| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/04 15:45 | flow | patch-triage |
20mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the w5100 Ethernet driver, which is for Wiznet W5100/W5200/W5500 hardware chips connected via SPI. These chips are not emulated in standard virtualized environments like QEMU. The driver's probe function explicitly checks hardware registers (e.g., verifying RTR_DEFAULT) and will fail to initialize without the physical hardware present. Therefore, the modified code paths cannot be reached during fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/08/04 15:45 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 724c8f71f8be0994f147ce5fa379e562f1e11bd2\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Aug 4 15:45:54 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/devicetree/bindings/net/wiznet,w5x00.txt b/Documentation/devicetree/bindings/net/wiznet,w5x00.txt\nindex e9665798c4be6..e97ce3cb91830 100644\n--- a/Documentation/devicetree/bindings/net/wiznet,w5x00.txt\n+++ b/Documentation/devicetree/bindings/net/wiznet,w5x00.txt\n@@ -25,6 +25,7 @@ Optional properties:\n According to the w5500 datasheet, the chip allows a maximum of 80 MHz, however,\n board designs may need to limit this value.\n - local-mac-address: See ethernet.txt in the same directory.\n+- link-gpios: a GPIO line used for the link detection interrupt\n \n \n Example (for Raspberry Pi with pin control stuff for GPIO irq):\n@@ -38,13 +39,14 @@ Example (for Raspberry Pi with pin control stuff for GPIO irq):\n \t\tinterrupt-parent = \u003c\u0026gpio\u003e;\n \t\tinterrupts = \u003c25 IRQ_TYPE_EDGE_FALLING\u003e;\n \t\tspi-max-frequency = \u003c30000000\u003e;\n+\t\tlink-gpios = \u003c\u0026gpio 4 GPIO_ACTIVE_HIGH\u003e;\n \t};\n };\n \n \u0026gpio {\n \teth1_pins: eth1_pins {\n-\t\tbrcm,pins = \u003c25\u003e;\n-\t\tbrcm,function = \u003c0\u003e; /* in */\n-\t\tbrcm,pull = \u003c0\u003e; /* none */\n+\t\tbrcm,pins = \u003c25 4\u003e;\n+\t\tbrcm,function = \u003c0 0\u003e; /* in */\n+\t\tbrcm,pull = \u003c0 0\u003e; /* none */\n \t};\n };\ndiff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c\nindex 53d8dc642fbd6..c9d1891f37b98 100644\n--- a/drivers/net/ethernet/wiznet/w5100.c\n+++ b/drivers/net/ethernet/wiznet/w5100.c\n@@ -22,6 +22,7 @@\n #include \u003clinux/ioport.h\u003e\n #include \u003clinux/interrupt.h\u003e\n #include \u003clinux/irq.h\u003e\n+#include \u003clinux/gpio/consumer.h\u003e\n \n #include \"w5100.h\"\n \n@@ -154,6 +155,8 @@ struct w5100_priv {\n \tu16 s0_rx_buf_size;\n \n \tint irq;\n+\tint link_irq;\n+\tstruct gpio_desc *link_gpio;\n \n \tstruct napi_struct napi;\n \tstruct net_device *ndev;\n@@ -414,6 +417,16 @@ static void w5100_get_drvinfo(struct net_device *ndev,\n \t\tsizeof(info-\u003ebus_info));\n }\n \n+static u32 w5100_get_link(struct net_device *ndev)\n+{\n+\tstruct w5100_priv *priv = netdev_priv(ndev);\n+\n+\tif (priv-\u003elink_gpio)\n+\t\treturn !!gpiod_get_value_cansleep(priv-\u003elink_gpio);\n+\n+\treturn 1;\n+}\n+\n static u32 w5100_get_msglevel(struct net_device *ndev)\n {\n \tstruct w5100_priv *priv = netdev_priv(ndev);\n@@ -616,6 +629,24 @@ static irqreturn_t w5100_interrupt(int irq, void *ndev_instance)\n \treturn IRQ_HANDLED;\n }\n \n+static irqreturn_t w5100_detect_link(int irq, void *ndev_instance)\n+{\n+\tstruct net_device *ndev = ndev_instance;\n+\tstruct w5100_priv *priv = netdev_priv(ndev);\n+\n+\tif (netif_running(ndev)) {\n+\t\tif (gpiod_get_value(priv-\u003elink_gpio) != 0) {\n+\t\t\tnetif_info(priv, link, ndev, \"link is up\\n\");\n+\t\t\tnetif_carrier_on(ndev);\n+\t\t} else {\n+\t\t\tnetif_info(priv, link, ndev, \"link is down\\n\");\n+\t\t\tnetif_carrier_off(ndev);\n+\t\t}\n+\t}\n+\n+\treturn IRQ_HANDLED;\n+}\n+\n static void w5100_setrx_work(struct work_struct *work)\n {\n \tstruct w5100_priv *priv = container_of(work, struct w5100_priv,\n@@ -659,6 +690,14 @@ static int w5100_open(struct net_device *ndev)\n \tw5100_hw_start(priv);\n \tnapi_enable(\u0026priv-\u003enapi);\n \tnetif_start_queue(ndev);\n+\n+\tif (priv-\u003elink_gpio) {\n+\t\tif (gpiod_get_value_cansleep(priv-\u003elink_gpio) != 0)\n+\t\t\tnetif_carrier_on(ndev);\n+\t\telse\n+\t\t\tnetif_carrier_off(ndev);\n+\t}\n+\n \treturn 0;\n }\n \n@@ -678,6 +717,7 @@ static const struct ethtool_ops w5100_ethtool_ops = {\n \t.get_drvinfo\t\t= w5100_get_drvinfo,\n \t.get_msglevel\t\t= w5100_get_msglevel,\n \t.set_msglevel\t\t= w5100_set_msglevel,\n+\t.get_link\t\t= w5100_get_link,\n \t.get_regs_len\t\t= w5100_get_regs_len,\n \t.get_regs\t\t= w5100_get_regs,\n };\n@@ -751,6 +791,13 @@ int w5100_probe(struct device *dev, const struct w5100_ops *ops,\n \tpriv-\u003endev = ndev;\n \tpriv-\u003eops = ops;\n \tpriv-\u003eirq = irq;\n+\tpriv-\u003elink_gpio = gpiod_get_optional(dev, \"link\", GPIOD_IN);\n+\tif (IS_ERR(priv-\u003elink_gpio)) {\n+\t\terr = dev_err_probe(dev, PTR_ERR(priv-\u003elink_gpio),\n+\t\t\t\t \"failed to get link GPIO\\n\");\n+\t\tpriv-\u003elink_gpio = NULL;\n+\t\tgoto err_register;\n+\t}\n \n \tndev-\u003enetdev_ops = \u0026w5100_netdev_ops;\n \tndev-\u003eethtool_ops = \u0026w5100_ethtool_ops;\n@@ -803,13 +850,40 @@ int w5100_probe(struct device *dev, const struct w5100_ops *ops,\n \tif (err)\n \t\tgoto err_hw;\n \n+\tif (priv-\u003elink_gpio) {\n+\t\tchar *link_name = devm_kasprintf(dev, GFP_KERNEL, \"%s-link\",\n+\t\t\t\t\t\t dev_name(dev));\n+\t\tif (!link_name) {\n+\t\t\terr = -ENOMEM;\n+\t\t\tgoto err_gpio;\n+\t\t}\n+\n+\t\tpriv-\u003elink_irq = gpiod_to_irq(priv-\u003elink_gpio);\n+\t\tif (priv-\u003elink_irq \u003c 0) {\n+\t\t\terr = priv-\u003elink_irq;\n+\t\t\tgoto err_gpio;\n+\t\t}\n+\n+\t\terr = request_any_context_irq(priv-\u003elink_irq, w5100_detect_link,\n+\t\t\t\t\t IRQF_TRIGGER_RISING |\n+\t\t\t\t\t\t IRQF_TRIGGER_FALLING,\n+\t\t\t\t\t link_name, priv-\u003endev);\n+\t\tif (err \u003c 0)\n+\t\t\tgoto err_gpio;\n+\t}\n+\n \treturn 0;\n \n+err_gpio:\n+\tfree_irq(priv-\u003eirq, ndev);\n err_hw:\n \tdestroy_workqueue(priv-\u003exfer_wq);\n err_wq:\n \tunregister_netdev(ndev);\n err_register:\n+\tif (priv-\u003elink_gpio)\n+\t\tgpiod_put(priv-\u003elink_gpio);\n+\n \tfree_netdev(ndev);\n \treturn err;\n }\n@@ -822,6 +896,10 @@ void w5100_remove(struct device *dev)\n \n \tw5100_hw_reset(priv);\n \tfree_irq(priv-\u003eirq, ndev);\n+\tif (priv-\u003elink_gpio) {\n+\t\tfree_irq(priv-\u003elink_irq, ndev);\n+\t\tgpiod_put(priv-\u003elink_gpio);\n+\t}\n \n \tflush_work(\u0026priv-\u003esetrx_work);\n \tflush_work(\u0026priv-\u003erestart_work);\n@@ -840,6 +918,7 @@ static int w5100_suspend(struct device *dev)\n \n \tif (netif_running(ndev)) {\n \t\tnetif_carrier_off(ndev);\n+\n \t\tnetif_device_detach(ndev);\n \n \t\tw5100_hw_close(priv);\n@@ -857,7 +936,12 @@ static int w5100_resume(struct device *dev)\n \t\tw5100_hw_start(priv);\n \n \t\tnetif_device_attach(ndev);\n+\n+\t\tif (!priv-\u003elink_gpio ||\n+\t\t gpiod_get_value_cansleep(priv-\u003elink_gpio) != 0)\n+\t\t\tnetif_carrier_on(ndev);\n \t}\n+\n \treturn 0;\n }\n #endif /* CONFIG_PM_SLEEP */\n"
} |
| 2/1 | 2026/08/04 15:45 | agent | patch-evaluator |
20mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the w5100 Ethernet driver, which is for Wiznet W5100/W5200/W5500 hardware chips connected via SPI. These chips are not emulated in standard virtualized environments like QEMU. The driver's probe function explicitly checks hardware registers (e.g., verifying RTR_DEFAULT) and will fail to initialize without the physical hardware present. Therefore, the modified code paths cannot be reached during fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 724c8f71f8be0994f147ce5fa379e562f1e11bd2
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Aug 4 15:45:54 2026 +0000
syz-cluster: applied patch under review
diff --git a/Documentation/devicetree/bindings/net/wiznet,w5x00.txt b/Documentation/devicetree/bindings/net/wiznet,w5x00.txt
index e9665798c4be6..e97ce3cb91830 100644
--- a/Documentation/devicetree/bindings/net/wiznet,w5x00.txt
+++ b/Documentation/devicetree/bindings/net/wiznet,w5x00.txt
@@ -25,6 +25,7 @@ Optional properties:
According to the w5500 datasheet, the chip allows a maximum of 80 MHz, however,
board designs may need to limit this value.
