AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the MediaTek MT7996 Wi-Fi driver, which is a hardware-specific PCI driver. Since there is no generic PCI device emulator in the Linux kernel (unlike USB gadget or mac80211_hwsim), this driver cannot be probed in virtualized environments like QEMU or GCE without the actual hardware. Therefore, the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 21c45270e8aea5c5c87cd8b6f6c40f880cdb31ff\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Jul 22 23:37:02 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c\nindex d6f9aa1ab52d12..115145f993d016 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c\n@@ -236,6 +236,23 @@ static const struct thermal_cooling_device_ops mt7996_thermal_ops = {\n \t.set_cur_state = mt7996_thermal_set_cur_throttle_state,\n };\n \n+static int mt7996_thermal_get_temp(struct thermal_zone_device *tz, int *temp)\n+{\n+\tstruct mt7996_phy *phy = thermal_zone_device_priv(tz);\n+\tint val;\n+\n+\tval = mt7996_mcu_get_temperature(phy);\n+\tif (val \u003c 0)\n+\t\treturn val;\n+\n+\t*temp = val * 1000;\n+\treturn 0;\n+}\n+\n+static const struct thermal_zone_device_ops mt7996_tz_ops = {\n+\t.get_temp = mt7996_thermal_get_temp,\n+};\n+\n static void mt7996_unregister_thermal(struct mt7996_phy *phy)\n {\n \tstruct wiphy *wiphy = phy-\u003emt76-\u003ehw-\u003ewiphy;\n@@ -277,6 +294,17 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)\n \tphy-\u003ethrottle_temp[MT7996_CRIT_TEMP_IDX] = MT7996_CRIT_TEMP;\n \tphy-\u003ethrottle_temp[MT7996_MAX_TEMP_IDX] = MT7996_MAX_TEMP;\n \n+\tphy-\u003etzone = devm_thermal_of_zone_register(phy-\u003edev-\u003emt76.dev,\n+\t\t\t\t\t\t   phy-\u003emt76-\u003eband_idx, phy,\n+\t\t\t\t\t\t   \u0026mt7996_tz_ops);\n+\tif (IS_ERR(phy-\u003etzone)) {\n+\t\tif (PTR_ERR(phy-\u003etzone) != -ENODEV)\n+\t\t\tdev_warn(phy-\u003edev-\u003emt76.dev,\n+\t\t\t\t \"failed to register thermal zone%d: %ld\\n\",\n+\t\t\t\t phy-\u003emt76-\u003eband_idx, PTR_ERR(phy-\u003etzone));\n+\t\tphy-\u003etzone = NULL;\n+\t}\n+\n \tif (!IS_REACHABLE(CONFIG_HWMON))\n \t\treturn 0;\n \ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h\nindex 0d6488522ba711..1207b5c7e98b9d 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h\n@@ -372,6 +372,7 @@ struct mt7996_phy {\n \n \tstruct ieee80211_sband_iftype_data iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];\n \n+\tstruct thermal_zone_device *tzone;\n \tstruct thermal_cooling_device *cdev;\n \tu8 cdev_state;\n \tu8 throttle_state;\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the MediaTek MT7996 Wi-Fi driver, which is a hardware-specific PCI driver. Since there is no generic PCI device emulator in the Linux kernel (unlike USB gadget or mac80211_hwsim), this driver cannot be probed in virtualized environments like QEMU or GCE without the actual hardware. Therefore, the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 21c45270e8aea5c5c87cd8b6f6c40f880cdb31ff
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Jul 22 23:37:02 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index d6f9aa1ab52d12..115145f993d016 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -236,6 +236,23 @@ static const struct thermal_cooling_device_ops mt7996_thermal_ops = {
 	.set_cur_state = mt7996_thermal_set_cur_throttle_state,
 };
 
