 0;\n--\ndrivers/tty/serial/sc16is7xx.c-1063-\t/* Update LCR register */\ndrivers/tty/serial/sc16is7xx.c:1064:\tsc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);\ndrivers/tty/serial/sc16is7xx.c-1065-\ndrivers/tty/serial/sc16is7xx.c-1066-\t/* Update EFR registers */\ndrivers/tty/serial/sc16is7xx.c:1067:\tsc16is7xx_regs_lock(port, SC16IS7XX_LCR_REG_SET_ENHANCED);\ndrivers/tty/serial/sc16is7xx.c:1068:\tsc16is7xx_port_write(port, SC16IS7XX_XON1_REG, termios-\u003ec_cc[VSTART]);\ndrivers/tty/serial/sc16is7xx.c:1069:\tsc16is7xx_port_write(port, SC16IS7XX_XOFF1_REG, termios-\u003ec_cc[VSTOP]);\ndrivers/tty/serial/sc16is7xx.c:1070:\tsc16is7xx_port_update(port, SC16IS7XX_EFR_REG,\ndrivers/tty/serial/sc16is7xx.c-1071-\t\t\t      SC16IS7XX_EFR_FLOWCTRL_BITS, flow);\ndrivers/tty/serial/sc16is7xx.c:1072:\tsc16is7xx_regs_unlock(port);\ndrivers/tty/serial/sc16is7xx.c-1073-\n--\ndrivers/tty/serial/sc16is7xx.c-1079-\t/* Setup baudrate generator */\ndrivers/tty/serial/sc16is7xx.c:1080:\tbaud = sc16is7xx_set_baud(port, baud);\ndrivers/tty/serial/sc16is7xx.c-1081-\n--\ndrivers/tty/serial/sc16is7xx.c-1087-\tif (UART_ENABLE_MS(port, termios-\u003ec_cflag))\ndrivers/tty/serial/sc16is7xx.c:1088:\t\tsc16is7xx_enable_ms(port);\ndrivers/tty/serial/sc16is7xx.c-1089-\n--\ndrivers/tty/serial/sc16is7xx.c-1092-\ndrivers/tty/serial/sc16is7xx.c:1093:static int sc16is7xx_config_rs485(struct uart_port *port, struct ktermios *termios,\ndrivers/tty/serial/sc16is7xx.c-1094-\t\t\t\t  struct serial_rs485 *rs485)\ndrivers/tty/serial/sc16is7xx.c-1095-{\ndrivers/tty/serial/sc16is7xx.c:1096:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c:1097:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-1098-\n--\ndrivers/tty/serial/sc16is7xx.c-1114-\ndrivers/tty/serial/sc16is7xx.c:1115:static int sc16is7xx_startup(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-1116-{\ndrivers/tty/serial/sc16is7xx.c:1117:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c:1118:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c-1119-\tunsigned int val;\n--\ndrivers/tty/serial/sc16is7xx.c-1121-\ndrivers/tty/serial/sc16is7xx.c:1122:\tsc16is7xx_power(port, 1);\ndrivers/tty/serial/sc16is7xx.c-1123-\n--\ndrivers/tty/serial/sc16is7xx.c-1125-\tval = SC16IS7XX_FCR_RXRESET_BIT | SC16IS7XX_FCR_TXRESET_BIT;\ndrivers/tty/serial/sc16is7xx.c:1126:\tsc16is7xx_port_write(port, SC16IS7XX_FCR_REG, val);\ndrivers/tty/serial/sc16is7xx.c-1127-\tudelay(5);\ndrivers/tty/serial/sc16is7xx.c:1128:\tsc16is7xx_port_write(port, SC16IS7XX_FCR_REG,\ndrivers/tty/serial/sc16is7xx.c-1129-\t\t\t     SC16IS7XX_FCR_FIFO_BIT);\n--\ndrivers/tty/serial/sc16is7xx.c-1131-\t/* Enable