- local-mac-address: See ethernet.txt in the same directory.
+- link-gpios: a GPIO line used for the link detection interrupt
Example (for Raspberry Pi with pin control stuff for GPIO irq):
@@ -38,13 +39,14 @@ Example (for Raspberry Pi with pin control stuff for GPIO irq):
interrupt-parent = <&gpio>;
interrupts = <25 IRQ_TYPE_EDGE_FALLING>;
spi-max-frequency = <30000000>;
+ link-gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
};
};
&gpio {
eth1_pins: eth1_pins {
- brcm,pins = <25>;
- brcm,function = <0>; /* in */
- brcm,pull = <0>; /* none */
+ brcm,pins = <25 4>;
+ brcm,function = <0 0>; /* in */
+ brcm,pull = <0 0>; /* none */
};
};
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index 53d8dc642fbd6..c9d1891f37b98 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -22,6 +22,7 @@
#include <linux/ioport.h>
#include <linux/interrupt.h>
#include <linux/irq.h>
+#include <linux/gpio/consumer.h>
#include "w5100.h"
@@ -154,6 +155,8 @@ struct w5100_priv {
u16 s0_rx_buf_size;
int irq;
+ int link_irq;
+ struct gpio_desc *link_gpio;
struct napi_struct napi;
struct net_device *ndev;
@@ -414,6 +417,16 @@ static void w5100_get_drvinfo(struct net_device *ndev,
sizeof(info->bus_info));
}
+static u32 w5100_get_link(struct net_device *ndev)
+{
+ struct w5100_priv *priv = netdev_priv(ndev);
+
+ if (priv->link_gpio)
+ return !!gpiod_get_value_cansleep(priv->link_gpio);
+
+ return 1;
+}
+
static u32 w5100_get_msglevel(struct net_device *ndev)
{
struct w5100_priv *priv = netdev_priv(ndev);
@@ -616,6 +629,24 @@ static irqreturn_t w5100_interrupt(int irq, void *ndev_instance)
return IRQ_HANDLED;
}
+static irqreturn_t w5100_detect_link(int irq, void *ndev_instance)
+{
+ struct net_device *ndev = ndev_instance;
+ struct w5100_priv *priv = netdev_priv(ndev);
+
+ if (netif_running(ndev)) {
+ if (gpiod_get_value(priv->link_gpio) != 0) {
+ netif_info(priv, link, ndev, "link is up\n");
+ netif_carrier_on(ndev);
+ } else {
+ netif_info(priv, link, ndev, "link is down\n");
+ netif_carrier_off(ndev);
+ }
+ }
+
+ return IRQ_HANDLED;
+}
+
static void w5100_setrx_work(struct work_struct *work)
{
struct w5100_priv *priv = container_of(work, struct w5100_priv,
@@ -659,6 +690,14 @@ static int w5100_open(struct net_device *ndev)
w5100_hw_start(priv);
napi_enable(&priv->napi);
netif_start_queue(ndev);
+
+ if (priv->link_gpio) {
+ if (gpiod_get_value_cansleep(priv->link_gpio) != 0)
+ netif_carrier_on(ndev);
+ else
+ netif_carrier_off(ndev);
+ }
+
return 0;
}
@@ -678,6 +717,7 @@ static const struct ethtool_ops w5100_ethtool_ops = {
.get_drvinfo = w5100_get_drvinfo,
.get_msglevel = w5100_get_msglevel,
.set_msglevel = w5100_set_msglevel,
+ .get_link = w5100_get_link,
.get_regs_len = w5100_get_regs_len,
.get_regs = w5100_get_regs,
};
@@ -751,6 +791,13 @@ int w5100_probe(struct device *dev, const struct w5100_ops *ops,
priv->ndev = ndev;
priv->ops = ops;
priv->irq = irq;
+ priv->link_gpio = gpiod_get_optional(dev, "link", GPIOD_IN);
+ if (IS_ERR(priv->link_gpio)) {
+ err = dev_err_probe(dev, PTR_ERR(priv->link_gpio),
+ "failed to get link GPIO\n");
+ priv->link_gpio = NULL;
+ goto err_register;
+ }
ndev->netdev_ops = &w5100_netdev_ops;
ndev->ethtool_ops = &w5100_ethtool_ops;
@@ -803,13 +850,40 @@ int w5100_probe(struct device *dev, const struct w5100_ops *ops,
if (err)
goto err_hw;
+ if (priv->link_gpio) {
+ char *link_name = devm_kasprintf(dev, GFP_KERNEL, "%s-link",
+ dev_name(dev));
+ if (!link_name) {
+ err = -ENOMEM;
+ goto err_gpio;
+ }
+
+ priv->link_irq = gpiod_to_irq(priv->link_gpio);
+ if (priv->link_irq < 0) {
+ err = priv->link_irq;
+ goto err_gpio;
+ }
+
+ err = request_any_context_irq(priv->link_irq, w5100_detect_link,
+ IRQF_TRIGGER_RISING |
+ IRQF_TRIGGER_FALLING,
+ link_name, priv->ndev);
+ if (err < 0)
+ goto err_gpio;
+ }
+
return 0;
+err_gpio:
+ free_irq(priv->irq, ndev);
err_hw:
destroy_workqueue(priv->xfer_wq);
err_wq:
unregister_netdev(ndev);
err_register:
+ if (priv->link_gpio)
+ gpiod_put(priv->link_gpio);
+
free_netdev(ndev);
return err;
}
@@ -822,6 +896,10 @@ void w5100_remove(struct device *dev)
w5100_hw_reset(priv);
free_irq(priv->irq, ndev);
+ if (priv->link_gpio) {
+ free_irq(priv->link_irq, ndev);
+ gpiod_put(priv->link_gpio);
+ }
flush_work(&priv->setrx_work);
flush_work(&priv->restart_work);
@@ -840,6 +918,7 @@ static int w5100_suspend(struct device *dev)
if (netif_running(ndev)) {
netif_carrier_off(ndev);
+
netif_device_detach(ndev);
w5100_hw_close(priv);
@@ -857,7 +936,12 @@ static int w5100_resume(struct device *dev)
w5100_hw_start(priv);
netif_device_attach(ndev);
+
+ if (!priv->link_gpio ||
+ gpiod_get_value_cansleep(priv->link_gpio) != 0)
+ netif_carrier_on(ndev);
}
+
return 0;
}
#endif /* CONFIG_PM_SLEEP */
|
| 3/2 | 2026/08/04 15:45 | llm | patch-evaluator |
2mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4430 output: 35 thoughts: 298 Thoughts: **Analyzing the Wiznet W5100 Ethernet Driver Patch** Okay, so I'm looking at a patch for the `w5100` ethernet driver, specifically `drivers/net/ethernet/wiznet/w5100.c`. It looks like this patch introduces link detection via a GPIO. I see new functions added: `w5100_get_link` and `w5100_detect_link`, the latter being an IRQ handler, which makes sense for responding to pin changes. It also touches a few other key areas: `w5100_open`, `w5100_probe`, `w5100_remove`, `w5100_suspend`, and `w5100_resume`. So, it's modifying the core lifecycle and power management functions to incorporate this new link detection. Now, I need to think about how this interacts with virtualization. This driver is for a Wiznet W5100, W5200, or W5500 MAC/PHY. My experience tells me these hardware-specific drivers, especially those that deal with SPI or memory-mapped interfaces, are generally *not* emulated by QEMU unless there's an explicit model. I wonder, does QEMU even have a Wiznet W5100 model? I should probably check that. To figure this out quickly, I'm going to search the kernel source for "w5100" to see if it's treated as a platform or SPI device. That'll tell me if it's integrated in a way that QEMU might touch. Wait, right... Wiznet devices are *typically* SPI or memory-mapped. I can check the driver itself, `drivers/net/ethernet/wiznet/w5100.c`. That should give me the clearest picture. Let me dive in there. |
| 4/2 | 2026/08/04 15:48 | tool | grepper |
0mArgs:{
"Expression": "w5100",
"PathPrefix": "drivers/net/ethernet/wiznet/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 648 lines.\nUse more precise expression if possible.\n\ndrivers/net/ethernet/wiznet/Kconfig=19=config WIZNET_W5100\n--\ndrivers/net/ethernet/wiznet/Kconfig-29-\t To compile this driver as a module, choose M here: the module\ndrivers/net/ethernet/wiznet/Kconfig:30:\t will be called w5100.\ndrivers/net/ethernet/wiznet/Kconfig-31-\n--\ndrivers/net/ethernet/wiznet/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/ethernet/wiznet/Makefile:2:obj-$(CONFIG_WIZNET_W5100) += w5100.o w5100-spi.o\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-20-\ndrivers/net/ethernet/wiznet/w5100-spi.c:21:#include \"w5100.h\"\ndrivers/net/ethernet/wiznet/w5100-spi.c-22-\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-25-\ndrivers/net/ethernet/wiznet/w5100-spi.c:26:static int w5100_spi_read(struct net_device *ndev, u32 addr)\ndrivers/net/ethernet/wiznet/w5100-spi.c-27-{\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-37-\ndrivers/net/ethernet/wiznet/w5100-spi.c:38:static int w5100_spi_write(struct net_device *ndev, u32 addr, u8 data)\ndrivers/net/ethernet/wiznet/w5100-spi.c-39-{\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-45-\ndrivers/net/ethernet/wiznet/w5100-spi.c:46:static int w5100_spi_read16(struct net_device *ndev, u32 addr)\ndrivers/net/ethernet/wiznet/w5100-spi.c-47-{\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-50-\ndrivers/net/ethernet/wiznet/w5100-spi.c:51:\tret = w5100_spi_read(ndev, addr);\ndrivers/net/ethernet/wiznet/w5100-spi.c-52-\tif (ret \u003c 0)\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-54-\tdata = ret \u003c\u003c 8;\ndrivers/net/ethernet/wiznet/w5100-spi.c:55:\tret = w5100_spi_read(ndev, addr + 1);\ndrivers/net/ethernet/wiznet/w5100-spi.c-56-\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-59-\ndrivers/net/ethernet/wiznet/w5100-spi.c:60:static int w5100_spi_write16(struct net_device *ndev, u32 addr, u16 data)\ndrivers/net/ethernet/wiznet/w5100-spi.c-61-{\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-63-\ndrivers/net/ethernet/wiznet/w5100-spi.c:64:\tret = w5100_spi_write(ndev, addr, data \u003e\u003e 8);\ndrivers/net/ethernet/wiznet/w5100-spi.c-65-\tif (ret)\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-67-\ndrivers/net/ethernet/wiznet/w5100-spi.c:68:\treturn w5100_spi_write(ndev, addr + 1, data \u0026 0xff);\ndrivers/net/ethernet/wiznet/w5100-spi.c-69-}\ndrivers/net/ethernet/wiznet/w5100-spi.c-70-\ndrivers/net/ethernet/wiznet/w5100-spi.c:71:static int w5100_spi_readbulk(struct net_device *ndev, u32 addr, u8 *buf,\ndrivers/net/ethernet/wiznet/w5100-spi.c-72-\t\t\t int len)\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-76-\tfor (i = 0; i \u003c len; i++) {\ndrivers/net/ethernet/wiznet/w5100-spi.c:77:\t\tint ret = w5100_spi_read(ndev, addr + i);\ndrivers/net/ethernet/wiznet/w5100-spi.c-78-\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-86-\ndrivers/net/ethernet/wiznet/w5100-spi.c:87:static int w5100_spi_writebulk(struct net_device *ndev, u32 addr, const u8 *buf,\ndrivers/net/ethernet/wiznet/w5100-spi.c-88-\t\t\t int len)\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-92-\tfor (i = 0; i \u003c len; i++) {\ndrivers/net/ethernet/wiznet/w5100-spi.c:93:\t\tint ret = w5100_spi_write(ndev, addr + i, buf[i]);\ndrivers/net/ethernet/wiznet/w5100-spi.c-94-\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-101-\ndrivers/net/ethernet/wiznet/w5100-spi.c:102:static const struct w5100_ops w5100_spi_ops = {\ndrivers/net/ethernet/wiznet/w5100-spi.c-103-\t.may_sleep = true,\ndrivers/net/ethernet/wiznet/w5100-spi.c-104-\t.chip_id = W5100,\ndrivers/net/ethernet/wiznet/w5100-spi.c:105:\t.read = w5100_spi_read,\ndrivers/net/ethernet/wiznet/w5100-spi.c:106:\t.write = w5100_spi_write,\ndrivers/net/ethernet/wiznet/w5100-spi.c:107:\t.read16 = w5100_spi_read16,\ndrivers/net/ethernet/wiznet/w5100-spi.c:108:\t.write16 = w5100_spi_write16,\ndrivers/net/ethernet/wiznet/w5100-spi.c:109:\t.readbulk = w5100_spi_readbulk,\ndrivers/net/ethernet/wiznet/w5100-spi.c:110:\t.writebulk = w5100_spi_writebulk,\ndrivers/net/ethernet/wiznet/w5100-spi.c-111-};\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c=125=static struct w5200_spi_priv *w5200_spi_priv(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100-spi.c-126-{\ndrivers/net/ethernet/wiznet/w5100-spi.c:127:\treturn w5100_ops_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100-spi.c-128-}\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c=213=static int w5200_spi_writebulk(struct net_device *ndev, u32 addr, const u8 *buf,\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-242-\ndrivers/net/ethernet/wiznet/w5100-spi.c:243:static const struct w5100_ops w5200_ops = {\ndrivers/net/ethernet/wiznet/w5100-spi.c-244-\t.may_sleep = true,\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c=270=static struct w5500_spi_priv *w5500_spi_priv(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100-spi.c-271-{\ndrivers/net/ethernet/wiznet/w5100-spi.c:272:\treturn w5100_ops_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100-spi.c-273-}\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c=372=static int w5500_spi_writebulk(struct net_device *ndev, u32 addr, const u8 *buf,\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-400-\ndrivers/net/ethernet/wiznet/w5100-spi.c:401:static const struct w5100_ops w5500_ops = {\ndrivers/net/ethernet/wiznet/w5100-spi.c-402-\t.may_sleep = true,\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-412-\ndrivers/net/ethernet/wiznet/w5100-spi.c:413:static const struct of_device_id w5100_of_match[] = {\ndrivers/net/ethernet/wiznet/w5100-spi.c:414:\t{ .compatible = \"wiznet,w5100\", .data = (const void*)W5100, },\ndrivers/net/ethernet/wiznet/w5100-spi.c-415-\t{ .compatible = \"wiznet,w5200\", .data = (const void*)W5200, },\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-418-};\ndrivers/net/ethernet/wiznet/w5100-spi.c:419:MODULE_DEVICE_TABLE(of, w5100_of_match);\ndrivers/net/ethernet/wiznet/w5100-spi.c-420-\ndrivers/net/ethernet/wiznet/w5100-spi.c:421:static int w5100_spi_probe(struct spi_device *spi)\ndrivers/net/ethernet/wiznet/w5100-spi.c-422-{\ndrivers/net/ethernet/wiznet/w5100-spi.c:423:\tconst struct w5100_ops *ops;\ndrivers/net/ethernet/wiznet/w5100-spi.c-424-\tkernel_ulong_t driver_data;\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-437-\tcase W5100:\ndrivers/net/ethernet/wiznet/w5100-spi.c:438:\t\tops = \u0026w5100_spi_ops;\ndrivers/net/ethernet/wiznet/w5100-spi.c-439-\t\tpriv_size = 0;\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-452-\ndrivers/net/ethernet/wiznet/w5100-spi.c:453:\treturn w5100_probe(\u0026spi-\u003edev, ops, priv_size, mac, spi-\u003eirq);\ndrivers/net/ethernet/wiznet/w5100-spi.c-454-}\ndrivers/net/ethernet/wiznet/w5100-spi.c-455-\ndrivers/net/ethernet/wiznet/w5100-spi.c:456:static void w5100_spi_remove(struct spi_device *spi)\ndrivers/net/ethernet/wiznet/w5100-spi.c-457-{\ndrivers/net/ethernet/wiznet/w5100-spi.c:458:\tw5100_remove(\u0026spi-\u003edev);\ndrivers/net/ethernet/wiznet/w5100-spi.c-459-}\ndrivers/net/ethernet/wiznet/w5100-spi.c-460-\ndrivers/net/ethernet/wiznet/w5100-spi.c:461:static const struct spi_device_id w5100_spi_ids[] = {\ndrivers/net/ethernet/wiznet/w5100-spi.c:462:\t{ \"w5100\", W5100 },\ndrivers/net/ethernet/wiznet/w5100-spi.c-463-\t{ \"w5200\", W5200 },\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-466-};\ndrivers/net/ethernet/wiznet/w5100-spi.c:467:MODULE_DEVICE_TABLE(spi, w5100_spi_ids);\ndrivers/net/ethernet/wiznet/w5100-spi.c-468-\ndrivers/net/ethernet/wiznet/w5100-spi.c:469:static struct spi_driver w5100_spi_driver = {\ndrivers/net/ethernet/wiznet/w5100-spi.c-470-\t.driver\t\t= {\ndrivers/net/ethernet/wiznet/w5100-spi.c:471:\t\t.name\t= \"w5100\",\ndrivers/net/ethernet/wiznet/w5100-spi.c:472:\t\t.pm\t= \u0026w5100_pm_ops,\ndrivers/net/ethernet/wiznet/w5100-spi.c:473:\t\t.of_match_table = w5100_of_match,\ndrivers/net/ethernet/wiznet/w5100-spi.c-474-\t},\ndrivers/net/ethernet/wiznet/w5100-spi.c:475:\t.probe\t\t= w5100_spi_probe,\ndrivers/net/ethernet/wiznet/w5100-spi.c:476:\t.remove\t\t= w5100_spi_remove,\ndrivers/net/ethernet/wiznet/w5100-spi.c:477:\t.id_table\t= w5100_spi_ids,\ndrivers/net/ethernet/wiznet/w5100-spi.c-478-};\ndrivers/net/ethernet/wiznet/w5100-spi.c:479:module_spi_driver(w5100_spi_driver);\ndrivers/net/ethernet/wiznet/w5100-spi.c-480-\n--\ndrivers/net/ethernet/wiznet/w5100.c-26-\ndrivers/net/ethernet/wiznet/w5100.c:27:#include \"w5100.h\"\ndrivers/net/ethernet/wiznet/w5100.c-28-\ndrivers/net/ethernet/wiznet/w5100.c:29:#define DRV_NAME\t\"w5100\"\ndrivers/net/ethernet/wiznet/w5100.c-30-#define DRV_VERSION\t\"2012-04-04\"\n--\ndrivers/net/ethernet/wiznet/w5100.c=35=MODULE_LICENSE(\"GPL\");\n--\ndrivers/net/ethernet/wiznet/w5100.c-144-\ndrivers/net/ethernet/wiznet/w5100.c:145:struct w5100_priv {\ndrivers/net/ethernet/wiznet/w5100.c:146:\tconst struct w5100_ops *ops;\ndrivers/net/ethernet/wiznet/w5100.c-147-\n--\ndrivers/net/ethernet/wiznet/w5100.c-173-\ndrivers/net/ethernet/wiznet/w5100.c:174:static int w5100_read(struct w5100_priv *priv, u32 addr)\ndrivers/net/ethernet/wiznet/w5100.c-175-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-178-\ndrivers/net/ethernet/wiznet/w5100.c:179:static int w5100_write(struct w5100_priv *priv, u32 addr, u8 data)\ndrivers/net/ethernet/wiznet/w5100.c-180-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-183-\ndrivers/net/ethernet/wiznet/w5100.c:184:static int w5100_read16(struct w5100_priv *priv, u32 addr)\ndrivers/net/ethernet/wiznet/w5100.c-185-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-188-\ndrivers/net/ethernet/wiznet/w5100.c:189:static int w5100_write16(struct w5100_priv *priv, u32 addr, u16 