AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/10 04:36	flow	patch-triage	0m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "KMSANReasoning": "", "NeedsKMSAN": false, "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false }
1/1	2026/09/10 04:36	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 2a8ee534af585374519e264e9af2aaa7dcbcefe1\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Sep 10 04:36:56 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c\nindex a949987125976..71e700008c20e 100644\n--- a/drivers/net/wwan/mhi_wwan_mbim.c\n+++ b/drivers/net/wwan/mhi_wwan_mbim.c\n@@ -254,6 +254,7 @@ static int mbim_rx_verify_ndp16(struct sk_buff skb, struct usb_cdc_ncm_ndp16 n\n static void mhi_mbim_rx(struct mhi_mbim_context mbim, struct sk_buff skb)\n {\n \tint ndpoffset;\n+\tint last_ndpoffset = 0;\n \n \t/* Check NTB header and retrieve first NDP offset /\n \tndpoffset = mbim_rx_verify_nth16(mbim, skb);\n@@ -265,6 +266,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context mbim, struct sk_buff skb)\n \t/ Process each NDP /\n \twhile (1) {\n \t\tstruct usb_cdc_ncm_ndp16 ndp16;\n+\n+\t\tif (ndpoffset \u003c= last_ndpoffset) {\n+\t\t\tnet_err_ratelimited(\"mbim: non-increasing NDP offset (%u)\\n\",\n+\t\t\t\t\t ndpoffset);\n+\t\t\tbreak;\n+\t\t}\n+\t\tlast_ndpoffset = ndpoffset;\n \t\tstruct usb_cdc_ncm_dpe16 dpe16;\n \t\tstruct mhi_mbim_link link;\n \t\tint nframes, n, dpeoffset;\n@@ -320,7 +328,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context mbim, struct sk_buff skb)\n \t\t\t\tcontinue;\n \n \t\t\tskb_put(skbn, dgram_len);\n-\t\t\tskb_copy_bits(skb, dgram_offset, skbn-\u003edata, dgram_len);\n+\t\t\tif (skb_copy_bits(skb, dgram_offset, skbn-\u003edata, dgram_len)) {\n+\t\t\t\tdev_kfree_skb_any(skbn);\n+\t\t\t\tu64_stats_update_begin(\u0026link-\u003erx_syncp);\n+\t\t\t\tu64_stats_inc(\u0026link-\u003erx_errors);\n+\t\t\t\tu64_stats_update_end(\u0026link-\u003erx_syncp);\n+\t\t\t\tcontinue;\n+\t\t\t}\n \n \t\t\tswitch (skbn-\u003edata[0] \u0026 0xf0) {\n \t\t\tcase 0x40:\ndiff --git a/drivers/net/wwan/t7xx/t7xx_netdev.c b/drivers/net/wwan/t7xx/t7xx_netdev.c\nindex fc0a7cb181df2..8f32c2d269312 100644\n--- a/drivers/net/wwan/t7xx/t7xx_netdev.c\n+++ b/drivers/net/wwan/t7xx/t7xx_netdev.c\n@@ -420,6 +420,10 @@ static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl *ccmni_ctlb, struct sk_bu\n \n \tskb_cb = T7XX_SKB_CB(skb);\n \tnetif_id = skb_cb-\u003enetif_idx;\n+\tif (netif_id \u003e= NIC_DEV_MAX) {\n+\t\tdev_kfree_skb(skb);\n+\t\treturn;\n+\t}\n \tccmni = READ_ONCE(ccmni_ctlb-\u003eccmni_inst[netif_id]);\n \tif (!ccmni) {\n \t\tdev_kfree_skb(skb);\n" }
2/1	2026/09/10 04:37	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 2a8ee534af585374519e264e9af2aaa7dcbcefe1 Author: syz-cluster <triage@syzkaller.com> Date: Thu Sep 10 04:36:56 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c index a949987125976..71e700008c20e 100644 --- a/drivers/net/wwan/mhi_wwan_mbim.c +++ b/drivers/net/wwan/mhi_wwan_mbim.c @@ -254,6 +254,7 @@ static int mbim_rx_verify_ndp16(struct sk_buff skb, struct usb_cdc_ncm_ndp16 n static void mhi_mbim_rx(struct mhi_mbim_context mbim, struct sk_buff skb) { int ndpoffset; + int last_ndpoffset = 0; /* Check NTB header and retrieve first NDP offset / ndpoffset = mbim_rx_verify_nth16(mbim, skb); @@ -265,6 +266,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context mbim, struct sk_buff skb) / Process each NDP / while (1) { struct usb_cdc_ncm_ndp16 ndp16; + + if (ndpoffset <= last_ndpoffset) { + net_err_ratelimited("mbim: non-increasing NDP offset (%u)\n", + ndpoffset); + break; + } + last_ndpoffset = ndpoffset; struct usb_cdc_ncm_dpe16 dpe16; struct mhi_mbim_link link; int nframes, n, dpeoffset; @@ -320,7 +328,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context mbim, struct sk_buff skb) continue; skb_put(skbn, dgram_len); - skb_copy_bits(skb, dgram_offset, skbn->data, dgram_len); + if (skb_copy_bits(skb, dgram_offset, skbn->data, dgram_len)) { + dev_kfree_skb_any(skbn); + u64_stats_update_begin(&link->rx_syncp); + u64_stats_inc(&link->rx_errors); + u64_stats_update_end(&link->rx_syncp); + continue; + } switch (skbn->data[0] & 0xf0) { case 0x40: diff --git a/drivers/net/wwan/t7xx/t7xx_netdev.c b/drivers/net/wwan/t7xx/t7xx_netdev.c index fc0a7cb181df2..8f32c2d269312 100644 --- a/drivers/net/wwan/t7xx/t7xx_netdev.c +++ b/drivers/net/wwan/t7xx/t7xx_netdev.c @@ -420,6 +420,10 @@ static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl *ccmni_ctlb, struct sk_bu skb_cb = T7XX_SKB_CB(skb); netif_id = skb_cb->netif_idx; + if (netif_id >= NIC_DEV_MAX) { + dev_kfree_skb(skb); + return; + } ccmni = READ_ONCE(ccmni_ctlb->ccmni_inst[netif_id]); if (!ccmni) { dev_kfree_skb(skb);
3/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 3685 output: 28 thoughts: 191 Thoughts: Analyzing this Patch: A Deep Dive Okay, let's break down this patch. My initial thought is to zero in on what's being touched. I see two files: `drivers/net/wwan/mhi_wwan_mbim.c` and `drivers/net/wwan/t7xx/t7xx_netdev.c`. Immediately, I need to understand what these drivers do. I know `mhi_wwan_mbim.c` is the MHI WWAN MBIM driver, dealing with MHI (Mobile Host Interface) connections and MBIM (Mobile Broadband Interface Model) communication, and `t7xx_netdev.c` is the MediaTek PCIe 5G WWAN modem driver for the t7xx chipset. Now, the real question is how these drivers are configured and whether there are any accessibility issues. I need to understand their Kconfig options and overall build process. Are there any conditions that will prevent me from using these drivers in my tests? This means digging into the relevant `Kconfig` files – specifically `drivers/net/wwan/Kconfig` and `drivers/net/wwan/t7xx/Kconfig` – as well as the accompanying `Makefile`s. This will tell me if they are reachable in virtualized environments like QEMU or syzkaller. Ultimately, I need to know if I can reliably test this patch.
4/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "WWAN", "PathPrefix": "drivers/net/wwan" } Results: { "Output": "\nFull output is too long, showing 500 out of 836 lines.\nUse more precise expression if possible.\n\ndrivers/net/wwan/Kconfig=6=menu \"Wireless WAN\"\ndrivers/net/wwan/Kconfig-7-\ndrivers/net/wwan/Kconfig:8:config WWAN\ndrivers/net/wwan/Kconfig:9:\ttristate \"WWAN Driver Core\"\ndrivers/net/wwan/Kconfig-10-\tdepends on GNSS \|\| GNSS = n\ndrivers/net/wwan/Kconfig-11-\thelp\ndrivers/net/wwan/Kconfig:12:\t Say Y here if you want to use the WWAN driver core. This driver\ndrivers/net/wwan/Kconfig:13:\t provides a common framework for WWAN drivers.\ndrivers/net/wwan/Kconfig-14-\n--\ndrivers/net/wwan/Kconfig-17-\ndrivers/net/wwan/Kconfig:18:if WWAN\ndrivers/net/wwan/Kconfig-19-\ndrivers/net/wwan/Kconfig:20:config WWAN_DEBUGFS\ndrivers/net/wwan/Kconfig:21:\tbool \"WWAN devices debugfs interface\" if EXPERT\ndrivers/net/wwan/Kconfig-22-\tdepends on DEBUG_FS\n--\ndrivers/net/wwan/Kconfig-24-\thelp\ndrivers/net/wwan/Kconfig:25:\t Enables debugfs infrastructure for the WWAN core and device drivers.\ndrivers/net/wwan/Kconfig-26-\ndrivers/net/wwan/Kconfig-27-\t If this option is selected, then you can find the debug interface\ndrivers/net/wwan/Kconfig:28:\t elements for each WWAN device in a directory that is corresponding to\ndrivers/net/wwan/Kconfig-29-\t the device name: debugfs/wwan/wwanX.\ndrivers/net/wwan/Kconfig-30-\ndrivers/net/wwan/Kconfig:31:config WWAN_HWSIM\ndrivers/net/wwan/Kconfig:32:\ttristate \"Simulated WWAN device\"\ndrivers/net/wwan/Kconfig-33-\thelp\ndrivers/net/wwan/Kconfig:34:\t This driver is a developer testing tool that can be used to test WWAN\ndrivers/net/wwan/Kconfig-35-\t framework.\n--\ndrivers/net/wwan/Kconfig-39-\ndrivers/net/wwan/Kconfig:40:config MHI_WWAN_CTRL\ndrivers/net/wwan/Kconfig:41:\ttristate \"MHI WWAN control driver for Qualcomm-based PCIe modems\"\ndrivers/net/wwan/Kconfig-42-\tdepends on MHI_BUS\ndrivers/net/wwan/Kconfig-43-\thelp\ndrivers/net/wwan/Kconfig:44:\t MHI WWAN CTRL allows QCOM-based PCIe modems to expose different modem\ndrivers/net/wwan/Kconfig-45-\t control protocols/ports to userspace, including AT, MBIM, QMI, DIAG\n--\ndrivers/net/wwan/Kconfig-52-\ndrivers/net/wwan/Kconfig:53:config MHI_WWAN_MBIM\ndrivers/net/wwan/Kconfig:54: tristate \"MHI WWAN MBIM network driver for Qualcomm-based PCIe modems\"\ndrivers/net/wwan/Kconfig-55- depends on MHI_BUS\ndrivers/net/wwan/Kconfig-56- help\ndrivers/net/wwan/Kconfig:57: MHI WWAN MBIM is a WWAN network driver for QCOM-based PCIe modems.\ndrivers/net/wwan/Kconfig-58- It implements MBIM over MHI, for IP data aggregation and muxing.\n--\ndrivers/net/wwan/Kconfig=65=config QCOM_BAM_DMUX\ndrivers/net/wwan/Kconfig:66:\ttristate \"Qualcomm BAM-DMUX WWAN network driver\"\ndrivers/net/wwan/Kconfig-67-\tdepends on (DMA_ENGINE \u0026\u0026 PM \u0026\u0026 QCOM_SMEM_STATE) \|\| COMPILE_TEST\n--\ndrivers/net/wwan/Kconfig-71-\t MSM8916 or MSM8974. The connection can be established via QMI/AT from\ndrivers/net/wwan/Kconfig:72:\t userspace with control ports available through the WWAN subsystem\ndrivers/net/wwan/Kconfig:73:\t (CONFIG_RPMSG_WWAN_CTRL) or QRTR network sockets (CONFIG_QRTR).\ndrivers/net/wwan/Kconfig-74-\n--\ndrivers/net/wwan/Kconfig-77-\ndrivers/net/wwan/Kconfig:78:config RPMSG_WWAN_CTRL\ndrivers/net/wwan/Kconfig:79:\ttristate \"RPMSG WWAN control driver\"\ndrivers/net/wwan/Kconfig-80-\tdepends on RPMSG\ndrivers/net/wwan/Kconfig-81-\thelp\ndrivers/net/wwan/Kconfig:82:\t RPMSG WWAN CTRL allows modems available via RPMSG channels to expose\ndrivers/net/wwan/Kconfig-83-\t different modem protocols/ports to userspace, including AT and QMI.\n--\ndrivers/net/wwan/Kconfig=96=config IOSM\ndrivers/net/wwan/Kconfig:97:\ttristate \"IOSM Driver for Intel M.2 WWAN Device\"\ndrivers/net/wwan/Kconfig-98-\tdepends on PCI\ndrivers/net/wwan/Kconfig-99-\tselect NET_DEVLINK\ndrivers/net/wwan/Kconfig:100:\tselect RELAY if WWAN_DEBUGFS\ndrivers/net/wwan/Kconfig-101-\thelp\ndrivers/net/wwan/Kconfig:102:\t This driver enables Intel M.2 WWAN Device communication.\ndrivers/net/wwan/Kconfig-103-\ndrivers/net/wwan/Kconfig:104:\t If you have one of those Intel M.2 WWAN Modules and wish to use it in\ndrivers/net/wwan/Kconfig-105-\t Linux say Y/M here.\n--\ndrivers/net/wwan/Kconfig=109=config MTK_T7XX\ndrivers/net/wwan/Kconfig:110:\ttristate \"MediaTek PCIe 5G WWAN modem T7xx device\"\ndrivers/net/wwan/Kconfig-111-\tdepends on PCI\ndrivers/net/wwan/Kconfig:112:\tselect RELAY if WWAN_DEBUGFS\ndrivers/net/wwan/Kconfig-113-\thelp\ndrivers/net/wwan/Kconfig:114:\t Enables MediaTek PCIe based 5G WWAN modem (T7xx series) device.\ndrivers/net/wwan/Kconfig:115:\t Adapts WWAN framework and provides network interface like wwan0\ndrivers/net/wwan/Kconfig-116-\t and tty interfaces like wwan0at0 (AT protocol), wwan0mbim0\n--\ndrivers/net/wwan/Kconfig-123-\ndrivers/net/wwan/Kconfig:124:endif # WWAN\ndrivers/net/wwan/Kconfig-125-\n--\ndrivers/net/wwan/Makefile-2-#\ndrivers/net/wwan/Makefile:3:# Makefile for the Linux WWAN device drivers.\ndrivers/net/wwan/Makefile-4-#\ndrivers/net/wwan/Makefile-5-\ndrivers/net/wwan/Makefile:6:obj-$(CONFIG_WWAN) += wwan.o\ndrivers/net/wwan/Makefile-7-wwan-objs += wwan_core.o\ndrivers/net/wwan/Makefile-8-\ndrivers/net/wwan/Makefile:9:obj-$(CONFIG_WWAN_HWSIM) += wwan_hwsim.o\ndrivers/net/wwan/Makefile-10-\ndrivers/net/wwan/Makefile:11:obj-$(CONFIG_MHI_WWAN_CTRL) += mhi_wwan_ctrl.o\ndrivers/net/wwan/Makefile:12:obj-$(CONFIG_MHI_WWAN_MBIM) += mhi_wwan_mbim.o\ndrivers/net/wwan/Makefile-13-obj-$(CONFIG_QCOM_BAM_DMUX) += qcom_bam_dmux.o\ndrivers/net/wwan/Makefile:14:obj-$(CONFIG_RPMSG_WWAN_CTRL) += rpmsg_wwan_ctrl.o\ndrivers/net/wwan/Makefile-15-obj-$(CONFIG_IOSM) += iosm/\n--\ndrivers/net/wwan/iosm/Makefile=6=iosm-y = \\\n--\ndrivers/net/wwan/iosm/Makefile-25-\ndrivers/net/wwan/iosm/Makefile:26:iosm-$(CONFIG_WWAN_DEBUGFS) += \\\ndrivers/net/wwan/iosm/Makefile-27-\tiosm_ipc_debugfs.o\t\t\\\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c=34=static struct ipc_chnl_cfg modem_cfg[] = {\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-37-\t IPC_MEM_MAX_TDS_MUX_LITE_UL, IPC_MEM_MAX_TDS_MUX_LITE_DL,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:38:\t IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE, WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-39-\t/* RPC - 0 /\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-41-\t IPC_MEM_MAX_TDS_RPC, IPC_MEM_MAX_TDS_RPC,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:42:\t IPC_MEM_MAX_DL_RPC_BUF_SIZE, WWAN_PORT_XMMRPC },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-43-\t/ IAT0 /\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-45-\t IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_DL_AT_BUF_SIZE,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:46:\t WWAN_PORT_AT },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-47-\t/ Trace /\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-49-\t IPC_MEM_TDS_TRC, IPC_MEM_TDS_TRC, IPC_MEM_MAX_DL_TRC_BUF_SIZE,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:50:\t WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-51-\t/ IAT1 /\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-53-\t IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_DL_AT_BUF_SIZE,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:54:\t WWAN_PORT_AT },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-55-\t/ Loopback /\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-57-\t IPC_MEM_MAX_TDS_LOOPBACK, IPC_MEM_MAX_TDS_LOOPBACK,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:58:\t IPC_MEM_MAX_DL_LOOPBACK_SIZE, WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-59-\t/ MBIM Channel /\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-61-\t IPC_MEM_MAX_TDS_MBIM, IPC_MEM_MAX_TDS_MBIM,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:62:\t IPC_MEM_MAX_DL_MBIM_BUF_SIZE, WWAN_PORT_MBIM },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-63-\t/ Flash Channel/Coredump Channel /\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-65-\t IPC_MEM_MAX_TDS_FLASH_UL, IPC_MEM_MAX_TDS_FLASH_DL,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:66:\t IPC_MEM_MAX_DL_FLASH_BUF_SIZE, WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-67-};\n--\ndrivers/net/wwan/iosm/iosm_ipc_debugfs.h-8-\ndrivers/net/wwan/iosm/iosm_ipc_debugfs.h:9:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_debugfs.h-10-void ipc_debugfs_init(struct iosm_imem ipc_imem);\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=17=static int ipc_imem_check_wwan_ips(struct ipc_mem_channel chnl)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-19-\tif (chnl)\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:20:\t\treturn chnl-\u003ectype == IPC_CTYPE_WWAN \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-21-\t\t chnl-\u003eif_id == IPC_MEM_MUX_IP_CH_IF_ID;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=298=static void ipc_imem_dl_skb_process(struct iosm_imem ipc_imem,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-322-\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:323:\tcase IPC_CTYPE_WWAN:\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-324-\t\tif (pipe-\u003echannel-\u003eif_id == IPC_MEM_MUX_IP_CH_IF_ID)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=562=static void ipc_imem_run_state_worker(struct work_struct instance)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-599-\t\t\tif (ipc_imem-\u003epcie-\u003epci-\u003edevice == INTEL_CP_DEVICE_7560_ID \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:600:\t\t\t chnl_cfg_port.wwan_port_type == WWAN_PORT_XMMRPC) {\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-601-\t\t\t\tctrl_chl_idx++;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-605-\t\t\tif (ipc_imem-\u003epcie-\u003epci-\u003edevice == INTEL_CP_DEVICE_7360_ID \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:606:\t\t\t chnl_cfg_port.wwan_port_type == WWAN_PORT_MBIM) {\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-607-\t\t\t\tctrl_chl_idx++;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-609-\t\t\t}\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:610:\t\t\tif (chnl_cfg_port.wwan_port_type != WWAN_PORT_UNKNOWN) {\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-611-\t\t\t\tipc_imem_channel_init(ipc_imem, IPC_CTYPE_CTRL,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=1060=int ipc_imem_channel_alloc(struct iosm_imem ipc_imem, int index,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-1084-\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:1085:\tif (channel-\u003ectype == IPC_CTYPE_WWAN \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-1086-\t index == IPC_MEM_MUX_IP_CH_IF_ID)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=136=enum ipc_channel_state {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-145- \t\t /IP traffic.\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:146: @IPC_CTYPE_WWAN:\t\tUsed for IP traffic\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-147- * @IPC_CTYPE_CTRL:\t\tUsed for Control Communication\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=149=enum ipc_ctype {\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:150:\tIPC_CTYPE_WWAN,\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-151-\tIPC_CTYPE_CTRL,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=273=enum ipc_phase {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-289- * @ipc_task:\t\t\tTask for entry into ipc task queue\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:290: * @wwan:\t\t\tWWAN device pointer\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-291- * @mux:\t\t\tIP Data multiplexing state.\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-330- * @pcie_wake_n:\t\tPcie wake flag\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:331: * @debugfs_wwan_dir:\t\tWWAN Debug FS directory entry\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-332- * @debugfs_dir:\t\tDebug FS directory for driver-specific entries\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=334=struct iosm_imem {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-341-\tstruct iosm_pcie pcie;\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:342:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-343-\tstruct iosm_trace trace;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-373-\t pcie_wake_n:1;\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:374:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-375-\tstruct dentry debugfs_wwan_dir;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c=80=int ipc_imem_wwan_channel_init(struct iosm_imem ipc_imem,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-86-\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c:87:\t/* If modem version is invalid (0xffffffff), do not initialize WWAN. /\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-88-\tif (ipc_imem-\u003ecp_version == -1) {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-101-\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c:102:\tipc_imem_channel_init(ipc_imem, IPC_CTYPE_WWAN, chnl_cfg,\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-103-\t\t\t IRQ_MOD_OFF);\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-104-\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c:105:\t/ WWAN registration. /\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-106-\tipc_imem-\u003ewwan = ipc_wwan_init(ipc_imem, ipc_imem-\u003edev);\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h=87=int ipc_imem_sys_wwan_transmit(struct iosm_imem ipc_imem, int if_id,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h-89-/*\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h:90: ipc_imem_wwan_channel_init - Initializes WWAN channels and the channel for\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h-91- \t\t\t\tMUX.\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c=9=static int ipc_mux_channel_create(struct iosm_mux ipc_mux)\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-13-\tchannel_id = ipc_imem_channel_alloc(ipc_mux-\u003eimem, ipc_mux-\u003einstance_id,\ndrivers/net/wwan/iosm/iosm_ipc_mux.c:14:\t\t\t\t\t IPC_CTYPE_WWAN);\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-15-\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c=424=int ipc_mux_open_session(struct iosm_mux ipc_mux, int session_nr)\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-432-\tsession_open-\u003eif_id = cpu_to_le32(session_nr);\ndrivers/net/wwan/iosm/iosm_ipc_mux.c:433:\tipc_mux-\u003esession[session_nr].flags \|= IPC_MEM_WWAN_MUX;\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-434-\treturn ipc_mux_schedule(ipc_mux, \u0026mux_msg);\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c=437=int ipc_mux_close_session(struct iosm_mux ipc_mux, int session_nr)\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-447-\tret_val = ipc_mux_schedule(ipc_mux, \u0026mux_msg);\ndrivers/net/wwan/iosm/iosm_ipc_mux.c:448:\tipc_mux-\u003esession[session_nr].flags \u0026= ~IPC_MEM_WWAN_MUX;\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-449-\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.h-58-/* MUX for route link devices /\ndrivers/net/wwan/iosm/iosm_ipc_mux.h:59:#define IPC_MEM_WWAN_MUX BIT(0)\ndrivers/net/wwan/iosm/iosm_ipc_mux.h-60-\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c=17=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-18-\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c:19:/ WWAN GUID /\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-20-static guid_t wwan_acpi_guid = GUID_INIT(0xbad01b75, 0x22a8, 0x4f48, 0x87, 0x92,\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c=220=static void ipc_pcie_config_init(struct iosm_pcie ipc_pcie)\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-231-\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c:232:/* This will read the BIOS WWAN RTD3 settings:\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-233- * D0L1.2/D3L2/Disabled\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c=260=static int ipc_pcie_probe(struct pci_dev pci,\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-305-\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c:306:\t/ Read WWAN RTD3 BIOS Setting\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-307-\t /\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h=39=enum ipc_pcie_sleep_state {\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h-61- @suspend:\t\t\tS2IDLE sleep/active\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h:62: * @d3l2_support:\t\tRead WWAN RTD3 BIOS setting for D3L2 support\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h-63- /\n--\ndrivers/net/wwan/iosm/iosm_ipc_port.h-18- @pcie:\t\tPCIe component\ndrivers/net/wwan/iosm/iosm_ipc_port.h:19: * @port_type:\t\tWWAN port type\ndrivers/net/wwan/iosm/iosm_ipc_port.h-20- * @channel:\t\tChannel instance\n--\ndrivers/net/wwan/iosm/iosm_ipc_trace.h=37=struct iosm_trace {\n--\ndrivers/net/wwan/iosm/iosm_ipc_trace.h-47-\ndrivers/net/wwan/iosm/iosm_ipc_trace.h:48:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_trace.h-49-\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-21-/*\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c:22: struct iosm_netdev_priv - netdev WWAN driver specific private data\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-23- * @ipc_wwan:\tPointer to iosm_wwan struct\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c=28=struct iosm_netdev_priv {\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-35-/*\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c:36: struct iosm_wwan - This structure contains information about WWAN root device\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-37- \t\t and interface to the IPC layer.\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c=289=struct iosm_wwan ipc_wwan_init(struct iosm_imem ipc_imem, struct device dev)\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-299-\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c:300:\t/* WWAN core will create a netdev for the default IP MUX channel /\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-301-\tif (wwan_register_ops(ipc_wwan-\u003edev, \u0026iosm_wwan_ops, ipc_wwan,\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-5-\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:6:#ifndef IOSM_IPC_WWAN_H\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:7:#define IOSM_IPC_WWAN_H\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-8-\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-9-/\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:10: ipc_wwan_init - Allocate, Init and register WWAN device\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-11- * @ipc_imem:\t\tPointer to imem data-struct\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h=16=struct iosm_wwan ipc_wwan_init(struct iosm_imem ipc_imem, struct device dev);\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-18-/\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:19: ipc_wwan_deinit - Unregister and free WWAN device, clear pointer\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-20- * @ipc_wwan:\tPointer to wwan instance data\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=9=enum mhi_wwan_flags {\ndrivers/net/wwan/mhi_wwan_ctrl.c:10:\tMHI_WWAN_DL_CAP,\ndrivers/net/wwan/mhi_wwan_ctrl.c:11:\tMHI_WWAN_UL_CAP,\ndrivers/net/wwan/mhi_wwan_ctrl.c:12:\tMHI_WWAN_RX_REFILL,\ndrivers/net/wwan/mhi_wwan_ctrl.c-13-};\ndrivers/net/wwan/mhi_wwan_ctrl.c-14-\ndrivers/net/wwan/mhi_wwan_ctrl.c:15:#define MHI_WWAN_MAX_MTU\t0x8000\ndrivers/net/wwan/mhi_wwan_ctrl.c-16-\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=41=static void mhi_wwan_rx_budget_inc(struct mhi_wwan_dev mhiwwan)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-46-\ndrivers/net/wwan/mhi_wwan_ctrl.c:47:\tif (test_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags))\ndrivers/net/wwan/mhi_wwan_ctrl.c-48-\t\tschedule_work(\u0026mhiwwan-\u003erx_refill);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=54=static bool mhi_wwan_rx_budget_dec(struct mhi_wwan_dev mhiwwan)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-61-\t\tmhiwwan-\u003erx_budget--;\ndrivers/net/wwan/mhi_wwan_ctrl.c:62:\t\tif (test_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags))\ndrivers/net/wwan/mhi_wwan_ctrl.c-63-\t\t\tret = true;\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=77=static void mhi_wwan_ctrl_refill_work(struct work_struct work)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-91-\t\t/ To prevent unlimited buffer allocation if nothing consumes\ndrivers/net/wwan/mhi_wwan_ctrl.c:92:\t\t * the RX buffers (passed to WWAN core), track their lifespan\ndrivers/net/wwan/mhi_wwan_ctrl.c-93-\t\t * to not allocate more than allowed budget.