AI Trajectory

null

{
  "EnableConfigs": [
    "NFC",
    "NFC_DIGITAL"
  ],
  "FocusSymbols": [
    "digital_tg_recv_dep_req",
    "digital_tg_send_dep_res"
  ],
  "KMSANReasoning": "The patch fixes a missing bounds check in net/nfc/digital_dep.c within digital_tg_recv_dep_req(). Previously, when DIGITAL_NFC_DEP_DID_BIT_SET(pfb) was true, resp-\u003edata[3] was accessed without checking if resp-\u003elen was at least 4 bytes (size + 1), potentially resulting in an out-of-bounds read on the received skb buffer. The patch adds `resp-\u003elen \u003c size + 1` to prevent this out-of-bounds read.\n\nThis is an out-of-bounds read vulnerability, which is detectable by KASAN. The patch does not introduce or manipulate uninitialized stack/heap memory, does not copy kernel data to user space, and does not alter control flow based on uninitialized fields. Thus, KMSAN is not required.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch fixes a bounds check and validation logic in digital_tg_recv_dep_req() when handling DEP (Data Exchange Protocol) request frames with the DID bit set in the NFC digital protocol stack. Previously, reading resp-\u003edata[3] could cause an out-of-bounds access if resp-\u003elen was insufficient. This code is reachable during NFC target mode communication via emulated virtual devices (nfcsim) or USB NFC devices (port100) supported in fuzzing environments.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 18792d11503ffc451da57a5940b9a66e8d66f8bb\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Sep 13 20:39:16 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c\nindex 3982fa084737f..ae5407fca12d4 100644\n--- a/net/nfc/digital_dep.c\n+++ b/net/nfc/digital_dep.c\n@@ -1117,12 +1117,12 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\n \tpfb = dep_req-\u003epfb;\n \n \tif (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {\n-\t\tif (ddev-\u003edid \u0026\u0026 (ddev-\u003edid == resp-\u003edata[3])) {\n-\t\t\tsize++;\n-\t\t} else {\n+\t\tif (resp-\u003elen \u003c size + 1 || !ddev-\u003edid ||\n+\t\t    ddev-\u003edid != resp-\u003edata[size]) {\n \t\t\trc = -EIO;\n \t\t\tgoto exit;\n \t\t}\n+\t\tsize++;\n \t} else if (ddev-\u003edid) {\n \t\trc = -EIO;\n \t\tgoto exit;\n"
}

core

null

{
  "EnableConfigs": [
    "NFC",
    "NFC_DIGITAL"
  ],
  "FocusSymbols": [
    "digital_tg_recv_dep_req",
    "digital_tg_send_dep_res"
  ],
  "Reasoning": "The patch fixes a bounds check and validation logic in digital_tg_recv_dep_req() when handling DEP (Data Exchange Protocol) request frames with the DID bit set in the NFC digital protocol stack. Previously, reading resp-\u003edata[3] could cause an out-of-bounds access if resp-\u003elen was insufficient. This code is reachable during NFC target mode communication via emulated virtual devices (nfcsim) or USB NFC devices (port100) supported in fuzzing environments.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 18792d11503ffc451da57a5940b9a66e8d66f8bb
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Sep 13 20:39:16 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 3982fa084737f..ae5407fca12d4 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -1117,12 +1117,12 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
 	pfb = dep_req->pfb;
 
 	if (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {
-		if (ddev->did && (ddev->did == resp->data[3])) {
-			size++;
-		} else {
+		if (resp->len < size + 1 || !ddev->did ||
+		    ddev->did != resp->data[size]) {
 			rc = -EIO;
 			goto exit;
 		}
+		size++;
 	} else if (ddev->did) {
 		rc = -EIO;
 		goto exit;

gemini-3.8-flash

null

null

							input: 2959
							output: 39
							thoughts: 355
						

**Analyzing the NFC Digital DEP Request Handling**

Okay, let's dive into this patch. I see they're modifying `net/nfc/digital_dep.c`, specifically around line 1117. My initial thought is to quickly understand the context. This looks like it's dealing with Device ID (DID) handling within the Digital DEP protocol. The core of this function, `digital_tg_recv_dep_req`, seems to be processing a received DEP request from a target device.

The main point of the diff is in how they validate the DID. Previously, it checked if `ddev->did` existed and matched `resp->data[3]` when the DID bit was set in `pfb`. Now, it seems like the check is more robust. It's verifying `resp->len` is sufficient to hold the DID, then checks if `ddev->did` is null, or it checks for a mismatch between `ddev->did` and `resp->data[size]`, immediately returning `-EIO` if it fails. The `size++` is now after this check. This appears to be a bug fix or security enhancement, because the old logic, if the DID was not present, would've incremented the size without the check and potentially led to an out-of-bounds read or memory corruption. This change likely addresses a potential vulnerability or logic error where an attacker could send a malformed request and possibly trigger an issue if the `DID` was not found. I'm going to quickly check the surrounding code for similar patterns. It's possible there are other similar issues in this module that also need to be addressed.

{
  "File": "net/nfc/digital_dep.c",
  "FirstLine": 1100,
  "LineCount": 60
}

{
  "Contents": "1100:\t\t\tgoto exit;\n1101:\t\t}\n1102:\t\n1103:\t\tif (resp-\u003elen \u003e ddev-\u003elocal_payload_max) {\n1104:\t\t\trc = -EMSGSIZE;\n1105:\t\t\tgoto exit;\n1106:\t\t}\n1107:\t\n1108:\t\tsize = sizeof(struct digital_dep_req_res);\n1109:\t\tdep_req = (struct digital_dep_req_res *)resp-\u003edata;\n1110:\t\n1111:\t\tif (resp-\u003elen \u003c size || dep_req-\u003edir != DIGITAL_NFC_DEP_FRAME_DIR_OUT ||\n1112:\t\t    dep_req-\u003ecmd != DIGITAL_CMD_DEP_REQ) {\n1113:\t\t\trc = -EIO;\n1114:\t\t\tgoto exit;\n1115:\t\t}\n1116:\t\n1117:\t\tpfb = dep_req-\u003epfb;\n1118:\t\n1119:\t\tif (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {\n1120:\t\t\tif (resp-\u003elen \u003c size + 1 || !ddev-\u003edid ||\n1121:\t\t\t    ddev-\u003edid != resp-\u003edata[size]) {\n1122:\t\t\t\trc = -EIO;\n1123:\t\t\t\tgoto exit;\n1124:\t\t\t}\n1125:\t\t\tsize++;\n1126:\t\t} else if (ddev-\u003edid) {\n1127:\t\t\trc = -EIO;\n1128:\t\t\tgoto exit;\n1129:\t\t}\n1130:\t\n1131:\t\tif (DIGITAL_NFC_DEP_NAD_BIT_SET(pfb)) {\n1132:\t\t\trc = -EIO;\n1133:\t\t\tgoto exit;\n1134:\t\t}\n1135:\t\n1136:\t\tif (size \u003e resp-\u003elen) {\n1137:\t\t\trc = -EIO;\n1138:\t\t\tgoto exit;\n1139:\t\t}\n1140:\t\n1141:\t\tskb_pull(resp, size);\n1142:\t\n1143:\t\tswitch (DIGITAL_NFC_DEP_PFB_TYPE(pfb)) {\n1144:\t\tcase DIGITAL_NFC_DEP_PFB_I_PDU:\n1145:\t\t\tpr_debug(\"DIGITAL_NFC_DEP_PFB_I_PDU\\n\");\n1146:\t\n1147:\t\t\tif (ddev-\u003eatn_count) {\n1148:\t\t\t\t/* The target has received (and replied to) at least one\n1149:\t\t\t\t * ATN DEP_REQ.\n1150:\t\t\t\t */\n1151:\t\t\t\tddev-\u003eatn_count = 0;\n1152:\t\n1153:\t\t\t\t/* pni of resp PDU equal to the target current pni - 1\n1154:\t\t\t\t * means resp is the previous DEP_REQ PDU received from\n1155:\t\t\t\t * the initiator so the target replies with saved_skb\n1156:\t\t\t\t * which is the previous DEP_RES saved in\n1157:\t\t\t\t * digital_tg_send_dep_res().\n1158:\t\t\t\t */\n1159:\t\t\t\tif (DIGITAL_NFC_DEP_PFB_PNI(pfb) ==\n"
}

gemini-3.8-flash

null

null

							input: 4586
							output: 29
							thoughts: 83
						

**Analyzing the NFC Digital Protocol Stack**

Okay, let's dive in. My focus right now is on understanding the `net/nfc/digital_dep.c` file. This is part of the NFC digital protocol stack, and I need to figure out how it fits into the bigger picture. First, I'll need to confirm that `CONFIG_NFC_DIGITAL` is enabled and understand its significance.

I need to understand its role, and how to verify if this is in use. I will next look at how this feature gets used within the kernel and its associated configuration options. Most importantly, I need to determine if this component is accessible or testable within environments like syzkaller or virtualized systems. Is it even reachable?

To get a clearer picture, I should check the Kconfig files within the `net/nfc` directory. That's where the dependencies and enabling conditions will be defined. That should point me in the right direction.

{
  "Expression": "config NFC_DIGITAL",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/Kconfig=6=menuconfig NFC\n--\nnet/nfc/Kconfig-16-\nnet/nfc/Kconfig:17:config NFC_DIGITAL\nnet/nfc/Kconfig-18-\tdepends on NFC\n"
}

gemini-3.8-flash

null

null

							input: 4974
							output: 33
							thoughts: 13
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into the NFC Kconfig**

Alright, let's pull up the `net/nfc/Kconfig` file. I'm assuming we're dealing with the standard Linux kernel source here, so this is where we'll find all the configuration options related to Near Field Communication. I'm immediately looking for the general structure. I'm expecting to see the standard `config` blocks, `bool`, `tristate`, and `string` definitions. I anticipate seeing dependencies, likely on other network-related features or potentially even hardware drivers, especially if NFC controller support is modularized.

I'm keeping an eye out for how they've organized the options. Are they grouped by NFC protocol standards (e.g., NFC-A, NFC-B, NFC-F)? By controller type? Or maybe by feature set, like reader/writer functionality versus peer-to-peer? The organization will tell me a lot about the design philosophy.

My focus will be on the dependencies and defaults. What other kernel features need to be enabled for NFC to work? Are there any hard dependencies, or are most things configurable? Understanding the defaults is key because they dictate the "out-of-the-box" behavior. Are the defaults sensible from a security and usability standpoint? That's what I'll be looking at.

I'll be paying close attention to any "expert" options, if there are any, and how they are explained. Are there clear descriptions of the impact of these options? I want to see if the Kconfig provides sufficient guidance for those who might want to customize the NFC stack for their specific embedded device or application. Finally, I'll skim for any deprecation warnings or anything that points to some of the code being replaced or under development. Always interesting to note the "TODO" entries as well.

{
  "File": "net/nfc/Kconfig",
  "FirstLine": 1,
  "LineCount": 60
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t#\n   3:\t# NFC subsystem configuration\n   4:\t#\n   5:\t\n   6:\tmenuconfig NFC\n   7:\t\tdepends on RFKILL || !RFKILL\n   8:\t\ttristate \"NFC subsystem support\"\n   9:\t\tdefault n\n  10:\t\thelp\n  11:\t\t  Say Y here if you want to build support for NFC (Near field\n  12:\t\t  communication) devices.\n  13:\t\n  14:\t\t  To compile this support as a module, choose M here: the module will\n  15:\t\t  be called nfc.\n  16:\t\n  17:\tconfig NFC_DIGITAL\n  18:\t\tdepends on NFC\n  19:\t\tselect CRC_CCITT\n  20:\t\tselect CRC_ITU_T\n  21:\t\ttristate \"NFC Digital Protocol stack support\"\n  22:\t\tdefault n\n  23:\t\thelp\n  24:\t\t  Say Y if you want to build NFC digital protocol stack support.\n  25:\t\t  This is needed by NFC chipsets whose firmware only implement\n  26:\t\t  the NFC analog layer.\n  27:\t\n  28:\t\t  To compile this support as a module, choose M here: the module will\n  29:\t\t  be called nfc_digital.\n  30:\t\n  31:\tsource \"net/nfc/nci/Kconfig\"\n  32:\tsource \"net/nfc/hci/Kconfig\"\n  33:\t\n  34:\tsource \"drivers/nfc/Kconfig\"\n"
}

gemini-3.8-flash

null

null

							input: 5840
							output: 26
							thoughts: 12
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own:

**Initial Assessment: Decoding NFC_DIGITAL Usage**

Right, let's dive into this. "NFC_DIGITAL." That immediately signals a specific application or functionality within the NFC (Near Field Communication) ecosystem. Given my experience, I'm thinking this likely refers to a digital representation or interface relating to NFC, likely for a particular device driver or software stack. My mind immediately starts running through the potential contexts. Is this related to secure element interactions? Contactless payment implementation? Perhaps it's tied to a specific reader module or a custom NFC protocol? The specificity of "DIGITAL" feels like it's pointing towards a digital encoding or data format layer. So, I need to figure out the drivers that *actually* leverage this digital interface. That's the key to understanding its purpose and potential vulnerabilities. Time to start digging!

