AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific PCI/AHB driver for Qualcomm Wi-Fi 7 devices. Since there is no software emulation for this hardware in the kernel (like mac80211_hwsim for generic mac80211), the driver will fail to probe in virtualized environments like GCE or QEMU without the physical hardware. Consequently, the modified code in `ath12k_bss_assoc` is unreachable and cannot be fuzzed.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit e25a199231174db858e8a40e7ef668d4952fc65a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jul 17 04:04:49 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c\nindex 16339469c24cd8..7061041686508a 100644\n--- a/drivers/net/wireless/ath/ath12k/mac.c\n+++ b/drivers/net/wireless/ath/ath12k/mac.c\n@@ -3985,6 +3985,17 @@ static void ath12k_bss_assoc(struct ath12k *ar,\n \t\tath12k_warn(ar-\u003eab, \"failed to set vdev %i OBSS PD parameters: %d\\n\",\n \t\t\t    arvif-\u003evdev_id, ret);\n \n+\tif (ar-\u003eab-\u003ehw_params-\u003esupports_sta_ps \u0026\u0026\n+\t    ahvif-\u003evdev_type == WMI_VDEV_TYPE_STA \u0026\u0026\n+\t    ahvif-\u003evdev_subtype == WMI_VDEV_SUBTYPE_NONE) {\n+\t\tret = ath12k_wmi_vdev_set_param_cmd(ar, arvif-\u003evdev_id,\n+\t\t\t\t\t\t    WMI_VDEV_PARAM_DTIM_POLICY,\n+\t\t\t\t\t\t    WMI_DTIM_POLICY_STICK);\n+\t\tif (ret)\n+\t\t\tath12k_warn(ar-\u003eab, \"failed to set vdev %d stick DTIM policy: %d\\n\",\n+\t\t\t\t    arvif-\u003evdev_id, ret);\n+\t}\n+\n \tif (test_bit(WMI_TLV_SERVICE_11D_OFFLOAD, ar-\u003eab-\u003ewmi_ab.svc_map) \u0026\u0026\n \t    ahvif-\u003evdev_type == WMI_VDEV_TYPE_STA \u0026\u0026\n \t    ahvif-\u003evdev_subtype == WMI_VDEV_SUBTYPE_NONE)\ndiff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h\nindex 51f3426e1fcd92..0145cc477944fc 100644\n--- a/drivers/net/wireless/ath/ath12k/wmi.h\n+++ b/drivers/net/wireless/ath/ath12k/wmi.h\n@@ -2330,6 +2330,13 @@ enum wmi_slot_time {\n \tWMI_VDEV_SLOT_TIME_SHORT = 2,\n };\n \n+enum wmi_dtim_policy {\n+\tWMI_DTIM_POLICY_IGNORE = 1,\n+\tWMI_DTIM_POLICY_NORMAL = 2,\n+\tWMI_DTIM_POLICY_STICK  = 3,\n+\tWMI_DTIM_POLICY_AUTO   = 4,\n+};\n+\n enum wmi_preamble {\n \tWMI_VDEV_PREAMBLE_LONG = 1,\n \tWMI_VDEV_PREAMBLE_SHORT = 2,\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific PCI/AHB driver for Qualcomm Wi-Fi 7 devices. Since there is no software emulation for this hardware in the kernel (like mac80211_hwsim for generic mac80211), the driver will fail to probe in virtualized environments like GCE or QEMU without the physical hardware. Consequently, the modified code in `ath12k_bss_assoc` is unreachable and cannot be fuzzed.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e25a199231174db858e8a40e7ef668d4952fc65a
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jul 17 04:04:49 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 16339469c24cd8..7061041686508a 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -3985,6 +3985,17 @@ static void ath12k_bss_assoc(struct ath12k *ar,
 		ath12k_warn(ar->ab, "failed to set vdev %i OBSS PD parameters: %d\n",
 			    arvif->vdev_id, ret);
 