TCR/TLR */\ndrivers/tty/serial/sc16is7xx.c:1132:\tsc16is7xx_port_update(port, SC16IS7XX_MCR_REG,\ndrivers/tty/serial/sc16is7xx.c-1133-\t\t\t      SC16IS7XX_MCR_TCRTLR_BIT,\n--\ndrivers/tty/serial/sc16is7xx.c-1137-\t/* Flow control halt level 48, resume level 24 */\ndrivers/tty/serial/sc16is7xx.c:1138:\tsc16is7xx_port_write(port, SC16IS7XX_TCR_REG,\ndrivers/tty/serial/sc16is7xx.c-1139-\t\t\t     SC16IS7XX_TCR_RX_RESUME(24) |\n--\ndrivers/tty/serial/sc16is7xx.c-1142-\t/* Disable TCR/TLR access */\ndrivers/tty/serial/sc16is7xx.c:1143:\tsc16is7xx_port_update(port, SC16IS7XX_MCR_REG, SC16IS7XX_MCR_TCRTLR_BIT, 0);\ndrivers/tty/serial/sc16is7xx.c-1144-\ndrivers/tty/serial/sc16is7xx.c-1145-\t/* Now, initialize the UART */\ndrivers/tty/serial/sc16is7xx.c:1146:\tsc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_WORD_LEN_8);\ndrivers/tty/serial/sc16is7xx.c-1147-\n--\ndrivers/tty/serial/sc16is7xx.c-1149-\t/* This bit must be written with LCR[7] = 0 */\ndrivers/tty/serial/sc16is7xx.c:1150:\tsc16is7xx_port_update(port, SC16IS7XX_MCR_REG,\ndrivers/tty/serial/sc16is7xx.c-1151-\t\t\t      SC16IS7XX_MCR_IRDA_BIT,\n--\ndrivers/tty/serial/sc16is7xx.c-1154-\t/* Enable the Rx and Tx FIFO */\ndrivers/tty/serial/sc16is7xx.c:1155:\tsc16is7xx_port_update(port, SC16IS7XX_EFCR_REG,\ndrivers/tty/serial/sc16is7xx.c-1156-\t\t\t      SC16IS7XX_EFCR_RXDISABLE_BIT |\n--\ndrivers/tty/serial/sc16is7xx.c-1162-\t      SC16IS7XX_IER_MSI_BIT;\ndrivers/tty/serial/sc16is7xx.c:1163:\tsc16is7xx_port_write(port, SC16IS7XX_IER_REG, val);\ndrivers/tty/serial/sc16is7xx.c-1164-\n--\ndrivers/tty/serial/sc16is7xx.c-1166-\tuart_port_lock_irqsave(port, \u0026flags);\ndrivers/tty/serial/sc16is7xx.c:1167:\tsc16is7xx_enable_ms(port);\ndrivers/tty/serial/sc16is7xx.c-1168-\tuart_port_unlock_irqrestore(port, flags);\n--\ndrivers/tty/serial/sc16is7xx.c-1176-\ndrivers/tty/serial/sc16is7xx.c:1177:static void sc16is7xx_shutdown(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-1178-{\ndrivers/tty/serial/sc16is7xx.c:1179:\tstruct sc16is7xx_port *s = dev_get_drvdata(port-\u003edev);\ndrivers/tty/serial/sc16is7xx.c:1180:\tstruct sc16is7xx_one *one = to_sc16is7xx_one(port);\ndrivers/tty/serial/sc16is7xx.c-1181-\n--\ndrivers/tty/serial/sc16is7xx.c-1184-\t/* Disable all interrupts */\ndrivers/tty/serial/sc16is7xx.c:1185:\tsc16is7xx_port_write(port, SC16IS7XX_IER_REG, 0);\ndrivers/tty/serial/sc16is7xx.c-1186-\t/* Disable TX/RX */\ndrivers/tty/serial/sc16is7xx.c:1187:\tsc16is7xx_port_update(port, SC16IS7XX_EFCR_REG,\ndrivers/tty/serial/sc16is7xx.c-1188-\t\t\t      SC16IS7XX_EFCR_RXDISABLE_BIT |\n--\n\n"
}