{
  "Expression": "CONFIG_NFC_DIGITAL|nfc_digital"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1100 lines.\nUse more precise expression if possible.\n\narch/arm/configs/exynos_defconfig=77=CONFIG_NFC=y\narch/arm/configs/exynos_defconfig:78:CONFIG_NFC_DIGITAL=m\narch/arm/configs/exynos_defconfig-79-CONFIG_NFC_NCI=y\n--\narch/arm/configs/multi_v7_defconfig=168=CONFIG_NFC=m\narch/arm/configs/multi_v7_defconfig:169:CONFIG_NFC_DIGITAL=m\narch/arm/configs/multi_v7_defconfig-170-CONFIG_NFC_NCI=m\n--\ndrivers/nfc/nfcsim.c-15-\ndrivers/nfc/nfcsim.c:16:#define NFCSIM_ERR(d, fmt, args...) nfc_err(\u0026d-\u003enfc_digital_dev-\u003enfc_dev-\u003edev, \\\ndrivers/nfc/nfcsim.c-17-\t\t\t\t\t    \"%s: \" fmt, __func__, ## args)\ndrivers/nfc/nfcsim.c-18-\ndrivers/nfc/nfcsim.c:19:#define NFCSIM_DBG(d, fmt, args...) dev_dbg(\u0026d-\u003enfc_digital_dev-\u003enfc_dev-\u003edev, \\\ndrivers/nfc/nfcsim.c-20-\t\t\t\t\t    \"%s: \" fmt, __func__, ## args)\n--\ndrivers/nfc/nfcsim.c=31=struct nfcsim {\ndrivers/nfc/nfcsim.c:32:\tstruct nfc_digital_dev *nfc_digital_dev;\ndrivers/nfc/nfcsim.c-33-\n--\ndrivers/nfc/nfcsim.c-45-\ndrivers/nfc/nfcsim.c:46:\tnfc_digital_cmd_complete_t cb;\ndrivers/nfc/nfcsim.c-47-\tvoid *arg;\n--\ndrivers/nfc/nfcsim.c=182=static void nfcsim_recv_wq(struct work_struct *work)\n--\ndrivers/nfc/nfcsim.c-197-\ndrivers/nfc/nfcsim.c:198:\tdev-\u003ecb(dev-\u003enfc_digital_dev, dev-\u003earg, skb);\ndrivers/nfc/nfcsim.c-199-}\ndrivers/nfc/nfcsim.c-200-\ndrivers/nfc/nfcsim.c:201:static int nfcsim_send(struct nfc_digital_dev *ddev, struct sk_buff *skb,\ndrivers/nfc/nfcsim.c:202:\t\t       u16 timeout, nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/nfcsim.c-203-{\ndrivers/nfc/nfcsim.c:204:\tstruct nfcsim *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/nfcsim.c-205-\tu8 delay;\n--\ndrivers/nfc/nfcsim.c-239-\ndrivers/nfc/nfcsim.c:240:static void nfcsim_abort_cmd(struct nfc_digital_dev *ddev)\ndrivers/nfc/nfcsim.c-241-{\ndrivers/nfc/nfcsim.c:242:\tconst struct nfcsim *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/nfcsim.c-243-\n--\ndrivers/nfc/nfcsim.c-246-\ndrivers/nfc/nfcsim.c:247:static int nfcsim_switch_rf(struct nfc_digital_dev *ddev, bool on)\ndrivers/nfc/nfcsim.c-248-{\ndrivers/nfc/nfcsim.c:249:\tstruct nfcsim *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/nfcsim.c-250-\n--\ndrivers/nfc/nfcsim.c-255-\ndrivers/nfc/nfcsim.c:256:static int nfcsim_in_configure_hw(struct nfc_digital_dev *ddev,\ndrivers/nfc/nfcsim.c-257-\t\t\t\t\t  int type, int param)\ndrivers/nfc/nfcsim.c-258-{\ndrivers/nfc/nfcsim.c:259:\tstruct nfcsim *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/nfcsim.c-260-\n--\ndrivers/nfc/nfcsim.c-278-\ndrivers/nfc/nfcsim.c:279:static int nfcsim_in_send_cmd(struct nfc_digital_dev *ddev,\ndrivers/nfc/nfcsim.c-280-\t\t\t       struct sk_buff *skb, u16 timeout,\ndrivers/nfc/nfcsim.c:281:\t\t\t       nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/nfcsim.c-282-{\n--\ndrivers/nfc/nfcsim.c-285-\ndrivers/nfc/nfcsim.c:286:static int nfcsim_tg_configure_hw(struct nfc_digital_dev *ddev,\ndrivers/nfc/nfcsim.c-287-\t\t\t\t\t  int type, int param)\ndrivers/nfc/nfcsim.c-288-{\ndrivers/nfc/nfcsim.c:289:\tstruct nfcsim *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/nfcsim.c-290-\n--\ndrivers/nfc/nfcsim.c-308-\ndrivers/nfc/nfcsim.c:309:static int nfcsim_tg_send_cmd(struct nfc_digital_dev *ddev,\ndrivers/nfc/nfcsim.c-310-\t\t\t       struct sk_buff *skb, u16 timeout,\ndrivers/nfc/nfcsim.c:311:\t\t\t       nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/nfcsim.c-312-{\n--\ndrivers/nfc/nfcsim.c-315-\ndrivers/nfc/nfcsim.c:316:static int nfcsim_tg_listen(struct nfc_digital_dev *ddev, u16 timeout,\ndrivers/nfc/nfcsim.c:317:\t\t\t    nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/nfcsim.c-318-{\n--\ndrivers/nfc/nfcsim.c-321-\ndrivers/nfc/nfcsim.c:322:static const struct nfc_digital_ops nfcsim_digital_ops = {\ndrivers/nfc/nfcsim.c-323-\t.in_configure_hw = nfcsim_in_configure_hw,\n--\ndrivers/nfc/nfcsim.c=346=static void nfcsim_debugfs_init_dev(struct nfcsim *dev)\n--\ndrivers/nfc/nfcsim.c-357-\ndrivers/nfc/nfcsim.c:358:\tidx = dev-\u003enfc_digital_dev-\u003enfc_dev-\u003eidx;\ndrivers/nfc/nfcsim.c-359-\tn = snprintf(devname, sizeof(devname), \"nfc%d\", idx);\n--\ndrivers/nfc/nfcsim.c=370=static struct nfcsim *nfcsim_device_new(struct nfcsim_link *link_in,\n--\ndrivers/nfc/nfcsim.c-382-\ndrivers/nfc/nfcsim.c:383:\tdev-\u003enfc_digital_dev =\ndrivers/nfc/nfcsim.c:384:\t\t\tnfc_digital_allocate_device(\u0026nfcsim_digital_ops,\ndrivers/nfc/nfcsim.c-385-\t\t\t\t\t\t    NFC_PROTO_NFC_DEP_MASK,\n--\ndrivers/nfc/nfcsim.c-387-\t\t\t\t\t\t    0, 0);\ndrivers/nfc/nfcsim.c:388:\tif (!dev-\u003enfc_digital_dev) {\ndrivers/nfc/nfcsim.c-389-\t\tkfree(dev);\n--\ndrivers/nfc/nfcsim.c-392-\ndrivers/nfc/nfcsim.c:393:\tnfc_digital_set_drvdata(dev-\u003enfc_digital_dev, dev);\ndrivers/nfc/nfcsim.c-394-\n--\ndrivers/nfc/nfcsim.c-397-\ndrivers/nfc/nfcsim.c:398:\trc = nfc_digital_register_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/nfcsim.c-399-\tif (rc) {\ndrivers/nfc/nfcsim.c-400-\t\tpr_err(\"Could not register digital device (%d)\\n\", rc);\ndrivers/nfc/nfcsim.c:401:\t\tnfc_digital_free_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/nfcsim.c-402-\t\tkfree(dev);\n--\ndrivers/nfc/nfcsim.c=412=static void nfcsim_device_free(struct nfcsim *dev)\ndrivers/nfc/nfcsim.c-413-{\ndrivers/nfc/nfcsim.c:414:\tnfc_digital_unregister_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/nfcsim.c-415-\n--\ndrivers/nfc/nfcsim.c-422-\ndrivers/nfc/nfcsim.c:423:\tnfc_digital_free_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/nfcsim.c-424-\n--\ndrivers/nfc/port100.c=221=in_protocols[][PORT100_IN_MAX_NUM_PROTOCOLS + 1] = {\n--\ndrivers/nfc/port100.c-288-\t[NFC_DIGITAL_FRAMING_NFCA_T1T] = {\ndrivers/nfc/port100.c:289:\t\t/* nfc_digital_framing_nfca_short */\ndrivers/nfc/port100.c-290-\t\t{ PORT100_IN_PROT_ADD_CRC,          2 },\n--\ndrivers/nfc/port100.c-296-\t[NFC_DIGITAL_FRAMING_NFCA_T2T] = {\ndrivers/nfc/port100.c:297:\t\t/* nfc_digital_framing_nfca_standard */\ndrivers/nfc/port100.c-298-\t\t{ PORT100_IN_PROT_ADD_CRC,   1 },\n--\ndrivers/nfc/port100.c-302-\t[NFC_DIGITAL_FRAMING_NFCA_T4T] = {\ndrivers/nfc/port100.c:303:\t\t/* nfc_digital_framing_nfca_standard_with_crc_a */\ndrivers/nfc/port100.c-304-\t\t{ PORT100_IN_PROT_END,       0 },\n--\ndrivers/nfc/port100.c-306-\t[NFC_DIGITAL_FRAMING_NFCA_NFC_DEP] = {\ndrivers/nfc/port100.c:307:\t\t/* nfc_digital_framing_nfca_standard */\ndrivers/nfc/port100.c-308-\t\t{ PORT100_IN_PROT_END, 0 },\n--\ndrivers/nfc/port100.c-332-\t[NFC_DIGITAL_FRAMING_NFCF_T3T] = {\ndrivers/nfc/port100.c:333:\t\t/* nfc_digital_framing_nfcf */\ndrivers/nfc/port100.c-334-\t\t{ PORT100_IN_PROT_END, 0 },\n--\ndrivers/nfc/port100.c-336-\t[NFC_DIGITAL_FRAMING_NFCF_NFC_DEP] = {\ndrivers/nfc/port100.c:337:\t\t/* nfc_digital_framing_nfcf */\ndrivers/nfc/port100.c-338-\t\t{ PORT100_IN_PROT_INITIAL_GUARD_TIME,     18 },\n--\ndrivers/nfc/port100.c-384-\t[NFC_DIGITAL_FRAMING_NFCB_T4T] = {\ndrivers/nfc/port100.c:385:\t\t/* nfc_digital_framing_nfcb */\ndrivers/nfc/port100.c-386-\t\t{ PORT100_IN_PROT_END,                     0 },\n--\ndrivers/nfc/port100.c=439=struct port100 {\ndrivers/nfc/port100.c:440:\tstruct nfc_digital_dev *nfc_digital_dev;\ndrivers/nfc/port100.c-441-\n--\ndrivers/nfc/port100.c=496=struct port100_cb_arg {\ndrivers/nfc/port100.c:497:\tnfc_digital_cmd_complete_t complete_cb;\ndrivers/nfc/port100.c-498-\tvoid *complete_arg;\n--\ndrivers/nfc/port100.c=931=static void port100_send_complete(struct urb *urb)\n--\ndrivers/nfc/port100.c-954-\ndrivers/nfc/port100.c:955:static void port100_abort_cmd(struct nfc_digital_dev *ddev)\ndrivers/nfc/port100.c-956-{\ndrivers/nfc/port100.c:957:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-958-\n--\ndrivers/nfc/port100.c=1025=static u16 port100_get_firmware_version(struct port100 *dev)\n--\ndrivers/nfc/port100.c-1046-\ndrivers/nfc/port100.c:1047:static int port100_switch_rf(struct nfc_digital_dev *ddev, bool on)\ndrivers/nfc/port100.c-1048-{\ndrivers/nfc/port100.c:1049:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1050-\tstruct sk_buff *skb, *resp;\n--\ndrivers/nfc/port100.c-1071-\ndrivers/nfc/port100.c:1072:static int port100_in_set_rf(struct nfc_digital_dev *ddev, u8 rf)\ndrivers/nfc/port100.c-1073-{\ndrivers/nfc/port100.c:1074:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1075-\tstruct sk_buff *skb;\n--\ndrivers/nfc/port100.c-1100-\ndrivers/nfc/port100.c:1101:static int port100_in_set_framing(struct nfc_digital_dev *ddev, int param)\ndrivers/nfc/port100.c-1102-{\ndrivers/nfc/port100.c:1103:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1104-\tconst struct port100_protocol *protocols;\n--\ndrivers/nfc/port100.c-1142-\ndrivers/nfc/port100.c:1143:static int port100_in_configure_hw(struct nfc_digital_dev *ddev, int type,\ndrivers/nfc/port100.c-1144-\t\t\t\t   int param)\n--\ndrivers/nfc/port100.c=1155=static void port100_in_comm_rf_complete(struct port100 *dev, void *arg,\n--\ndrivers/nfc/port100.c-1158-\tconst struct port100_cb_arg *cb_arg = arg;\ndrivers/nfc/port100.c:1159:\tnfc_digital_cmd_complete_t cb = cb_arg-\u003ecomplete_cb;\ndrivers/nfc/port100.c-1160-\tu32 status;\n--\ndrivers/nfc/port100.c-1200-exit:\ndrivers/nfc/port100.c:1201:\tcb(dev-\u003enfc_digital_dev, cb_arg-\u003ecomplete_arg, resp);\ndrivers/nfc/port100.c-1202-\n--\ndrivers/nfc/port100.c-1205-\ndrivers/nfc/port100.c:1206:static int port100_in_send_cmd(struct nfc_digital_dev *ddev,\ndrivers/nfc/port100.c-1207-\t\t\t       struct sk_buff *skb, u16 _timeout,\ndrivers/nfc/port100.c:1208:\t\t\t       nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/port100.c-1209-{\ndrivers/nfc/port100.c:1210:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1211-\tstruct port100_cb_arg *cb_arg;\n--\ndrivers/nfc/port100.c-1228-\ndrivers/nfc/port100.c:1229:static int port100_tg_set_rf(struct nfc_digital_dev *ddev, u8 rf)\ndrivers/nfc/port100.c-1230-{\ndrivers/nfc/port100.c:1231:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1232-\tstruct sk_buff *skb;\n--\ndrivers/nfc/port100.c-1257-\ndrivers/nfc/port100.c:1258:static int port100_tg_set_framing(struct nfc_digital_dev *ddev, int param)\ndrivers/nfc/port100.c-1259-{\ndrivers/nfc/port100.c:1260:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1261-\tconst struct port100_protocol *protocols;\n--\ndrivers/nfc/port100.c-1299-\ndrivers/nfc/port100.c:1300:static int port100_tg_configure_hw(struct nfc_digital_dev *ddev, int type,\ndrivers/nfc/port100.c-1301-\t\t\t\t   int param)\n--\ndrivers/nfc/port100.c=1332=static void port100_tg_comm_rf_complete(struct port100 *dev, void *arg,\n--\ndrivers/nfc/port100.c-1336-\tconst struct port100_cb_arg *cb_arg = arg;\ndrivers/nfc/port100.c:1337:\tnfc_digital_cmd_complete_t cb = cb_arg-\u003ecomplete_cb;\ndrivers/nfc/port100.c-1338-\tstruct port100_tg_comm_rf_res *hdr;\n--\ndrivers/nfc/port100.c-1366-exit:\ndrivers/nfc/port100.c:1367:\tcb(dev-\u003enfc_digital_dev, cb_arg-\u003ecomplete_arg, resp);\ndrivers/nfc/port100.c-1368-\n--\ndrivers/nfc/port100.c-1371-\ndrivers/nfc/port100.c:1372:static int port100_tg_send_cmd(struct nfc_digital_dev *ddev,\ndrivers/nfc/port100.c-1373-\t\t\t       struct sk_buff *skb, u16 timeout,\ndrivers/nfc/port100.c:1374:\t\t\t       nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/port100.c-1375-{\ndrivers/nfc/port100.c:1376:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1377-\tstruct port100_tg_comm_rf_cmd *hdr;\n--\ndrivers/nfc/port100.c-1399-\ndrivers/nfc/port100.c:1400:static int port100_listen_mdaa(struct nfc_digital_dev *ddev,\ndrivers/nfc/port100.c-1401-\t\t\t       struct digital_tg_mdaa_params *params,\ndrivers/nfc/port100.c-1402-\t\t\t       u16 timeout,\ndrivers/nfc/port100.c:1403:\t\t\t       nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/port100.c-1404-{\ndrivers/nfc/port100.c:1405:\tstruct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1406-\tstruct port100_tg_comm_rf_cmd *hdr;\n--\ndrivers/nfc/port100.c-1455-\ndrivers/nfc/port100.c:1456:static int port100_listen(struct nfc_digital_dev *ddev, u16 timeout,\ndrivers/nfc/port100.c:1457:\t\t\t  nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/port100.c-1458-{\ndrivers/nfc/port100.c:1459:\tconst struct port100 *dev = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/port100.c-1460-\tstruct sk_buff *skb;\n--\ndrivers/nfc/port100.c-1468-\ndrivers/nfc/port100.c:1469:static const struct nfc_digital_ops port100_digital_ops = {\ndrivers/nfc/port100.c-1470-\t.in_configure_hw = port100_in_configure_hw,\n--\ndrivers/nfc/port100.c=1489=static int port100_probe(struct usb_interface *interface,\n--\ndrivers/nfc/port100.c-1571-\ndrivers/nfc/port100.c:1572:\tdev-\u003enfc_digital_dev = nfc_digital_allocate_device(\u0026port100_digital_ops,\ndrivers/nfc/port100.c-1573-\t\t\t\t\t\t\t   PORT100_PROTOCOLS,\n--\ndrivers/nfc/port100.c-1576-\t\t\t\t\t\t\t   dev-\u003eskb_tailroom);\ndrivers/nfc/port100.c:1577:\tif (!dev-\u003enfc_digital_dev) {\ndrivers/nfc/port100.c-1578-\t\tnfc_err(\u0026interface-\u003edev,\ndrivers/nfc/port100.c:1579:\t\t\t\"Could not allocate nfc_digital_dev\\n\");\ndrivers/nfc/port100.c-1580-\t\trc = -ENOMEM;\n--\ndrivers/nfc/port100.c-1583-\ndrivers/nfc/port100.c:1584:\tnfc_digital_set_parent_dev(dev-\u003enfc_digital_dev, \u0026interface-\u003edev);\ndrivers/nfc/port100.c:1585:\tnfc_digital_set_drvdata(dev-\u003enfc_digital_dev, dev);\ndrivers/nfc/port100.c-1586-\ndrivers/nfc/port100.c:1587:\trc = nfc_digital_register_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/port100.c-1588-\tif (rc) {\n--\ndrivers/nfc/port100.c-1596-free_nfc_dev:\ndrivers/nfc/port100.c:1597:\tnfc_digital_free_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/port100.c-1598-\n--\ndrivers/nfc/port100.c=1608=static void port100_disconnect(struct usb_interface *interface)\n--\ndrivers/nfc/port100.c-1614-\ndrivers/nfc/port100.c:1615:\tnfc_digital_unregister_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/port100.c:1616:\tnfc_digital_free_device(dev-\u003enfc_digital_dev);\ndrivers/nfc/port100.c-1617-\n--\ndrivers/nfc/st95hf/core.c=185=struct st95_digital_cmd_complete_arg {\ndrivers/nfc/st95hf/core.c-186-\tstruct sk_buff *skb_resp;\ndrivers/nfc/st95hf/core.c:187:\tnfc_digital_cmd_complete_t complete_cb;\ndrivers/nfc/st95hf/core.c-188-\tvoid *cb_usrarg;\n--\ndrivers/nfc/st95hf/core.c=217=struct st95hf_context {\ndrivers/nfc/st95hf/core.c-218-\tstruct st95hf_spi_context spicontext;\ndrivers/nfc/st95hf/core.c:219:\tstruct nfc_digital_dev *ddev;\ndrivers/nfc/st95hf/core.c-220-\tstruct nfc_dev *nfcdev;\n--\ndrivers/nfc/st95hf/core.c=531=static int iso14443_config_fdt(struct st95hf_context *st95context, int wtxm)\n--\ndrivers/nfc/st95hf/core.c-534-\tstruct device *dev = \u0026st95context-\u003espicontext.spidev-\u003edev;\ndrivers/nfc/st95hf/core.c:535:\tstruct nfc_digital_dev *nfcddev = st95context-\u003eddev;\ndrivers/nfc/st95hf/core.c-536-\tunsigned char pp_typeb;\n--\ndrivers/nfc/st95hf/core.c=602=static int st95hf_handle_wtx(struct st95hf_context *stcontext,\n--\ndrivers/nfc/st95hf/core.c-608-\tstruct param_list new_params[1];\ndrivers/nfc/st95hf/core.c:609:\tstruct nfc_digital_dev *nfcddev = stcontext-\u003eddev;\ndrivers/nfc/st95hf/core.c-610-\tstruct device *dev = \u0026stcontext-\u003enfcdev-\u003edev;\n--\ndrivers/nfc/st95hf/core.c=693=static int st95hf_response_handler(struct st95hf_context *stcontext,\n--\ndrivers/nfc/st95hf/core.c-699-\tunsigned char val_mm;\ndrivers/nfc/st95hf/core.c:700:\tstruct nfc_digital_dev *nfcddev = stcontext-\u003eddev;\ndrivers/nfc/st95hf/core.c-701-\tstruct device *dev = \u0026stcontext-\u003enfcdev-\u003edev;\n--\ndrivers/nfc/st95hf/core.c=766=static irqreturn_t st95hf_irq_thread_handler(int irq, void  *st95hfcontext)\n--\ndrivers/nfc/st95hf/core.c-868-/* NFC ops functions definition */\ndrivers/nfc/st95hf/core.c:869:static int st95hf_in_configure_hw(struct nfc_digital_dev *ddev,\ndrivers/nfc/st95hf/core.c-870-\t\t\t\t  int type,\n--\ndrivers/nfc/st95hf/core.c-872-{\ndrivers/nfc/st95hf/core.c:873:\tstruct st95hf_context *stcontext = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/st95hf/core.c-874-\n--\ndrivers/nfc/st95hf/core.c=901=static int rf_off(struct st95hf_context *stcontext)\n--\ndrivers/nfc/st95hf/core.c-914-\ndrivers/nfc/st95hf/core.c:915:static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev,\ndrivers/nfc/st95hf/core.c-916-\t\t\t      struct sk_buff *skb,\ndrivers/nfc/st95hf/core.c-917-\t\t\t      u16 timeout,\ndrivers/nfc/st95hf/core.c:918:\t\t\t      nfc_digital_cmd_complete_t cb,\ndrivers/nfc/st95hf/core.c-919-\t\t\t      void *arg)\ndrivers/nfc/st95hf/core.c-920-{\ndrivers/nfc/st95hf/core.c:921:\tstruct st95hf_context *stcontext = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/st95hf/core.c-922-\tint rc;\n--\ndrivers/nfc/st95hf/core.c-988-/* p2p will be supported in a later release ! */\ndrivers/nfc/st95hf/core.c:989:static int st95hf_tg_configure_hw(struct nfc_digital_dev *ddev,\ndrivers/nfc/st95hf/core.c-990-\t\t\t\t  int type,\n--\ndrivers/nfc/st95hf/core.c-995-\ndrivers/nfc/st95hf/core.c:996:static int st95hf_tg_send_cmd(struct nfc_digital_dev *ddev,\ndrivers/nfc/st95hf/core.c-997-\t\t\t      struct sk_buff *skb,\ndrivers/nfc/st95hf/core.c-998-\t\t\t      u16 timeout,\ndrivers/nfc/st95hf/core.c:999:\t\t\t      nfc_digital_cmd_complete_t cb,\ndrivers/nfc/st95hf/core.c-1000-\t\t\t      void *arg)\n--\ndrivers/nfc/st95hf/core.c-1004-\ndrivers/nfc/st95hf/core.c:1005:static int st95hf_tg_listen(struct nfc_digital_dev *ddev,\ndrivers/nfc/st95hf/core.c-1006-\t\t\t    u16 timeout,\ndrivers/nfc/st95hf/core.c:1007:\t\t\t    nfc_digital_cmd_complete_t cb,\ndrivers/nfc/st95hf/core.c-1008-\t\t\t    void *arg)\n--\ndrivers/nfc/st95hf/core.c-1012-\ndrivers/nfc/st95hf/core.c:1013:static int st95hf_tg_get_rf_tech(struct nfc_digital_dev *ddev, u8 *rf_tech)\ndrivers/nfc/st95hf/core.c-1014-{\n--\ndrivers/nfc/st95hf/core.c-1017-\ndrivers/nfc/st95hf/core.c:1018:static int st95hf_switch_rf(struct nfc_digital_dev *ddev, bool on)\ndrivers/nfc/st95hf/core.c-1019-{\ndrivers/nfc/st95hf/core.c-1020-\tu8 rf_tech;\ndrivers/nfc/st95hf/core.c:1021:\tstruct st95hf_context *stcontext = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/st95hf/core.c-1022-\n--\ndrivers/nfc/st95hf/core.c-1033-/* TODO st95hf_abort_cmd */\ndrivers/nfc/st95hf/core.c:1034:static void st95hf_abort_cmd(struct nfc_digital_dev *ddev)\ndrivers/nfc/st95hf/core.c-1035-{\n--\ndrivers/nfc/st95hf/core.c-1037-\ndrivers/nfc/st95hf/core.c:1038:static const struct nfc_digital_ops st95hf_nfc_digital_ops = {\ndrivers/nfc/st95hf/core.c-1039-\t.in_configure_hw = st95hf_in_configure_hw,\n--\ndrivers/nfc/st95hf/core.c=1063=static int st95hf_probe(struct spi_device *nfc_spi_dev)\n--\ndrivers/nfc/st95hf/core.c-1159-\t/* create NFC dev object and register with NFC Subsystem */\ndrivers/nfc/st95hf/core.c:1160:\tst95context-\u003eddev = nfc_digital_allocate_device(\u0026st95hf_nfc_digital_ops,\ndrivers/nfc/st95hf/core.c-1161-\t\t\t\t\t\t\tST95HF_SUPPORTED_PROT,\n--\ndrivers/nfc/st95hf/core.c-1170-\tst95context-\u003enfcdev = st95context-\u003eddev-\u003enfc_dev;\ndrivers/nfc/st95hf/core.c:1171:\tnfc_digital_set_parent_dev(st95context-\u003eddev, \u0026nfc_spi_dev-\u003edev);\ndrivers/nfc/st95hf/core.c-1172-\ndrivers/nfc/st95hf/core.c:1173:\tret =  nfc_digital_register_device(st95context-\u003eddev);\ndrivers/nfc/st95hf/core.c-1174-\tif (ret) {\n--\ndrivers/nfc/st95hf/core.c-1179-\t/* store st95context in nfc device object */\ndrivers/nfc/st95hf/core.c:1180:\tnfc_digital_set_drvdata(st95context-\u003eddev, st95context);\ndrivers/nfc/st95hf/core.c-1181-\n--\ndrivers/nfc/st95hf/core.c-1187-err_free_digital_device:\ndrivers/nfc/st95hf/core.c:1188:\tnfc_digital_free_device(st95context-\u003eddev);\ndrivers/nfc/st95hf/core.c-1189-err_disable_regulator:\n--\ndrivers/nfc/st95hf/core.c=1196=static void st95hf_remove(struct spi_device *nfc_spi_dev)\n--\ndrivers/nfc/st95hf/core.c-1207-\ndrivers/nfc/st95hf/core.c:1208:\tnfc_digital_unregister_device(stcontext-\u003eddev);\ndrivers/nfc/st95hf/core.c:1209:\tnfc_digital_free_device(stcontext-\u003eddev);\ndrivers/nfc/st95hf/core.c-1210-\tstcontext-\u003enfcdev_free = true;\n--\ndrivers/nfc/trf7970a.c=430=struct trf7970a {\n--\ndrivers/nfc/trf7970a.c-435-\tstruct regulator\t\t*vddio_regulator;\ndrivers/nfc/trf7970a.c:436:\tstruct nfc_digital_dev\t\t*ddev;\ndrivers/nfc/trf7970a.c-437-\tu32\t\t\t\tquirks;\n--\ndrivers/nfc/trf7970a.c-441-\tstruct sk_buff\t\t\t*rx_skb;\ndrivers/nfc/trf7970a.c:442:\tnfc_digital_cmd_complete_t\tcb;\ndrivers/nfc/trf7970a.c-443-\tvoid\t\t\t\t*cb_arg;\n--\ndrivers/nfc/trf7970a.c=1147=static int trf7970a_switch_rf_on(struct trf7970a *trf)\n--\ndrivers/nfc/trf7970a.c-1171-\ndrivers/nfc/trf7970a.c:1172:static int trf7970a_switch_rf(struct nfc_digital_dev *ddev, bool on)\ndrivers/nfc/trf7970a.c-1173-{\ndrivers/nfc/trf7970a.c:1174:\tstruct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1175-\tint ret = 0;\n--\ndrivers/nfc/trf7970a.c=1312=static int trf7970a_in_config_framing(struct trf7970a *trf, int framing)\n--\ndrivers/nfc/trf7970a.c-1386-\ndrivers/nfc/trf7970a.c:1387:static int trf7970a_in_configure_hw(struct nfc_digital_dev *ddev, int type,\ndrivers/nfc/trf7970a.c-1388-\t\t\t\t    int param)\ndrivers/nfc/trf7970a.c-1389-{\ndrivers/nfc/trf7970a.c:1390:\tstruct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1391-\tint ret;\n--\ndrivers/nfc/trf7970a.c=1439=static int trf7970a_per_cmd_config(struct trf7970a *trf,\n--\ndrivers/nfc/trf7970a.c-1507-\ndrivers/nfc/trf7970a.c:1508:static int trf7970a_send_cmd(struct nfc_digital_dev *ddev,\ndrivers/nfc/trf7970a.c-1509-\t\t\t     struct sk_buff *skb, u16 timeout,\ndrivers/nfc/trf7970a.c:1510:\t\t\t     nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/trf7970a.c-1511-{\ndrivers/nfc/trf7970a.c:1512:\tstruct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1513-\tu8 prefix[5];\n--\ndrivers/nfc/trf7970a.c=1670=static int trf7970a_tg_config_framing(struct trf7970a *trf, int framing)\n--\ndrivers/nfc/trf7970a.c-1728-\ndrivers/nfc/trf7970a.c:1729:static int trf7970a_tg_configure_hw(struct nfc_digital_dev *ddev, int type,\ndrivers/nfc/trf7970a.c-1730-\t\t\t\t    int param)\ndrivers/nfc/trf7970a.c-1731-{\ndrivers/nfc/trf7970a.c:1732:\tstruct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1733-\tint ret;\n--\ndrivers/nfc/trf7970a.c-1764-\ndrivers/nfc/trf7970a.c:1765:static int _trf7970a_tg_listen(struct nfc_digital_dev *ddev, u16 timeout,\ndrivers/nfc/trf7970a.c:1766:\t\t\t       nfc_digital_cmd_complete_t cb, void *arg,\ndrivers/nfc/trf7970a.c-1767-\t\t\t       bool mode_detect)\ndrivers/nfc/trf7970a.c-1768-{\ndrivers/nfc/trf7970a.c:1769:\tstruct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1770-\tint ret;\n--\ndrivers/nfc/trf7970a.c-1843-\ndrivers/nfc/trf7970a.c:1844:static int trf7970a_tg_listen(struct nfc_digital_dev *ddev, u16 timeout,\ndrivers/nfc/trf7970a.c:1845:\t\t\t      nfc_digital_cmd_complete_t cb, void *arg)\ndrivers/nfc/trf7970a.c-1846-{\ndrivers/nfc/trf7970a.c:1847:\tconst struct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1848-\n--\ndrivers/nfc/trf7970a.c-1854-\ndrivers/nfc/trf7970a.c:1855:static int trf7970a_tg_listen_md(struct nfc_digital_dev *ddev,\ndrivers/nfc/trf7970a.c:1856:\t\t\t\t u16 timeout, nfc_digital_cmd_complete_t cb,\ndrivers/nfc/trf7970a.c-1857-\t\t\t\t void *arg)\ndrivers/nfc/trf7970a.c-1858-{\ndrivers/nfc/trf7970a.c:1859:\tconst struct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1860-\tint ret;\n--\ndrivers/nfc/trf7970a.c-1877-\ndrivers/nfc/trf7970a.c:1878:static int trf7970a_tg_get_rf_tech(struct nfc_digital_dev *ddev, u8 *rf_tech)\ndrivers/nfc/trf7970a.c-1879-{\ndrivers/nfc/trf7970a.c:1880:\tconst struct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1881-\n--\ndrivers/nfc/trf7970a.c-1889-\ndrivers/nfc/trf7970a.c:1890:static void trf7970a_abort_cmd(struct nfc_digital_dev *ddev)\ndrivers/nfc/trf7970a.c-1891-{\ndrivers/nfc/trf7970a.c:1892:\tstruct trf7970a *trf = nfc_digital_get_drvdata(ddev);\ndrivers/nfc/trf7970a.c-1893-\n--\ndrivers/nfc/trf7970a.c-1916-\ndrivers/nfc/trf7970a.c:1917:static const struct nfc_digital_ops trf7970a_nfc_ops = {\ndrivers/nfc/trf7970a.c-1918-\t.in_configure_hw\t= trf7970a_in_configure_hw,\n--\ndrivers/nfc/trf7970a.c=2045=static int trf7970a_probe(struct spi_device *spi)\n--\ndrivers/nfc/trf7970a.c-2173-\ndrivers/nfc/trf7970a.c:2174:\ttrf-\u003eddev = nfc_digital_allocate_device(\u0026trf7970a_nfc_ops,\ndrivers/nfc/trf7970a.c-2175-\t\t\t\t\t\tTRF7970A_SUPPORTED_PROTOCOLS,\n--\ndrivers/nfc/trf7970a.c-2184-\ndrivers/nfc/trf7970a.c:2185:\tnfc_digital_set_parent_dev(trf-\u003eddev, trf-\u003edev);\ndrivers/nfc/trf7970a.c:2186:\tnfc_digital_set_drvdata(trf-\u003eddev, trf);\ndrivers/nfc/trf7970a.c-2187-\tspi_set_drvdata(spi, trf);\n--\n\n"
}