\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=106=static int mhi_wwan_ctrl_start(struct wwan_port port)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-119-\t/ Add buffers to the MHI inbound queue /\ndrivers/net/wwan/mhi_wwan_ctrl.c:120:\tif (test_bit(MHI_WWAN_DL_CAP, \u0026mhiwwan-\u003eflags)) {\ndrivers/net/wwan/mhi_wwan_ctrl.c:121:\t\tset_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-122-\t\tmhi_wwan_ctrl_refill_work(\u0026mhiwwan-\u003erx_refill);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=128=static void mhi_wwan_ctrl_stop(struct wwan_port port)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-132-\tspin_lock_bh(\u0026mhiwwan-\u003erx_lock);\ndrivers/net/wwan/mhi_wwan_ctrl.c:133:\tclear_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-134-\tspin_unlock_bh(\u0026mhiwwan-\u003erx_lock);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=141=static int mhi_wwan_ctrl_tx(struct wwan_port port, struct sk_buff skb)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-148-\ndrivers/net/wwan/mhi_wwan_ctrl.c:149:\tif (!test_bit(MHI_WWAN_UL_CAP, \u0026mhiwwan-\u003eflags))\ndrivers/net/wwan/mhi_wwan_ctrl.c-150-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=213=static int mhi_wwan_ctrl_probe(struct mhi_device mhi_dev,\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-224-\tmhiwwan-\u003emhi_dev = mhi_dev;\ndrivers/net/wwan/mhi_wwan_ctrl.c:225:\tmhiwwan-\u003emtu = MHI_WWAN_MAX_MTU;\ndrivers/net/wwan/mhi_wwan_ctrl.c-226-\tINIT_WORK(\u0026mhiwwan-\u003erx_refill, mhi_wwan_ctrl_refill_work);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-230-\tif (mhi_dev-\u003edl_chan)\ndrivers/net/wwan/mhi_wwan_ctrl.c:231:\t\tset_bit(MHI_WWAN_DL_CAP, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-232-\tif (mhi_dev-\u003eul_chan)\ndrivers/net/wwan/mhi_wwan_ctrl.c:233:\t\tset_bit(MHI_WWAN_UL_CAP, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-234-\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=258=static const struct mhi_device_id mhi_wwan_ctrl_match_table[] = {\ndrivers/net/wwan/mhi_wwan_ctrl.c:259:\t{ .chan = \"DUN\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/mhi_wwan_ctrl.c:260:\t{ .chan = \"DUN2\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/mhi_wwan_ctrl.c:261:\t{ .chan = \"MBIM\", .driver_data = WWAN_PORT_MBIM },\ndrivers/net/wwan/mhi_wwan_ctrl.c:262:\t{ .chan = \"QMI\", .driver_data = WWAN_PORT_QMI },\ndrivers/net/wwan/mhi_wwan_ctrl.c:263:\t{ .chan = \"DIAG\", .driver_data = WWAN_PORT_QCDM },\ndrivers/net/wwan/mhi_wwan_ctrl.c:264:\t{ .chan = \"FIREHOSE\", .driver_data = WWAN_PORT_FIREHOSE },\ndrivers/net/wwan/mhi_wwan_ctrl.c:265:\t{ .chan = \"NMEA\", .driver_data = WWAN_PORT_NMEA },\ndrivers/net/wwan/mhi_wwan_ctrl.c-266-\t{},\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=283=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/mhi_wwan_ctrl.c:284:MODULE_DESCRIPTION(\"MHI WWAN CTRL Driver\");\ndrivers/net/wwan/mhi_wwan_ctrl.c-285-MODULE_AUTHOR(\"Loic Poulain \u003cloic.poulain@linaro.org\u003e\");\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=620=static int mhi_mbim_probe(struct mhi_device mhi_dev, const struct mhi_device_id id)\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-644-\ndrivers/net/wwan/mhi_wwan_mbim.c:645:\t/ Register wwan link ops with MHI controller representing WWAN instance /\ndrivers/net/wwan/mhi_wwan_mbim.c-646-\treturn wwan_register_ops(\u0026cntrl-\u003emhi_dev-\u003edev, \u0026mhi_mbim_wwan_ops, mbim, 0);\n--\ndrivers/net/wwan/qcom_bam_dmux.c-2-/\ndrivers/net/wwan/qcom_bam_dmux.c:3: * Qualcomm BAM-DMUX WWAN network driver\ndrivers/net/wwan/qcom_bam_dmux.c-4- * Copyright (c) 2020, Stephan Gerhold \u003cstephan@gerhold.net\u003e\n--\ndrivers/net/wwan/qcom_bam_dmux.c=905=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/qcom_bam_dmux.c:906:MODULE_DESCRIPTION(\"Qualcomm BAM-DMUX WWAN Network Driver\");\ndrivers/net/wwan/qcom_bam_dmux.c-907-MODULE_AUTHOR(\"Stephan Gerhold \u003cstephan@gerhold.net\u003e\");\n--\ndrivers/net/wwan/rpmsg_wwan_ctrl.c=98=static struct device rpmsg_wwan_find_parent(struct device dev)\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-99-{\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:100:\t/* Select first platform device as parent for the WWAN ports.\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-101-\t * On Qualcomm platforms this is usually the platform device that\n--\ndrivers/net/wwan/rpmsg_wwan_ctrl.c=147=static const struct rpmsg_device_id rpmsg_wwan_ctrl_id_table[] = {\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-148-\t/* RPMSG channels for Qualcomm SoCs with integrated modem /\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:149:\t{ .name = \"DATA5_CNTL\", .driver_data = WWAN_PORT_QMI },\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:150:\t{ .name = \"DATA4\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:151:\t{ .name = \"DATA1\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-152-\t{},\n--\ndrivers/net/wwan/rpmsg_wwan_ctrl.c=164=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:165:MODULE_DESCRIPTION(\"RPMSG WWAN CTRL Driver\");\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-166-MODULE_AUTHOR(\"Stephan Gerhold \u003cstephan@gerhold.net\u003e\");\n--\ndrivers/net/wwan/t7xx/Makefile=4=mtk_t7xx-y:=\tt7xx_pci.o \\\n--\ndrivers/net/wwan/t7xx/Makefile-19-\ndrivers/net/wwan/t7xx/Makefile:20:mtk_t7xx-$(CONFIG_WWAN_DEBUGFS) += \\\ndrivers/net/wwan/t7xx/Makefile-21-\t\tt7xx_port_trace.o \\\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c=338=static int t7xx_ccmni_register_wwan(struct t7xx_ccmni_ctrl ctlb)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c-345-\ndrivers/net/wwan/t7xx/t7xx_netdev.c:346:\t/* WWAN core will create a netdev for the default IP MUX channel /\ndrivers/net/wwan/t7xx/t7xx_netdev.c-347-\tret = wwan_register_ops(dev, \u0026ccmni_wwan_ops, ctlb, IP_MUX_SESSION_DEFAULT);\ndrivers/net/wwan/t7xx/t7xx_netdev.c-348-\tif (ret \u003c 0) {\ndrivers/net/wwan/t7xx/t7xx_netdev.c:349:\t\tdev_err(dev, \"Unable to register WWAN ops, %d\\n\", ret);\ndrivers/net/wwan/t7xx/t7xx_netdev.c-350-\t\treturn ret;\n--\ndrivers/net/wwan/t7xx/t7xx_pci.c=962=MODULE_AUTHOR(\"MediaTek Inc\");\ndrivers/net/wwan/t7xx/t7xx_pci.c:963:MODULE_DESCRIPTION(\"MediaTek PCIe 5G WWAN modem T7xx driver\");\ndrivers/net/wwan/t7xx/t7xx_pci.c-964-MODULE_LICENSE(\"GPL\");\n--\ndrivers/net/wwan/t7xx/t7xx_pci.h=74=struct t7xx_pci_dev {\n--\ndrivers/net/wwan/t7xx/t7xx_pci.h-92-\tstruct completion\tsleep_lock_acquire;\ndrivers/net/wwan/t7xx/t7xx_pci.h:93:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/t7xx/t7xx_pci.h-94-\tstruct dentry\t\tdebugfs_dir;\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c=55=static const struct t7xx_port_conf t7xx_port_conf[] = {\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-65-\t\t.name = \"AT\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:66:\t\t.port_type = WWAN_PORT_AT,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-67-\t}, {\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-74-\t\t.name = \"MBIM\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:75:\t\t.port_type = WWAN_PORT_MBIM,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-76-\t}, {\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:77:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-78-\t\t.tx_ch = PORT_CH_MD_LOG_TX,\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-111-\t\t.name = \"adb\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:112:\t\t.port_type = WWAN_PORT_ADB,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-113-\t\t.debug = true,\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-121-\t\t.name = \"mipc\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:122:\t\t.port_type = WWAN_PORT_MIPC,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-123-\t\t.debug = true,\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c=127=static const struct t7xx_port_conf t7xx_early_port_conf[] = {\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-137-\t\t.name = \"fastboot\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:138:\t\t.port_type = WWAN_PORT_FASTBOOT,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-139-\t},\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h=95=extern struct port_ops ctl_port_ops;\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h-96-\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h:97:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h-98-extern struct port_ops t7xx_trace_port_ops;\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=130=static int t7xx_port_wwan_tx(struct wwan_port port, struct sk_buff skb)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-138-\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:139:\tif (port_conf-\u003eport_type != WWAN_PORT_FASTBOOT)\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-140-\t\tret = t7xx_port_ctrl_tx(port_private, skb);\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=153=static void t7xx_port_wwan_create(struct t7xx_port port)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-165-\t\tif (IS_ERR(port-\u003ewwan.wwan_port))\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:166:\t\t\tdev_err(port-\u003edev, \"Unable to create WWAN port %s\", port_conf-\u003ename);\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-167-\t}\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=170=static int t7xx_port_wwan_init(struct t7xx_port port)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-173-\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:174:\tif (port_conf-\u003eport_type == WWAN_PORT_FASTBOOT \|\|\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:175:\t port_conf-\u003eport_type == WWAN_PORT_ADB \|\|\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:176:\t port_conf-\u003eport_type == WWAN_PORT_MIPC)\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-177-\t\tt7xx_port_wwan_create(port);\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=227=static void t7xx_port_wwan_md_state_notify(struct t7xx_port port, unsigned int state)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-230-\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:231:\tif (port_conf-\u003eport_type == WWAN_PORT_FASTBOOT \|\|\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:232:\t port_conf-\u003eport_type == WWAN_PORT_ADB \|\|\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:233:\t port_conf-\u003eport_type == WWAN_PORT_MIPC)\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-234-\t\treturn;\n--\ndrivers/net/wwan/wwan_core.c-1-// SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wwan/wwan_core.c:2:/ WWAN Driver Core\n\n" }
5/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 17555 output: 19 thoughts: 151 Thoughts: Investigating WWAN Driver Dependencies Okay, let's dive in. I need to understand the relationship between these WWAN drivers and the underlying hardware. Specifically, I'm focusing on `drivers/net/wwan/mhi_wwan_mbim.c` and `drivers/net/wwan/t7xx/t7xx_netdev.c`. I know that `mhi_wwan_mbim.c` is related to Qualcomm MHI bus devices based on the naming, but I need to confirm this and understand the hardware it is communicating with. My immediate thought is to check the Kconfig dependencies. `mhi_wwan_mbim.c` has `MHI_WWAN_MBIM`, which in turn depends on `MHI_BUS`. Now, the key question is what is `MHI_BUS`? Is it a physical bus, potentially PCIe, or is it a virtual construct like a simulated bus, or perhaps a USB gadget or some other kind of inter-device communication layer? To figure that out, I'll need to locate `MHI_BUS`'s definition. My guess is it will be in `drivers/bus/mhi/Kconfig` or a similar configuration file. I need to understand what this bus is, as it is the crux of how the driver interfaces with the hardware.
6/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "config MHI_BUS" } Results: { "Output": "drivers/bus/mhi/ep/Kconfig:1:config MHI_BUS_EP\ndrivers/bus/mhi/ep/Kconfig-2-\ttristate \"Modem Host Interface (MHI) bus Endpoint implementation\"\n--\ndrivers/bus/mhi/host/Kconfig-7-\ndrivers/bus/mhi/host/Kconfig:8:config MHI_BUS\ndrivers/bus/mhi/host/Kconfig-9-\ttristate \"Modem Host Interface (MHI) bus\"\n--\ndrivers/bus/mhi/host/Kconfig-15-\ndrivers/bus/mhi/host/Kconfig:16:config MHI_BUS_DEBUG\ndrivers/bus/mhi/host/Kconfig-17-\tbool \"Debugfs support for the MHI bus\"\n--\ndrivers/bus/mhi/host/Kconfig-23-\ndrivers/bus/mhi/host/Kconfig:24:config MHI_BUS_PCI_GENERIC\ndrivers/bus/mhi/host/Kconfig-25-\ttristate \"MHI PCI controller driver\"\n" }
7/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 18290 output: 40 thoughts: 386 Thoughts: My Initial Assessment of the MHI/WWAN Situation Okay, let's break this down. First, `MHI_BUS_EP` is clearly an MHI bus Endpoint implementation, that's straightforward. Now, the interesting part is `MHI_WWAN_MBIM`. I need to figure out how that fits into the picture, so I'll check `mhi_wwan_mbim.c` to see how it's integrated, likely through an `mhi_driver` and `mhi_driver_register`. I'll also want to understand how MHI devices are probed in general. Looking back at the base `MHI_BUS_PCI_GENERIC`, it appears to handle registration of PCI devices, specifically Foxconn, Quectel, and Telit PCIe WWAN modems. Then there is the `MTK_T7XX` driver to consider. It's a PCI driver (`t7xx_pci.c`, `pci_register_driver(&t7xx_pci_driver)`) that has specific MediaTek PCI device IDs (like `PCI_DEVICE_ID_MEDIATEK_MT6855`). Okay, so that's a PCI-based MediaTek solution, likely targeting a specific hardware revision. Hold on, let's not jump to conclusions. I need to keep in mind those crucial instructions, specifically Section 2 regarding structurally unreachable hardware. It highlights that certain drivers, like those for vendor-specific PCIe switches, SmartNICs, or GPUs (e.g., `mlxsw`, `pds_core`, `qed`, `ionic`, `amdgpu`), are unlikely to be instantiated without their associated physical ASIC/PCIe cards in a standard QEMU environment. Now, I need to check if these WWAN drivers (MHI, MTK_T7XX, MHI_WWAN_MBIM) can be instantiated in standard QEMU or via virtual buses (like USB gadget, hwsim, etc.) or if they are vendor-specific PCIe modem drivers. This is the critical question. If they rely on specific hardware, I'm going to have a problem. I might need to look for drivers that work through virtual bus implementations, like `wwan_hwsim`, to provide a path. Let's see if that's even feasible. Let's see if `wwan_hwsim` connects to `mhi_wwan_mbim` or `t7xx`? I'll check `wwan_hwsim.c` for some clues on its internal implementation.
8/2	2026/09/10 04:37	tool	grepper	0m Error: no matches Args: { "Expression": "mhi\|t7xx", "PathPrefix": "drivers/net/wwan/wwan_hwsim.c" } Results: { "error": "no matches" }
9/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 19284 output: 40 thoughts: 20 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Diving into the wwan_hwsim.c Source Alright, let's crack open `drivers/net/wwan/wwan_hwsim.c`. Time to see what kind of shenanigans the hardware simulation is up to. I'm especially curious about the implementation details – how are they abstracting the hardware layer? What's the interface like for emulating WWAN functionality within the kernel? Are they using any clever tricks to handle the complexities of cellular communication? I'll be looking for the core structures, the main entry points, the interrupt handling (if any), and how they're simulating the data transfer process. I want to understand how this code fits into the broader networking stack, and how well it mirrors real-world WWAN behavior. Specifically, I'll be searching for any areas that might have subtle bugs or inefficiencies that could impact testing or development. It would be insightful to review the error handling, too - how robust is the simulation? My focus is on the architecture and design choices here, paying close attention to any areas that might require optimization or further refinement. It's time to become intimately acquainted with the simulated world of WWAN within the kernel.
10/2	2026/09/10 04:37	tool	read-file	0m Args: { "File": "drivers/net/wwan/wwan_hwsim.c", "FirstLine": 1, "LineCount": 80 } Results: { "Contents": " 1:\t// SPDX-License-Identifier: GPL-2.0-only\n 2:\t/\n 3:\t WWAN device simulator for WWAN framework testing.\n 4:\t \n 5:\t Copyright (c) 2021, 2025, Sergey Ryazanov \u003cryazanov.s.a@gmail.com\u003e\n 6:\t /\n 7:\t\n 8:\t#define pr_fmt(fmt) KBUILD_MODNAME \": \" fmt\n 9:\t\n 10:\t#include \u003clinux/kernel.h\u003e\n 11:\t#include \u003clinux/module.h\u003e\n 12:\t#include \u003clinux/slab.h\u003e\n 13:\t#include \u003clinux/device.h\u003e\n 14:\t#include \u003clinux/spinlock.h\u003e\n 15:\t#include \u003clinux/time.h\u003e\n 16:\t#include \u003clinux/list.h\u003e\n 17:\t#include \u003clinux/skbuff.h\u003e\n 18:\t#include \u003clinux/timer.h\u003e\n 19:\t#include \u003clinux/netdevice.h\u003e\n 20:\t#include \u003clinux/wwan.h\u003e\n 21:\t#include \u003clinux/debugfs.h\u003e\n 22:\t#include \u003clinux/workqueue.h\u003e\n 23:\t\n 24:\t#include \u003cnet/arp.h\u003e\n 25:\t\n 26:\tstatic int wwan_hwsim_devsnum = 2;\n 27:\tmodule_param_named(devices, wwan_hwsim_devsnum, int, 0444);\n 28:\tMODULE_PARM_DESC(devices, \"Number of simulated devices\");\n 29:\t\n 30:\tstatic const struct class wwan_hwsim_class = {\n 31:\t\t.name = \"wwan_hwsim\",\n 32:\t};\n 33:\t\n 34:\tstatic struct dentry wwan_hwsim_debugfs_topdir;\n 35:\tstatic struct dentry wwan_hwsim_debugfs_devcreate;\n 36:\t\n 37:\tstatic DEFINE_SPINLOCK(wwan_hwsim_devs_lock);\n 38:\tstatic LIST_HEAD(wwan_hwsim_devs);\n 39:\tstatic unsigned int wwan_hwsim_dev_idx;\n 40:\tstatic struct workqueue_struct wwan_wq;\n 41:\t\n 42:\tstruct wwan_hwsim_dev {\n 43:\t\tstruct list_head list;\n 44:\t\tunsigned int id;\n 45:\t\tstruct device dev;\n 46:\t\tstruct work_struct del_work;\n 47:\t\tstruct dentry debugfs_topdir;\n 48:\t\tstruct dentry debugfs_portcreate;\n 49:\t\tspinlock_t ports_lock;\t/* Serialize ports creation/deletion /\n 50:\t\tunsigned int port_idx;\n 51:\t\tstruct list_head ports;\n 52:\t};\n 53:\t\n 54:\tstruct wwan_hwsim_port {\n 55:\t\tstruct list_head list;\n 56:\t\tunsigned int id;\n 57:\t\tstruct wwan_hwsim_dev dev;\n 58:\t\tstruct wwan_port wwan;\n 59:\t\tstruct work_struct del_work;\n 60:\t\tstruct dentry debugfs_topdir;\n 61:\t\tunion {\n 62:\t\t\tstruct {\n 63:\t\t\t\tenum {\t/* AT command parser state /\n 64:\t\t\t\t\tAT_PARSER_WAIT_A,\n 65:\t\t\t\t\tAT_PARSER_WAIT_T,\n 66:\t\t\t\t\tAT_PARSER_WAIT_TERM,\n 67:\t\t\t\t\tAT_PARSER_SKIP_LINE,\n 68:\t\t\t\t} pstate;\n 69:\t\t\t} at_emul;\n 70:\t\t\tstruct {\n 71:\t\t\t\tstruct timer_list timer;\n 72:\t\t\t} nmea_emul;\n 73:\t\t};\n 74:\t};\n 75:\t\n 76:\tstatic const struct file_operations wwan_hwsim_debugfs_portdestroy_fops;\n 77:\tstatic const struct file_operations wwan_hwsim_debugfs_portcreate_fops;\n 78:\tstatic const struct file_operations wwan_hwsim_debugfs_devdestroy_fops;\n 79:\tstatic void wwan_hwsim_port_del_work(struct work_struct work);\n 80:\tstatic void wwan_hwsim_dev_del_work(struct work_struct *work);\n" }
11/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 20792 output: 19 thoughts: 106 Thoughts: Investigating WWAN Driver Implementations Okay, so it seems `wwan_hwsim` has gone its own way, implementing its own WWAN port operations and network device operations. That's good to know. It means it's not relying on the more generic `mhi_wwan_mbim.c` or `t7xx_netdev.c` drivers. Now, the next logical step is to determine if those files, `mhi_wwan_mbim.c` and `t7xx_netdev.c`, are even needed in other areas of the system. I need to figure out where those specific modules are being used, if at all. My plan is to conduct a thorough search for any remaining references to either `mhi_wwan_mbim` or `t7xx` within the codebase. Hopefully, this will tell us how necessary they actually are.
12/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "mhi_mbim" } Results: { "Output": "drivers/net/wwan/mhi_wwan_mbim.c-45-\ndrivers/net/wwan/mhi_wwan_mbim.c:46:struct mhi_mbim_link {\ndrivers/net/wwan/mhi_wwan_mbim.c:47:\tstruct mhi_mbim_context mbim;\ndrivers/net/wwan/mhi_wwan_mbim.c-48-\tstruct net_device ndev;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-64-\ndrivers/net/wwan/mhi_wwan_mbim.c:65:struct mhi_mbim_context {\ndrivers/net/wwan/mhi_wwan_mbim.c-66-\tstruct mhi_device mdev;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=78=struct mbim_tx_hdr {\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-83-\ndrivers/net/wwan/mhi_wwan_mbim.c:84:static struct mhi_mbim_link mhi_mbim_get_link_rcu(struct mhi_mbim_context mbim,\ndrivers/net/wwan/mhi_wwan_mbim.c-85-\t\t\t\t\t\t unsigned int session)\ndrivers/net/wwan/mhi_wwan_mbim.c-86-{\ndrivers/net/wwan/mhi_wwan_mbim.c:87:\tstruct mhi_mbim_link link;\ndrivers/net/wwan/mhi_wwan_mbim.c-88-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-96-\ndrivers/net/wwan/mhi_wwan_mbim.c:97:static int mhi_mbim_get_link_mux_id(struct mhi_controller cntrl)\ndrivers/net/wwan/mhi_wwan_mbim.c-98-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=107=static struct sk_buff mbim_tx_fixup(struct sk_buff skb, unsigned int session,\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-150-\ndrivers/net/wwan/mhi_wwan_mbim.c:151:static netdev_tx_t mhi_mbim_ndo_xmit(struct sk_buff skb, struct net_device ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-152-{\ndrivers/net/wwan/mhi_wwan_mbim.c:153:\tstruct mhi_mbim_link link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c:154:\tstruct mhi_mbim_context mbim = link-\u003embim;\ndrivers/net/wwan/mhi_wwan_mbim.c-155-\tunsigned long flags;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-192-\ndrivers/net/wwan/mhi_wwan_mbim.c:193:static int mbim_rx_verify_nth16(struct mhi_mbim_context mbim, struct sk_buff skb)\ndrivers/net/wwan/mhi_wwan_mbim.c-194-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=231=static int mbim_rx_verify_ndp16(struct sk_buff skb, struct usb_cdc_ncm_ndp16 ndp16)\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-253-\ndrivers/net/wwan/mhi_wwan_mbim.c:254:static void mhi_mbim_rx(struct mhi_mbim_context mbim, struct sk_buff skb)\ndrivers/net/wwan/mhi_wwan_mbim.c-255-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-276-\t\tstruct usb_cdc_ncm_dpe16 dpe16;\ndrivers/net/wwan/mhi_wwan_mbim.c:277:\t\tstruct mhi_mbim_link link;\ndrivers/net/wwan/mhi_wwan_mbim.c-278-\t\tint nframes, n, dpeoffset;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-304-\ndrivers/net/wwan/mhi_wwan_mbim.c:305:\t\tlink = mhi_mbim_get_link_rcu(mbim, session);\ndrivers/net/wwan/mhi_wwan_mbim.c-306-\t\tif (!link) {\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-378-\ndrivers/net/wwan/mhi_wwan_mbim.c:379:static struct sk_buff mhi_net_skb_agg(struct mhi_mbim_context mbim,\ndrivers/net/wwan/mhi_wwan_mbim.c-380-\t\t\t\t struct sk_buff skb)\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=405=static void mhi_net_rx_refill_work(struct work_struct work)\ndrivers/net/wwan/mhi_wwan_mbim.c-406-{\ndrivers/net/wwan/mhi_wwan_mbim.c:407:\tstruct mhi_mbim_context mbim = container_of(work, struct mhi_mbim_context,\ndrivers/net/wwan/mhi_wwan_mbim.c-408-\t\t\t\t\t\t rx_refill.work);\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-435-\ndrivers/net/wwan/mhi_wwan_mbim.c:436:static void mhi_mbim_dl_callback(struct mhi_device mhi_dev,\ndrivers/net/wwan/mhi_wwan_mbim.c-437-\t\t\t\t struct mhi_result mhi_res)\ndrivers/net/wwan/mhi_wwan_mbim.c-438-{\ndrivers/net/wwan/mhi_wwan_mbim.c:439:\tstruct mhi_mbim_context mbim = dev_get_drvdata(\u0026mhi_dev-\u003edev);\ndrivers/net/wwan/mhi_wwan_mbim.c-440-\tstruct sk_buff skb = mhi_res-\u003ebuf_addr;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-468-\ndrivers/net/wwan/mhi_wwan_mbim.c:469:\t\tmhi_mbim_rx(mbim, skb);\ndrivers/net/wwan/mhi_wwan_mbim.c-470-\t}\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-476-\ndrivers/net/wwan/mhi_wwan_mbim.c:477:static void mhi_mbim_ndo_get_stats64(struct net_device ndev,\ndrivers/net/wwan/mhi_wwan_mbim.c-478-\t\t\t\t struct rtnl_link_stats64 stats)\ndrivers/net/wwan/mhi_wwan_mbim.c-479-{\ndrivers/net/wwan/mhi_wwan_mbim.c:480:\tstruct mhi_mbim_link link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-481-\tunsigned int start;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-498-\ndrivers/net/wwan/mhi_wwan_mbim.c:499:static void mhi_mbim_ul_callback(struct mhi_device mhi_dev,\ndrivers/net/wwan/mhi_wwan_mbim.c-500-\t\t\t\t struct mhi_result mhi_res)\ndrivers/net/wwan/mhi_wwan_mbim.c-501-{\ndrivers/net/wwan/mhi_wwan_mbim.c:502:\tstruct