data)\ndrivers/net/ethernet/wiznet/w5100.c-190-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-193-\ndrivers/net/ethernet/wiznet/w5100.c:194:static int w5100_readbulk(struct w5100_priv *priv, u32 addr, u8 *buf, int len)\ndrivers/net/ethernet/wiznet/w5100.c-195-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-198-\ndrivers/net/ethernet/wiznet/w5100.c:199:static int w5100_writebulk(struct w5100_priv *priv, u32 addr, const u8 *buf,\ndrivers/net/ethernet/wiznet/w5100.c-200-\t\t\t int len)\n--\ndrivers/net/ethernet/wiznet/w5100.c-204-\ndrivers/net/ethernet/wiznet/w5100.c:205:static int w5100_readbuf(struct w5100_priv *priv, u16 offset, u8 *buf, int len)\ndrivers/net/ethernet/wiznet/w5100.c-206-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-220-\ndrivers/net/ethernet/wiznet/w5100.c:221:\tret = w5100_readbulk(priv, addr, buf, len);\ndrivers/net/ethernet/wiznet/w5100.c-222-\tif (ret || !remain)\n--\ndrivers/net/ethernet/wiznet/w5100.c-224-\ndrivers/net/ethernet/wiznet/w5100.c:225:\treturn w5100_readbulk(priv, mem_start, buf + len, remain);\ndrivers/net/ethernet/wiznet/w5100.c-226-}\ndrivers/net/ethernet/wiznet/w5100.c-227-\ndrivers/net/ethernet/wiznet/w5100.c:228:static int w5100_writebuf(struct w5100_priv *priv, u16 offset, const u8 *buf,\ndrivers/net/ethernet/wiznet/w5100.c-229-\t\t\t int len)\n--\ndrivers/net/ethernet/wiznet/w5100.c-244-\ndrivers/net/ethernet/wiznet/w5100.c:245:\tret = w5100_writebulk(priv, addr, buf, len);\ndrivers/net/ethernet/wiznet/w5100.c-246-\tif (ret || !remain)\n--\ndrivers/net/ethernet/wiznet/w5100.c-248-\ndrivers/net/ethernet/wiznet/w5100.c:249:\treturn w5100_writebulk(priv, mem_start, buf + len, remain);\ndrivers/net/ethernet/wiznet/w5100.c-250-}\ndrivers/net/ethernet/wiznet/w5100.c-251-\ndrivers/net/ethernet/wiznet/w5100.c:252:static int w5100_reset(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-253-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-256-\ndrivers/net/ethernet/wiznet/w5100.c:257:\tw5100_write(priv, W5100_MR, MR_RST);\ndrivers/net/ethernet/wiznet/w5100.c-258-\tmdelay(5);\ndrivers/net/ethernet/wiznet/w5100.c:259:\tw5100_write(priv, W5100_MR, MR_PB);\ndrivers/net/ethernet/wiznet/w5100.c-260-\n--\ndrivers/net/ethernet/wiznet/w5100.c-263-\ndrivers/net/ethernet/wiznet/w5100.c:264:static int w5100_command(struct w5100_priv *priv, u16 cmd)\ndrivers/net/ethernet/wiznet/w5100.c-265-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-267-\ndrivers/net/ethernet/wiznet/w5100.c:268:\tw5100_write(priv, W5100_S0_CR(priv), cmd);\ndrivers/net/ethernet/wiznet/w5100.c-269-\n--\ndrivers/net/ethernet/wiznet/w5100.c-271-\ndrivers/net/ethernet/wiznet/w5100.c:272:\twhile (w5100_read(priv, W5100_S0_CR(priv)) != 0) {\ndrivers/net/ethernet/wiznet/w5100.c-273-\t\tif (time_after(jiffies, timeout))\n--\ndrivers/net/ethernet/wiznet/w5100.c-280-\ndrivers/net/ethernet/wiznet/w5100.c:281:static void w5100_write_macaddr(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-282-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-284-\ndrivers/net/ethernet/wiznet/w5100.c:285:\tw5100_writebulk(priv, W5100_SHAR, ndev-\u003edev_addr, ETH_ALEN);\ndrivers/net/ethernet/wiznet/w5100.c-286-}\ndrivers/net/ethernet/wiznet/w5100.c-287-\ndrivers/net/ethernet/wiznet/w5100.c:288:static void w5100_socket_intr_mask(struct w5100_priv *priv, u8 mask)\ndrivers/net/ethernet/wiznet/w5100.c-289-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-296-\ndrivers/net/ethernet/wiznet/w5100.c:297:\tw5100_write(priv, imr, mask);\ndrivers/net/ethernet/wiznet/w5100.c-298-}\ndrivers/net/ethernet/wiznet/w5100.c-299-\ndrivers/net/ethernet/wiznet/w5100.c:300:static void w5100_enable_intr(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-301-{\ndrivers/net/ethernet/wiznet/w5100.c:302:\tw5100_socket_intr_mask(priv, IR_S0);\ndrivers/net/ethernet/wiznet/w5100.c-303-}\ndrivers/net/ethernet/wiznet/w5100.c-304-\ndrivers/net/ethernet/wiznet/w5100.c:305:static void w5100_disable_intr(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-306-{\ndrivers/net/ethernet/wiznet/w5100.c:307:\tw5100_socket_intr_mask(priv, 0);\ndrivers/net/ethernet/wiznet/w5100.c-308-}\ndrivers/net/ethernet/wiznet/w5100.c-309-\ndrivers/net/ethernet/wiznet/w5100.c:310:static void w5100_memory_configure(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-311-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-314-\t */\ndrivers/net/ethernet/wiznet/w5100.c:315:\tw5100_write(priv, W5100_RMSR, 0x03);\ndrivers/net/ethernet/wiznet/w5100.c:316:\tw5100_write(priv, W5100_TMSR, 0x03);\ndrivers/net/ethernet/wiznet/w5100.c-317-}\ndrivers/net/ethernet/wiznet/w5100.c-318-\ndrivers/net/ethernet/wiznet/w5100.c:319:static void w5200_memory_configure(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-320-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-325-\t */\ndrivers/net/ethernet/wiznet/w5100.c:326:\tw5100_write(priv, W5200_Sn_RXMEM_SIZE(0), 0x10);\ndrivers/net/ethernet/wiznet/w5100.c:327:\tw5100_write(priv, W5200_Sn_TXMEM_SIZE(0), 0x10);\ndrivers/net/ethernet/wiznet/w5100.c-328-\ndrivers/net/ethernet/wiznet/w5100.c-329-\tfor (i = 1; i \u003c 8; i++) {\ndrivers/net/ethernet/wiznet/w5100.c:330:\t\tw5100_write(priv, W5200_Sn_RXMEM_SIZE(i), 0);\ndrivers/net/ethernet/wiznet/w5100.c:331:\t\tw5100_write(priv, W5200_Sn_TXMEM_SIZE(i), 0);\ndrivers/net/ethernet/wiznet/w5100.c-332-\t}\n--\ndrivers/net/ethernet/wiznet/w5100.c-334-\ndrivers/net/ethernet/wiznet/w5100.c:335:static void w5500_memory_configure(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-336-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-341-\t */\ndrivers/net/ethernet/wiznet/w5100.c:342:\tw5100_write(priv, W5500_Sn_RXMEM_SIZE(0), 0x10);\ndrivers/net/ethernet/wiznet/w5100.c:343:\tw5100_write(priv, W5500_Sn_TXMEM_SIZE(0), 0x10);\ndrivers/net/ethernet/wiznet/w5100.c-344-\ndrivers/net/ethernet/wiznet/w5100.c-345-\tfor (i = 1; i \u003c 8; i++) {\ndrivers/net/ethernet/wiznet/w5100.c:346:\t\tw5100_write(priv, W5500_Sn_RXMEM_SIZE(i), 0);\ndrivers/net/ethernet/wiznet/w5100.c:347:\t\tw5100_write(priv, W5500_Sn_TXMEM_SIZE(i), 0);\ndrivers/net/ethernet/wiznet/w5100.c-348-\t}\n--\ndrivers/net/ethernet/wiznet/w5100.c-350-\ndrivers/net/ethernet/wiznet/w5100.c:351:static int w5100_hw_reset(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-352-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-354-\ndrivers/net/ethernet/wiznet/w5100.c:355:\tw5100_reset(priv);\ndrivers/net/ethernet/wiznet/w5100.c-356-\ndrivers/net/ethernet/wiznet/w5100.c:357:\tw5100_disable_intr(priv);\ndrivers/net/ethernet/wiznet/w5100.c:358:\tw5100_write_macaddr(priv);\ndrivers/net/ethernet/wiznet/w5100.c-359-\n--\ndrivers/net/ethernet/wiznet/w5100.c-361-\tcase W5100:\ndrivers/net/ethernet/wiznet/w5100.c:362:\t\tw5100_memory_configure(priv);\ndrivers/net/ethernet/wiznet/w5100.c-363-\t\trtr = W5100_RTR;\n--\ndrivers/net/ethernet/wiznet/w5100.c-376-\ndrivers/net/ethernet/wiznet/w5100.c:377:\tif (w5100_read16(priv, rtr) != RTR_DEFAULT)\ndrivers/net/ethernet/wiznet/w5100.c-378-\t\treturn -ENODEV;\n--\ndrivers/net/ethernet/wiznet/w5100.c-382-\ndrivers/net/ethernet/wiznet/w5100.c:383:static void w5100_hw_start(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-384-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-393-\ndrivers/net/ethernet/wiznet/w5100.c:394:\tw5100_write(priv, W5100_S0_MR(priv), mode);\ndrivers/net/ethernet/wiznet/w5100.c:395:\tw5100_command(priv, S0_CR_OPEN);\ndrivers/net/ethernet/wiznet/w5100.c:396:\tw5100_enable_intr(priv);\ndrivers/net/ethernet/wiznet/w5100.c-397-}\ndrivers/net/ethernet/wiznet/w5100.c-398-\ndrivers/net/ethernet/wiznet/w5100.c:399:static void w5100_hw_close(struct w5100_priv *priv)\ndrivers/net/ethernet/wiznet/w5100.c-400-{\ndrivers/net/ethernet/wiznet/w5100.c:401:\tw5100_disable_intr(priv);\ndrivers/net/ethernet/wiznet/w5100.c:402:\tw5100_command(priv, S0_CR_CLOSE);\ndrivers/net/ethernet/wiznet/w5100.c-403-}\n--\ndrivers/net/ethernet/wiznet/w5100.c-410-\ndrivers/net/ethernet/wiznet/w5100.c:411:static void w5100_get_drvinfo(struct net_device *ndev,\ndrivers/net/ethernet/wiznet/w5100.c-412-\t\t\t struct ethtool_drvinfo *info)\n--\ndrivers/net/ethernet/wiznet/w5100.c-419-\ndrivers/net/ethernet/wiznet/w5100.c:420:static u32 w5100_get_link(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100.c-421-{\ndrivers/net/ethernet/wiznet/w5100.c:422:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-423-\n--\ndrivers/net/ethernet/wiznet/w5100.c-429-\ndrivers/net/ethernet/wiznet/w5100.c:430:static u32 w5100_get_msglevel(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100.c-431-{\ndrivers/net/ethernet/wiznet/w5100.c:432:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-433-\n--\ndrivers/net/ethernet/wiznet/w5100.c-436-\ndrivers/net/ethernet/wiznet/w5100.c:437:static void w5100_set_msglevel(struct net_device *ndev, u32 value)\ndrivers/net/ethernet/wiznet/w5100.c-438-{\ndrivers/net/ethernet/wiznet/w5100.c:439:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-440-\n--\ndrivers/net/ethernet/wiznet/w5100.c-443-\ndrivers/net/ethernet/wiznet/w5100.c:444:static int w5100_get_regs_len(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100.c-445-{\n--\ndrivers/net/ethernet/wiznet/w5100.c-448-\ndrivers/net/ethernet/wiznet/w5100.c:449:static void w5100_get_regs(struct net_device *ndev,\ndrivers/net/ethernet/wiznet/w5100.c-450-\t\t\t struct ethtool_regs *regs, void *buf)\ndrivers/net/ethernet/wiznet/w5100.c-451-{\ndrivers/net/ethernet/wiznet/w5100.c:452:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-453-\ndrivers/net/ethernet/wiznet/w5100.c-454-\tregs-\u003eversion = 1;\ndrivers/net/ethernet/wiznet/w5100.c:455:\tw5100_readbulk(priv, W5100_COMMON_REGS, buf, W5100_COMMON_REGS_LEN);\ndrivers/net/ethernet/wiznet/w5100.c-456-\tbuf += W5100_COMMON_REGS_LEN;\ndrivers/net/ethernet/wiznet/w5100.c:457:\tw5100_readbulk(priv, S0_REGS(priv), buf, W5100_S0_REGS_LEN);\ndrivers/net/ethernet/wiznet/w5100.c-458-}\ndrivers/net/ethernet/wiznet/w5100.c-459-\ndrivers/net/ethernet/wiznet/w5100.c:460:static void w5100_restart(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100.c-461-{\ndrivers/net/ethernet/wiznet/w5100.c:462:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-463-\ndrivers/net/ethernet/wiznet/w5100.c-464-\tnetif_stop_queue(ndev);\ndrivers/net/ethernet/wiznet/w5100.c:465:\tw5100_hw_reset(priv);\ndrivers/net/ethernet/wiznet/w5100.c:466:\tw5100_hw_start(priv);\ndrivers/net/ethernet/wiznet/w5100.c-467-\tndev-\u003estats.tx_errors++;\n--\ndrivers/net/ethernet/wiznet/w5100.c-471-\ndrivers/net/ethernet/wiznet/w5100.c:472:static void w5100_restart_work(struct work_struct *work)\ndrivers/net/ethernet/wiznet/w5100.c-473-{\ndrivers/net/ethernet/wiznet/w5100.c:474:\tstruct w5100_priv *priv = container_of(work, struct w5100_priv,\ndrivers/net/ethernet/wiznet/w5100.c-475-\t\t\t\t\t restart_work);\ndrivers/net/ethernet/wiznet/w5100.c-476-\ndrivers/net/ethernet/wiznet/w5100.c:477:\tw5100_restart(priv-\u003endev);\ndrivers/net/ethernet/wiznet/w5100.c-478-}\ndrivers/net/ethernet/wiznet/w5100.c-479-\ndrivers/net/ethernet/wiznet/w5100.c:480:static void w5100_tx_timeout(struct net_device *ndev, unsigned int txqueue)\ndrivers/net/ethernet/wiznet/w5100.c-481-{\ndrivers/net/ethernet/wiznet/w5100.c:482:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-483-\n--\ndrivers/net/ethernet/wiznet/w5100.c-486-\telse\ndrivers/net/ethernet/wiznet/w5100.c:487:\t\tw5100_restart(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-488-}\ndrivers/net/ethernet/wiznet/w5100.c-489-\ndrivers/net/ethernet/wiznet/w5100.c:490:static void w5100_tx_skb(struct net_device *ndev, struct sk_buff *skb)\ndrivers/net/ethernet/wiznet/w5100.c-491-{\ndrivers/net/ethernet/wiznet/w5100.c:492:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-493-\tu16 offset;\ndrivers/net/ethernet/wiznet/w5100.c-494-\ndrivers/net/ethernet/wiznet/w5100.c:495:\toffset = w5100_read16(priv, W5100_S0_TX_WR(priv));\ndrivers/net/ethernet/wiznet/w5100.c:496:\tw5100_writebuf(priv, offset, skb-\u003edata, skb-\u003elen);\ndrivers/net/ethernet/wiznet/w5100.c:497:\tw5100_write16(priv, W5100_S0_TX_WR(priv), offset + skb-\u003elen);\ndrivers/net/ethernet/wiznet/w5100.c-498-\tndev-\u003estats.tx_bytes += skb-\u003elen;\n--\ndrivers/net/ethernet/wiznet/w5100.c-501-\ndrivers/net/ethernet/wiznet/w5100.c:502:\tw5100_command(priv, S0_CR_SEND);\ndrivers/net/ethernet/wiznet/w5100.c-503-}\ndrivers/net/ethernet/wiznet/w5100.c-504-\ndrivers/net/ethernet/wiznet/w5100.c:505:static void w5100_tx_work(struct work_struct *work)\ndrivers/net/ethernet/wiznet/w5100.c-506-{\ndrivers/net/ethernet/wiznet/w5100.c:507:\tstruct w5100_priv *priv = container_of(work, struct w5100_priv,\ndrivers/net/ethernet/wiznet/w5100.c-508-\t\t\t\t\t tx_work);\n--\ndrivers/net/ethernet/wiznet/w5100.c-514-\t\treturn;\ndrivers/net/ethernet/wiznet/w5100.c:515:\tw5100_tx_skb(priv-\u003endev, skb);\ndrivers/net/ethernet/wiznet/w5100.c-516-}\ndrivers/net/ethernet/wiznet/w5100.c-517-\ndrivers/net/ethernet/wiznet/w5100.c:518:static netdev_tx_t w5100_start_tx(struct sk_buff *skb, struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100.c-519-{\ndrivers/net/ethernet/wiznet/w5100.c:520:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-521-\n--\ndrivers/net/ethernet/wiznet/w5100.c-528-\t} else {\ndrivers/net/ethernet/wiznet/w5100.c:529:\t\tw5100_tx_skb(ndev, skb);\ndrivers/net/ethernet/wiznet/w5100.c-530-\t}\n--\ndrivers/net/ethernet/wiznet/w5100.c-534-\ndrivers/net/ethernet/wiznet/w5100.c:535:static struct sk_buff *w5100_rx_skb(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100.c-536-{\ndrivers/net/ethernet/wiznet/w5100.c:537:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-538-\tstruct sk_buff *skb;\n--\ndrivers/net/ethernet/wiznet/w5100.c-541-\tu8 header[2];\ndrivers/net/ethernet/wiznet/w5100.c:542:\tu16 rx_buf_len = w5100_read16(priv, W5100_S0_RX_RSR(priv));\ndrivers/net/ethernet/wiznet/w5100.c-543-\n--\ndrivers/net/ethernet/wiznet/w5100.c-546-\ndrivers/net/ethernet/wiznet/w5100.c:547:\toffset = w5100_read16(priv, W5100_S0_RX_RD(priv));\ndrivers/net/ethernet/wiznet/w5100.c:548:\tw5100_readbuf(priv, offset, header, 2);\ndrivers/net/ethernet/wiznet/w5100.c-549-\trx_len = get_unaligned_be16(header) - 2;\n--\ndrivers/net/ethernet/wiznet/w5100.c-552-\tif (unlikely(!skb)) {\ndrivers/net/ethernet/wiznet/w5100.c:553:\t\tw5100_write16(priv, W5100_S0_RX_RD(priv), offset + rx_buf_len);\ndrivers/net/ethernet/wiznet/w5100.c:554:\t\tw5100_command(priv, S0_CR_RECV);\ndrivers/net/ethernet/wiznet/w5100.c-555-\t\tndev-\u003estats.rx_dropped++;\n--\ndrivers/net/ethernet/wiznet/w5100.c-559-\tskb_put(skb, rx_len);\ndrivers/net/ethernet/wiznet/w5100.c:560:\tw5100_readbuf(priv, offset + 2, skb-\u003edata, rx_len);\ndrivers/net/ethernet/wiznet/w5100.c:561:\tw5100_write16(priv, W5100_S0_RX_RD(priv), offset + 2 + rx_len);\ndrivers/net/ethernet/wiznet/w5100.c:562:\tw5100_command(priv, S0_CR_RECV);\ndrivers/net/ethernet/wiznet/w5100.c-563-\tskb-\u003eprotocol = eth_type_trans(skb, ndev);\n--\ndrivers/net/ethernet/wiznet/w5100.c-570-\ndrivers/net/ethernet/wiznet/w5100.c:571:static void w5100_rx_work(struct work_struct *work)\ndrivers/net/ethernet/wiznet/w5100.c-572-{\ndrivers/net/ethernet/wiznet/w5100.c:573:\tstruct w5100_priv *priv = container_of(work, struct w5100_priv,\ndrivers/net/ethernet/wiznet/w5100.c-574-\t\t\t\t\t rx_work);\n--\ndrivers/net/ethernet/wiznet/w5100.c-576-\ndrivers/net/ethernet/wiznet/w5100.c:577:\twhile ((skb = w5100_rx_skb(priv-\u003endev)))\ndrivers/net/ethernet/wiznet/w5100.c-578-\t\tnetif_rx(skb);\ndrivers/net/ethernet/wiznet/w5100.c-579-\ndrivers/net/ethernet/wiznet/w5100.c:580:\tw5100_enable_intr(priv);\ndrivers/net/ethernet/wiznet/w5100.c-581-}\ndrivers/net/ethernet/wiznet/w5100.c-582-\ndrivers/net/ethernet/wiznet/w5100.c:583:static int w5100_napi_poll(struct napi_struct *napi, int budget)\ndrivers/net/ethernet/wiznet/w5100.c-584-{\ndrivers/net/ethernet/wiznet/w5100.c:585:\tstruct w5100_priv *priv = container_of(napi, struct w5100_priv, napi);\ndrivers/net/ethernet/wiznet/w5100.c-586-\tint rx_count;\n--\ndrivers/net/ethernet/wiznet/w5100.c-588-\tfor (rx_count = 0; rx_count \u003c budget; rx_count++) {\ndrivers/net/ethernet/wiznet/w5100.c:589:\t\tstruct sk_buff *skb = w5100_rx_skb(priv-\u003endev);\ndrivers/net/ethernet/wiznet/w5100.c-590-\n--\ndrivers/net/ethernet/wiznet/w5100.c-598-\t\tnapi_complete_done(napi, rx_count);\ndrivers/net/ethernet/wiznet/w5100.c:599:\t\tw5100_enable_intr(priv);\ndrivers/net/ethernet/wiznet/w5100.c-600-\t}\n--\ndrivers/net/ethernet/wiznet/w5100.c-604-\ndrivers/net/ethernet/wiznet/w5100.c:605:static irqreturn_t w5100_interrupt(int irq, void *ndev_instance)\ndrivers/net/ethernet/wiznet/w5100.c-606-{\ndrivers/net/ethernet/wiznet/w5100.c-607-\tstruct net_device *ndev = ndev_instance;\ndrivers/net/ethernet/wiznet/w5100.c:608:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-609-\ndrivers/net/ethernet/wiznet/w5100.c:610:\tint ir = w5100_read(priv, W5100_S0_IR(priv));\ndrivers/net/ethernet/wiznet/w5100.c-611-\tif (!ir)\ndrivers/net/ethernet/wiznet/w5100.c-612-\t\treturn IRQ_NONE;\ndrivers/net/ethernet/wiznet/w5100.c:613:\tw5100_write(priv, W5100_S0_IR(priv), ir);\ndrivers/net/ethernet/wiznet/w5100.c-614-\n--\ndrivers/net/ethernet/wiznet/w5100.c-620-\tif (ir \u0026 S0_IR_RECV) {\ndrivers/net/ethernet/wiznet/w5100.c:621:\t\tw5100_disable_intr(priv);\ndrivers/net/ethernet/wiznet/w5100.c-622-\n--\ndrivers/net/ethernet/wiznet/w5100.c-631-\ndrivers/net/ethernet/wiznet/w5100.c:632:static irqreturn_t w5100_detect_link(int irq, void *ndev_instance)\ndrivers/net/ethernet/wiznet/w5100.c-633-{\ndrivers/net/ethernet/wiznet/w5100.c-634-\tstruct net_device *ndev = ndev_instance;\ndrivers/net/ethernet/wiznet/w5100.c:635:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-636-\n--\ndrivers/net/ethernet/wiznet/w5100.c-649-\ndrivers/net/ethernet/wiznet/w5100.c:650:static void w5100_setrx_work(struct work_struct *work)\ndrivers/net/ethernet/wiznet/w5100.c-651-{\ndrivers/net/ethernet/wiznet/w5100.c:652:\tstruct w5100_priv *priv = container_of(work, struct w5100_priv,\ndrivers/net/ethernet/wiznet/w5100.c-653-\t\t\t\t\t setrx_work);\ndrivers/net/ethernet/wiznet/w5100.c-654-\ndrivers/net/ethernet/wiznet/w5100.c:655:\tw5100_hw_start(priv);\ndrivers/net/ethernet/wiznet/w5100.c-656-}\ndrivers/net/ethernet/wiznet/w5100.c-657-\ndrivers/net/ethernet/wiznet/w5100.c:658:static void w5100_set_rx_mode(struct net_device *ndev)\ndrivers/net/ethernet/wiznet/w5100.c-659-{\ndrivers/net/ethernet/wiznet/w5100.c:660:\tstruct w5100_priv *priv = netdev_priv(ndev);\ndrivers/net/ethernet/wiznet/w5100.c-661-\tbool set_promisc = (ndev-\u003eflags \u0026 IFF_PROMISC) != 0;\n--\n\n"
} |
| 5/2 | 2026/08/04 15:48 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19636 output: 27 thoughts: 409 Thoughts: **Analyzing the Fuzzing Potential of the W5100 Driver** Okay, let's break this down. My initial focus is on the `drivers/net/ethernet/wiznet/w5100.c` driver, specifically, and whether it's worth fuzzing in the context of our virtualized environment. It's either an SPI device, as per `w5100-spi.c`, or a platform device. The critical question: can Syzkaller instantiate it directly? Syzkaller can work with SPI devices, right? But it needs a mechanism – either injection, pseudo-devices, or device tree overlays. And the usual QEMU setup doesn't just *have* SPI devices lying around unless specifically configured. Does QEMU even have a virtual SPI controller by default? Yes, but typically without a W5100 attached. So, Syzkaller *could* test it if the probe gets triggered. Is `w5100_probe` reachable? Let's trace it. It's called from either `w5100_spi_probe` or `w5100_mmio_probe`. Can Syzkaller directly trigger `w5100_probe`? My initial instinct is no, because while Syzkaller has `syz_genetlink_get_family` and so on, it usually struggles with platform/SPI devices unless there's a specific Syzkaller description, or if it's a PCI or USB device, both of which can be emulated. Now, the prompt's instructions are key. It states a "WorthFuzzing=false" if the patch concerns code paths that are impossible to reach in environments like QEMU or GCE, specifically if it's software-emulated, or even more, in vendor-specific PCIe switch, SmartNIC, or GPU drivers. Things that need physical cards not emulated in standard QEMU. So, the crux of the matter: *is* the W5100 emulated in standard QEMU? This is the critical question. I need to verify whether the W5100 is present in the standard QEMU configuration. That's the first thing to check. |
| 6/2 | 2026/08/04 15:48 | tool | grepper |
0mError:no matches Args: {
"Expression": "w5100",
"PathPrefix": "tools/"
}Results: {
"error": "no matches"
} |
| 7/2 | 2026/08/04 15:48 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 20569 output: 27 thoughts: 20 Thoughts: Okay, here's my thought process summarized as requested: **Checking Syzkaller for W5100 Information** Alright, let's get down to brass tacks. I need to figure out the syzkaller coverage, if any, for the W5100. That's the starting point. I need to see if there are existing descriptions, definitions, or even just mentions of that specific hardware component within the syzkaller framework. This will dictate my next steps. If it's already documented, I can build on that knowledge. If not, then I know I'm starting from scratch, which will require a much different approach. Either way, checking syzkaller is the intelligent initial move. Let's see what's out there. |
| 8/2 | 2026/08/04 15:49 | tool | grepper |
0mError:no matches Args: {
"Expression": "w5100",
"PathPrefix": "net/"
}Results: {
"error": "no matches"
} |
| 9/2 | 2026/08/04 15:49 | llm | patch-evaluator |
7mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 20792 output: 37 thoughts: 842 Thoughts: **Analyzing the Syzkaller Context for Wiznet W5100 Vulnerability**
Okay, first thought: Wait, those syzkaller descriptions aren't actually *in* the kernel tree, right? But the prompt states an impossibility: reaching code paths in virtualized environments like GCE or QEMU, even with emulated hardware. My experience tells me the Wiznet W5100 is an embedded Ethernet controller, typically used in something like an Arduino, and it connects via SPI or memory-mapped I/O.
Can this code even *be* reached in QEMU? Hmm, QEMU doesn't emulate the W5100. So, can syzkaller even instantiate those platform or SPI devices? No, that `syz_devlink` or similar doesn't do that, does it? I believe syzkaller can inject device tree overlays or use `platform_device_register`, provided there's a pseudo-syscall. But generally, it doesn't.
How about a way to trigger `w5100_probe` directly? I wonder... through `sysfs`? Nah, you can't just *create* an SPI device from sysfs unless you have an SPI controller that supports it, like `spidev`, right? No, `spidev` is for userspace SPI access.
Wait, isn't there something like `spi-mock`? I should check if there's *any* way to probe SPI devices within syzkaller. Does syzkaller have something like `syz_spi_setup`? Nope.
Okay, let's step back. If the patch is authored by `syz-cluster <triage@syzkaller.com>`, it *might* mean syzkaller found a crash or was testing this patch, right? Wait, hold on. The prompt is saying:
```
commit 724c8f71f8be0994f147ce5fa379e562f1e11bd2
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Aug 4 15:45:54 2026 +0000
syz-cluster: applied patch under review
```
This is just a dummy commit message from syzkaller, right? This means it's just testing patches sent to the mailing lists. If someone sends a patch for `w5100`, syzkaller will try and test it, maybe just compile it and find no coverage.
So if it's an SPI/MMIO device, it *requires* hardware or a full QEMU emulation. Does QEMU emulate W5100? No. Does QEMU emulate W5500? No. So I should check if there's *any* QEMU emulation for Wiznet.
Can't do a full source search, but I *know* Wiznet isn't a standard QEMU device. Standard devices are things like e1000, rtl8139, virtio-net, ne2k, pcnet, vmxnet3, etc. Also, this patch is adding a GPIO link detection, and GPIOs are *hardware-specific*, right?
Therefore, this driver is for a physical chip (Wiznet W5100/W5200/W5500) connected via SPI or MMIO, which is not emulated in standard QEMU. That means it's *impossible* to reach in virtualized environments like GCE or QEMU.
