AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/08/19 21:21	flow	patch-triage	2m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "KMSANReasoning": "", "NeedsKMSAN": false, "Reasoning": "The patch adds support for the `st,st21nfcd` NFC controller, which uses raw NCI instead of NDLC. The `raw_nci` mode is enabled by checking `device_get_match_data(dev) == ST_NCI_I2C_PROTO_RAW_NCI`. In a virtualized environment like QEMU, this device is not present in the static device tree. While syzkaller can instantiate I2C devices via sysfs (`new_device`) or `syz_i2c_setup`, these methods do not attach an `fwnode` to the device. Consequently, `device_get_match_data()` will always return `NULL`, leaving `raw_nci = 0`. When `raw_nci` is 0, the driver behaves exactly as it did before the patch. The newly added regulator and clock properties are optional and will simply be skipped if not present. Therefore, the new code paths are unreachable in the fuzzing environment.", "WorthFuzzing": false }
1/1	2026/08/19 21:21	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 504e4c1065d7508aee639ff6f607b03dcd7d5bc9\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Aug 19 21:21:48 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml b/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml\nindex 1dcbddbc5a74e..4bdbb36669605 100644\n--- a/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml\n+++ b/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml\n@@ -11,10 +11,14 @@ maintainers:\n \n properties:\n compatible:\n+ description: \|\n+ st,st21nfcb-* and st,st21nfcc-i2c use NDLC on the wire.\n+ st,st21nfcd is ST21NFCD with raw NCI (no NDLC PCB).\n enum:\n - st,st21nfcb-i2c\n - st,st21nfcb-spi\n - st,st21nfcc-i2c\n+ - st,st21nfcd\n \n reset-gpios:\n description: Output GPIO pin used for resetting the controller\n@@ -36,6 +40,15 @@ properties:\n Specifies that the uicc swp signal can be physically connected to the\n controller\n \n+ clocks:\n+ maxItems: 1\n+ description:\n+ External reference clock connected to SYS_CLK.\n+\n+ vdd-io-supply:\n+ description:\n+ Digital I/O supply (VPS_IO).\n+\n required:\n - compatible\n - interrupts\n@@ -49,6 +62,7 @@ if:\n enum:\n - st,st21nfcb-i2c\n - st,st21nfcc-i2c\n+ - st,st21nfcd\n then:\n properties:\n spi-max-frequency: false\n@@ -81,6 +95,27 @@ examples:\n };\n };\n \n+ - \|\n+ #include \u003cdt-bindings/gpio/gpio.h\u003e\n+ #include \u003cdt-bindings/interrupt-controller/irq.h\u003e\n+\n+ i2c {\n+ #address-cells = \u003c1\u003e;\n+ #size-cells = \u003c0\u003e;\n+\n+ nfc@8 {\n+ compatible = \"st,st21nfcd\";\n+ reg = \u003c0x08\u003e;\n+\n+ interrupt-parent = \u003c\u0026gpio5\u003e;\n+ interrupts = \u003c2 IRQ_TYPE_LEVEL_HIGH\u003e;\n+ reset-gpios = \u003c\u0026gpio5 29 GPIO_ACTIVE_HIGH\u003e;\n+\n+ clocks = \u003c\u0026clk\u003e;\n+ vdd-io-supply = \u003c\u0026vdd_io\u003e;\n+ };\n+ };\n+\n - \|\n #include \u003cdt-bindings/gpio/gpio.h\u003e\n #include \u003cdt-bindings/interrupt-controller/irq.h\u003e\ndiff --git a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts\nindex 04cb9230d29fd..c5d51826b6033 100644\n--- a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts\n+++ b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts\n@@ -908,7 +908,23 @@ redriver_ss_in: endpoint {\n \u0026i2c9 {\n \tstatus = \"okay\";\n \n-\t/* ST21NFC NFC @ 28 /\n+\tnfc@8 {\n+\t\tcompatible = \"st,st21nfcd\";\n+\t\treg = \u003c0x08\u003e;\n+\n+\t\tinterrupts-extended = \u003c\u0026tlmm 41 IRQ_TYPE_LEVEL_HIGH\u003e;\n+\t\treset-gpios = \u003c\u0026tlmm 38 GPIO_ACTIVE_HIGH\u003e;\n+\n+\t\tpinctrl-0 = \u003c\u0026nfc_int_default\u003e, \u003c\u0026nfc_reset_default\u003e;\n+\t\tpinctrl-names = \"default\";\n+\n+\t\tclocks = \u003c\u0026rpmhcc RPMH_LN_BB_CLK2\u003e;\n+\t\tvdd-io-supply = \u003c\u0026vreg_l18b\u003e;\n+\n+\t\tese-present;\n+\t\tuicc-present;\n+\t};\n+\n \t/ VL53L3 ToF @ 29 /\n };\n \n@@ -1410,6 +1426,21 @@ hall_sensor_default: hall-sensor-default-state {\n \t\tdrive-strength = \u003c2\u003e;\n \t\tbias-pull-up;\n \t};\n+\n+\tnfc_int_default: nfc-int-default-state {\n+\t\tpins = \"gpio41\";\n+\t\tfunction = \"gpio\";\n+\t\tdrive-strength = \u003c2\u003e;\n+\t\tbias-disable;\n+\t};\n+\n+\tnfc_reset_default: nfc-reset-default-state {\n+\t\tpins = \"gpio38\";\n+\t\tfunction = \"gpio\";\n+\t\tdrive-strength = \u003c2\u003e;\n+\t\tbias-disable;\n+\t\toutput-high;\n+\t};\n };\n \n \u0026uart5 {\ndiff --git a/drivers/nfc/st-nci/core.c b/drivers/nfc/st-nci/core.c\nindex a367136d4330a..2356f16b80706 100644\n--- a/drivers/nfc/st-nci/core.c\n+++ b/drivers/nfc/st-nci/core.c\n@@ -18,8 +18,13 @@\n \n static int st_nci_init(struct nci_dev ndev)\n {\n+\tstruct st_nci_info info = nci_get_drvdata(ndev);\n \tstruct nci_mode_set_cmd cmd;\n \n+\t/ ST21NFCD has no NDLC proprietary SET_NFC_MODE /\n+\tif (info-\u003endlc-\u003eraw_nci)\n+\t\treturn 0;\n+\n \tcmd.cmd_type = ST_NCI_SET_NFC_MODE;\n \tcmd.mode = 1;\n \ndiff --git a/drivers/nfc/st-nci/i2c.c b/drivers/nfc/st-nci/i2c.c\nindex 9ae839a6f5cc0..566689d5aadb4 100644\n--- a/drivers/nfc/st-nci/i2c.c\n+++ b/drivers/nfc/st-nci/i2c.c\n@@ -10,10 +10,13 @@\n #include \u003clinux/i2c.h\u003e\n #include \u003clinux/gpio/consumer.h\u003e\n #include \u003clinux/acpi.h\u003e\n+#include \u003clinux/clk.h\u003e\n #include \u003clinux/interrupt.h\u003e\n #include \u003clinux/delay.h\u003e\n #include \u003clinux/nfc.h\u003e\n #include \u003clinux/of.h\u003e\n+#include \u003clinux/property.h\u003e\n+#include \u003clinux/regulator/consumer.h\u003e\n \n #include \"st-nci.h\"\n \n@@ -22,10 +25,17 @@\n / ndlc header /\n #define ST_NCI_FRAME_HEADROOM 1\n #define ST_NCI_FRAME_TAILROOM 0\n+#define ST_NCI_RAW_FRAME_HEADROOM 0\n \n #define ST_NCI_I2C_MIN_SIZE 4 / PCB(1) + NCI Packet header(3) /\n+#define ST_NCI_NCI_HDR_SIZE 3 / raw NCI: MT/PBF/GID + OID + len /\n #define ST_NCI_I2C_MAX_SIZE 250 / req 4.2.1 /\n \n+enum st_nci_i2c_proto {\n+\tST_NCI_I2C_PROTO_NDLC = 0,\n+\tST_NCI_I2C_PROTO_RAW_NCI,\n+};\n+\n #define ST_NCI_DRIVER_NAME \"st_nci\"\n #define ST_NCI_I2C_DRIVER_NAME \"st_nci_i2c\"\n \n@@ -34,6 +44,7 @@ struct st_nci_i2c_phy {\n \tstruct llt_ndlc ndlc;\n \n \tbool irq_active;\n+\tbool raw_nci;\n \n \tstruct gpio_desc gpiod_reset;\n \n@@ -111,6 +122,42 @@ static int st_nci_i2c_read(struct st_nci_i2c_phy phy,\n \tu8 buf[ST_NCI_I2C_MAX_SIZE];\n \tstruct i2c_client client = phy-\u003ei2c_dev;\n \n+\tif (phy-\u003eraw_nci) {\n+\t\tr = i2c_master_recv(client, buf, ST_NCI_NCI_HDR_SIZE);\n+\t\tif (r \u003c 0) {\n+\t\t\tusleep_range(1000, 4000);\n+\t\t\tr = i2c_master_recv(client, buf, ST_NCI_NCI_HDR_SIZE);\n+\t\t}\n+\t\tif (r != ST_NCI_NCI_HDR_SIZE)\n+\t\t\treturn -EREMOTEIO;\n+\n+\t\tlen = buf[2];\n+\t\tif (len \u003e ST_NCI_I2C_MAX_SIZE) {\n+\t\t\tnfc_err(\u0026client-\u003edev, \"invalid frame len\\n\");\n+\t\t\treturn -EBADMSG;\n+\t\t}\n+\n+\t\tskb = alloc_skb(ST_NCI_NCI_HDR_SIZE + len, GFP_KERNEL);\n+\t\tif (!skb)\n+\t\t\treturn -ENOMEM;\n+\n+\t\tskb_put(skb, ST_NCI_NCI_HDR_SIZE);\n+\t\tmemcpy((skb)-\u003edata, buf, ST_NCI_NCI_HDR_SIZE);\n+\n+\t\tif (!len)\n+\t\t\treturn 0;\n+\n+\t\tr = i2c_master_recv(client, buf, len);\n+\t\tif (r != len) {\n+\t\t\tkfree_skb(skb);\n+\t\t\treturn -EREMOTEIO;\n+\t\t}\n+\n+\t\tskb_put(skb, len);\n+\t\tmemcpy((skb)-\u003edata + ST_NCI_NCI_HDR_SIZE, buf, len);\n+\t\treturn 0;\n+\t}\n+\n \tr = i2c_master_recv(client, buf, ST_NCI_I2C_MIN_SIZE);\n \tif (r \u003c 0) { /* Retry, chip was in standby /\n \t\tusleep_range(1000, 4000);\n@@ -211,6 +258,8 @@ static int st_nci_i2c_probe(struct i2c_client client)\n \t\treturn -ENOMEM;\n \n \tphy-\u003ei2c_dev = client;\n+\tphy-\u003eraw_nci = (uintptr_t)device_get_match_data(dev) ==\n+\t\t\tST_NCI_I2C_PROTO_RAW_NCI;\n \n \ti2c_set_clientdata(client, phy);\n \n@@ -225,19 +274,31 @@ static int st_nci_i2c_probe(struct i2c_client client)\n \t\treturn -ENODEV;\n \t}\n \n+\tr = devm_regulator_get_enable_optional(dev, \"vdd-io\");\n+\tif (r \u0026\u0026 r != -ENODEV)\n+\t\treturn dev_err_probe(dev, r, \"failed to enable vdd-io\\n\");\n+\n+\tr = PTR_ERR_OR_ZERO(devm_clk_get_optional_enabled(dev, NULL));\n+\tif (r)\n+\t\treturn dev_err_probe(dev, r, \"failed to enable clock\\n\");\n+\n \tphy-\u003ese_status.is_ese_present =\n \t\t\t\tdevice_property_read_bool(dev, \"ese-present\");\n \tphy-\u003ese_status.is_uicc_present =\n \t\t\t\tdevice_property_read_bool(dev, \"uicc-present\");\n \n \tr = ndlc_probe(phy, \u0026i2c_phy_ops, \u0026client-\u003edev,\n-\t\t\tST_NCI_FRAME_HEADROOM, ST_NCI_FRAME_TAILROOM,\n+\t\t\tphy-\u003eraw_nci ? ST_NCI_RAW_FRAME_HEADROOM :\n+\t\t\t\t ST_NCI_FRAME_HEADROOM,\n+\t\t\tST_NCI_FRAME_TAILROOM,\n \t\t\t\u0026phy-\u003endlc, \u0026phy-\u003ese_status);\n \tif (r \u003c 0) {\n \t\tnfc_err(\u0026client-\u003edev, \"Unable to register ndlc layer\\n\");\n \t\treturn r;\n \t}\n \n+\tphy-\u003endlc-\u003eraw_nci = phy-\u003eraw_nci;\n+\n \tphy-\u003eirq_active = true;\n \tr = devm_request_threaded_irq(\u0026client-\u003edev, client-\u003eirq, NULL,\n \t\t\t\tst_nci_irq_thread_fn,\n@@ -273,6 +334,8 @@ static const struct of_device_id of_st_nci_i2c_match[] __maybe_unused = {\n \t{ .compatible = \"st,st21nfcb-i2c\", },\n \t{ .compatible = \"st,st21nfcb_i2c\", },\n \t{ .compatible = \"st,st21nfcc-i2c\", },\n+\t{ .compatible = \"st,st21nfcd\",\n+\t .data = (void )ST_NCI_I2C_PROTO_RAW_NCI },\n \t{}\n };\n MODULE_DEVICE_TABLE(of, of_st_nci_i2c_match);\ndiff --git a/drivers/nfc/st-nci/ndlc.c b/drivers/nfc/st-nci/ndlc.c\nindex be4808859cfa9..b3192460c96e3 100644\n--- a/drivers/nfc/st-nci/ndlc.c\n+++ b/drivers/nfc/st-nci/ndlc.c\n@@ -62,8 +62,9 @@ void ndlc_close(struct llt_ndlc ndlc)\n \t/ toggle reset pin /\n \tndlc-\u003eops-\u003eenable(ndlc-\u003ephy_id);\n \n-\tnci_prop_cmd(ndlc-\u003endev, ST_NCI_CORE_PROP,\n-\t\t sizeof(struct nci_mode_set_cmd), (__u8 )\u0026cmd);\n+\tif (!ndlc-\u003eraw_nci)\n+\t\tnci_prop_cmd(ndlc-\u003endev, ST_NCI_CORE_PROP,\n+\t\t\t sizeof(struct nci_mode_set_cmd), (__u8 )\u0026cmd);\n \n \tndlc-\u003epowered = 0;\n \tndlc-\u003eops-\u003edisable(ndlc-\u003ephy_id);\n@@ -72,11 +73,13 @@ EXPORT_SYMBOL(ndlc_close);\n \n int ndlc_send(struct llt_ndlc ndlc, struct sk_buff skb)\n {\n-\t/ add ndlc header /\n-\tu8 pcb = PCB_TYPE_DATAFRAME \| PCB_DATAFRAME_RETRANSMIT_NO \|\n-\t\tPCB_FRAME_CRC_INFO_NOTPRESENT;\n+\tif (!ndlc-\u003eraw_nci) {\n+\t\t/ add ndlc header /\n+\t\tu8 pcb = PCB_TYPE_DATAFRAME \| PCB_DATAFRAME_RETRANSMIT_NO \|\n+\t\t\tPCB_FRAME_CRC_INFO_NOTPRESENT;\n \n-\t(u8 )skb_push(skb, 1) = pcb;\n+\t\t(u8 )skb_push(skb, 1) = pcb;\n+\t}\n \tskb_queue_tail(\u0026ndlc-\u003esend_q, skb);\n \n \tschedule_work(\u0026ndlc-\u003esm_work);\n@@ -103,6 +106,10 @@ static void llt_ndlc_send_queue(struct llt_ndlc ndlc)\n \t\t\tndlc-\u003ehard_fault = r;\n \t\t\tbreak;\n \t\t}\n+\t\tif (ndlc-\u003eraw_nci) {\n+\t\t\tkfree_skb(skb);\n+\t\t\tcontinue;\n+\t\t}\n \t\ttime_sent = jiffies;\n \t\t(unsigned long )skb-\u003ecb = time_sent;\n \n@@ -154,6 +161,10 @@ static void llt_ndlc_rcv_queue(struct llt_ndlc ndlc)\n \t\tpr_debug(\"rcvQlen=%d\\n\", ndlc-\u003ercv_q.qlen);\n \n \twhile ((skb = skb_dequeue(\u0026ndlc-\u003ercv_q)) != NULL) {\n+\t\tif (ndlc-\u003eraw_nci) {\n+\t\t\tnci_recv_frame(ndlc-\u003endev, skb);\n+\t\t\tcontinue;\n+\t\t}\n \t\tpcb = skb-\u003edata[0];\n \t\tskb_pull(skb, 1);\n \t\tif ((pcb \u0026 PCB_TYPE_MASK) == PCB_TYPE_SUPERVISOR) {\ndiff --git a/drivers/nfc/st-nci/ndlc.h b/drivers/nfc/st-nci/ndlc.h\nindex c24ce9b0df52e..5c1f8baf04718 100644\n--- a/drivers/nfc/st-nci/ndlc.h\n+++ b/drivers/nfc/st-nci/ndlc.h\n@@ -39,6 +39,8 @@ struct llt_ndlc {\n \t /\n \tint hard_fault;\n \tint powered;\n+\t/* ST21NFCD: raw NCI on the wire, no NDLC PCB / ACK timers /\n+\tbool raw_nci;\n };\n \n int ndlc_open(struct llt_ndlc ndlc);\ndiff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c\nindex 607ec768eb7b4..44cc102bcde21 100644\n--- a/drivers/nfc/st-nci/se.c\n+++ b/drivers/nfc/st-nci/se.c\n@@ -621,6 +621,9 @@ int st_nci_discover_se(struct nci_dev ndev)\n \tint se_count = 0;\n \tstruct st_nci_info info = nci_get_drvdata(ndev);\n \n+\tif (info-\u003endlc-\u003eraw_nci)\n+\t\treturn 0;\n+\n \tr = st_nci_hci_network_init(ndev);\n \tif (r != 0)\n \t\treturn r;\n" }
2/1	2026/08/19 21:21	agent	patch-evaluator	2m Model: best-expensive Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch adds support for the `st,st21nfcd` NFC controller, which uses raw NCI instead of NDLC. The `raw_nci` mode is enabled by checking `device_get_match_data(dev) == ST_NCI_I2C_PROTO_RAW_NCI`. In a virtualized environment like QEMU, this device is not present in the static device tree. While syzkaller can instantiate I2C devices via sysfs (`new_device`) or `syz_i2c_setup`, these methods do not attach an `fwnode` to the device. Consequently, `device_get_match_data()` will always return `NULL`, leaving `raw_nci = 0`. When `raw_nci` is 0, the driver behaves exactly as it did before the patch. The newly added regulator and clock properties are optional and will simply be skipped if not present. Therefore, the new code paths are unreachable in the fuzzing environment.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 504e4c1065d7508aee639ff6f607b03dcd7d5bc9 Author: syz-cluster <triage@syzkaller.com> Date: Wed Aug 19 21:21:48 2026 +0000 syz-cluster: applied patch under review diff --git a/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml b/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml index 1dcbddbc5a74e..4bdbb36669605 100644 --- a/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml +++ b/Documentation/devicetree/bindings/net/nfc/st,st-nci.yaml @@ -11,10 +11,14 @@ maintainers: properties: compatible: + description: \| + st,st21nfcb-* and st,st21nfcc-i2c use NDLC on the wire. + st,st21nfcd is ST21NFCD with raw NCI (no NDLC PCB). enum: - st,st21nfcb-i2c - st,st21nfcb-spi - st,st21nfcc-i2c + - st,st21nfcd reset-gpios: description: Output GPIO pin used for resetting the controller @@ -36,6 +40,15 @@ properties: Specifies that the uicc swp signal can be physically connected to the controller + clocks: + maxItems: 1 + description: + External reference clock connected to SYS_CLK. + + vdd-io-supply: + description: + Digital I/O supply (VPS_IO). + required: - compatible - interrupts @@ -49,6 +62,7 @@ if: enum: - st,st21nfcb-i2c - st,st21nfcc-i2c + - st,st21nfcd then: properties: spi-max-frequency: false @@ -81,6 +95,27 @@ examples: }; }; + - \| + #include <dt-bindings/gpio/gpio.h> + #include <dt-bindings/interrupt-controller/irq.h> + + i2c { + #address-cells = <1>; + #size-cells = <0>; + + nfc@8 { + compatible = "st,st21nfcd"; + reg = <0x08>; + + interrupt-parent = <&gpio5>; + interrupts = <2 IRQ_TYPE_LEVEL_HIGH>; + reset-gpios = <&gpio5 29 GPIO_ACTIVE_HIGH>; + + clocks = <&clk>; + vdd-io-supply = <&vdd_io>; + }; + }; + - \| #include <dt-bindings/gpio/gpio.h> #include <dt-bindings/interrupt-controller/irq.h> diff --git a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts index 04cb9230d29fd..c5d51826b6033 100644 --- a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts +++ b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts @@ -908,7 +908,23 @@ redriver_ss_in: endpoint { &i2c9 { status = "okay"; - /* ST21NFC NFC @ 28 / + nfc@8 { + compatible = "st,st21nfcd"; + reg = <0x08>; + + interrupts-extended = <&tlmm 41 IRQ_TYPE_LEVEL_HIGH>; + reset-gpios = <&tlmm 38 GPIO_ACTIVE_HIGH>; + + pinctrl-0 = <&nfc_int_default>, <&nfc_reset_default>; + pinctrl-names = "default"; + + clocks = <&rpmhcc RPMH_LN_BB_CLK2>; + vdd-io-supply = <&vreg_l18b>; + + ese-present; + uicc-present; + }; + / VL53L3 ToF @ 29 / }; @@ -1410,6 +1426,21 @@ hall_sensor_default: hall-sensor-default-state { drive-strength = <2>; bias-pull-up; }; + + nfc_int_default: nfc-int-default-state { + pins = "gpio41"; + function = "gpio"; + drive-strength = <2>; + bias-disable; + }; + + nfc_reset_default: nfc-reset-default-state { + pins = "gpio38"; + function = "gpio"; + drive-strength = <2>; + bias-disable; + output-high; + }; }; &uart5 { diff --git a/drivers/nfc/st-nci/core.c b/drivers/nfc/st-nci/core.c index a367136d4330a..2356f16b80706 100644 --- a/drivers/nfc/st-nci/core.c +++ b/drivers/nfc/st-nci/core.c @@ -18,8 +18,13 @@ static int st_nci_init(struct nci_dev ndev) { + struct st_nci_info info = nci_get_drvdata(ndev); struct nci_mode_set_cmd cmd; + / ST21NFCD has no NDLC proprietary SET_NFC_MODE / + if (info->ndlc->raw_nci) + return 0; + cmd.cmd_type = ST_NCI_SET_NFC_MODE; cmd.mode = 1; diff --git a/drivers/nfc/st-nci/i2c.c b/drivers/nfc/st-nci/i2c.c index 9ae839a6f5cc0..566689d5aadb4 100644 --- a/drivers/nfc/st-nci/i2c.c +++ b/drivers/nfc/st-nci/i2c.c @@ -10,10 +10,13 @@ #include <linux/i2c.h> #include <linux/gpio/consumer.h> #include <linux/acpi.h> +#include <linux/clk.h> #include <linux/interrupt.h> #include <linux/delay.h> #include <linux/nfc.h> #include <linux/of.h> +#include <linux/property.h> +#include <linux/regulator/consumer.h> #include "st-nci.h" @@ -22,10 +25,17 @@ / ndlc header / #define ST_NCI_FRAME_HEADROOM 1 #define ST_NCI_FRAME_TAILROOM 0 +#define ST_NCI_RAW_FRAME_HEADROOM 0 #define ST_NCI_I2C_MIN_SIZE 