mhi_mbim_context mbim = dev_get_drvdata(\u0026mhi_dev-\u003edev);\ndrivers/net/wwan/mhi_wwan_mbim.c-503-\tstruct sk_buff skb = mhi_res-\u003ebuf_addr;\ndrivers/net/wwan/mhi_wwan_mbim.c-504-\tstruct net_device ndev = skb-\u003edev;\ndrivers/net/wwan/mhi_wwan_mbim.c:505:\tstruct mhi_mbim_link link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-506-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-530-\ndrivers/net/wwan/mhi_wwan_mbim.c:531:static int mhi_mbim_ndo_open(struct net_device ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-532-{\ndrivers/net/wwan/mhi_wwan_mbim.c:533:\tstruct mhi_mbim_link link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-534-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-545-\ndrivers/net/wwan/mhi_wwan_mbim.c:546:static int mhi_mbim_ndo_stop(struct net_device ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-547-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-553-\ndrivers/net/wwan/mhi_wwan_mbim.c:554:static const struct net_device_ops mhi_mbim_ndo = {\ndrivers/net/wwan/mhi_wwan_mbim.c:555:\t.ndo_open = mhi_mbim_ndo_open,\ndrivers/net/wwan/mhi_wwan_mbim.c:556:\t.ndo_stop = mhi_mbim_ndo_stop,\ndrivers/net/wwan/mhi_wwan_mbim.c:557:\t.ndo_start_xmit = mhi_mbim_ndo_xmit,\ndrivers/net/wwan/mhi_wwan_mbim.c:558:\t.ndo_get_stats64 = mhi_mbim_ndo_get_stats64,\ndrivers/net/wwan/mhi_wwan_mbim.c-559-};\ndrivers/net/wwan/mhi_wwan_mbim.c-560-\ndrivers/net/wwan/mhi_wwan_mbim.c:561:static int mhi_mbim_newlink(void ctxt, struct net_device ndev, u32 if_id,\ndrivers/net/wwan/mhi_wwan_mbim.c-562-\t\t\t struct netlink_ext_ack extack)\ndrivers/net/wwan/mhi_wwan_mbim.c-563-{\ndrivers/net/wwan/mhi_wwan_mbim.c:564:\tstruct mhi_mbim_link link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c:565:\tstruct mhi_mbim_context mbim = ctxt;\ndrivers/net/wwan/mhi_wwan_mbim.c-566-\ndrivers/net/wwan/mhi_wwan_mbim.c-567-\tlink-\u003embim = mbim;\ndrivers/net/wwan/mhi_wwan_mbim.c:568:\tlink-\u003esession = mhi_mbim_get_link_mux_id(link-\u003embim-\u003emdev-\u003emhi_cntrl) + if_id;\ndrivers/net/wwan/mhi_wwan_mbim.c-569-\tlink-\u003endev = ndev;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-573-\trcu_read_lock();\ndrivers/net/wwan/mhi_wwan_mbim.c:574:\tif (mhi_mbim_get_link_rcu(mbim, if_id)) {\ndrivers/net/wwan/mhi_wwan_mbim.c-575-\t\trcu_read_unlock();\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-585-\ndrivers/net/wwan/mhi_wwan_mbim.c:586:static void mhi_mbim_dellink(void ctxt, struct net_device ndev,\ndrivers/net/wwan/mhi_wwan_mbim.c-587-\t\t\t struct list_head head)\ndrivers/net/wwan/mhi_wwan_mbim.c-588-{\ndrivers/net/wwan/mhi_wwan_mbim.c:589:\tstruct mhi_mbim_link link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-590-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-596-\ndrivers/net/wwan/mhi_wwan_mbim.c:597:static void mhi_mbim_setup(struct net_device ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-598-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-604-\tndev-\u003eflags = IFF_POINTOPOINT \| IFF_NOARP;\ndrivers/net/wwan/mhi_wwan_mbim.c:605:\tndev-\u003enetdev_ops = \u0026mhi_mbim_ndo;\ndrivers/net/wwan/mhi_wwan_mbim.c-606-\tndev-\u003emtu = MHI_MBIM_DEFAULT_MTU;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-612-\ndrivers/net/wwan/mhi_wwan_mbim.c:613:static const struct wwan_ops mhi_mbim_wwan_ops = {\ndrivers/net/wwan/mhi_wwan_mbim.c:614:\t.priv_size = sizeof(struct mhi_mbim_link),\ndrivers/net/wwan/mhi_wwan_mbim.c:615:\t.setup = mhi_mbim_setup,\ndrivers/net/wwan/mhi_wwan_mbim.c:616:\t.newlink = mhi_mbim_newlink,\ndrivers/net/wwan/mhi_wwan_mbim.c:617:\t.dellink = mhi_mbim_dellink,\ndrivers/net/wwan/mhi_wwan_mbim.c-618-};\ndrivers/net/wwan/mhi_wwan_mbim.c-619-\ndrivers/net/wwan/mhi_wwan_mbim.c:620:static int mhi_mbim_probe(struct mhi_device mhi_dev, const struct mhi_device_id id)\ndrivers/net/wwan/mhi_wwan_mbim.c-621-{\ndrivers/net/wwan/mhi_wwan_mbim.c-622-\tstruct mhi_controller cntrl = mhi_dev-\u003emhi_cntrl;\ndrivers/net/wwan/mhi_wwan_mbim.c:623:\tstruct mhi_mbim_context mbim;\ndrivers/net/wwan/mhi_wwan_mbim.c-624-\tint err;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-645-\t/ Register wwan link ops with MHI controller representing WWAN instance /\ndrivers/net/wwan/mhi_wwan_mbim.c:646:\treturn wwan_register_ops(\u0026cntrl-\u003emhi_dev-\u003edev, \u0026mhi_mbim_wwan_ops, mbim, 0);\ndrivers/net/wwan/mhi_wwan_mbim.c-647-}\ndrivers/net/wwan/mhi_wwan_mbim.c-648-\ndrivers/net/wwan/mhi_wwan_mbim.c:649:static void mhi_mbim_remove(struct mhi_device mhi_dev)\ndrivers/net/wwan/mhi_wwan_mbim.c-650-{\ndrivers/net/wwan/mhi_wwan_mbim.c:651:\tstruct mhi_mbim_context mbim = dev_get_drvdata(\u0026mhi_dev-\u003edev);\ndrivers/net/wwan/mhi_wwan_mbim.c-652-\tstruct mhi_controller cntrl = mhi_dev-\u003emhi_cntrl;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-660-\ndrivers/net/wwan/mhi_wwan_mbim.c:661:static const struct mhi_device_id mhi_mbim_id_table[] = {\ndrivers/net/wwan/mhi_wwan_mbim.c-662-\t/* Hardware accelerated data PATH (to modem IPA), MBIM protocol */\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-665-};\ndrivers/net/wwan/mhi_wwan_mbim.c:666:MODULE_DEVICE_TABLE(mhi, mhi_mbim_id_table);\ndrivers/net/wwan/mhi_wwan_mbim.c-667-\ndrivers/net/wwan/mhi_wwan_mbim.c:668:static struct mhi_driver mhi_mbim_driver = {\ndrivers/net/wwan/mhi_wwan_mbim.c:669:\t.probe = mhi_mbim_probe,\ndrivers/net/wwan/mhi_wwan_mbim.c:670:\t.remove = mhi_mbim_remove,\ndrivers/net/wwan/mhi_wwan_mbim.c:671:\t.dl_xfer_cb = mhi_mbim_dl_callback,\ndrivers/net/wwan/mhi_wwan_mbim.c:672:\t.ul_xfer_cb = mhi_mbim_ul_callback,\ndrivers/net/wwan/mhi_wwan_mbim.c:673:\t.id_table = mhi_mbim_id_table,\ndrivers/net/wwan/mhi_wwan_mbim.c-674-\t.driver = {\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-678-\ndrivers/net/wwan/mhi_wwan_mbim.c:679:module_mhi_driver(mhi_mbim_driver);\ndrivers/net/wwan/mhi_wwan_mbim.c-680-\n" }
13/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 26197 output: 42 thoughts: 17 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Investigating Network Device Driver Behavior Okay, so we're seeing something unusual in the network behavior. My first instinct, considering the potential points of failure, is to cast a wider net. I'm going to take a look at `t7xx_netdev.c` as well. This driver seems to be a key component and could very well be the root cause, or at least be involved in the cascade of issues we are currently seeing. It's time to dive into that specific module and start examining its functions and data structures. Let's see if we can identify any clues in its handling of packet transmission or reception, interrupt management, or resource allocation. We'll start with the obvious suspect areas and then dig deeper if needed.
14/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "t7xx_ccmni_recv_skb", "PathPrefix": "drivers/net/wwan/t7xx" } Results: { "Output": "drivers/net/wwan/t7xx/t7xx_netdev.c=399=static void init_md_status_notifier(struct t7xx_pci_dev t7xx_dev)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c-411-\ndrivers/net/wwan/t7xx/t7xx_netdev.c:412:static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl ccmni_ctlb, struct sk_buff skb,\ndrivers/net/wwan/t7xx/t7xx_netdev.c-413-\t\t\t\tstruct napi_struct napi)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c=490=int t7xx_ccmni_init(struct t7xx_pci_dev *t7xx_dev)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c-502-\tctlb-\u003ecallbacks.state_notify = t7xx_ccmni_queue_state_notify;\ndrivers/net/wwan/t7xx/t7xx_netdev.c:503:\tctlb-\u003ecallbacks.recv_skb = t7xx_ccmni_recv_skb;\ndrivers/net/wwan/t7xx/t7xx_netdev.c-504-\tctlb-\u003enic_dev_num = NIC_DEV_DEFAULT;\n" }
15/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 26816 output: 32 thoughts: 130 Thoughts: Analyzing MHI Drivers for Vulnerability Research Okay, let's dive into these drivers. My immediate question is, are we dealing with drivers specifically tied to physical PCIe hardware, or can I get away with fuzzing these in a standard virtualized environment like QEMU or GCE? That's the first thing I need to establish. Now, let's take a closer look at `MHI_WWAN_MBIM`. Right, MHI stands for Modem Host Interface, a key piece of information. This points to Qualcomm PCIe modems – think Snapdragon X55, X62, X65, the kind that connect over PCIe. Good. That helps narrow the scope considerably. To understand how the MHI controller is probed, I should probably check out `drivers/bus/mhi/host/pci_generic.c`. This is where the rubber meets the road, so to speak. This should give me a good handle on the initialization process.
16/2	2026/09/10 04:37	tool	grepper	0m Error: no matches Args: { "Expression": "pci_register_driver", "PathPrefix": "drivers/bus/mhi" } Results: { "error": "no matches" }
17/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 27198 output: 32 thoughts: 15 Thoughts: Here's my thought process, as if I were considering this driver search: Diving into the MHI Driver Space Okay, so I need to track down some PCI drivers. My first instinct, given what I'm working on, is to look within the `drivers/bus/mhi` directory. That's usually the go-to location for anything related to the Mobile Host Interface (MHI) bus. Considering that I'm looking for PCI drivers, I'm hoping I find some drivers to interface with MHI devices. I'll need to check the typical subdirectories to see if there is any abstraction layers that would be helpful as a starting point. From there, I'll need to dig through the code itself to see what PCI devices are supported and how the driver interacts with the hardware.
18/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "module_pci_driver", "PathPrefix": "drivers/bus/mhi" } Results: { "Output": "drivers/bus/mhi/host/pci_generic.c=1767=static struct pci_driver mhi_pci_driver = {\n--\ndrivers/bus/mhi/host/pci_generic.c-1776-};\ndrivers/bus/mhi/host/pci_generic.c:1777:module_pci_driver(mhi_pci_driver);\ndrivers/bus/mhi/host/pci_generic.c-1778-\n" }
19/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 27550 output: 35 thoughts: 24 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Analyzing `mhi_pci_driver` in `pci_generic.c` Okay, so I'm diving into `pci_generic.c` again. My immediate focus is on how the `mhi_pci_driver` is registered and initialized within this generic PCI framework. What specific functions are being called, and what structures are being populated to make the MHI (presumably Mobile Host Interface) device function correctly within the broader PCI context? I'm particularly interested in how the driver handles resource allocation – are we using standard PCI resource management, or are there custom hooks in place to deal with the MHI's specific memory-mapped I/O or interrupt requirements? Also, how does the driver interact with the PCI bus's configuration space? I want to see if we are dealing with interrupts correctly. Are we using standard PCI interrupt mechanisms, or does the MHI hardware necessitate a more intricate interrupt handling strategy? This will also give me clues on the platform requirements to see if this driver will work on a new target. I also want to see how the probe function is implemented; what does it look for in the device ID table, and how are any platform-specific dependencies handled there? Lastly, I'll be looking for any indications of error handling – how are PCI bus errors, device not present scenarios, or resource allocation failures dealt with within the context of this MHI driver? I should also ensure that the driver complies with the latest PCI specification versions and any relevant platform standards.
20/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "mhi_pci_id_table", "PathPrefix": "drivers/bus/mhi" } Results: { "Output": "drivers/bus/mhi/host/pci_generic.c=941=static const struct mhi_pci_dev_info mhi_netprisma_fcun69_info = {\n--\ndrivers/bus/mhi/host/pci_generic.c-951-/* Keep the list sorted based on the PID. New VID should be added as the last entry */\ndrivers/bus/mhi/host/pci_generic.c:952:static const struct pci_device_id mhi_pci_id_table[] = {\ndrivers/bus/mhi/host/pci_generic.c-953-\t{PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0116),\n--\ndrivers/bus/mhi/host/pci_generic.c-1086-};\ndrivers/bus/mhi/host/pci_generic.c:1087:MODULE_DEVICE_TABLE(pci, mhi_pci_id_table);\ndrivers/bus/mhi/host/pci_generic.c-1088-\n--\ndrivers/bus/mhi/host/pci_generic.c=1767=static struct pci_driver mhi_pci_driver = {\ndrivers/bus/mhi/host/pci_generic.c-1768-\t.name\t\t= \"mhi-pci-generic\",\ndrivers/bus/mhi/host/pci_generic.c:1769:\t.id_table\t= mhi_pci_id_table,\ndrivers/bus/mhi/host/pci_generic.c-1770-\t.probe\t\t= mhi_pci_probe,\n" }
21/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 28365 output: 20 thoughts: 25 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person: Investigating MHI Host Controllers Alright, so we've established the primary MHI host controller situation, but I need to make absolutely sure we haven't overlooked any other potential instances of MHI controller implementation in this system. My immediate concern is that there could be hidden MHI controller configurations: perhaps a virtual or platform-level controller interacting with the hardware, or even an endpoint-specific controller that we haven't identified yet. It's a critical next step. I need to comprehensively verify that our understanding of the MHI architecture is complete. I can't afford to miss any controller in the system. The next step is a deep dive into the firmware and hardware.
22/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "mhi_register_controller" } Results: { "Output": "Documentation/mhi/topology.rst=20=Below are the roles of the MHI controller driver:\n--\nDocumentation/mhi/topology.rst-24-* Allocates struct mhi_controller and registers with the MHI bus framework\nDocumentation/mhi/topology.rst:25: with channel and event configurations using mhi_register_controller.\nDocumentation/mhi/topology.rst-26-* Initiates power on and shutdown sequence\n--\ndrivers/accel/qaic/mhi_controller.c=800=static int mhi_reset_and_async_power_up(struct mhi_controller mhi_cntrl)\n--\ndrivers/accel/qaic/mhi_controller.c-826-\ndrivers/accel/qaic/mhi_controller.c:827:struct mhi_controller qaic_mhi_register_controller(struct pci_dev pci_dev, void __iomem mhi_bar,\ndrivers/accel/qaic/mhi_controller.c-828-\t\t\t\t\t\t int mhi_irq, bool shared_msi, int family)\n--\ndrivers/accel/qaic/mhi_controller.c-875-\tmhi_config.timeout_ms = mhi_timeout_ms;\ndrivers/accel/qaic/mhi_controller.c:876:\tret = mhi_register_controller(mhi_cntrl, \u0026mhi_config);\ndrivers/accel/qaic/mhi_controller.c-877-\tif (ret) {\ndrivers/accel/qaic/mhi_controller.c:878:\t\tpci_err(pci_dev, \"mhi_register_controller failed %d\\n\", ret);\ndrivers/accel/qaic/mhi_controller.c-879-\t\treturn ERR_PTR(ret);\n--\ndrivers/accel/qaic/mhi_controller.h-8-\ndrivers/accel/qaic/mhi_controller.h:9:struct mhi_controller qaic_mhi_register_controller(struct pci_dev pci_dev, void __iomem mhi_bar,\ndrivers/accel/qaic/mhi_controller.h-10-\t\t\t\t\t\t int mhi_irq, bool shared_msi, int family);\n--\ndrivers/accel/qaic/qaic_drv.c=570=static int qaic_pci_probe(struct pci_dev pdev, const struct pci_device_id id)\n--\ndrivers/accel/qaic/qaic_drv.c-596-\ndrivers/accel/qaic/qaic_drv.c:597:\tqdev-\u003emhi_cntrl = qaic_mhi_register_controller(pdev, qdev-\u003ebar_mhi, mhi_irq,\ndrivers/accel/qaic/qaic_drv.c-598-\t\t\t\t\t\t qdev-\u003esingle_msi, config-\u003efamily);\n--\ndrivers/bus/mhi/host/init.c=881=static int parse_config(struct mhi_controller mhi_cntrl,\n--\ndrivers/bus/mhi/host/init.c-918-\ndrivers/bus/mhi/host/init.c:919:int mhi_register_controller(struct mhi_controller mhi_cntrl,\ndrivers/bus/mhi/host/init.c-920-\t\t\t const struct mhi_controller_config config)\n--\ndrivers/bus/mhi/host/init.c-1058-}\ndrivers/bus/mhi/host/init.c:1059:EXPORT_SYMBOL_GPL(mhi_register_controller);\ndrivers/bus/mhi/host/init.c-1060-\n--\ndrivers/bus/mhi/host/pci_generic.c=1365=static int mhi_pci_probe(struct pci_dev pdev, const struct pci_device_id id)\n--\ndrivers/bus/mhi/host/pci_generic.c-1440-\ndrivers/bus/mhi/host/pci_generic.c:1441:\terr = mhi_register_controller(mhi_cntrl, mhi_cntrl_config);\ndrivers/bus/mhi/host/pci_generic.c-1442-\tif (err)\n--\ndrivers/net/wireless/ath/ath11k/mhi.c=335=int ath11k_mhi_register(struct ath11k_pci ab_pci)\n--\ndrivers/net/wireless/ath/ath11k/mhi.c-409-\tab_pci-\u003emhi_pre_cb = MHI_CB_INVALID;\ndrivers/net/wireless/ath/ath11k/mhi.c:410:\tret = mhi_register_controller(mhi_ctrl, ath11k_mhi_config);\ndrivers/net/wireless/ath/ath11k/mhi.c-411-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath12k/mhi.c=187=int ath12k_mhi_register(struct ath12k_pci ab_pci)\n--\ndrivers/net/wireless/ath/ath12k/mhi.c-264-\ndrivers/net/wireless/ath/ath12k/mhi.c:265:\tret = mhi_register_controller(mhi_ctrl, ab-\u003ehw_params-\u003emhi_config);\ndrivers/net/wireless/ath/ath12k/mhi.c-266-\tif (ret) {\n--\ninclude/linux/mhi.h=294=struct mhi_controller_config {\n--\ninclude/linux/mhi.h-385- * Fields marked as (required) need to be populated by the controller driver\ninclude/linux/mhi.h:386: * before calling mhi_register_controller(). For the fields marked as (optional)\ninclude/linux/mhi.h-387- * they can be populated depending on the usecase.\n--\ninclude/linux/mhi.h=550=void mhi_free_controller(struct mhi_controller mhi_cntrl);\n--\ninclude/linux/mhi.h-552-/\ninclude/linux/mhi.h:553: mhi_register_controller - Register MHI controller\ninclude/linux/mhi.h-554- * @mhi_cntrl: MHI controller to register\n--\ninclude/linux/mhi.h-556- /\ninclude/linux/mhi.h:557:int mhi_register_controller(struct mhi_controller mhi_cntrl,\ninclude/linux/mhi.h-558-\t\t\tconst struct mhi_controller_config *config);\n" }
23/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 30286 output: 34 thoughts: 630 Thoughts: Assessing the Fuzzability of WWAN Modem Drivers Okay, let's break this down. My goal is to determine if we can effectively fuzz either the `mhi_wwan_mbim` or `t7xx_netdev` drivers. Both are hardware drivers for physical PCIe WWAN modems, which immediately raises a flag. We need to be able to reach them without actual hardware. First, let's review the drivers themselves: `mhi_wwan_mbim.c` handles Qualcomm PCIe modems, and `t7xx_netdev.c` deals with MediaTek T7xx devices, both of which require their respective physical PCI modems. The critical question now becomes, can we trigger these drivers in an emulated environment, or are they inherently tied to the presence of physical hardware? Specifically, are these devices "structurally unreachable" according to the defined criteria, meaning they need real hardware not emulated by standard QEMU? That's the key. Let's look at `mhi_wwan_mbim.c` first. The `mhi_mbim_probe` function appears to be the entry point. It's triggered when an MHI device matches `mhi_mbim_id_table` on the MHI bus. The MHI bus devices are created by MHI controllers. This seems to happen when the underlying physical PCIe device initializes the MHI channels. Packets are then handled through `mhi_mbim_rx` which itself is called from the MHI core when the transfer has completed from the hardware. It's a chain of events triggered by the PCI modem interacting with the MHI bus. This suggests that the initialization process is tied to the physical hardware. Now, let's examine `t7xx_netdev.c`. The `t7xx_ccmni_recv_skb` function is called when the MTK T7xx PCIe device receives packets from the physical modem. The driver is registered as a PCI driver. This also implies a dependency on the presence of a physical PCI device. I need to check the PCI IDs within `t7xx_pci.c` to understand exactly which hardware the driver is tied to. Based on this preliminary investigation, the initial impression is that both drivers are strongly coupled to their respective physical PCIe modems. Reaching them in an emulated environment may be challenging, and perhaps impossible, as they rely on the MHI bus or PCIe device enumeration and initialization, both of which require interaction with physical hardware. We'll need to carefully investigate the setup process to confirm this.
24/2	2026/09/10 04:37	tool	grepper	0m Args: { "Expression": "PCI_DEVICE.", "PathPrefix": "drivers/net/wwan/t7xx" } Results:* { "Output": "drivers/net/wwan/t7xx/t7xx_pci.c=943=static const struct pci_device_id t7xx_pci_table[] = {\ndrivers/net/wwan/t7xx/t7xx_pci.c:944:\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x4d75) },\ndrivers/net/wwan/t7xx/t7xx_pci.c:945:\t{ PCI_DEVICE(0x03f0, 0x09c8) }, // HP DRMR-H01\ndrivers/net/wwan/t7xx/t7xx_pci.c:946:\t{ PCI_DEVICE(0x14c0, 0x4d75) }, // Dell DW5933e\ndrivers/net/wwan/t7xx/t7xx_pci.c-947-\t{ }\n" }
25/2	2026/09/10 04:37	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 31748 output: 147 thoughts: 585 Thoughts: Analysis of Vendor-Specific PCIe Modem Drivers for Fuzzing Feasibility Okay, let me break this down. My analysis tells me that the proposed patch affects two specific vendor-specific PCIe modem drivers: `mhi_wwan_mbim.c` and `t7xx/t7xx_netdev.c`. Specifically, we're looking at a Qualcomm PCIe modem MBIM network driver utilizing the MHI bus and a MediaTek T7xx series PCIe 5G WWAN modem driver, respectively. The critical point, as I see it, is that neither of these devices, as far as I understand the common practices, can be meaningfully fuzzed within standard QEMU or GCE environments. They require actual physical hardware – a Qualcomm Snapdragon PCIe modem and a MediaTek T7xx PCIe modem, respectively. The commit diff confirms this, showing changes restricted to those two files, nothing else. Therefore, because these drivers are structurally dependent on hardware unavailable in a typical syzkaller testing setup, this falls squarely under Section 2: "Structurally unreachable hardware." We're talking about drivers that demand physical PCIe cards not emulated in standard environments. This essentially classifies the code as unreachable. Consequently, from my perspective, the `WorthFuzzing` flag should be set to `false`. Since the code paths are unreachable without the required hardware, fuzzing efforts would be wasted. And so, the `FocusSymbols` and `EnableConfigs` lists can safely remain empty, `[]`. If `WorthFuzzing` is `false`, empty lists are standard practice. In short, I'll be setting this appropriately for the system to understand: these changes, while potentially interesting, don't represent a viable target for immediate fuzzing without specialized hardware. Time to call `set-results`.
26/2	2026/09/10 04:37	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false }
27/1	2026/09/10 04:37	action	If	0m Args: { "WorthFuzzing": false } Results: null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "PatchDiff": "commit 2a8ee534af585374519e264e9af2aaa7dcbcefe1\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Sep 10 04:36:56 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c\nindex a949987125976..71e700008c20e 100644\n--- a/drivers/net/wwan/mhi_wwan_mbim.c\n+++ b/drivers/net/wwan/mhi_wwan_mbim.c\n@@ -254,6 +254,7 @@ static int mbim_rx_verify_ndp16(struct sk_buff *skb, struct usb_cdc_ncm_ndp16 *n\n static void mhi_mbim_rx(struct mhi_mbim_context *mbim, struct sk_buff *skb)\n {\n \tint ndpoffset;\n+\tint last_ndpoffset = 0;\n \n \t/* Check NTB header and retrieve first NDP offset */\n \tndpoffset = mbim_rx_verify_nth16(mbim, skb);\n@@ -265,6 +266,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context *mbim, struct sk_buff *skb)\n \t/* Process each NDP */\n \twhile (1) {\n \t\tstruct usb_cdc_ncm_ndp16 ndp16;\n+\n+\t\tif (ndpoffset \u003c= last_ndpoffset) {\n+\t\t\tnet_err_ratelimited(\"mbim: non-increasing NDP offset (%u)\\n\",\n+\t\t\t\t\t    ndpoffset);\n+\t\t\tbreak;\n+\t\t}\n+\t\tlast_ndpoffset = ndpoffset;\n \t\tstruct usb_cdc_ncm_dpe16 dpe16;\n \t\tstruct mhi_mbim_link *link;\n \t\tint nframes, n, dpeoffset;\n@@ -320,7 +328,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context *mbim, struct sk_buff *skb)\n \t\t\t\tcontinue;\n \n \t\t\tskb_put(skbn, dgram_len);\n-\t\t\tskb_copy_bits(skb, dgram_offset, skbn-\u003edata, dgram_len);\n+\t\t\tif (skb_copy_bits(skb, dgram_offset, skbn-\u003edata, dgram_len)) {\n+\t\t\t\tdev_kfree_skb_any(skbn);\n+\t\t\t\tu64_stats_update_begin(\u0026link-\u003erx_syncp);\n+\t\t\t\tu64_stats_inc(\u0026link-\u003erx_errors);\n+\t\t\t\tu64_stats_update_end(\u0026link-\u003erx_syncp);\n+\t\t\t\tcontinue;\n+\t\t\t}\n \n \t\t\tswitch (skbn-\u003edata[0] \u0026 0xf0) {\n \t\t\tcase 0x40:\ndiff --git a/drivers/net/wwan/t7xx/t7xx_netdev.c b/drivers/net/wwan/t7xx/t7xx_netdev.c\nindex fc0a7cb181df2..8f32c2d269312 100644\n--- a/drivers/net/wwan/t7xx/t7xx_netdev.c\n+++ b/drivers/net/wwan/t7xx/t7xx_netdev.c\n@@ -420,6 +420,10 @@ static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl *ccmni_ctlb, struct sk_bu\n \n \tskb_cb = T7XX_SKB_CB(skb);\n \tnetif_id = skb_cb-\u003enetif_idx;\n+\tif (netif_id \u003e= NIC_DEV_MAX) {\n+\t\tdev_kfree_skb(skb);\n+\t\treturn;\n+\t}\n \tccmni = READ_ONCE(ccmni_ctlb-\u003eccmni_inst[netif_id]);\n \tif (!ccmni) {\n \t\tdev_kfree_skb(skb);\n"
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 2a8ee534af585374519e264e9af2aaa7dcbcefe1
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Sep 10 04:36:56 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
index a949987125976..71e700008c20e 100644
--- a/drivers/net/wwan/mhi_wwan_mbim.c
+++ b/drivers/net/wwan/mhi_wwan_mbim.c
@@ -254,6 +254,7 @@ static int mbim_rx_verify_ndp16(struct sk_buff *skb, struct usb_cdc_ncm_ndp16 *n
 static void mhi_mbim_rx(struct mhi_mbim_context *mbim, struct sk_buff *skb)
 {
 	int ndpoffset;
+	int last_ndpoffset = 0;
 