gemini-3.8-flash

null

null

							input: 23740
							output: 34
							thoughts: 485
						

**Fuzzing the SC16IS7xx Serial Driver: A Feasibility Analysis**

Okay, so I'm looking at the `sc16is7xx` serial driver, which interfaces with NXP SC16IS7xx UART chips, typically through I2C or SPI. The key question is whether this thing is even *reachable* within a standard QEMU or GCE environment. Let's see... Section 2 of the instructions explicitly calls out "structurally unreachable hardware," like vendor-specific PCIe devices and the drivers that go with them, which require actual hardware not emulated by standard QEMU. That's a red flag.

So, let's step back and identify what *is* fuzzable, according to Sections 1, 2, and 3. The rule is reachability first and foremost. We can only fuzz code that *executes* in a standard virtual environment using emulated devices like USB gadgets, netdev, or tun/tap. Devices accessible via virtual buses are fair game: virtio, USB gadget, loopback, netlink, binder, sockets, etc.

Can we reach the SC16IS7XX through a USB gadget connection? I need to think about that. Wait! It’s I2C or SPI. Hmm... is there a virtual I2C or SPI bus or a mock device that we could use?

I have to explore what Syzkaller, which is the fuzzer of choice here, does with I2C or SPI. Does it support those? Let's see... Does Syzkaller have any I2C pseudo-syscalls or configurations? Wait, I remember now... Syzkaller *does* fuzz `/dev/i2c-*` ioctls like `I2C_SLAVE` and `I2C_RDWR`. That's encouraging! Can interacting with `/dev/i2c-*` actually instantiate an I2C client device? I need to check the `i2c-dev.c` driver in the kernel to find out!