4 / PCB(1) + NCI Packet header(3) / +#define ST_NCI_NCI_HDR_SIZE 3 / raw NCI: MT/PBF/GID + OID + len / #define ST_NCI_I2C_MAX_SIZE 250 / req 4.2.1 / +enum st_nci_i2c_proto { + ST_NCI_I2C_PROTO_NDLC = 0, + ST_NCI_I2C_PROTO_RAW_NCI, +}; + #define ST_NCI_DRIVER_NAME "st_nci" #define ST_NCI_I2C_DRIVER_NAME "st_nci_i2c" @@ -34,6 +44,7 @@ struct st_nci_i2c_phy { struct llt_ndlc ndlc; bool irq_active; + bool raw_nci; struct gpio_desc gpiod_reset; @@ -111,6 +122,42 @@ static int st_nci_i2c_read(struct st_nci_i2c_phy phy, u8 buf[ST_NCI_I2C_MAX_SIZE]; struct i2c_client client = phy->i2c_dev; + if (phy->raw_nci) { + r = i2c_master_recv(client, buf, ST_NCI_NCI_HDR_SIZE); + if (r < 0) { + usleep_range(1000, 4000); + r = i2c_master_recv(client, buf, ST_NCI_NCI_HDR_SIZE); + } + if (r != ST_NCI_NCI_HDR_SIZE) + return -EREMOTEIO; + + len = buf[2]; + if (len > ST_NCI_I2C_MAX_SIZE) { + nfc_err(&client->dev, "invalid frame len\n"); + return -EBADMSG; + } + + skb = alloc_skb(ST_NCI_NCI_HDR_SIZE + len, GFP_KERNEL); + if (!skb) + return -ENOMEM; + + skb_put(skb, ST_NCI_NCI_HDR_SIZE); + memcpy((skb)->data, buf, ST_NCI_NCI_HDR_SIZE); + + if (!len) + return 0; + + r = i2c_master_recv(client, buf, len); + if (r != len) { + kfree_skb(skb); + return -EREMOTEIO; + } + + skb_put(skb, len); + memcpy((skb)->data + ST_NCI_NCI_HDR_SIZE, buf, len); + return 0; + } + r = i2c_master_recv(client, buf, ST_NCI_I2C_MIN_SIZE); if (r < 0) { /* Retry, chip was in standby / usleep_range(1000, 4000); @@ -211,6 +258,8 @@ static int st_nci_i2c_probe(struct i2c_client client) return -ENOMEM; phy->i2c_dev = client; + phy->raw_nci = (uintptr_t)device_get_match_data(dev) == + ST_NCI_I2C_PROTO_RAW_NCI; i2c_set_clientdata(client, phy); @@ -225,19 +274,31 @@ static int st_nci_i2c_probe(struct i2c_client client) return -ENODEV; } + r = devm_regulator_get_enable_optional(dev, "vdd-io"); + if (r && r != -ENODEV) + return dev_err_probe(dev, r, "failed to enable vdd-io\n"); + + r = PTR_ERR_OR_ZERO(devm_clk_get_optional_enabled(dev, NULL)); + if (r) + return dev_err_probe(dev, r, "failed to enable clock\n"); + phy->se_status.is_ese_present = device_property_read_bool(dev, "ese-present"); phy->se_status.is_uicc_present = device_property_read_bool(dev, "uicc-present"); r = ndlc_probe(phy, &i2c_phy_ops, &client->dev, - ST_NCI_FRAME_HEADROOM, ST_NCI_FRAME_TAILROOM, + phy->raw_nci ? ST_NCI_RAW_FRAME_HEADROOM : + ST_NCI_FRAME_HEADROOM, + ST_NCI_FRAME_TAILROOM, &phy->ndlc, &phy->se_status); if (r < 0) { nfc_err(&client->dev, "Unable to register ndlc layer\n"); return r; } + phy->ndlc->raw_nci = phy->raw_nci; + phy->irq_active = true; r = devm_request_threaded_irq(&client->dev, client->irq, NULL, st_nci_irq_thread_fn, @@ -273,6 +334,8 @@ static const struct of_device_id of_st_nci_i2c_match[] __maybe_unused = { { .compatible = "st,st21nfcb-i2c", }, { .compatible = "st,st21nfcb_i2c", }, { .compatible = "st,st21nfcc-i2c", }, + { .compatible = "st,st21nfcd", + .data = (void )ST_NCI_I2C_PROTO_RAW_NCI }, {} }; MODULE_DEVICE_TABLE(of, of_st_nci_i2c_match); diff --git a/drivers/nfc/st-nci/ndlc.c b/drivers/nfc/st-nci/ndlc.c index be4808859cfa9..b3192460c96e3 100644 --- a/drivers/nfc/st-nci/ndlc.c +++ b/drivers/nfc/st-nci/ndlc.c @@ -62,8 +62,9 @@ void ndlc_close(struct llt_ndlc ndlc) / toggle reset pin / ndlc->ops->enable(ndlc->phy_id); - nci_prop_cmd(ndlc->ndev, ST_NCI_CORE_PROP, - sizeof(struct nci_mode_set_cmd), (__u8 )&cmd); + if (!ndlc->raw_nci) + nci_prop_cmd(ndlc->ndev, ST_NCI_CORE_PROP, + sizeof(struct nci_mode_set_cmd), (__u8 )&cmd); ndlc->powered = 0; ndlc->ops->disable(ndlc->phy_id); @@ -72,11 +73,13 @@ EXPORT_SYMBOL(ndlc_close); int ndlc_send(struct llt_ndlc ndlc, struct sk_buff skb) { - / add ndlc header / - u8 pcb = PCB_TYPE_DATAFRAME \| PCB_DATAFRAME_RETRANSMIT_NO \| - PCB_FRAME_CRC_INFO_NOTPRESENT; + if (!ndlc->raw_nci) { + / add ndlc header / + u8 pcb = PCB_TYPE_DATAFRAME \| PCB_DATAFRAME_RETRANSMIT_NO \| + PCB_FRAME_CRC_INFO_NOTPRESENT; - (u8 )skb_push(skb, 1) = pcb; + (u8 )skb_push(skb, 1) = pcb; + } skb_queue_tail(&ndlc->send_q, skb); schedule_work(&ndlc->sm_work); @@ -103,6 +106,10 @@ static void llt_ndlc_send_queue(struct llt_ndlc ndlc) ndlc->hard_fault = r; break; } + if (ndlc->raw_nci) { + kfree_skb(skb); + continue; + } time_sent = jiffies; (unsigned long )skb->cb = time_sent; @@ -154,6 +161,10 @@ static void llt_ndlc_rcv_queue(struct llt_ndlc ndlc) pr_debug("rcvQlen=%d\n", ndlc->rcv_q.qlen); while ((skb = skb_dequeue(&ndlc->rcv_q)) != NULL) { + if (ndlc->raw_nci) { + nci_recv_frame(ndlc->ndev, skb); + continue; + } pcb = skb->data[0]; skb_pull(skb, 1); if ((pcb & PCB_TYPE_MASK) == PCB_TYPE_SUPERVISOR) { diff --git a/drivers/nfc/st-nci/ndlc.h b/drivers/nfc/st-nci/ndlc.h index c24ce9b0df52e..5c1f8baf04718 100644 --- a/drivers/nfc/st-nci/ndlc.h +++ b/drivers/nfc/st-nci/ndlc.h @@ -39,6 +39,8 @@ struct llt_ndlc { / int hard_fault; int powered; + /* ST21NFCD: raw NCI on the wire, no NDLC PCB / ACK timers / + bool raw_nci; }; int ndlc_open(struct llt_ndlc ndlc); diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c index 607ec768eb7b4..44cc102bcde21 100644 --- a/drivers/nfc/st-nci/se.c +++ b/drivers/nfc/st-nci/se.c @@ -621,6 +621,9 @@ int st_nci_discover_se(struct nci_dev ndev) int se_count = 0; struct st_nci_info info = nci_get_drvdata(ndev); + if (info->ndlc->raw_nci) + return 0; + r = st_nci_hci_network_init(ndev); if (r != 0) return r;
3/2	2026/08/19 21:21	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6660 output: 21 thoughts: 594 Thoughts: Analyzing the New NFC Driver Patch Okay, so I've got this patch that introduces support for a new NFC controller, `st,st21nfcd`, within the `st-nci` driver. This controller is a bit different; it uses raw NCI instead of the usual NDLC. My initial impression is that these changes seem straightforward: we're essentially bypassing the NDLC layer and handling the NCI frames directly in several key functions. `st_nci_init` skips the `ST_NCI_SET_NFC_MODE` command under the new flag. `st_nci_i2c_read` seems updated to handle the raw NCI frame format. The probing logic in `st_nci_i2c_probe` now includes reading some properties and setting the `raw_nci` flag which signals the different mode. And then, there are corresponding adjustments to `ndlc_close`, `ndlc_send`, `llt_ndlc_send_queue`, `llt_ndlc_rcv_queue`, and `st_nci_discover_se` to account for this raw NCI mode. Now, I'm thinking about the implications for fuzzing. This is an I2C driver, right? So, how would we go about fuzzing it? I2C drivers can be instantiated through sysfs or the device tree, that part is clear. And, since it's an I2C driver, the big question is, can we reach it in QEMU? Syzkaller should be able to inject I2C traffic, or, depending on the scenario, instantiate the driver, probably via sysfs/netlink if applicable. Okay, I need to brush up on syzkaller's I2C capabilities. I know syzkaller has some basic I2C support, but it's typically more effective if it has a specific pseudo-device, or if the device gets instantiated via `i2c_new_client_device` inside a test module. But I also remember that Syzkaller can fuzz I2C devices with `syz_i2c_setup` or writing to `/dev/i2c-*`. Wait, this driver is an I2C driver, but it registers an NCI device, which is part of the NFC subsystem. Syzkaller definitely has some good coverage of NFC through virtual drivers like `nfcsim` or by instantiating devices. But can syzkaller instantiate I2C devices reliably? That's what I have to check. Let me use `default_api:grepper` to search for descriptions of `st_nci` or `NFC_ST_NCI` within Syzkaller to see what's already known.
4/2	2026/08/19 21:21	tool	grepper	0m Args: { "Expression": "NFC_ST_NCI" } Results: { "Output": "drivers/nfc/Makefile=15=obj-$(CONFIG_NFC_ST21NFCA) \t+= st21nfca/\ndrivers/nfc/Makefile:16:obj-$(CONFIG_NFC_ST_NCI)\t+= st-nci/\ndrivers/nfc/Makefile-17-obj-$(CONFIG_NFC_NXP_NCI)\t+= nxp-nci/\n--\ndrivers/nfc/st-nci/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/nfc/st-nci/Kconfig:2:config NFC_ST_NCI\ndrivers/nfc/st-nci/Kconfig-3-\ttristate\n--\ndrivers/nfc/st-nci/Kconfig-8-\ndrivers/nfc/st-nci/Kconfig:9:config NFC_ST_NCI_I2C\ndrivers/nfc/st-nci/Kconfig-10-\ttristate \"STMicroelectronics ST NCI NFC driver (I2C)\"\ndrivers/nfc/st-nci/Kconfig-11-\tdepends on NFC_NCI \u0026\u0026 I2C\ndrivers/nfc/st-nci/Kconfig:12:\tselect NFC_ST_NCI\ndrivers/nfc/st-nci/Kconfig-13-\thelp\n--\ndrivers/nfc/st-nci/Kconfig-20-\ndrivers/nfc/st-nci/Kconfig:21:config NFC_ST_NCI_SPI\ndrivers/nfc/st-nci/Kconfig-22-\ttristate \"STMicroelectronics ST NCI NFC driver (SPI)\"\ndrivers/nfc/st-nci/Kconfig-23-\tdepends on NFC_NCI \u0026\u0026 SPI\ndrivers/nfc/st-nci/Kconfig:24:\tselect NFC_ST_NCI\ndrivers/nfc/st-nci/Kconfig-25-\thelp\n--\ndrivers/nfc/st-nci/Makefile=6=st-nci-objs = ndlc.o core.o se.o vendor_cmds.o\ndrivers/nfc/st-nci/Makefile:7:obj-$(CONFIG_NFC_ST_NCI) += st-nci.o\ndrivers/nfc/st-nci/Makefile-8-\ndrivers/nfc/st-nci/Makefile=9=st-nci_i2c-objs = i2c.o\ndrivers/nfc/st-nci/Makefile:10:obj-$(CONFIG_NFC_ST_NCI_I2C) += st-nci_i2c.o\ndrivers/nfc/st-nci/Makefile-11-\ndrivers/nfc/st-nci/Makefile=12=st-nci_spi-objs = spi.o\ndrivers/nfc/st-nci/Makefile:13:obj-$(CONFIG_NFC_ST_NCI_SPI) += st-nci_spi.o\n" }
5/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8597 output: 24 thoughts: 159 Thoughts: Investigating the `NFC_ST_NCI_I2C` Driver in a Virtualized Environment Okay, so I'm looking at this `NFC_ST_NCI_I2C` driver. The immediate question is, can I even get to the I2C probe function when I'm running this thing in a virtualized environment? Syzkaller, of course, gives me some options. I can use `syz_i2c_setup` or something similar, assuming I have device descriptions. Alternatively, I could try using `/sys/bus/i2c/devices/i2c-X/new_device` to create the I2C devices directly by name. My gut feeling is that sysfs is the way to go here, so I need to verify that. Let's start by checking if the driver can be instantiated through sysfs. I'm thinking the driver probably has an I2C device table. What's the name of that table? Ah, `st_nci_i2c_id`. Okay, so I should be able to find everything I need in `drivers/nfc/st-nci/i2c.c`. Let's dig in there and see what we can find.
6/2	2026/08/19 21:22	tool	grepper	0m Args: { "Expression": "st_nci_i2c_id" } Results: { "Output": "drivers/nfc/st-nci/i2c.c=313=static void st_nci_i2c_remove(struct i2c_client *client)\n--\ndrivers/nfc/st-nci/i2c.c-319-\ndrivers/nfc/st-nci/i2c.c:320:static const struct i2c_device_id st_nci_i2c_id_table[] = {\ndrivers/nfc/st-nci/i2c.c-321-\t{ .name = ST_NCI_DRIVER_NAME },\n--\ndrivers/nfc/st-nci/i2c.c-323-};\ndrivers/nfc/st-nci/i2c.c:324:MODULE_DEVICE_TABLE(i2c, st_nci_i2c_id_table);\ndrivers/nfc/st-nci/i2c.c-325-\n--\ndrivers/nfc/st-nci/i2c.c=343=static struct i2c_driver st_nci_i2c_driver = {\n--\ndrivers/nfc/st-nci/i2c.c-349-\t.probe = st_nci_i2c_probe,\ndrivers/nfc/st-nci/i2c.c:350:\t.id_table = st_nci_i2c_id_table,\ndrivers/nfc/st-nci/i2c.c-351-\t.remove = st_nci_i2c_remove,\n" }
7/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9455 output: 24 thoughts: 420 Thoughts: Analyzing the I2C Driver Instantiation Logic Okay, so I'm looking at this I2C driver for the ST NFC controller. The code defines an `i2c_device_id` table, and the driver's name is "st_nci". So, theoretically, I should be able to instantiate this driver by writing "st_nci <address>" to the `/sys/bus/i2c/devices/i2c-X/new_device` file, right? That's the standard sysfs way. But, hang on, there's a new compatible string being introduced, "st,st21nfcd", and the `raw_nci` flag is being set based on `device_get_match_data(dev)`. This function is looking at the OF (device tree) or ACPI match tables, depending on the platform. If I instantiate the device through sysfs' `new_device`, it'll use the `i2c_device_id` table, which only has "st_nci". Here's the problem: if I instantiate it using the "st_nci" name via sysfs, `device_get_match_data` will return `NULL` because it's not present in the OF table, right? Or will the OF name somehow get matched? I'm missing something... Ah, right! `i2c_new_client_device` can instantiate devices based on OF nodes. But when done from userspace, via `new_device`, the system is limited to passing the I2C name. So, if I pass "st_nci", it matches the `i2c_device_id` table. Since `device_get_match_data` would return `NULL`, the `raw_nci` flag will be initialized to 0. Wait, the question is, can I instantiate it with the OF compatible string through sysfs? Probably not. The `new_device` function probably only matches against the `i2c_device_id`, the `acpi_device_id`, or the `of_device_id` tables directly. Let's confirm that by digging into the `i2c_sysfs_new_device` function in `drivers/i2c/i2c-core-base.c`. That should give me the final answer.
8/2	2026/08/19 21:22	tool	grepper	0m Args: { "Expression": "i2c_sysfs_new_device" } Results: { "Output": "drivers/i2c/i2c-core-base.c=1320=static DEVICE_ATTR_WO(new_device);\n--\ndrivers/i2c/i2c-core-base.c-1324- * they got it wrong. This interface can only be used to delete devices\ndrivers/i2c/i2c-core-base.c:1325: * instantiated by i2c_sysfs_new_device above. This guarantees that we\ndrivers/i2c/i2c-core-base.c-1326- * don't delete devices to which some kernel code still has references.\n" }
9/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10579 output: 19 thoughts: 29 Thoughts: Here's a first-person summary, tailored for an expert audience, based on your prompt: Diving into the I2C Device Registration Okay, time to dig into the `new_device` function. I need to refresh my memory on how device registration is handled at the I2C core level. Let's start with `drivers/i2c/i2c-core-base.c`. I expect to find the core logic there for creating and linking new I2C device instances. I'm especially interested in how it interacts with the I2C adapter structure and how it handles potential resource conflicts or address collisions. I'm hoping to get a clear picture of the device initialization sequence and any associated error handling. I'll be looking specifically at the interactions with the `i2c_driver` structure and how the device's probe and remove functions are integrated into the registration process. Hopefully, it is straightforward and not an overly complex mess. Let's get cracking.
10/2	2026/08/19 21:22	tool	grepper	0m Args: { "Expression": "new_device_store" } Results: { "Output": "drivers/ata/pata_parport/pata_parport.c=624=EXPORT_SYMBOL_GPL(pata_parport_unregister_driver);\ndrivers/ata/pata_parport/pata_parport.c-625-\ndrivers/ata/pata_parport/pata_parport.c:626:static ssize_t new_device_store(const struct bus_type bus, const char buf, size_t count)\ndrivers/ata/pata_parport/pata_parport.c-627-{\n--\ndrivers/gpio/gpio-aggregator.c=1367=static int gpio_aggregator_parse(struct gpio_aggregator aggr)\n--\ndrivers/gpio/gpio-aggregator.c-1454-\ndrivers/gpio/gpio-aggregator.c:1455:static ssize_t gpio_aggregator_new_device_store(struct device_driver driver,\ndrivers/gpio/gpio-aggregator.c-1456-\t\t\t\t\t\tconst char buf, size_t count)\n--\ndrivers/gpio/gpio-aggregator.c=1527=static struct driver_attribute driver_attr_gpio_aggregator_new_device =\ndrivers/gpio/gpio-aggregator.c:1528:\t__ATTR(new_device, 0200, NULL, gpio_aggregator_new_device_store);\ndrivers/gpio/gpio-aggregator.c-1529-\n--\ndrivers/gpio/gpio-aggregator.c=1695=static int __init gpio_aggregator_init(void)\n--\ndrivers/gpio/gpio-aggregator.c-1712-\t exposed and accessed by users before configfs registration\ndrivers/gpio/gpio-aggregator.c:1713:\t * completes. new_device_store() does not expect a partially\ndrivers/gpio/gpio-aggregator.c-1714-\t * initialized configfs state.\n--\ndrivers/i2c/i2c-core-base.c=1263=static ssize_t\ndrivers/i2c/i2c-core-base.c:1264:new_device_store(struct device dev, struct device_attribute attr,\ndrivers/i2c/i2c-core-base.c-1265-\t\t const char buf, size_t count)\n--\ndrivers/net/netdevsim/bus.c=158=static ssize_t\ndrivers/net/netdevsim/bus.c:159:new_device_store(const struct bus_type bus, const char *buf, size_t count)\ndrivers/net/netdevsim/bus.c-160-{\n" }
11/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11507 output: 44 thoughts: 29 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Diving into the I2C Driver Core Okay, time to crack open `drivers/i2c/i2c-core-base.c` and specifically, I want to take a look at the `new_device_store` function. I'm probably trying to debug something related to device registration or probing, or maybe I'm looking to understand how new I2C devices are handled at a low level. I want to understand exactly how the driver core manages the sysfs entries for the I2C devices we attach. Is it creating and populating the attributes correctly? Are there any race conditions that might be possible with the device creation logic in there? Maybe a problem with attributes not being properly initialized, or not being correctly attached? Understanding this function is going to be key to whatever I'm troubleshooting. Let's see what we've got.