 	/* Check NTB header and retrieve first NDP offset */
 	ndpoffset = mbim_rx_verify_nth16(mbim, skb);
@@ -265,6 +266,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context *mbim, struct sk_buff *skb)
 	/* Process each NDP */
 	while (1) {
 		struct usb_cdc_ncm_ndp16 ndp16;
+
+		if (ndpoffset <= last_ndpoffset) {
+			net_err_ratelimited("mbim: non-increasing NDP offset (%u)\n",
+					    ndpoffset);
+			break;
+		}
+		last_ndpoffset = ndpoffset;
 		struct usb_cdc_ncm_dpe16 dpe16;
 		struct mhi_mbim_link *link;
 		int nframes, n, dpeoffset;
@@ -320,7 +328,13 @@ static void mhi_mbim_rx(struct mhi_mbim_context *mbim, struct sk_buff *skb)
 				continue;
 
 			skb_put(skbn, dgram_len);
-			skb_copy_bits(skb, dgram_offset, skbn->data, dgram_len);
+			if (skb_copy_bits(skb, dgram_offset, skbn->data, dgram_len)) {
+				dev_kfree_skb_any(skbn);
+				u64_stats_update_begin(&link->rx_syncp);
+				u64_stats_inc(&link->rx_errors);
+				u64_stats_update_end(&link->rx_syncp);
+				continue;
+			}
 