+	if (ar->ab->hw_params->supports_sta_ps &&
+	    ahvif->vdev_type == WMI_VDEV_TYPE_STA &&
+	    ahvif->vdev_subtype == WMI_VDEV_SUBTYPE_NONE) {
+		ret = ath12k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+						    WMI_VDEV_PARAM_DTIM_POLICY,
+						    WMI_DTIM_POLICY_STICK);
+		if (ret)
+			ath12k_warn(ar->ab, "failed to set vdev %d stick DTIM policy: %d\n",
+				    arvif->vdev_id, ret);
+	}
+
 	if (test_bit(WMI_TLV_SERVICE_11D_OFFLOAD, ar->ab->wmi_ab.svc_map) &&
 	    ahvif->vdev_type == WMI_VDEV_TYPE_STA &&
 	    ahvif->vdev_subtype == WMI_VDEV_SUBTYPE_NONE)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h
index 51f3426e1fcd92..0145cc477944fc 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.h
+++ b/drivers/net/wireless/ath/ath12k/wmi.h
@@ -2330,6 +2330,13 @@ enum wmi_slot_time {
 	WMI_VDEV_SLOT_TIME_SHORT = 2,
 };
 
+enum wmi_dtim_policy {
+	WMI_DTIM_POLICY_IGNORE = 1,
+	WMI_DTIM_POLICY_NORMAL = 2,
+	WMI_DTIM_POLICY_STICK  = 3,
+	WMI_DTIM_POLICY_AUTO   = 4,
+};
+
 enum wmi_preamble {
 	WMI_VDEV_PREAMBLE_LONG = 1,
 	WMI_VDEV_PREAMBLE_SHORT = 2,

gemini-3.1-pro-preview

null

null

							input: 2397
							output: 39
							thoughts: 250
						

**Analyzing a Patch to a Qualcomm Wi-Fi 7 Driver**

Okay, so I'm looking at this patch that tweaks `ath12k` – specifically, it's adding a call to `ath12k_wmi_vdev_set_param_cmd` for `WMI_VDEV_PARAM_DTIM_POLICY` with `WMI_DTIM_POLICY_STICK` within `ath12k_bss_assoc`. This looks like a very targeted change within the `ath12k` driver. My initial thought is, "Can we fuzz this?"

Since `ath12k` handles hardware, specifically for Qualcomm Wi-Fi 7 devices, I have to consider the fuzzability landscape. Hardware drivers, especially PCI/AHB ones, are notoriously difficult to fuzz directly unless we're dealing with a specific emulator or a USB driver that we can hit with `dummy_hcd`. But it sounds like this is a PCI/AHB driver.

Time to confirm my suspicions and verify that it’s not USB. I'll need to check the Kconfig file for the `ath12k` driver.

{
  "Expression": "ath12k",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/Kconfig"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/Kconfig=2=config ATH12K\ndrivers/net/wireless/ath/ath12k/Kconfig:3:\ttristate \"Qualcomm Wi-Fi 7 support (ath12k)\"\ndrivers/net/wireless/ath/ath12k/Kconfig-4-\tdepends on MAC80211 \u0026\u0026 HAS_DMA \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-14-\ndrivers/net/wireless/ath/ath12k/Kconfig:15:\t  If you choose to build a module, it'll be called ath12k.\ndrivers/net/wireless/ath/ath12k/Kconfig-16-\ndrivers/net/wireless/ath/ath12k/Kconfig=17=config ATH12K_AHB\ndrivers/net/wireless/ath/ath12k/Kconfig:18:\tbool \"Qualcomm ath12k AHB support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-19-\tdepends on ATH12K \u0026\u0026 REMOTEPROC\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=25=config ATH12K_DEBUG\ndrivers/net/wireless/ath/ath12k/Kconfig:26:\tbool \"ath12k debugging\"\ndrivers/net/wireless/ath/ath12k/Kconfig-27-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=35=config ATH12K_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig:36:\tbool \"Qualcomm ath12k debugfs support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-37-\tdepends on ATH12K \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig-38-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:39:\t  Enable ath12k debugfs support\ndrivers/net/wireless/ath/ath12k/Kconfig-40-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=44=config ATH12K_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig:45:\tbool \"ath12k tracing support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-46-\tdepends on ATH12K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig-47-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:48:\t  Enable ath12k tracing infrastructure.\ndrivers/net/wireless/ath/ath12k/Kconfig-49-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=53=config ATH12K_COREDUMP\ndrivers/net/wireless/ath/ath12k/Kconfig:54:\tbool \"ath12k coredump\"\ndrivers/net/wireless/ath/ath12k/Kconfig-55-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-57-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:58:\t  Enable ath12k coredump collection\ndrivers/net/wireless/ath/ath12k/Kconfig-59-\n"
}