12/2	2026/08/19 21:22	tool	read-file	0m Args: { "File": "drivers/i2c/i2c-core-base.c", "FirstLine": 1263, "LineCount": 50 } Results: { "Contents": "1263:\tstatic ssize_t\n1264:\tnew_device_store(struct device dev, struct device_attribute attr,\n1265:\t\t\t const char buf, size_t count)\n1266:\t{\n1267:\t\tstruct i2c_adapter adap = to_i2c_adapter(dev);\n1268:\t\tstruct i2c_board_info info;\n1269:\t\tstruct i2c_client client;\n1270:\t\tchar blank, end;\n1271:\t\tint res;\n1272:\t\n1273:\t\tmemset(\u0026info, 0, sizeof(struct i2c_board_info));\n1274:\t\n1275:\t\tblank = strchr(buf, ' ');\n1276:\t\tif (!blank) {\n1277:\t\t\tdev_err(dev, \"%s: Missing parameters\\n\", \"new_device\");\n1278:\t\t\treturn -EINVAL;\n1279:\t\t}\n1280:\t\tif (blank - buf \u003e I2C_NAME_SIZE - 1) {\n1281:\t\t\tdev_err(dev, \"%s: Invalid device name\\n\", \"new_device\");\n1282:\t\t\treturn -EINVAL;\n1283:\t\t}\n1284:\t\tmemcpy(info.type, buf, blank - buf);\n1285:\t\n1286:\t\t/* Parse remaining parameters, reject extra parameters /\n1287:\t\tres = sscanf(++blank, \"%hi%c\", \u0026info.addr, \u0026end);\n1288:\t\tif (res \u003c 1) {\n1289:\t\t\tdev_err(dev, \"%s: Can't parse I2C address\\n\", \"new_device\");\n1290:\t\t\treturn -EINVAL;\n1291:\t\t}\n1292:\t\tif (res \u003e 1 \u0026\u0026 end != '\\n') {\n1293:\t\t\tdev_err(dev, \"%s: Extra parameters\\n\", \"new_device\");\n1294:\t\t\treturn -EINVAL;\n1295:\t\t}\n1296:\t\n1297:\t\tif ((info.addr \u0026 I2C_ADDR_OFFSET_TEN_BIT) == I2C_ADDR_OFFSET_TEN_BIT) {\n1298:\t\t\tinfo.addr \u0026= ~I2C_ADDR_OFFSET_TEN_BIT;\n1299:\t\t\tinfo.flags \|= I2C_CLIENT_TEN;\n1300:\t\t}\n1301:\t\n1302:\t\tif (info.addr \u0026 I2C_ADDR_OFFSET_SLAVE) {\n1303:\t\t\tinfo.addr \u0026= ~I2C_ADDR_OFFSET_SLAVE;\n1304:\t\t\tinfo.flags \|= I2C_CLIENT_SLAVE;\n1305:\t\t}\n1306:\t\n1307:\t\tclient = i2c_new_client_device(adap, \u0026info);\n1308:\t\tif (IS_ERR(client))\n1309:\t\t\treturn PTR_ERR(client);\n1310:\t\n1311:\t\t/ Keep track of the added device */\n1312:\t\tmutex_lock(\u0026adap-\u003euserspace_clients_lock);\n" }
13/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 12608 output: 23 thoughts: 97 Thoughts: Analyzing the I2C Client Device Driver Matching Okay, so I'm digging into how `i2c_new_client_device` handles driver matching. My initial thought is that it's relying on `info.type` for this. Specifically, if we provide something like `"st21nfcd"`, there's a good chance it will try to match against the OF table, whether or not the I2C core strips the vendor prefix `"st,"`. Hold on... I'm pretty sure the I2C core actually handles matching against OF compatible strings without the vendor prefix. This makes things a bit more interesting. Alright, let's double-check how that's done. I need to refresh my memory on `i2c_of_match_device` and `i2c_device_match`. I need to review those functions to fully understand the matching process. This will help me be more precise in debugging and ensure we're getting the driver mapping correct.
14/2	2026/08/19 21:22	tool	grepper	0m Args: { "Expression": "i2c_of_match_device" } Results: { "Output": "drivers/i2c/i2c-core-base.c=140=static int i2c_device_match(struct device dev, const struct device_driver drv)\n--\ndrivers/i2c/i2c-core-base.c-146-\t/* Attempt an OF style match /\ndrivers/i2c/i2c-core-base.c:147:\tif (i2c_of_match_device(drv-\u003eof_match_table, client))\ndrivers/i2c/i2c-core-base.c-148-\t\treturn 1;\n--\ndrivers/i2c/i2c-core-base.c=491=static int i2c_device_probe(struct device dev)\n--\ndrivers/i2c/i2c-core-base.c-541-\t !acpi_driver_match_device(dev, dev-\u003edriver) \u0026\u0026\ndrivers/i2c/i2c-core-base.c:542:\t !i2c_of_match_device(dev-\u003edriver-\u003eof_match_table, client)) {\ndrivers/i2c/i2c-core-base.c-543-\t\tstatus = -ENODEV;\n--\ndrivers/i2c/i2c-core-of.c=115=static const struct of_device_id\ndrivers/i2c/i2c-core-of.c:116:i2c_of_match_device_sysfs(const struct of_device_id matches,\ndrivers/i2c/i2c-core-of.c-117-\t\t\t\t struct i2c_client client)\n--\ndrivers/i2c/i2c-core-of.c=144=const struct of_device_id\ndrivers/i2c/i2c-core-of.c:145:i2c_of_match_device(const struct of_device_id matches,\ndrivers/i2c/i2c-core-of.c-146-\t\t struct i2c_client client)\n--\ndrivers/i2c/i2c-core-of.c-156-\ndrivers/i2c/i2c-core-of.c:157:\treturn i2c_of_match_device_sysfs(matches, client);\ndrivers/i2c/i2c-core-of.c-158-}\n--\ndrivers/i2c/i2c-core.h=87=void of_i2c_register_devices(struct i2c_adapter adap);\ndrivers/i2c/i2c-core.h:88:const struct of_device_id i2c_of_match_device(const struct of_device_id matches,\ndrivers/i2c/i2c-core.h-89-\t\t\t\t\t struct i2c_client client);\n--\ndrivers/i2c/i2c-core.h=93=static inline\ndrivers/i2c/i2c-core.h:94:const struct of_device_id i2c_of_match_device(const struct of_device_id matches,\ndrivers/i2c/i2c-core.h-95-\t\t\t\t\t struct i2c_client *client)\n" }
15/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 13762 output: 43 thoughts: 36 Thoughts: Here's my summary, as though I'm reading and thinking about the code: Diving into i2c_of_match_device_sysfs Okay, time to get into `i2c_of_match_device_sysfs` within `drivers/i2c/i2c-core-of.c`. I'm curious to see how this function is handling the crucial task of matching I2C devices against the device tree, and how it's exposing that information through sysfs. I expect it'll be a key component in enabling hotplugging and user-space interaction with devices discovered via the device tree. I'm especially interested in how it handles properties like addresses, bus numbers, and any custom platform data that's needed. Let's see how they've structured this to be robust and efficient, considering the overhead that device tree parsing can sometimes bring. I'll be keeping an eye out for potential areas to refine, especially in terms of error handling and resource management. Let's get reading and see what treasures lie within!
16/2	2026/08/19 21:22	tool	read-file	0m Args: { "File": "drivers/i2c/i2c-core-of.c", "FirstLine": 115, "LineCount": 30 } Results: { "Contents": " 115:\tstatic const struct of_device_id\n 116:\ti2c_of_match_device_sysfs(const struct of_device_id matches,\n 117:\t\t\t\t\t struct i2c_client client)\n 118:\t{\n 119:\t\tconst char name;\n 120:\t\n 121:\t\tfor (; matches-\u003ecompatible[0]; matches++) {\n 122:\t\t\t/\n 123:\t\t\t Adding devices through the i2c sysfs interface provides us\n 124:\t\t\t * a string to match which may be compatible with the device\n 125:\t\t\t * tree compatible strings, however with no actual of_node the\n 126:\t\t\t * of_match_device() will not match\n 127:\t\t\t */\n 128:\t\t\tif (sysfs_streq(client-\u003ename, matches-\u003ecompatible))\n 129:\t\t\t\treturn matches;\n 130:\t\n 131:\t\t\tname = strchr(matches-\u003ecompatible, ',');\n 132:\t\t\tif (!name)\n 133:\t\t\t\tname = matches-\u003ecompatible;\n 134:\t\t\telse\n 135:\t\t\t\tname++;\n 136:\t\n 137:\t\t\tif (sysfs_streq(client-\u003ename, name))\n 138:\t\t\t\treturn matches;\n 139:\t\t}\n 140:\t\n 141:\t\treturn NULL;\n 142:\t}\n 143:\t\n 144:\tconst struct of_device_id\n" }
17/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 14473 output: 21 thoughts: 163 Thoughts: My Line of Reasoning Okay, so `i2c_of_match_device_sysfs` is the key. It's comparing the `client->name` field with what's in `matches->compatible`, or the portion after a comma within that string. So, if I feed `"st21nfcd"` to `new_device`, the system should correctly associate it with `"st,st21nfcd"` in the compatible string. Excellent. Now, does that mean `device_get_match_data(dev)` will subsequently return `ST_NCI_I2C_PROTO_RAW_NCI`, given that `i2c_device_probe` calls `i2c_of_match_device` and handles the initial setup? It seems likely. But, hang on... `device_get_match_data` relies on the `device_driver` and the device itself (`dev`) for its lookups. I need to be absolutely certain about this. Time to dig into the actual implementation of `device_get_match_data` to confirm how it pulls the matching data. Gotta make sure the connection is solid.
18/2	2026/08/19 21:22	tool	grepper	0m Args: { "Expression": "device_get_match_data" } Results: { "Output": "\nFull output is too long, showing 500 out of 9265 lines.\nUse more precise expression if possible.\n\narch/arm/mach-imx/mmdc.c=473=static int imx_mmdc_perf_init(struct platform_device pdev, void __iomem mmdc_base,\n--\narch/arm/mach-imx/mmdc.c-509-\tpmu_mmdc-\u003emmdc_ipg_clk = mmdc_ipg_clk;\narch/arm/mach-imx/mmdc.c:510:\tpmu_mmdc-\u003edevtype_data = device_get_match_data(\u0026pdev-\u003edev);\narch/arm/mach-imx/mmdc.c-511-\n--\narch/powerpc/platforms/83xx/suspend.c=344=static int pmc_probe(struct platform_device ofdev)\n--\narch/powerpc/platforms/83xx/suspend.c-350-\narch/powerpc/platforms/83xx/suspend.c:351:\ttype = of_device_get_match_data(\u0026ofdev-\u003edev);\narch/powerpc/platforms/83xx/suspend.c-352-\tif (!type)\n--\narch/powerpc/sysdev/cpm_gpio.c=20=static int cpm_gpio_probe(struct platform_device ofdev)\n--\narch/powerpc/sysdev/cpm_gpio.c-22-\tstruct device dev = \u0026ofdev-\u003edev;\narch/powerpc/sysdev/cpm_gpio.c:23:\tint (gp_add)(struct device dev) = of_device_get_match_data(dev);\narch/powerpc/sysdev/cpm_gpio.c-24-\n--\narch/powerpc/sysdev/fsl_msi.c=393=static int fsl_of_msi_probe(struct platform_device dev)\n--\narch/powerpc/sysdev/fsl_msi.c-403-\narch/powerpc/sysdev/fsl_msi.c:404:\tfeatures = device_get_match_data(\u0026dev-\u003edev);\narch/powerpc/sysdev/fsl_msi.c-405-\n--\narch/sparc/kernel/pci_sabre.c=460=static int sabre_probe(struct platform_device op)\n--\narch/sparc/kernel/pci_sabre.c-470-\narch/sparc/kernel/pci_sabre.c:471:\thummingbird_p = (uintptr_t)device_get_match_data(\u0026op-\u003edev);\narch/sparc/kernel/pci_sabre.c-472-\tif (!hummingbird_p) {\n--\narch/sparc/kernel/pci_schizo.c=1465=static int schizo_probe(struct platform_device op)\narch/sparc/kernel/pci_schizo.c-1466-{\narch/sparc/kernel/pci_schizo.c:1467:\tunsigned long chip_type = (unsigned long)device_get_match_data(\u0026op-\u003edev);\narch/sparc/kernel/pci_schizo.c-1468-\n--\ndrivers/acpi/bus.c=1081=EXPORT_SYMBOL_GPL(acpi_match_device);\ndrivers/acpi/bus.c-1082-\ndrivers/acpi/bus.c:1083:const void acpi_device_get_match_data(const struct device dev)\ndrivers/acpi/bus.c-1084-{\n--\ndrivers/acpi/bus.c-1101-}\ndrivers/acpi/bus.c:1102:EXPORT_SYMBOL_GPL(acpi_device_get_match_data);\ndrivers/acpi/bus.c-1103-\n--\ndrivers/acpi/property.c=1596=static const void \ndrivers/acpi/property.c:1597:acpi_fwnode_device_get_match_data(const struct fwnode_handle fwnode,\ndrivers/acpi/property.c-1598-\t\t\t\t const struct device dev)\ndrivers/acpi/property.c-1599-{\ndrivers/acpi/property.c:1600:\treturn acpi_device_get_match_data(dev);\ndrivers/acpi/property.c-1601-}\n--\ndrivers/acpi/property.c=1725=static int acpi_fwnode_irq_get(const struct fwnode_handle fwnode,\n--\ndrivers/acpi/property.c-1740-\t\t.device_is_available = acpi_fwnode_device_is_available, \\\ndrivers/acpi/property.c:1741:\t\t.device_get_match_data = acpi_fwnode_device_get_match_data, \\\ndrivers/acpi/property.c-1742-\t\t.device_dma_supported =\t\t\t\t\\\n--\ndrivers/ata/ahci_dwc.c=109=static struct ahci_host_priv ahci_dwc_get_resources(struct platform_device pdev)\n--\ndrivers/ata/ahci_dwc.c-118-\tdpriv-\u003epdev = pdev;\ndrivers/ata/ahci_dwc.c:119:\tdpriv-\u003epdata = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/ata/ahci_dwc.c-120-\tif (!dpriv-\u003epdata)\n--\ndrivers/ata/ahci_imx.c=858=static int imx_ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_imx.c-872-\timxpriv-\u003efirst_time = true;\ndrivers/ata/ahci_imx.c:873:\timxpriv-\u003etype = (unsigned long)device_get_match_data(dev);\ndrivers/ata/ahci_imx.c-874-\n--\ndrivers/ata/ahci_mvebu.c=185=static int ahci_mvebu_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_mvebu.c-190-\ndrivers/ata/ahci_mvebu.c:191:\tpdata = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/ata/ahci_mvebu.c-192-\tif (!pdata)\n--\ndrivers/ata/ahci_platform.c=42=static int ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_platform.c-60-\ndrivers/ata/ahci_platform.c:61:\tport = device_get_match_data(dev);\ndrivers/ata/ahci_platform.c-62-\tif (!port)\n--\ndrivers/ata/ahci_tegra.c=515=static int tegra_ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_tegra.c-532-\ttegra-\u003epdev = pdev;\ndrivers/ata/ahci_tegra.c:533:\ttegra-\u003esoc = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/ata/ahci_tegra.c-534-\n--\ndrivers/ata/ahci_xgene.c=727=static int xgene_ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_xgene.c-775-\tif (dev-\u003eof_node) {\ndrivers/ata/ahci_xgene.c:776:\t\tversion = (unsigned long)of_device_get_match_data(dev);\ndrivers/ata/ahci_xgene.c-777-\t}\n--\ndrivers/ata/sata_rcar.c=859=static int sata_rcar_probe(struct platform_device pdev)\n--\ndrivers/ata/sata_rcar.c-873-\ndrivers/ata/sata_rcar.c:874:\tpriv-\u003etype = (unsigned long)of_device_get_match_data(dev);\ndrivers/ata/sata_rcar.c-875-\n--\ndrivers/auxdisplay/img-ascii-lcd.c=228=static int img_ascii_lcd_probe(struct platform_device pdev)\n--\ndrivers/auxdisplay/img-ascii-lcd.c-230-\tstruct device dev = \u0026pdev-\u003edev;\ndrivers/auxdisplay/img-ascii-lcd.c:231:\tconst struct img_ascii_lcd_config cfg = device_get_match_data(dev);\ndrivers/auxdisplay/img-ascii-lcd.c-232-\tstruct img_ascii_lcd_ctx ctx;\n--\ndrivers/base/property.c=1347=EXPORT_SYMBOL(fwnode_graph_parse_endpoint);\ndrivers/base/property.c-1348-\ndrivers/base/property.c:1349:const void device_get_match_data(const struct device dev)\ndrivers/base/property.c-1350-{\ndrivers/base/property.c:1351:\treturn fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);\ndrivers/base/property.c-1352-}\ndrivers/base/property.c:1353:EXPORT_SYMBOL_GPL(device_get_match_data);\ndrivers/base/property.c-1354-\n--\ndrivers/bluetooth/btmtkuart.c=828=static int btmtkuart_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/btmtkuart.c-837-\ndrivers/bluetooth/btmtkuart.c:838:\tbdev-\u003edata = of_device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/btmtkuart.c-839-\tif (!bdev-\u003edata)\n--\ndrivers/bluetooth/btnxpuart.c=1821=static int nxp_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/btnxpuart.c-1831-\ndrivers/bluetooth/btnxpuart.c:1832:\tnxpdev-\u003enxp_data = (struct btnxpuart_data )device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/btnxpuart.c-1833-\n--\ndrivers/bluetooth/hci_aml.c=680=static int aml_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_aml.c-697-\ndrivers/bluetooth/hci_aml.c:698:\tamldev-\u003eaml_dev_data = device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/hci_aml.c-699-\n--\ndrivers/bluetooth/hci_bcm.c=1505=static int bcm_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_bcm.c-1545-\ndrivers/bluetooth/hci_bcm.c:1546:\tdata = device_get_match_data(bcmdev-\u003edev);\ndrivers/bluetooth/hci_bcm.c-1547-\tif (data) {\n--\ndrivers/bluetooth/hci_h5.c=855=static int h5_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_h5.c-883-\t} else {\ndrivers/bluetooth/hci_h5.c:884:\t\tdata = of_device_get_match_data(dev);\ndrivers/bluetooth/hci_h5.c-885-\t\tif (!data)\n--\ndrivers/bluetooth/hci_mrvl.c=462=static int mrvl_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_mrvl.c-464-\tstruct mrvl_serdev mrvldev;\ndrivers/bluetooth/hci_mrvl.c:465:\tconst struct hci_uart_proto mrvl_proto = device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/hci_mrvl.c-466-\n--\ndrivers/bluetooth/hci_qca.c=2392=static int qca_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_qca.c-2404-\tqcadev-\u003eserdev_hu.serdev = serdev;\ndrivers/bluetooth/hci_qca.c:2405:\tdata = device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/hci_qca.c-2406-\tserdev_device_set_drvdata(serdev, qcadev);\n--\ndrivers/bus/imx-aipstz.c=49=static int imx_aipstz_probe(struct platform_device pdev)\n--\ndrivers/bus/imx-aipstz.c-62-\ndrivers/bus/imx-aipstz.c:63:\tdata-\u003edefault_cfg = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/bus/imx-aipstz.c-64-\n--\ndrivers/bus/imx-weim.c=206=static int weim_parse_dt(struct platform_device pdev)\ndrivers/bus/imx-weim.c-207-{\ndrivers/bus/imx-weim.c:208:\tconst struct imx_weim_devtype devtype = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/bus/imx-weim.c-209-\tint ret = 0, have_child = 0;\n--\ndrivers/bus/simple-pm-bus.c=77=static void simple_pm_bus_remove(struct platform_device pdev)\ndrivers/bus/simple-pm-bus.c-78-{\ndrivers/bus/simple-pm-bus.c:79:\tconst void data = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/bus/simple-pm-bus.c-80-\n--\ndrivers/bus/stm32_rifsc.c=605=static int stm32_rifsc_register_debugfs(struct stm32_firewall_controller rifsc_controller,\n--\ndrivers/bus/stm32_rifsc.c-618-\trifsc_priv-\u003enb_risal = nb_risal;\ndrivers/bus/stm32_rifsc.c:619:\trifsc_priv-\u003eres_names = of_device_get_match_data(rifsc_controller-\u003edev);\ndrivers/bus/stm32_rifsc.c-620-\n--\ndrivers/bus/ti-sysc.c=2863=static int sysc_init_match(struct sysc ddata)\n--\ndrivers/bus/ti-sysc.c-2866-\ndrivers/bus/ti-sysc.c:2867:\tcap = of_device_get_match_data(ddata-\u003edev);\ndrivers/bus/ti-sysc.c-2868-\tif (!cap)\n--\ndrivers/cache/sifive_ccache.c=256=static int sifive_ccache_probe(struct platform_device pdev)\n--\ndrivers/cache/sifive_ccache.c-261-\ndrivers/cache/sifive_ccache.c:262:\tquirks = (unsigned long)device_get_match_data(dev);\ndrivers/cache/sifive_ccache.c-263-\n--\ndrivers/char/hw_random/atmel-rng.c=114=static int atmel_trng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/atmel-rng.c-130-\t\treturn PTR_ERR(trng-\u003eclk);\ndrivers/char/hw_random/atmel-rng.c:131:\tdata = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/atmel-rng.c-132-\tif (!data)\n--\ndrivers/char/hw_random/bcm2835-rng.c=143=static int bcm2835_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/bcm2835-rng.c-175-\t\t/* Check for rng init function, execute it /\ndrivers/char/hw_random/bcm2835-rng.c:176:\t\tof_data = of_device_get_match_data(dev);\ndrivers/char/hw_random/bcm2835-rng.c-177-\t\tif (of_data)\n--\ndrivers/char/hw_random/exynos-trng.c=183=static int exynos_trng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/exynos-trng.c-194-\ndrivers/char/hw_random/exynos-trng.c:195:\ttrng-\u003eflags = (unsigned long)device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/exynos-trng.c-196-\n--\ndrivers/char/hw_random/ingenic-rng.c=83=static int ingenic_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/ingenic-rng.c-97-\ndrivers/char/hw_random/ingenic-rng.c:98:\tpriv-\u003eversion = (enum ingenic_rng_version)(uintptr_t)of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/ingenic-rng.c-99-\n--\ndrivers/char/hw_random/meson-rng.c=86=static int meson_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/meson-rng.c-96-\ndrivers/char/hw_random/meson-rng.c:97:\tpriv = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/meson-rng.c-98-\tif (!priv)\n--\ndrivers/char/hw_random/mtk-rng.c=165=static int mtk_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/mtk-rng.c-176-\tpriv-\u003erng.quality = 900;\ndrivers/char/hw_random/mtk-rng.c:177:\tpriv-\u003eflags = (unsigned long)device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/mtk-rng.c-178-\n--\ndrivers/char/hw_random/n2-drv.c=697=static int n2rng_probe(struct platform_device op)\n--\ndrivers/char/hw_random/n2-drv.c-706-\tnp-\u003eop = op;\ndrivers/char/hw_random/n2-drv.c:707:\tnp-\u003edata = (struct n2rng_template )device_get_match_data(\u0026op-\u003edev);\ndrivers/char/hw_random/n2-drv.c-708-\n--\ndrivers/char/hw_random/npcm-rng.c=88=static int npcm_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/npcm-rng.c-112-\tpriv-\u003edev = \u0026pdev-\u003edev;\ndrivers/char/hw_random/npcm-rng.c:113:\tpriv-\u003eclkp = (u32)(uintptr_t)of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/npcm-rng.c-114-\n--\ndrivers/char/hw_random/omap-rng.c=375=static int of_get_omap_rng_device_details(struct omap_rng_dev priv,\n--\ndrivers/char/hw_random/omap-rng.c-380-\ndrivers/char/hw_random/omap-rng.c:381:\tpriv-\u003epdata = of_device_get_match_data(dev);\ndrivers/char/hw_random/omap-rng.c-382-\tif (!priv-\u003epdata)\n--\ndrivers/char/hw_random/omap3-rom-rng.c=110=static int omap3_rom_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/omap3-rom-rng.c-121-\tddata-\u003eops.name = \"omap3-rom\";\ndrivers/char/hw_random/omap3-rom-rng.c:122:\tddata-\u003eops.read = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/omap3-rom-rng.c-123-\tddata-\u003eops.quality = 900;\n--\ndrivers/char/hw_random/rockchip-rng.c=385=static int rk_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/rockchip-rng.c-395-\ndrivers/char/hw_random/rockchip-rng.c:396:\trk_rng-\u003esoc_data = of_device_get_match_data(dev);\ndrivers/char/hw_random/rockchip-rng.c-397-\trk_rng-\u003ebase = devm_platform_ioremap_resource(pdev, 0);\n--\ndrivers/char/hw_random/stm32-rng.c=531=static int stm32_rng_probe(struct platform_device ofdev)\n--\ndrivers/char/hw_random/stm32-rng.c-557-\ndrivers/char/hw_random/stm32-rng.c:558:\tpriv-\u003edata = of_device_get_match_data(dev);\ndrivers/char/hw_random/stm32-rng.c-559-\tif (!priv-\u003edata)\n--\ndrivers/char/ipmi/ipmi_si_platform.c=227=static int of_ipmi_probe(struct platform_device pdev)\n--\ndrivers/char/ipmi/ipmi_si_platform.c-268-\tmemset(\u0026io, 0, sizeof(io));\ndrivers/char/ipmi/ipmi_si_platform.c:269:\tio.si_info\t= device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/ipmi/ipmi_si_platform.c-270-\tio.addr_source\t= SI_DEVICETREE;\n--\ndrivers/char/tpm/tpm_tis_spi_main.c=292=static int tpm_tis_spi_driver_probe(struct spi_device spi)\n--\ndrivers/char/tpm/tpm_tis_spi_main.c-296-\ndrivers/char/tpm/tpm_tis_spi_main.c:297:\tprobe_func = of_device_get_match_data(\u0026spi-\u003edev);\ndrivers/char/tpm/tpm_tis_spi_main.c-298-\tif (!probe_func) {\n--\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c=688=static int hwicap_drv_probe(struct platform_device pdev)\n--\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c-694-\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c:695:\tconfig = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c-696-\n--\ndrivers/clk/aspeed/clk-aspeed.c=384=static int aspeed_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/aspeed/clk-aspeed.c-416-\t/* SoC generations share common layouts but have different divisors /\ndrivers/clk/aspeed/clk-aspeed.c:417:\tsoc_data = of_device_get_match_data(dev);\ndrivers/clk/aspeed/clk-aspeed.c-418-\tif (!soc_data) {\n--\ndrivers/clk/aspeed/clk-ast2700.c=870=static int ast2700_soc_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/aspeed/clk-ast2700.c-896-\ndrivers/clk/aspeed/clk-ast2700.c:897:\tclk_data = device_get_match_data(dev);\ndrivers/clk/aspeed/clk-ast2700.c-898-\tif (!clk_data)\n--\ndrivers/clk/axs10x/pll_clock.c=217=static int axs10x_pll_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/axs10x/pll_clock.c-243-\tpll_clk-\u003edev = dev;\ndrivers/clk/axs10x/pll_clock.c:244:\tpll_clk-\u003epll_cfg = of_device_get_match_data(dev);\ndrivers/clk/axs10x/pll_clock.c-245-\n--\ndrivers/clk/bcm/clk-bcm2835.c=2267=static int bcm2835_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/bcm/clk-bcm2835.c-2277-\ndrivers/clk/bcm/clk-bcm2835.c:2278:\tpdata = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/bcm/clk-bcm2835.c-2279-\tif (!pdata)\n--\ndrivers/clk/bcm/clk-bcm63xx-gate.c=484=static int clk_bcm63xx_probe(struct platform_device pdev)\n--\ndrivers/clk/bcm/clk-bcm63xx-gate.c-490-\ndrivers/clk/bcm/clk-bcm63xx-gate.c:491:\ttable = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/bcm/clk-bcm63xx-gate.c-492-\tif (!table)\n--\ndrivers/clk/bcm/clk-sr.c=403=static int sr_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/bcm/clk-sr.c-406-\ndrivers/clk/bcm/clk-sr.c:407:\tprobe_func = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/bcm/clk-sr.c-408-\tif (!probe_func)\n--\ndrivers/clk/clk-axi-clkgen.c=566=static int axi_clkgen_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-axi-clkgen.c-577-\ndrivers/clk/clk-axi-clkgen.c:578:\tdflt_limits = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/clk-axi-clkgen.c-579-\tif (!dflt_limits)\n--\ndrivers/clk/clk-en7523.c=596=static struct clk_hw en7523_register_pcie_clk(struct device dev,\n--\ndrivers/clk/clk-en7523.c-598-{\ndrivers/clk/clk-en7523.c:599:\tconst struct en_clk_soc_data soc_data = device_get_match_data(dev);\ndrivers/clk/clk-en7523.c-600-\tstruct clk_init_data init = {\n--\ndrivers/clk/clk-en7523.c=960=static int en7523_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-en7523.c-966-\ndrivers/clk/clk-en7523.c:967:\tsoc_data = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/clk-en7523.c-968-\n--\ndrivers/clk/clk-eyeq.c=338=static int eqc_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-eyeq.c-347-\ndrivers/clk/clk-eyeq.c:348:\tdata = device_get_match_data(dev);\ndrivers/clk/clk-eyeq.c-349-\tif (!data)\n--\ndrivers/clk/clk-fsl-flexspi.c=47=static int fsl_flexspi_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-fsl-flexspi.c-57-\ndrivers/clk/clk-fsl-flexspi.c:58:\tdivs = device_get_match_data(dev);\ndrivers/clk/clk-fsl-flexspi.c-59-\tif (!divs)\n--\ndrivers/clk/clk-fsl-sai.c=61=static int fsl_sai_clk_register(struct device dev, void __iomem base,\n--\ndrivers/clk/clk-fsl-sai.c-66-{\ndrivers/clk/clk-fsl-sai.c:67:\tconst struct fsl_sai_data data = device_get_match_data(dev);\ndrivers/clk/clk-fsl-sai.c-68-\tstruct clk_parent_data pdata = { .index = 0 };\n--\ndrivers/clk/clk-fsl-sai.c=104=static int fsl_sai_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-fsl-sai.c-106-\tstruct device dev = \u0026pdev-\u003edev;\ndrivers/clk/clk-fsl-sai.c:107:\tconst struct fsl_sai_data data = device_get_match_data(dev);\ndrivers/clk/clk-fsl-sai.c-108-\tstruct fsl_sai_clk sai_clk;\n--\ndrivers/clk/clk-hsdk-pll.c=305=static int hsdk_pll_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-hsdk-pll.c-334-\tpll_clk-\u003edev = dev;\ndrivers/clk/clk-hsdk-pll.c:335:\tpll_clk-\u003epll_devdata = of_device_get_match_data(dev);\ndrivers/clk/clk-hsdk-pll.c-336-\n--\ndrivers/clk/clk-lan966x.c=250=static int lan966x_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-lan966x.c-258-\ndrivers/clk/clk-lan966x.c:259:\tdata = device_get_match_data(dev);\ndrivers/clk/clk-lan966x.c-260-\tif (!data)\n--\ndrivers/clk/clk-lochnagar.c=238=static int lochnagar_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-lochnagar.c-254-\tpriv-\u003eregmap = dev_get_regmap(dev-\u003eparent, NULL);\ndrivers/clk/clk-lochnagar.c:255:\tconf = (struct lochnagar_config )device_get_match_data(dev);\ndrivers/clk/clk-lochnagar.c-256-\n--\ndrivers/clk/clk-loongson2.c=355=static int loongson2_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-loongson2.c-363-\ndrivers/clk/clk-loongson2.c:364:\tdata = device_get_match_data(dev);\ndrivers/clk/clk-loongson2.c-365-\tif (!data)\n--\ndrivers/clk/clk-palmas.c=230=static int palmas_clks_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-palmas.c-237-\ndrivers/clk/clk-palmas.c:238:\tmatch_data = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/clk-palmas.c-239-\tif (!match_data)\n--\ndrivers/clk/davinci/da8xx-cfgchip.c=742=static int da8xx_cfgchip_probe(struct platform_device pdev)\n--\ndrivers/clk/davinci/da8xx-cfgchip.c-748-\ndrivers/clk/davinci/da8xx-cfgchip.c:749:\tclk_init = device_get_match_data(dev);\ndrivers/clk/davinci/da8xx-cfgchip.c-750-\tif (clk_init) {\n--\ndrivers/clk/davinci/pll.c=861=static int davinci_pll_probe(struct platform_device pdev)\n--\ndrivers/clk/davinci/pll.c-867-\ndrivers/clk/davinci/pll.c:868:\tpll_init = device_get_match_data(dev);\ndrivers/clk/davinci/pll.c-869-\tif (!pll_init \u0026\u0026 pdev-\u003eid_entry)\n--\ndrivers/clk/davinci/psc.c=513=static int davinci_psc_probe(struct platform_device pdev)\n--\ndrivers/clk/davinci/psc.c-519-\ndrivers/clk/davinci/psc.c:520:\tinit_data = device_get_match_data(dev);\ndrivers/clk/davinci/psc.c-521-\tif (!init_data \u0026\u0026 pdev-\u003eid_entry)\n--\ndrivers/clk/hisilicon/clk-hi3559a.c=784=static int hi3559av100_crg_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/clk-hi3559a.c-791-\ndrivers/clk/hisilicon/clk-hi3559a.c:792:\tcrg-\u003efuncs = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/hisilicon/clk-hi3559a.c-793-\tif (!crg-\u003efuncs)\n--\ndrivers/clk/hisilicon/clk-hi3660.c=610=static int hi3660_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/clk-hi3660.c-615-\ndrivers/clk/hisilicon/clk-hi3660.c:616:\tinit_func = of_device_get_match_data(dev);\ndrivers/clk/hisilicon/clk-hi3660.c-617-\tif (!init_func)\n--\ndrivers/clk/hisilicon/clk-hi3670.c=989=static int hi3670_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/clk-hi3670.c-994-\ndrivers/clk/hisilicon/clk-hi3670.c:995:\tinit_func = of_device_get_match_data(dev);\ndrivers/clk/hisilicon/clk-hi3670.c-996-\tif (!init_func)\n--\ndrivers/clk/hisilicon/crg-hi3516cv300.c=261=static int hi3516cv300_crg_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/crg-hi3516cv300.c-268-\ndrivers/clk/hisilicon/crg-hi3516cv300.c:269:\tcrg-\u003efuncs = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/hisilicon/crg-hi3516cv300.c-270-\tif (!crg-\u003efuncs)\n--\ndrivers/clk/hisilicon/crg-hi3798cv200.c=344=static int hi3798cv200_crg_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/crg-hi3798cv200.c-351-\ndrivers/clk/hisilicon/crg-hi3798cv200.c:352:\tcrg-\u003efuncs = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/hisilicon/crg-hi3798cv200.c-353-\tif (!crg-\u003efuncs)\n--\ndrivers/clk/imx/clk-imx8-acm.c=332=static int imx8_acm_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8-acm.c-351-\tpriv-\u003ereg = base;\ndrivers/clk/imx/clk-imx8-acm.c:352:\tpriv-\u003esoc_data = of_device_get_match_data(dev);\ndrivers/clk/imx/clk-imx8-acm.c-353-\tplatform_set_drvdata(pdev, priv);\n--\ndrivers/clk/imx/clk-imx8qxp-lpcg.c=286=static int imx8qxp_lpcg_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8qxp-lpcg.c-303-\ndrivers/clk/imx/clk-imx8qxp-lpcg.c:304:\tss_lpcg = of_device_get_match_data(dev);\ndrivers/clk/imx/clk-imx8qxp-lpcg.c-305-\tif (!ss_lpcg)\n--\ndrivers/clk/imx/clk-imx8qxp.c=130=static int imx8qxp_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8qxp.c-135-\ndrivers/clk/imx/clk-imx8qxp.c:136:\trsrc_table = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/imx/clk-imx8qxp.c-137-\tret = imx_clk_scu_init(ccm_node, rsrc_table);\n--\ndrivers/clk/imx/clk-imx8ulp.c=536=static int imx8ulp_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8ulp.c-539-\ndrivers/clk/imx/clk-imx8ulp.c:540:\tprobe = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/imx/clk-imx8ulp.c-541-\n--\ndrivers/clk/imx/clk-imx93.c=274=static int imx93_clocks_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx93.c-281-\tint i, ret;\ndrivers/clk/imx/clk-imx93.c:282:\tconst unsigned long plat = (unsigned long)device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/imx/clk-imx93.c-283-\n--\ndrivers/clk/imx/clk-imx95-blk-ctl.c=350=static int imx95_bc_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx95-blk-ctl.c-381-\ndrivers/clk/imx/clk-imx95-blk-ctl.c:382:\tbc-\u003epdata = of_device_get_match_data(dev);\ndrivers/clk/imx/clk-imx95-blk-ctl.c-383-\tif (!bc-\u003epdata)\n--\ndrivers/clk/keystone/syscon-clk.c=114=static int ti_syscon_gate_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/keystone/syscon-clk.c-123-\ndrivers/clk/keystone/syscon-clk.c:124:\tdata = device_get_match_data(dev);\ndrivers/clk/keystone/syscon-clk.c-125-\tif (!data)\n--\ndrivers/clk/mediatek/clk-mt2701.c=1007=static int clk_mt2701_probe(struct platform_device pdev)\n--\ndrivers/clk/mediatek/clk-mt2701.c-1011-\ndrivers/clk/mediatek/clk-mt2701.c:1012:\tclk_init = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/mediatek/clk-mt2701.c-1013-\tif (!clk_init)\n--\ndrivers/clk/mediatek/clk-mt6765.c=843=static int clk_mt6765_probe(struct platform_device pdev)\n--\ndrivers/clk/mediatek/clk-mt6765.c-847-\ndrivers/clk/mediatek/clk-mt6765.c:848:\tclk_probe = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/mediatek/clk-mt6765.c-849-\tif (!clk_probe)\n--\ndrivers/clk/mediatek/clk-mt6779.c=1277=static int clk_mt6779_probe(struct platform_device pdev)\n--\ndrivers/clk/mediatek/clk-mt6779.c-1281-\ndrivers/clk/mediatek/clk-mt6779.c:1282:\tclk_probe = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/mediatek/clk-mt6779.c-1283-\tif (!clk_probe)\n--\ndrivers/clk/mediatek/clk-mt6797.c=679=static int clk_mt6797_probe(struct platform_device *pdev)\n--\ndrivers/clk/mediatek/clk-mt6797.c-683-\ndrivers/clk/mediatek/clk-mt6797.c:684:\tclk_init = of_device_get_match_data(\u0026pdev-\u003edev);\n\n" }
19/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26012 output: 36 thoughts: 148 Thoughts: My Reasoning on Device Matching Alright, let's break this down. My understanding is that `device_get_match_data` should handle device matching during sysfs instantiation. The logic, as I recall, hinges on `i2c_of_match_device` setting `dev->driver_data`, right? Hmm, no, that's not quite it. It seems `device_get_match_data` actually calls `fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev)`. Now, the crucial bit for sysfs is the fallback. If we don't have an fwnode – which is exactly the case when a device is created via sysfs – then `device_get_match_data` must fall back to using the match data provided by the `device_driver`. That's the key, that's where the relevant data comes from. To make absolutely sure I'm following the correct path, let me double-check the `device_get_match_data` function in `drivers/base/property.c`. I need to ensure my understanding of the fallback mechanism is accurate.
20/2	2026/08/19 21:22	tool	read-file	0m Args: { "File": "drivers/base/property.c", "FirstLine": 1347, "LineCount": 30 } Results: { "Contents": "1347:\tEXPORT_SYMBOL(fwnode_graph_parse_endpoint);\n1348:\t\n1349:\tconst void device_get_match_data(const struct device dev)\n1350:\t{\n1351:\t\treturn fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);\n1352:\t}\n1353:\tEXPORT_SYMBOL_GPL(device_get_match_data);\n1354:\t\n1355:\tstatic unsigned int fwnode_graph_devcon_matches(const struct fwnode_handle fwnode,\n1356:\t\t\t\t\t\t\tconst char con_id, void data,\n1357:\t\t\t\t\t\t\tdevcon_match_fn_t match,\n1358:\t\t\t\t\t\t\tvoid matches,\n1359:\t\t\t\t\t\t\tunsigned int matches_len)\n1360:\t{\n1361:\t\tstruct fwnode_handle node;\n1362:\t\tstruct fwnode_handle ep;\n1363:\t\tunsigned int count = 0;\n1364:\t\tvoid ret;\n1365:\t\n1366:\t\tfwnode_graph_for_each_endpoint(fwnode, ep) {\n1367:\t\t\tif (matches \u0026\u0026 count \u003e= matches_len) {\n1368:\t\t\t\tfwnode_handle_put(ep);\n1369:\t\t\t\tbreak;\n1370:\t\t\t}\n1371:\t\n1372:\t\t\tnode = fwnode_graph_get_remote_port_parent(ep);\n1373:\t\t\tif (!fwnode_device_is_available(node)) {\n1374:\t\t\t\tfwnode_handle_put(node);\n1375:\t\t\t\tcontinue;\n1376:\t\t\t}\n" }
21/2	2026/08/19 21:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26930 output: 23 thoughts: 88 Thoughts: Here's my thought process, as it stands: Navigating I2C Probe and Match Data Okay, so I'm looking at how device matching works with I2C devices, specifically considering the interaction between the `device_get_match_data` function and the potential null return when no FW node is present. Right off the bat, I realize that `device_get_match_data` relies on `fwnode_call_ptr_op`, which makes sense. If there's no Firmware Node, a NULL return is the anticipated outcome. However, the puzzle isn't complete yet, because I have a hunch... Does the `i2c_device_probe` function found in `drivers/i2c/i2c-core-base.c` mess with how `i2c_get_match_data` is handled, potentially setting something up? It's worth investigating further. So, my next logical step is to delve into how `i2c_get_match_data` actually functions within that context and see how it interacts.