+static int mt7996_thermal_get_temp(struct thermal_zone_device *tz, int *temp)
+{
+	struct mt7996_phy *phy = thermal_zone_device_priv(tz);
+	int val;
+
+	val = mt7996_mcu_get_temperature(phy);
+	if (val < 0)
+		return val;
+
+	*temp = val * 1000;
+	return 0;
+}
+
+static const struct thermal_zone_device_ops mt7996_tz_ops = {
+	.get_temp = mt7996_thermal_get_temp,
+};
+
 static void mt7996_unregister_thermal(struct mt7996_phy *phy)
 {
 	struct wiphy *wiphy = phy->mt76->hw->wiphy;
@@ -277,6 +294,17 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
 	phy->throttle_temp[MT7996_CRIT_TEMP_IDX] = MT7996_CRIT_TEMP;
 	phy->throttle_temp[MT7996_MAX_TEMP_IDX] = MT7996_MAX_TEMP;
 
+	phy->tzone = devm_thermal_of_zone_register(phy->dev->mt76.dev,
+						   phy->mt76->band_idx, phy,
+						   &mt7996_tz_ops);
+	if (IS_ERR(phy->tzone)) {
+		if (PTR_ERR(phy->tzone) != -ENODEV)
+			dev_warn(phy->dev->mt76.dev,
+				 "failed to register thermal zone%d: %ld\n",
+				 phy->mt76->band_idx, PTR_ERR(phy->tzone));
+		phy->tzone = NULL;
+	}
+
 	if (!IS_REACHABLE(CONFIG_HWMON))
 		return 0;
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 0d6488522ba711..1207b5c7e98b9d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -372,6 +372,7 @@ struct mt7996_phy {
 
 	struct ieee80211_sband_iftype_data iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];
 
+	struct thermal_zone_device *tzone;
 	struct thermal_cooling_device *cdev;
 	u8 cdev_state;
 	u8 throttle_state;

gemini-3.1-pro-preview

null

null

							input: 2691
							output: 44
							thoughts: 173
						

**Analyzing the `mt7996` Thermal Zone Patch**

Okay, so I'm looking at this patch adding thermal zone support to the `mt7996` wireless driver. It's registering the thermal zone device using `devm_thermal_of_zone_register`, which seems standard enough. But I'm starting to think about reachability, and whether this is even realistically testable in virtualized environments. This is a driver for a *physical* Wi-Fi device, the `mt7996`.  Usually, unless there's a specific software emulation layer in place—like `mac80211_hwsim`—a PCI or USB Wi-Fi driver is pretty much inaccessible in a typical VM setup.

Now, if I think about it more carefully, and I believe this is a PCIe driver, so the reachability question becomes more interesting. It *could* be fuzzed, given PCIe’s characteristics. I need to confirm whether `mt7996` is, in fact, PCIe or USB. I'll use `grepper` to quickly determine what bus type this driver is associated with.