gemini-3.8-flash

null

null

							input: 18372
							output: 33
							thoughts: 124
						

**Initial Assessment of NFC Driver Landscape**

Okay, here's what's going on. I'm looking at `port100.c` – ah, right, that's a USB driver, specifically located in the `drivers/nfc` directory. Seems like the USB NFC driver. Interesting! And then there's `drivers/nfc/nfcsim.c`, which, based on the name, must be a virtual or simulated NFC driver. This is helpful to know. I've been meaning to dive deeper into the NFC landscape in the kernel.

Now, considering the capabilities of syzkaller, it supports USB fuzzing, specifically utilizing Raw Gadget or USB emulation. This is perfect! That means it can potentially emulate the `port100` USB device, or even the `nfcsim` virtual device. It can also likely interact with NFC netlink / sockets (`AF_NFC`), which is another avenue to explore.

Right, time to dig deeper. I need to understand the function calls, so let's start by checking how `digital_tg_recv_dep_req` is actually invoked.

{
  "Expression": "digital_tg_recv_dep_req",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/digital_dep.c=106=static void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-107-\t\t\t\t    struct sk_buff *resp);\nnet/nfc/digital_dep.c:108:static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-109-\t\t\t\t    struct sk_buff *resp);\n--\nnet/nfc/digital_dep.c=978=static int digital_tg_send_ack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-1012-\nnet/nfc/digital_dep.c:1013:\trc = digital_tg_send_cmd(ddev, skb, 1500, digital_tg_recv_dep_req,\nnet/nfc/digital_dep.c-1014-\t\t\t\t data_exch);\n--\nnet/nfc/digital_dep.c=1024=static int digital_tg_send_atn(struct nfc_digital_dev *ddev)\n--\nnet/nfc/digital_dep.c-1051-\nnet/nfc/digital_dep.c:1052:\trc = digital_tg_send_cmd(ddev, skb, 1500, digital_tg_recv_dep_req,\nnet/nfc/digital_dep.c-1053-\t\t\t\t NULL);\n--\nnet/nfc/digital_dep.c=1060=static int digital_tg_send_saved_skb(struct nfc_digital_dev *ddev)\n--\nnet/nfc/digital_dep.c-1069-\trc = digital_tg_send_cmd(ddev, ddev-\u003esaved_skb, 1500,\nnet/nfc/digital_dep.c:1070:\t\t\t\t digital_tg_recv_dep_req, NULL);\nnet/nfc/digital_dep.c-1071-\tif (rc)\n--\nnet/nfc/digital_dep.c-1076-\nnet/nfc/digital_dep.c:1077:static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-1078-\t\t\t\t    struct sk_buff *resp)\n--\nnet/nfc/digital_dep.c=1297=int digital_tg_send_dep_res(struct nfc_digital_dev *ddev, struct sk_buff *skb)\n--\nnet/nfc/digital_dep.c-1331-\nnet/nfc/digital_dep.c:1332:\trc = digital_tg_send_cmd(ddev, tmp_skb, 1500, digital_tg_recv_dep_req,\nnet/nfc/digital_dep.c-1333-\t\t\t\t NULL);\n--\nnet/nfc/digital_dep.c=1348=static void digital_tg_send_psl_res_complete(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-1359-\nnet/nfc/digital_dep.c:1360:\tdigital_tg_listen(ddev, 1500, digital_tg_recv_dep_req, NULL);\nnet/nfc/digital_dep.c-1361-\n--\nnet/nfc/digital_dep.c=1467=static void digital_tg_send_atr_res_complete(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-1485-\telse\nnet/nfc/digital_dep.c:1486:\t\tdigital_tg_recv_dep_req(ddev, arg, resp);\nnet/nfc/digital_dep.c-1487-}\n"
}

gemini-3.8-flash

null

null

							input: 19793
							output: 32
							thoughts: 580
						

**Analyzing the DEP_REQ Frame Handling in Digital NFC**

Okay, let's break this down. My focus is on `digital_tg_recv_dep_req`, which handles the incoming DEP_REQ frames in target mode within `digital_dep.c`. I need to understand this specific change. First, I'll need to check the commit itself to grasp the bug that's being fixed or the change introduced. I could use `git log` if necessary, or simply examine the commit message and the diff directly.

The provided diff gives me the meat of the change. It seems we're dealing with Device ID (DID) handling within the DEP_REQ frame. Initially, the code had a conditional check for the DID bit being set in the Protocol Format Byte (PFB). If the DID bit was set, and the `ddev->did` was valid, it performed a check on the incoming data. The original check was flawed. The updated version now explicitly checks that the response length (`resp->len`) is sufficient to include the DID byte. It also ensures that the `ddev->did` is valid and that the incoming DID matches the expected value, effectively improving the robustness of the DID validation. This appears to be a crucial fix for ensuring correct DID processing.

Now, I'm going to look at the surrounding code to grasp the context of this change within `digital_tg_recv_dep_req`. I can see the code starts by checking the basic frame structure – size, direction, and command. Then, it proceeds to evaluate the PFB, and the DID check is done if the bit is set in the PFB. It calculates the `size` of the structure. I should check what `sizeof(struct digital_dep_req_res)` actually is. I'll need to find the definition of that structure to fully understand what's going on.

{
  "Expression": "struct digital_dep_req_res",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/digital_dep.c=94=struct digital_psl_res {\n--\nnet/nfc/digital_dep.c-99-\nnet/nfc/digital_dep.c:100:struct digital_dep_req_res {\nnet/nfc/digital_dep.c-101-\tu8 dir;\n--\nnet/nfc/digital_dep.c=200=digital_send_dep_data_prep(struct nfc_digital_dev *ddev, struct sk_buff *skb,\nnet/nfc/digital_dep.c:201:\t\t\t   struct digital_dep_req_res *dep_req_res,\nnet/nfc/digital_dep.c-202-\t\t\t   struct digital_data_exch *data_exch)\n--\nnet/nfc/digital_dep.c=529=static int digital_in_send_ack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-531-{\nnet/nfc/digital_dep.c:532:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-533-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-539-\nnet/nfc/digital_dep.c:540:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-541-\nnet/nfc/digital_dep.c:542:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-543-\n--\nnet/nfc/digital_dep.c=566=static int digital_in_send_nack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-568-{\nnet/nfc/digital_dep.c:569:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-570-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-576-\nnet/nfc/digital_dep.c:577:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-578-\nnet/nfc/digital_dep.c:579:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-580-\n--\nnet/nfc/digital_dep.c=598=static int digital_in_send_atn(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-600-{\nnet/nfc/digital_dep.c:601:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-602-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-608-\nnet/nfc/digital_dep.c:609:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-610-\nnet/nfc/digital_dep.c:611:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-612-\n--\nnet/nfc/digital_dep.c=629=static int digital_in_send_rtox(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-631-{\nnet/nfc/digital_dep.c:632:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-633-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-646-\nnet/nfc/digital_dep.c:647:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-648-\nnet/nfc/digital_dep.c:649:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-650-\n--\nnet/nfc/digital_dep.c=686=static void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-689-\tstruct digital_data_exch *data_exch = arg;\nnet/nfc/digital_dep.c:690:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-691-\tu8 pfb;\n--\nnet/nfc/digital_dep.c-755-\nnet/nfc/digital_dep.c:756:\tsize = sizeof(struct digital_dep_req_res);\nnet/nfc/digital_dep.c:757:\tdep_res = (struct digital_dep_req_res *)resp-\u003edata;\nnet/nfc/digital_dep.c-758-\n--\nnet/nfc/digital_dep.c=904=int digital_in_send_dep_req(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-907-{\nnet/nfc/digital_dep.c:908:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-909-\tstruct sk_buff *chaining_skb, *tmp_skb;\n--\nnet/nfc/digital_dep.c-911-\nnet/nfc/digital_dep.c:912:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-913-\nnet/nfc/digital_dep.c:914:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-915-\n--\nnet/nfc/digital_dep.c=978=static int digital_tg_send_ack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-980-{\nnet/nfc/digital_dep.c:981:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-982-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-988-\nnet/nfc/digital_dep.c:989:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-990-\nnet/nfc/digital_dep.c:991:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-992-\n--\nnet/nfc/digital_dep.c=1024=static int digital_tg_send_atn(struct nfc_digital_dev *ddev)\nnet/nfc/digital_dep.c-1025-{\nnet/nfc/digital_dep.c:1026:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-1027-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-1033-\nnet/nfc/digital_dep.c:1034:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-1035-\nnet/nfc/digital_dep.c:1036:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-1037-\n--\nnet/nfc/digital_dep.c=1077=static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-1080-\tint rc;\nnet/nfc/digital_dep.c:1081:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-1082-\tu8 pfb;\n--\nnet/nfc/digital_dep.c-1107-\nnet/nfc/digital_dep.c:1108:\tsize = sizeof(struct digital_dep_req_res);\nnet/nfc/digital_dep.c:1109:\tdep_req = (struct digital_dep_req_res *)resp-\u003edata;\nnet/nfc/digital_dep.c-1110-\n--\nnet/nfc/digital_dep.c=1297=int digital_tg_send_dep_res(struct nfc_digital_dev *ddev, struct sk_buff *skb)\nnet/nfc/digital_dep.c-1298-{\nnet/nfc/digital_dep.c:1299:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-1300-\tstruct sk_buff *chaining_skb, *tmp_skb;\n--\nnet/nfc/digital_dep.c-1302-\nnet/nfc/digital_dep.c:1303:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-1304-\nnet/nfc/digital_dep.c:1305:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-1306-\n"
}

gemini-3.8-flash

null

null

							input: 23378
							output: 37
							thoughts: 18
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing the `digital_dep_req_res` Struct**

Okay, let's dive into the `struct digital_dep_req_res` definition. My initial thought process is to quickly assess its purpose. I'm expecting this to likely encapsulate the data exchanged during a digital deposit request and response cycle, maybe for financial transactions, API calls, or similar. I'll be looking for key fields that provide clues about the structure. I'll mentally map out, based on industry standards, what essential components are likely to be present: identifiers, timestamps, request data, response codes, any transaction details, potentially error messages if the response represents failure, and perhaps even security-related fields like signatures or hashes. I'll need to rapidly interpret the structure and how it relates to broader systems I am familiar with. My primary considerations will involve potential areas for optimization, security vulnerabilities, or possible inefficiencies. My secondary considerations will look into data type usage, padding, and alignment.

{
  "File": "net/nfc/digital_dep.c",
  "FirstLine": 98,
  "LineCount": 10
}

{
  "Contents": "  98:\t} __packed;\n  99:\t\n 100:\tstruct digital_dep_req_res {\n 101:\t\tu8 dir;\n 102:\t\tu8 cmd;\n 103:\t\tu8 pfb;\n 104:\t} __packed;\n 105:\t\n 106:\tstatic void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\n 107:\t\t\t\t\t    struct sk_buff *resp);\n"
}

gemini-3.8-flash

null

null

							input: 23799
							output: 38
							thoughts: 123
						

**Analyzing `struct digital_dep_req_res` for Potential Vulnerabilities**

Okay, let's dive into this `struct digital_dep_req_res`. I see `dir` (1 byte), `cmd` (1 byte), and `pfb` (1 byte). That sums up to a size of 3 bytes, got it. Now, let's rewind and look at the code *before* this commit, specifically this line: `if (ddev->did && (ddev->did == resp->data[3]))`. Hmm... that `resp->data[3]` is making me twitch. If `resp->len` happens to be exactly 3, we're staring at an out-of-bounds read right in the face. That's a classic mistake!

Just to be absolutely sure I'm not missing anything, I need to check how `digital_in_recv_dep_res` handles this too. Okay, let's take a look at lines 750-780, just to confirm that this is not an issue there as well.

{
  "File": "net/nfc/digital_dep.c",
  "FirstLine": 750,
  "LineCount": 40
}

{
  "Contents": " 750:\t\n 751:\t\tif (resp-\u003elen \u003e ddev-\u003elocal_payload_max) {\n 752:\t\t\trc = -EMSGSIZE;\n 753:\t\t\tgoto exit;\n 754:\t\t}\n 755:\t\n 756:\t\tsize = sizeof(struct digital_dep_req_res);\n 757:\t\tdep_res = (struct digital_dep_req_res *)resp-\u003edata;\n 758:\t\n 759:\t\tif (resp-\u003elen \u003c size || dep_res-\u003edir != DIGITAL_NFC_DEP_FRAME_DIR_IN ||\n 760:\t\t    dep_res-\u003ecmd != DIGITAL_CMD_DEP_RES) {\n 761:\t\t\trc = -EIO;\n 762:\t\t\tgoto error;\n 763:\t\t}\n 764:\t\n 765:\t\tpfb = dep_res-\u003epfb;\n 766:\t\n 767:\t\tif (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {\n 768:\t\t\tPROTOCOL_ERR(\"14.8.2.1\");\n 769:\t\t\trc = -EIO;\n 770:\t\t\tgoto error;\n 771:\t\t}\n 772:\t\n 773:\t\tif (DIGITAL_NFC_DEP_NAD_BIT_SET(pfb)) {\n 774:\t\t\trc = -EIO;\n 775:\t\t\tgoto exit;\n 776:\t\t}\n 777:\t\n 778:\t\tif (size \u003e resp-\u003elen) {\n 779:\t\t\trc = -EIO;\n 780:\t\t\tgoto error;\n 781:\t\t}\n 782:\t\n 783:\t\tskb_pull(resp, size);\n 784:\t\n 785:\t\tswitch (DIGITAL_NFC_DEP_PFB_TYPE(pfb)) {\n 786:\t\tcase DIGITAL_NFC_DEP_PFB_I_PDU:\n 787:\t\t\tif (DIGITAL_NFC_DEP_PFB_PNI(pfb) != ddev-\u003ecurr_nfc_dep_pni) {\n 788:\t\t\t\tPROTOCOL_ERR(\"14.12.3.3\");\n 789:\t\t\t\trc = -EIO;\n"
}

gemini-3.8-flash

null

null

							input: 24799
							output: 28
							thoughts: 440
						

**Analyzing NFC DEP Frame Processing**

Okay, let's break down this `digital_tg_recv_dep_req` function in `net/nfc/digital_dep.c`. This snippet is interesting; it's the core of how Digital Target mode requests are handled. The code checks a couple of key conditions based on the Protocol Frame Bit (PFB):

If the Digital Identification (DID) bit is set in the PFB, then it makes certain assertions about the incoming response data. Specifically, it verifies that the response length is sufficient to include the DID, the device has a valid DID, and the response DID matches the expected DID. An `EIO` error is returned and execution jumps to the `exit` label if these checks fail. If the DID bit is not set, but the device *does* have a DID assigned, it's also considered an error, and `EIO` is returned.

Now, let's figure out *where* this function actually gets called. Time to trace the callers: Looks like `digital_tg_recv_dep_req` is used in multiple scenarios: It's the callback for sending an ACK (`digital_tg_send_ack`), sending an ATN (`digital_tg_send_atn`), sending a saved SKB (`digital_tg_send_saved_skb`), and sending a DEP response (`digital_tg_send_dep_res`). Intriguingly, it's also called via `digital_tg_listen` in `digital_tg_send_psl_res_complete`, and directly in `digital_tg_send_atr_res_complete`.

To get a better understanding of the code flow and use cases, I need to understand how the target mode is entered or how the NFC digital device (`ddev`) is used. I'll search for occurrences of `digital_tg_` within relevant files, specifically `net/nfc/digital_*.c` and `net/nfc/digital_core.c`, to build a clearer picture of the function's broader context and identify the possible entry points for these operations. This will help determine the possible states that need to be considered when debugging this function.