 			switch (skbn->data[0] & 0xf0) {
 			case 0x40:
diff --git a/drivers/net/wwan/t7xx/t7xx_netdev.c b/drivers/net/wwan/t7xx/t7xx_netdev.c
index fc0a7cb181df2..8f32c2d269312 100644
--- a/drivers/net/wwan/t7xx/t7xx_netdev.c
+++ b/drivers/net/wwan/t7xx/t7xx_netdev.c
@@ -420,6 +420,10 @@ static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl *ccmni_ctlb, struct sk_bu
 
 	skb_cb = T7XX_SKB_CB(skb);
 	netif_id = skb_cb->netif_idx;
+	if (netif_id >= NIC_DEV_MAX) {
+		dev_kfree_skb(skb);
+		return;
+	}
 	ccmni = READ_ONCE(ccmni_ctlb->ccmni_inst[netif_id]);
 	if (!ccmni) {
 		dev_kfree_skb(skb);

							input: 3685
							output: 28
							thoughts: 191

**Analyzing this Patch: A Deep Dive**

Okay, let's break down this patch. My initial thought is to zero in on what's being touched. I see two files: `drivers/net/wwan/mhi_wwan_mbim.c` and `drivers/net/wwan/t7xx/t7xx_netdev.c`. Immediately, I need to understand what these drivers *do*. I know `mhi_wwan_mbim.c` is the MHI WWAN MBIM driver, dealing with MHI (Mobile Host Interface) connections and MBIM (Mobile Broadband Interface Model) communication, and `t7xx_netdev.c` is the MediaTek PCIe 5G WWAN modem driver for the t7xx chipset.

Now, the real question is *how* these drivers are configured and whether there are any accessibility issues. I need to understand their Kconfig options and overall build process. Are there any conditions that will prevent me from using these drivers in my tests? This means digging into the relevant `Kconfig` files – specifically `drivers/net/wwan/Kconfig` and `drivers/net/wwan/t7xx/Kconfig` – as well as the accompanying `Makefile`s. This will tell me if they are reachable in virtualized environments like QEMU or syzkaller. Ultimately, I need to know if I can reliably test this patch.