{
  "Expression": "i2c_new_client_device",
  "PathPrefix": "drivers/i2c"
}

{
  "Output": "drivers/i2c/busses/i2c-ccgx-ucsi.c=16=struct i2c_client *i2c_new_ccgx_ucsi(struct i2c_adapter *adapter, int irq,\n--\ndrivers/i2c/busses/i2c-ccgx-ucsi.c-25-\ndrivers/i2c/busses/i2c-ccgx-ucsi.c:26:\treturn i2c_new_client_device(adapter, \u0026info);\ndrivers/i2c/busses/i2c-ccgx-ucsi.c-27-}\n--\ndrivers/i2c/busses/i2c-cht-wc.c=426=static int cht_wc_i2c_adap_i2c_probe(struct platform_device *pdev)\n--\ndrivers/i2c/busses/i2c-cht-wc.c-514-\t\tboard_info-\u003eirq = adap-\u003eclient_irq;\ndrivers/i2c/busses/i2c-cht-wc.c:515:\t\tadap-\u003eclient = i2c_new_client_device(\u0026adap-\u003eadapter, board_info);\ndrivers/i2c/busses/i2c-cht-wc.c-516-\t\tif (IS_ERR(adap-\u003eclient)) {\n--\ndrivers/i2c/busses/i2c-i801.c=1121=static void dmi_check_onboard_device(u8 type, const char *name,\n--\ndrivers/i2c/busses/i2c-i801.c-1136-\t\tstrscpy(info.type, dmi_devices[i].i2c_type, I2C_NAME_SIZE);\ndrivers/i2c/busses/i2c-i801.c:1137:\t\ti2c_new_client_device(adap, \u0026info);\ndrivers/i2c/busses/i2c-i801.c-1138-\t\tbreak;\n--\ndrivers/i2c/busses/i2c-i801.c=1174=static void i801_probe_optional_targets(struct i801_priv *priv)\n--\ndrivers/i2c/busses/i2c-i801.c-1185-\ndrivers/i2c/busses/i2c-i801.c:1186:\t\ti2c_new_client_device(\u0026priv-\u003eadapter, \u0026info);\ndrivers/i2c/busses/i2c-i801.c-1187-\t}\n--\ndrivers/i2c/busses/i2c-ocores.c=580=static int ocores_i2c_probe(struct platform_device *pdev)\n--\ndrivers/i2c/busses/i2c-ocores.c-713-\t\tfor (i = 0; i \u003c pdata-\u003enum_devices; i++)\ndrivers/i2c/busses/i2c-ocores.c:714:\t\t\ti2c_new_client_device(\u0026i2c-\u003eadap, pdata-\u003edevices + i);\ndrivers/i2c/busses/i2c-ocores.c-715-\t}\n--\ndrivers/i2c/busses/i2c-powermac.c=227=static void i2c_powermac_create_one(struct i2c_adapter *adap,\n--\ndrivers/i2c/busses/i2c-powermac.c-235-\tinfo.addr = addr;\ndrivers/i2c/busses/i2c-powermac.c:236:\tnewdev = i2c_new_client_device(adap, \u0026info);\ndrivers/i2c/busses/i2c-powermac.c-237-\tif (IS_ERR(newdev))\n--\ndrivers/i2c/busses/i2c-powermac.c=306=static void i2c_powermac_register_devices(struct i2c_adapter *adap,\n--\ndrivers/i2c/busses/i2c-powermac.c-353-\ndrivers/i2c/busses/i2c-powermac.c:354:\t\tnewdev = i2c_new_client_device(adap, \u0026info);\ndrivers/i2c/busses/i2c-powermac.c-355-\t\tif (IS_ERR(newdev)) {\n--\ndrivers/i2c/busses/i2c-taos-evm.c=47=static struct i2c_client *taos_instantiate_device(struct i2c_adapter *adapter)\n--\ndrivers/i2c/busses/i2c-taos-evm.c-51-\t\t\ttsl2550_info.type, tsl2550_info.addr);\ndrivers/i2c/busses/i2c-taos-evm.c:52:\t\treturn i2c_new_client_device(adapter, \u0026tsl2550_info);\ndrivers/i2c/busses/i2c-taos-evm.c-53-\t}\n--\ndrivers/i2c/busses/i2c-xiic.c=1421=static int xiic_i2c_probe(struct platform_device *pdev)\n--\ndrivers/i2c/busses/i2c-xiic.c-1521-\t\tfor (i = 0; i \u003c pdata-\u003enum_devices; i++)\ndrivers/i2c/busses/i2c-xiic.c:1522:\t\t\ti2c_new_client_device(\u0026i2c-\u003eadap, pdata-\u003edevices + i);\ndrivers/i2c/busses/i2c-xiic.c-1523-\t}\n--\ndrivers/i2c/i2c-core-acpi.c=278=static void i2c_acpi_register_device(struct i2c_adapter *adapter,\n--\ndrivers/i2c/i2c-core-acpi.c-291-\ndrivers/i2c/i2c-core-acpi.c:292:\tif (IS_ERR(i2c_new_client_device(adapter, info)))\ndrivers/i2c/i2c-core-acpi.c-293-\t\tadev-\u003epower.flags.ignore_parent = false;\n--\ndrivers/i2c/i2c-core-acpi.c=522=struct notifier_block i2c_acpi_notifier = {\n--\ndrivers/i2c/i2c-core-acpi.c-537- *\ndrivers/i2c/i2c-core-acpi.c:538: * Also see i2c_new_client_device, which this function calls to create the\ndrivers/i2c/i2c-core-acpi.c-539- * i2c-client.