{
  "Expression": "mt7996",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 6535 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:3:obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:5:mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-6-\t     debugfs.o mmio.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:8:mt7996e-$(CONFIG_MT7996_NPU) += npu.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:9:mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=12=MODULE_PARM_DESC(coredump_memdump, \"Optional ability to dump firmware memory\");\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-13-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:14:static const struct mt7996_mem_region mt7996_mem_regions[] = {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-15-\t{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-46-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:47:const struct mt7996_mem_region*\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:48:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-49-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-52-\tcase MT7996_DEVICE_ID_2:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:53:\t\t*num = ARRAY_SIZE(mt7996_mem_regions);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:54:\t\treturn \u0026mt7996_mem_regions[0];\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-55-\tdefault:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:60:static int mt7996_coredump_get_mem_size(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-61-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:62:\tconst struct mt7996_mem_region *mem_region;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-63-\tsize_t size = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-66-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:67:\tmem_region = mt7996_coredump_get_mem_layout(dev, \u0026num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-68-\tif (!mem_region)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-76-\t/* reserve space for the headers */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:77:\tsize += num * sizeof(struct mt7996_mem_hdr);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-78-\t/* make sure it is aligned 4 bytes for debug message print out */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-83-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:84:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-85-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:86:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-87-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=100=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:101:mt7996_coredump_fw_state(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-102-\t\t\t bool *exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=117=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:118:mt7996_coredump_fw_stack(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-119-\t\t\t bool exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-161-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:162:static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-163-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:164:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:165:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:166:\tstruct mt7996_coredump_mem *dump_mem;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-167-\tsize_t len, sofar = 0, hdr_len = sizeof(*dump);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-186-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:187:\tdump = (struct mt7996_coredump *)(buf);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-188-\tdump-\u003elen = len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:201:\tmt7996_coredump_fw_state(dev, dump, \u0026exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:202:\tmt7996_coredump_fw_stack(dev, dump, exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-203-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-204-\t/* gather memory content */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:205:\tdump_mem = (struct mt7996_coredump_mem *)(buf + sofar);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-206-\tdump_mem-\u003elen = crash_data-\u003ememdump_buf_len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-215-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:216:int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-217-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:218:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:220:\tdump = mt7996_coredump_build(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-221-\tif (!dump) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-230-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:231:int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-232-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:233:\tstruct mt7996_crash_data *crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-234-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-241-\tif (coredump_memdump) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:242:\t\tcrash_data-\u003ememdump_buf_len = mt7996_coredump_get_mem_size(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-243-\t\tif (!crash_data-\u003ememdump_buf_len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-256-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:257:void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-258-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-6-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-8-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:9:struct mt7996_coredump {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-10-\tchar magic[16];\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-39-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:40:struct mt7996_coredump_mem {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-41-\tu32 len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-44-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:45:struct mt7996_mem_hdr {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-46-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-50-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:51:struct mt7996_mem_region {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-52-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:60:const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:61:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:62:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:63:int mt7996_coredump_submit(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:64:int mt7996_coredump_register(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:65:void mt7996_coredump_unregister(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-66-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-68-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:69:static inline const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:70:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-71-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-74-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:75:static inline int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-76-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h=80=static inline struct\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:81:mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-82-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-85-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:86:static inline int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-87-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-90-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:91:static inline void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-92-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-6-#include \u003clinux/relay.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-8-#include \"eeprom.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=23=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:24:mt7996_implicit_txbf_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-25-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:26:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-27-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-32-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:33:\treturn mt7996_mcu_set_txbf(dev, BF_HW_EN_UPDATE);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-34-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=36=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:37:mt7996_implicit_txbf_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-38-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:39:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-40-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-45-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:46:DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7996_implicit_txbf_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:47:\t\t\t mt7996_implicit_txbf_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-48-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=50=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:51:mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-52-\t\t\tsize_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-53-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:54:\tstruct mt7996_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-55-\tchar buf[16], *sep;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-91-\tcase UNI_CMD_SER_QUERY:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:92:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_QUERY, 0, band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-93-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-100-\tcase