{
  "Expression": "WWAN",
  "PathPrefix": "drivers/net/wwan"
}

{
  "Output": "\nFull output is too long, showing 500 out of 836 lines.\nUse more precise expression if possible.\n\ndrivers/net/wwan/Kconfig=6=menu \"Wireless WAN\"\ndrivers/net/wwan/Kconfig-7-\ndrivers/net/wwan/Kconfig:8:config WWAN\ndrivers/net/wwan/Kconfig:9:\ttristate \"WWAN Driver Core\"\ndrivers/net/wwan/Kconfig-10-\tdepends on GNSS || GNSS = n\ndrivers/net/wwan/Kconfig-11-\thelp\ndrivers/net/wwan/Kconfig:12:\t  Say Y here if you want to use the WWAN driver core. This driver\ndrivers/net/wwan/Kconfig:13:\t  provides a common framework for WWAN drivers.\ndrivers/net/wwan/Kconfig-14-\n--\ndrivers/net/wwan/Kconfig-17-\ndrivers/net/wwan/Kconfig:18:if WWAN\ndrivers/net/wwan/Kconfig-19-\ndrivers/net/wwan/Kconfig:20:config WWAN_DEBUGFS\ndrivers/net/wwan/Kconfig:21:\tbool \"WWAN devices debugfs interface\" if EXPERT\ndrivers/net/wwan/Kconfig-22-\tdepends on DEBUG_FS\n--\ndrivers/net/wwan/Kconfig-24-\thelp\ndrivers/net/wwan/Kconfig:25:\t  Enables debugfs infrastructure for the WWAN core and device drivers.\ndrivers/net/wwan/Kconfig-26-\ndrivers/net/wwan/Kconfig-27-\t  If this option is selected, then you can find the debug interface\ndrivers/net/wwan/Kconfig:28:\t  elements for each WWAN device in a directory that is corresponding to\ndrivers/net/wwan/Kconfig-29-\t  the device name: debugfs/wwan/wwanX.\ndrivers/net/wwan/Kconfig-30-\ndrivers/net/wwan/Kconfig:31:config WWAN_HWSIM\ndrivers/net/wwan/Kconfig:32:\ttristate \"Simulated WWAN device\"\ndrivers/net/wwan/Kconfig-33-\thelp\ndrivers/net/wwan/Kconfig:34:\t  This driver is a developer testing tool that can be used to test WWAN\ndrivers/net/wwan/Kconfig-35-\t  framework.\n--\ndrivers/net/wwan/Kconfig-39-\ndrivers/net/wwan/Kconfig:40:config MHI_WWAN_CTRL\ndrivers/net/wwan/Kconfig:41:\ttristate \"MHI WWAN control driver for Qualcomm-based PCIe modems\"\ndrivers/net/wwan/Kconfig-42-\tdepends on MHI_BUS\ndrivers/net/wwan/Kconfig-43-\thelp\ndrivers/net/wwan/Kconfig:44:\t  MHI WWAN CTRL allows QCOM-based PCIe modems to expose different modem\ndrivers/net/wwan/Kconfig-45-\t  control protocols/ports to userspace, including AT, MBIM, QMI, DIAG\n--\ndrivers/net/wwan/Kconfig-52-\ndrivers/net/wwan/Kconfig:53:config MHI_WWAN_MBIM\ndrivers/net/wwan/Kconfig:54:        tristate \"MHI WWAN MBIM network driver for Qualcomm-based PCIe modems\"\ndrivers/net/wwan/Kconfig-55-        depends on MHI_BUS\ndrivers/net/wwan/Kconfig-56-        help\ndrivers/net/wwan/Kconfig:57:          MHI WWAN MBIM is a WWAN network driver for QCOM-based PCIe modems.\ndrivers/net/wwan/Kconfig-58-          It implements MBIM over MHI, for IP data aggregation and muxing.\n--\ndrivers/net/wwan/Kconfig=65=config QCOM_BAM_DMUX\ndrivers/net/wwan/Kconfig:66:\ttristate \"Qualcomm BAM-DMUX WWAN network driver\"\ndrivers/net/wwan/Kconfig-67-\tdepends on (DMA_ENGINE \u0026\u0026 PM \u0026\u0026 QCOM_SMEM_STATE) || COMPILE_TEST\n--\ndrivers/net/wwan/Kconfig-71-\t  MSM8916 or MSM8974. The connection can be established via QMI/AT from\ndrivers/net/wwan/Kconfig:72:\t  userspace with control ports available through the WWAN subsystem\ndrivers/net/wwan/Kconfig:73:\t  (CONFIG_RPMSG_WWAN_CTRL) or QRTR network sockets (CONFIG_QRTR).\ndrivers/net/wwan/Kconfig-74-\n--\ndrivers/net/wwan/Kconfig-77-\ndrivers/net/wwan/Kconfig:78:config RPMSG_WWAN_CTRL\ndrivers/net/wwan/Kconfig:79:\ttristate \"RPMSG WWAN control driver\"\ndrivers/net/wwan/Kconfig-80-\tdepends on RPMSG\ndrivers/net/wwan/Kconfig-81-\thelp\ndrivers/net/wwan/Kconfig:82:\t  RPMSG WWAN CTRL allows modems available via RPMSG channels to expose\ndrivers/net/wwan/Kconfig-83-\t  different modem protocols/ports to userspace, including AT and QMI.\n--\ndrivers/net/wwan/Kconfig=96=config IOSM\ndrivers/net/wwan/Kconfig:97:\ttristate \"IOSM Driver for Intel M.2 WWAN Device\"\ndrivers/net/wwan/Kconfig-98-\tdepends on PCI\ndrivers/net/wwan/Kconfig-99-\tselect NET_DEVLINK\ndrivers/net/wwan/Kconfig:100:\tselect RELAY if WWAN_DEBUGFS\ndrivers/net/wwan/Kconfig-101-\thelp\ndrivers/net/wwan/Kconfig:102:\t  This driver enables Intel M.2 WWAN Device communication.\ndrivers/net/wwan/Kconfig-103-\ndrivers/net/wwan/Kconfig:104:\t  If you have one of those Intel M.2 WWAN Modules and wish to use it in\ndrivers/net/wwan/Kconfig-105-\t  Linux say Y/M here.\n--\ndrivers/net/wwan/Kconfig=109=config MTK_T7XX\ndrivers/net/wwan/Kconfig:110:\ttristate \"MediaTek PCIe 5G WWAN modem T7xx device\"\ndrivers/net/wwan/Kconfig-111-\tdepends on PCI\ndrivers/net/wwan/Kconfig:112:\tselect RELAY if WWAN_DEBUGFS\ndrivers/net/wwan/Kconfig-113-\thelp\ndrivers/net/wwan/Kconfig:114:\t  Enables MediaTek PCIe based 5G WWAN modem (T7xx series) device.\ndrivers/net/wwan/Kconfig:115:\t  Adapts WWAN framework and provides network interface like wwan0\ndrivers/net/wwan/Kconfig-116-\t  and tty interfaces like wwan0at0 (AT protocol), wwan0mbim0\n--\ndrivers/net/wwan/Kconfig-123-\ndrivers/net/wwan/Kconfig:124:endif # WWAN\ndrivers/net/wwan/Kconfig-125-\n--\ndrivers/net/wwan/Makefile-2-#\ndrivers/net/wwan/Makefile:3:# Makefile for the Linux WWAN device drivers.\ndrivers/net/wwan/Makefile-4-#\ndrivers/net/wwan/Makefile-5-\ndrivers/net/wwan/Makefile:6:obj-$(CONFIG_WWAN) += wwan.o\ndrivers/net/wwan/Makefile-7-wwan-objs += wwan_core.o\ndrivers/net/wwan/Makefile-8-\ndrivers/net/wwan/Makefile:9:obj-$(CONFIG_WWAN_HWSIM) += wwan_hwsim.o\ndrivers/net/wwan/Makefile-10-\ndrivers/net/wwan/Makefile:11:obj-$(CONFIG_MHI_WWAN_CTRL) += mhi_wwan_ctrl.o\ndrivers/net/wwan/Makefile:12:obj-$(CONFIG_MHI_WWAN_MBIM) += mhi_wwan_mbim.o\ndrivers/net/wwan/Makefile-13-obj-$(CONFIG_QCOM_BAM_DMUX) += qcom_bam_dmux.o\ndrivers/net/wwan/Makefile:14:obj-$(CONFIG_RPMSG_WWAN_CTRL) += rpmsg_wwan_ctrl.o\ndrivers/net/wwan/Makefile-15-obj-$(CONFIG_IOSM) += iosm/\n--\ndrivers/net/wwan/iosm/Makefile=6=iosm-y = \\\n--\ndrivers/net/wwan/iosm/Makefile-25-\ndrivers/net/wwan/iosm/Makefile:26:iosm-$(CONFIG_WWAN_DEBUGFS) += \\\ndrivers/net/wwan/iosm/Makefile-27-\tiosm_ipc_debugfs.o\t\t\\\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c=34=static struct ipc_chnl_cfg modem_cfg[] = {\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-37-\t  IPC_MEM_MAX_TDS_MUX_LITE_UL, IPC_MEM_MAX_TDS_MUX_LITE_DL,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:38:\t  IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE, WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-39-\t/* RPC - 0 */\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-41-\t  IPC_MEM_MAX_TDS_RPC, IPC_MEM_MAX_TDS_RPC,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:42:\t  IPC_MEM_MAX_DL_RPC_BUF_SIZE, WWAN_PORT_XMMRPC },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-43-\t/* IAT0 */\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-45-\t  IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_DL_AT_BUF_SIZE,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:46:\t  WWAN_PORT_AT },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-47-\t/* Trace */\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-49-\t  IPC_MEM_TDS_TRC, IPC_MEM_TDS_TRC, IPC_MEM_MAX_DL_TRC_BUF_SIZE,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:50:\t  WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-51-\t/* IAT1 */\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-53-\t  IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_TDS_AT, IPC_MEM_MAX_DL_AT_BUF_SIZE,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:54:\t  WWAN_PORT_AT },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-55-\t/* Loopback */\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-57-\t  IPC_MEM_MAX_TDS_LOOPBACK, IPC_MEM_MAX_TDS_LOOPBACK,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:58:\t  IPC_MEM_MAX_DL_LOOPBACK_SIZE, WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-59-\t/* MBIM Channel */\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-61-\t  IPC_MEM_MAX_TDS_MBIM, IPC_MEM_MAX_TDS_MBIM,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:62:\t  IPC_MEM_MAX_DL_MBIM_BUF_SIZE, WWAN_PORT_MBIM },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-63-\t/* Flash Channel/Coredump Channel */\n--\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-65-\t  IPC_MEM_MAX_TDS_FLASH_UL, IPC_MEM_MAX_TDS_FLASH_DL,\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c:66:\t  IPC_MEM_MAX_DL_FLASH_BUF_SIZE, WWAN_PORT_UNKNOWN },\ndrivers/net/wwan/iosm/iosm_ipc_chnl_cfg.c-67-};\n--\ndrivers/net/wwan/iosm/iosm_ipc_debugfs.h-8-\ndrivers/net/wwan/iosm/iosm_ipc_debugfs.h:9:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_debugfs.h-10-void ipc_debugfs_init(struct iosm_imem *ipc_imem);\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=17=static int ipc_imem_check_wwan_ips(struct ipc_mem_channel *chnl)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-19-\tif (chnl)\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:20:\t\treturn chnl-\u003ectype == IPC_CTYPE_WWAN \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-21-\t\t       chnl-\u003eif_id == IPC_MEM_MUX_IP_CH_IF_ID;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=298=static void ipc_imem_dl_skb_process(struct iosm_imem *ipc_imem,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-322-\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:323:\tcase IPC_CTYPE_WWAN:\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-324-\t\tif (pipe-\u003echannel-\u003eif_id == IPC_MEM_MUX_IP_CH_IF_ID)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=562=static void ipc_imem_run_state_worker(struct work_struct *instance)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-599-\t\t\tif (ipc_imem-\u003epcie-\u003epci-\u003edevice == INTEL_CP_DEVICE_7560_ID \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:600:\t\t\t    chnl_cfg_port.wwan_port_type == WWAN_PORT_XMMRPC) {\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-601-\t\t\t\tctrl_chl_idx++;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-605-\t\t\tif (ipc_imem-\u003epcie-\u003epci-\u003edevice == INTEL_CP_DEVICE_7360_ID \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:606:\t\t\t    chnl_cfg_port.wwan_port_type == WWAN_PORT_MBIM) {\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-607-\t\t\t\tctrl_chl_idx++;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-609-\t\t\t}\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:610:\t\t\tif (chnl_cfg_port.wwan_port_type != WWAN_PORT_UNKNOWN) {\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-611-\t\t\t\tipc_imem_channel_init(ipc_imem, IPC_CTYPE_CTRL,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c=1060=int ipc_imem_channel_alloc(struct iosm_imem *ipc_imem, int index,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-1084-\ndrivers/net/wwan/iosm/iosm_ipc_imem.c:1085:\tif (channel-\u003ectype == IPC_CTYPE_WWAN \u0026\u0026\ndrivers/net/wwan/iosm/iosm_ipc_imem.c-1086-\t    index == IPC_MEM_MUX_IP_CH_IF_ID)\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=136=enum ipc_channel_state {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-145- *\t\t    /IP traffic.\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:146: * @IPC_CTYPE_WWAN:\t\tUsed for IP traffic\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-147- * @IPC_CTYPE_CTRL:\t\tUsed for Control Communication\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=149=enum ipc_ctype {\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:150:\tIPC_CTYPE_WWAN,\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-151-\tIPC_CTYPE_CTRL,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=273=enum ipc_phase {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-289- * @ipc_task:\t\t\tTask for entry into ipc task queue\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:290: * @wwan:\t\t\tWWAN device pointer\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-291- * @mux:\t\t\tIP Data multiplexing state.\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-330- * @pcie_wake_n:\t\tPcie wake flag\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:331: * @debugfs_wwan_dir:\t\tWWAN Debug FS directory entry\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-332- * @debugfs_dir:\t\tDebug FS directory for driver-specific entries\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h=334=struct iosm_imem {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-341-\tstruct iosm_pcie *pcie;\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:342:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-343-\tstruct iosm_trace *trace;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-373-\t   pcie_wake_n:1;\ndrivers/net/wwan/iosm/iosm_ipc_imem.h:374:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_imem.h-375-\tstruct dentry *debugfs_wwan_dir;\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c=80=int ipc_imem_wwan_channel_init(struct iosm_imem *ipc_imem,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-86-\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c:87:\t/* If modem version is invalid (0xffffffff), do not initialize WWAN. */\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-88-\tif (ipc_imem-\u003ecp_version == -1) {\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-101-\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c:102:\tipc_imem_channel_init(ipc_imem, IPC_CTYPE_WWAN, chnl_cfg,\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-103-\t\t\t      IRQ_MOD_OFF);\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-104-\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c:105:\t/* WWAN registration. */\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.c-106-\tipc_imem-\u003ewwan = ipc_wwan_init(ipc_imem, ipc_imem-\u003edev);\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h=87=int ipc_imem_sys_wwan_transmit(struct iosm_imem *ipc_imem, int if_id,\n--\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h-89-/**\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h:90: * ipc_imem_wwan_channel_init - Initializes WWAN channels and the channel for\ndrivers/net/wwan/iosm/iosm_ipc_imem_ops.h-91- *\t\t\t\tMUX.\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c=9=static int ipc_mux_channel_create(struct iosm_mux *ipc_mux)\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-13-\tchannel_id = ipc_imem_channel_alloc(ipc_mux-\u003eimem, ipc_mux-\u003einstance_id,\ndrivers/net/wwan/iosm/iosm_ipc_mux.c:14:\t\t\t\t\t    IPC_CTYPE_WWAN);\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-15-\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c=424=int ipc_mux_open_session(struct iosm_mux *ipc_mux, int session_nr)\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-432-\tsession_open-\u003eif_id = cpu_to_le32(session_nr);\ndrivers/net/wwan/iosm/iosm_ipc_mux.c:433:\tipc_mux-\u003esession[session_nr].flags |= IPC_MEM_WWAN_MUX;\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-434-\treturn ipc_mux_schedule(ipc_mux, \u0026mux_msg);\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c=437=int ipc_mux_close_session(struct iosm_mux *ipc_mux, int session_nr)\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-447-\tret_val = ipc_mux_schedule(ipc_mux, \u0026mux_msg);\ndrivers/net/wwan/iosm/iosm_ipc_mux.c:448:\tipc_mux-\u003esession[session_nr].flags \u0026= ~IPC_MEM_WWAN_MUX;\ndrivers/net/wwan/iosm/iosm_ipc_mux.c-449-\n--\ndrivers/net/wwan/iosm/iosm_ipc_mux.h-58-/* MUX for route link devices */\ndrivers/net/wwan/iosm/iosm_ipc_mux.h:59:#define IPC_MEM_WWAN_MUX BIT(0)\ndrivers/net/wwan/iosm/iosm_ipc_mux.h-60-\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c=17=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-18-\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c:19:/* WWAN GUID */\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-20-static guid_t wwan_acpi_guid = GUID_INIT(0xbad01b75, 0x22a8, 0x4f48, 0x87, 0x92,\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c=220=static void ipc_pcie_config_init(struct iosm_pcie *ipc_pcie)\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-231-\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c:232:/* This will read the BIOS WWAN RTD3 settings:\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-233- * D0L1.2/D3L2/Disabled\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c=260=static int ipc_pcie_probe(struct pci_dev *pci,\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-305-\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c:306:\t/* Read WWAN RTD3 BIOS Setting\ndrivers/net/wwan/iosm/iosm_ipc_pcie.c-307-\t */\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h=39=enum ipc_pcie_sleep_state {\n--\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h-61- * @suspend:\t\t\tS2IDLE sleep/active\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h:62: * @d3l2_support:\t\tRead WWAN RTD3 BIOS setting for D3L2 support\ndrivers/net/wwan/iosm/iosm_ipc_pcie.h-63- */\n--\ndrivers/net/wwan/iosm/iosm_ipc_port.h-18- * @pcie:\t\tPCIe component\ndrivers/net/wwan/iosm/iosm_ipc_port.h:19: * @port_type:\t\tWWAN port type\ndrivers/net/wwan/iosm/iosm_ipc_port.h-20- * @channel:\t\tChannel instance\n--\ndrivers/net/wwan/iosm/iosm_ipc_trace.h=37=struct iosm_trace {\n--\ndrivers/net/wwan/iosm/iosm_ipc_trace.h-47-\ndrivers/net/wwan/iosm/iosm_ipc_trace.h:48:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/iosm/iosm_ipc_trace.h-49-\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-21-/**\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c:22: * struct iosm_netdev_priv - netdev WWAN driver specific private data\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-23- * @ipc_wwan:\tPointer to iosm_wwan struct\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c=28=struct iosm_netdev_priv {\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-35-/**\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c:36: * struct iosm_wwan - This structure contains information about WWAN root device\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-37- *\t\t      and interface to the IPC layer.\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c=289=struct iosm_wwan *ipc_wwan_init(struct iosm_imem *ipc_imem, struct device *dev)\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-299-\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c:300:\t/* WWAN core will create a netdev for the default IP MUX channel */\ndrivers/net/wwan/iosm/iosm_ipc_wwan.c-301-\tif (wwan_register_ops(ipc_wwan-\u003edev, \u0026iosm_wwan_ops, ipc_wwan,\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-5-\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:6:#ifndef IOSM_IPC_WWAN_H\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:7:#define IOSM_IPC_WWAN_H\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-8-\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-9-/**\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:10: * ipc_wwan_init - Allocate, Init and register WWAN device\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-11- * @ipc_imem:\t\tPointer to imem data-struct\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h=16=struct iosm_wwan *ipc_wwan_init(struct iosm_imem *ipc_imem, struct device *dev);\n--\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-18-/**\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h:19: * ipc_wwan_deinit - Unregister and free WWAN device, clear pointer\ndrivers/net/wwan/iosm/iosm_ipc_wwan.h-20- * @ipc_wwan:\tPointer to wwan instance data\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=9=enum mhi_wwan_flags {\ndrivers/net/wwan/mhi_wwan_ctrl.c:10:\tMHI_WWAN_DL_CAP,\ndrivers/net/wwan/mhi_wwan_ctrl.c:11:\tMHI_WWAN_UL_CAP,\ndrivers/net/wwan/mhi_wwan_ctrl.c:12:\tMHI_WWAN_RX_REFILL,\ndrivers/net/wwan/mhi_wwan_ctrl.c-13-};\ndrivers/net/wwan/mhi_wwan_ctrl.c-14-\ndrivers/net/wwan/mhi_wwan_ctrl.c:15:#define MHI_WWAN_MAX_MTU\t0x8000\ndrivers/net/wwan/mhi_wwan_ctrl.c-16-\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=41=static void mhi_wwan_rx_budget_inc(struct mhi_wwan_dev *mhiwwan)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-46-\ndrivers/net/wwan/mhi_wwan_ctrl.c:47:\tif (test_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags))\ndrivers/net/wwan/mhi_wwan_ctrl.c-48-\t\tschedule_work(\u0026mhiwwan-\u003erx_refill);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=54=static bool mhi_wwan_rx_budget_dec(struct mhi_wwan_dev *mhiwwan)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-61-\t\tmhiwwan-\u003erx_budget--;\ndrivers/net/wwan/mhi_wwan_ctrl.c:62:\t\tif (test_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags))\ndrivers/net/wwan/mhi_wwan_ctrl.c-63-\t\t\tret = true;\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=77=static void mhi_wwan_ctrl_refill_work(struct work_struct *work)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-91-\t\t/* To prevent unlimited buffer allocation if nothing consumes\ndrivers/net/wwan/mhi_wwan_ctrl.c:92:\t\t * the RX buffers (passed to WWAN core), track their lifespan\ndrivers/net/wwan/mhi_wwan_ctrl.c-93-\t\t * to not allocate more than allowed budget.\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=106=static int mhi_wwan_ctrl_start(struct wwan_port *port)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-119-\t/* Add buffers to the MHI inbound queue */\ndrivers/net/wwan/mhi_wwan_ctrl.c:120:\tif (test_bit(MHI_WWAN_DL_CAP, \u0026mhiwwan-\u003eflags)) {\ndrivers/net/wwan/mhi_wwan_ctrl.c:121:\t\tset_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-122-\t\tmhi_wwan_ctrl_refill_work(\u0026mhiwwan-\u003erx_refill);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=128=static void mhi_wwan_ctrl_stop(struct wwan_port *port)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-132-\tspin_lock_bh(\u0026mhiwwan-\u003erx_lock);\ndrivers/net/wwan/mhi_wwan_ctrl.c:133:\tclear_bit(MHI_WWAN_RX_REFILL, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-134-\tspin_unlock_bh(\u0026mhiwwan-\u003erx_lock);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=141=static int mhi_wwan_ctrl_tx(struct wwan_port *port, struct sk_buff *skb)\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-148-\ndrivers/net/wwan/mhi_wwan_ctrl.c:149:\tif (!test_bit(MHI_WWAN_UL_CAP, \u0026mhiwwan-\u003eflags))\ndrivers/net/wwan/mhi_wwan_ctrl.c-150-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=213=static int mhi_wwan_ctrl_probe(struct mhi_device *mhi_dev,\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-224-\tmhiwwan-\u003emhi_dev = mhi_dev;\ndrivers/net/wwan/mhi_wwan_ctrl.c:225:\tmhiwwan-\u003emtu = MHI_WWAN_MAX_MTU;\ndrivers/net/wwan/mhi_wwan_ctrl.c-226-\tINIT_WORK(\u0026mhiwwan-\u003erx_refill, mhi_wwan_ctrl_refill_work);\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c-230-\tif (mhi_dev-\u003edl_chan)\ndrivers/net/wwan/mhi_wwan_ctrl.c:231:\t\tset_bit(MHI_WWAN_DL_CAP, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-232-\tif (mhi_dev-\u003eul_chan)\ndrivers/net/wwan/mhi_wwan_ctrl.c:233:\t\tset_bit(MHI_WWAN_UL_CAP, \u0026mhiwwan-\u003eflags);\ndrivers/net/wwan/mhi_wwan_ctrl.c-234-\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=258=static const struct mhi_device_id mhi_wwan_ctrl_match_table[] = {\ndrivers/net/wwan/mhi_wwan_ctrl.c:259:\t{ .chan = \"DUN\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/mhi_wwan_ctrl.c:260:\t{ .chan = \"DUN2\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/mhi_wwan_ctrl.c:261:\t{ .chan = \"MBIM\", .driver_data = WWAN_PORT_MBIM },\ndrivers/net/wwan/mhi_wwan_ctrl.c:262:\t{ .chan = \"QMI\", .driver_data = WWAN_PORT_QMI },\ndrivers/net/wwan/mhi_wwan_ctrl.c:263:\t{ .chan = \"DIAG\", .driver_data = WWAN_PORT_QCDM },\ndrivers/net/wwan/mhi_wwan_ctrl.c:264:\t{ .chan = \"FIREHOSE\", .driver_data = WWAN_PORT_FIREHOSE },\ndrivers/net/wwan/mhi_wwan_ctrl.c:265:\t{ .chan = \"NMEA\", .driver_data = WWAN_PORT_NMEA },\ndrivers/net/wwan/mhi_wwan_ctrl.c-266-\t{},\n--\ndrivers/net/wwan/mhi_wwan_ctrl.c=283=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/mhi_wwan_ctrl.c:284:MODULE_DESCRIPTION(\"MHI WWAN CTRL Driver\");\ndrivers/net/wwan/mhi_wwan_ctrl.c-285-MODULE_AUTHOR(\"Loic Poulain \u003cloic.poulain@linaro.org\u003e\");\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=620=static int mhi_mbim_probe(struct mhi_device *mhi_dev, const struct mhi_device_id *id)\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-644-\ndrivers/net/wwan/mhi_wwan_mbim.c:645:\t/* Register wwan link ops with MHI controller representing WWAN instance */\ndrivers/net/wwan/mhi_wwan_mbim.c-646-\treturn wwan_register_ops(\u0026cntrl-\u003emhi_dev-\u003edev, \u0026mhi_mbim_wwan_ops, mbim, 0);\n--\ndrivers/net/wwan/qcom_bam_dmux.c-2-/*\ndrivers/net/wwan/qcom_bam_dmux.c:3: * Qualcomm BAM-DMUX WWAN network driver\ndrivers/net/wwan/qcom_bam_dmux.c-4- * Copyright (c) 2020, Stephan Gerhold \u003cstephan@gerhold.net\u003e\n--\ndrivers/net/wwan/qcom_bam_dmux.c=905=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/qcom_bam_dmux.c:906:MODULE_DESCRIPTION(\"Qualcomm BAM-DMUX WWAN Network Driver\");\ndrivers/net/wwan/qcom_bam_dmux.c-907-MODULE_AUTHOR(\"Stephan Gerhold \u003cstephan@gerhold.net\u003e\");\n--\ndrivers/net/wwan/rpmsg_wwan_ctrl.c=98=static struct device *rpmsg_wwan_find_parent(struct device *dev)\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-99-{\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:100:\t/* Select first platform device as parent for the WWAN ports.\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-101-\t * On Qualcomm platforms this is usually the platform device that\n--\ndrivers/net/wwan/rpmsg_wwan_ctrl.c=147=static const struct rpmsg_device_id rpmsg_wwan_ctrl_id_table[] = {\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-148-\t/* RPMSG channels for Qualcomm SoCs with integrated modem */\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:149:\t{ .name = \"DATA5_CNTL\", .driver_data = WWAN_PORT_QMI },\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:150:\t{ .name = \"DATA4\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:151:\t{ .name = \"DATA1\", .driver_data = WWAN_PORT_AT },\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-152-\t{},\n--\ndrivers/net/wwan/rpmsg_wwan_ctrl.c=164=MODULE_LICENSE(\"GPL v2\");\ndrivers/net/wwan/rpmsg_wwan_ctrl.c:165:MODULE_DESCRIPTION(\"RPMSG WWAN CTRL Driver\");\ndrivers/net/wwan/rpmsg_wwan_ctrl.c-166-MODULE_AUTHOR(\"Stephan Gerhold \u003cstephan@gerhold.net\u003e\");\n--\ndrivers/net/wwan/t7xx/Makefile=4=mtk_t7xx-y:=\tt7xx_pci.o \\\n--\ndrivers/net/wwan/t7xx/Makefile-19-\ndrivers/net/wwan/t7xx/Makefile:20:mtk_t7xx-$(CONFIG_WWAN_DEBUGFS) += \\\ndrivers/net/wwan/t7xx/Makefile-21-\t\tt7xx_port_trace.o \\\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c=338=static int t7xx_ccmni_register_wwan(struct t7xx_ccmni_ctrl *ctlb)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c-345-\ndrivers/net/wwan/t7xx/t7xx_netdev.c:346:\t/* WWAN core will create a netdev for the default IP MUX channel */\ndrivers/net/wwan/t7xx/t7xx_netdev.c-347-\tret = wwan_register_ops(dev, \u0026ccmni_wwan_ops, ctlb, IP_MUX_SESSION_DEFAULT);\ndrivers/net/wwan/t7xx/t7xx_netdev.c-348-\tif (ret \u003c 0) {\ndrivers/net/wwan/t7xx/t7xx_netdev.c:349:\t\tdev_err(dev, \"Unable to register WWAN ops, %d\\n\", ret);\ndrivers/net/wwan/t7xx/t7xx_netdev.c-350-\t\treturn ret;\n--\ndrivers/net/wwan/t7xx/t7xx_pci.c=962=MODULE_AUTHOR(\"MediaTek Inc\");\ndrivers/net/wwan/t7xx/t7xx_pci.c:963:MODULE_DESCRIPTION(\"MediaTek PCIe 5G WWAN modem T7xx driver\");\ndrivers/net/wwan/t7xx/t7xx_pci.c-964-MODULE_LICENSE(\"GPL\");\n--\ndrivers/net/wwan/t7xx/t7xx_pci.h=74=struct t7xx_pci_dev {\n--\ndrivers/net/wwan/t7xx/t7xx_pci.h-92-\tstruct completion\tsleep_lock_acquire;\ndrivers/net/wwan/t7xx/t7xx_pci.h:93:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/t7xx/t7xx_pci.h-94-\tstruct dentry\t\t*debugfs_dir;\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c=55=static const struct t7xx_port_conf t7xx_port_conf[] = {\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-65-\t\t.name = \"AT\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:66:\t\t.port_type = WWAN_PORT_AT,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-67-\t}, {\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-74-\t\t.name = \"MBIM\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:75:\t\t.port_type = WWAN_PORT_MBIM,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-76-\t}, {\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:77:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-78-\t\t.tx_ch = PORT_CH_MD_LOG_TX,\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-111-\t\t.name = \"adb\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:112:\t\t.port_type = WWAN_PORT_ADB,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-113-\t\t.debug = true,\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-121-\t\t.name = \"mipc\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:122:\t\t.port_type = WWAN_PORT_MIPC,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-123-\t\t.debug = true,\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c=127=static const struct t7xx_port_conf t7xx_early_port_conf[] = {\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-137-\t\t.name = \"fastboot\",\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c:138:\t\t.port_type = WWAN_PORT_FASTBOOT,\ndrivers/net/wwan/t7xx/t7xx_port_proxy.c-139-\t},\n--\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h=95=extern struct port_ops ctl_port_ops;\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h-96-\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h:97:#ifdef CONFIG_WWAN_DEBUGFS\ndrivers/net/wwan/t7xx/t7xx_port_proxy.h-98-extern struct port_ops t7xx_trace_port_ops;\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=130=static int t7xx_port_wwan_tx(struct wwan_port *port, struct sk_buff *skb)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-138-\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:139:\tif (port_conf-\u003eport_type != WWAN_PORT_FASTBOOT)\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-140-\t\tret = t7xx_port_ctrl_tx(port_private, skb);\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=153=static void t7xx_port_wwan_create(struct t7xx_port *port)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-165-\t\tif (IS_ERR(port-\u003ewwan.wwan_port))\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:166:\t\t\tdev_err(port-\u003edev, \"Unable to create WWAN port %s\", port_conf-\u003ename);\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-167-\t}\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=170=static int t7xx_port_wwan_init(struct t7xx_port *port)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-173-\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:174:\tif (port_conf-\u003eport_type == WWAN_PORT_FASTBOOT ||\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:175:\t    port_conf-\u003eport_type == WWAN_PORT_ADB ||\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:176:\t    port_conf-\u003eport_type == WWAN_PORT_MIPC)\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-177-\t\tt7xx_port_wwan_create(port);\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c=227=static void t7xx_port_wwan_md_state_notify(struct t7xx_port *port, unsigned int state)\n--\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-230-\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:231:\tif (port_conf-\u003eport_type == WWAN_PORT_FASTBOOT ||\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:232:\t    port_conf-\u003eport_type == WWAN_PORT_ADB ||\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c:233:\t    port_conf-\u003eport_type == WWAN_PORT_MIPC)\ndrivers/net/wwan/t7xx/t7xx_port_wwan.c-234-\t\treturn;\n--\ndrivers/net/wwan/wwan_core.c-1-// SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wwan/wwan_core.c:2:/* WWAN Driver Core\n\n"
}

							input: 17555
							output: 19
							thoughts: 151

**Investigating WWAN Driver Dependencies**

Okay, let's dive in. I need to understand the relationship between these WWAN drivers and the underlying hardware. Specifically, I'm focusing on `drivers/net/wwan/mhi_wwan_mbim.c` and `drivers/net/wwan/t7xx/t7xx_netdev.c`. I know that `mhi_wwan_mbim.c` is related to Qualcomm MHI bus devices based on the naming, but I need to confirm this and understand the hardware it is communicating with.

My immediate thought is to check the Kconfig dependencies. `mhi_wwan_mbim.c` has `MHI_WWAN_MBIM`, which in turn depends on `MHI_BUS`. Now, the key question is what *is* `MHI_BUS`? Is it a physical bus, potentially PCIe, or is it a virtual construct like a simulated bus, or perhaps a USB gadget or some other kind of inter-device communication layer? To figure that out, I'll need to locate `MHI_BUS`'s definition. My guess is it will be in `drivers/bus/mhi/Kconfig` or a similar configuration file. I need to understand what this bus is, as it is the crux of how the driver interfaces with the hardware.