{
  "Expression": "digital_tg_",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/digital.h=48=int digital_send_cmd(struct nfc_digital_dev *ddev, u8 cmd_type,\nnet/nfc/digital.h:49:\t\t     struct sk_buff *skb, struct digital_tg_mdaa_params *params,\nnet/nfc/digital.h-50-\t\t     u16 timeout, nfc_digital_cmd_complete_t cmd_cb,\n--\nnet/nfc/digital.h=83=int digital_in_send_dep_req(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital.h-86-\nnet/nfc/digital.h:87:int digital_tg_configure_hw(struct nfc_digital_dev *ddev, int type, int param);\nnet/nfc/digital.h:88:static inline int digital_tg_send_cmd(struct nfc_digital_dev *ddev,\nnet/nfc/digital.h-89-\t\t\tstruct sk_buff *skb, u16 timeout,\n--\nnet/nfc/digital.h-95-\nnet/nfc/digital.h:96:void digital_tg_recv_sens_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital.h-97-\t\t\t      struct sk_buff *resp);\nnet/nfc/digital.h-98-\nnet/nfc/digital.h:99:void digital_tg_recv_sensf_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital.h-100-\t\t\t       struct sk_buff *resp);\nnet/nfc/digital.h-101-\nnet/nfc/digital.h:102:static inline int digital_tg_listen(struct nfc_digital_dev *ddev, u16 timeout,\nnet/nfc/digital.h-103-\t\t\t\t    nfc_digital_cmd_complete_t cb, void *arg)\n--\nnet/nfc/digital.h-108-\nnet/nfc/digital.h:109:void digital_tg_recv_atr_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital.h-110-\t\t\t     struct sk_buff *resp);\nnet/nfc/digital.h-111-\nnet/nfc/digital.h:112:int digital_tg_send_dep_res(struct nfc_digital_dev *ddev, struct sk_buff *skb);\nnet/nfc/digital.h-113-\nnet/nfc/digital.h:114:int digital_tg_listen_nfca(struct nfc_digital_dev *ddev, u8 rf_tech);\nnet/nfc/digital.h:115:int digital_tg_listen_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech);\nnet/nfc/digital.h:116:void digital_tg_recv_md_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital.h-117-\t\t\t    struct sk_buff *resp);\n--\nnet/nfc/digital_core.c=27=struct digital_cmd {\n--\nnet/nfc/digital_core.c-35-\tstruct sk_buff *resp;\nnet/nfc/digital_core.c:36:\tstruct digital_tg_mdaa_params *mdaa_params;\nnet/nfc/digital_core.c-37-\n--\nnet/nfc/digital_core.c=152=static void digital_wq_cmd(struct work_struct *work)\n--\nnet/nfc/digital_core.c-155-\tstruct digital_cmd *cmd;\nnet/nfc/digital_core.c:156:\tstruct digital_tg_mdaa_params *params;\nnet/nfc/digital_core.c-157-\tstruct nfc_digital_dev *ddev = container_of(work,\n--\nnet/nfc/digital_core.c=227=int digital_send_cmd(struct nfc_digital_dev *ddev, u8 cmd_type,\nnet/nfc/digital_core.c:228:\t\t     struct sk_buff *skb, struct digital_tg_mdaa_params *params,\nnet/nfc/digital_core.c-229-\t\t     u16 timeout, nfc_digital_cmd_complete_t cmd_cb,\n--\nnet/nfc/digital_core.c=255=int digital_in_configure_hw(struct nfc_digital_dev *ddev, int type, int param)\n--\nnet/nfc/digital_core.c-265-\nnet/nfc/digital_core.c:266:int digital_tg_configure_hw(struct nfc_digital_dev *ddev, int type, int param)\nnet/nfc/digital_core.c-267-{\n--\nnet/nfc/digital_core.c-276-\nnet/nfc/digital_core.c:277:static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech)\nnet/nfc/digital_core.c-278-{\nnet/nfc/digital_core.c:279:\tstruct digital_tg_mdaa_params *params;\nnet/nfc/digital_core.c-280-\tint rc;\n--\nnet/nfc/digital_core.c-295-\trc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params,\nnet/nfc/digital_core.c:296:\t\t\t      500, digital_tg_recv_atr_req, NULL);\nnet/nfc/digital_core.c-297-\tif (rc)\n--\nnet/nfc/digital_core.c-302-\nnet/nfc/digital_core.c:303:static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech)\nnet/nfc/digital_core.c-304-{\nnet/nfc/digital_core.c-305-\treturn digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MD, NULL, NULL, 500,\nnet/nfc/digital_core.c:306:\t\t\t\tdigital_tg_recv_md_req, NULL);\nnet/nfc/digital_core.c-307-}\n--\nnet/nfc/digital_core.c=476=static int digital_start_poll(struct nfc_dev *nfc_dev, __u32 im_protocols,\n--\nnet/nfc/digital_core.c-528-\t\t\tdigital_add_poll_tech(ddev, 0,\nnet/nfc/digital_core.c:529:\t\t\t\t\t      digital_tg_listen_mdaa);\nnet/nfc/digital_core.c-530-\t\t} else if (ddev-\u003eops-\u003etg_listen_md) {\nnet/nfc/digital_core.c-531-\t\t\tdigital_add_poll_tech(ddev, 0,\nnet/nfc/digital_core.c:532:\t\t\t\t\t      digital_tg_listen_md);\nnet/nfc/digital_core.c-533-\t\t} else {\nnet/nfc/digital_core.c-534-\t\t\tdigital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_106A,\nnet/nfc/digital_core.c:535:\t\t\t\t\t      digital_tg_listen_nfca);\nnet/nfc/digital_core.c-536-\nnet/nfc/digital_core.c-537-\t\t\tdigital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_212F,\nnet/nfc/digital_core.c:538:\t\t\t\t\t      digital_tg_listen_nfcf);\nnet/nfc/digital_core.c-539-\nnet/nfc/digital_core.c-540-\t\t\tdigital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_424F,\nnet/nfc/digital_core.c:541:\t\t\t\t\t      digital_tg_listen_nfcf);\nnet/nfc/digital_core.c-542-\t\t}\n--\nnet/nfc/digital_core.c=641=static void digital_deactivate_target(struct nfc_dev *nfc_dev,\n--\nnet/nfc/digital_core.c-655-\nnet/nfc/digital_core.c:656:static int digital_tg_send(struct nfc_dev *dev, struct sk_buff *skb)\nnet/nfc/digital_core.c-657-{\n--\nnet/nfc/digital_core.c-659-\nnet/nfc/digital_core.c:660:\treturn digital_tg_send_dep_res(ddev, skb);\nnet/nfc/digital_core.c-661-}\n--\nnet/nfc/digital_core.c=744=static const struct nfc_ops digital_nfc_ops = {\n--\nnet/nfc/digital_core.c-752-\t.deactivate_target = digital_deactivate_target,\nnet/nfc/digital_core.c:753:\t.tm_send = digital_tg_send,\nnet/nfc/digital_core.c-754-\t.im_transceive = digital_in_send,\n--\nnet/nfc/digital_dep.c=106=static void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-107-\t\t\t\t    struct sk_buff *resp);\nnet/nfc/digital_dep.c:108:static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-109-\t\t\t\t    struct sk_buff *resp);\n--\nnet/nfc/digital_dep.c=904=int digital_in_send_dep_req(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-950-\nnet/nfc/digital_dep.c:951:static void digital_tg_set_rf_tech(struct nfc_digital_dev *ddev, u8 rf_tech)\nnet/nfc/digital_dep.c-952-{\n--\nnet/nfc/digital_dep.c-977-\nnet/nfc/digital_dep.c:978:static int digital_tg_send_ack(struct nfc_digital_dev *ddev,\nnet/nfc/digital_dep.c-979-\t\t\t       struct digital_data_exch *data_exch)\n--\nnet/nfc/digital_dep.c-1012-\nnet/nfc/digital_dep.c:1013:\trc = digital_tg_send_cmd(ddev, skb, 1500, digital_tg_recv_dep_req,\nnet/nfc/digital_dep.c-1014-\t\t\t\t data_exch);\n--\nnet/nfc/digital_dep.c-1023-\nnet/nfc/digital_dep.c:1024:static int digital_tg_send_atn(struct nfc_digital_dev *ddev)\nnet/nfc/digital_dep.c-1025-{\n--\nnet/nfc/digital_dep.c-1051-\nnet/nfc/digital_dep.c:1052:\trc = digital_tg_send_cmd(ddev, skb, 1500, digital_tg_recv_dep_req,\nnet/nfc/digital_dep.c-1053-\t\t\t\t NULL);\n--\nnet/nfc/digital_dep.c-1059-\nnet/nfc/digital_dep.c:1060:static int digital_tg_send_saved_skb(struct nfc_digital_dev *ddev)\nnet/nfc/digital_dep.c-1061-{\n--\nnet/nfc/digital_dep.c-1068-\nnet/nfc/digital_dep.c:1069:\trc = digital_tg_send_cmd(ddev, ddev-\u003esaved_skb, 1500,\nnet/nfc/digital_dep.c:1070:\t\t\t\t digital_tg_recv_dep_req, NULL);\nnet/nfc/digital_dep.c-1071-\tif (rc)\n--\nnet/nfc/digital_dep.c-1076-\nnet/nfc/digital_dep.c:1077:static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-1078-\t\t\t\t    struct sk_buff *resp)\n--\nnet/nfc/digital_dep.c-1156-\t\t\t * which is the previous DEP_RES saved in\nnet/nfc/digital_dep.c:1157:\t\t\t * digital_tg_send_dep_res().\nnet/nfc/digital_dep.c-1158-\t\t\t */\n--\nnet/nfc/digital_dep.c-1160-\t\t\t  DIGITAL_NFC_DEP_PFB_PNI(ddev-\u003ecurr_nfc_dep_pni - 1)) {\nnet/nfc/digital_dep.c:1161:\t\t\t\trc = digital_tg_send_saved_skb(ddev);\nnet/nfc/digital_dep.c-1162-\t\t\t\tif (rc)\n--\nnet/nfc/digital_dep.c-1184-\t\tresp = digital_recv_dep_data_gather(ddev, pfb, resp,\nnet/nfc/digital_dep.c:1185:\t\t\t\t\t\t    digital_tg_send_ack, NULL);\nnet/nfc/digital_dep.c-1186-\t\tif (IS_ERR(resp)) {\n--\nnet/nfc/digital_dep.c-1210-\nnet/nfc/digital_dep.c:1211:\t\t\trc = digital_tg_send_saved_skb(ddev);\nnet/nfc/digital_dep.c-1212-\t\t\tif (rc)\n--\nnet/nfc/digital_dep.c-1230-\t\t\t\t\t\tddev-\u003ecurr_nfc_dep_pni) {\nnet/nfc/digital_dep.c:1231:\t\t\t\trc = digital_tg_send_saved_skb(ddev);\nnet/nfc/digital_dep.c-1232-\t\t\t\tif (rc)\n--\nnet/nfc/digital_dep.c-1254-\nnet/nfc/digital_dep.c:1255:\t\trc = digital_tg_send_dep_res(ddev, ddev-\u003echaining_skb);\nnet/nfc/digital_dep.c-1256-\t\tif (rc)\n--\nnet/nfc/digital_dep.c-1265-\nnet/nfc/digital_dep.c:1266:\t\trc = digital_tg_send_atn(ddev);\nnet/nfc/digital_dep.c-1267-\t\tif (rc)\n--\nnet/nfc/digital_dep.c-1296-\nnet/nfc/digital_dep.c:1297:int digital_tg_send_dep_res(struct nfc_digital_dev *ddev, struct sk_buff *skb)\nnet/nfc/digital_dep.c-1298-{\n--\nnet/nfc/digital_dep.c-1331-\nnet/nfc/digital_dep.c:1332:\trc = digital_tg_send_cmd(ddev, tmp_skb, 1500, digital_tg_recv_dep_req,\nnet/nfc/digital_dep.c-1333-\t\t\t\t NULL);\n--\nnet/nfc/digital_dep.c-1347-\nnet/nfc/digital_dep.c:1348:static void digital_tg_send_psl_res_complete(struct nfc_digital_dev *ddev,\nnet/nfc/digital_dep.c-1349-\t\t\t\t\t     void *arg, struct sk_buff *resp)\n--\nnet/nfc/digital_dep.c-1355-\nnet/nfc/digital_dep.c:1356:\tdigital_tg_set_rf_tech(ddev, rf_tech);\nnet/nfc/digital_dep.c-1357-\nnet/nfc/digital_dep.c:1358:\tdigital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH, rf_tech);\nnet/nfc/digital_dep.c-1359-\nnet/nfc/digital_dep.c:1360:\tdigital_tg_listen(ddev, 1500, digital_tg_recv_dep_req, NULL);\nnet/nfc/digital_dep.c-1361-\n--\nnet/nfc/digital_dep.c-1364-\nnet/nfc/digital_dep.c:1365:static int digital_tg_send_psl_res(struct nfc_digital_dev *ddev, u8 did,\nnet/nfc/digital_dep.c-1366-\t\t\t\t   u8 rf_tech)\n--\nnet/nfc/digital_dep.c-1389-\nnet/nfc/digital_dep.c:1390:\trc = digital_tg_send_cmd(ddev, skb, 0, digital_tg_send_psl_res_complete,\nnet/nfc/digital_dep.c-1391-\t\t\t\t (void *)(unsigned long)rf_tech);\n--\nnet/nfc/digital_dep.c-1397-\nnet/nfc/digital_dep.c:1398:static void digital_tg_recv_psl_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-1399-\t\t\t\t    struct sk_buff *resp)\n--\nnet/nfc/digital_dep.c-1460-\nnet/nfc/digital_dep.c:1461:\trc = digital_tg_send_psl_res(ddev, psl_req-\u003edid, rf_tech);\nnet/nfc/digital_dep.c-1462-\n--\nnet/nfc/digital_dep.c-1466-\nnet/nfc/digital_dep.c:1467:static void digital_tg_send_atr_res_complete(struct nfc_digital_dev *ddev,\nnet/nfc/digital_dep.c-1468-\t\t\t\t\t     void *arg, struct sk_buff *resp)\n--\nnet/nfc/digital_dep.c-1483-\tif (resp-\u003edata[offset] == DIGITAL_CMD_PSL_REQ)\nnet/nfc/digital_dep.c:1484:\t\tdigital_tg_recv_psl_req(ddev, arg, resp);\nnet/nfc/digital_dep.c-1485-\telse\nnet/nfc/digital_dep.c:1486:\t\tdigital_tg_recv_dep_req(ddev, arg, resp);\nnet/nfc/digital_dep.c-1487-}\nnet/nfc/digital_dep.c-1488-\nnet/nfc/digital_dep.c:1489:static int digital_tg_send_atr_res(struct nfc_digital_dev *ddev,\nnet/nfc/digital_dep.c-1490-\t\t\t\t   struct digital_atr_req *atr_req)\n--\nnet/nfc/digital_dep.c-1532-\nnet/nfc/digital_dep.c:1533:\trc = digital_tg_send_cmd(ddev, skb, 999,\nnet/nfc/digital_dep.c:1534:\t\t\t\t digital_tg_send_atr_res_complete, NULL);\nnet/nfc/digital_dep.c-1535-\tif (rc)\n--\nnet/nfc/digital_dep.c-1540-\nnet/nfc/digital_dep.c:1541:void digital_tg_recv_atr_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_dep.c-1542-\t\t\t     struct sk_buff *resp)\n--\nnet/nfc/digital_dep.c-1561-\t\tmin_size = DIGITAL_ATR_REQ_MIN_SIZE + 2;\nnet/nfc/digital_dep.c:1562:\t\tdigital_tg_set_rf_tech(ddev, NFC_DIGITAL_RF_TECH_106A);\nnet/nfc/digital_dep.c-1563-\t} else {\nnet/nfc/digital_dep.c-1564-\t\tmin_size = DIGITAL_ATR_REQ_MIN_SIZE + 1;\nnet/nfc/digital_dep.c:1565:\t\tdigital_tg_set_rf_tech(ddev, NFC_DIGITAL_RF_TECH_212F);\nnet/nfc/digital_dep.c-1566-\t}\n--\nnet/nfc/digital_dep.c-1605-\nnet/nfc/digital_dep.c:1606:\trc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,\nnet/nfc/digital_dep.c-1607-\t\t\t\t     NFC_DIGITAL_FRAMING_NFC_DEP_ACTIVATED);\n--\nnet/nfc/digital_dep.c-1610-\nnet/nfc/digital_dep.c:1611:\trc = digital_tg_send_atr_res(ddev, atr_req);\nnet/nfc/digital_dep.c-1612-\tif (rc)\n--\nnet/nfc/digital_technology.c=895=int digital_in_send_iso15693_inv_req(struct nfc_digital_dev *ddev, u8 rf_tech)\n--\nnet/nfc/digital_technology.c-934-\nnet/nfc/digital_technology.c:935:static int digital_tg_send_sel_res(struct nfc_digital_dev *ddev)\nnet/nfc/digital_technology.c-936-{\n--\nnet/nfc/digital_technology.c-948-\nnet/nfc/digital_technology.c:949:\trc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,\nnet/nfc/digital_technology.c-950-\t\t\t\t     NFC_DIGITAL_FRAMING_NFCA_ANTICOL_COMPLETE);\n--\nnet/nfc/digital_technology.c-955-\nnet/nfc/digital_technology.c:956:\trc = digital_tg_send_cmd(ddev, skb, 300, digital_tg_recv_atr_req,\nnet/nfc/digital_technology.c-957-\t\t\t\t NULL);\n--\nnet/nfc/digital_technology.c-963-\nnet/nfc/digital_technology.c:964:static void digital_tg_recv_sel_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_technology.c-965-\t\t\t\t    struct sk_buff *resp)\n--\nnet/nfc/digital_technology.c-984-\nnet/nfc/digital_technology.c:985:\trc = digital_tg_send_sel_res(ddev);\nnet/nfc/digital_technology.c-986-\n--\nnet/nfc/digital_technology.c-993-\nnet/nfc/digital_technology.c:994:static int digital_tg_send_sdd_res(struct nfc_digital_dev *ddev)\nnet/nfc/digital_technology.c-995-{\n--\nnet/nfc/digital_technology.c-1013-\nnet/nfc/digital_technology.c:1014:\trc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,\nnet/nfc/digital_technology.c-1015-\t\t\t\tNFC_DIGITAL_FRAMING_NFCA_STANDARD_WITH_CRC_A);\n--\nnet/nfc/digital_technology.c-1020-\nnet/nfc/digital_technology.c:1021:\trc = digital_tg_send_cmd(ddev, skb, 300, digital_tg_recv_sel_req,\nnet/nfc/digital_technology.c-1022-\t\t\t\t NULL);\n--\nnet/nfc/digital_technology.c-1028-\nnet/nfc/digital_technology.c:1029:static void digital_tg_recv_sdd_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_technology.c-1030-\t\t\t\t    struct sk_buff *resp)\n--\nnet/nfc/digital_technology.c-1048-\nnet/nfc/digital_technology.c:1049:\trc = digital_tg_send_sdd_res(ddev);\nnet/nfc/digital_technology.c-1050-\n--\nnet/nfc/digital_technology.c-1057-\nnet/nfc/digital_technology.c:1058:static int digital_tg_send_sens_res(struct nfc_digital_dev *ddev)\nnet/nfc/digital_technology.c-1059-{\n--\nnet/nfc/digital_technology.c-1072-\nnet/nfc/digital_technology.c:1073:\trc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,\nnet/nfc/digital_technology.c-1074-\t\t\t\t     NFC_DIGITAL_FRAMING_NFCA_STANDARD);\n--\nnet/nfc/digital_technology.c-1079-\nnet/nfc/digital_technology.c:1080:\trc = digital_tg_send_cmd(ddev, skb, 300, digital_tg_recv_sdd_req,\nnet/nfc/digital_technology.c-1081-\t\t\t\t NULL);\n--\nnet/nfc/digital_technology.c-1087-\nnet/nfc/digital_technology.c:1088:void digital_tg_recv_sens_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_technology.c-1089-\t\t\t      struct sk_buff *resp)\n--\nnet/nfc/digital_technology.c-1107-\nnet/nfc/digital_technology.c:1108:\trc = digital_tg_send_sens_res(ddev);\nnet/nfc/digital_technology.c-1109-\n--\nnet/nfc/digital_technology.c-1116-\nnet/nfc/digital_technology.c:1117:static void digital_tg_recv_atr_or_sensf_req(struct nfc_digital_dev *ddev,\nnet/nfc/digital_technology.c-1118-\t\tvoid *arg, struct sk_buff *resp)\n--\nnet/nfc/digital_technology.c-1121-\t\t\t(resp-\u003edata[1] == DIGITAL_CMD_SENSF_REQ))\nnet/nfc/digital_technology.c:1122:\t\tdigital_tg_recv_sensf_req(ddev, arg, resp);\nnet/nfc/digital_technology.c-1123-\telse\nnet/nfc/digital_technology.c:1124:\t\tdigital_tg_recv_atr_req(ddev, arg, resp);\nnet/nfc/digital_technology.c-1125-\n--\nnet/nfc/digital_technology.c-1128-\nnet/nfc/digital_technology.c:1129:static int digital_tg_send_sensf_res(struct nfc_digital_dev *ddev,\nnet/nfc/digital_technology.c-1130-\t\t\t      struct digital_sensf_req *sensf_req)\n--\nnet/nfc/digital_technology.c-1172-\nnet/nfc/digital_technology.c:1173:\trc = digital_tg_send_cmd(ddev, skb, 300,\nnet/nfc/digital_technology.c:1174:\t\t\t\t digital_tg_recv_atr_or_sensf_req, NULL);\nnet/nfc/digital_technology.c-1175-\tif (rc)\n--\nnet/nfc/digital_technology.c-1180-\nnet/nfc/digital_technology.c:1181:void digital_tg_recv_sensf_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_technology.c-1182-\t\t\t       struct sk_buff *resp)\n--\nnet/nfc/digital_technology.c-1213-\nnet/nfc/digital_technology.c:1214:\trc = digital_tg_send_sensf_res(ddev, sensf_req);\nnet/nfc/digital_technology.c-1215-\n--\nnet/nfc/digital_technology.c-1222-\nnet/nfc/digital_technology.c:1223:static int digital_tg_config_nfca(struct nfc_digital_dev *ddev)\nnet/nfc/digital_technology.c-1224-{\n--\nnet/nfc/digital_technology.c-1226-\nnet/nfc/digital_technology.c:1227:\trc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,\nnet/nfc/digital_technology.c-1228-\t\t\t\t     NFC_DIGITAL_RF_TECH_106A);\n--\nnet/nfc/digital_technology.c-1231-\nnet/nfc/digital_technology.c:1232:\treturn digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,\nnet/nfc/digital_technology.c-1233-\t\t\t\t       NFC_DIGITAL_FRAMING_NFCA_NFC_DEP);\n--\nnet/nfc/digital_technology.c-1235-\nnet/nfc/digital_technology.c:1236:int digital_tg_listen_nfca(struct nfc_digital_dev *ddev, u8 rf_tech)\nnet/nfc/digital_technology.c-1237-{\n--\nnet/nfc/digital_technology.c-1239-\nnet/nfc/digital_technology.c:1240:\trc = digital_tg_config_nfca(ddev);\nnet/nfc/digital_technology.c-1241-\tif (rc)\n--\nnet/nfc/digital_technology.c-1243-\nnet/nfc/digital_technology.c:1244:\treturn digital_tg_listen(ddev, 300, digital_tg_recv_sens_req, NULL);\nnet/nfc/digital_technology.c-1245-}\nnet/nfc/digital_technology.c-1246-\nnet/nfc/digital_technology.c:1247:static int digital_tg_config_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech)\nnet/nfc/digital_technology.c-1248-{\n--\nnet/nfc/digital_technology.c-1250-\nnet/nfc/digital_technology.c:1251:\trc = digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH, rf_tech);\nnet/nfc/digital_technology.c-1252-\tif (rc)\n--\nnet/nfc/digital_technology.c-1254-\nnet/nfc/digital_technology.c:1255:\treturn digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,\nnet/nfc/digital_technology.c-1256-\t\t\t\t       NFC_DIGITAL_FRAMING_NFCF_NFC_DEP);\n--\nnet/nfc/digital_technology.c-1258-\nnet/nfc/digital_technology.c:1259:int digital_tg_listen_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech)\nnet/nfc/digital_technology.c-1260-{\n--\nnet/nfc/digital_technology.c-1262-\nnet/nfc/digital_technology.c:1263:\trc = digital_tg_config_nfcf(ddev, rf_tech);\nnet/nfc/digital_technology.c-1264-\tif (rc)\n--\nnet/nfc/digital_technology.c-1266-\nnet/nfc/digital_technology.c:1267:\treturn digital_tg_listen(ddev, 300, digital_tg_recv_sensf_req, NULL);\nnet/nfc/digital_technology.c-1268-}\nnet/nfc/digital_technology.c-1269-\nnet/nfc/digital_technology.c:1270:void digital_tg_recv_md_req(struct nfc_digital_dev *ddev, void *arg,\nnet/nfc/digital_technology.c-1271-\t\t\t    struct sk_buff *resp)\n--\nnet/nfc/digital_technology.c-1286-\tcase NFC_DIGITAL_RF_TECH_106A:\nnet/nfc/digital_technology.c:1287:\t\trc = digital_tg_config_nfca(ddev);\nnet/nfc/digital_technology.c-1288-\t\tif (rc)\nnet/nfc/digital_technology.c-1289-\t\t\tgoto exit_free_skb;\nnet/nfc/digital_technology.c:1290:\t\tdigital_tg_recv_sens_req(ddev, arg, resp);\nnet/nfc/digital_technology.c-1291-\t\tbreak;\n--\nnet/nfc/digital_technology.c-1293-\tcase NFC_DIGITAL_RF_TECH_424F:\nnet/nfc/digital_technology.c:1294:\t\trc = digital_tg_config_nfcf(ddev, rf_tech);\nnet/nfc/digital_technology.c-1295-\t\tif (rc)\nnet/nfc/digital_technology.c-1296-\t\t\tgoto exit_free_skb;\nnet/nfc/digital_technology.c:1297:\t\tdigital_tg_recv_sensf_req(ddev, arg, resp);\nnet/nfc/digital_technology.c-1298-\t\tbreak;\n"
}

gemini-3.8-flash

null

null

							input: 34688
							output: 27
							thoughts: 61
						

**Tracing the Digital NFC Send Function**

Okay, let's break this down. It looks like `digital_tg_send` is, as I suspected, implemented as `dev->ops->tm_send` within the `digital_nfc_ops` structure. That's good, that confirms the core relationship. Now, the next logical question: *where* is this `tm_send` function actually being called from? I need to understand its context. Time to dive into the `net/nfc` directory and specifically examine the `tm_send` function's usage. That's where I should find the answer to my question.