UNI_CMD_SER_SET_RECOVER_L4_MDP:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:101:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_SET, BIT(val), band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-102-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:105:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_TRIGGER, val, band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-106-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-111-\t\tdev-\u003erecovery.state |= MT_MCU_CMD_WDT_MASK;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:112:\t\tmt7996_reset(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-113-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-116-\tcase UNI_CMD_SER_SET_SYSTEM_ASSERT:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:117:\t\tret = mt7996_mcu_trigger_assert(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-118-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=128=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:129:mt7996_sys_recovery_get(struct file *file, char __user *user_buf,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-130-\t\t\tsize_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-131-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:132:\tstruct mt7996_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-133-\tchar *buff;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-214-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:215:static const struct file_operations mt7996_sys_recovery_ops = {\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:216:\t.write = mt7996_sys_recovery_set,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:217:\t.read = mt7996_sys_recovery_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-218-\t.open = simple_open,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=222=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:223:mt7996_radar_trigger(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-224-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-226-#define RADAR_BACKGROUND\t2\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:227:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:228:\tstruct mt7996_phy *phy = mt7996_band_phy(dev, NL80211_BAND_5GHZ);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-229-\tstruct cfg80211_chan_def *chandef;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-247-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:248:\trdd_idx = mt7996_get_rdd_idx(phy, val == RADAR_BACKGROUND);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-249-\tif (rdd_idx \u003c 0) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-258-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:259:\treturn mt7996_mcu_rdd_cmd(dev, RDD_RADAR_EMULATE, rdd_idx, 0);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-260-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=262=DEFINE_DEBUGFS_ATTRIBUTE(fops_radar_trigger, NULL,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:263:\t\t\t mt7996_radar_trigger, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-264-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=265=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:266:mt7996_rdd_monitor(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-267-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:268:\tstruct mt7996_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-269-\tstruct cfg80211_chan_def *chandef = \u0026dev-\u003erdd2_chandef;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=312=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:313:mt7996_fw_debug_wm_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-314-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:315:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-316-\tenum {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-337-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:338:\tret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, val);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-339-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-350-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:351:\t\tret = mt7996_mcu_fw_dbg_ctrl(dev, debug, val);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-352-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=359=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:360:mt7996_fw_debug_wm_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-361-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:362:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-363-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-368-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:369:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_wm, mt7996_fw_debug_wm_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:370:\t\t\t mt7996_fw_debug_wm_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-371-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=372=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:373:mt7996_fw_debug_wa_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-374-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:375:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-376-\tint ret;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-379-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:380:\tret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, dev-\u003efw_debug_wa);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-381-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-383-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:384:\treturn mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_PDMA_RX,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-385-\t\t\t\t !!dev-\u003efw_debug_wa, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=388=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:389:mt7996_fw_debug_wa_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-390-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:391:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-392-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-397-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:398:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_wa, mt7996_fw_debug_wa_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:399:\t\t\t mt7996_fw_debug_wa_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-400-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=425=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:426:mt7996_fw_debug_bin_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-427-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-431-\t};\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:432:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-433-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-443-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:444:\treturn mt7996_fw_debug_wm_set(dev, dev-\u003efw_debug_wm);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-445-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=447=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:448:mt7996_fw_debug_bin_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-449-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:450:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-451-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-456-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:457:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_bin, mt7996_fw_debug_bin_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:458:\t\t\t mt7996_fw_debug_bin_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-459-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=460=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:461:mt7996_fw_util_wa_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-462-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:463:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-464-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-465-\tif (dev-\u003efw_debug_wa)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:466:\t\treturn mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-467-\t\t\t\t\t MCU_WA_PARAM_CPU_UTIL, 0, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-471-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:472:DEFINE_SHOW_ATTRIBUTE(mt7996_fw_util_wa);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-473-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=474=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:475:mt7996_ampdu_stat_read_phy(struct mt7996_phy *phy, struct seq_file *file)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-476-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:477:\tstruct mt7996_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-478-\tint bound[15], range[8], i;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=504=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:505:mt7996_txbf_stat_read_phy(struct mt7996_phy *phy, struct seq_file *s)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-506-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=552=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:553:mt7996_tx_stats_show_phy(struct seq_file *file, struct mt7996_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-554-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-558-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:559:\tmt7996_mac_update_stats(phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:560:\tmt7996_ampdu_stat_read_phy(phy, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-561-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-568-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:569:\tmt7996_txbf_stat_read_phy(phy, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-570-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=584=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:585:mt7996_tx_stats_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-586-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:587:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:588:\tstruct