22/2	2026/08/19 21:23	tool	grepper	0m Args: { "Expression": "i2c_get_match_data" } Results: { "Output": "\nFull output is too long, showing 500 out of 1303 lines.\nUse more precise expression if possible.\n\ndrivers/auxdisplay/ht16k33.c=657=static int ht16k33_probe(struct i2c_client client)\n--\ndrivers/auxdisplay/ht16k33.c-673-\tpriv-\u003eclient = client;\ndrivers/auxdisplay/ht16k33.c:674:\tpriv-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/auxdisplay/ht16k33.c-675-\n--\ndrivers/char/tpm/tpm_i2c_nuvoton.c=527=static int i2c_nuvoton_probe(struct i2c_client client)\n--\ndrivers/char/tpm/tpm_i2c_nuvoton.c-549-\ndrivers/char/tpm/tpm_i2c_nuvoton.c:550:\tif (i2c_get_match_data(client))\ndrivers/char/tpm/tpm_i2c_nuvoton.c-551-\t\tchip-\u003eflags \|= TPM_CHIP_FLAG_TPM2;\n--\ndrivers/clk/clk-cdce925.c=617=static int cdce925_probe(struct i2c_client client)\n--\ndrivers/clk/clk-cdce925.c-650-\tdata-\u003ei2c_client = client;\ndrivers/clk/clk-cdce925.c:651:\tdata-\u003echip_info = i2c_get_match_data(client);\ndrivers/clk/clk-cdce925.c-652-\tconfig.max_register = CDCE925_OFFSET_PLL +\n--\ndrivers/clk/clk-renesas-pcie.c=282=static int rs9_probe(struct i2c_client client)\n--\ndrivers/clk/clk-renesas-pcie.c-295-\trs9-\u003eclient = client;\ndrivers/clk/clk-renesas-pcie.c:296:\trs9-\u003echip_info = i2c_get_match_data(client);\ndrivers/clk/clk-renesas-pcie.c-297-\tif (!rs9-\u003echip_info)\n--\ndrivers/clk/clk-si521xx.c=281=static int si521xx_probe(struct i2c_client client)\ndrivers/clk/clk-si521xx.c-282-{\ndrivers/clk/clk-si521xx.c:283:\tconst u16 chip_info = (u16)(uintptr_t)i2c_get_match_data(client);\ndrivers/clk/clk-si521xx.c-284-\tconst struct clk_parent_data clk_parent_data = { .index = 0 };\n--\ndrivers/clk/clk-si5351.c=1436=static int si5351_i2c_probe(struct i2c_client client)\n--\ndrivers/clk/clk-si5351.c-1445-\ndrivers/clk/clk-si5351.c:1446:\tvariant = (enum si5351_variant)(uintptr_t)i2c_get_match_data(client);\ndrivers/clk/clk-si5351.c-1447-\tret = si5351_dt_parse(client, variant);\n--\ndrivers/clk/clk-si544.c=434=static int si544_probe(struct i2c_client client)\n--\ndrivers/clk/clk-si544.c-448-\tdata-\u003ei2c_client = client;\ndrivers/clk/clk-si544.c:449:\tdata-\u003emax_freq = (uintptr_t)i2c_get_match_data(client);\ndrivers/clk/clk-si544.c-450-\n--\ndrivers/clk/clk-si570.c=412=static int si570_probe(struct i2c_client client)\n--\ndrivers/clk/clk-si570.c-429-\ndrivers/clk/clk-si570.c:430:\tdata-\u003einfo = i2c_get_match_data(client);\ndrivers/clk/clk-si570.c-431-\tif (data-\u003einfo-\u003ehas_temperature_stability) {\n--\ndrivers/clk/clk-versaclock3.c=997=static int vc3_probe(struct i2c_client client)\n--\ndrivers/clk/clk-versaclock3.c-1048-\ndrivers/clk/clk-versaclock3.c:1049:\tdata = i2c_get_match_data(client);\ndrivers/clk/clk-versaclock3.c-1050-\n--\ndrivers/clk/clk-versaclock5.c=951=static int vc5_probe(struct i2c_client client)\n--\ndrivers/clk/clk-versaclock5.c-965-\tvc5-\u003eclient = client;\ndrivers/clk/clk-versaclock5.c:966:\tvc5-\u003echip_info = i2c_get_match_data(client);\ndrivers/clk/clk-versaclock5.c-967-\n--\ndrivers/clk/clk-versaclock7.c=1100=static int vc7_probe(struct i2c_client client)\n--\ndrivers/clk/clk-versaclock7.c-1116-\tvc7-\u003eclient = client;\ndrivers/clk/clk-versaclock7.c:1117:\tvc7-\u003echip_info = i2c_get_match_data(client);\ndrivers/clk/clk-versaclock7.c-1118-\n--\ndrivers/crypto/atmel-sha204a.c=164=static int atmel_sha204a_probe(struct i2c_client client)\n--\ndrivers/crypto/atmel-sha204a.c-180-\ndrivers/crypto/atmel-sha204a.c:181:\tquality = i2c_get_match_data(client);\ndrivers/crypto/atmel-sha204a.c-182-\tif (quality)\n--\ndrivers/gpio/gpio-pca953x.c=1192=static int pca953x_probe(struct i2c_client client)\n--\ndrivers/gpio/gpio-pca953x.c-1228-\tchip-\u003eclient = client;\ndrivers/gpio/gpio-pca953x.c:1229:\tchip-\u003edriver_data = (uintptr_t)i2c_get_match_data(client);\ndrivers/gpio/gpio-pca953x.c-1230-\tif (!chip-\u003edriver_data)\n--\ndrivers/gpio/gpio-pcf857x.c=277=static int pcf857x_probe(struct i2c_client client)\n--\ndrivers/gpio/gpio-pcf857x.c-300-\tgpio-\u003echip.direction_output\t= pcf857x_output;\ndrivers/gpio/gpio-pcf857x.c:301:\tgpio-\u003echip.ngpio\t\t= (uintptr_t)i2c_get_match_data(client);\ndrivers/gpio/gpio-pcf857x.c-302-\n--\ndrivers/gpu/drm/bridge/adv7511/adv7511_drv.c=1229=static int adv7511_probe(struct i2c_client i2c)\n--\ndrivers/gpu/drm/bridge/adv7511/adv7511_drv.c-1247-\tadv7511-\u003estatus = connector_status_disconnected;\ndrivers/gpu/drm/bridge/adv7511/adv7511_drv.c:1248:\tadv7511-\u003einfo = i2c_get_match_data(i2c);\ndrivers/gpu/drm/bridge/adv7511/adv7511_drv.c-1249-\n--\ndrivers/gpu/drm/bridge/waveshare-dsi.c=144=static int ws_bridge_probe(struct i2c_client i2c)\n--\ndrivers/gpu/drm/bridge/waveshare-dsi.c-179-\ndrivers/gpu/drm/bridge/waveshare-dsi.c:180:\tws-\u003ebridge.type = (uintptr_t)i2c_get_match_data(i2c);\ndrivers/gpu/drm/bridge/waveshare-dsi.c-181-\tws-\u003ebridge.of_node = dev-\u003eof_node;\n--\ndrivers/hwmon/ad7418.c=233=static int ad7418_probe(struct i2c_client client)\n--\ndrivers/hwmon/ad7418.c-252-\tdata-\u003eclient = client;\ndrivers/hwmon/ad7418.c:253:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/ad7418.c-254-\n--\ndrivers/hwmon/adm1031.c=1024=static int adm1031_probe(struct i2c_client client)\n--\ndrivers/hwmon/adm1031.c-1035-\tdata-\u003eclient = client;\ndrivers/hwmon/adm1031.c:1036:\tdata-\u003echip_type = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/adm1031.c-1037-\tmutex_init(\u0026data-\u003eupdate_lock);\n--\ndrivers/hwmon/ads7828.c=102=static int ads7828_probe(struct i2c_client client)\n--\ndrivers/hwmon/ads7828.c-139-\ndrivers/hwmon/ads7828.c:140:\tchip = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/ads7828.c-141-\n--\ndrivers/hwmon/adt7475.c=1805=static int adt7475_probe(struct i2c_client client)\n--\ndrivers/hwmon/adt7475.c-1827-\ndrivers/hwmon/adt7475.c:1828:\tchip = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/adt7475.c-1829-\n--\ndrivers/hwmon/aht10.c=332=static int aht10_probe(struct i2c_client client)\ndrivers/hwmon/aht10.c-333-{\ndrivers/hwmon/aht10.c:334:\tenum aht10_variant variant = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/aht10.c-335-\tstruct device device = \u0026client-\u003edev;\n--\ndrivers/hwmon/dme1737.c=2464=static int dme1737_i2c_probe(struct i2c_client client)\n--\ndrivers/hwmon/dme1737.c-2474-\ti2c_set_clientdata(client, data);\ndrivers/hwmon/dme1737.c:2475:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/dme1737.c-2476-\tdata-\u003eclient = client;\n--\ndrivers/hwmon/ds1621.c=345=static int ds1621_probe(struct i2c_client client)\n--\ndrivers/hwmon/ds1621.c-356-\ndrivers/hwmon/ds1621.c:357:\tdata-\u003ekind = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/ds1621.c-358-\tdata-\u003eclient = client;\n--\ndrivers/hwmon/emc1812.c=824=static int emc1812_chip_identify(struct emc1812_data data, struct i2c_client client)\n--\ndrivers/hwmon/emc1812.c-856-\t\t /\ndrivers/hwmon/emc1812.c:857:\t\tchip = i2c_get_match_data(client);\ndrivers/hwmon/emc1812.c-858-\t\tif (!chip)\n--\ndrivers/hwmon/f75375s.c=791=static int f75375_probe(struct i2c_client client)\n--\ndrivers/hwmon/f75375s.c-807-\tmutex_init(\u0026data-\u003eupdate_lock);\ndrivers/hwmon/f75375s.c:808:\tdata-\u003ekind = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/f75375s.c-809-\n--\ndrivers/hwmon/fschmd.c=1082=static int fschmd_probe(struct i2c_client client)\n--\ndrivers/hwmon/fschmd.c-1088-\tint i, err;\ndrivers/hwmon/fschmd.c:1089:\tenum chips kind = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/fschmd.c-1090-\n--\ndrivers/hwmon/ina238.c=883=static int ina238_probe(struct i2c_client client)\n--\ndrivers/hwmon/ina238.c-891-\ndrivers/hwmon/ina238.c:892:\tchip = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/ina238.c-893-\n--\ndrivers/hwmon/ina2xx.c=961=static int ina2xx_probe(struct i2c_client client)\n--\ndrivers/hwmon/ina2xx.c-968-\ndrivers/hwmon/ina2xx.c:969:\tchip = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/ina2xx.c-970-\n--\ndrivers/hwmon/lm63.c=1245=static int lm63_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm63.c-1259-\t/* Set the device type /\ndrivers/hwmon/lm63.c:1260:\tdata-\u003ekind = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/lm63.c-1261-\tif (data-\u003ekind == lm64)\n--\ndrivers/hwmon/lm75.c=818=static int lm75_i2c_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm75.c-830-\ndrivers/hwmon/lm75.c:831:\treturn lm75_generic_probe(dev, client-\u003ename, (uintptr_t)i2c_get_match_data(client),\ndrivers/hwmon/lm75.c-832-\t\t\t\t client-\u003eirq, regmap);\n--\ndrivers/hwmon/lm78.c=630=static int lm78_i2c_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm78.c-640-\tdata-\u003eclient = client;\ndrivers/hwmon/lm78.c:641:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/lm78.c-642-\n--\ndrivers/hwmon/lm83.c=420=static int lm83_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm83.c-433-\ndrivers/hwmon/lm83.c:434:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/lm83.c-435-\n--\ndrivers/hwmon/lm85.c=1547=static int lm85_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm85.c-1558-\tdata-\u003eclient = client;\ndrivers/hwmon/lm85.c:1559:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/lm85.c-1560-\tmutex_init(\u0026data-\u003eupdate_lock);\n--\ndrivers/hwmon/lm90.c=2768=static int lm90_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm90.c-2790-\t/* Set the device type /\ndrivers/hwmon/lm90.c:2791:\tdata-\u003ekind = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/lm90.c-2792-\n--\ndrivers/hwmon/lm92.c=374=static int lm92_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm92.c-391-\tdata-\u003eregmap = regmap;\ndrivers/hwmon/lm92.c:392:\tdata-\u003eresolution = (unsigned long)i2c_get_match_data(client);\ndrivers/hwmon/lm92.c-393-\n--\ndrivers/hwmon/lm95234.c=503=static int lm95234_probe(struct i2c_client client)\n--\ndrivers/hwmon/lm95234.c-514-\ndrivers/hwmon/lm95234.c:515:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/lm95234.c-516-\n--\ndrivers/hwmon/max16065.c=505=static int max16065_probe(struct i2c_client client)\n--\ndrivers/hwmon/max16065.c-514-\tint groups = 0;\ndrivers/hwmon/max16065.c:515:\tenum chips chip = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/max16065.c-516-\n--\ndrivers/hwmon/max1668.c=269=static int max1668_probe(struct i2c_client client)\n--\ndrivers/hwmon/max1668.c-287-\ndrivers/hwmon/max1668.c:288:\tdata-\u003echannels = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/max1668.c-289-\n--\ndrivers/hwmon/max6650.c=763=static int max6650_probe(struct i2c_client client)\n--\ndrivers/hwmon/max6650.c-778-\ndrivers/hwmon/max6650.c:779:\tdata-\u003enr_fans = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/max6650.c-780-\n--\ndrivers/hwmon/max6697.c=537=static int max6697_probe(struct i2c_client client)\n--\ndrivers/hwmon/max6697.c-553-\tdata-\u003eregmap = regmap;\ndrivers/hwmon/max6697.c:554:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/max6697.c-555-\tdata-\u003echip = \u0026max6697_chip_data[data-\u003etype];\n--\ndrivers/hwmon/mcp3021.c=119=static int mcp3021_probe(struct i2c_client client)\n--\ndrivers/hwmon/mcp3021.c-150-\ndrivers/hwmon/mcp3021.c:151:\ttype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/mcp3021.c-152-\tswitch (type) {\n--\ndrivers/hwmon/mcp9982.c=911=static int mcp9982_probe(struct i2c_client client)\n--\ndrivers/hwmon/mcp9982.c-930-\ndrivers/hwmon/mcp9982.c:931:\tchip = i2c_get_match_data(client);\ndrivers/hwmon/mcp9982.c-932-\tif (!chip)\n--\ndrivers/hwmon/nct6775-i2c.c=155=static int nct6775_i2c_probe(struct i2c_client client)\n--\ndrivers/hwmon/nct6775-i2c.c-163-\ndrivers/hwmon/nct6775-i2c.c:164:\tdata-\u003ekind = (enum kinds)(uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/nct6775-i2c.c-165-\tdata-\u003eread_only = true;\n--\ndrivers/hwmon/pmbus/adp1050.c=79=static int adp1050_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/adp1050.c-82-\ndrivers/hwmon/pmbus/adp1050.c:83:\tinfo = (struct pmbus_driver_info )i2c_get_match_data(client);\ndrivers/hwmon/pmbus/adp1050.c-84-\tif (!info)\n--\ndrivers/hwmon/pmbus/bel-pfe.c=91=static int pfe_pmbus_probe(struct i2c_client client)\ndrivers/hwmon/pmbus/bel-pfe.c-92-{\ndrivers/hwmon/pmbus/bel-pfe.c:93:\tint model = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/bel-pfe.c-94-\n--\ndrivers/hwmon/pmbus/ibm-cffps.c=482=static int ibm_cffps_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/ibm-cffps.c-484-\tint i, rc;\ndrivers/hwmon/pmbus/ibm-cffps.c:485:\tenum versions vs = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/ibm-cffps.c-486-\tstruct dentry debugfs;\n--\ndrivers/hwmon/pmbus/isl68137.c=325=static int isl68137_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/isl68137.c-347-\ndrivers/hwmon/pmbus/isl68137.c:348:\tswitch ((uintptr_t)i2c_get_match_data(client)) {\ndrivers/hwmon/pmbus/isl68137.c-349-\tcase raa_dmpvr1_2rail:\n--\ndrivers/hwmon/pmbus/lm25066.c=465=static int lm25066_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/lm25066.c-485-\ndrivers/hwmon/pmbus/lm25066.c:486:\tdata-\u003eid = (enum chips)(unsigned long)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/lm25066.c-487-\n--\ndrivers/hwmon/pmbus/max20730.c=661=static int max20730_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/max20730.c-717-\ndrivers/hwmon/pmbus/max20730.c:718:\tchip_id = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/max20730.c-719-\n--\ndrivers/hwmon/pmbus/max34440.c=737=static int max34440_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/max34440.c-745-\t\treturn -ENOMEM;\ndrivers/hwmon/pmbus/max34440.c:746:\tdata-\u003eid = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/max34440.c-747-\tdata-\u003einfo = max34440_info[data-\u003eid];\n--\ndrivers/hwmon/pmbus/mp2856.c=395=static int mp2856_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/mp2856.c-406-\ndrivers/hwmon/pmbus/mp2856.c:407:\tchip_id = (kernel_ulong_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/mp2856.c-408-\n--\ndrivers/hwmon/pmbus/mp2975.c=996=static int mp2975_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/mp2975.c-1002-\ndrivers/hwmon/pmbus/mp2975.c:1003:\tddinfo = i2c_get_match_data(client);\ndrivers/hwmon/pmbus/mp2975.c-1004-\tif (!ddinfo)\n--\ndrivers/hwmon/pmbus/mpq8785.c=130=static int mpq8785_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/mpq8785.c-144-\telse\ndrivers/hwmon/pmbus/mpq8785.c:145:\t\tchip_id = (kernel_ulong_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/mpq8785.c-146-\n--\ndrivers/hwmon/pmbus/pmbus.c=164=static int pmbus_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/pmbus.c-174-\ndrivers/hwmon/pmbus/pmbus.c:175:\tdevice_info = (struct pmbus_device_info )i2c_get_match_data(client);\ndrivers/hwmon/pmbus/pmbus.c-176-\tif (device_info-\u003eflags) {\n--\ndrivers/hwmon/pmbus/q54sj108a2.c=281=static int q54sj108a2_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/q54sj108a2.c-297-\ndrivers/hwmon/pmbus/q54sj108a2.c:298:\tchip_id = (enum chips)(uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/q54sj108a2.c-299-\n--\ndrivers/hwmon/pmbus/tps53679.c=250=static int tps53679_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/tps53679.c-255-\ndrivers/hwmon/pmbus/tps53679.c:256:\tchip_id = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/tps53679.c-257-\n--\ndrivers/hwmon/pmbus/xdp720.c=76=static int xdp720_probe(struct i2c_client client)\n--\ndrivers/hwmon/pmbus/xdp720.c-86-\ndrivers/hwmon/pmbus/xdp720.c:87:\tdata-\u003eid = (enum xdp720_chip_id)(uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/pmbus/xdp720.c-88-\tdata-\u003einfo = xdp720_info;\n--\ndrivers/hwmon/powr1220.c=274=static int powr1220_probe(struct i2c_client client)\n--\ndrivers/hwmon/powr1220.c-286-\ndrivers/hwmon/powr1220.c:287:\tchip = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/powr1220.c-288-\tswitch (chip) {\n--\ndrivers/hwmon/sht3x.c=875=static int sht3x_probe(struct i2c_client client)\n--\ndrivers/hwmon/sht3x.c-903-\tdata-\u003eclient = client;\ndrivers/hwmon/sht3x.c:904:\tdata-\u003echip_id = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/sht3x.c-905-\tcrc8_populate_msb(sht3x_crc8_table, SHT3X_CRC8_POLYNOMIAL);\n--\ndrivers/hwmon/shtc1.c=189=static int shtc1_probe(struct i2c_client client)\n--\ndrivers/hwmon/shtc1.c-195-\tstruct device hwmon_dev;\ndrivers/hwmon/shtc1.c:196:\tenum shtcx_chips chip = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/shtc1.c-197-\tstruct i2c_adapter adap = client-\u003eadapter;\n--\ndrivers/hwmon/thmc50.c=380=static int thmc50_probe(struct i2c_client client)\n--\ndrivers/hwmon/thmc50.c-391-\tdata-\u003eclient = client;\ndrivers/hwmon/thmc50.c:392:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/thmc50.c-393-\tmutex_init(\u0026data-\u003eupdate_lock);\n--\ndrivers/hwmon/tmp108.c=499=static int tmp108_probe(struct i2c_client client)\n--\ndrivers/hwmon/tmp108.c-512-\ndrivers/hwmon/tmp108.c:513:\treturn tmp108_common_probe(dev, regmap, client-\u003ename, i2c_get_match_data(client));\ndrivers/hwmon/tmp108.c-514-}\n--\ndrivers/hwmon/tmp401.c=665=static int tmp401_probe(struct i2c_client client)\n--\ndrivers/hwmon/tmp401.c-680-\tdata-\u003eclient = client;\ndrivers/hwmon/tmp401.c:681:\tdata-\u003ekind = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/tmp401.c-682-\n--\ndrivers/hwmon/tmp421.c=425=static int tmp421_probe(struct i2c_client client)\n--\ndrivers/hwmon/tmp421.c-435-\ndrivers/hwmon/tmp421.c:436:\tdata-\u003echannels = (unsigned long)i2c_get_match_data(client);\ndrivers/hwmon/tmp421.c-437-\tdata-\u003eclient = client;\n--\ndrivers/hwmon/tmp464.c=637=static int tmp464_probe(struct i2c_client client)\n--\ndrivers/hwmon/tmp464.c-651-\ndrivers/hwmon/tmp464.c:652:\tdata-\u003echannels = (int)(unsigned long)i2c_get_match_data(client);\ndrivers/hwmon/tmp464.c-653-\n--\ndrivers/hwmon/tmp513.c=712=static int tmp51x_probe(struct i2c_client client)\n--\ndrivers/hwmon/tmp513.c-722-\ndrivers/hwmon/tmp513.c:723:\tdata-\u003emax_channels = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/tmp513.c-724-\n--\ndrivers/hwmon/w83781d.c=1195=static int w83781d_probe(struct i2c_client client)\n--\ndrivers/hwmon/w83781d.c-1208-\ndrivers/hwmon/w83781d.c:1209:\tdata-\u003etype = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/w83781d.c-1210-\tdata-\u003eclient = client;\n--\ndrivers/hwmon/w83795.c=2137=static int w83795_probe(struct i2c_client client)\n--\ndrivers/hwmon/w83795.c-2149-\ti2c_set_clientdata(client, data);\ndrivers/hwmon/w83795.c:2150:\tdata-\u003echip_type = (uintptr_t)i2c_get_match_data(client);\ndrivers/hwmon/w83795.c-2151-\tdata-\u003ebank = i2c_smbus_read_byte_data(client, W83795_REG_BANKSEL);\n--\ndrivers/i2c/i2c-core-base.c=119=EXPORT_SYMBOL_GPL(i2c_match_id);\ndrivers/i2c/i2c-core-base.c-120-\ndrivers/i2c/i2c-core-base.c:121:const void i2c_get_match_data(const struct i2c_client client)\ndrivers/i2c/i2c-core-base.c-122-{\n--\ndrivers/i2c/i2c-core-base.c-137-}\ndrivers/i2c/i2c-core-base.c:138:EXPORT_SYMBOL(i2c_get_match_data);\ndrivers/i2c/i2c-core-base.c-139-\n--\ndrivers/iio/accel/adxl313_i2c.c=64=static int adxl313_i2c_probe(struct i2c_client client)\n--\ndrivers/iio/accel/adxl313_i2c.c-73-\t /\ndrivers/iio/accel/adxl313_i2c.c:74:\tchip_data = i2c_get_match_data(client);\ndrivers/iio/accel/adxl313_i2c.c-75-\n--\ndrivers/iio/accel/adxl355_i2c.c=22=static int adxl355_i2c_probe(struct i2c_client client)\n--\ndrivers/iio/accel/adxl355_i2c.c-27-\ndrivers/iio/accel/adxl355_i2c.c:28:\tchip_data = i2c_get_match_data(client);\ndrivers/iio/accel/adxl355_i2c.c-29-\tif (!chip_data)\n--\ndrivers/iio/accel/adxl372_i2c.c=20=static int adxl372_i2c_probe(struct i2c_client client)\n--\ndrivers/iio/accel/adxl372_i2c.c-26-\ndrivers/iio/accel/adxl372_i2c.c:27:\tchip_info = i2c_get_match_data(client);\ndrivers/iio/accel/adxl372_i2c.c-28-\n--\ndrivers/iio/accel/adxl380_i2c.c=20=static int adxl380_i2c_probe(struct i2c_client client)\n--\ndrivers/iio/accel/adxl380_i2c.c-24-\ndrivers/iio/accel/adxl380_i2c.c:25:\tchip_data = i2c_get_match_data(client);\ndrivers/iio/accel/adxl380_i2c.c-26-\n--\ndrivers/iio/accel/bma180.c=917=static int bma180_probe(struct i2c_client client)\n--\ndrivers/iio/accel/bma180.c-931-\tdata-\u003eclient = client;\ndrivers/iio/accel/bma180.c:932:\tdata-\u003epart_info = i2c_get_match_data(client);\ndrivers/iio/accel/bma180.c-933-\n--\ndrivers/iio/accel/da280.c=100=static int da280_probe(struct i2c_client client)\n--\ndrivers/iio/accel/da280.c-110-\ndrivers/iio/accel/da280.c:111:\tmatch_data = i2c_get_match_data(client);\ndrivers/iio/accel/da280.c-112-\tif (!match_data) {\n--\ndrivers/iio/accel/kionix-kx022a-i2c.c=15=static int kx022a_i2c_probe(struct i2c_client i2c)\n--\ndrivers/iio/accel/kionix-kx022a-i2c.c-25-\ndrivers/iio/accel/kionix-kx022a-i2c.c:26:\tchip_info = i2c_get_match_data(i2c);\ndrivers/iio/accel/kionix-kx022a-i2c.c-27-\tif (!chip_info)\n--\ndrivers/iio/accel/mc3230.c=143=static int mc3230_probe(struct i2c_client client)\n--\ndrivers/iio/accel/mc3230.c-149-\ndrivers/iio/accel/mc3230.c:150:\tchip_info = i2c_get_match_data(client);\ndrivers/iio/accel/mc3230.c-151-\tif (chip_info == NULL) {\n--\ndrivers/iio/accel/mma8452.c=1548=static int mma8452_probe(struct i2c_client client)\n--\ndrivers/iio/accel/mma8452.c-1562-\ndrivers/iio/accel/mma8452.c:1563:\tdata-\u003echip_info = i2c_get_match_data(client);\ndrivers/iio/accel/mma8452.c-1564-\tif (!data-\u003echip_info)\n--\ndrivers/iio/adc/ltc2309.c=202=static int ltc2309_probe(struct i2c_client client)\n--\ndrivers/iio/adc/ltc2309.c-213-\tltc2309 = iio_priv(indio_dev);\ndrivers/iio/adc/ltc2309.c:214:\tchip_info = i2c_get_match_data(client);\ndrivers/iio/adc/ltc2309.c-215-\n--\ndrivers/iio/adc/ltc2497.c=95=static int ltc2497_probe(struct i2c_client client)\n--\ndrivers/iio/adc/ltc2497.c-115-\ndrivers/iio/adc/ltc2497.c:116:\tchip_info = i2c_get_match_data(client);\ndrivers/iio/adc/ltc2497.c-117-\tst-\u003ecommon_ddata.chip_info = chip_info;\n--\ndrivers/iio/adc/max1363.c=1557=static int max1363_probe(struct i2c_client client)\n--\ndrivers/iio/adc/max1363.c-1575-\ndrivers/iio/adc/max1363.c:1576:\tst-\u003echip_info = i2c_get_match_data(client);\ndrivers/iio/adc/max1363.c-1577-\tst-\u003eclient = client;\n--\ndrivers/iio/adc/max34408.c=193=static int max34408_probe(struct i2c_client client)\n--\ndrivers/iio/adc/max34408.c-202-\ndrivers/iio/adc/max34408.c:203:\tmodel_data = i2c_get_match_data(client);\ndrivers/iio/adc/max34408.c-204-\tif (!model_data)\n--\ndrivers/iio/adc/nct7201.c=407=static int nct7201_probe(struct i2c_client client)\n--\ndrivers/iio/adc/nct7201.c-414-\ndrivers/iio/adc/nct7201.c:415:\tmodel_data = i2c_get_match_data(client);\ndrivers/iio/adc/nct7201.c-416-\tif (!model_data)\n--\ndrivers/iio/adc/pac1934.c=1481=static int pac1934_probe(struct i2c_client client)\n--\n\n" }
23/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 38543 output: 43 thoughts: 33 Thoughts: Here's my summary, as if I were thinking these thoughts: Diving into the I2C Core: Understanding `i2c_get_match_data` Okay, time to dig into this I2C core and figure out what's really happening. I'm going to head straight for `i2c_get_match_data` in `drivers/i2c/i2c-core-base.c`. I need to understand how devices are matched and how data is associated with those matches within this driver. This function is probably central to that process. Let's see how it handles the device probing and initialization flow; I'm expecting this to be a key piece of the puzzle. I anticipate it's likely responsible for determining the "best match" and retrieving associated platform-specific data. Let's see if my understanding is correct.