{
  "Expression": "tm_send",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/core.c=488=int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,\n--\nnet/nfc/core.c-519-\t\t\t\t  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));\nnet/nfc/core.c:520:\t} else if (dev-\u003erf_mode == NFC_RF_TARGET \u0026\u0026 dev-\u003eops-\u003etm_send != NULL) {\nnet/nfc/core.c:521:\t\trc = dev-\u003eops-\u003etm_send(dev, skb);\nnet/nfc/core.c-522-\t} else {\n--\nnet/nfc/digital_core.c=744=static const struct nfc_ops digital_nfc_ops = {\n--\nnet/nfc/digital_core.c-752-\t.deactivate_target = digital_deactivate_target,\nnet/nfc/digital_core.c:753:\t.tm_send = digital_tg_send,\nnet/nfc/digital_core.c-754-\t.im_transceive = digital_in_send,\n--\nnet/nfc/hci/core.c=722=static int hci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target,\n--\nnet/nfc/hci/core.c-767-\nnet/nfc/hci/core.c:768:static int hci_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)\nnet/nfc/hci/core.c-769-{\n--\nnet/nfc/hci/core.c-771-\nnet/nfc/hci/core.c:772:\tif (!hdev-\u003eops-\u003etm_send) {\nnet/nfc/hci/core.c-773-\t\tkfree_skb(skb);\n--\nnet/nfc/hci/core.c-776-\nnet/nfc/hci/core.c:777:\treturn hdev-\u003eops-\u003etm_send(hdev, skb);\nnet/nfc/hci/core.c-778-}\n--\nnet/nfc/hci/core.c=941=static const struct nfc_ops hci_nfc_ops = {\n--\nnet/nfc/hci/core.c-950-\t.im_transceive = hci_transceive,\nnet/nfc/hci/core.c:951:\t.tm_send = hci_tm_send,\nnet/nfc/hci/core.c-952-\t.check_presence = hci_check_presence,\n--\nnet/nfc/nci/core.c=1040=static int nci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target,\n--\nnet/nfc/nci/core.c-1077-\nnet/nfc/nci/core.c:1078:static int nci_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)\nnet/nfc/nci/core.c-1079-{\n--\nnet/nfc/nci/core.c=1149=static const struct nfc_ops nci_nfc_ops = {\n--\nnet/nfc/nci/core.c-1158-\t.im_transceive = nci_transceive,\nnet/nfc/nci/core.c:1159:\t.tm_send = nci_tm_send,\nnet/nfc/nci/core.c-1160-\t.enable_se = nci_enable_se,\n"
}

gemini-3.8-flash

null

null

							input: 35871
							output: 30
							thoughts: 31
						

Here's my summary, as though I'm thinking through this process:

**Tracing the Data Flow in NFC Communication**

Okay, so `nfc_data_exchange` is a crucial function, likely the heart of the NFC data transfer process. My initial hunch, given its name and the typical architecture, is that it's getting invoked either through Netlink, the established inter-kernel communication pathway, or more directly through a socket layer, handling the user-space interaction. That's the expected high-level view, at least. Now, the real task is to figure out the exact call chain. Let's dig deeper and trace back all the calls to `nfc_data_exchange`. Understanding the callers will illuminate precisely which part of the system initiates the data exchange and what context it's operating within. It’s also important to understand the calling contexts. For instance, is this a blocking or non-blocking call? Are there any locks held during this call? This is where the debugging begins!

{
  "Expression": "nfc_data_exchange",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/core.c=442=int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx, u8 mode)\n--\nnet/nfc/core.c-477-/**\nnet/nfc/core.c:478: * nfc_data_exchange - transceive data\nnet/nfc/core.c-479- *\n--\nnet/nfc/core.c-487- */\nnet/nfc/core.c:488:int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,\nnet/nfc/core.c-489-\t\t      data_exchange_cb_t cb, void *cb_context)\n--\nnet/nfc/llcp_commands.c=371=int nfc_llcp_send_symm(struct nfc_dev *dev)\n--\nnet/nfc/llcp_commands.c-398-\nnet/nfc/llcp_commands.c:399:\terr = nfc_data_exchange(dev, local-\u003etarget_idx, skb,\nnet/nfc/llcp_commands.c-400-\t\t\t\t nfc_llcp_recv, local);\n--\nnet/nfc/llcp_core.c=761=static void nfc_llcp_tx_work(struct work_struct *work)\n--\nnet/nfc/llcp_core.c-796-\nnet/nfc/llcp_core.c:797:\t\t\tret = nfc_data_exchange(local-\u003edev, local-\u003etarget_idx,\nnet/nfc/llcp_core.c-798-\t\t\t\t\t\tskb, nfc_llcp_recv, local);\n--\nnet/nfc/nfc.h=143=int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx, u8 mode);\nnet/nfc/nfc.h-144-\nnet/nfc/nfc.h:145:int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,\nnet/nfc/nfc.h-146-\t\t      data_exchange_cb_t cb, void *cb_context);\n--\nnet/nfc/rawsock.c=188=static void rawsock_tx_work(struct work_struct *work)\n--\nnet/nfc/rawsock.c-206-\tsock_hold(sk);\nnet/nfc/rawsock.c:207:\trc = nfc_data_exchange(dev, target_idx, skb,\nnet/nfc/rawsock.c-208-\t\t\t       rawsock_data_exchange_complete, sk);\n"
}

gemini-3.8-flash

null

null

							input: 36856
							output: 27
							thoughts: 439
						

**My Assessment of the NFC Subsystem's Fuzzing Potential**

Okay, so I'm looking at this NFC code and I see that raw sockets (`rawsock.c`) and LLCP (`llcp_core.c`) are using `nfc_data_exchange`. That's interesting, and right away I'm thinking about the bigger picture. I know syzkaller has some serious NFC coverage, using AF_NFC sockets, netlink commands like `NFC_CMD_START_POLL` and `NFC_CMD_DEP_LINK_UP`, and even USB emulation with port100 or nfcsim. And it's clearly fuzzing NFC pretty extensively. I mean, the number of CVEs and bugs it's found in `net/nfc` is impressive.

Given all of that, my next step is to see if syzkaller has flagged anything in `digital_dep.c` or within `net/nfc` more broadly. Ah, here's a commit that fixes an out-of-bounds access or logic error in `digital_tg_recv_dep_req`.

Now, let's step back and consider the relevant sections. My focus is on reachability. Is `digital_dep.c` actually reachable? Absolutely, via the NFC subsystem, AF_NFC sockets, netlink, or even emulated USB devices like port100, or nfcsim. That's a solid start.

The second critical thing I'm considering is that fuzzing is valuable because the code can be made to execute in a standard virtualized environment like GCE or QEMU, using software-emulated devices like USB gadgets, netdev, tun/tap. That sounds ideal.

And finally, the 'WorthFuzzing' criteria. That's what I'm looking for - can the patch touch reachable executable code, including core subsystems, and drivers that are accessible via virtual buses, like the USB gadget, netlink, and sockets. Well, the `net/nfc` code *is* part of Linux networking (net/), so...

"WorthFuzzing: true!" Bingo.

Now to see what Kconfig options are required to enable `digital_dep.o`'s compilation - let's trace through `net/nfc/Makefile` to confirm the build dependencies.

{
  "Expression": "digital_dep",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/Makefile=11=nfc-objs := core.o netlink.o af_nfc.o rawsock.o llcp_core.o llcp_commands.o \\\n--\nnet/nfc/Makefile-13-\nnet/nfc/Makefile:14:nfc_digital-objs := digital_core.o digital_technology.o digital_dep.o\n--\nnet/nfc/digital_core.c=586=static int digital_dev_down(struct nfc_dev *nfc_dev)\n--\nnet/nfc/digital_core.c-594-\nnet/nfc/digital_core.c:595:static int digital_dep_link_up(struct nfc_dev *nfc_dev,\nnet/nfc/digital_core.c-596-\t\t\t       struct nfc_target *target,\n--\nnet/nfc/digital_core.c-609-\nnet/nfc/digital_core.c:610:static int digital_dep_link_down(struct nfc_dev *nfc_dev)\nnet/nfc/digital_core.c-611-{\n--\nnet/nfc/digital_core.c=744=static const struct nfc_ops digital_nfc_ops = {\n--\nnet/nfc/digital_core.c-748-\t.stop_poll = digital_stop_poll,\nnet/nfc/digital_core.c:749:\t.dep_link_up = digital_dep_link_up,\nnet/nfc/digital_core.c:750:\t.dep_link_down = digital_dep_link_down,\nnet/nfc/digital_core.c-751-\t.activate_target = digital_activate_target,\n--\nnet/nfc/digital_dep.c=94=struct digital_psl_res {\n--\nnet/nfc/digital_dep.c-99-\nnet/nfc/digital_dep.c:100:struct digital_dep_req_res {\nnet/nfc/digital_dep.c-101-\tu8 dir;\n--\nnet/nfc/digital_dep.c=200=digital_send_dep_data_prep(struct nfc_digital_dev *ddev, struct sk_buff *skb,\nnet/nfc/digital_dep.c:201:\t\t\t   struct digital_dep_req_res *dep_req_res,\nnet/nfc/digital_dep.c-202-\t\t\t   struct digital_data_exch *data_exch)\n--\nnet/nfc/digital_dep.c=529=static int digital_in_send_ack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-531-{\nnet/nfc/digital_dep.c:532:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-533-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-539-\nnet/nfc/digital_dep.c:540:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-541-\nnet/nfc/digital_dep.c:542:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-543-\n--\nnet/nfc/digital_dep.c=566=static int digital_in_send_nack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-568-{\nnet/nfc/digital_dep.c:569:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-570-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-576-\nnet/nfc/digital_dep.c:577:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-578-\nnet/nfc/digital_dep.c:579:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-580-\n--\nnet/nfc/digital_dep.c=598=static int digital_in_send_atn(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-600-{\nnet/nfc/digital_dep.c:601:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-602-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-608-\nnet/nfc/digital_dep.c:609:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-610-\nnet/nfc/digital_dep.c:611:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-612-\n--\nnet/nfc/digital_dep.c=629=static int digital_in_send_rtox(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-631-{\nnet/nfc/digital_dep.c:632:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-633-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-646-\nnet/nfc/digital_dep.c:647:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-648-\nnet/nfc/digital_dep.c:649:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-650-\n--\nnet/nfc/digital_dep.c=686=static void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-689-\tstruct digital_data_exch *data_exch = arg;\nnet/nfc/digital_dep.c:690:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-691-\tu8 pfb;\n--\nnet/nfc/digital_dep.c-755-\nnet/nfc/digital_dep.c:756:\tsize = sizeof(struct digital_dep_req_res);\nnet/nfc/digital_dep.c:757:\tdep_res = (struct digital_dep_req_res *)resp-\u003edata;\nnet/nfc/digital_dep.c-758-\n--\nnet/nfc/digital_dep.c=904=int digital_in_send_dep_req(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-907-{\nnet/nfc/digital_dep.c:908:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-909-\tstruct sk_buff *chaining_skb, *tmp_skb;\n--\nnet/nfc/digital_dep.c-911-\nnet/nfc/digital_dep.c:912:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-913-\nnet/nfc/digital_dep.c:914:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-915-\n--\nnet/nfc/digital_dep.c=978=static int digital_tg_send_ack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-980-{\nnet/nfc/digital_dep.c:981:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-982-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-988-\nnet/nfc/digital_dep.c:989:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-990-\nnet/nfc/digital_dep.c:991:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-992-\n--\nnet/nfc/digital_dep.c=1024=static int digital_tg_send_atn(struct nfc_digital_dev *ddev)\nnet/nfc/digital_dep.c-1025-{\nnet/nfc/digital_dep.c:1026:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-1027-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-1033-\nnet/nfc/digital_dep.c:1034:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-1035-\nnet/nfc/digital_dep.c:1036:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-1037-\n--\nnet/nfc/digital_dep.c=1077=static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-1080-\tint rc;\nnet/nfc/digital_dep.c:1081:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-1082-\tu8 pfb;\n--\nnet/nfc/digital_dep.c-1107-\nnet/nfc/digital_dep.c:1108:\tsize = sizeof(struct digital_dep_req_res);\nnet/nfc/digital_dep.c:1109:\tdep_req = (struct digital_dep_req_res *)resp-\u003edata;\nnet/nfc/digital_dep.c-1110-\n--\nnet/nfc/digital_dep.c=1297=int digital_tg_send_dep_res(struct nfc_digital_dev *ddev, struct sk_buff *skb)\nnet/nfc/digital_dep.c-1298-{\nnet/nfc/digital_dep.c:1299:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-1300-\tstruct sk_buff *chaining_skb, *tmp_skb;\n--\nnet/nfc/digital_dep.c-1302-\nnet/nfc/digital_dep.c:1303:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-1304-\nnet/nfc/digital_dep.c:1305:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-1306-\n"
}

gemini-3.8-flash

null

null

							input: 40842
							output: 32
							thoughts: 12
						

Here's my summary, as though I'm thinking it:

**Diving into the NFC Makefile**

Okay, time to get my hands dirty. I need to understand the build process for the NFC components, so let's start with the `net/nfc/Makefile`. This file is the central point of control, right? It's where the dependencies, compilation flags, and linking are all orchestrated for these NFC-related modules. I need to see how the kernel builds these things, any specific modules it's creating, and how they interact. I'm especially interested in whether there are any unusual build flags or custom rules that might indicate platform-specific optimizations or potential areas of interest for performance tuning or security vulnerability research. Let's see what gems we can find.

{
  "File": "net/nfc/Makefile",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0\n   2:\t#\n   3:\t# Makefile for the Linux NFC subsystem.\n   4:\t#\n   5:\t\n   6:\tobj-$(CONFIG_NFC) += nfc.o\n   7:\tobj-$(CONFIG_NFC_NCI) += nci/\n   8:\tobj-$(CONFIG_NFC_HCI) += hci/\n   9:\tobj-$(CONFIG_NFC_DIGITAL) += nfc_digital.o\n  10:\t\n  11:\tnfc-objs := core.o netlink.o af_nfc.o rawsock.o llcp_core.o llcp_commands.o \\\n  12:\t\t\tllcp_sock.o\n  13:\t\n  14:\tnfc_digital-objs := digital_core.o digital_technology.o digital_dep.o\n"
}

gemini-3.8-flash

null

null

							input: 41284
							output: 32
							thoughts: 85
						

**My Analysis of NFC Driver Dependencies**

Okay, so I'm looking at this `nfc_digital.o` module and immediately, I see a clear dependency path. It needs `CONFIG_NFC_DIGITAL`, which itself is contingent on `CONFIG_NFC`. That's standard Kconfig stuff. Gotta make sure the base NFC functionality is enabled before we even think about the digital layer.

Then I quickly want to understand *what* uses this `nfc_digital` part. The dependency list tells me it's used by `CONFIG_NFC_SIM`, the nfcsim driver, and also `CONFIG_NFC_PORT100`, the port100 driver. Alright, useful to know. 

To fully understand the configuration options, my next step is obviously to go and inspect the `drivers/nfc/Kconfig` file. I need to see the context of these configs, any additional dependencies or constraints, default values, help text – the whole shebang. Gotta have the full picture before I make any judgements or changes.