{
  "Expression": "config MHI_BUS"
}

{
  "Output": "drivers/bus/mhi/ep/Kconfig:1:config MHI_BUS_EP\ndrivers/bus/mhi/ep/Kconfig-2-\ttristate \"Modem Host Interface (MHI) bus Endpoint implementation\"\n--\ndrivers/bus/mhi/host/Kconfig-7-\ndrivers/bus/mhi/host/Kconfig:8:config MHI_BUS\ndrivers/bus/mhi/host/Kconfig-9-\ttristate \"Modem Host Interface (MHI) bus\"\n--\ndrivers/bus/mhi/host/Kconfig-15-\ndrivers/bus/mhi/host/Kconfig:16:config MHI_BUS_DEBUG\ndrivers/bus/mhi/host/Kconfig-17-\tbool \"Debugfs support for the MHI bus\"\n--\ndrivers/bus/mhi/host/Kconfig-23-\ndrivers/bus/mhi/host/Kconfig:24:config MHI_BUS_PCI_GENERIC\ndrivers/bus/mhi/host/Kconfig-25-\ttristate \"MHI PCI controller driver\"\n"
}

							input: 18290
							output: 40
							thoughts: 386

**My Initial Assessment of the MHI/WWAN Situation**

Okay, let's break this down. First, `MHI_BUS_EP` is clearly an MHI bus Endpoint implementation, that's straightforward. Now, the interesting part is `MHI_WWAN_MBIM`. I need to figure out how that fits into the picture, so I'll check `mhi_wwan_mbim.c` to see how it's integrated, likely through an `mhi_driver` and `mhi_driver_register`. I'll also want to understand how MHI devices are probed in general. Looking back at the base `MHI_BUS_PCI_GENERIC`, it appears to handle registration of PCI devices, specifically Foxconn, Quectel, and Telit PCIe WWAN modems.

Then there is the `MTK_T7XX` driver to consider. It's a PCI driver (`t7xx_pci.c`, `pci_register_driver(&t7xx_pci_driver)`) that has specific MediaTek PCI device IDs (like `PCI_DEVICE_ID_MEDIATEK_MT6855`). Okay, so that's a PCI-based MediaTek solution, likely targeting a specific hardware revision.

Hold on, let's not jump to conclusions. I need to keep in mind those crucial instructions, specifically Section 2 regarding structurally unreachable hardware. It highlights that certain drivers, like those for vendor-specific PCIe switches, SmartNICs, or GPUs (e.g., `mlxsw`, `pds_core`, `qed`, `ionic`, `amdgpu`), are unlikely to be instantiated without their associated physical ASIC/PCIe cards in a standard QEMU environment.

Now, I need to check if these WWAN drivers (MHI, MTK_T7XX, MHI_WWAN_MBIM) can be instantiated in standard QEMU or via virtual buses (like USB gadget, hwsim, etc.) or if they are vendor-specific PCIe modem drivers. This is the critical question. If they rely on specific hardware, I'm going to have a problem. I might need to look for drivers that work through virtual bus implementations, like `wwan_hwsim`, to provide a path. Let's see if that's even feasible.

Let's see if `wwan_hwsim` connects to `mhi_wwan_mbim` or `t7xx`? I'll check `wwan_hwsim.c` for some clues on its internal implementation.

{
  "Expression": "mhi|t7xx",
  "PathPrefix": "drivers/net/wwan/wwan_hwsim.c"
}

{
  "error": "no matches"
}

							input: 19284
							output: 40
							thoughts: 20

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into the wwan_hwsim.c Source**

Alright, let's crack open `drivers/net/wwan/wwan_hwsim.c`. Time to see what kind of shenanigans the hardware simulation is up to. I'm especially curious about the implementation details – how are they abstracting the hardware layer? What's the interface like for emulating WWAN functionality within the kernel? Are they using any clever tricks to handle the complexities of cellular communication?

I'll be looking for the core structures, the main entry points, the interrupt handling (if any), and how they're simulating the data transfer process. I want to understand how this code fits into the broader networking stack, and how well it mirrors real-world WWAN behavior. Specifically, I'll be searching for any areas that might have subtle bugs or inefficiencies that could impact testing or development. It would be insightful to review the error handling, too - how robust is the simulation?

My focus is on the architecture and design choices here, paying close attention to any areas that might require optimization or further refinement. It's time to become intimately acquainted with the simulated world of WWAN within the kernel.

{
  "File": "drivers/net/wwan/wwan_hwsim.c",
  "FirstLine": 1,
  "LineCount": 80
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: GPL-2.0-only\n   2:\t/*\n   3:\t * WWAN device simulator for WWAN framework testing.\n   4:\t *\n   5:\t * Copyright (c) 2021, 2025, Sergey Ryazanov \u003cryazanov.s.a@gmail.com\u003e\n   6:\t */\n   7:\t\n   8:\t#define pr_fmt(fmt) KBUILD_MODNAME \": \" fmt\n   9:\t\n  10:\t#include \u003clinux/kernel.h\u003e\n  11:\t#include \u003clinux/module.h\u003e\n  12:\t#include \u003clinux/slab.h\u003e\n  13:\t#include \u003clinux/device.h\u003e\n  14:\t#include \u003clinux/spinlock.h\u003e\n  15:\t#include \u003clinux/time.h\u003e\n  16:\t#include \u003clinux/list.h\u003e\n  17:\t#include \u003clinux/skbuff.h\u003e\n  18:\t#include \u003clinux/timer.h\u003e\n  19:\t#include \u003clinux/netdevice.h\u003e\n  20:\t#include \u003clinux/wwan.h\u003e\n  21:\t#include \u003clinux/debugfs.h\u003e\n  22:\t#include \u003clinux/workqueue.h\u003e\n  23:\t\n  24:\t#include \u003cnet/arp.h\u003e\n  25:\t\n  26:\tstatic int wwan_hwsim_devsnum = 2;\n  27:\tmodule_param_named(devices, wwan_hwsim_devsnum, int, 0444);\n  28:\tMODULE_PARM_DESC(devices, \"Number of simulated devices\");\n  29:\t\n  30:\tstatic const struct class wwan_hwsim_class = {\n  31:\t\t.name = \"wwan_hwsim\",\n  32:\t};\n  33:\t\n  34:\tstatic struct dentry *wwan_hwsim_debugfs_topdir;\n  35:\tstatic struct dentry *wwan_hwsim_debugfs_devcreate;\n  36:\t\n  37:\tstatic DEFINE_SPINLOCK(wwan_hwsim_devs_lock);\n  38:\tstatic LIST_HEAD(wwan_hwsim_devs);\n  39:\tstatic unsigned int wwan_hwsim_dev_idx;\n  40:\tstatic struct workqueue_struct *wwan_wq;\n  41:\t\n  42:\tstruct wwan_hwsim_dev {\n  43:\t\tstruct list_head list;\n  44:\t\tunsigned int id;\n  45:\t\tstruct device dev;\n  46:\t\tstruct work_struct del_work;\n  47:\t\tstruct dentry *debugfs_topdir;\n  48:\t\tstruct dentry *debugfs_portcreate;\n  49:\t\tspinlock_t ports_lock;\t/* Serialize ports creation/deletion */\n  50:\t\tunsigned int port_idx;\n  51:\t\tstruct list_head ports;\n  52:\t};\n  53:\t\n  54:\tstruct wwan_hwsim_port {\n  55:\t\tstruct list_head list;\n  56:\t\tunsigned int id;\n  57:\t\tstruct wwan_hwsim_dev *dev;\n  58:\t\tstruct wwan_port *wwan;\n  59:\t\tstruct work_struct del_work;\n  60:\t\tstruct dentry *debugfs_topdir;\n  61:\t\tunion {\n  62:\t\t\tstruct {\n  63:\t\t\t\tenum {\t/* AT command parser state */\n  64:\t\t\t\t\tAT_PARSER_WAIT_A,\n  65:\t\t\t\t\tAT_PARSER_WAIT_T,\n  66:\t\t\t\t\tAT_PARSER_WAIT_TERM,\n  67:\t\t\t\t\tAT_PARSER_SKIP_LINE,\n  68:\t\t\t\t} pstate;\n  69:\t\t\t} at_emul;\n  70:\t\t\tstruct {\n  71:\t\t\t\tstruct timer_list timer;\n  72:\t\t\t} nmea_emul;\n  73:\t\t};\n  74:\t};\n  75:\t\n  76:\tstatic const struct file_operations wwan_hwsim_debugfs_portdestroy_fops;\n  77:\tstatic const struct file_operations wwan_hwsim_debugfs_portcreate_fops;\n  78:\tstatic const struct file_operations wwan_hwsim_debugfs_devdestroy_fops;\n  79:\tstatic void wwan_hwsim_port_del_work(struct work_struct *work);\n  80:\tstatic void wwan_hwsim_dev_del_work(struct work_struct *work);\n"
}

							input: 20792
							output: 19
							thoughts: 106

**Investigating WWAN Driver Implementations**

Okay, so it seems `wwan_hwsim` has gone its own way, implementing its own WWAN port operations and network device operations. That's good to know. It means it's not relying on the more generic `mhi_wwan_mbim.c` or `t7xx_netdev.c` drivers. Now, the next logical step is to determine if those files, `mhi_wwan_mbim.c` and `t7xx_netdev.c`, are even *needed* in other areas of the system. I need to figure out where those specific modules are being used, if at all. My plan is to conduct a thorough search for any remaining references to either `mhi_wwan_mbim` or `t7xx` within the codebase. Hopefully, this will tell us how necessary they actually are.

{
  "Expression": "mhi_mbim"
}

{
  "Output": "drivers/net/wwan/mhi_wwan_mbim.c-45-\ndrivers/net/wwan/mhi_wwan_mbim.c:46:struct mhi_mbim_link {\ndrivers/net/wwan/mhi_wwan_mbim.c:47:\tstruct mhi_mbim_context *mbim;\ndrivers/net/wwan/mhi_wwan_mbim.c-48-\tstruct net_device *ndev;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-64-\ndrivers/net/wwan/mhi_wwan_mbim.c:65:struct mhi_mbim_context {\ndrivers/net/wwan/mhi_wwan_mbim.c-66-\tstruct mhi_device *mdev;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=78=struct mbim_tx_hdr {\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-83-\ndrivers/net/wwan/mhi_wwan_mbim.c:84:static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim,\ndrivers/net/wwan/mhi_wwan_mbim.c-85-\t\t\t\t\t\t   unsigned int session)\ndrivers/net/wwan/mhi_wwan_mbim.c-86-{\ndrivers/net/wwan/mhi_wwan_mbim.c:87:\tstruct mhi_mbim_link *link;\ndrivers/net/wwan/mhi_wwan_mbim.c-88-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-96-\ndrivers/net/wwan/mhi_wwan_mbim.c:97:static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl)\ndrivers/net/wwan/mhi_wwan_mbim.c-98-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=107=static struct sk_buff *mbim_tx_fixup(struct sk_buff *skb, unsigned int session,\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-150-\ndrivers/net/wwan/mhi_wwan_mbim.c:151:static netdev_tx_t mhi_mbim_ndo_xmit(struct sk_buff *skb, struct net_device *ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-152-{\ndrivers/net/wwan/mhi_wwan_mbim.c:153:\tstruct mhi_mbim_link *link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c:154:\tstruct mhi_mbim_context *mbim = link-\u003embim;\ndrivers/net/wwan/mhi_wwan_mbim.c-155-\tunsigned long flags;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-192-\ndrivers/net/wwan/mhi_wwan_mbim.c:193:static int mbim_rx_verify_nth16(struct mhi_mbim_context *mbim, struct sk_buff *skb)\ndrivers/net/wwan/mhi_wwan_mbim.c-194-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=231=static int mbim_rx_verify_ndp16(struct sk_buff *skb, struct usb_cdc_ncm_ndp16 *ndp16)\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-253-\ndrivers/net/wwan/mhi_wwan_mbim.c:254:static void mhi_mbim_rx(struct mhi_mbim_context *mbim, struct sk_buff *skb)\ndrivers/net/wwan/mhi_wwan_mbim.c-255-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-276-\t\tstruct usb_cdc_ncm_dpe16 dpe16;\ndrivers/net/wwan/mhi_wwan_mbim.c:277:\t\tstruct mhi_mbim_link *link;\ndrivers/net/wwan/mhi_wwan_mbim.c-278-\t\tint nframes, n, dpeoffset;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-304-\ndrivers/net/wwan/mhi_wwan_mbim.c:305:\t\tlink = mhi_mbim_get_link_rcu(mbim, session);\ndrivers/net/wwan/mhi_wwan_mbim.c-306-\t\tif (!link) {\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-378-\ndrivers/net/wwan/mhi_wwan_mbim.c:379:static struct sk_buff *mhi_net_skb_agg(struct mhi_mbim_context *mbim,\ndrivers/net/wwan/mhi_wwan_mbim.c-380-\t\t\t\t       struct sk_buff *skb)\n--\ndrivers/net/wwan/mhi_wwan_mbim.c=405=static void mhi_net_rx_refill_work(struct work_struct *work)\ndrivers/net/wwan/mhi_wwan_mbim.c-406-{\ndrivers/net/wwan/mhi_wwan_mbim.c:407:\tstruct mhi_mbim_context *mbim = container_of(work, struct mhi_mbim_context,\ndrivers/net/wwan/mhi_wwan_mbim.c-408-\t\t\t\t\t\t     rx_refill.work);\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-435-\ndrivers/net/wwan/mhi_wwan_mbim.c:436:static void mhi_mbim_dl_callback(struct mhi_device *mhi_dev,\ndrivers/net/wwan/mhi_wwan_mbim.c-437-\t\t\t\t struct mhi_result *mhi_res)\ndrivers/net/wwan/mhi_wwan_mbim.c-438-{\ndrivers/net/wwan/mhi_wwan_mbim.c:439:\tstruct mhi_mbim_context *mbim = dev_get_drvdata(\u0026mhi_dev-\u003edev);\ndrivers/net/wwan/mhi_wwan_mbim.c-440-\tstruct sk_buff *skb = mhi_res-\u003ebuf_addr;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-468-\ndrivers/net/wwan/mhi_wwan_mbim.c:469:\t\tmhi_mbim_rx(mbim, skb);\ndrivers/net/wwan/mhi_wwan_mbim.c-470-\t}\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-476-\ndrivers/net/wwan/mhi_wwan_mbim.c:477:static void mhi_mbim_ndo_get_stats64(struct net_device *ndev,\ndrivers/net/wwan/mhi_wwan_mbim.c-478-\t\t\t\t     struct rtnl_link_stats64 *stats)\ndrivers/net/wwan/mhi_wwan_mbim.c-479-{\ndrivers/net/wwan/mhi_wwan_mbim.c:480:\tstruct mhi_mbim_link *link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-481-\tunsigned int start;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-498-\ndrivers/net/wwan/mhi_wwan_mbim.c:499:static void mhi_mbim_ul_callback(struct mhi_device *mhi_dev,\ndrivers/net/wwan/mhi_wwan_mbim.c-500-\t\t\t\t struct mhi_result *mhi_res)\ndrivers/net/wwan/mhi_wwan_mbim.c-501-{\ndrivers/net/wwan/mhi_wwan_mbim.c:502:\tstruct mhi_mbim_context *mbim = dev_get_drvdata(\u0026mhi_dev-\u003edev);\ndrivers/net/wwan/mhi_wwan_mbim.c-503-\tstruct sk_buff *skb = mhi_res-\u003ebuf_addr;\ndrivers/net/wwan/mhi_wwan_mbim.c-504-\tstruct net_device *ndev = skb-\u003edev;\ndrivers/net/wwan/mhi_wwan_mbim.c:505:\tstruct mhi_mbim_link *link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-506-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-530-\ndrivers/net/wwan/mhi_wwan_mbim.c:531:static int mhi_mbim_ndo_open(struct net_device *ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-532-{\ndrivers/net/wwan/mhi_wwan_mbim.c:533:\tstruct mhi_mbim_link *link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-534-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-545-\ndrivers/net/wwan/mhi_wwan_mbim.c:546:static int mhi_mbim_ndo_stop(struct net_device *ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-547-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-553-\ndrivers/net/wwan/mhi_wwan_mbim.c:554:static const struct net_device_ops mhi_mbim_ndo = {\ndrivers/net/wwan/mhi_wwan_mbim.c:555:\t.ndo_open = mhi_mbim_ndo_open,\ndrivers/net/wwan/mhi_wwan_mbim.c:556:\t.ndo_stop = mhi_mbim_ndo_stop,\ndrivers/net/wwan/mhi_wwan_mbim.c:557:\t.ndo_start_xmit = mhi_mbim_ndo_xmit,\ndrivers/net/wwan/mhi_wwan_mbim.c:558:\t.ndo_get_stats64 = mhi_mbim_ndo_get_stats64,\ndrivers/net/wwan/mhi_wwan_mbim.c-559-};\ndrivers/net/wwan/mhi_wwan_mbim.c-560-\ndrivers/net/wwan/mhi_wwan_mbim.c:561:static int mhi_mbim_newlink(void *ctxt, struct net_device *ndev, u32 if_id,\ndrivers/net/wwan/mhi_wwan_mbim.c-562-\t\t\t    struct netlink_ext_ack *extack)\ndrivers/net/wwan/mhi_wwan_mbim.c-563-{\ndrivers/net/wwan/mhi_wwan_mbim.c:564:\tstruct mhi_mbim_link *link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c:565:\tstruct mhi_mbim_context *mbim = ctxt;\ndrivers/net/wwan/mhi_wwan_mbim.c-566-\ndrivers/net/wwan/mhi_wwan_mbim.c-567-\tlink-\u003embim = mbim;\ndrivers/net/wwan/mhi_wwan_mbim.c:568:\tlink-\u003esession = mhi_mbim_get_link_mux_id(link-\u003embim-\u003emdev-\u003emhi_cntrl) + if_id;\ndrivers/net/wwan/mhi_wwan_mbim.c-569-\tlink-\u003endev = ndev;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-573-\trcu_read_lock();\ndrivers/net/wwan/mhi_wwan_mbim.c:574:\tif (mhi_mbim_get_link_rcu(mbim, if_id)) {\ndrivers/net/wwan/mhi_wwan_mbim.c-575-\t\trcu_read_unlock();\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-585-\ndrivers/net/wwan/mhi_wwan_mbim.c:586:static void mhi_mbim_dellink(void *ctxt, struct net_device *ndev,\ndrivers/net/wwan/mhi_wwan_mbim.c-587-\t\t\t     struct list_head *head)\ndrivers/net/wwan/mhi_wwan_mbim.c-588-{\ndrivers/net/wwan/mhi_wwan_mbim.c:589:\tstruct mhi_mbim_link *link = wwan_netdev_drvpriv(ndev);\ndrivers/net/wwan/mhi_wwan_mbim.c-590-\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-596-\ndrivers/net/wwan/mhi_wwan_mbim.c:597:static void mhi_mbim_setup(struct net_device *ndev)\ndrivers/net/wwan/mhi_wwan_mbim.c-598-{\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-604-\tndev-\u003eflags = IFF_POINTOPOINT | IFF_NOARP;\ndrivers/net/wwan/mhi_wwan_mbim.c:605:\tndev-\u003enetdev_ops = \u0026mhi_mbim_ndo;\ndrivers/net/wwan/mhi_wwan_mbim.c-606-\tndev-\u003emtu = MHI_MBIM_DEFAULT_MTU;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-612-\ndrivers/net/wwan/mhi_wwan_mbim.c:613:static const struct wwan_ops mhi_mbim_wwan_ops = {\ndrivers/net/wwan/mhi_wwan_mbim.c:614:\t.priv_size = sizeof(struct mhi_mbim_link),\ndrivers/net/wwan/mhi_wwan_mbim.c:615:\t.setup = mhi_mbim_setup,\ndrivers/net/wwan/mhi_wwan_mbim.c:616:\t.newlink = mhi_mbim_newlink,\ndrivers/net/wwan/mhi_wwan_mbim.c:617:\t.dellink = mhi_mbim_dellink,\ndrivers/net/wwan/mhi_wwan_mbim.c-618-};\ndrivers/net/wwan/mhi_wwan_mbim.c-619-\ndrivers/net/wwan/mhi_wwan_mbim.c:620:static int mhi_mbim_probe(struct mhi_device *mhi_dev, const struct mhi_device_id *id)\ndrivers/net/wwan/mhi_wwan_mbim.c-621-{\ndrivers/net/wwan/mhi_wwan_mbim.c-622-\tstruct mhi_controller *cntrl = mhi_dev-\u003emhi_cntrl;\ndrivers/net/wwan/mhi_wwan_mbim.c:623:\tstruct mhi_mbim_context *mbim;\ndrivers/net/wwan/mhi_wwan_mbim.c-624-\tint err;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-645-\t/* Register wwan link ops with MHI controller representing WWAN instance */\ndrivers/net/wwan/mhi_wwan_mbim.c:646:\treturn wwan_register_ops(\u0026cntrl-\u003emhi_dev-\u003edev, \u0026mhi_mbim_wwan_ops, mbim, 0);\ndrivers/net/wwan/mhi_wwan_mbim.c-647-}\ndrivers/net/wwan/mhi_wwan_mbim.c-648-\ndrivers/net/wwan/mhi_wwan_mbim.c:649:static void mhi_mbim_remove(struct mhi_device *mhi_dev)\ndrivers/net/wwan/mhi_wwan_mbim.c-650-{\ndrivers/net/wwan/mhi_wwan_mbim.c:651:\tstruct mhi_mbim_context *mbim = dev_get_drvdata(\u0026mhi_dev-\u003edev);\ndrivers/net/wwan/mhi_wwan_mbim.c-652-\tstruct mhi_controller *cntrl = mhi_dev-\u003emhi_cntrl;\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-660-\ndrivers/net/wwan/mhi_wwan_mbim.c:661:static const struct mhi_device_id mhi_mbim_id_table[] = {\ndrivers/net/wwan/mhi_wwan_mbim.c-662-\t/* Hardware accelerated data PATH (to modem IPA), MBIM protocol */\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-665-};\ndrivers/net/wwan/mhi_wwan_mbim.c:666:MODULE_DEVICE_TABLE(mhi, mhi_mbim_id_table);\ndrivers/net/wwan/mhi_wwan_mbim.c-667-\ndrivers/net/wwan/mhi_wwan_mbim.c:668:static struct mhi_driver mhi_mbim_driver = {\ndrivers/net/wwan/mhi_wwan_mbim.c:669:\t.probe = mhi_mbim_probe,\ndrivers/net/wwan/mhi_wwan_mbim.c:670:\t.remove = mhi_mbim_remove,\ndrivers/net/wwan/mhi_wwan_mbim.c:671:\t.dl_xfer_cb = mhi_mbim_dl_callback,\ndrivers/net/wwan/mhi_wwan_mbim.c:672:\t.ul_xfer_cb = mhi_mbim_ul_callback,\ndrivers/net/wwan/mhi_wwan_mbim.c:673:\t.id_table = mhi_mbim_id_table,\ndrivers/net/wwan/mhi_wwan_mbim.c-674-\t.driver = {\n--\ndrivers/net/wwan/mhi_wwan_mbim.c-678-\ndrivers/net/wwan/mhi_wwan_mbim.c:679:module_mhi_driver(mhi_mbim_driver);\ndrivers/net/wwan/mhi_wwan_mbim.c-680-\n"
}