24/2	2026/08/19 21:23	tool	read-file	0m Args: { "File": "drivers/i2c/i2c-core-base.c", "FirstLine": 119, "LineCount": 30 } Results: { "Contents": " 119:\tEXPORT_SYMBOL_GPL(i2c_match_id);\n 120:\t\n 121:\tconst void i2c_get_match_data(const struct i2c_client client)\n 122:\t{\n 123:\t\tstruct i2c_driver driver = to_i2c_driver(client-\u003edev.driver);\n 124:\t\tconst struct i2c_device_id match;\n 125:\t\tconst void data;\n 126:\t\n 127:\t\tdata = device_get_match_data(\u0026client-\u003edev);\n 128:\t\tif (!data) {\n 129:\t\t\tmatch = i2c_match_id(driver-\u003eid_table, client);\n 130:\t\t\tif (!match)\n 131:\t\t\t\treturn NULL;\n 132:\t\n 133:\t\t\tdata = (const void )match-\u003edriver_data;\n 134:\t\t}\n 135:\t\n 136:\t\treturn data;\n 137:\t}\n 138:\tEXPORT_SYMBOL(i2c_get_match_data);\n 139:\t\n 140:\tstatic int i2c_device_match(struct device dev, const struct device_driver drv)\n 141:\t{\n 142:\t\tstruct i2c_client\tclient = i2c_verify_client(dev);\n 143:\t\tconst struct i2c_driver\tdriver;\n 144:\t\n 145:\t\n 146:\t\t/* Attempt an OF style match */\n 147:\t\tif (i2c_of_match_device(drv-\u003eof_match_table, client))\n 148:\t\t\treturn 1;\n" }
25/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 39270 output: 43 thoughts: 670 Thoughts: Analyzing I2C Device Instantiation and Match Data Okay, so I was pondering this `device_get_match_data` function and how it interacts with I2C devices. It struck me: does this function actually work for I2C devices instantiated through sysfs? Let me re-examine this. Looking at the implementation, it's calling `fwnode_call_ptr_op` on the device's fwnode. If there isn't an fwnode, it returns NULL. Now, I remember that `i2c_device_probe` uses `i2c_of_match_device` which relies on `sysfs_streq` to match the client name with the compatible string in the match table. But, `device_get_match_data` doesn't know about this sysfs-based I2C matching. It resides in `drivers/base/property.c` and depends on the fwnode. Digging deeper into `fwnode_call_ptr_op`, if the device doesn't have a fwnode (which is the case for sysfs-instantiated devices), then it also returns NULL. So, `device_get_match_data` will, indeed, return NULL for sysfs-instantiated I2C devices. This is a potential problem for `st_nci_i2c_probe`, which calls `device_get_match_data(dev)`. If the device is created via sysfs, then `dev_fwnode(dev)` is NULL, and thus `device_get_match_data` returns NULL. This means that `phy->raw_nci` will be zero. But, wait... if `phy->raw_nci` is zero, doesn't the driver behave exactly as before? The key here is whether we can instantiate it with a fwnode. I thought about syzkaller and its `syz_i2c_setup` call. Does that create a device tree node? No, it doesn't dynamically modify the device tree. However, it does use `i2c_new_client_device` with `info.type` set to the driver name. So, even if the device is created with `syz_i2c_setup` it passes the name. If the name is `"st21nfcd"`, it will match the OF table via `i2c_of_match_device_sysfs` during probe. But, crucially, `device_get_match_data` still returns NULL! Which would mean `phy->raw_nci` will be zero. Ah, so this returns NULL for sysfs devices is actually a known issue, isn't it? That's why many drivers correctly use `i2c_get_match_data(client)` instead of `device_get_match_data(dev)`! This makes sense. But, darn it, `st_nci_i2c_probe` is still using `device_get_match_data(dev)`. Let me go check `st_nci_i2c_probe` in `drivers/nfc/st-nci/i2c.c`... to confirm the implications.
26/2	2026/08/19 21:23	tool	read-file	0m Args: { "File": "drivers/nfc/st-nci/i2c.c", "FirstLine": 250, "LineCount": 30 } Results: { "Contents": " 250:\t\n 251:\t\tif (!i2c_check_functionality(client-\u003eadapter, I2C_FUNC_I2C)) {\n 252:\t\t\tnfc_err(\u0026client-\u003edev, \"Need I2C_FUNC_I2C\\n\");\n 253:\t\t\treturn -ENODEV;\n 254:\t\t}\n 255:\t\n 256:\t\tphy = devm_kzalloc(dev, sizeof(struct st_nci_i2c_phy), GFP_KERNEL);\n 257:\t\tif (!phy)\n 258:\t\t\treturn -ENOMEM;\n 259:\t\n 260:\t\tphy-\u003ei2c_dev = client;\n 261:\t\tphy-\u003eraw_nci = (uintptr_t)device_get_match_data(dev) ==\n 262:\t\t\t\tST_NCI_I2C_PROTO_RAW_NCI;\n 263:\t\n 264:\t\ti2c_set_clientdata(client, phy);\n 265:\t\n 266:\t\tr = devm_acpi_dev_add_driver_gpios(dev, acpi_st_nci_gpios);\n 267:\t\tif (r)\n 268:\t\t\tdev_dbg(dev, \"Unable to add GPIO mapping table\\n\");\n 269:\t\n 270:\t\t/* Get RESET GPIO */\n 271:\t\tphy-\u003egpiod_reset = devm_gpiod_get(dev, \"reset\", GPIOD_OUT_HIGH);\n 272:\t\tif (IS_ERR(phy-\u003egpiod_reset)) {\n 273:\t\t\tnfc_err(dev, \"Unable to get RESET GPIO\\n\");\n 274:\t\t\treturn -ENODEV;\n 275:\t\t}\n 276:\t\n 277:\t\tr = devm_regulator_get_enable_optional(dev, \"vdd-io\");\n 278:\t\tif (r \u0026\u0026 r != -ENODEV)\n 279:\t\t\treturn dev_err_probe(dev, r, \"failed to enable vdd-io\\n\");\n" }
27/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 41243 output: 36 thoughts: 248 Thoughts: My Line of Reasoning Okay, so I'm trying to understand this code. First, a crucial point: `device_get_match_data` returns NULL when there's no fwnode associated with the device. Right. But what about devices initialized through ACPI? Ah, with ACPI, `device_get_match_data` does work as expected. However, syzkaller, the fuzzer I'm looking at, doesn't use ACPI for device instantiation. Hold on, syzkaller can use `syz_i2c_setup` to create I2C devices. But does that create an fwnode? No, it just calls `i2c_new_client_device`. So, if `device_get_match_data` returns NULL, `phy->raw_nci` will be zero. I need to figure out other paths to reach this code. Is there another way the code could be triggered? What about the fallback of `device_get_match_data` to `device_driver`? Wait a minute... I seem to recall that the behavior of `device_get_match_data` changed around Linux 6.2 or so, right? It now falls back to using the device driver match data. I really need to confirm that. Let me double-check the implementation of `device_get_match_data` in `drivers/base/property.c` again. That's the key.
28/2	2026/08/19 21:23	tool	read-file	0m Args: { "File": "drivers/base/property.c", "FirstLine": 1347, "LineCount": 20 } Results: { "Contents": "1347:\tEXPORT_SYMBOL(fwnode_graph_parse_endpoint);\n1348:\t\n1349:\tconst void device_get_match_data(const struct device dev)\n1350:\t{\n1351:\t\treturn fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);\n1352:\t}\n1353:\tEXPORT_SYMBOL_GPL(device_get_match_data);\n1354:\t\n1355:\tstatic unsigned int fwnode_graph_devcon_matches(const struct fwnode_handle fwnode,\n1356:\t\t\t\t\t\t\tconst char con_id, void data,\n1357:\t\t\t\t\t\t\tdevcon_match_fn_t match,\n1358:\t\t\t\t\t\t\tvoid matches,\n1359:\t\t\t\t\t\t\tunsigned int matches_len)\n1360:\t{\n1361:\t\tstruct fwnode_handle node;\n1362:\t\tstruct fwnode_handle ep;\n1363:\t\tunsigned int count = 0;\n1364:\t\tvoid ret;\n1365:\t\n1366:\t\tfwnode_graph_for_each_endpoint(fwnode, ep) {\n" }
29/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 42183 output: 25 thoughts: 40 Thoughts: Okay, here's my take on those thoughts, framed as my own mental process, given my expertise: Diving into the Function Call Chain Hmm, so `device_get_match_data` exclusively relies on `fwnode_call_ptr_op`. That's interesting, but not entirely unexpected. Now, I need to understand what `fwnode_call_ptr_op` is actually doing. It’s the linchpin here, the thing that’s ultimately responsible for providing the match data, if that’s even what it is doing. What data is it using? What are the possible call sites or arguments? What are the potential side effects? It's time to dig into that function and trace the operations it’s making. I need to figure out what it's calling and how it's processing the data. Let’s see what's what.
30/2	2026/08/19 21:23	tool	grepper	0m Args: { "Expression": "#define fwnode_call_ptr_op" } Results: { "Output": "include/linux/fwnode.h=140=struct fwnode_operations {\n--\ninclude/linux/fwnode.h-198-\ninclude/linux/fwnode.h:199:#define fwnode_call_ptr_op(fwnode, op, ...)\t\t\\\ninclude/linux/fwnode.h-200-\t(fwnode_has_op(fwnode, op) ?\t\t\t\\\n" }
31/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 42565 output: 37 thoughts: 27 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Diving into the `fwnode_call_ptr_op` Macro Okay, time to refresh my memory on the internal workings of the firmware node system. Let's start by looking directly at the definition of `fwnode_call_ptr_op` in `include/linux/fwnode.h`. I'm particularly interested in how this macro handles indirect function calls within the fwnode context. I want to see exactly how it achieves type-safety and how it deals with potential null pointers or other error conditions within the underlying `fwnode` structure. Understanding this macro is key to tracing through how the device tree information is accessed and utilized within the kernel. I'll need to pay close attention to the argument passing mechanism and any potential optimizations or compiler-specific quirks involved. Let's see how they've handled the error checking.
32/2	2026/08/19 21:23	tool	read-file	0m Args: { "File": "include/linux/fwnode.h", "FirstLine": 198, "LineCount": 10 } Results: { "Contents": " 198:\t\n 199:\t#define fwnode_call_ptr_op(fwnode, op, ...)\t\t\\\n 200:\t\t(fwnode_has_op(fwnode, op) ?\t\t\t\\\n 201:\t\t (fwnode)-\u003eops-\u003eop(fwnode, ## __VA_ARGS__) : NULL)\n 202:\t#define fwnode_call_void_op(fwnode, op, ...)\t\t\t\t\\\n 203:\t\tdo {\t\t\t\t\t\t\t\t\\\n 204:\t\t\tif (fwnode_has_op(fwnode, op))\t\t\t\t\\\n 205:\t\t\t\t(fwnode)-\u003eops-\u003eop(fwnode, ## __VA_ARGS__);\t\\\n 206:\t\t} while (false)\n 207:\t\n" }
33/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 43042 output: 43 thoughts: 555 Thoughts: Deep Dive into Device Instantiation and Match Data Okay, so if `fwnode` is NULL, `fwnode_has_op` just returns false, which logically makes `device_get_match_data` return NULL. But I'm pondering how this interacts with OF devices. Right, OF devices do have an fwnode, and their `device_get_match_data` is handled by `of_fwnode_ops`, specifically `of_fwnode_device_get_match_data`. Got it. Now, a device instantiated via sysfs, that won't have an fwnode. That means `device_get_match_data` will be NULL. Aha! So, if `device_get_match_data` returns NULL, `phy->raw_nci` becomes 0. That's key, because it means the new code paths I'm worried about, the ones that depend on `raw_nci`, won't execute if the device comes up through sysfs. That's a relief, but is that always the case? Okay, let's explore if there are other ways to instantiate this device with an fwnode. Syzkaller can use `syz_i2c_setup` which I know doesn't create an fwnode. Hmm, what about `mac80211_hwsim` or other such mechanisms? This is, after all, an I2C device. Is there some virtual I2C controller that does create fwnodes? Probably not. Syzkaller doesn't have a way to generate OF nodes dynamically. Wait, the Device Tree overlay feature! Syzkaller can load device tree overlays, right? Oh right, but Syzkaller doesn't load them by default. Alright, what if the device is instantiated via `i2c_new_client_device` with `info.type` set to `"st21nfcd"`? That seems promising, but if `info.type` is `"st21nfcd"`, `i2c_of_match_device_sysfs` should match it, and then `device_get_match_data` will still return NULL. Wait, wait, let's trace this. `i2c_of_match_device_sysfs` is called by `i2c_device_match`, and that, in turn, is called by the driver core. Now, does the driver core do something, like set `dev->driver_data`? No, no, it looks like `i2c_of_match_device_sysfs` just returns the `of_device_id` match. Right, so `device_get_match_data` doesn't actually use that match data! But...wait... didn't someone introduce `i2c_get_match_data` specifically to solve this kind of issue? Let me go check `drivers/i2c/i2c-core-base.c`. I have a feeling that's the key.
34/2	2026/08/19 21:23	tool	read-file	0m Args: { "File": "drivers/i2c/i2c-core-base.c", "FirstLine": 121, "LineCount": 20 } Results: { "Contents": " 121:\tconst void i2c_get_match_data(const struct i2c_client client)\n 122:\t{\n 123:\t\tstruct i2c_driver driver = to_i2c_driver(client-\u003edev.driver);\n 124:\t\tconst struct i2c_device_id match;\n 125:\t\tconst void data;\n 126:\t\n 127:\t\tdata = device_get_match_data(\u0026client-\u003edev);\n 128:\t\tif (!data) {\n 129:\t\t\tmatch = i2c_match_id(driver-\u003eid_table, client);\n 130:\t\t\tif (!match)\n 131:\t\t\t\treturn NULL;\n 132:\t\n 133:\t\t\tdata = (const void )match-\u003edriver_data;\n 134:\t\t}\n 135:\t\n 136:\t\treturn data;\n 137:\t}\n 138:\tEXPORT_SYMBOL(i2c_get_match_data);\n 139:\t\n 140:\tstatic int i2c_device_match(struct device dev, const struct device_driver drv)\n" }
35/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 44631 output: 43 thoughts: 605 Thoughts: My Analysis of the `st_nci` I2C Driver's Device Matching and `raw_nci` Initialization Okay, here's the deal. I'm looking at this `st_nci` I2C driver and trying to understand how `phy->raw_nci` gets initialized. It seems like the code flow hinges on `device_get_match_data`. If that returns NULL, then `i2c_get_match_data` is called as a fallback which uses `i2c_match_id` with the driver's ID table. The problem is that the `st_nci_i2c_id_table` only contains `"st_nci"` and nothing else, meaning no `driver_data` is associated with the device ID. Thus, the fallback via `i2c_get_match_data` also always returns NULL. So, if `device_get_match_data` and `i2c_get_match_data` return NULL, that means `phy->raw_nci` ends up being 0. That makes the new code paths for `raw_nci` completely unreachable if the device is instantiated via sysfs or `syz_i2c_setup`! This is assuming the device can even be instantiated that way... Now, the question that is burning in my mind is: can we even get a fwnode to be used? Could a device tree with `st,st21nfcd` work somehow? Syzkaller uses a fixed device tree for ARM and ARM64, but on x86, it typically uses ACPI or no device tree. Hang on, Syzkaller primarily fuzzes x86_64, right? On x86_64, there's no device tree by default unless it's UML or something. And Syzkaller can use `syz_i2c_setup` on x86_64. So if `phy->raw_nci` is always 0, then these new code paths are simply never getting hit. Let's quickly check whether `device_get_match_data` can return something on x86_64. Oh wait, `device_get_match_data` was changed around Linux 6.6! Let me dig into the current version in `drivers/base/property.c` again. Right, it's: ```c const void device_get_match_data(const struct device dev) { return fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev); } ``` Okay, so it calls a fwnode operation. I should probably check how `i2c_device_probe` sets up the fwnode or something. Let me go look at `i2c_device_probe` in `drivers/i2c/i2c-core-base.c`.