{
  "Expression": "PORT100|NFCSIM",
  "PathPrefix": "drivers/nfc"
}

{
  "Output": "\nFull output is too long, showing 500 out of 682 lines.\nUse more precise expression if possible.\n\ndrivers/nfc/Kconfig=31=config NFC_SIM\n--\ndrivers/nfc/Kconfig-41-\ndrivers/nfc/Kconfig:42:config NFC_PORT100\ndrivers/nfc/Kconfig-43-\ttristate \"Sony NFC Port-100 Series USB device support\"\n--\ndrivers/nfc/Makefile=11=obj-$(CONFIG_NFC_SIM)\t\t+= nfcsim.o\ndrivers/nfc/Makefile:12:obj-$(CONFIG_NFC_PORT100)\t+= port100.o\ndrivers/nfc/Makefile-13-obj-$(CONFIG_NFC_MRVL)\t\t+= nfcmrvl/\n--\ndrivers/nfc/nfcsim.c-15-\ndrivers/nfc/nfcsim.c:16:#define NFCSIM_ERR(d, fmt, args...) nfc_err(\u0026d-\u003enfc_digital_dev-\u003enfc_dev-\u003edev, \\\ndrivers/nfc/nfcsim.c-17-\t\t\t\t\t    \"%s: \" fmt, __func__, ## args)\ndrivers/nfc/nfcsim.c-18-\ndrivers/nfc/nfcsim.c:19:#define NFCSIM_DBG(d, fmt, args...) dev_dbg(\u0026d-\u003enfc_digital_dev-\u003enfc_dev-\u003edev, \\\ndrivers/nfc/nfcsim.c-20-\t\t\t\t\t    \"%s: \" fmt, __func__, ## args)\ndrivers/nfc/nfcsim.c-21-\ndrivers/nfc/nfcsim.c:22:#define NFCSIM_VERSION \"0.2\"\ndrivers/nfc/nfcsim.c-23-\ndrivers/nfc/nfcsim.c:24:#define NFCSIM_MODE_NONE\t0\ndrivers/nfc/nfcsim.c:25:#define NFCSIM_MODE_INITIATOR\t1\ndrivers/nfc/nfcsim.c:26:#define NFCSIM_MODE_TARGET\t2\ndrivers/nfc/nfcsim.c-27-\ndrivers/nfc/nfcsim.c:28:#define NFCSIM_CAPABILITIES (NFC_DIGITAL_DRV_CAPS_IN_CRC   | \\\ndrivers/nfc/nfcsim.c-29-\t\t\t     NFC_DIGITAL_DRV_CAPS_TG_CRC)\n--\ndrivers/nfc/nfcsim.c=104=static void nfcsim_link_recv_cancel(struct nfcsim_link *link)\n--\ndrivers/nfc/nfcsim.c-107-\ndrivers/nfc/nfcsim.c:108:\tlink-\u003emode = NFCSIM_MODE_NONE;\ndrivers/nfc/nfcsim.c-109-\n--\ndrivers/nfc/nfcsim.c=115=static void nfcsim_link_shutdown(struct nfcsim_link *link)\n--\ndrivers/nfc/nfcsim.c-119-\tlink-\u003eshutdown = 1;\ndrivers/nfc/nfcsim.c:120:\tlink-\u003emode = NFCSIM_MODE_NONE;\ndrivers/nfc/nfcsim.c-121-\n--\ndrivers/nfc/nfcsim.c=182=static void nfcsim_recv_wq(struct work_struct *work)\n--\ndrivers/nfc/nfcsim.c-190-\tif (!dev-\u003eup) {\ndrivers/nfc/nfcsim.c:191:\t\tNFCSIM_ERR(dev, \"Device is down\\n\");\ndrivers/nfc/nfcsim.c-192-\n--\ndrivers/nfc/nfcsim.c=201=static int nfcsim_send(struct nfc_digital_dev *ddev, struct sk_buff *skb,\n--\ndrivers/nfc/nfcsim.c-207-\tif (!dev-\u003eup) {\ndrivers/nfc/nfcsim.c:208:\t\tNFCSIM_ERR(dev, \"Device is down\\n\");\ndrivers/nfc/nfcsim.c-209-\t\treturn -ENODEV;\n--\ndrivers/nfc/nfcsim.c-218-\tif (dev-\u003edropframe) {\ndrivers/nfc/nfcsim.c:219:\t\tNFCSIM_DBG(dev, \"dropping frame (out of %d)\\n\", dev-\u003edropframe);\ndrivers/nfc/nfcsim.c-220-\t\tdev_kfree_skb(skb);\n--\ndrivers/nfc/nfcsim.c=256=static int nfcsim_in_configure_hw(struct nfc_digital_dev *ddev,\n--\ndrivers/nfc/nfcsim.c-263-\t\tdev-\u003eup = true;\ndrivers/nfc/nfcsim.c:264:\t\tdev-\u003emode = NFCSIM_MODE_INITIATOR;\ndrivers/nfc/nfcsim.c-265-\t\tdev-\u003erf_tech = param;\n--\ndrivers/nfc/nfcsim.c-271-\tdefault:\ndrivers/nfc/nfcsim.c:272:\t\tNFCSIM_ERR(dev, \"Invalid configuration type: %d\\n\", type);\ndrivers/nfc/nfcsim.c-273-\t\treturn -EINVAL;\n--\ndrivers/nfc/nfcsim.c=286=static int nfcsim_tg_configure_hw(struct nfc_digital_dev *ddev,\n--\ndrivers/nfc/nfcsim.c-293-\t\tdev-\u003eup = true;\ndrivers/nfc/nfcsim.c:294:\t\tdev-\u003emode = NFCSIM_MODE_TARGET;\ndrivers/nfc/nfcsim.c-295-\t\tdev-\u003erf_tech = param;\n--\ndrivers/nfc/nfcsim.c-301-\tdefault:\ndrivers/nfc/nfcsim.c:302:\t\tNFCSIM_ERR(dev, \"Invalid configuration type: %d\\n\", type);\ndrivers/nfc/nfcsim.c-303-\t\treturn -EINVAL;\n--\ndrivers/nfc/nfcsim.c=346=static void nfcsim_debugfs_init_dev(struct nfcsim *dev)\n--\ndrivers/nfc/nfcsim.c-353-\tif (!nfcsim_debugfs_root) {\ndrivers/nfc/nfcsim.c:354:\t\tNFCSIM_ERR(dev, \"nfcsim debugfs not initialized\\n\");\ndrivers/nfc/nfcsim.c-355-\t\treturn;\n--\ndrivers/nfc/nfcsim.c-360-\tif (n \u003e= sizeof(devname)) {\ndrivers/nfc/nfcsim.c:361:\t\tNFCSIM_ERR(dev, \"Could not compute dev name for dev %d\\n\", idx);\ndrivers/nfc/nfcsim.c-362-\t\treturn;\n--\ndrivers/nfc/nfcsim.c=370=static struct nfcsim *nfcsim_device_new(struct nfcsim_link *link_in,\n--\ndrivers/nfc/nfcsim.c-385-\t\t\t\t\t\t    NFC_PROTO_NFC_DEP_MASK,\ndrivers/nfc/nfcsim.c:386:\t\t\t\t\t\t    NFCSIM_CAPABILITIES,\ndrivers/nfc/nfcsim.c-387-\t\t\t\t\t\t    0, 0);\n--\ndrivers/nfc/nfcsim.c=431=static int __init nfcsim_init(void)\n--\ndrivers/nfc/nfcsim.c-458-\ndrivers/nfc/nfcsim.c:459:\tpr_info(\"nfcsim \" NFCSIM_VERSION \" initialized\\n\");\ndrivers/nfc/nfcsim.c-460-\n--\ndrivers/nfc/nfcsim.c=491=module_exit(nfcsim_exit);\ndrivers/nfc/nfcsim.c-492-\ndrivers/nfc/nfcsim.c:493:MODULE_DESCRIPTION(\"NFCSim driver ver \" NFCSIM_VERSION);\ndrivers/nfc/nfcsim.c:494:MODULE_VERSION(NFCSIM_VERSION);\ndrivers/nfc/nfcsim.c-495-MODULE_LICENSE(\"GPL\");\n--\ndrivers/nfc/port100.c-18-\ndrivers/nfc/port100.c:19:#define PORT100_PROTOCOLS (NFC_PROTO_JEWEL_MASK    | \\\ndrivers/nfc/port100.c-20-\t\t\t   NFC_PROTO_MIFARE_MASK   | \\\n--\ndrivers/nfc/port100.c-25-\ndrivers/nfc/port100.c:26:#define PORT100_CAPABILITIES (NFC_DIGITAL_DRV_CAPS_IN_CRC | \\\ndrivers/nfc/port100.c-27-\t\t\t      NFC_DIGITAL_DRV_CAPS_TG_CRC)\n--\ndrivers/nfc/port100.c-29-/* Standard port100 frame definitions */\ndrivers/nfc/port100.c:30:#define PORT100_FRAME_HEADER_LEN (sizeof(struct port100_frame) \\\ndrivers/nfc/port100.c-31-\t\t\t\t  + 2) /* data[0] CC, data[1] SCC */\ndrivers/nfc/port100.c:32:#define PORT100_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/\ndrivers/nfc/port100.c-33-\ndrivers/nfc/port100.c:34:#define PORT100_COMM_RF_HEAD_MAX_LEN (sizeof(struct port100_tg_comm_rf_cmd))\ndrivers/nfc/port100.c-35-\n--\ndrivers/nfc/port100.c-37- * Max extended frame payload len, excluding CC and SCC\ndrivers/nfc/port100.c:38: * which are already in PORT100_FRAME_HEADER_LEN.\ndrivers/nfc/port100.c-39- */\ndrivers/nfc/port100.c:40:#define PORT100_FRAME_MAX_PAYLOAD_LEN 1001\ndrivers/nfc/port100.c-41-\ndrivers/nfc/port100.c:42:#define PORT100_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),\ndrivers/nfc/port100.c-43-\t\t\t\t    Postamble (1) */\ndrivers/nfc/port100.c:44:static u8 ack_frame[PORT100_FRAME_ACK_SIZE] = {\ndrivers/nfc/port100.c-45-\t0x00, 0x00, 0xff, 0x00, 0xff, 0x00\n--\ndrivers/nfc/port100.c-47-\ndrivers/nfc/port100.c:48:#define PORT100_FRAME_CHECKSUM(f) (f-\u003edata[le16_to_cpu(f-\u003edatalen)])\ndrivers/nfc/port100.c:49:#define PORT100_FRAME_POSTAMBLE(f) (f-\u003edata[le16_to_cpu(f-\u003edatalen) + 1])\ndrivers/nfc/port100.c-50-\ndrivers/nfc/port100.c-51-/* start of frame */\ndrivers/nfc/port100.c:52:#define PORT100_FRAME_SOF\t0x00FF\ndrivers/nfc/port100.c:53:#define PORT100_FRAME_EXT\t0xFFFF\ndrivers/nfc/port100.c:54:#define PORT100_FRAME_ACK\t0x00FF\ndrivers/nfc/port100.c-55-\ndrivers/nfc/port100.c-56-/* Port-100 command: in or out */\ndrivers/nfc/port100.c:57:#define PORT100_FRAME_DIRECTION(f) (f-\u003edata[0]) /* CC */\ndrivers/nfc/port100.c:58:#define PORT100_FRAME_DIR_OUT 0xD6\ndrivers/nfc/port100.c:59:#define PORT100_FRAME_DIR_IN  0xD7\ndrivers/nfc/port100.c-60-\ndrivers/nfc/port100.c-61-/* Port-100 sub-command */\ndrivers/nfc/port100.c:62:#define PORT100_FRAME_CMD(f) (f-\u003edata[1]) /* SCC */\ndrivers/nfc/port100.c-63-\ndrivers/nfc/port100.c:64:#define PORT100_CMD_GET_FIRMWARE_VERSION 0x20\ndrivers/nfc/port100.c:65:#define PORT100_CMD_GET_COMMAND_TYPE     0x28\ndrivers/nfc/port100.c:66:#define PORT100_CMD_SET_COMMAND_TYPE     0x2A\ndrivers/nfc/port100.c-67-\ndrivers/nfc/port100.c:68:#define PORT100_CMD_IN_SET_RF       0x00\ndrivers/nfc/port100.c:69:#define PORT100_CMD_IN_SET_PROTOCOL 0x02\ndrivers/nfc/port100.c:70:#define PORT100_CMD_IN_COMM_RF      0x04\ndrivers/nfc/port100.c-71-\ndrivers/nfc/port100.c:72:#define PORT100_CMD_TG_SET_RF       0x40\ndrivers/nfc/port100.c:73:#define PORT100_CMD_TG_SET_PROTOCOL 0x42\ndrivers/nfc/port100.c:74:#define PORT100_CMD_TG_SET_RF_OFF   0x46\ndrivers/nfc/port100.c:75:#define PORT100_CMD_TG_COMM_RF      0x48\ndrivers/nfc/port100.c-76-\ndrivers/nfc/port100.c:77:#define PORT100_CMD_SWITCH_RF       0x06\ndrivers/nfc/port100.c-78-\ndrivers/nfc/port100.c:79:#define PORT100_CMD_RESPONSE(cmd) (cmd + 1)\ndrivers/nfc/port100.c-80-\ndrivers/nfc/port100.c:81:#define PORT100_CMD_TYPE_IS_SUPPORTED(mask, cmd_type) \\\ndrivers/nfc/port100.c-82-\t((mask) \u0026 (0x01 \u003c\u003c (cmd_type)))\ndrivers/nfc/port100.c:83:#define PORT100_CMD_TYPE_0\t0\ndrivers/nfc/port100.c:84:#define PORT100_CMD_TYPE_1\t1\ndrivers/nfc/port100.c-85-\ndrivers/nfc/port100.c:86:#define PORT100_CMD_STATUS_OK      0x00\ndrivers/nfc/port100.c:87:#define PORT100_CMD_STATUS_TIMEOUT 0x80\ndrivers/nfc/port100.c-88-\ndrivers/nfc/port100.c:89:#define PORT100_MDAA_TGT_HAS_BEEN_ACTIVATED_MASK 0x01\ndrivers/nfc/port100.c:90:#define PORT100_MDAA_TGT_WAS_ACTIVATED_MASK      0x02\ndrivers/nfc/port100.c-91-\n--\ndrivers/nfc/port100.c=106=struct port100_in_rf_setting {\n--\ndrivers/nfc/port100.c-112-\ndrivers/nfc/port100.c:113:#define PORT100_COMM_TYPE_IN_212F 0x01\ndrivers/nfc/port100.c:114:#define PORT100_COMM_TYPE_IN_424F 0x02\ndrivers/nfc/port100.c:115:#define PORT100_COMM_TYPE_IN_106A 0x03\ndrivers/nfc/port100.c:116:#define PORT100_COMM_TYPE_IN_106B 0x07\ndrivers/nfc/port100.c-117-\ndrivers/nfc/port100.c=118=static const struct port100_in_rf_setting in_rf_settings[] = {\n--\ndrivers/nfc/port100.c-120-\t\t.in_send_set_number = 1,\ndrivers/nfc/port100.c:121:\t\t.in_send_comm_type  = PORT100_COMM_TYPE_IN_212F,\ndrivers/nfc/port100.c-122-\t\t.in_recv_set_number = 15,\ndrivers/nfc/port100.c:123:\t\t.in_recv_comm_type  = PORT100_COMM_TYPE_IN_212F,\ndrivers/nfc/port100.c-124-\t},\n--\ndrivers/nfc/port100.c-126-\t\t.in_send_set_number = 1,\ndrivers/nfc/port100.c:127:\t\t.in_send_comm_type  = PORT100_COMM_TYPE_IN_424F,\ndrivers/nfc/port100.c-128-\t\t.in_recv_set_number = 15,\ndrivers/nfc/port100.c:129:\t\t.in_recv_comm_type  = PORT100_COMM_TYPE_IN_424F,\ndrivers/nfc/port100.c-130-\t},\n--\ndrivers/nfc/port100.c-132-\t\t.in_send_set_number = 2,\ndrivers/nfc/port100.c:133:\t\t.in_send_comm_type  = PORT100_COMM_TYPE_IN_106A,\ndrivers/nfc/port100.c-134-\t\t.in_recv_set_number = 15,\ndrivers/nfc/port100.c:135:\t\t.in_recv_comm_type  = PORT100_COMM_TYPE_IN_106A,\ndrivers/nfc/port100.c-136-\t},\n--\ndrivers/nfc/port100.c-138-\t\t.in_send_set_number = 3,\ndrivers/nfc/port100.c:139:\t\t.in_send_comm_type  = PORT100_COMM_TYPE_IN_106B,\ndrivers/nfc/port100.c-140-\t\t.in_recv_set_number = 15,\ndrivers/nfc/port100.c:141:\t\t.in_recv_comm_type  = PORT100_COMM_TYPE_IN_106B,\ndrivers/nfc/port100.c-142-\t},\n--\ndrivers/nfc/port100.c=158=struct port100_tg_rf_setting {\n--\ndrivers/nfc/port100.c-162-\ndrivers/nfc/port100.c:163:#define PORT100_COMM_TYPE_TG_106A 0x0B\ndrivers/nfc/port100.c:164:#define PORT100_COMM_TYPE_TG_212F 0x0C\ndrivers/nfc/port100.c:165:#define PORT100_COMM_TYPE_TG_424F 0x0D\ndrivers/nfc/port100.c-166-\ndrivers/nfc/port100.c=167=static const struct port100_tg_rf_setting tg_rf_settings[] = {\n--\ndrivers/nfc/port100.c-169-\t\t.tg_set_number = 8,\ndrivers/nfc/port100.c:170:\t\t.tg_comm_type = PORT100_COMM_TYPE_TG_106A,\ndrivers/nfc/port100.c-171-\t},\n--\ndrivers/nfc/port100.c-173-\t\t.tg_set_number = 8,\ndrivers/nfc/port100.c:174:\t\t.tg_comm_type = PORT100_COMM_TYPE_TG_212F,\ndrivers/nfc/port100.c-175-\t},\n--\ndrivers/nfc/port100.c-177-\t\t.tg_set_number = 8,\ndrivers/nfc/port100.c:178:\t\t.tg_comm_type = PORT100_COMM_TYPE_TG_424F,\ndrivers/nfc/port100.c-179-\t},\n--\ndrivers/nfc/port100.c-184-\ndrivers/nfc/port100.c:185:#define PORT100_IN_PROT_INITIAL_GUARD_TIME      0x00\ndrivers/nfc/port100.c:186:#define PORT100_IN_PROT_ADD_CRC                 0x01\ndrivers/nfc/port100.c:187:#define PORT100_IN_PROT_CHECK_CRC               0x02\ndrivers/nfc/port100.c:188:#define PORT100_IN_PROT_MULTI_CARD              0x03\ndrivers/nfc/port100.c:189:#define PORT100_IN_PROT_ADD_PARITY              0x04\ndrivers/nfc/port100.c:190:#define PORT100_IN_PROT_CHECK_PARITY            0x05\ndrivers/nfc/port100.c:191:#define PORT100_IN_PROT_BITWISE_AC_RECV_MODE    0x06\ndrivers/nfc/port100.c:192:#define PORT100_IN_PROT_VALID_BIT_NUMBER        0x07\ndrivers/nfc/port100.c:193:#define PORT100_IN_PROT_CRYPTO1                 0x08\ndrivers/nfc/port100.c:194:#define PORT100_IN_PROT_ADD_SOF                 0x09\ndrivers/nfc/port100.c:195:#define PORT100_IN_PROT_CHECK_SOF               0x0A\ndrivers/nfc/port100.c:196:#define PORT100_IN_PROT_ADD_EOF                 0x0B\ndrivers/nfc/port100.c:197:#define PORT100_IN_PROT_CHECK_EOF               0x0C\ndrivers/nfc/port100.c:198:#define PORT100_IN_PROT_DEAF_TIME               0x0E\ndrivers/nfc/port100.c:199:#define PORT100_IN_PROT_CRM                     0x0F\ndrivers/nfc/port100.c:200:#define PORT100_IN_PROT_CRM_MIN_LEN             0x10\ndrivers/nfc/port100.c:201:#define PORT100_IN_PROT_T1_TAG_FRAME            0x11\ndrivers/nfc/port100.c:202:#define PORT100_IN_PROT_RFCA                    0x12\ndrivers/nfc/port100.c:203:#define PORT100_IN_PROT_GUARD_TIME_AT_INITIATOR 0x13\ndrivers/nfc/port100.c:204:#define PORT100_IN_PROT_END                     0x14\ndrivers/nfc/port100.c-205-\ndrivers/nfc/port100.c:206:#define PORT100_IN_MAX_NUM_PROTOCOLS            19\ndrivers/nfc/port100.c-207-\ndrivers/nfc/port100.c:208:#define PORT100_TG_PROT_TU           0x00\ndrivers/nfc/port100.c:209:#define PORT100_TG_PROT_RF_OFF       0x01\ndrivers/nfc/port100.c:210:#define PORT100_TG_PROT_CRM          0x02\ndrivers/nfc/port100.c:211:#define PORT100_TG_PROT_END          0x03\ndrivers/nfc/port100.c-212-\ndrivers/nfc/port100.c:213:#define PORT100_TG_MAX_NUM_PROTOCOLS 3\ndrivers/nfc/port100.c-214-\n--\ndrivers/nfc/port100.c=220=static const struct port100_protocol\ndrivers/nfc/port100.c:221:in_protocols[][PORT100_IN_MAX_NUM_PROTOCOLS + 1] = {\ndrivers/nfc/port100.c-222-\t[NFC_DIGITAL_FRAMING_NFCA_SHORT] = {\ndrivers/nfc/port100.c:223:\t\t{ PORT100_IN_PROT_INITIAL_GUARD_TIME,      6 },\ndrivers/nfc/port100.c:224:\t\t{ PORT100_IN_PROT_ADD_CRC,                 0 },\ndrivers/nfc/port100.c:225:\t\t{ PORT100_IN_PROT_CHECK_CRC,               0 },\ndrivers/nfc/port100.c:226:\t\t{ PORT100_IN_PROT_MULTI_CARD,              0 },\ndrivers/nfc/port100.c:227:\t\t{ PORT100_IN_PROT_ADD_PARITY,              0 },\ndrivers/nfc/port100.c:228:\t\t{ PORT100_IN_PROT_CHECK_PARITY,            1 },\ndrivers/nfc/port100.c:229:\t\t{ PORT100_IN_PROT_BITWISE_AC_RECV_MODE,    0 },\ndrivers/nfc/port100.c:230:\t\t{ PORT100_IN_PROT_VALID_BIT_NUMBER,        7 },\ndrivers/nfc/port100.c:231:\t\t{ PORT100_IN_PROT_CRYPTO1,                 0 },\ndrivers/nfc/port100.c:232:\t\t{ PORT100_IN_PROT_ADD_SOF,                 0 },\ndrivers/nfc/port100.c:233:\t\t{ PORT100_IN_PROT_CHECK_SOF,               0 },\ndrivers/nfc/port100.c:234:\t\t{ PORT100_IN_PROT_ADD_EOF,                 0 },\ndrivers/nfc/port100.c:235:\t\t{ PORT100_IN_PROT_CHECK_EOF,               0 },\ndrivers/nfc/port100.c:236:\t\t{ PORT100_IN_PROT_DEAF_TIME,               4 },\ndrivers/nfc/port100.c:237:\t\t{ PORT100_IN_PROT_CRM,                     0 },\ndrivers/nfc/port100.c:238:\t\t{ PORT100_IN_PROT_CRM_MIN_LEN,             0 },\ndrivers/nfc/port100.c:239:\t\t{ PORT100_IN_PROT_T1_TAG_FRAME,            0 },\ndrivers/nfc/port100.c:240:\t\t{ PORT100_IN_PROT_RFCA,                    0 },\ndrivers/nfc/port100.c:241:\t\t{ PORT100_IN_PROT_GUARD_TIME_AT_INITIATOR, 6 },\ndrivers/nfc/port100.c:242:\t\t{ PORT100_IN_PROT_END,                     0 },\ndrivers/nfc/port100.c-243-\t},\ndrivers/nfc/port100.c-244-\t[NFC_DIGITAL_FRAMING_NFCA_STANDARD] = {\ndrivers/nfc/port100.c:245:\t\t{ PORT100_IN_PROT_INITIAL_GUARD_TIME,      6 },\ndrivers/nfc/port100.c:246:\t\t{ PORT100_IN_PROT_ADD_CRC,                 0 },\ndrivers/nfc/port100.c:247:\t\t{ PORT100_IN_PROT_CHECK_CRC,               0 },\ndrivers/nfc/port100.c:248:\t\t{ PORT100_IN_PROT_MULTI_CARD,              0 },\ndrivers/nfc/port100.c:249:\t\t{ PORT100_IN_PROT_ADD_PARITY,              1 },\ndrivers/nfc/port100.c:250:\t\t{ PORT100_IN_PROT_CHECK_PARITY,            1 },\ndrivers/nfc/port100.c:251:\t\t{ PORT100_IN_PROT_BITWISE_AC_RECV_MODE,    0 },\ndrivers/nfc/port100.c:252:\t\t{ PORT100_IN_PROT_VALID_BIT_NUMBER,        8 },\ndrivers/nfc/port100.c:253:\t\t{ PORT100_IN_PROT_CRYPTO1,                 0 },\ndrivers/nfc/port100.c:254:\t\t{ PORT100_IN_PROT_ADD_SOF,                 0 },\ndrivers/nfc/port100.c:255:\t\t{ PORT100_IN_PROT_CHECK_SOF,               0 },\ndrivers/nfc/port100.c:256:\t\t{ PORT100_IN_PROT_ADD_EOF,                 0 },\ndrivers/nfc/port100.c:257:\t\t{ PORT100_IN_PROT_CHECK_EOF,               0 },\ndrivers/nfc/port100.c:258:\t\t{ PORT100_IN_PROT_DEAF_TIME,               4 },\ndrivers/nfc/port100.c:259:\t\t{ PORT100_IN_PROT_CRM,                     0 },\ndrivers/nfc/port100.c:260:\t\t{ PORT100_IN_PROT_CRM_MIN_LEN,             0 },\ndrivers/nfc/port100.c:261:\t\t{ PORT100_IN_PROT_T1_TAG_FRAME,            0 },\ndrivers/nfc/port100.c:262:\t\t{ PORT100_IN_PROT_RFCA,                    0 },\ndrivers/nfc/port100.c:263:\t\t{ PORT100_IN_PROT_GUARD_TIME_AT_INITIATOR, 6 },\ndrivers/nfc/port100.c:264:\t\t{ PORT100_IN_PROT_END,                     0 },\ndrivers/nfc/port100.c-265-\t},\ndrivers/nfc/port100.c-266-\t[NFC_DIGITAL_FRAMING_NFCA_STANDARD_WITH_CRC_A] = {\ndrivers/nfc/port100.c:267:\t\t{ PORT100_IN_PROT_INITIAL_GUARD_TIME,      6 },\ndrivers/nfc/port100.c:268:\t\t{ PORT100_IN_PROT_ADD_CRC,                 1 },\ndrivers/nfc/port100.c:269:\t\t{ PORT100_IN_PROT_CHECK_CRC,               1 },\ndrivers/nfc/port100.c:270:\t\t{ PORT100_IN_PROT_MULTI_CARD,              0 },\ndrivers/nfc/port100.c:271:\t\t{ PORT100_IN_PROT_ADD_PARITY,              1 },\ndrivers/nfc/port100.c:272:\t\t{ PORT100_IN_PROT_CHECK_PARITY,            1 },\ndrivers/nfc/port100.c:273:\t\t{ PORT100_IN_PROT_BITWISE_AC_RECV_MODE,    0 },\ndrivers/nfc/port100.c:274:\t\t{ PORT100_IN_PROT_VALID_BIT_NUMBER,        8 },\ndrivers/nfc/port100.c:275:\t\t{ PORT100_IN_PROT_CRYPTO1,                 0 },\ndrivers/nfc/port100.c:276:\t\t{ PORT100_IN_PROT_ADD_SOF,                 0 },\ndrivers/nfc/port100.c:277:\t\t{ PORT100_IN_PROT_CHECK_SOF,               0 },\ndrivers/nfc/port100.c:278:\t\t{ PORT100_IN_PROT_ADD_EOF,                 0 },\ndrivers/nfc/port100.c:279:\t\t{ PORT100_IN_PROT_CHECK_EOF,               0 },\ndrivers/nfc/port100.c:280:\t\t{ PORT100_IN_PROT_DEAF_TIME,               4 },\ndrivers/nfc/port100.c:281:\t\t{ PORT100_IN_PROT_CRM,                     0 },\ndrivers/nfc/port100.c:282:\t\t{ PORT100_IN_PROT_CRM_MIN_LEN,             0 },\ndrivers/nfc/port100.c:283:\t\t{ PORT100_IN_PROT_T1_TAG_FRAME,            0 },\ndrivers/nfc/port100.c:284:\t\t{ PORT100_IN_PROT_RFCA,                    0 },\ndrivers/nfc/port100.c:285:\t\t{ PORT100_IN_PROT_GUARD_TIME_AT_INITIATOR, 6 },\ndrivers/nfc/port100.c:286:\t\t{ PORT100_IN_PROT_END,                     0 },\ndrivers/nfc/port100.c-287-\t},\n--\ndrivers/nfc/port100.c-289-\t\t/* nfc_digital_framing_nfca_short */\ndrivers/nfc/port100.c:290:\t\t{ PORT100_IN_PROT_ADD_CRC,          2 },\ndrivers/nfc/port100.c:291:\t\t{ PORT100_IN_PROT_CHECK_CRC,        2 },\ndrivers/nfc/port100.c:292:\t\t{ PORT100_IN_PROT_VALID_BIT_NUMBER, 8 },\ndrivers/nfc/port100.c:293:\t\t{ PORT100_IN_PROT_T1_TAG_FRAME,     2 },\ndrivers/nfc/port100.c:294:\t\t{ PORT100_IN_PROT_END,              0 },\ndrivers/nfc/port100.c-295-\t},\n--\ndrivers/nfc/port100.c-297-\t\t/* nfc_digital_framing_nfca_standard */\ndrivers/nfc/port100.c:298:\t\t{ PORT100_IN_PROT_ADD_CRC,   1 },\ndrivers/nfc/port100.c:299:\t\t{ PORT100_IN_PROT_CHECK_CRC, 0 },\ndrivers/nfc/port100.c:300:\t\t{ PORT100_IN_PROT_END,       0 },\ndrivers/nfc/port100.c-301-\t},\n--\ndrivers/nfc/port100.c-303-\t\t/* nfc_digital_framing_nfca_standard_with_crc_a */\ndrivers/nfc/port100.c:304:\t\t{ PORT100_IN_PROT_END,       0 },\ndrivers/nfc/port100.c-305-\t},\n--\ndrivers/nfc/port100.c-307-\t\t/* nfc_digital_framing_nfca_standard */\ndrivers/nfc/port100.c:308:\t\t{ PORT100_IN_PROT_END, 0 },\ndrivers/nfc/port100.c-309-\t},\ndrivers/nfc/port100.c-310-\t[NFC_DIGITAL_FRAMING_NFCF] = {\ndrivers/nfc/port100.c:311:\t\t{ PORT100_IN_PROT_INITIAL_GUARD_TIME,     18 },\ndrivers/nfc/port100.c:312:\t\t{ PORT100_IN_PROT_ADD_CRC,                 1 },\ndrivers/nfc/port100.c:313:\t\t{ PORT100_IN_PROT_CHECK_CRC,               1 },\ndrivers/nfc/port100.c:314:\t\t{ PORT100_IN_PROT_MULTI_CARD,              0 },\ndrivers/nfc/port100.c:315:\t\t{ PORT100_IN_PROT_ADD_PARITY,              0 },\ndrivers/nfc/port100.c:316:\t\t{ PORT100_IN_PROT_CHECK_PARITY,            0 },\ndrivers/nfc/port100.c:317:\t\t{ PORT100_IN_PROT_BITWISE_AC_RECV_MODE,    0 },\ndrivers/nfc/port100.c:318:\t\t{ PORT100_IN_PROT_VALID_BIT_NUMBER,        8 },\ndrivers/nfc/port100.c:319:\t\t{ PORT100_IN_PROT_CRYPTO1,                 0 },\ndrivers/nfc/port100.c:320:\t\t{ PORT100_IN_PROT_ADD_SOF,                 0 },\ndrivers/nfc/port100.c:321:\t\t{ PORT100_IN_PROT_CHECK_SOF,               0 },\ndrivers/nfc/port100.c:322:\t\t{ PORT100_IN_PROT_ADD_EOF,                 0 },\ndrivers/nfc/port100.c:323:\t\t{ PORT100_IN_PROT_CHECK_EOF,               0 },\ndrivers/nfc/port100.c:324:\t\t{ PORT100_IN_PROT_DEAF_TIME,               4 },\ndrivers/nfc/port100.c:325:\t\t{ PORT100_IN_PROT_CRM,                     0 },\ndrivers/nfc/port100.c:326:\t\t{ PORT100_IN_PROT_CRM_MIN_LEN,             0 },\ndrivers/nfc/port100.c:327:\t\t{ PORT100_IN_PROT_T1_TAG_FRAME,            0 },\ndrivers/nfc/port100.c:328:\t\t{ PORT100_IN_PROT_RFCA,                    0 },\ndrivers/nfc/port100.c:329:\t\t{ PORT100_IN_PROT_GUARD_TIME_AT_INITIATOR, 6 },\ndrivers/nfc/port100.c:330:\t\t{ PORT100_IN_PROT_END,                     0 },\ndrivers/nfc/port100.c-331-\t},\n--\ndrivers/nfc/port100.c-333-\t\t/* nfc_digital_framing_nfcf */\ndrivers/nfc/port100.c:334:\t\t{ PORT100_IN_PROT_END, 0 },\ndrivers/nfc/port100.c-335-\t},\n--\ndrivers/nfc/port100.c-337-\t\t/* nfc_digital_framing_nfcf */\ndrivers/nfc/port100.c:338:\t\t{ PORT100_IN_PROT_INITIAL_GUARD_TIME,     18 },\ndrivers/nfc/port100.c:339:\t\t{ PORT100_IN_PROT_ADD_CRC,                 1 },\ndrivers/nfc/port100.c:340:\t\t{ PORT100_IN_PROT_CHECK_CRC,               1 },\ndrivers/nfc/port100.c:341:\t\t{ PORT100_IN_PROT_MULTI_CARD,              0 },\ndrivers/nfc/port100.c:342:\t\t{ PORT100_IN_PROT_ADD_PARITY,              0 },\ndrivers/nfc/port100.c:343:\t\t{ PORT100_IN_PROT_CHECK_PARITY,            0 },\ndrivers/nfc/port100.c:344:\t\t{ PORT100_IN_PROT_BITWISE_AC_RECV_MODE,    0 },\ndrivers/nfc/port100.c:345:\t\t{ PORT100_IN_PROT_VALID_BIT_NUMBER,        8 },\ndrivers/nfc/port100.c:346:\t\t{ PORT100_IN_PROT_CRYPTO1,                 0 },\ndrivers/nfc/port100.c:347:\t\t{ PORT100_IN_PROT_ADD_SOF,                 0 },\ndrivers/nfc/port100.c:348:\t\t{ PORT100_IN_PROT_CHECK_SOF,               0 },\ndrivers/nfc/port100.c:349:\t\t{ PORT100_IN_PROT_ADD_EOF,                 0 },\ndrivers/nfc/port100.c:350:\t\t{ PORT100_IN_PROT_CHECK_EOF,               0 },\ndrivers/nfc/port100.c:351:\t\t{ PORT100_IN_PROT_DEAF_TIME,               4 },\ndrivers/nfc/port100.c:352:\t\t{ PORT100_IN_PROT_CRM,                     0 },\ndrivers/nfc/port100.c:353:\t\t{ PORT100_IN_PROT_CRM_MIN_LEN,             0 },\ndrivers/nfc/port100.c:354:\t\t{ PORT100_IN_PROT_T1_TAG_FRAME,            0 },\ndrivers/nfc/port100.c:355:\t\t{ PORT100_IN_PROT_RFCA,                    0 },\ndrivers/nfc/port100.c:356:\t\t{ PORT100_IN_PROT_GUARD_TIME_AT_INITIATOR, 6 },\ndrivers/nfc/port100.c:357:\t\t{ PORT100_IN_PROT_END,                     0 },\ndrivers/nfc/port100.c-358-\t},\ndrivers/nfc/port100.c-359-\t[NFC_DIGITAL_FRAMING_NFC_DEP_ACTIVATED] = {\ndrivers/nfc/port100.c:360:\t\t{ PORT100_IN_PROT_END, 0 },\ndrivers/nfc/port100.c-361-\t},\ndrivers/nfc/port100.c-362-\t[NFC_DIGITAL_FRAMING_NFCB] = {\ndrivers/nfc/port100.c:363:\t\t{ PORT100_IN_PROT_INITIAL_GUARD_TIME,     20 },\ndrivers/nfc/port100.c:364:\t\t{ PORT100_IN_PROT_ADD_CRC,                 1 },\ndrivers/nfc/port100.c:365:\t\t{ PORT100_IN_PROT_CHECK_CRC,               1 },\ndrivers/nfc/port100.c:366:\t\t{ PORT100_IN_PROT_MULTI_CARD,              0 },\ndrivers/nfc/port100.c:367:\t\t{ PORT100_IN_PROT_ADD_PARITY,              0 },\ndrivers/nfc/port100.c:368:\t\t{ PORT100_IN_PROT_CHECK_PARITY,            0 },\ndrivers/nfc/port100.c:369:\t\t{ PORT100_IN_PROT_BITWISE_AC_RECV_MODE,    0 },\ndrivers/nfc/port100.c:370:\t\t{ PORT100_IN_PROT_VALID_BIT_NUMBER,        8 },\ndrivers/nfc/port100.c:371:\t\t{ PORT100_IN_PROT_CRYPTO1,                 0 },\ndrivers/nfc/port100.c:372:\t\t{ PORT100_IN_PROT_ADD_SOF,                 1 },\ndrivers/nfc/port100.c:373:\t\t{ PORT100_IN_PROT_CHECK_SOF,               1 },\ndrivers/nfc/port100.c:374:\t\t{ PORT100_IN_PROT_ADD_EOF,                 1 },\ndrivers/nfc/port100.c:375:\t\t{ PORT100_IN_PROT_CHECK_EOF,               1 },\ndrivers/nfc/port100.c:376:\t\t{ PORT100_IN_PROT_DEAF_TIME,               4 },\ndrivers/nfc/port100.c:377:\t\t{ PORT100_IN_PROT_CRM,                     0 },\ndrivers/nfc/port100.c:378:\t\t{ PORT100_IN_PROT_CRM_MIN_LEN,             0 },\ndrivers/nfc/port100.c:379:\t\t{ PORT100_IN_PROT_T1_TAG_FRAME,            0 },\ndrivers/nfc/port100.c:380:\t\t{ PORT100_IN_PROT_RFCA,                    0 },\ndrivers/nfc/port100.c:381:\t\t{ PORT100_IN_PROT_GUARD_TIME_AT_INITIATOR, 6 },\ndrivers/nfc/port100.c:382:\t\t{ PORT100_IN_PROT_END,                     0 },\ndrivers/nfc/port100.c-383-\t},\n--\ndrivers/nfc/port100.c-385-\t\t/* nfc_digital_framing_nfcb */\ndrivers/nfc/port100.c:386:\t\t{ PORT100_IN_PROT_END,                     0 },\ndrivers/nfc/port100.c-387-\t},\n--\ndrivers/nfc/port100.c-389-\t[NFC_DIGITAL_FRAMING_LAST] = {\ndrivers/nfc/port100.c:390:\t\t{ PORT100_IN_PROT_END, 0 },\ndrivers/nfc/port100.c-391-\t},\n--\ndrivers/nfc/port100.c=394=static const struct port100_protocol\ndrivers/nfc/port100.c:395:tg_protocols[][PORT100_TG_MAX_NUM_PROTOCOLS + 1] = {\ndrivers/nfc/port100.c-396-\t[NFC_DIGITAL_FRAMING_NFCA_SHORT] = {\ndrivers/nfc/port100.c:397:\t\t{ PORT100_TG_PROT_END, 0 },\ndrivers/nfc/port100.c-398-\t},\ndrivers/nfc/port100.c-399-\t[NFC_DIGITAL_FRAMING_NFCA_STANDARD] = {\ndrivers/nfc/port100.c:400:\t\t{ PORT100_TG_PROT_END, 0 },\ndrivers/nfc/port100.c-401-\t},\ndrivers/nfc/port100.c-402-\t[NFC_DIGITAL_FRAMING_NFCA_STANDARD_WITH_CRC_A] = {\ndrivers/nfc/port100.c:403:\t\t{ PORT100_TG_PROT_END, 0 },\ndrivers/nfc/port100.c-404-\t},\ndrivers/nfc/port100.c-405-\t[NFC_DIGITAL_FRAMING_NFCA_T1T] = {\ndrivers/nfc/port100.c:406:\t\t{ PORT100_TG_PROT_END, 0 },\ndrivers/nfc/port100.c-407-\t},\ndrivers/nfc/port100.c-408-\t[NFC_DIGITAL_FRAMING_NFCA_T2T] = {\ndrivers/nfc/port100.c:409:\t\t{ PORT100_TG_PROT_END, 0 },\ndrivers/nfc/port100.c-410-\t},\ndrivers/nfc/port100.c-411-\t[NFC_DIGITAL_FRAMING_NFCA_NFC_DEP] = {\ndrivers/nfc/port100.c:412:\t\t{ PORT100_TG_PROT_TU,     1 },\ndrivers/nfc/port100.c:413:\t\t{ PORT100_TG_PROT_RF_OFF, 0 },\ndrivers/nfc/port100.c:414:\t\t{ PORT100_TG_PROT_CRM,    7 },\ndrivers/nfc/port100.c:415:\t\t{ PORT100_TG_PROT_END,    0 },\ndrivers/nfc/port100.c-416-\t},\ndrivers/nfc/port100.c-417-\t[NFC_DIGITAL_FRAMING_NFCF] = {\ndrivers/nfc/port100.c:418:\t\t{ PORT100_TG_PROT_END, 0 },\ndrivers/nfc/port100.c-419-\t},\ndrivers/nfc/port100.c-420-\t[NFC_DIGITAL_FRAMING_NFCF_T3T] = {\ndrivers/nfc/port100.c:421:\t\t{ PORT100_TG_PROT_END, 0 },\ndrivers/nfc/port100.c-422-\t},\ndrivers/nfc/port100.c-423-\t[NFC_DIGITAL_FRAMING_NFCF_NFC_DEP] = {\ndrivers/nfc/port100.c:424:\t\t{ PORT100_TG_PROT_TU,     1 },\ndrivers/nfc/port100.c:425:\t\t{ PORT100_TG_PROT_RF_OFF, 0 },\ndrivers/nfc/port100.c:426:\t\t{ PORT100_TG_PROT_CRM,    7 },\ndrivers/nfc/port100.c:427:\t\t{ PORT100_TG_PROT_END,    0 },\ndrivers/nfc/port100.c-428-\t},\ndrivers/nfc/port100.c-429-\t[NFC_DIGITAL_FRAMING_NFC_DEP_ACTIVATED] = {\ndrivers/nfc/port100.c:430:\t\t{ PORT100_TG_PROT_RF_OFF, 1 },\ndrivers/nfc/port100.c:431:\t\t{ PORT100_TG_PROT_END,    0 },\ndrivers/nfc/port100.c-432-\t},\n--\ndrivers/nfc/port100.c-434-\t[NFC_DIGITAL_FRAMING_LAST] = {\ndrivers/nfc/port100.c:435:\t\t{ PORT100_TG_PROT_END,    0 },\ndrivers/nfc/port100.c-436-\t},\n--\ndrivers/nfc/port100.c=540=static void port100_tx_frame_init(void *_frame, u8 cmd_code)\n--\ndrivers/nfc/port100.c-544-\tframe-\u003epreamble = 0;\ndrivers/nfc/port100.c:545:\tframe-\u003estart_frame = cpu_to_be16(PORT100_FRAME_SOF);\ndrivers/nfc/port100.c:546:\tframe-\u003eextended_frame = cpu_to_be16(PORT100_FRAME_EXT);\ndrivers/nfc/port100.c:547:\tPORT100_FRAME_DIRECTION(frame) = PORT100_FRAME_DIR_OUT;\ndrivers/nfc/port100.c:548:\tPORT100_FRAME_CMD(frame) = cmd_code;\ndrivers/nfc/port100.c-549-\tframe-\u003edatalen = cpu_to_le16(2);\n--\ndrivers/nfc/port100.c=552=static void port100_tx_frame_finish(void *_frame)\n--\ndrivers/nfc/port100.c-557-\ndrivers/nfc/port100.c:558:\tPORT100_FRAME_CHECKSUM(frame) =\ndrivers/nfc/port100.c-559-\t\tport100_data_checksum(frame-\u003edata, le16_to_cpu(frame-\u003edatalen));\ndrivers/nfc/port100.c-560-\ndrivers/nfc/port100.c:561:\tPORT100_FRAME_POSTAMBLE(frame) = 0;\ndrivers/nfc/port100.c-562-}\n--\ndrivers/nfc/port100.c=571=static bool port100_rx_frame_is_valid(const void *_frame)\n--\ndrivers/nfc/port100.c-575-\ndrivers/nfc/port100.c:576:\tif (frame-\u003estart_frame != cpu_to_be16(PORT100_FRAME_SOF) ||\n\n"
}