\n--\ndrivers/i2c/i2c-core-acpi.c=544=struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,\n--\ndrivers/i2c/i2c-core-acpi.c-576-\ndrivers/i2c/i2c-core-acpi.c:577:\treturn i2c_new_client_device(adapter, info);\ndrivers/i2c/i2c-core-acpi.c-578-}\n--\ndrivers/i2c/i2c-core-base.c=937=static void i2c_unlock_addr(struct i2c_adapter *adap, unsigned short addr,\n--\ndrivers/i2c/i2c-core-base.c-944-/**\ndrivers/i2c/i2c-core-base.c:945: * i2c_new_client_device - instantiate an i2c device\ndrivers/i2c/i2c-core-base.c-946- * @adap: the adapter managing the device\n--\ndrivers/i2c/i2c-core-base.c=960=struct i2c_client *\ndrivers/i2c/i2c-core-base.c:961:i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *info)\ndrivers/i2c/i2c-core-base.c-962-{\n--\ndrivers/i2c/i2c-core-base.c-1047-}\ndrivers/i2c/i2c-core-base.c:1048:EXPORT_SYMBOL_GPL(i2c_new_client_device);\ndrivers/i2c/i2c-core-base.c-1049-\n--\ndrivers/i2c/i2c-core-base.c=1145=struct i2c_client *i2c_new_dummy_device(struct i2c_adapter *adapter, u16 address)\n--\ndrivers/i2c/i2c-core-base.c-1150-\ndrivers/i2c/i2c-core-base.c:1151:\treturn i2c_new_client_device(adapter, \u0026info);\ndrivers/i2c/i2c-core-base.c-1152-}\n--\ndrivers/i2c/i2c-core-base.c=1265=new_device_store(struct device *dev, struct device_attribute *attr,\n--\ndrivers/i2c/i2c-core-base.c-1307-\ndrivers/i2c/i2c-core-base.c:1308:\tclient = i2c_new_client_device(adap, \u0026info);\ndrivers/i2c/i2c-core-base.c-1309-\tif (IS_ERR(client))\n--\ndrivers/i2c/i2c-core-base.c=1410=static void i2c_scan_static_board_info(struct i2c_adapter *adapter)\n--\ndrivers/i2c/i2c-core-base.c-1416-\t\tif (devinfo-\u003ebusnum == adapter-\u003enr \u0026\u0026\ndrivers/i2c/i2c-core-base.c:1417:\t\t    IS_ERR(i2c_new_client_device(adapter, \u0026devinfo-\u003eboard_info)))\ndrivers/i2c/i2c-core-base.c-1418-\t\t\tdev_err(\u0026adapter-\u003edev,\n--\ndrivers/i2c/i2c-core-base.c=2473=static int i2c_detect_address(struct i2c_client *temp_client,\n--\ndrivers/i2c/i2c-core-base.c-2524-\t\t\tinfo.type, info.addr);\ndrivers/i2c/i2c-core-base.c:2525:\t\tclient = i2c_new_client_device(adapter, \u0026info);\ndrivers/i2c/i2c-core-base.c-2526-\t\tif (!IS_ERR(client))\n--\ndrivers/i2c/i2c-core-base.c=2588=i2c_new_scanned_device(struct i2c_adapter *adap,\n--\ndrivers/i2c/i2c-core-base.c-2624-\tinfo-\u003eaddr = addr_list[i];\ndrivers/i2c/i2c-core-base.c:2625:\treturn i2c_new_client_device(adap, info);\ndrivers/i2c/i2c-core-base.c-2626-}\n--\ndrivers/i2c/i2c-core-of.c=64=static struct i2c_client *of_i2c_register_device(struct i2c_adapter *adap,\n--\ndrivers/i2c/i2c-core-of.c-76-\ndrivers/i2c/i2c-core-of.c:77:\tclient = i2c_new_client_device(adap, \u0026info);\ndrivers/i2c/i2c-core-of.c-78-\tif (IS_ERR(client))\n--\ndrivers/i2c/i2c-core-smbus.c=707=struct i2c_client *i2c_new_smbus_alert_device(struct i2c_adapter *adapter,\n--\ndrivers/i2c/i2c-core-smbus.c-714-\ndrivers/i2c/i2c-core-smbus.c:715:\treturn i2c_new_client_device(adapter, \u0026ara_board_info);\ndrivers/i2c/i2c-core-smbus.c-716-}\n--\ndrivers/i2c/i2c-smbus.c=312=struct i2c_client *i2c_new_slave_host_notify_device(struct i2c_adapter *adapter)\n--\ndrivers/i2c/i2c-smbus.c-327-\ndrivers/i2c/i2c-smbus.c:328:\tclient = i2c_new_client_device(adapter, \u0026host_notify_board_info);\ndrivers/i2c/i2c-smbus.c-329-\tif (IS_ERR(client)) {\n"
}