							input: 26197
							output: 42
							thoughts: 17

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating Network Device Driver Behavior**

Okay, so we're seeing something unusual in the network behavior. My first instinct, considering the potential points of failure, is to cast a wider net. I'm going to take a look at `t7xx_netdev.c` as well. This driver seems to be a key component and could very well be the root cause, or at least be involved in the cascade of issues we are currently seeing. It's time to dive into that specific module and start examining its functions and data structures. Let's see if we can identify any clues in its handling of packet transmission or reception, interrupt management, or resource allocation. We'll start with the obvious suspect areas and then dig deeper if needed.

{
  "Expression": "t7xx_ccmni_recv_skb",
  "PathPrefix": "drivers/net/wwan/t7xx"
}

{
  "Output": "drivers/net/wwan/t7xx/t7xx_netdev.c=399=static void init_md_status_notifier(struct t7xx_pci_dev *t7xx_dev)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c-411-\ndrivers/net/wwan/t7xx/t7xx_netdev.c:412:static void t7xx_ccmni_recv_skb(struct t7xx_ccmni_ctrl *ccmni_ctlb, struct sk_buff *skb,\ndrivers/net/wwan/t7xx/t7xx_netdev.c-413-\t\t\t\tstruct napi_struct *napi)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c=490=int t7xx_ccmni_init(struct t7xx_pci_dev *t7xx_dev)\n--\ndrivers/net/wwan/t7xx/t7xx_netdev.c-502-\tctlb-\u003ecallbacks.state_notify = t7xx_ccmni_queue_state_notify;\ndrivers/net/wwan/t7xx/t7xx_netdev.c:503:\tctlb-\u003ecallbacks.recv_skb = t7xx_ccmni_recv_skb;\ndrivers/net/wwan/t7xx/t7xx_netdev.c-504-\tctlb-\u003enic_dev_num = NIC_DEV_DEFAULT;\n"
}

							input: 26816
							output: 32
							thoughts: 130

**Analyzing MHI Drivers for Vulnerability Research**

Okay, let's dive into these drivers. My immediate question is, are we dealing with drivers specifically tied to physical PCIe hardware, or can I get away with fuzzing these in a standard virtualized environment like QEMU or GCE? That's the first thing I need to establish.

Now, let's take a closer look at `MHI_WWAN_MBIM`. Right, MHI stands for Modem Host Interface, a key piece of information. This points to Qualcomm PCIe modems – think Snapdragon X55, X62, X65, the kind that connect over PCIe. Good. That helps narrow the scope considerably.

To understand how the MHI controller is probed, I should probably check out `drivers/bus/mhi/host/pci_generic.c`. This is where the rubber meets the road, so to speak. This should give me a good handle on the initialization process.

{
  "Expression": "pci_register_driver",
  "PathPrefix": "drivers/bus/mhi"
}

{
  "error": "no matches"
}

							input: 27198
							output: 32
							thoughts: 15

Here's my thought process, as if I were considering this driver search:

**Diving into the MHI Driver Space**

Okay, so I need to track down some PCI drivers. My first instinct, given what I'm working on, is to look within the `drivers/bus/mhi` directory. That's usually the go-to location for anything related to the Mobile Host Interface (MHI) bus. Considering that I'm looking for PCI drivers, I'm hoping I find some drivers to interface with MHI devices. I'll need to check the typical subdirectories to see if there is any abstraction layers that would be helpful as a starting point. From there, I'll need to dig through the code itself to see what PCI devices are supported and how the driver interacts with the hardware.

{
  "Expression": "module_pci_driver",
  "PathPrefix": "drivers/bus/mhi"
}

{
  "Output": "drivers/bus/mhi/host/pci_generic.c=1767=static struct pci_driver mhi_pci_driver = {\n--\ndrivers/bus/mhi/host/pci_generic.c-1776-};\ndrivers/bus/mhi/host/pci_generic.c:1777:module_pci_driver(mhi_pci_driver);\ndrivers/bus/mhi/host/pci_generic.c-1778-\n"
}

							input: 27550
							output: 35
							thoughts: 24

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing `mhi_pci_driver` in `pci_generic.c`**

Okay, so I'm diving into `pci_generic.c` again. My immediate focus is on how the `mhi_pci_driver` is registered and initialized within this generic PCI framework. What specific functions are being called, and what structures are being populated to make the MHI (presumably Mobile Host Interface) device function correctly within the broader PCI context? I'm particularly interested in how the driver handles resource allocation – are we using standard PCI resource management, or are there custom hooks in place to deal with the MHI's specific memory-mapped I/O or interrupt requirements? Also, how does the driver interact with the PCI bus's configuration space? I want to see if we are dealing with interrupts correctly. Are we using standard PCI interrupt mechanisms, or does the MHI hardware necessitate a more intricate interrupt handling strategy? This will also give me clues on the platform requirements to see if this driver will work on a new target. I also want to see how the probe function is implemented; what does it look for in the device ID table, and how are any platform-specific dependencies handled there? Lastly, I'll be looking for any indications of error handling – how are PCI bus errors, device not present scenarios, or resource allocation failures dealt with within the context of this MHI driver? I should also ensure that the driver complies with the latest PCI specification versions and any relevant platform standards.

{
  "Expression": "mhi_pci_id_table",
  "PathPrefix": "drivers/bus/mhi"
}

{
  "Output": "drivers/bus/mhi/host/pci_generic.c=941=static const struct mhi_pci_dev_info mhi_netprisma_fcun69_info = {\n--\ndrivers/bus/mhi/host/pci_generic.c-951-/* Keep the list sorted based on the PID. New VID should be added as the last entry */\ndrivers/bus/mhi/host/pci_generic.c:952:static const struct pci_device_id mhi_pci_id_table[] = {\ndrivers/bus/mhi/host/pci_generic.c-953-\t{PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0116),\n--\ndrivers/bus/mhi/host/pci_generic.c-1086-};\ndrivers/bus/mhi/host/pci_generic.c:1087:MODULE_DEVICE_TABLE(pci, mhi_pci_id_table);\ndrivers/bus/mhi/host/pci_generic.c-1088-\n--\ndrivers/bus/mhi/host/pci_generic.c=1767=static struct pci_driver mhi_pci_driver = {\ndrivers/bus/mhi/host/pci_generic.c-1768-\t.name\t\t= \"mhi-pci-generic\",\ndrivers/bus/mhi/host/pci_generic.c:1769:\t.id_table\t= mhi_pci_id_table,\ndrivers/bus/mhi/host/pci_generic.c-1770-\t.probe\t\t= mhi_pci_probe,\n"
}

							input: 28365
							output: 20
							thoughts: 25

Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person:

**Investigating MHI Host Controllers**

Alright, so we've established the primary MHI host controller situation, but I need to make absolutely sure we haven't overlooked any other potential instances of MHI controller implementation in this system. My immediate concern is that there could be hidden MHI controller configurations: perhaps a virtual or platform-level controller interacting with the hardware, or even an endpoint-specific controller that we haven't identified yet. It's a critical next step. I need to comprehensively verify that our understanding of the MHI architecture is complete. I can't afford to miss any controller in the system. The next step is a deep dive into the firmware and hardware.

{
  "Expression": "mhi_register_controller"
}

{
  "Output": "Documentation/mhi/topology.rst=20=Below are the roles of the MHI controller driver:\n--\nDocumentation/mhi/topology.rst-24-* Allocates struct mhi_controller and registers with the MHI bus framework\nDocumentation/mhi/topology.rst:25:  with channel and event configurations using mhi_register_controller.\nDocumentation/mhi/topology.rst-26-* Initiates power on and shutdown sequence\n--\ndrivers/accel/qaic/mhi_controller.c=800=static int mhi_reset_and_async_power_up(struct mhi_controller *mhi_cntrl)\n--\ndrivers/accel/qaic/mhi_controller.c-826-\ndrivers/accel/qaic/mhi_controller.c:827:struct mhi_controller *qaic_mhi_register_controller(struct pci_dev *pci_dev, void __iomem *mhi_bar,\ndrivers/accel/qaic/mhi_controller.c-828-\t\t\t\t\t\t    int mhi_irq, bool shared_msi, int family)\n--\ndrivers/accel/qaic/mhi_controller.c-875-\tmhi_config.timeout_ms = mhi_timeout_ms;\ndrivers/accel/qaic/mhi_controller.c:876:\tret = mhi_register_controller(mhi_cntrl, \u0026mhi_config);\ndrivers/accel/qaic/mhi_controller.c-877-\tif (ret) {\ndrivers/accel/qaic/mhi_controller.c:878:\t\tpci_err(pci_dev, \"mhi_register_controller failed %d\\n\", ret);\ndrivers/accel/qaic/mhi_controller.c-879-\t\treturn ERR_PTR(ret);\n--\ndrivers/accel/qaic/mhi_controller.h-8-\ndrivers/accel/qaic/mhi_controller.h:9:struct mhi_controller *qaic_mhi_register_controller(struct pci_dev *pci_dev, void __iomem *mhi_bar,\ndrivers/accel/qaic/mhi_controller.h-10-\t\t\t\t\t\t    int mhi_irq, bool shared_msi, int family);\n--\ndrivers/accel/qaic/qaic_drv.c=570=static int qaic_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/accel/qaic/qaic_drv.c-596-\ndrivers/accel/qaic/qaic_drv.c:597:\tqdev-\u003emhi_cntrl = qaic_mhi_register_controller(pdev, qdev-\u003ebar_mhi, mhi_irq,\ndrivers/accel/qaic/qaic_drv.c-598-\t\t\t\t\t\t       qdev-\u003esingle_msi, config-\u003efamily);\n--\ndrivers/bus/mhi/host/init.c=881=static int parse_config(struct mhi_controller *mhi_cntrl,\n--\ndrivers/bus/mhi/host/init.c-918-\ndrivers/bus/mhi/host/init.c:919:int mhi_register_controller(struct mhi_controller *mhi_cntrl,\ndrivers/bus/mhi/host/init.c-920-\t\t\t    const struct mhi_controller_config *config)\n--\ndrivers/bus/mhi/host/init.c-1058-}\ndrivers/bus/mhi/host/init.c:1059:EXPORT_SYMBOL_GPL(mhi_register_controller);\ndrivers/bus/mhi/host/init.c-1060-\n--\ndrivers/bus/mhi/host/pci_generic.c=1365=static int mhi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/bus/mhi/host/pci_generic.c-1440-\ndrivers/bus/mhi/host/pci_generic.c:1441:\terr = mhi_register_controller(mhi_cntrl, mhi_cntrl_config);\ndrivers/bus/mhi/host/pci_generic.c-1442-\tif (err)\n--\ndrivers/net/wireless/ath/ath11k/mhi.c=335=int ath11k_mhi_register(struct ath11k_pci *ab_pci)\n--\ndrivers/net/wireless/ath/ath11k/mhi.c-409-\tab_pci-\u003emhi_pre_cb = MHI_CB_INVALID;\ndrivers/net/wireless/ath/ath11k/mhi.c:410:\tret = mhi_register_controller(mhi_ctrl, ath11k_mhi_config);\ndrivers/net/wireless/ath/ath11k/mhi.c-411-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath12k/mhi.c=187=int ath12k_mhi_register(struct ath12k_pci *ab_pci)\n--\ndrivers/net/wireless/ath/ath12k/mhi.c-264-\ndrivers/net/wireless/ath/ath12k/mhi.c:265:\tret = mhi_register_controller(mhi_ctrl, ab-\u003ehw_params-\u003emhi_config);\ndrivers/net/wireless/ath/ath12k/mhi.c-266-\tif (ret) {\n--\ninclude/linux/mhi.h=294=struct mhi_controller_config {\n--\ninclude/linux/mhi.h-385- * Fields marked as (required) need to be populated by the controller driver\ninclude/linux/mhi.h:386: * before calling mhi_register_controller(). For the fields marked as (optional)\ninclude/linux/mhi.h-387- * they can be populated depending on the usecase.\n--\ninclude/linux/mhi.h=550=void mhi_free_controller(struct mhi_controller *mhi_cntrl);\n--\ninclude/linux/mhi.h-552-/**\ninclude/linux/mhi.h:553: * mhi_register_controller - Register MHI controller\ninclude/linux/mhi.h-554- * @mhi_cntrl: MHI controller to register\n--\ninclude/linux/mhi.h-556- */\ninclude/linux/mhi.h:557:int mhi_register_controller(struct mhi_controller *mhi_cntrl,\ninclude/linux/mhi.h-558-\t\t\tconst struct mhi_controller_config *config);\n"
}

							input: 30286
							output: 34
							thoughts: 630

**Assessing the Fuzzability of WWAN Modem Drivers**

Okay, let's break this down. My goal is to determine if we can effectively fuzz either the `mhi_wwan_mbim` or `t7xx_netdev` drivers. Both are hardware drivers for physical PCIe WWAN modems, which immediately raises a flag. We need to be able to reach them without actual hardware.

First, let's review the drivers themselves: `mhi_wwan_mbim.c` handles Qualcomm PCIe modems, and `t7xx_netdev.c` deals with MediaTek T7xx devices, both of which require their respective physical PCI modems.

The critical question now becomes, can we trigger these drivers in an emulated environment, or are they inherently tied to the presence of physical hardware? Specifically, are these devices "structurally unreachable" according to the defined criteria, meaning they need real hardware not emulated by standard QEMU? That's the key.

Let's look at `mhi_wwan_mbim.c` first. The `mhi_mbim_probe` function appears to be the entry point. It's triggered when an MHI device matches `mhi_mbim_id_table` on the MHI bus. The MHI bus devices are created by MHI controllers. This seems to happen when the underlying physical PCIe device initializes the MHI channels. Packets are then handled through `mhi_mbim_rx` which itself is called from the MHI core when the transfer has completed from the hardware. It's a chain of events triggered by the PCI modem interacting with the MHI bus. This suggests that the initialization process is tied to the physical hardware.

Now, let's examine `t7xx_netdev.c`. The `t7xx_ccmni_recv_skb` function is called when the MTK T7xx PCIe device receives packets from the physical modem. The driver is registered as a PCI driver. This also implies a dependency on the presence of a physical PCI device. I need to check the PCI IDs within `t7xx_pci.c` to understand exactly which hardware the driver is tied to.

Based on this preliminary investigation, the initial impression is that both drivers are strongly coupled to their respective physical PCIe modems. Reaching them in an emulated environment may be challenging, and perhaps impossible, as they rely on the MHI bus or PCIe device enumeration and initialization, both of which require interaction with physical hardware. We'll need to carefully investigate the setup process to confirm this.

{
  "Expression": "PCI_DEVICE.*",
  "PathPrefix": "drivers/net/wwan/t7xx"
}

{
  "Output": "drivers/net/wwan/t7xx/t7xx_pci.c=943=static const struct pci_device_id t7xx_pci_table[] = {\ndrivers/net/wwan/t7xx/t7xx_pci.c:944:\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x4d75) },\ndrivers/net/wwan/t7xx/t7xx_pci.c:945:\t{ PCI_DEVICE(0x03f0, 0x09c8) }, // HP DRMR-H01\ndrivers/net/wwan/t7xx/t7xx_pci.c:946:\t{ PCI_DEVICE(0x14c0, 0x4d75) }, // Dell DW5933e\ndrivers/net/wwan/t7xx/t7xx_pci.c-947-\t{ }\n"
}

							input: 31748
							output: 147
							thoughts: 585

**Analysis of Vendor-Specific PCIe Modem Drivers for Fuzzing Feasibility**

Okay, let me break this down. My analysis tells me that the proposed patch affects two specific vendor-specific PCIe modem drivers: `mhi_wwan_mbim.c` and `t7xx/t7xx_netdev.c`. Specifically, we're looking at a Qualcomm PCIe modem MBIM network driver utilizing the MHI bus and a MediaTek T7xx series PCIe 5G WWAN modem driver, respectively.

The critical point, as I see it, is that neither of these devices, as far as I understand the common practices, can be meaningfully fuzzed within standard QEMU or GCE environments. They require *actual* physical hardware – a Qualcomm Snapdragon PCIe modem and a MediaTek T7xx PCIe modem, respectively. The commit diff confirms this, showing changes restricted to those two files, nothing else.

Therefore, because these drivers are structurally dependent on hardware unavailable in a typical syzkaller testing setup, this falls squarely under Section 2: "Structurally unreachable hardware." We're talking about drivers that demand physical PCIe cards not emulated in standard environments. This essentially classifies the code as unreachable.

Consequently, from my perspective, the `WorthFuzzing` flag should be set to `false`. Since the code paths are unreachable without the required hardware, fuzzing efforts would be wasted. And so, the `FocusSymbols` and `EnableConfigs` lists can safely remain empty, `[]`. If `WorthFuzzing` is `false`, empty lists are standard practice.

In short, I'll be setting this appropriately for the system to understand: these changes, while potentially interesting, don't represent a viable target for immediate fuzzing without specialized hardware. Time to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies drivers/net/wwan/mhi_wwan_mbim.c (Qualcomm MHI WWAN MBIM driver) and drivers/net/wwan/t7xx/t7xx_netdev.c (MediaTek PCIe 5G WWAN modem driver). Both drivers require vendor-specific physical PCIe WWAN modem hardware (Qualcomm and MediaTek T7xx) that is not emulated in standard virtualized environments (QEMU/GCE). As such, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)