gemini-3.8-flash

null

null

							input: 55829
							output: 168
							thoughts: 1632
						

**Analysis of NFC Digital Target DEP Request Handling**

Okay, let's break this down. My goal is to determine the impact of this patch and whether fuzzing is warranted. I see the key configuration options are `CONFIG_NFC` and `CONFIG_NFC_DIGITAL`. Looking at `drivers/nfc/Kconfig`, it's evident that `NFC_SIM` and `NFC_PORT100` are also relevant, but the core building blocks are `NFC` and `NFC_DIGITAL`, which directly enable the digital NFC protocol stack, specifically `digital_dep.c`.

The heart of this patch lies within `net/nfc/digital_dep.c`, specifically the `digital_tg_recv_dep_req` function. It's marked `static`, but, crucially, it's not inlined because its address is taken and passed as a function pointer: this means it generates a unique symbol and is definitely a specific point to target. Other related functions in `digital_dep.c`, such as `digital_tg_send_dep_res`, `digital_tg_send_atr_res_complete`, and `digital_tg_send_psl_res_complete` are also in this same code.

This patch directly modifies the logic within `digital_tg_recv_dep_req` and, after carefully reviewing the code, it becomes clear what's happening. The original code had a potential out-of-bounds read vulnerability. Specifically, when handling a DEP (Data Exchange Protocol) request where the DID (Device ID) bit is set, it used a hardcoded index `3` to access the response data, even when the `resp->len` was smaller than that index. This patch fixes this by checking the bounds of `resp->data` before reading, ensuring the index is within the valid range and using the correct index via the `size` variable. This avoids the out-of-bounds read and fixes the potential vulnerability, but is still reachable code.

Now, considering the patch's changes, the core functions to focus on are `digital_tg_recv_dep_req` and potentially `digital_tg_send_dep_res`. These are the precise functions where the modified logic is implemented, making them the most relevant for testing.

To enable the code in this patch, the following configurations are necessary: `NFC` and `NFC_DIGITAL`.

Therefore, based on my understanding, fuzzing this code is essential. The patch addresses a tangible bug in kernel networking NFC protocol stack (`net/nfc/digital_dep.c`) that directly involves packet validation and checking bounds for DEP request frames in NFC target mode. It's a clear vulnerability that can be triggered through a variety of NFC digital devices, making fuzzing both practical and critical. I think we have enough information to call `set-results`.