gemini-3.8-flash

null

null

							input: 28074
							output: 44
							thoughts: 61
						

Here's my summary, as if I were thinking it:

**Diving into `i2c-core-base.c`**

Okay, time to get my hands dirty with this `i2c-core-base.c` file. Specifically, I need to focus in on the `new_device_store` function. I vaguely remember needing to tweak how new devices are handled with the I2C subsystem, but I can't quite recall the specifics, so let me quickly refresh my memory.

Alright, let's zoom in on lines 1265-1320 of that file. I expect to find the core logic for the device addition process there. I want to pay attention to how device registration happens, any sanity checks performed, and the allocation of resources. I'll need to figure out the exact flow, any potential race conditions, error handling strategies, and how the underlying I2C bus interacts with the newly attached device. Specifically I'll be looking for any indications of where and how the device data is created and populated to be used for future operations. Let's see what gems are contained in those lines. This should bring me up to speed, and I can start to make some informed decisions.

{
  "File": "drivers/i2c/i2c-core-base.c",
  "FirstLine": 1265,
  "LineCount": 55
}

{
  "Contents": "1265:\tnew_device_store(struct device *dev, struct device_attribute *attr,\n1266:\t\t\t const char *buf, size_t count)\n1267:\t{\n1268:\t\tstruct i2c_adapter *adap = to_i2c_adapter(dev);\n1269:\t\tstruct i2c_board_info info;\n1270:\t\tstruct i2c_client *client;\n1271:\t\tchar *blank, end;\n1272:\t\tint res;\n1273:\t\n1274:\t\tmemset(\u0026info, 0, sizeof(struct i2c_board_info));\n1275:\t\n1276:\t\tblank = strchr(buf, ' ');\n1277:\t\tif (!blank) {\n1278:\t\t\tdev_err(dev, \"%s: Missing parameters\\n\", \"new_device\");\n1279:\t\t\treturn -EINVAL;\n1280:\t\t}\n1281:\t\tif (blank - buf \u003e I2C_NAME_SIZE - 1) {\n1282:\t\t\tdev_err(dev, \"%s: Invalid device name\\n\", \"new_device\");\n1283:\t\t\treturn -EINVAL;\n1284:\t\t}\n1285:\t\tmemcpy(info.type, buf, blank - buf);\n1286:\t\n1287:\t\t/* Parse remaining parameters, reject extra parameters */\n1288:\t\tres = sscanf(++blank, \"%hi%c\", \u0026info.addr, \u0026end);\n1289:\t\tif (res \u003c 1) {\n1290:\t\t\tdev_err(dev, \"%s: Can't parse I2C address\\n\", \"new_device\");\n1291:\t\t\treturn -EINVAL;\n1292:\t\t}\n1293:\t\tif (res \u003e 1  \u0026\u0026 end != '\\n') {\n1294:\t\t\tdev_err(dev, \"%s: Extra parameters\\n\", \"new_device\");\n1295:\t\t\treturn -EINVAL;\n1296:\t\t}\n1297:\t\n1298:\t\tif ((info.addr \u0026 I2C_ADDR_OFFSET_TEN_BIT) == I2C_ADDR_OFFSET_TEN_BIT) {\n1299:\t\t\tinfo.addr \u0026= ~I2C_ADDR_OFFSET_TEN_BIT;\n1300:\t\t\tinfo.flags |= I2C_CLIENT_TEN;\n1301:\t\t}\n1302:\t\n1303:\t\tif (info.addr \u0026 I2C_ADDR_OFFSET_SLAVE) {\n1304:\t\t\tinfo.addr \u0026= ~I2C_ADDR_OFFSET_SLAVE;\n1305:\t\t\tinfo.flags |= I2C_CLIENT_SLAVE;\n1306:\t\t}\n1307:\t\n1308:\t\tclient = i2c_new_client_device(adap, \u0026info);\n1309:\t\tif (IS_ERR(client))\n1310:\t\t\treturn PTR_ERR(client);\n1311:\t\n1312:\t\t/* Keep track of the added device */\n1313:\t\tmutex_lock(\u0026adap-\u003euserspace_clients_lock);\n1314:\t\tlist_add_tail(\u0026client-\u003edetected, \u0026adap-\u003euserspace_clients);\n1315:\t\tmutex_unlock(\u0026adap-\u003euserspace_clients_lock);\n1316:\t\tdev_info(dev, \"%s: Instantiated device %s at 0x%02hx\\n\", \"new_device\",\n1317:\t\t\t info.type, info.addr);\n1318:\t\n1319:\t\treturn count;\n"
}

gemini-3.8-flash

null

null

							input: 29370
							output: 44
							thoughts: 568
						

**Analyzing the `sc16is7xx` Driver Probe and `handle_tx` Function**

Okay, so someone's trying to instantiate an SC16IS750 via `sysfs` and writing to `/sys/bus/i2c/devices/i2c-X/new_device`. My first thought is: what actually happens during the probe process? Let's dive into the `sc16is7xx_probe` function within `drivers/tty/serial/sc16is7xx.c`.