mt7996_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-589-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-591-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:592:\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:593:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-594-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:595:\t\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:596:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-597-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:598:\t\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-599-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-604-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:605:DEFINE_SHOW_ATTRIBUTE(mt7996_tx_stats);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-606-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=607=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:608:mt7996_hw_queue_read(struct seq_file *s, u32 size,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-609-\t\t     const struct hw_queue_map *map)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-610-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:611:\tstruct mt7996_phy *phy = s-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:612:\tstruct mt7996_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-613-\tu32 i, val;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=638=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:639:mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-640-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:641:\tstruct mt7996_sta *msta = (struct mt7996_sta *)sta-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:642:\tstruct mt7996_vif *mvif = msta-\u003evif;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:643:\tstruct mt7996_phy *phy = mt7996_vif_link_phy(\u0026mvif-\u003edeflink);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-644-\tstruct ieee80211_link_sta *link_sta;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-646-\tstruct ieee80211_vif *vif;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:647:\tstruct mt7996_dev *dev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-648-\tunsigned int link_id;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-658-\tfor_each_sta_active_link(vif, sta, link_sta, link_id) {\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:659:\t\tstruct mt7996_sta_link *msta_link;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-660-\t\tstruct mt76_vif_link *mlink;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-666-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:667:\t\tmsta_link = mt7996_sta_link(msta, link_id);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-668-\t\tif (!msta_link)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=694=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:695:mt7996_hw_queues_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-696-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:697:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:698:\tstruct mt7996_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-699-\tstatic const struct hw_queue_map ple_queue_map[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-747-\tseq_puts(file, \"PLE non-empty queue info:\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:748:\tmt7996_hw_queue_read(file, ARRAY_SIZE(ple_queue_map),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-749-\t\t\t     \u0026ple_queue_map[0]);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-752-\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:753:\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:754:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-755-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-756-\t\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:757:\t\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:758:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-759-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-760-\t\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:761:\t\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-762-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-764-\tseq_puts(file, \"PSE non-empty queue info:\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:765:\tmt7996_hw_queue_read(file, ARRAY_SIZE(pse_queue_map),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-766-\t\t\t     \u0026pse_queue_map[0]);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-770-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:771:DEFINE_SHOW_ATTRIBUTE(mt7996_hw_queues);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-772-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=773=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:774:mt7996_xmit_queues_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-775-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:776:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:777:\tstruct mt7996_phy *phy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-778-\tstruct {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-790-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:791:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-792-\tif (phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-794-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:795:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-796-\tif (phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-813-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:814:DEFINE_SHOW_ATTRIBUTE(mt7996_xmit_queues);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-815-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=816=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:817:mt7996_twt_stats(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-818-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:819:\tstruct mt7996_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:820:\tstruct mt7996_twt_flow *iter;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-821-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=845=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:846:mt7996_rf_regval_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-847-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:848:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-849-\tu32 regval;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-851-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:852:\tret = mt7996_mcu_rf_regval(dev, dev-\u003emt76.debugfs_reg, \u0026regval, false);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-853-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=861=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:862:mt7996_rf_regval_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-863-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:864:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-865-\tu32 val32 = val;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-866-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:867:\treturn mt7996_mcu_rf_regval(dev, dev-\u003emt76.debugfs_reg, \u0026val32, true);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-868-}\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-869-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:870:DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:871:\t\t\t mt7996_rf_regval_set, \"0x%08llx\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-872-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:873:int mt7996_init_debugfs(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-874-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-879-\tdebugfs_create_file(\"hw-queues\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:880:\t\t\t    \u0026mt7996_hw_queues_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-881-\tdebugfs_create_file(\"xmit-queues\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:882:\t\t\t    \u0026mt7996_xmit_queues_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:883:\tdebugfs_create_file(\"tx_stats\", 0400, dir, dev, \u0026mt7996_tx_stats_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-884-\tdebugfs_create_file(\"sys_recovery\", 0600, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:885:\t\t\t    \u0026mt7996_sys_recovery_ops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-886-\tdebugfs_create_file(\"fw_debug_wm\", 0600, dir, dev, \u0026fops_fw_debug_wm);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-890-\tdebugfs_create_file(\"fw_util_wa\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:891:\t\t\t    \u0026mt7996_fw_util_wa_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-892-\tdebugfs_create_file(\"implicit_txbf\", 0600, dir, dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-894-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"twt_stats\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:895:\t\t\t\t    mt7996_twt_stats);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-896-\tdebugfs_create_file(\"rf_regval\", 0600, dir, dev, \u0026fops_rf_regval);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-901-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"rdd_monitor\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:902:\t\t\t\t    mt7996_rdd_monitor);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-903-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=909=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:910:mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-911-\t\t\t   const void *data, int len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-933-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:934:void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-935-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-955-\thdr.len = *(__le16 *)data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:956:\tmt7996_debugfs_write_fwlog(dev, \u0026hdr, sizeof(hdr), data, len);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-957-}\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-958-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 19977
							output: 43
							thoughts: 78
						