{
  "EnableConfigs": [
    "NFC",
    "NFC_DIGITAL"
  ],
  "FocusSymbols": [
    "digital_tg_recv_dep_req",
    "digital_tg_send_dep_res"
  ],
  "Reasoning": "The patch fixes a bounds check and validation logic in digital_tg_recv_dep_req() when handling DEP (Data Exchange Protocol) request frames with the DID bit set in the NFC digital protocol stack. Previously, reading resp-\u003edata[3] could cause an out-of-bounds access if resp-\u003elen was insufficient. This code is reachable during NFC target mode communication via emulated virtual devices (nfcsim) or USB NFC devices (port100) supported in fuzzing environments.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "NFC",
    "NFC_DIGITAL"
  ],
  "FocusSymbols": [
    "digital_tg_recv_dep_req",
    "digital_tg_send_dep_res"
  ],
  "Reasoning": "The patch fixes a bounds check and validation logic in digital_tg_recv_dep_req() when handling DEP (Data Exchange Protocol) request frames with the DID bit set in the NFC digital protocol stack. Previously, reading resp-\u003edata[3] could cause an out-of-bounds access if resp-\u003elen was insufficient. This code is reachable during NFC target mode communication via emulated virtual devices (nfcsim) or USB NFC devices (port100) supported in fuzzing environments.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

core

null

{
  "KMSANReasoning": "The patch fixes a missing bounds check in net/nfc/digital_dep.c within digital_tg_recv_dep_req(). Previously, when DIGITAL_NFC_DEP_DID_BIT_SET(pfb) was true, resp-\u003edata[3] was accessed without checking if resp-\u003elen was at least 4 bytes (size + 1), potentially resulting in an out-of-bounds read on the received skb buffer. The patch adds `resp-\u003elen \u003c size + 1` to prevent this out-of-bounds read.\n\nThis is an out-of-bounds read vulnerability, which is detectable by KASAN. The patch does not introduce or manipulate uninitialized stack/heap memory, does not copy kernel data to user space, and does not alter control flow based on uninitialized fields. Thus, KMSAN is not required.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 18792d11503ffc451da57a5940b9a66e8d66f8bb
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Sep 13 20:39:16 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 3982fa084737f..ae5407fca12d4 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -1117,12 +1117,12 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
 	pfb = dep_req->pfb;
 
 	if (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {
-		if (ddev->did && (ddev->did == resp->data[3])) {
-			size++;
-		} else {
+		if (resp->len < size + 1 || !ddev->did ||
+		    ddev->did != resp->data[size]) {
 			rc = -EIO;
 			goto exit;
 		}
+		size++;
 	} else if (ddev->did) {
 		rc = -EIO;
 		goto exit;

gemini-3.8-flash

null

null

							input: 2171
							output: 39
							thoughts: 47
						

Okay, let's get down to brass tacks.

**Analyzing this Patch: A Focused Approach**

Alright, time to dive into this patch. My immediate instinct is to pinpoint the core of the change. I need to understand what's being altered and, more importantly, *why*. I'm going to start by zeroing in on `net/nfc/digital_dep.c`, specifically around line 1117. I'll probably fire up either `read-file` or `grepper` – whatever's quickest and most efficient given my current environment – to extract that section of the code and get a clearer picture. My goal is to understand the context and intent of the change before I go any deeper. This initial focused examination will give me a critical foundation for further analysis.

{
  "File": "net/nfc/digital_dep.c",
  "FirstLine": 1095,
  "LineCount": 55
}

{
  "Contents": "1095:\t\t}\n1096:\t\n1097:\t\trc = digital_skb_pull_dep_sod(ddev, resp);\n1098:\t\tif (rc) {\n1099:\t\t\tPROTOCOL_ERR(\"14.4.1.2\");\n1100:\t\t\tgoto exit;\n1101:\t\t}\n1102:\t\n1103:\t\tif (resp-\u003elen \u003e ddev-\u003elocal_payload_max) {\n1104:\t\t\trc = -EMSGSIZE;\n1105:\t\t\tgoto exit;\n1106:\t\t}\n1107:\t\n1108:\t\tsize = sizeof(struct digital_dep_req_res);\n1109:\t\tdep_req = (struct digital_dep_req_res *)resp-\u003edata;\n1110:\t\n1111:\t\tif (resp-\u003elen \u003c size || dep_req-\u003edir != DIGITAL_NFC_DEP_FRAME_DIR_OUT ||\n1112:\t\t    dep_req-\u003ecmd != DIGITAL_CMD_DEP_REQ) {\n1113:\t\t\trc = -EIO;\n1114:\t\t\tgoto exit;\n1115:\t\t}\n1116:\t\n1117:\t\tpfb = dep_req-\u003epfb;\n1118:\t\n1119:\t\tif (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {\n1120:\t\t\tif (resp-\u003elen \u003c size + 1 || !ddev-\u003edid ||\n1121:\t\t\t    ddev-\u003edid != resp-\u003edata[size]) {\n1122:\t\t\t\trc = -EIO;\n1123:\t\t\t\tgoto exit;\n1124:\t\t\t}\n1125:\t\t\tsize++;\n1126:\t\t} else if (ddev-\u003edid) {\n1127:\t\t\trc = -EIO;\n1128:\t\t\tgoto exit;\n1129:\t\t}\n1130:\t\n1131:\t\tif (DIGITAL_NFC_DEP_NAD_BIT_SET(pfb)) {\n1132:\t\t\trc = -EIO;\n1133:\t\t\tgoto exit;\n1134:\t\t}\n1135:\t\n1136:\t\tif (size \u003e resp-\u003elen) {\n1137:\t\t\trc = -EIO;\n1138:\t\t\tgoto exit;\n1139:\t\t}\n1140:\t\n1141:\t\tskb_pull(resp, size);\n1142:\t\n1143:\t\tswitch (DIGITAL_NFC_DEP_PFB_TYPE(pfb)) {\n1144:\t\tcase DIGITAL_NFC_DEP_PFB_I_PDU:\n1145:\t\t\tpr_debug(\"DIGITAL_NFC_DEP_PFB_I_PDU\\n\");\n1146:\t\n1147:\t\t\tif (ddev-\u003eatn_count) {\n1148:\t\t\t\t/* The target has received (and replied to) at least one\n1149:\t\t\t\t * ATN DEP_REQ.\n"
}

gemini-3.8-flash

null

null

							input: 3215
							output: 32
							thoughts: 163
						

**Analyzing a Digital NFC DEP Bug Fix**

Okay, let's dive into this patch. I need to understand the context and exactly what bug is being addressed, specifically within `net/nfc/digital_dep.c`. I'm seeing a code snippet here... it looks like a conditional block dealing with Device ID (DID) handling in the Digital NFC DEP protocol. I see the "Previously" code block, and I need to piece together the original logic. Okay, if the `DIGITAL_NFC_DEP_DID_BIT_SET(pfb)` macro is true, then we have a DID. The code checks if the device already has a `ddev->did` set and if the DID in the response `resp->data[3]` matches. If they match, then `size++`. If they *don't* match, it's an I/O error (`-EIO`), and we jump to the exit. Otherwise, if there's a device DID set (`ddev->did`), but `DIGITAL_NFC_DEP_DID_BIT_SET(pfb)` is *not* set, this again raises an I/O error. I get the basic gist of this, but hold on... I need to refresh my memory. What exactly is `resp->data[3]` supposed to be here? It feels like something is missing. I should check the definition of the `struct digital_dep_req_res` structure right away to properly understand what's happening.

{
  "Expression": "struct digital_dep_req_res",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/digital_dep.c=94=struct digital_psl_res {\n--\nnet/nfc/digital_dep.c-99-\nnet/nfc/digital_dep.c:100:struct digital_dep_req_res {\nnet/nfc/digital_dep.c-101-\tu8 dir;\n--\nnet/nfc/digital_dep.c=200=digital_send_dep_data_prep(struct nfc_digital_dev *ddev, struct sk_buff *skb,\nnet/nfc/digital_dep.c:201:\t\t\t   struct digital_dep_req_res *dep_req_res,\nnet/nfc/digital_dep.c-202-\t\t\t   struct digital_data_exch *data_exch)\n--\nnet/nfc/digital_dep.c=529=static int digital_in_send_ack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-531-{\nnet/nfc/digital_dep.c:532:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-533-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-539-\nnet/nfc/digital_dep.c:540:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-541-\nnet/nfc/digital_dep.c:542:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-543-\n--\nnet/nfc/digital_dep.c=566=static int digital_in_send_nack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-568-{\nnet/nfc/digital_dep.c:569:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-570-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-576-\nnet/nfc/digital_dep.c:577:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-578-\nnet/nfc/digital_dep.c:579:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-580-\n--\nnet/nfc/digital_dep.c=598=static int digital_in_send_atn(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-600-{\nnet/nfc/digital_dep.c:601:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-602-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-608-\nnet/nfc/digital_dep.c:609:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-610-\nnet/nfc/digital_dep.c:611:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-612-\n--\nnet/nfc/digital_dep.c=629=static int digital_in_send_rtox(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-631-{\nnet/nfc/digital_dep.c:632:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-633-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-646-\nnet/nfc/digital_dep.c:647:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-648-\nnet/nfc/digital_dep.c:649:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-650-\n--\nnet/nfc/digital_dep.c=686=static void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-689-\tstruct digital_data_exch *data_exch = arg;\nnet/nfc/digital_dep.c:690:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-691-\tu8 pfb;\n--\nnet/nfc/digital_dep.c-755-\nnet/nfc/digital_dep.c:756:\tsize = sizeof(struct digital_dep_req_res);\nnet/nfc/digital_dep.c:757:\tdep_res = (struct digital_dep_req_res *)resp-\u003edata;\nnet/nfc/digital_dep.c-758-\n--\nnet/nfc/digital_dep.c=904=int digital_in_send_dep_req(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-907-{\nnet/nfc/digital_dep.c:908:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-909-\tstruct sk_buff *chaining_skb, *tmp_skb;\n--\nnet/nfc/digital_dep.c-911-\nnet/nfc/digital_dep.c:912:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-913-\nnet/nfc/digital_dep.c:914:\tdep_req = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-915-\n--\nnet/nfc/digital_dep.c=978=static int digital_tg_send_ack(struct nfc_digital_dev *ddev,\n--\nnet/nfc/digital_dep.c-980-{\nnet/nfc/digital_dep.c:981:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-982-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-988-\nnet/nfc/digital_dep.c:989:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-990-\nnet/nfc/digital_dep.c:991:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-992-\n--\nnet/nfc/digital_dep.c=1024=static int digital_tg_send_atn(struct nfc_digital_dev *ddev)\nnet/nfc/digital_dep.c-1025-{\nnet/nfc/digital_dep.c:1026:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-1027-\tstruct sk_buff *skb;\n--\nnet/nfc/digital_dep.c-1033-\nnet/nfc/digital_dep.c:1034:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-1035-\nnet/nfc/digital_dep.c:1036:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-1037-\n--\nnet/nfc/digital_dep.c=1077=static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-1080-\tint rc;\nnet/nfc/digital_dep.c:1081:\tstruct digital_dep_req_res *dep_req;\nnet/nfc/digital_dep.c-1082-\tu8 pfb;\n--\nnet/nfc/digital_dep.c-1107-\nnet/nfc/digital_dep.c:1108:\tsize = sizeof(struct digital_dep_req_res);\nnet/nfc/digital_dep.c:1109:\tdep_req = (struct digital_dep_req_res *)resp-\u003edata;\nnet/nfc/digital_dep.c-1110-\n--\nnet/nfc/digital_dep.c=1297=int digital_tg_send_dep_res(struct nfc_digital_dev *ddev, struct sk_buff *skb)\nnet/nfc/digital_dep.c-1298-{\nnet/nfc/digital_dep.c:1299:\tstruct digital_dep_req_res *dep_res;\nnet/nfc/digital_dep.c-1300-\tstruct sk_buff *chaining_skb, *tmp_skb;\n--\nnet/nfc/digital_dep.c-1302-\nnet/nfc/digital_dep.c:1303:\tskb_push(skb, sizeof(struct digital_dep_req_res));\nnet/nfc/digital_dep.c-1304-\nnet/nfc/digital_dep.c:1305:\tdep_res = (struct digital_dep_req_res *)skb-\u003edata;\nnet/nfc/digital_dep.c-1306-\n"
}

gemini-3.8-flash

null

null

							input: 6308
							output: 37
							thoughts: 26
						

Here's my summary, as if I were thinking these thoughts:

**Analyzing the `digital_dep.c` Code**

Okay, let's dive into this. I need to take a look at the `net/nfc/digital_dep.c` file, specifically lines 95 through 110. Knowing the NFC stack pretty well, I can likely guess what's going on in that section. Given the context, I'm probably looking at some core digital data exchange function, possibly initialization, error handling, or the dispatching logic for the protocol. My experience tells me there's a good chance this is the heart of the Digital Data Exchange (DDEP) layer. This part is likely crucial for determining how different NFC readers and devices communicate. I need to be sure that this code is functioning as expected in case there are bugs to be found. Time to get my eyes on it and see what it's doing.

{
  "File": "net/nfc/digital_dep.c",
  "FirstLine": 95,
  "LineCount": 20
}

{
  "Contents": "  95:\t\tu8 dir;\n  96:\t\tu8 cmd;\n  97:\t\tu8 did;\n  98:\t} __packed;\n  99:\t\n 100:\tstruct digital_dep_req_res {\n 101:\t\tu8 dir;\n 102:\t\tu8 cmd;\n 103:\t\tu8 pfb;\n 104:\t} __packed;\n 105:\t\n 106:\tstatic void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\n 107:\t\t\t\t\t    struct sk_buff *resp);\n 108:\tstatic void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\n 109:\t\t\t\t\t    struct sk_buff *resp);\n 110:\t\n 111:\tstatic const u8 digital_payload_bits_map[4] = {\n 112:\t\t[0] = 64,\n 113:\t\t[1] = 128,\n 114:\t\t[2] = 192,\n"
}

gemini-3.8-flash

null

null

							input: 6872
							output: 37
							thoughts: 442
						

**My Analysis of a Potential Out-of-Bounds Read**

Okay, let's break this down. We've got a structure, `struct digital_dep_req_res`, which is, as expected, of size 3 bytes: `dir`, `cmd`, and `pfb`. Simple enough. The code then uses `sizeof` to determine this size.

Now, in the `digital_tg_recv_dep_req` function, there's an initial check ensuring `resp->len >= 3`. This seems reasonable, guaranteeing we have at least the basic structure data. However, here's where it gets interesting. We check if a specific bit is set in `pfb` using `DIGITAL_NFC_DEP_DID_BIT_SET(pfb)`. If that bit is indeed set, it then proceeds to read `resp->data[3]` without *first* verifying that `resp->len` is, at minimum, 4! It also checks `ddev->did` but not the length!

Specifically, the code then checks `ddev->did && (ddev->did == resp->data[3])`. If this condition holds, it increments the size. However, what if `resp->len` is precisely 3? Then `resp->data[3]` becomes an out-of-bounds read! This is a classic buffer overflow vulnerability, even if it's a small one. The suggested patch is spot on. It correctly includes a length check. It now checks for: `resp->len < size + 1` before accessing `resp->data[size]`.

Finally, it's also worth checking `digital_in_recv_dep_res` to see if there's similar logic there that needs to be addressed. We should be consistent with the fix to ensure the issue is completely eliminated from the code.

{
  "Expression": "DIGITAL_NFC_DEP_DID_BIT_SET",
  "PathPrefix": "net/nfc"
}

{
  "Output": "net/nfc/digital_dep.c-52-#define DIGITAL_NFC_DEP_NAD_BIT_SET(pfb) ((pfb) \u0026 0x08)\nnet/nfc/digital_dep.c:53:#define DIGITAL_NFC_DEP_DID_BIT_SET(pfb) ((pfb) \u0026 DIGITAL_NFC_DEP_PFB_DID_BIT)\nnet/nfc/digital_dep.c-54-#define DIGITAL_NFC_DEP_PFB_PNI(pfb)     ((pfb) \u0026 0x03)\n--\nnet/nfc/digital_dep.c=686=static void digital_in_recv_dep_res(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-766-\nnet/nfc/digital_dep.c:767:\tif (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {\nnet/nfc/digital_dep.c-768-\t\tPROTOCOL_ERR(\"14.8.2.1\");\n--\nnet/nfc/digital_dep.c=1077=static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,\n--\nnet/nfc/digital_dep.c-1118-\nnet/nfc/digital_dep.c:1119:\tif (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {\nnet/nfc/digital_dep.c-1120-\t\tif (resp-\u003elen \u003c size + 1 || !ddev-\u003edid ||\n"
}

gemini-3.8-flash

null

null

							input: 8166
							output: 38
							thoughts: 27
						

Okay, here's my interpretation of that thought process, assuming I'm deep in my domain expertise and analyzing that code snippet:

**Decoding `digital_in_recv_dep_res`**

Alright, let's dive into this `digital_in_recv_dep_res` situation. Lines 766-775... right. My immediate thought is, what's the context here? Is this a hardware abstraction layer, a specific driver, or some core communication protocol? Knowing that will drastically affect how I approach this. Based on the variable name, I'm guessing it deals with digital input reception and, crucially, some kind of dependency resolution. "Dependency resolution" is the key. Are we talking about a data integrity check? Hardware handshake synchronization? Or maybe interrupt handling synchronization?

I need to quickly grasp the logical flow: what signals or events are initiating this? Is it a rising edge, a falling edge, a specific bit pattern? What's being *resolved*? Is it a resource contention issue? A timing problem with external digital input? Are we dealing with an interrupt that needs to acknowledge a hardware signal, and we are managing the required dependencies?

I'm mentally stepping through each line. Line 766: what starts it all? Then I'll work forward. Does the code branch? I'm looking for any conditional statements – ifs, whiles, switches – that impact execution path, because those will be critical to understand possible race conditions or unexpected behaviors. I'll mentally substitute variables to understand how data is used to resolve the dependancies.

I'm mentally building the control flow. Error handling will be critical, so I'm paying close attention to any error codes or flags that might be set or checked. What are the potential failure modes? Does it log errors? This is likely a critical section of the code, given the dependency aspect of it, so race conditions are on my mind. Any possibility of a mutex or interrupt disable within this section of code?

In a good design, this resolution step should be atomic or highly time-sensitive to prevent corruption.

{
  "File": "net/nfc/digital_dep.c",
  "FirstLine": 765,
  "LineCount": 20
}

{
  "Contents": " 765:\t\tpfb = dep_res-\u003epfb;\n 766:\t\n 767:\t\tif (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {\n 768:\t\t\tPROTOCOL_ERR(\"14.8.2.1\");\n 769:\t\t\trc = -EIO;\n 770:\t\t\tgoto error;\n 771:\t\t}\n 772:\t\n 773:\t\tif (DIGITAL_NFC_DEP_NAD_BIT_SET(pfb)) {\n 774:\t\t\trc = -EIO;\n 775:\t\t\tgoto exit;\n 776:\t\t}\n 777:\t\n 778:\t\tif (size \u003e resp-\u003elen) {\n 779:\t\t\trc = -EIO;\n 780:\t\t\tgoto error;\n 781:\t\t}\n 782:\t\n 783:\t\tskb_pull(resp, size);\n 784:\t\n"
}

gemini-3.8-flash

null

null

							input: 8936
							output: 206
							thoughts: 1285
						

**KMSAN Assessment: Digital NFC DEP Request Handling**

Okay, let's break this down. In `digital_tg_recv_dep_req`, the core issue was a potential out-of-bounds read. Previously, the code accessed `resp->data[3]` without verifying if `resp->len` was long enough. If `resp->len` was 3, we had a classic out-of-bounds read scenario. The patch adds a crucial bounds check: `if (resp->len < size + 1 ...)` before accessing the `resp->data` buffer.  `size` is then incremented, and there's a final check `if (size > resp->len)` later. This ensures all accesses stay within the allocated `resp->data` boundaries.

Now, the important question: does this warrant a KMSAN run? The answer is a clear "no". Let's run through the checklist:

*   **No user-space information leaks:** No `copy_to_user`, `put_user`, netlink attributes, ioctl output, socket options, or BPF buffers are involved where potentially uninitialized memory could be exposed to the user.
*   **No uninitialized variables or branching:** All variables used in conditional logic (`resp->len`, `size`, `ddev->did`, `resp->data[size]`) are either initialized or derived from initialized values. The code *fixes* a bounds issue rather than introducing a new one.
*   **No new allocations or initialization risks:** The patch doesn't add any new allocations or change existing ones in a way that could lead to uninitialized memory.
*   **The patch *strengthens* bounds checks:** It *adds* a check: `resp->len < size + 1`, and uses `size` instead of hardcoded `3`, ensuring all accesses are within the bounds of `resp`. The initial check was missing, meaning that was the vulnerability.

We need to be crystal clear on the distinction between KASAN and KMSAN.  KASAN is designed to catch out-of-bounds reads and writes, which is *exactly* the type of bug this patch addresses. We're dealing with skb data (received from a device or socket). This data is initialized with the received packet. Any attempt to read beyond the boundaries of this data is an out-of-bounds access, which KASAN is built to detect. KMSAN, on the other hand, deals with uses of *uninitialized* memory.

The patch does not introduce any risks of using uninitialized memory. There's no uninitialized memory. The patch adds a bounds check, which fixes an out-of-bounds access. The entire problem is that `resp->data` may be accessed out-of-bounds. The patch enforces a check to keep it in-bounds.

The prompt specifically says to avoid KMSAN if the issue is caught by KASAN, and this is definitively a KASAN bug. This issue is an out-of-bounds read and is *not* an uninitialized memory issue. The patch addresses and prevents an out-of-bounds read.  KMSAN is not needed here. The reasoning is clear, detailed, accurate, and highlights the distinction between KASAN and KMSAN. The answer is NeedsKMSAN = false.

{
  "KMSANReasoning": "The patch fixes a missing bounds check in net/nfc/digital_dep.c within digital_tg_recv_dep_req(). Previously, when DIGITAL_NFC_DEP_DID_BIT_SET(pfb) was true, resp-\u003edata[3] was accessed without checking if resp-\u003elen was at least 4 bytes (size + 1), potentially resulting in an out-of-bounds read on the received skb buffer. The patch adds `resp-\u003elen \u003c size + 1` to prevent this out-of-bounds read.\n\nThis is an out-of-bounds read vulnerability, which is detectable by KASAN. The patch does not introduce or manipulate uninitialized stack/heap memory, does not copy kernel data to user space, and does not alter control flow based on uninitialized fields. Thus, KMSAN is not required.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch fixes a missing bounds check in net/nfc/digital_dep.c within digital_tg_recv_dep_req(). Previously, when DIGITAL_NFC_DEP_DID_BIT_SET(pfb) was true, resp-\u003edata[3] was accessed without checking if resp-\u003elen was at least 4 bytes (size + 1), potentially resulting in an out-of-bounds read on the received skb buffer. The patch adds `resp-\u003elen \u003c size + 1` to prevent this out-of-bounds read.\n\nThis is an out-of-bounds read vulnerability, which is detectable by KASAN. The patch does not introduce or manipulate uninitialized stack/heap memory, does not copy kernel data to user space, and does not alter control flow based on uninitialized fields. Thus, KMSAN is not required.",
  "NeedsKMSAN": false
}