Right away, the code does a `regmap_read` to check for hardware. If there's no device responding on the I2C bus (leading to an `-ENXIO` or `-EIO` error), `regmap_read` will fail, and the probe immediately returns `-EPROBE_DEFER`. Good, so it should be deferring probe if no hardware responds.

But let's assume `regmap_read` *succeeds*, what next? It then tries to get a clock. When instantiated via `sysfs`, there won't be a `clock-frequency` device property, no platform data `pfreq`, and no clock `s->clk` since it is not a DT or ACPI device. This means the clock frequency will be zero (`freq == 0`), and the probe will return `-EINVAL`. This also makes probe fail.

Therefore, the probe *cannot* succeed when done via `sysfs` since there is no necessary information to create the clock.

Now, even if by some miracle the probe *did* succeed, the original question involves `sc16is7xx_handle_tx`. The critical point here is to understand when this function is actually called. I'm pretty certain that `sc16is7xx_handle_tx` is only called when there is an active UART port open and transmitting. But I need to be sure; can it be called without the device being probed first? No, because it is a static function.

Let me confirm that by checking all call sites of `sc16is7xx_handle_tx` to be absolutely certain of the dependency on a successful probe.

{
  "Expression": "sc16is7xx_handle_tx",
  "PathPrefix": "drivers/tty/serial/sc16is7xx.c"
}

{
  "Output": "drivers/tty/serial/sc16is7xx.c=571=static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,\n--\ndrivers/tty/serial/sc16is7xx.c-649-\ndrivers/tty/serial/sc16is7xx.c:650:static void sc16is7xx_handle_tx(struct uart_port *port)\ndrivers/tty/serial/sc16is7xx.c-651-{\n--\ndrivers/tty/serial/sc16is7xx.c=747=static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)\n--\ndrivers/tty/serial/sc16is7xx.c-787-\tcase SC16IS7XX_IIR_THRI_SRC:\ndrivers/tty/serial/sc16is7xx.c:788:\t\tsc16is7xx_handle_tx(port);\ndrivers/tty/serial/sc16is7xx.c-789-\t\tbreak;\n--\ndrivers/tty/serial/sc16is7xx.c=829=static void sc16is7xx_tx_proc(struct kthread_work *ws)\n--\ndrivers/tty/serial/sc16is7xx.c-841-\t\t\t      SC16IS7XX_IER_THRI_BIT);\ndrivers/tty/serial/sc16is7xx.c:842:\tsc16is7xx_handle_tx(port);\ndrivers/tty/serial/sc16is7xx.c-843-}\n"
}

gemini-3.8-flash

null

null

							input: 30874
							output: 32
							thoughts: 254
						

**Analyzing the Call Paths to `sc16is7xx_handle_tx`**

Okay, so I'm digging into this `sc16is7xx_handle_tx` function. It looks like it's a critical piece of the puzzle for this SC16IS7xx UART driver. Let's see how it gets called. My initial analysis shows two primary call paths.

First, the interrupt handler, `sc16is7xx_port_irq`, that makes sense. Interrupt-driven UARTs, responding to transmit buffer empty and related events, will naturally call a transmit handler.

Second, there's `sc16is7xx_tx_proc`, which is a kernel thread worker, queued by `sc16is7xx_start_tx`. Ah, so `sc16is7xx_start_tx` kicks off a separate thread to handle the actual transmission process. This is a common pattern for managing UARTs asynchronously.

Now, where does `sc16is7xx_start_tx` come from? Right, it's part of the standard `uart_ops` structure, specifically the `sc16is7xx_ops` for this driver. This `uart_ops` struct is registered with the core UART layer using `uart_add_one_port`. And, from what I recall, that registration happens within `sc16is7xx_probe`, so at the driver's initialization stage. Got it. This makes sense.