gemini-3.1-pro-preview

null

null

							input: 3796
							output: 37
							thoughts: 87
						

**Considering the Architecture and Environment**

Okay, so I'm thinking through this driver. My initial assessment hinges on understanding the interplay between PCI and AHB – that's fundamental. Specifically, this driver is tailored for Qualcomm Wi-Fi 7 devices. Knowing this, I immediately recognize it's a hardware driver, meaning it's designed to directly interface with physical hardware.

The question then becomes: can I even *access* this driver in a virtualized environment? Platforms like Google Compute Engine (GCE) or QEMU are common, but they abstract away from the physical layer. Unless there's a specific emulator built for this particular 'ath12k' component, the answer is likely no – I won't be able to interact with it directly. Therefore, I need to check – are there any emulators out there that specifically target ath12k? That's the key to making any progress in a virtual setting.

{
  "Expression": "ath12k",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 34948 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath12k/Kconfig=2=config ATH12K\ndrivers/net/wireless/ath/ath12k/Kconfig:3:\ttristate \"Qualcomm Wi-Fi 7 support (ath12k)\"\ndrivers/net/wireless/ath/ath12k/Kconfig-4-\tdepends on MAC80211 \u0026\u0026 HAS_DMA \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-14-\ndrivers/net/wireless/ath/ath12k/Kconfig:15:\t  If you choose to build a module, it'll be called ath12k.\ndrivers/net/wireless/ath/ath12k/Kconfig-16-\ndrivers/net/wireless/ath/ath12k/Kconfig=17=config ATH12K_AHB\ndrivers/net/wireless/ath/ath12k/Kconfig:18:\tbool \"Qualcomm ath12k AHB support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-19-\tdepends on ATH12K \u0026\u0026 REMOTEPROC\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=25=config ATH12K_DEBUG\ndrivers/net/wireless/ath/ath12k/Kconfig:26:\tbool \"ath12k debugging\"\ndrivers/net/wireless/ath/ath12k/Kconfig-27-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=35=config ATH12K_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig:36:\tbool \"Qualcomm ath12k debugfs support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-37-\tdepends on ATH12K \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig-38-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:39:\t  Enable ath12k debugfs support\ndrivers/net/wireless/ath/ath12k/Kconfig-40-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=44=config ATH12K_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig:45:\tbool \"ath12k tracing support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-46-\tdepends on ATH12K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig-47-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:48:\t  Enable ath12k tracing infrastructure.\ndrivers/net/wireless/ath/ath12k/Kconfig-49-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=53=config ATH12K_COREDUMP\ndrivers/net/wireless/ath/ath12k/Kconfig:54:\tbool \"ath12k coredump\"\ndrivers/net/wireless/ath/ath12k/Kconfig-55-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-57-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:58:\t  Enable ath12k coredump collection\ndrivers/net/wireless/ath/ath12k/Kconfig-59-\n--\ndrivers/net/wireless/ath/ath12k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath12k/Makefile:2:obj-$(CONFIG_ATH12K) += ath12k.o\ndrivers/net/wireless/ath/ath12k/Makefile:3:ath12k-y += core.o \\\ndrivers/net/wireless/ath/ath12k/Makefile-4-\t    hal.o \\\n--\ndrivers/net/wireless/ath/ath12k/Makefile-24-\ndrivers/net/wireless/ath/ath12k/Makefile:25:ath12k-$(CONFIG_ATH12K_AHB) += ahb.o\ndrivers/net/wireless/ath/ath12k/Makefile-26-\ndrivers/net/wireless/ath/ath12k/Makefile=27=obj-$(CONFIG_ATH12K) += wifi7/\ndrivers/net/wireless/ath/ath12k/Makefile-28-\ndrivers/net/wireless/ath/ath12k/Makefile:29:ath12k-$(CONFIG_ATH12K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath12k/Makefile:30:ath12k-$(CONFIG_ACPI) += acpi.o\ndrivers/net/wireless/ath/ath12k/Makefile:31:ath12k-$(CONFIG_ATH12K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath12k/Makefile:32:ath12k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath12k/Makefile:33:ath12k-$(CONFIG_ATH12K_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath12k/Makefile:34:ath12k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath12k/Makefile:35:ath12k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath12k/Makefile-36-\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-10-\ndrivers/net/wireless/ath/ath12k/acpi.c:11:static int ath12k_acpi_dsm_get_data(struct ath12k_base *ab, int func)\ndrivers/net/wireless/ath/ath12k/acpi.c-12-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-18-\tif (!root_handle) {\ndrivers/net/wireless/ath/ath12k/acpi.c:19:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"invalid acpi handler\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-20-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-26-\tif (!obj) {\ndrivers/net/wireless/ath/ath12k/acpi.c:27:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"acpi_evaluate_dsm() failed\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-28-\t\treturn -ENOENT;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-46-\t\t\t\t   ATH12K_ACPI_BDF_ANCHOR_STRING_LEN)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:47:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM BDF size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-48-\t\t\t\t\t    obj-\u003estring.