Okay, here's my interpretation of that thought process, tailored for an expert audience:

**Analyzing the mt7996 Driver**

Right, so I'm looking at this `mt7996`. My initial thought was that it was a MediaTek Wi-Fi driver – common assumption given the naming convention. But then, a red flag went up. Memory is hazy, I need to check something. Wait a second, isn't `mt7996` actually a PCIe driver, right? I need to quickly confirm this. Where would that information be located? Ah, yes, if this is a PCIe driver, the obvious places to investigate are likely `drivers/net/wireless/mediatek/mt76/mt7996/pci.c` or perhaps `init.c`. That should give me the details I need to confirm its role and dive deeper into the code's specifics. Let's see what these files reveal.

{
  "Expression": "pci_driver",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7996/mmio.c=868=static int __init mt7996_init(void)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-875-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:876:\tret = pci_register_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-877-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c=883=static void __exit mt7996_exit(void)\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-884-{\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:885:\tpci_unregister_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-886-\tpci_unregister_driver(\u0026mt7996_hif_driver);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=669=extern const struct ieee80211_ops mt7996_ops;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:670:extern struct pci_driver mt7996_pci_driver;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:671:extern struct pci_driver mt7996_hif_driver;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-672-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c=233=static void mt7996_pci_remove(struct pci_dev *pdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-243-\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:244:struct pci_driver mt7996_hif_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-245-\t.name\t\t= KBUILD_MODNAME \"_hif\",\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-250-\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:251:struct pci_driver mt7996_pci_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-252-\t.name\t\t= KBUILD_MODNAME,\n"
}

gemini-3.1-pro-preview

null

null

							input: 21116
							output: 30
							thoughts: 763
						

**Analyzing the Reachability of the mt7996 Driver for Fuzzing**

Okay, so I'm looking at a PCI driver, specifically `mt7996`. The question is, can I effectively fuzz this driver using syzkaller? My initial thought is that it *might* be possible, since syzkaller *does* have PCI fuzzing capabilities, right? But then I remember the note about virtualized environments and unreachable code paths. This driver, being hardware-specific, throws up a red flag. I know syzkaller uses pseudo-syscalls like `syz_pci_...`, but the prompt emphasizes that syzkaller pseudo-syscalls are not present in the Linux kernel and cannot be searched using this tool.

My immediate assumption is that without the actual MediaTek MT7996 PCIe hardware, or a precise QEMU emulation of it, it's a dead end. QEMU does *not* natively emulate the MT7996, which kills that option. We have `syz_usb_connect` for USB, `mac80211_hwsim` for Wi-Fi, but `mt7996` is different, it's a specific hardware driver, not a software simulator.

Wait, syzkaller *does* have some level of PCI fuzzing, right? It uses `syz_pci_...` pseudo-syscalls, or maybe it injects PCI devices somehow? It can't be that simple. And then I have to remember that the tool I'm using can't search for those `syz_` pseudo-syscalls directly.

Okay, so the `mt7996` driver has an `mt7996_thermal_init` function. Can I reach it during initialization? The key here is if the `mt7996` driver itself is reachable. I check, and it's confirmed; it's a PCI driver.

So, the issue is clear: Can I probe a PCI driver without the hardware? Syzkaller uses `vhci` for USB, `netdevsim` for networking, and `mac80211_hwsim` for Wi-Fi. But `mac80211_hwsim` doesn't help here, it's a software simulator that *doesn't* use `mt7996`.

So, *does* syzkaller have some generic PCI device emulator via a virtual PCI bus, or maybe via `vfio`? Nope. I then check again, confirming that `mt7996` is indeed a MediaTek Wi-Fi 7 driver.

So, if it is a hardware-specific PCI driver, it’s generally unreachable unless there is a specific emulator. And I have to assume, given the context, that a specific emulator doesn't exist. There might be some interesting code like `devm_thermal_of_zone_register`, but it's moot if the driver cannot be probed. The bottom line is, this code is likely unreachable without the hardware or a suitable emulator. I need to verify if there's *any* way to probe `mt7996` without the hardware before I waste time on this.