Now, a slightly unrelated thought. I wonder if this particular SC16IS7xx driver is even compiled into the kernel used in Syzkaller or the x86_64 defconfig that I'm currently working with? It's worth a quick check to see if `CONFIG_SERIAL_SC16IS7XX` is enabled in those configs. I should probably look in the arch/x86/configs/ directory or the kernel configuration files for the specific targets I'm interested in to confirm this.

{
  "Expression": "CONFIG_SERIAL_SC16IS7XX",
  "PathPrefix": "arch/"
}

{
  "Output": "arch/mips/configs/cu1000-neo_defconfig=56=CONFIG_SERIAL_OF_PLATFORM=y\narch/mips/configs/cu1000-neo_defconfig:57:CONFIG_SERIAL_SC16IS7XX=y\narch/mips/configs/cu1000-neo_defconfig:58:# CONFIG_SERIAL_SC16IS7XX_I2C is not set\narch/mips/configs/cu1000-neo_defconfig:59:CONFIG_SERIAL_SC16IS7XX_SPI=y\narch/mips/configs/cu1000-neo_defconfig-60-CONFIG_I2C=y\n--\narch/mips/configs/cu1830-neo_defconfig=59=CONFIG_SERIAL_OF_PLATFORM=y\narch/mips/configs/cu1830-neo_defconfig:60:CONFIG_SERIAL_SC16IS7XX=y\narch/mips/configs/cu1830-neo_defconfig:61:# CONFIG_SERIAL_SC16IS7XX_I2C is not set\narch/mips/configs/cu1830-neo_defconfig:62:CONFIG_SERIAL_SC16IS7XX_SPI=y\narch/mips/configs/cu1830-neo_defconfig-63-CONFIG_I2C=y\n"
}

gemini-3.8-flash

null

null

							input: 31946
							output: 114
							thoughts: 1949
						

**Analysis of Patch Reachability for Fuzzing**

Okay, so this patch seems to be touching the SC16IS7xx driver, specifically the `sc16is7xx_handle_tx` function. My initial thought is to figure out if it's even *reachable* in a typical fuzzing environment. I know syzkaller is running on `amd64`, and the standard virtual environments are GCE or QEMU. But, immediately, alarm bells are going off. This driver is for NXP's SC16IS7xx chip, which uses SPI or I2C. I remember those require dedicated physical hardware, a specific board, or a defined device tree.

I quickly check - is there emulation of SC16IS7xx in QEMU? No. QEMU has other serial controllers, but not this one. Can I use a USB gadget to emulate it? Nope. This isn't a USB device; it's SPI/I2C. Can it be reached through any virtual bus in standard QEMU or GCE? No way.

Now, I re-read the triage guidelines. Reachability is the *primary* gate. The modified code must be *executable* in standard virtualized environments. If it's structurally unreachable, don't fuzz it. This definitely falls under the negative criteria: Structurally unreachable hardware. Specifically, the guideline explicitly mentions vendor-specific devices requiring physical hardware. This SC16IS7xx driver is exactly that: it needs a physical ASIC/PCIe card, not emulated in standard QEMU.

I take a closer look at the patch itself. It's just modifying `drivers/tty/serial/sc16is7xx.c`, and only inside `sc16is7xx_handle_tx`. This function only executes when the SC16IS7xx port is probed and active. Given my previous findings, that's just not going to happen with standard syzkaller.

Therefore, because this driver requires specific, non-emulated hardware, the code modified is structurally unreachable in the standard QEMU/GCE environments used for fuzzing. The patch is not worth fuzzing, and I can be confident in making this determination.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies sc16is7xx_handle_tx() in drivers/tty/serial/sc16is7xx.c, which is a serial driver for external NXP SC16IS7xx UART chips connected over I2C or SPI. This hardware is not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies sc16is7xx_handle_tx() in drivers/tty/serial/sc16is7xx.c, which is a serial driver for external NXP SC16IS7xx UART chips connected over I2C or SPI. This hardware is not emulated in standard QEMU/GCE virtualized environments, making the modified code structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null