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-62-\t\t\t    obj-\u003ebuffer.length \u003e ATH12K_ACPI_DSM_FUNC_MAX_BITMAP_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:63:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM func size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-64-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-75-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_TAS_CFG_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:76:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM TAS config size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-77-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-87-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_TAS_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:88:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM TAS data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-89-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-99-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_BIOS_SAR_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:100:\t\t\t\tath12k_warn(ab, \"invalid ACPI BIOS SAR data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-101-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-111-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_GEO_OFFSET_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:112:\t\t\t\tath12k_warn(ab, \"invalid ACPI GEO OFFSET data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-113-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-123-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_CCA_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:124:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM CCA data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-125-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-135-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_BAND_EDGE_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:136:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM band edge data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-137-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-147-\t} else {\ndrivers/net/wireless/ath/ath12k/acpi.c:148:\t\tath12k_warn(ab, \"ACPI DSM method returned an unsupported object type: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-149-\t\t\t    obj-\u003etype);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-160-\ndrivers/net/wireless/ath/ath12k/acpi.c:161:static int ath12k_acpi_set_power_limit(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-162-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-167-\t    tas_sar_power_table[1] != ATH12K_ACPI_TAS_DATA_ENABLE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:168:\t\tath12k_warn(ab, \"latest ACPI TAS data is invalid\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-169-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-171-\ndrivers/net/wireless/ath/ath12k/acpi.c:172:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_DATA_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-173-\t\t\t\t      tas_sar_power_table,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-175-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:176:\t\tath12k_warn(ab, \"failed to send ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-177-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-182-\ndrivers/net/wireless/ath/ath12k/acpi.c:183:static int ath12k_acpi_set_bios_sar_power(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-184-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-188-\t    ab-\u003eacpi.bios_sar_data[1] != ATH12K_ACPI_POWER_LIMIT_ENABLE_FLAG) {\ndrivers/net/wireless/ath/ath12k/acpi.c:189:\t\tath12k_warn(ab, \"invalid latest ACPI BIOS SAR data\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-190-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-192-\ndrivers/net/wireless/ath/ath12k/acpi.c:193:\tret = ath12k_wmi_set_bios_sar_cmd(ab, ab-\u003eacpi.bios_sar_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-194-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:195:\t\tath12k_warn(ab, \"failed to set ACPI BIOS SAR table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-196-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-201-\ndrivers/net/wireless/ath/ath12k/acpi.c:202:static void ath12k_acpi_dsm_notify(acpi_handle handle, u32 event, void *data)\ndrivers/net/wireless/ath/ath12k/acpi.c-203-{\ndrivers/net/wireless/ath/ath12k/acpi.c-204-\tint ret;\ndrivers/net/wireless/ath/ath12k/acpi.c:205:\tstruct ath12k_base *ab = data;\ndrivers/net/wireless/ath/ath12k/acpi.c-206-\ndrivers/net/wireless/ath/ath12k/acpi.c-207-\tif (event == ATH12K_ACPI_NOTIFY_EVENT) {\ndrivers/net/wireless/ath/ath12k/acpi.c:208:\t\tath12k_warn(ab, \"unknown acpi notify %u\\n\", event);\ndrivers/net/wireless/ath/ath12k/acpi.c-209-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-212-\tif (!ab-\u003eacpi.acpi_tas_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:213:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"acpi_tas_enable is false\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-214-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-216-\ndrivers/net/wireless/ath/ath12k/acpi.c:217:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_DATA);\ndrivers/net/wireless/ath/ath12k/acpi.c-218-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:219:\t\tath12k_warn(ab, \"failed to update ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-220-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-222-\ndrivers/net/wireless/ath/ath12k/acpi.c:223:\tret = ath12k_acpi_set_power_limit(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-224-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:225:\t\tath12k_warn(ab, \"failed to set ACPI TAS power limit data: %d\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-226-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-231-\ndrivers/net/wireless/ath/ath12k/acpi.c:232:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BIOS_SAR);\ndrivers/net/wireless/ath/ath12k/acpi.c-233-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:234:\t\tath12k_warn(ab, \"failed to update BIOS SAR: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-235-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-237-\ndrivers/net/wireless/ath/ath12k/acpi.c:238:\tret = ath12k_acpi_set_bios_sar_power(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-239-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:240:\t\tath12k_warn(ab, \"failed to set BIOS SAR power limit: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-241-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-244-\ndrivers/net/wireless/ath/ath12k/acpi.c:245:static int ath12k_acpi_set_bios_sar_params(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-246-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-248-\ndrivers/net/wireless/ath/ath12k/acpi.c:249:\tret = ath12k_wmi_set_bios_sar_cmd(ab, ab-\u003eacpi.bios_sar_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-250-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:251:\t\tath12k_warn(ab, \"failed to set ACPI BIOS SAR table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-252-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-254-\ndrivers/net/wireless/ath/ath12k/acpi.c:255:\tret = ath12k_wmi_set_bios_geo_cmd(ab, ab-\u003eacpi.geo_offset_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-256-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:257:\t\tath12k_warn(ab, \"failed to set ACPI BIOS GEO table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-258-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-263-\ndrivers/net/wireless/ath/ath12k/acpi.c:264:static int ath12k_acpi_set_tas_params(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-265-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-267-\ndrivers/net/wireless/ath/ath12k/acpi.c:268:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_CONFIG_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-269-\t\t\t\t      ab-\u003eacpi.tas_cfg,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-271-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:272:\t\tath12k_warn(ab, \"failed to send ACPI TAS config table parameter: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-273-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-276-\ndrivers/net/wireless/ath/ath12k/acpi.c:277:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_DATA_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-278-\t\t\t\t      ab-\u003eacpi.tas_sar_power_table,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-280-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:281:\t\tath12k_warn(ab, \"failed to send ACPI TAS data table parameter: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-282-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-288-\ndrivers/net/wireless/ath/ath12k/acpi.c:289:bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-290-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-293-\ndrivers/net/wireless/ath/ath12k/acpi.c:294:bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-295-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-298-\ndrivers/net/wireless/ath/ath12k/acpi.c:299:void ath12k_acpi_set_dsm_func(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-300-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-308-\tif (ab-\u003eacpi.acpi_tas_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:309:\t\tret = ath12k_acpi_set_tas_params(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-310-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:311:\t\t\tath12k_warn(ab, \"failed to send ACPI TAS parameters: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-312-\t\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-316-\tif (ab-\u003eacpi.acpi_bios_sar_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:317:\t\tret = ath12k_acpi_set_bios_sar_params(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-318-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:319:\t\t\tath12k_warn(ab, \"failed to send ACPI BIOS SAR: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-320-\t\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-325-\t\tbuf = ab-\u003eacpi.cca_data + ATH12K_ACPI_CCA_THR_OFFSET_DATA_OFFSET;\ndrivers/net/wireless/ath/ath12k/acpi.c:326:\t\tret = ath12k_wmi_set_bios_cmd(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-327-\t\t\t\t\t      WMI_BIOS_PARAM_CCA_THRESHOLD_TYPE,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-330-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:331:\t\t\tath12k_warn(ab, \"failed to set ACPI DSM CCA threshold: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-332-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-337-\tif (ab-\u003eacpi.acpi_band_edge_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:338:\t\tret = ath12k_wmi_set_bios_cmd(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-339-\t\t\t\t\t      