{
  "Expression": "mt7996_pci_driver",
  "PathPrefix": ""
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7996/mmio.c=868=static int __init mt7996_init(void)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-875-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:876:\tret = pci_register_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-877-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c=883=static void __exit mt7996_exit(void)\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-884-{\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:885:\tpci_unregister_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-886-\tpci_unregister_driver(\u0026mt7996_hif_driver);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=669=extern const struct ieee80211_ops mt7996_ops;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:670:extern struct pci_driver mt7996_pci_driver;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-671-extern struct pci_driver mt7996_hif_driver;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c=244=struct pci_driver mt7996_hif_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-250-\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:251:struct pci_driver mt7996_pci_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-252-\t.name\t\t= KBUILD_MODNAME,\n"
}

gemini-3.1-pro-preview

null

null

							input: 23258
							output: 30
							thoughts: 402
						

**My Assessment of PCI Driver Fuzzing Feasibility**

Okay, so the prompt mentions a PCI driver and the limitations of virtualized environments. First thought: Can Syzkaller handle this driver? Does Syzkaller have a generic way to fuzz *arbitrary* PCI drivers? Unless, of course, there's a virtual device already in place, or a dedicated PCI fuzzer. Wait... does Syzkaller *have* a PCI fuzzer?

Ah, right, `syz_pci_...` pseudo-syscalls! Yes, there is a PCI fuzzer that emulates PCI devices. But, the prompt raises a crucial point about code paths unreachable in virtualized environments, even with emulated hardware. So, can Syzkaller's PCI fuzzer emulate *arbitrary* PCI devices, or is it just limited to injecting them?

Okay, let's think this through. Syzkaller has a USB fuzzer because USB has a software-defined interface for device emulation. USB gadget is the key. But PCI is *different*. It lacks a generic software-defined interface in the Linux kernel for arbitrary device emulation. To emulate a PCI device, you need something like a QEMU device model, or possibly a specific kernel module? `vfio`? No, that's for userspace drivers, that's not what I'm looking for.

Ah, there isn't a *generic* PCI device emulator in the kernel that lets userspace emulate arbitrary devices.

Therefore, for this specific hardware device like the MediaTek MT7996, it's virtually impossible to probe and fuzz this in a virtualized environment unless QEMU *specifically* emulates it, which it doesn't. Okay, I'll double-check for a platform driver or something similar to see if there's any other option.

{
  "Expression": "mt7996_pci_probe",
  "PathPrefix": ""
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7996/pci.c=79=static int mt7996_pci_hif2_probe(struct pci_dev *pdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-98-\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:99:static int mt7996_pci_probe(struct pci_dev *pdev,\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-100-\t\t\t    const struct pci_device_id *id)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c=244=struct pci_driver mt7996_hif_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-246-\t.id_table\t= mt7996_hif_device_table,\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:247:\t.probe\t\t= mt7996_pci_probe,\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-248-\t.remove\t\t= mt7996_hif_remove,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c=251=struct pci_driver mt7996_pci_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-253-\t.id_table\t= mt7996_pci_device_table,\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:254:\t.probe\t\t= mt7996_pci_probe,\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-255-\t.remove\t\t= mt7996_pci_remove,\n"
}

gemini-3.1-pro-preview

null

null

							input: 24649
							output: 48
							thoughts: 196
						

**PCI Fuzzing Conundrum**

Okay, wait a minute, does syzkaller even *have* a PCI fuzzer? I should probably double-check. Let me see if there's anything obvious in the kernel source, like a `syz_pci` call. Oh, right, the prompt warned me. It specifically said not to look for anything starting with "syz_" in the kernel itself. Those are just syzkaller's internal pseudo-syscalls. Okay, so scratch that.

Instead of looking for a syz_pci, I should look for a PCI emulation framework, *within* the kernel. Let me see... Aha, I see `CONFIG_PCI_ENDPOINT_TEST`, but that's just for endpoints, not a general emulation framework. So, no, there isn't any generic PCI emulation capability in the kernel that would let userspace just define and interact with an arbitrary PCI device.

Hmm, what if the driver isn't strictly PCI but can also be accessed via SDIO or USB? I need to find the driver directory, so let me see… Alright, the directory is `drivers/net/wireless/mediatek/mt76/mt7996/`. Now let's dig into the `Makefile` to see how it works.