Let me just double-check, though. Is there any sort of virtual driver, anything at all? Let's check `drivers/net/ethernet/wiznet/w5100.c`... ah, and `w5100_probe`. It's called by `w5100_spi_probe` in `w5100-spi.c`. Yep, confirmed. This confirms it's not possible to reach the code path.
|
| 10/2 | 2026/08/04 15:56 | tool | grepper |
0mArgs:{
"Expression": "w5100_probe",
"PathPrefix": "drivers/net/ethernet/wiznet/"
}Results: {
"Output": "drivers/net/ethernet/wiznet/w5100-spi.c=421=static int w5100_spi_probe(struct spi_device *spi)\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-452-\ndrivers/net/ethernet/wiznet/w5100-spi.c:453:\treturn w5100_probe(\u0026spi-\u003edev, ops, priv_size, mac, spi-\u003eirq);\ndrivers/net/ethernet/wiznet/w5100-spi.c-454-}\n--\ndrivers/net/ethernet/wiznet/w5100.c=740=EXPORT_SYMBOL_GPL(w5100_ops_priv);\ndrivers/net/ethernet/wiznet/w5100.c-741-\ndrivers/net/ethernet/wiznet/w5100.c:742:int w5100_probe(struct device *dev, const struct w5100_ops *ops,\ndrivers/net/ethernet/wiznet/w5100.c-743-\t\tint sizeof_ops_priv, const void *mac_addr, int irq)\n--\ndrivers/net/ethernet/wiznet/w5100.c-889-}\ndrivers/net/ethernet/wiznet/w5100.c:890:EXPORT_SYMBOL_GPL(w5100_probe);\ndrivers/net/ethernet/wiznet/w5100.c-891-\n--\ndrivers/net/ethernet/wiznet/w5100.h=29=void *w5100_ops_priv(const struct net_device *ndev);\ndrivers/net/ethernet/wiznet/w5100.h-30-\ndrivers/net/ethernet/wiznet/w5100.h:31:int w5100_probe(struct device *dev, const struct w5100_ops *ops,\ndrivers/net/ethernet/wiznet/w5100.h-32-\t\tint sizeof_ops_priv, const void *mac_addr, int irq);\n"
} |
| 11/2 | 2026/08/04 15:56 | llm | patch-evaluator |
4mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 23116 output: 27 thoughts: 16 Thoughts: Okay, here's my summary, in the first person, as requested: **Digging into Function Calls** Alright, I'm trying to get a handle on this `w5100_probe` function. The first thing that comes to mind is: *Is there anywhere else in this codebase, or any related files, that this function gets called?* I need to see the bigger picture, to understand where this function fits into the overall logic and what triggers its execution. Knowing the callers will tell me its purpose. I need a comprehensive overview of how this function is integrated. |
| 12/2 | 2026/08/04 16:01 | tool | grepper |
0mArgs:{
"Expression": "w5100_probe",
"PathPrefix": ""
}Results: {
"Output": "drivers/net/ethernet/wiznet/w5100-spi.c=421=static int w5100_spi_probe(struct spi_device *spi)\n--\ndrivers/net/ethernet/wiznet/w5100-spi.c-452-\ndrivers/net/ethernet/wiznet/w5100-spi.c:453:\treturn w5100_probe(\u0026spi-\u003edev, ops, priv_size, mac, spi-\u003eirq);\ndrivers/net/ethernet/wiznet/w5100-spi.c-454-}\n--\ndrivers/net/ethernet/wiznet/w5100.c=740=EXPORT_SYMBOL_GPL(w5100_ops_priv);\ndrivers/net/ethernet/wiznet/w5100.c-741-\ndrivers/net/ethernet/wiznet/w5100.c:742:int w5100_probe(struct device *dev, const struct w5100_ops *ops,\ndrivers/net/ethernet/wiznet/w5100.c-743-\t\tint sizeof_ops_priv, const void *mac_addr, int irq)\n--\ndrivers/net/ethernet/wiznet/w5100.c-889-}\ndrivers/net/ethernet/wiznet/w5100.c:890:EXPORT_SYMBOL_GPL(w5100_probe);\ndrivers/net/ethernet/wiznet/w5100.c-891-\n--\ndrivers/net/ethernet/wiznet/w5100.h=29=void *w5100_ops_priv(const struct net_device *ndev);\ndrivers/net/ethernet/wiznet/w5100.h-30-\ndrivers/net/ethernet/wiznet/w5100.h:31:int w5100_probe(struct device *dev, const struct w5100_ops *ops,\ndrivers/net/ethernet/wiznet/w5100.h-32-\t\tint sizeof_ops_priv, const void *mac_addr, int irq);\n"
} |
| 13/2 | 2026/08/04 16:01 | llm | patch-evaluator |
3mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 23841 output: 28 thoughts: 76 Thoughts: Here's my take on those thoughts: **Investigating the W5100 Driver Probe Function** Okay, so I'm looking at the driver code and it seems `w5100_probe` is only called by `w5100_spi_probe`. That's interesting, but I need to make sure I haven't missed anything. I'm wondering if there was ever a `w5100-mmio.c` file for memory-mapped I/O. Did they get rid of it completely, or am I just not seeing it? I know how these things go, sometimes code gets moved or refactored. Let me quickly check the entire `drivers/net/ethernet/wiznet/` directory just to be absolutely sure I haven't overlooked any related files. Gotta be thorough. |
| 14/2 | 2026/08/04 16:04 | tool | codesearch-dir-index |
0mArgs:{
"Dir": "drivers/net/ethernet/wiznet/"
}Results: {
"Files": [
"w5100-spi.c",
"w5100.c",
"w5100.h"
],
"Subdirs": null
} |
| 15/2 | 2026/08/04 16:04 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 24170 output: 46 thoughts: 216 Thoughts: **Analyzing the W5100 Driver in a QEMU Environment** Okay, so I'm looking at these files: `w5100-spi.c`, `w5100.c`, and `w5100.h`. Right off the bat, it's clear this is an SPI-based device. That's the key. Now, the standard QEMU setup I'm using *doesn't* emulate SPI devices out-of-the-box. That's the immediate problem. Let's think. Can I somehow inject an SPI device using syzkaller? I know syzkaller *can* be powerful, but I don't recall seeing a general SPI injection mechanism that lets you just poke any SPI driver. Unless there's a pseudo-device defined somewhere, or it’s part of the device tree, that avenue is likely blocked. Even *if* I could wrangle syzkaller to overlay a device tree entry, the driver itself, this `w5100` driver, is going to be communicating with the hardware using those low-level SPI read/write functions: `w5100_spi_read`, `w5100_spi_write`. If there's no actual hardware connected, those SPI reads will probably just return garbage – maybe zeroes, maybe `0xff` – some default value that doesn’t correspond to the expected response. And that’s a red flag. The driver's `probe` function, that's the crucial point. The probe will almost certainly fail if it reads garbage. I need to confirm whether it reads from the hardware and errors out if it doesn't match the expected values. Let me check `w5100_probe` to be sure. |
| 16/2 | 2026/08/04 16:05 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/wiznet/w5100.c",
"FirstLine": 740,
"LineCount": 100
}Results: {
"Contents": " 740:\tEXPORT_SYMBOL_GPL(w5100_ops_priv);\n 741:\t\n 742:\tint w5100_probe(struct device *dev, const struct w5100_ops *ops,\n 743:\t\t\tint sizeof_ops_priv, const void *mac_addr, int irq)\n 744:\t{\n 745:\t\tstruct w5100_priv *priv;\n 746:\t\tstruct net_device *ndev;\n 747:\t\tint err;\n 748:\t\tsize_t alloc_size;\n 749:\t\n 750:\t\talloc_size = sizeof(*priv);\n 751:\t\tif (sizeof_ops_priv) {\n 752:\t\t\talloc_size = ALIGN(alloc_size, NETDEV_ALIGN);\n 753:\t\t\talloc_size += sizeof_ops_priv;\n 754:\t\t}\n 755:\t\talloc_size += NETDEV_ALIGN - 1;\n 756:\t\n 757:\t\tndev = alloc_etherdev(alloc_size);\n 758:\t\tif (!ndev)\n 759:\t\t\treturn -ENOMEM;\n 760:\t\tSET_NETDEV_DEV(ndev, dev);\n 761:\t\tdev_set_drvdata(dev, ndev);\n 762:\t\tpriv = netdev_priv(ndev);\n 763:\t\n 764:\t\tswitch (ops-\u003echip_id) {\n 765:\t\tcase W5100:\n 766:\t\t\tpriv-\u003es0_regs = W5100_S0_REGS;\n 767:\t\t\tpriv-\u003es0_tx_buf = W5100_TX_MEM_START;\n 768:\t\t\tpriv-\u003es0_tx_buf_size = W5100_TX_MEM_SIZE;\n 769:\t\t\tpriv-\u003es0_rx_buf = W5100_RX_MEM_START;\n 770:\t\t\tpriv-\u003es0_rx_buf_size = W5100_RX_MEM_SIZE;\n 771:\t\t\tbreak;\n 772:\t\tcase W5200:\n 773:\t\t\tpriv-\u003es0_regs = W5200_S0_REGS;\n 774:\t\t\tpriv-\u003es0_tx_buf = W5200_TX_MEM_START;\n 775:\t\t\tpriv-\u003es0_tx_buf_size = W5200_TX_MEM_SIZE;\n 776:\t\t\tpriv-\u003es0_rx_buf = W5200_RX_MEM_START;\n 777:\t\t\tpriv-\u003es0_rx_buf_size = W5200_RX_MEM_SIZE;\n 778:\t\t\tbreak;\n 779:\t\tcase W5500:\n 780:\t\t\tpriv-\u003es0_regs = W5500_S0_REGS;\n 781:\t\t\tpriv-\u003es0_tx_buf = W5500_TX_MEM_START;\n 782:\t\t\tpriv-\u003es0_tx_buf_size = W5500_TX_MEM_SIZE;\n 783:\t\t\tpriv-\u003es0_rx_buf = W5500_RX_MEM_START;\n 784:\t\t\tpriv-\u003es0_rx_buf_size = W5500_RX_MEM_SIZE;\n 785:\t\t\tbreak;\n 786:\t\tdefault:\n 787:\t\t\terr = -EINVAL;\n 788:\t\t\tgoto err_register;\n 789:\t\t}\n 790:\t\n 791:\t\tpriv-\u003endev = ndev;\n 792:\t\tpriv-\u003eops = ops;\n 793:\t\tpriv-\u003eirq = irq;\n 794:\t\tpriv-\u003elink_gpio = gpiod_get_optional(dev, \"link\", GPIOD_IN);\n 795:\t\tif (IS_ERR(priv-\u003elink_gpio)) {\n 796:\t\t\terr = dev_err_probe(dev, PTR_ERR(priv-\u003elink_gpio),\n 797:\t\t\t\t\t \"failed to get link GPIO\\n\");\n 798:\t\t\tpriv-\u003elink_gpio = NULL;\n 799:\t\t\tgoto err_register;\n 800:\t\t}\n 801:\t\n 802:\t\tndev-\u003enetdev_ops = \u0026w5100_netdev_ops;\n 803:\t\tndev-\u003eethtool_ops = \u0026w5100_ethtool_ops;\n 804:\t\tnetif_napi_add_weight(ndev, \u0026priv-\u003enapi, w5100_napi_poll, 16);\n 805:\t\n 806:\t\t/* This chip doesn't support VLAN packets with normal MTU,\n 807:\t\t * so disable VLAN for this device.