36/2	2026/08/19 21:23	tool	read-file	0m Args: { "File": "drivers/i2c/i2c-core-base.c", "FirstLine": 491, "LineCount": 50 } Results: { "Contents": " 491:\tstatic int i2c_device_probe(struct device dev)\n 492:\t{\n 493:\t\tstruct fwnode_handle\tfwnode = dev_fwnode(dev);\n 494:\t\tstruct i2c_client\tclient = i2c_verify_client(dev);\n 495:\t\tstruct i2c_driver\tdriver;\n 496:\t\tbool do_power_on;\n 497:\t\tint status;\n 498:\t\n 499:\t\tif (!client)\n 500:\t\t\treturn 0;\n 501:\t\n 502:\t\tclient-\u003eirq = client-\u003einit_irq;\n 503:\t\n 504:\t\tif (!client-\u003eirq) {\n 505:\t\t\tint irq = -ENOENT;\n 506:\t\n 507:\t\t\tif (client-\u003eflags \u0026 I2C_CLIENT_HOST_NOTIFY) {\n 508:\t\t\t\tdev_dbg(dev, \"Using Host Notify IRQ\\n\");\n 509:\t\t\t\t/* Keep adapter active when Host Notify is required /\n 510:\t\t\t\tpm_runtime_get_sync(\u0026client-\u003eadapter-\u003edev);\n 511:\t\t\t\tirq = i2c_smbus_host_notify_to_irq(client);\n 512:\t\t\t} else if (is_of_node(fwnode)) {\n 513:\t\t\t\tirq = fwnode_irq_get_byname(fwnode, \"irq\");\n 514:\t\t\t\tif (irq == -EINVAL \|\| irq == -ENODATA)\n 515:\t\t\t\t\tirq = fwnode_irq_get(fwnode, 0);\n 516:\t\t\t} else if (is_acpi_device_node(fwnode)) {\n 517:\t\t\t\tbool wake_capable;\n 518:\t\n 519:\t\t\t\tirq = i2c_acpi_get_irq(client, \u0026wake_capable);\n 520:\t\t\t\tif (irq \u003e 0 \u0026\u0026 wake_capable)\n 521:\t\t\t\t\tclient-\u003eflags \|= I2C_CLIENT_WAKE;\n 522:\t\t\t}\n 523:\t\t\tif (irq == -EPROBE_DEFER) {\n 524:\t\t\t\tstatus = dev_err_probe(dev, irq, \"can't get irq\\n\");\n 525:\t\t\t\tgoto put_sync_adapter;\n 526:\t\t\t}\n 527:\t\n 528:\t\t\tif (irq \u003c 0)\n 529:\t\t\t\tirq = 0;\n 530:\t\n 531:\t\t\tclient-\u003eirq = irq;\n 532:\t\t}\n 533:\t\n 534:\t\tdriver = to_i2c_driver(dev-\u003edriver);\n 535:\t\n 536:\t\t/\n 537:\t\t * An I2C ID table is not mandatory, if and only if, a suitable OF\n 538:\t\t * or ACPI ID table is supplied for the probing device.\n 539:\t\t */\n 540:\t\tif (!driver-\u003eid_table \u0026\u0026\n" }
37/2	2026/08/19 21:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 46760 output: 24 thoughts: 668 Thoughts: Analyzing the Patch's Impact on the Driver Okay, so the `device_get_match_data` function is key here, and it calls `fwnode_call_ptr_op`. If the device is instantiated through sysfs, `dev_fwnode(dev)` will be NULL. This means `device_get_match_data` returns NULL. I need to figure out how syzkaller interacts with this, though. Does syzkaller even use software nodes (swnode) in this context? No, it doesn't appear to for I2C devices. So, `phy->raw_nci` will be zero, which is the crux of the issue. Let's look at the actual patch itself, though. It introduces `vdd-io` and `clocks` properties: it attempts to get and enable a regulator, and a clock, both optionally. If they aren't there, it just moves on. It then sets `phy->raw_nci` to zero. After that `ndlc_probe` is called with the `ST_NCI_FRAME_HEADROOM` value because `raw_nci` is 0. Finally, `phy->ndlc->raw_nci` is set to `phy->raw_nci`, which is still zero. Effectively, the driver behaves exactly as it did before the patch! But, just in case, is there any other way for `device_get_match_data` to return non-NULL? What about if the driver is probed via device tree? Does syzkaller run on QEMU, and does QEMU include this device in its device tree? Hmm, no, QEMU's `virt` machine doesn't have `st,st21nfcd`. Wait, syzkaller can boot with a custom device tree if configured, but usually it doesn't. Okay, okay, what about syzkaller's pseudo-syscalls? Does it have a relevant function, like `syz_i2c_setup`? Nope, `syz_i2c_setup` just creates an I2C device with a given name. Can syzkaller set `raw_nci` using `syz_genetlink` or something similar? No. Alright, so the only way `raw_nci` can be set is via `device_get_match_data(dev)`. And because `device_get_match_data` returns NULL, `raw_nci` is zero. I better double check that `device_get_match_data` doesn't magically fall back to `of_match_table` when `fwnode` is NULL. Let me just go back and review the implementation of `device_get_match_data` to be absolutely certain...
38/2	2026/08/19 21:24	tool	grepper	0m Args: { "Expression": "const void \\device_get_match_data" } Results:* { "Output": "drivers/base/property.c=1347=EXPORT_SYMBOL(fwnode_graph_parse_endpoint);\ndrivers/base/property.c-1348-\ndrivers/base/property.c:1349:const void device_get_match_data(const struct device dev)\ndrivers/base/property.c-1350-{\n--\ninclude/linux/property.h=499=enum dev_dma_attr device_get_dma_attr(const struct device dev);\ninclude/linux/property.h-500-\ninclude/linux/property.h:501:const void device_get_match_data(const struct device *dev);\ninclude/linux/property.h-502-\n" }
39/2	2026/08/19 21:24	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 48257 output: 36 thoughts: 15 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Analyzing `device_get_match_data` Okay, time to revisit `device_get_match_data`. I need to refresh my understanding of how this routine functions, especially given the context of the recent changes to the system. Let me quickly step through it again, keeping a mental checklist of the key areas I'll want to focus on: the data structure it operates on, any potential race conditions I should be on the lookout for, and the algorithms used for matching devices. Specifically, I should pay close attention to the handling of edge cases and error conditions, to see if there are any subtle bugs or performance bottlenecks lurking within the code. Let's see if the logic flow remains as I remember it, or if those recent changes introduced any new wrinkles. Ultimately, my aim here is to either validate that the function remains robust and efficient, or to identify potential areas that require further scrutiny or optimization. I should ensure the data structures it relies on are still appropriate for the current scale of operations. Right, let's dive in.
40/2	2026/08/19 21:24	tool	read-file	0m Args: { "File": "drivers/base/property.c", "FirstLine": 1349, "LineCount": 10 } Results: { "Contents": "1349:\tconst void device_get_match_data(const struct device dev)\n1350:\t{\n1351:\t\treturn fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);\n1352:\t}\n1353:\tEXPORT_SYMBOL_GPL(device_get_match_data);\n1354:\t\n1355:\tstatic unsigned int fwnode_graph_devcon_matches(const struct fwnode_handle fwnode,\n1356:\t\t\t\t\t\t\tconst char con_id, void data,\n1357:\t\t\t\t\t\t\tdevcon_match_fn_t match,\n1358:\t\t\t\t\t\t\tvoid *matches,\n" }
41/2	2026/08/19 21:24	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 48739 output: 21 thoughts: 910 Thoughts: Analyzing the Impact of the Code Change Okay, so I'm looking at this code and immediately see it's calling `fwnode_call_ptr_op` on `fwnode`. If `dev_fwnode(dev)` is NULL, the whole thing returns NULL. The question is, when isn't `dev_fwnode(dev)` NULL? For an I2C device created from userspace, it should always be NULL, right? Userspace creation doesn't attach an fwnode. But what about ACPI enumeration? Syzkaller doesn't use custom ACPI tables, so no. Device tree? Nope, same issue. Wait... are there ways to create "software nodes" from userspace that I'm forgetting? No, not really. So, in the context of Syzkaller, `device_get_match_data` should always return NULL. If `device_get_match_data` is NULL, then `raw_nci` becomes 0. That's the key. With `raw_nci` at 0, the driver should behave the same as before. Let's make sure. Okay, checking for other changes... `devm_regulator_get_enable_optional` and `devm_clk_get_optional_enabled` are called. Those are optional calls, and if those regulators or clocks aren't there (which they won't be), it continues. Then it gets the "ese-present" property with `device_property_read_bool`, which was already there. Then we hit `ndlc_probe`. In `ndlc_probe`, since `raw_nci` is 0, we're passing `ST_NCI_FRAME_HEADROOM`. Then it sets `phy->ndlc->raw_nci` to `phy->raw_nci` which is zero. So, `ndlc->raw_nci` is 0. Looking at `ndlc_close`, `ndlc_send`, `llt_ndlc_send_queue`, `llt_ndlc_rcv_queue`, and `st_nci_discover_se`, they all check `raw_nci` and act accordingly, but `raw_nci` is zero. So, they all behave the same as before. Is there any scenario where this change does something functional? No, because `raw_nci` is always zero. Hang on... could `device_get_match_data` ever return something other than NULL, even if we're missing something about the fwnode? What if the driver itself has an `of_match_table` and `device_get_match_data` falls back to that? Wait, no. `device_get_match_data` doesn't fall back to the driver's match data. Okay, let me double-check the code for `device_get_match_data` again, in `drivers/base/property.c`. Yup: It just calls `fwnode_call_ptr_op` on `dev_fwnode(dev)`. There is no fallback to the driver data. Now I remember, did they change this in Linux 6.2 or so to have some fallback? Let me check quickly if there is another implementation of `device_get_match_data`. Nope. It should always be NULL, and the code should behave exactly the same way. The change is functionally inert in our environment.
42/2	2026/08/19 21:24	tool	grepper	0m Args: { "Expression": "device_get_match_data" } Results: { "Output": "\nFull output is too long, showing 500 out of 9265 lines.\nUse more precise expression if possible.\n\narch/arm/mach-imx/mmdc.c=473=static int imx_mmdc_perf_init(struct platform_device pdev, void __iomem mmdc_base,\n--\narch/arm/mach-imx/mmdc.c-509-\tpmu_mmdc-\u003emmdc_ipg_clk = mmdc_ipg_clk;\narch/arm/mach-imx/mmdc.c:510:\tpmu_mmdc-\u003edevtype_data = device_get_match_data(\u0026pdev-\u003edev);\narch/arm/mach-imx/mmdc.c-511-\n--\narch/powerpc/platforms/83xx/suspend.c=344=static int pmc_probe(struct platform_device ofdev)\n--\narch/powerpc/platforms/83xx/suspend.c-350-\narch/powerpc/platforms/83xx/suspend.c:351:\ttype = of_device_get_match_data(\u0026ofdev-\u003edev);\narch/powerpc/platforms/83xx/suspend.c-352-\tif (!type)\n--\narch/powerpc/sysdev/cpm_gpio.c=20=static int cpm_gpio_probe(struct platform_device ofdev)\n--\narch/powerpc/sysdev/cpm_gpio.c-22-\tstruct device dev = \u0026ofdev-\u003edev;\narch/powerpc/sysdev/cpm_gpio.c:23:\tint (gp_add)(struct device dev) = of_device_get_match_data(dev);\narch/powerpc/sysdev/cpm_gpio.c-24-\n--\narch/powerpc/sysdev/fsl_msi.c=393=static int fsl_of_msi_probe(struct platform_device dev)\n--\narch/powerpc/sysdev/fsl_msi.c-403-\narch/powerpc/sysdev/fsl_msi.c:404:\tfeatures = device_get_match_data(\u0026dev-\u003edev);\narch/powerpc/sysdev/fsl_msi.c-405-\n--\narch/sparc/kernel/pci_sabre.c=460=static int sabre_probe(struct platform_device op)\n--\narch/sparc/kernel/pci_sabre.c-470-\narch/sparc/kernel/pci_sabre.c:471:\thummingbird_p = (uintptr_t)device_get_match_data(\u0026op-\u003edev);\narch/sparc/kernel/pci_sabre.c-472-\tif (!hummingbird_p) {\n--\narch/sparc/kernel/pci_schizo.c=1465=static int schizo_probe(struct platform_device op)\narch/sparc/kernel/pci_schizo.c-1466-{\narch/sparc/kernel/pci_schizo.c:1467:\tunsigned long chip_type = (unsigned long)device_get_match_data(\u0026op-\u003edev);\narch/sparc/kernel/pci_schizo.c-1468-\n--\ndrivers/acpi/bus.c=1081=EXPORT_SYMBOL_GPL(acpi_match_device);\ndrivers/acpi/bus.c-1082-\ndrivers/acpi/bus.c:1083:const void acpi_device_get_match_data(const struct device dev)\ndrivers/acpi/bus.c-1084-{\n--\ndrivers/acpi/bus.c-1101-}\ndrivers/acpi/bus.c:1102:EXPORT_SYMBOL_GPL(acpi_device_get_match_data);\ndrivers/acpi/bus.c-1103-\n--\ndrivers/acpi/property.c=1596=static const void \ndrivers/acpi/property.c:1597:acpi_fwnode_device_get_match_data(const struct fwnode_handle fwnode,\ndrivers/acpi/property.c-1598-\t\t\t\t const struct device dev)\ndrivers/acpi/property.c-1599-{\ndrivers/acpi/property.c:1600:\treturn acpi_device_get_match_data(dev);\ndrivers/acpi/property.c-1601-}\n--\ndrivers/acpi/property.c=1725=static int acpi_fwnode_irq_get(const struct fwnode_handle fwnode,\n--\ndrivers/acpi/property.c-1740-\t\t.device_is_available = acpi_fwnode_device_is_available, \\\ndrivers/acpi/property.c:1741:\t\t.device_get_match_data = acpi_fwnode_device_get_match_data, \\\ndrivers/acpi/property.c-1742-\t\t.device_dma_supported =\t\t\t\t\\\n--\ndrivers/ata/ahci_dwc.c=109=static struct ahci_host_priv ahci_dwc_get_resources(struct platform_device pdev)\n--\ndrivers/ata/ahci_dwc.c-118-\tdpriv-\u003epdev = pdev;\ndrivers/ata/ahci_dwc.c:119:\tdpriv-\u003epdata = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/ata/ahci_dwc.c-120-\tif (!dpriv-\u003epdata)\n--\ndrivers/ata/ahci_imx.c=858=static int imx_ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_imx.c-872-\timxpriv-\u003efirst_time = true;\ndrivers/ata/ahci_imx.c:873:\timxpriv-\u003etype = (unsigned long)device_get_match_data(dev);\ndrivers/ata/ahci_imx.c-874-\n--\ndrivers/ata/ahci_mvebu.c=185=static int ahci_mvebu_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_mvebu.c-190-\ndrivers/ata/ahci_mvebu.c:191:\tpdata = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/ata/ahci_mvebu.c-192-\tif (!pdata)\n--\ndrivers/ata/ahci_platform.c=42=static int ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_platform.c-60-\ndrivers/ata/ahci_platform.c:61:\tport = device_get_match_data(dev);\ndrivers/ata/ahci_platform.c-62-\tif (!port)\n--\ndrivers/ata/ahci_tegra.c=515=static int tegra_ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_tegra.c-532-\ttegra-\u003epdev = pdev;\ndrivers/ata/ahci_tegra.c:533:\ttegra-\u003esoc = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/ata/ahci_tegra.c-534-\n--\ndrivers/ata/ahci_xgene.c=727=static int xgene_ahci_probe(struct platform_device pdev)\n--\ndrivers/ata/ahci_xgene.c-775-\tif (dev-\u003eof_node) {\ndrivers/ata/ahci_xgene.c:776:\t\tversion = (unsigned long)of_device_get_match_data(dev);\ndrivers/ata/ahci_xgene.c-777-\t}\n--\ndrivers/ata/sata_rcar.c=859=static int sata_rcar_probe(struct platform_device pdev)\n--\ndrivers/ata/sata_rcar.c-873-\ndrivers/ata/sata_rcar.c:874:\tpriv-\u003etype = (unsigned long)of_device_get_match_data(dev);\ndrivers/ata/sata_rcar.c-875-\n--\ndrivers/auxdisplay/img-ascii-lcd.c=228=static int img_ascii_lcd_probe(struct platform_device pdev)\n--\ndrivers/auxdisplay/img-ascii-lcd.c-230-\tstruct device dev = \u0026pdev-\u003edev;\ndrivers/auxdisplay/img-ascii-lcd.c:231:\tconst struct img_ascii_lcd_config cfg = device_get_match_data(dev);\ndrivers/auxdisplay/img-ascii-lcd.c-232-\tstruct img_ascii_lcd_ctx ctx;\n--\ndrivers/base/property.c=1347=EXPORT_SYMBOL(fwnode_graph_parse_endpoint);\ndrivers/base/property.c-1348-\ndrivers/base/property.c:1349:const void device_get_match_data(const struct device dev)\ndrivers/base/property.c-1350-{\ndrivers/base/property.c:1351:\treturn fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);\ndrivers/base/property.c-1352-}\ndrivers/base/property.c:1353:EXPORT_SYMBOL_GPL(device_get_match_data);\ndrivers/base/property.c-1354-\n--\ndrivers/bluetooth/btmtkuart.c=828=static int btmtkuart_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/btmtkuart.c-837-\ndrivers/bluetooth/btmtkuart.c:838:\tbdev-\u003edata = of_device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/btmtkuart.c-839-\tif (!bdev-\u003edata)\n--\ndrivers/bluetooth/btnxpuart.c=1821=static int nxp_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/btnxpuart.c-1831-\ndrivers/bluetooth/btnxpuart.c:1832:\tnxpdev-\u003enxp_data = (struct btnxpuart_data )device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/btnxpuart.c-1833-\n--\ndrivers/bluetooth/hci_aml.c=680=static int aml_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_aml.c-697-\ndrivers/bluetooth/hci_aml.c:698:\tamldev-\u003eaml_dev_data = device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/hci_aml.c-699-\n--\ndrivers/bluetooth/hci_bcm.c=1505=static int bcm_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_bcm.c-1545-\ndrivers/bluetooth/hci_bcm.c:1546:\tdata = device_get_match_data(bcmdev-\u003edev);\ndrivers/bluetooth/hci_bcm.c-1547-\tif (data) {\n--\ndrivers/bluetooth/hci_h5.c=855=static int h5_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_h5.c-883-\t} else {\ndrivers/bluetooth/hci_h5.c:884:\t\tdata = of_device_get_match_data(dev);\ndrivers/bluetooth/hci_h5.c-885-\t\tif (!data)\n--\ndrivers/bluetooth/hci_mrvl.c=462=static int mrvl_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_mrvl.c-464-\tstruct mrvl_serdev mrvldev;\ndrivers/bluetooth/hci_mrvl.c:465:\tconst struct hci_uart_proto mrvl_proto = device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/hci_mrvl.c-466-\n--\ndrivers/bluetooth/hci_qca.c=2392=static int qca_serdev_probe(struct serdev_device serdev)\n--\ndrivers/bluetooth/hci_qca.c-2404-\tqcadev-\u003eserdev_hu.serdev = serdev;\ndrivers/bluetooth/hci_qca.c:2405:\tdata = device_get_match_data(\u0026serdev-\u003edev);\ndrivers/bluetooth/hci_qca.c-2406-\tserdev_device_set_drvdata(serdev, qcadev);\n--\ndrivers/bus/imx-aipstz.c=49=static int imx_aipstz_probe(struct platform_device pdev)\n--\ndrivers/bus/imx-aipstz.c-62-\ndrivers/bus/imx-aipstz.c:63:\tdata-\u003edefault_cfg = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/bus/imx-aipstz.c-64-\n--\ndrivers/bus/imx-weim.c=206=static int weim_parse_dt(struct platform_device pdev)\ndrivers/bus/imx-weim.c-207-{\ndrivers/bus/imx-weim.c:208:\tconst struct imx_weim_devtype devtype = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/bus/imx-weim.c-209-\tint ret = 0, have_child = 0;\n--\ndrivers/bus/simple-pm-bus.c=77=static void simple_pm_bus_remove(struct platform_device pdev)\ndrivers/bus/simple-pm-bus.c-78-{\ndrivers/bus/simple-pm-bus.c:79:\tconst void data = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/bus/simple-pm-bus.c-80-\n--\ndrivers/bus/stm32_rifsc.c=605=static int stm32_rifsc_register_debugfs(struct stm32_firewall_controller rifsc_controller,\n--\ndrivers/bus/stm32_rifsc.c-618-\trifsc_priv-\u003enb_risal = nb_risal;\ndrivers/bus/stm32_rifsc.c:619:\trifsc_priv-\u003eres_names = of_device_get_match_data(rifsc_controller-\u003edev);\ndrivers/bus/stm32_rifsc.c-620-\n--\ndrivers/bus/ti-sysc.c=2863=static int sysc_init_match(struct sysc ddata)\n--\ndrivers/bus/ti-sysc.c-2866-\ndrivers/bus/ti-sysc.c:2867:\tcap = of_device_get_match_data(ddata-\u003edev);\ndrivers/bus/ti-sysc.c-2868-\tif (!cap)\n--\ndrivers/cache/sifive_ccache.c=256=static int sifive_ccache_probe(struct platform_device pdev)\n--\ndrivers/cache/sifive_ccache.c-261-\ndrivers/cache/sifive_ccache.c:262:\tquirks = (unsigned long)device_get_match_data(dev);\ndrivers/cache/sifive_ccache.c-263-\n--\ndrivers/char/hw_random/atmel-rng.c=114=static int atmel_trng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/atmel-rng.c-130-\t\treturn PTR_ERR(trng-\u003eclk);\ndrivers/char/hw_random/atmel-rng.c:131:\tdata = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/atmel-rng.c-132-\tif (!data)\n--\ndrivers/char/hw_random/bcm2835-rng.c=143=static int bcm2835_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/bcm2835-rng.c-175-\t\t/* Check for rng init function, execute it /\ndrivers/char/hw_random/bcm2835-rng.c:176:\t\tof_data = of_device_get_match_data(dev);\ndrivers/char/hw_random/bcm2835-rng.c-177-\t\tif (of_data)\n--\ndrivers/char/hw_random/exynos-trng.c=183=static int exynos_trng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/exynos-trng.c-194-\ndrivers/char/hw_random/exynos-trng.c:195:\ttrng-\u003eflags = (unsigned long)device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/exynos-trng.c-196-\n--\ndrivers/char/hw_random/ingenic-rng.c=83=static int ingenic_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/ingenic-rng.c-97-\ndrivers/char/hw_random/ingenic-rng.c:98:\tpriv-\u003eversion = (enum ingenic_rng_version)(uintptr_t)of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/ingenic-rng.c-99-\n--\ndrivers/char/hw_random/meson-rng.c=86=static int meson_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/meson-rng.c-96-\ndrivers/char/hw_random/meson-rng.c:97:\tpriv = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/meson-rng.c-98-\tif (!priv)\n--\ndrivers/char/hw_random/mtk-rng.c=165=static int mtk_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/mtk-rng.c-176-\tpriv-\u003erng.quality = 900;\ndrivers/char/hw_random/mtk-rng.c:177:\tpriv-\u003eflags = (unsigned long)device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/mtk-rng.c-178-\n--\ndrivers/char/hw_random/n2-drv.c=697=static int n2rng_probe(struct platform_device op)\n--\ndrivers/char/hw_random/n2-drv.c-706-\tnp-\u003eop = op;\ndrivers/char/hw_random/n2-drv.c:707:\tnp-\u003edata = (struct n2rng_template )device_get_match_data(\u0026op-\u003edev);\ndrivers/char/hw_random/n2-drv.c-708-\n--\ndrivers/char/hw_random/npcm-rng.c=88=static int npcm_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/npcm-rng.c-112-\tpriv-\u003edev = \u0026pdev-\u003edev;\ndrivers/char/hw_random/npcm-rng.c:113:\tpriv-\u003eclkp = (u32)(uintptr_t)of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/npcm-rng.c-114-\n--\ndrivers/char/hw_random/omap-rng.c=375=static int of_get_omap_rng_device_details(struct omap_rng_dev priv,\n--\ndrivers/char/hw_random/omap-rng.c-380-\ndrivers/char/hw_random/omap-rng.c:381:\tpriv-\u003epdata = of_device_get_match_data(dev);\ndrivers/char/hw_random/omap-rng.c-382-\tif (!priv-\u003epdata)\n--\ndrivers/char/hw_random/omap3-rom-rng.c=110=static int omap3_rom_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/omap3-rom-rng.c-121-\tddata-\u003eops.name = \"omap3-rom\";\ndrivers/char/hw_random/omap3-rom-rng.c:122:\tddata-\u003eops.read = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/hw_random/omap3-rom-rng.c-123-\tddata-\u003eops.quality = 900;\n--\ndrivers/char/hw_random/rockchip-rng.c=385=static int rk_rng_probe(struct platform_device pdev)\n--\ndrivers/char/hw_random/rockchip-rng.c-395-\ndrivers/char/hw_random/rockchip-rng.c:396:\trk_rng-\u003esoc_data = of_device_get_match_data(dev);\ndrivers/char/hw_random/rockchip-rng.c-397-\trk_rng-\u003ebase = devm_platform_ioremap_resource(pdev, 0);\n--\ndrivers/char/hw_random/stm32-rng.c=531=static int stm32_rng_probe(struct platform_device ofdev)\n--\ndrivers/char/hw_random/stm32-rng.c-557-\ndrivers/char/hw_random/stm32-rng.c:558:\tpriv-\u003edata = of_device_get_match_data(dev);\ndrivers/char/hw_random/stm32-rng.c-559-\tif (!priv-\u003edata)\n--\ndrivers/char/ipmi/ipmi_si_platform.c=227=static int of_ipmi_probe(struct platform_device pdev)\n--\ndrivers/char/ipmi/ipmi_si_platform.c-268-\tmemset(\u0026io, 0, sizeof(io));\ndrivers/char/ipmi/ipmi_si_platform.c:269:\tio.si_info\t= device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/ipmi/ipmi_si_platform.c-270-\tio.addr_source\t= SI_DEVICETREE;\n--\ndrivers/char/tpm/tpm_tis_spi_main.c=292=static int tpm_tis_spi_driver_probe(struct spi_device spi)\n--\ndrivers/char/tpm/tpm_tis_spi_main.c-296-\ndrivers/char/tpm/tpm_tis_spi_main.c:297:\tprobe_func = of_device_get_match_data(\u0026spi-\u003edev);\ndrivers/char/tpm/tpm_tis_spi_main.c-298-\tif (!probe_func) {\n--\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c=688=static int hwicap_drv_probe(struct platform_device pdev)\n--\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c-694-\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c:695:\tconfig = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/char/xilinx_hwicap/xilinx_hwicap.c-696-\n--\ndrivers/clk/aspeed/clk-aspeed.c=384=static int aspeed_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/aspeed/clk-aspeed.c-416-\t/* SoC generations share common layouts but have different divisors /\ndrivers/clk/aspeed/clk-aspeed.c:417:\tsoc_data = of_device_get_match_data(dev);\ndrivers/clk/aspeed/clk-aspeed.c-418-\tif (!soc_data) {\n--\ndrivers/clk/aspeed/clk-ast2700.c=870=static int ast2700_soc_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/aspeed/clk-ast2700.c-896-\ndrivers/clk/aspeed/clk-ast2700.c:897:\tclk_data = device_get_match_data(dev);\ndrivers/clk/aspeed/clk-ast2700.c-898-\tif (!clk_data)\n--\ndrivers/clk/axs10x/pll_clock.c=217=static int axs10x_pll_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/axs10x/pll_clock.c-243-\tpll_clk-\u003edev = dev;\ndrivers/clk/axs10x/pll_clock.c:244:\tpll_clk-\u003epll_cfg = of_device_get_match_data(dev);\ndrivers/clk/axs10x/pll_clock.c-245-\n--\ndrivers/clk/bcm/clk-bcm2835.c=2267=static int bcm2835_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/bcm/clk-bcm2835.c-2277-\ndrivers/clk/bcm/clk-bcm2835.c:2278:\tpdata = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/bcm/clk-bcm2835.c-2279-\tif (!pdata)\n--\ndrivers/clk/bcm/clk-bcm63xx-gate.c=484=static int clk_bcm63xx_probe(struct platform_device pdev)\n--\ndrivers/clk/bcm/clk-bcm63xx-gate.c-490-\ndrivers/clk/bcm/clk-bcm63xx-gate.c:491:\ttable = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/bcm/clk-bcm63xx-gate.c-492-\tif (!table)\n--\ndrivers/clk/bcm/clk-sr.c=403=static int sr_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/bcm/clk-sr.c-406-\ndrivers/clk/bcm/clk-sr.c:407:\tprobe_func = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/bcm/clk-sr.c-408-\tif (!probe_func)\n--\ndrivers/clk/clk-axi-clkgen.c=566=static int axi_clkgen_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-axi-clkgen.c-577-\ndrivers/clk/clk-axi-clkgen.c:578:\tdflt_limits = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/clk-axi-clkgen.c-579-\tif (!dflt_limits)\n--\ndrivers/clk/clk-en7523.c=596=static struct clk_hw en7523_register_pcie_clk(struct device dev,\n--\ndrivers/clk/clk-en7523.c-598-{\ndrivers/clk/clk-en7523.c:599:\tconst struct en_clk_soc_data soc_data = device_get_match_data(dev);\ndrivers/clk/clk-en7523.c-600-\tstruct clk_init_data init = {\n--\ndrivers/clk/clk-en7523.c=960=static int en7523_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-en7523.c-966-\ndrivers/clk/clk-en7523.c:967:\tsoc_data = device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/clk-en7523.c-968-\n--\ndrivers/clk/clk-eyeq.c=338=static int eqc_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-eyeq.c-347-\ndrivers/clk/clk-eyeq.c:348:\tdata = device_get_match_data(dev);\ndrivers/clk/clk-eyeq.c-349-\tif (!data)\n--\ndrivers/clk/clk-fsl-flexspi.c=47=static int fsl_flexspi_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-fsl-flexspi.c-57-\ndrivers/clk/clk-fsl-flexspi.c:58:\tdivs = device_get_match_data(dev);\ndrivers/clk/clk-fsl-flexspi.c-59-\tif (!divs)\n--\ndrivers/clk/clk-fsl-sai.c=61=static int fsl_sai_clk_register(struct device dev, void __iomem base,\n--\ndrivers/clk/clk-fsl-sai.c-66-{\ndrivers/clk/clk-fsl-sai.c:67:\tconst struct fsl_sai_data data = device_get_match_data(dev);\ndrivers/clk/clk-fsl-sai.c-68-\tstruct clk_parent_data pdata = { .index = 0 };\n--\ndrivers/clk/clk-fsl-sai.c=104=static int fsl_sai_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-fsl-sai.c-106-\tstruct device dev = \u0026pdev-\u003edev;\ndrivers/clk/clk-fsl-sai.c:107:\tconst struct fsl_sai_data data = device_get_match_data(dev);\ndrivers/clk/clk-fsl-sai.c-108-\tstruct fsl_sai_clk sai_clk;\n--\ndrivers/clk/clk-hsdk-pll.c=305=static int hsdk_pll_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-hsdk-pll.c-334-\tpll_clk-\u003edev = dev;\ndrivers/clk/clk-hsdk-pll.c:335:\tpll_clk-\u003epll_devdata = of_device_get_match_data(dev);\ndrivers/clk/clk-hsdk-pll.c-336-\n--\ndrivers/clk/clk-lan966x.c=250=static int lan966x_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-lan966x.c-258-\ndrivers/clk/clk-lan966x.c:259:\tdata = device_get_match_data(dev);\ndrivers/clk/clk-lan966x.c-260-\tif (!data)\n--\ndrivers/clk/clk-lochnagar.c=238=static int lochnagar_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-lochnagar.c-254-\tpriv-\u003eregmap = dev_get_regmap(dev-\u003eparent, NULL);\ndrivers/clk/clk-lochnagar.c:255:\tconf = (struct lochnagar_config )device_get_match_data(dev);\ndrivers/clk/clk-lochnagar.c-256-\n--\ndrivers/clk/clk-loongson2.c=355=static int loongson2_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-loongson2.c-363-\ndrivers/clk/clk-loongson2.c:364:\tdata = device_get_match_data(dev);\ndrivers/clk/clk-loongson2.c-365-\tif (!data)\n--\ndrivers/clk/clk-palmas.c=230=static int palmas_clks_probe(struct platform_device pdev)\n--\ndrivers/clk/clk-palmas.c-237-\ndrivers/clk/clk-palmas.c:238:\tmatch_data = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/clk-palmas.c-239-\tif (!match_data)\n--\ndrivers/clk/davinci/da8xx-cfgchip.c=742=static int da8xx_cfgchip_probe(struct platform_device pdev)\n--\ndrivers/clk/davinci/da8xx-cfgchip.c-748-\ndrivers/clk/davinci/da8xx-cfgchip.c:749:\tclk_init = device_get_match_data(dev);\ndrivers/clk/davinci/da8xx-cfgchip.c-750-\tif (clk_init) {\n--\ndrivers/clk/davinci/pll.c=861=static int davinci_pll_probe(struct platform_device pdev)\n--\ndrivers/clk/davinci/pll.c-867-\ndrivers/clk/davinci/pll.c:868:\tpll_init = device_get_match_data(dev);\ndrivers/clk/davinci/pll.c-869-\tif (!pll_init \u0026\u0026 pdev-\u003eid_entry)\n--\ndrivers/clk/davinci/psc.c=513=static int davinci_psc_probe(struct platform_device pdev)\n--\ndrivers/clk/davinci/psc.c-519-\ndrivers/clk/davinci/psc.c:520:\tinit_data = device_get_match_data(dev);\ndrivers/clk/davinci/psc.c-521-\tif (!init_data \u0026\u0026 pdev-\u003eid_entry)\n--\ndrivers/clk/hisilicon/clk-hi3559a.c=784=static int hi3559av100_crg_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/clk-hi3559a.c-791-\ndrivers/clk/hisilicon/clk-hi3559a.c:792:\tcrg-\u003efuncs = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/hisilicon/clk-hi3559a.c-793-\tif (!crg-\u003efuncs)\n--\ndrivers/clk/hisilicon/clk-hi3660.c=610=static int hi3660_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/clk-hi3660.c-615-\ndrivers/clk/hisilicon/clk-hi3660.c:616:\tinit_func = of_device_get_match_data(dev);\ndrivers/clk/hisilicon/clk-hi3660.c-617-\tif (!init_func)\n--\ndrivers/clk/hisilicon/clk-hi3670.c=989=static int hi3670_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/clk-hi3670.c-994-\ndrivers/clk/hisilicon/clk-hi3670.c:995:\tinit_func = of_device_get_match_data(dev);\ndrivers/clk/hisilicon/clk-hi3670.c-996-\tif (!init_func)\n--\ndrivers/clk/hisilicon/crg-hi3516cv300.c=261=static int hi3516cv300_crg_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/crg-hi3516cv300.c-268-\ndrivers/clk/hisilicon/crg-hi3516cv300.c:269:\tcrg-\u003efuncs = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/hisilicon/crg-hi3516cv300.c-270-\tif (!crg-\u003efuncs)\n--\ndrivers/clk/hisilicon/crg-hi3798cv200.c=344=static int hi3798cv200_crg_probe(struct platform_device pdev)\n--\ndrivers/clk/hisilicon/crg-hi3798cv200.c-351-\ndrivers/clk/hisilicon/crg-hi3798cv200.c:352:\tcrg-\u003efuncs = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/hisilicon/crg-hi3798cv200.c-353-\tif (!crg-\u003efuncs)\n--\ndrivers/clk/imx/clk-imx8-acm.c=332=static int imx8_acm_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8-acm.c-351-\tpriv-\u003ereg = base;\ndrivers/clk/imx/clk-imx8-acm.c:352:\tpriv-\u003esoc_data = of_device_get_match_data(dev);\ndrivers/clk/imx/clk-imx8-acm.c-353-\tplatform_set_drvdata(pdev, priv);\n--\ndrivers/clk/imx/clk-imx8qxp-lpcg.c=286=static int imx8qxp_lpcg_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8qxp-lpcg.c-303-\ndrivers/clk/imx/clk-imx8qxp-lpcg.c:304:\tss_lpcg = of_device_get_match_data(dev);\ndrivers/clk/imx/clk-imx8qxp-lpcg.c-305-\tif (!ss_lpcg)\n--\ndrivers/clk/imx/clk-imx8qxp.c=130=static int imx8qxp_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8qxp.c-135-\ndrivers/clk/imx/clk-imx8qxp.c:136:\trsrc_table = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/imx/clk-imx8qxp.c-137-\tret = imx_clk_scu_init(ccm_node, rsrc_table);\n--\ndrivers/clk/imx/clk-imx8ulp.c=536=static int imx8ulp_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx8ulp.c-539-\ndrivers/clk/imx/clk-imx8ulp.c:540:\tprobe = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/imx/clk-imx8ulp.c-541-\n--\ndrivers/clk/imx/clk-imx93.c=274=static int imx93_clocks_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx93.c-281-\tint i, ret;\ndrivers/clk/imx/clk-imx93.c:282:\tconst unsigned long plat = (unsigned long)device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/imx/clk-imx93.c-283-\n--\ndrivers/clk/imx/clk-imx95-blk-ctl.c=350=static int imx95_bc_probe(struct platform_device pdev)\n--\ndrivers/clk/imx/clk-imx95-blk-ctl.c-381-\ndrivers/clk/imx/clk-imx95-blk-ctl.c:382:\tbc-\u003epdata = of_device_get_match_data(dev);\ndrivers/clk/imx/clk-imx95-blk-ctl.c-383-\tif (!bc-\u003epdata)\n--\ndrivers/clk/keystone/syscon-clk.c=114=static int ti_syscon_gate_clk_probe(struct platform_device pdev)\n--\ndrivers/clk/keystone/syscon-clk.c-123-\ndrivers/clk/keystone/syscon-clk.c:124:\tdata = device_get_match_data(dev);\ndrivers/clk/keystone/syscon-clk.c-125-\tif (!data)\n--\ndrivers/clk/mediatek/clk-mt2701.c=1007=static int clk_mt2701_probe(struct platform_device pdev)\n--\ndrivers/clk/mediatek/clk-mt2701.c-1011-\ndrivers/clk/mediatek/clk-mt2701.c:1012:\tclk_init = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/mediatek/clk-mt2701.c-1013-\tif (!clk_init)\n--\ndrivers/clk/mediatek/clk-mt6765.c=843=static int clk_mt6765_probe(struct platform_device pdev)\n--\ndrivers/clk/mediatek/clk-mt6765.c-847-\ndrivers/clk/mediatek/clk-mt6765.c:848:\tclk_probe = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/mediatek/clk-mt6765.c-849-\tif (!clk_probe)\n--\ndrivers/clk/mediatek/clk-mt6779.c=1277=static int clk_mt6779_probe(struct platform_device pdev)\n--\ndrivers/clk/mediatek/clk-mt6779.c-1281-\ndrivers/clk/mediatek/clk-mt6779.c:1282:\tclk_probe = of_device_get_match_data(\u0026pdev-\u003edev);\ndrivers/clk/mediatek/clk-mt6779.c-1283-\tif (!clk_probe)\n--\ndrivers/clk/mediatek/clk-mt6797.c=679=static int clk_mt6797_probe(struct platform_device *pdev)\n--\ndrivers/clk/mediatek/clk-mt6797.c-683-\ndrivers/clk/mediatek/clk-mt6797.c:684:\tclk_init = of_device_get_match_data(\u0026pdev-\u003edev);\n\n" }
43/2	2026/08/19 21:24	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 61554 output: 36 thoughts: 208 Thoughts: Analyzing Device Matching in the Kernel Okay, so I'm tracing the origin of `device_get_match_data`. Hmm, it looks like the definitive definition resides in `drivers/base/property.c`. Good, let's see if there are any other definitions floating around – no, that's the only one. And it seems that it's just utilizing `fwnode_call_ptr_op`. Now, I'm wondering if `dev->driver->of_match_table` is being accessed directly within `i2c_device_probe`. The structure of I2C probes can sometimes be tricky. Ah, yes, `i2c_device_probe` calls `i2c_of_match_device`. But does it set `client->dev.of_node`? No, it doesn't. Wait a second… I've got it. I recall seeing this change before. Was it… yes! Commit `123456789` introduced a fallback mechanism in `device_get_match_data` to check `dev->driver->of_match_table`. Okay, time to double-check that `device_get_match_data` definition in `drivers/base/property.c` to confirm my understanding. Gotta make sure I'm following the correct execution path.
44/2	2026/08/19 21:24	tool	read-file	0m Args: { "File": "drivers/base/property.c", "FirstLine": 1340, "LineCount": 30 } Results: { "Contents": "1340:\tint fwnode_graph_parse_endpoint(const struct fwnode_handle fwnode,\n1341:\t\t\t\t\tstruct fwnode_endpoint endpoint)\n1342:\t{\n1343:\t\tmemset(endpoint, 0, sizeof(endpoint));\n1344:\t\n1345:\t\treturn fwnode_call_int_op(fwnode, graph_parse_endpoint, endpoint);\n1346:\t}\n1347:\tEXPORT_SYMBOL(fwnode_graph_parse_endpoint);\n1348:\t\n1349:\tconst void device_get_match_data(const struct device dev)\n1350:\t{\n1351:\t\treturn fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);\n1352:\t}\n1353:\tEXPORT_SYMBOL_GPL(device_get_match_data);\n1354:\t\n1355:\tstatic unsigned int fwnode_graph_devcon_matches(const struct fwnode_handle fwnode,\n1356:\t\t\t\t\t\t\tconst char con_id, void data,\n1357:\t\t\t\t\t\t\tdevcon_match_fn_t match,\n1358:\t\t\t\t\t\t\tvoid *matches,\n1359:\t\t\t\t\t\t\tunsigned int matches_len)\n1360:\t{\n1361:\t\tstruct fwnode_handle node;\n1362:\t\tstruct fwnode_handle ep;\n1363:\t\tunsigned int count = 0;\n1364:\t\tvoid ret;\n1365:\t\n1366:\t\tfwnode_graph_for_each_endpoint(fwnode, ep) {\n1367:\t\t\tif (matches \u0026\u0026 count \u003e= matches_len) {\n1368:\t\t\t\tfwnode_handle_put(ep);\n1369:\t\t\t\tbreak;\n" }
45/2	2026/08/19 21:24	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 62585 output: 245 thoughts: 1017 Thoughts: Unreachable Code Paths in the Current Fuzzing Setup Okay, let me think this through. The new code uses `fwnode_call_ptr_op`, but is that really the issue? The crucial point is `dev_fwnode(dev)` and how it gets set. `i2c_new_client_device` takes an `i2c_board_info` which contains an `fwnode_handle`. Does `syz_i2c_setup` set this? No, it doesn't. Alright, so the key seems to be `device_get_match_data`. If that returns NULL, then `raw_nci` is 0. Is there any other way for `raw_nci` to become true? No. So the new paths in the code are unreachable in our syzkaller environment as it stands. But wait a minute, what about device tree instantiation on an ARM board? Syzkaller does run on ARM64 sometimes, like on Android devices, and on QEMU virt. But, QEMU virt doesn't have the `st,st21nfcd` node in the device tree. Hmm. And now I see it, the patch also modifies `arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts`. This implies a specific physical device, the Fairphone 5. Syzkaller doesn't run on a Fairphone 5, that's not our target. So that device tree node won't be present in our QEMU virt environment. Meaning the driver won't be probed via the device tree. If probed via sysfs, then `raw_nci` is 0. Therefore, the functional changes are completely unreachable in the virtualized environment that we use for fuzzing. Hang on… is there a fallback from `device_get_match_data` to `i2c_device_id`? No, that's not how it works. `device_get_match_data` is generic and independent of I2C. What if it was `i2c_get_match_data`? Even then it'd return NULL because `st_nci_i2c_id_table` doesn't include `st21nfcd`. So, there's a disconnect here. The author, likely, intends device tree instantiation, but it won't work that way with sysfs, and probably doesn't care. Since device tree instantiation is required to get `raw_nci = 1`, and we can't provide that device tree node, the new code paths are unreachable. Now I need to double-check something. Can syzkaller inject device tree nodes? No, it can't. It relies on the static device tree at boot. So, `raw_nci` will always be 0. If `raw_nci` is 0, the driver is in its original state. One last thought… the `vdd-io` and `clocks` properties. They are optional ( `devm_regulator_get_enable_optional`, `devm_clk_get_optional_enabled`). If they're missing, the driver will continue without them. So there's absolutely no functional change that can be reached and fuzzed. I'm going to return `WorthFuzzing=false`. In summary: the patch adds support for `st,st21nfcd` using raw NCI via `device_get_match_data(dev) == ST_NCI_I2C_PROTO_RAW_NCI`. This code path is unreachable in a virtualized QEMU environment as it needs a specific device tree node. While syzkaller can instantiate I2C devices, it does not attach an `fwnode`, and `device_get_match_data` will return NULL, causing `raw_nci = 0`. The optional regulator and clock properties will simply be skipped if not available. Therefore, the new code is unreachable in our fuzzing environment.
46/2	2026/08/19 21:24	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch adds support for the `st,st21nfcd` NFC controller, which uses raw NCI instead of NDLC. The `raw_nci` mode is enabled by checking `device_get_match_data(dev) == ST_NCI_I2C_PROTO_RAW_NCI`. In a virtualized environment like QEMU, this device is not present in the static device tree. While syzkaller can instantiate I2C devices via sysfs (`new_device`) or `syz_i2c_setup`, these methods do not attach an `fwnode` to the device. Consequently, `device_get_match_data()` will always return `NULL`, leaving `raw_nci = 0`. When `raw_nci` is 0, the driver behaves exactly as it did before the patch. The newly added regulator and clock properties are optional and will simply be skipped if not present. Therefore, the new code paths are unreachable in the fuzzing environment.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch adds support for the `st,st21nfcd` NFC controller, which uses raw NCI instead of NDLC. The `raw_nci` mode is enabled by checking `device_get_match_data(dev) == ST_NCI_I2C_PROTO_RAW_NCI`. In a virtualized environment like QEMU, this device is not present in the static device tree. While syzkaller can instantiate I2C devices via sysfs (`new_device`) or `syz_i2c_setup`, these methods do not attach an `fwnode` to the device. Consequently, `device_get_match_data()` will always return `NULL`, leaving `raw_nci = 0`. When `raw_nci` is 0, the driver behaves exactly as it did before the patch. The newly added regulator and clock properties are optional and will simply be skipped if not present. Therefore, the new code paths are unreachable in the fuzzing environment.", "WorthFuzzing": false }
47/1	2026/08/19 21:24	action	If	0m Args: { "WorthFuzzing": false } Results: null

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)