{
  "Expression": "mt7996e-y",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996/Makefile"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7996/Makefile=3=obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:5:mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-6-\t     debugfs.o mmio.o\n"
}

gemini-3.1-pro-preview

null

null

							input: 25346
							output: 42
							thoughts: 137
						

**My Assessment of This PCI Driver's Fuzzing Potential**

Okay, so the issue at hand is solely within `pci.o`. That immediately flags it as a PCI-specific driver. Given that it targets a particular hardware device through the PCI interface, I know, based on experience, that the likelihood of triggering it in a virtualized environment – like a GCE instance or QEMU – is effectively zero, barring very specific and sophisticated emulation.

Consequently, any code paths residing within `mt7996_thermal_init` and `mt7996_thermal_get_temp` are, in this context, inaccessible. They are intimately tied to the hardware interaction that simply won't be available to me during my fuzzing efforts in this type of environment.

Therefore, the prudent and resource-conscious decision here is to declare `WorthFuzzing=false`. It's a waste of time to chase functionality that's fundamentally unreachable without the appropriate physical hardware or a very specialized emulator.

Just to be absolutely certain, let me quickly scan the broader device registration landscape within the driver. Are there any indications of platform device registration or alternate pathways that might allow for some form of code execution within this driver? I need to be sure that I haven't missed a more indirect method of getting at it.

no matches

{
  "Expression": "platform_driver",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 25816
							output: 116
							thoughts: 504
						

**WorthFuzzing=false: MediaTek Wi-Fi Driver Analysis**

Okay, so I'm looking at this MediaTek Wi-Fi driver, trying to figure out if it's a good target for fuzzing. Initially, I was thinking, "No platform driver, so is there another way to get at this?" The answer is pretty clear: No.

Then I had a flicker of an idea, "Wait, MediaTek drivers, sometimes used in SoCs as platform devices, maybe it could be used by SoCs, like OpenWrt routers and such?" I checked the code. The Makefile only builds `pci.o` and `mmio.o`, so it seems it's not the case. The `mt7996_init` function only registers the PCI drivers.

So it's purely a PCI driver. That's a problem. Syzkaller runs in environments like QEMU or GCE, and there's no generic PCI device emulator built into the Linux kernel like with USB gadget or `mac80211_hwsim`. This means that PCI drivers for specific hardware just can't be probed in a virtualized environment. This means the thermal zone registration and the `mt7996_thermal_get_temp` function are unreachable via fuzzing.

My conclusion is that this is a hardware-specific PCI driver that cannot be effectively fuzzed in a virtualized environment. Therefore, I need to return `WorthFuzzing=false`.

Let me just confirm there isn't some hidden generic PCI device emulator in the kernel that I'm forgetting... There's `PCI_STUB` but that's for hiding devices from the host, not for emulating. Then there's `VFIO_PCI`, but that's for passing through *real* devices. Nothing there. So, really, Syzkaller's PCI fuzzing *relies* on QEMU's PCI emulation, or it doesn't exist...

Wait, doesn't Syzkaller have a PCI fuzzer? How does that work? Does it inject PCI devices via a custom QEMU device or something? No, it doesn't. Syzkaller uses `syz_pci_...` which might be implemented via some custom kernel module? No, syzkaller doesn't use custom kernel modules. It does use `vhci` for USB, but I can't find a `vhci` equivalent for PCI.

Right, then how? Does Syzkaller have a custom QEMU device? No. Then, how do they inject PCI devices, syzkaller uses the `syz_pci` pseudo-syscalls which are implemented in the executor, but how do they inject PCI devices? They don't. They just fuzz the PCI configuration space of existing devices? No. It injects a *new* PCI device. Actually, syzkaller does not have a generic PCI device emulator.

Given all of that, it is clear that I will set `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the MediaTek MT7996 Wi-Fi driver, which is a hardware-specific PCI driver. Since there is no generic PCI device emulator in the Linux kernel (unlike USB gadget or mac80211_hwsim), this driver cannot be probed in virtualized environments like QEMU or GCE without the actual hardware. Therefore, the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the MediaTek MT7996 Wi-Fi driver, which is a hardware-specific PCI driver. Since there is no generic PCI device emulator in the Linux kernel (unlike USB gadget or mac80211_hwsim), this driver cannot be probed in virtualized environments like QEMU or GCE without the actual hardware. Therefore, the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}