\n 808:\t\t */\n 809:\t\tndev-\u003efeatures |= NETIF_F_VLAN_CHALLENGED;\n 810:\t\n 811:\t\terr = register_netdev(ndev);\n 812:\t\tif (err \u003c 0)\n 813:\t\t\tgoto err_register;\n 814:\t\n 815:\t\tpriv-\u003exfer_wq = alloc_workqueue(\"%s\", WQ_MEM_RECLAIM | WQ_PERCPU, 0,\n 816:\t\t\t\t\t\tnetdev_name(ndev));\n 817:\t\tif (!priv-\u003exfer_wq) {\n 818:\t\t\terr = -ENOMEM;\n 819:\t\t\tgoto err_wq;\n 820:\t\t}\n 821:\t\n 822:\t\tINIT_WORK(\u0026priv-\u003erx_work, w5100_rx_work);\n 823:\t\tINIT_WORK(\u0026priv-\u003etx_work, w5100_tx_work);\n 824:\t\tINIT_WORK(\u0026priv-\u003esetrx_work, w5100_setrx_work);\n 825:\t\tINIT_WORK(\u0026priv-\u003erestart_work, w5100_restart_work);\n 826:\t\n 827:\t\tif (mac_addr)\n 828:\t\t\teth_hw_addr_set(ndev, mac_addr);\n 829:\t\telse\n 830:\t\t\teth_hw_addr_random(ndev);\n 831:\t\n 832:\t\tif (priv-\u003eops-\u003einit) {\n 833:\t\t\terr = priv-\u003eops-\u003einit(priv-\u003endev);\n 834:\t\t\tif (err)\n 835:\t\t\t\tgoto err_hw;\n 836:\t\t}\n 837:\t\n 838:\t\terr = w5100_hw_reset(priv);\n 839:\t\tif (err)\n"
} |
| 17/2 | 2026/08/04 16:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26571 output: 45 thoughts: 18 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: **Analyzing the `w5100_hw_reset` Function** Alright, let's dive into this `w5100_hw_reset` routine. I need to understand exactly what it's doing. Is it just toggling a pin? Is it a more elaborate sequence involving delays, or perhaps interacting with any power-on reset circuitry? I'm already thinking about potential race conditions – does the timing align correctly with the W5100's internal clock and power-up characteristics? Does it handle any potential voltage transients gracefully, or is there a risk of exceeding absolute maximum ratings? I want to make sure the implementation is robust, especially if this reset is occurring in a noisy environment or within a critical section. I need to consider all the failure modes and how this function addresses them. |
| 18/2 | 2026/08/04 16:05 | tool | read-file |
0mArgs:{
"File": "drivers/net/ethernet/wiznet/w5100.c",
"FirstLine": 351,
"LineCount": 50
}Results: {
"Contents": " 351:\tstatic int w5100_hw_reset(struct w5100_priv *priv)\n 352:\t{\n 353:\t\tu32 rtr;\n 354:\t\n 355:\t\tw5100_reset(priv);\n 356:\t\n 357:\t\tw5100_disable_intr(priv);\n 358:\t\tw5100_write_macaddr(priv);\n 359:\t\n 360:\t\tswitch (priv-\u003eops-\u003echip_id) {\n 361:\t\tcase W5100:\n 362:\t\t\tw5100_memory_configure(priv);\n 363:\t\t\trtr = W5100_RTR;\n 364:\t\t\tbreak;\n 365:\t\tcase W5200:\n 366:\t\t\tw5200_memory_configure(priv);\n 367:\t\t\trtr = W5100_RTR;\n 368:\t\t\tbreak;\n 369:\t\tcase W5500:\n 370:\t\t\tw5500_memory_configure(priv);\n 371:\t\t\trtr = W5500_RTR;\n 372:\t\t\tbreak;\n 373:\t\tdefault:\n 374:\t\t\treturn -EINVAL;\n 375:\t\t}\n 376:\t\n 377:\t\tif (w5100_read16(priv, rtr) != RTR_DEFAULT)\n 378:\t\t\treturn -ENODEV;\n 379:\t\n 380:\t\treturn 0;\n 381:\t}\n 382:\t\n 383:\tstatic void w5100_hw_start(struct w5100_priv *priv)\n 384:\t{\n 385:\t\tu8 mode = S0_MR_MACRAW;\n 386:\t\n 387:\t\tif (!priv-\u003epromisc) {\n 388:\t\t\tif (priv-\u003eops-\u003echip_id == W5500)\n 389:\t\t\t\tmode |= W5500_S0_MR_MF;\n 390:\t\t\telse\n 391:\t\t\t\tmode |= S0_MR_MF;\n 392:\t\t}\n 393:\t\n 394:\t\tw5100_write(priv, W5100_S0_MR(priv), mode);\n 395:\t\tw5100_command(priv, S0_CR_OPEN);\n 396:\t\tw5100_enable_intr(priv);\n 397:\t}\n 398:\t\n 399:\tstatic void w5100_hw_close(struct w5100_priv *priv)\n 400:\t{\n"
} |
| 19/2 | 2026/08/04 16:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27567 output: 34 thoughts: 466 Thoughts: **Analyzing the Impossibility of Virtualized Testing for this Driver** Okay, so I'm looking at this `w5100_hw_reset` function, and it seems pretty straightforward. The critical part is that it checks the value of a register, `rtr`, against `RTR_DEFAULT`. If that check fails, it immediately returns `-ENODEV`, which means the driver will not load. The `w5100_read16` function, being fundamental, will likely return garbage data if the actual hardware isn't present, which definitely won't match `RTR_DEFAULT`. And this hardware happens to be SPI, which, as I know, is not emulated by QEMU. Therefore, since `w5100_hw_reset` is directly called in `w5100_probe`, if the check fails, `w5100_probe` fails, and the driver is dead in the water. This means there's no way to even reach the functional parts of this driver, like `w5100_open`, `w5100_detect_link`, or `w5100_get_link` within QEMU or similar virtualized environments. This falls squarely into the "impossible to reach in virtualized environments" category. It's an SPI device, and for a specific hardware chip at that, so there won't be a software emulation. Now, could there be a backdoor? Maybe through `syzkaller` and a mock SPI driver? Let me think... No. There's no generic mock SPI driver that can fake arbitrary device registers in the mainline kernel. While there is `spi-loopback-test`, it's not a general-purpose register faker. So, that's not happening. Therefore, the conclusion that this is `WorthFuzzing=false` is accurate. Just want to quickly double check the `RTR_DEFAULT` value one last time and then I can move on. |
| 20/2 | 2026/08/04 16:05 | tool | grepper |
0mArgs:{
"Expression": "RTR_DEFAULT",
"PathPrefix": "drivers/net/ethernet/wiznet/"
}Results: {
"Output": "drivers/net/ethernet/wiznet/w5100.c=35=MODULE_LICENSE(\"GPL\");\n--\ndrivers/net/ethernet/wiznet/w5100.c-89-#define W5100_RTR\t\t0x0017 /* Retry Time-value Register */\ndrivers/net/ethernet/wiznet/w5100.c:90:#define RTR_DEFAULT\t\t 2000 /* =0x07d0 (2000) */\ndrivers/net/ethernet/wiznet/w5100.c-91-\n--\ndrivers/net/ethernet/wiznet/w5100.c=351=static int w5100_hw_reset(struct w5100_priv *priv)\n--\ndrivers/net/ethernet/wiznet/w5100.c-376-\ndrivers/net/ethernet/wiznet/w5100.c:377:\tif (w5100_read16(priv, rtr) != RTR_DEFAULT)\ndrivers/net/ethernet/wiznet/w5100.c-378-\t\treturn -ENODEV;\n"
} |
| 21/2 | 2026/08/04 16:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28810 output: 131 thoughts: 131 Thoughts: **My Assessment of the SPI Driver's Probing Capabilities** Okay, so I've confirmed that the default register value, `RTR_DEFAULT`, is indeed 2000, which in hexadecimal is `0x07d0`. A standard dummy SPI read, something you might try in a virtualized environment, would return either `0x0000` or `0xffff`, depending on how the SPI is handled at the hardware layer. Consequently, any attempted probe function will inevitably fail if it's relying on reading and verifying hardware-specific registers. Therefore, and given my understanding of the driver and its dependencies, setting `WorthFuzzing=false` is the correct path. I'll need to clearly articulate this in the comments. This driver is specifically designed for the Wiznet W5100, W5200, and W5500 ethernet chips, and its communication is solely through SPI. Standard QEMU, as it's implemented now, doesn't emulate the necessary hardware interactions with those chips. The probe function is clearly designed to check specific hardware registers that are unavailable or uninitialized in a generic virtual environment. There's no value in fuzzing this driver until the hardware itself is emulated, or other register-based check is implemented. |
| 22/2 | 2026/08/04 16:06 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the w5100 Ethernet driver, which is for Wiznet W5100/W5200/W5500 hardware chips connected via SPI. These chips are not emulated in standard virtualized environments like QEMU. The driver's probe function explicitly checks hardware registers (e.g., verifying RTR_DEFAULT) and will fail to initialize without the physical hardware present. Therefore, the modified code paths cannot be reached during fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the w5100 Ethernet driver, which is for Wiznet W5100/W5200/W5500 hardware chips connected via SPI. These chips are not emulated in standard virtualized environments like QEMU. The driver's probe function explicitly checks hardware registers (e.g., verifying RTR_DEFAULT) and will fail to initialize without the physical hardware present. Therefore, the modified code paths cannot be reached during fuzzing.",
"WorthFuzzing": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|