WMI_BIOS_PARAM_TYPE_BANDEDGE,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-342-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:343:\t\t\tath12k_warn(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-344-\t\t\t\t    \"failed to set ACPI DSM band edge channel power: %d\\n\",\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-350-\ndrivers/net/wireless/ath/ath12k/acpi.c:351:int ath12k_acpi_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-352-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-368-\ndrivers/net/wireless/ath/ath12k/acpi.c:369:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_SUPPORT_FUNCS);\ndrivers/net/wireless/ath/ath12k/acpi.c-370-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:371:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"failed to get ACPI DSM data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-372-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-375-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_DISABLE_FLAG)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:376:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_DISABLE_FLAG);\ndrivers/net/wireless/ath/ath12k/acpi.c-377-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:378:\t\t\tath12k_warn(ab, \"failed to get ACPI DISABLE FLAG: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-379-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-391-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_BDF_EXT)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:392:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BDF_EXT);\ndrivers/net/wireless/ath/ath12k/acpi.c-393-\t\tif (ret || ab-\u003eacpi.bdf_string[0] == '\\0') {\ndrivers/net/wireless/ath/ath12k/acpi.c:394:\t\t\tath12k_warn(ab, \"failed to get ACPI BDF EXT: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-395-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-401-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_TAS_CFG)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:402:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_CFG);\ndrivers/net/wireless/ath/ath12k/acpi.c-403-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:404:\t\t\tath12k_warn(ab, \"failed to get ACPI TAS config table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-405-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-409-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_TAS_DATA)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:410:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_DATA);\ndrivers/net/wireless/ath/ath12k/acpi.c-411-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:412:\t\t\tath12k_warn(ab, \"failed to get ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-413-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-422-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_BIOS_SAR)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:423:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BIOS_SAR);\ndrivers/net/wireless/ath/ath12k/acpi.c-424-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:425:\t\t\tath12k_warn(ab, \"failed to get ACPI bios sar data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-426-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-430-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_GEO_OFFSET)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:431:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_GEO_OFFSET);\ndrivers/net/wireless/ath/ath12k/acpi.c-432-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:433:\t\t\tath12k_warn(ab, \"failed to get ACPI geo offset data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-434-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-444-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_CCA)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:445:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_INDEX_CCA);\ndrivers/net/wireless/ath/ath12k/acpi.c-446-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:447:\t\t\tath12k_warn(ab, \"failed to get ACPI DSM CCA threshold configuration: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-448-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-459-\t\t\t\t       ATH12K_ACPI_FUNC_BIT_BAND_EDGE_CHAN_POWER)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:460:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_INDEX_BAND_EDGE);\ndrivers/net/wireless/ath/ath12k/acpi.c-461-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:462:\t\t\tath12k_warn(ab, \"failed to get ACPI DSM band edge channel power: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-463-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-473-\t\t\t\t\t     ACPI_DEVICE_NOTIFY,\ndrivers/net/wireless/ath/ath12k/acpi.c:474:\t\t\t\t\t     ath12k_acpi_dsm_notify, ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-475-\tif (ACPI_FAILURE(status)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:476:\t\tath12k_warn(ab, \"failed to install DSM notify callback: %d\\n\", status);\ndrivers/net/wireless/ath/ath12k/acpi.c-477-\t\treturn -EIO;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-484-\ndrivers/net/wireless/ath/ath12k/acpi.c:485:int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-486-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-492-\tif (strscpy(ab-\u003eqmi.target.bdf_ext, ab-\u003eacpi.bdf_string + 4, max_len) \u003c 0)\ndrivers/net/wireless/ath/ath12k/acpi.c:493:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT,\ndrivers/net/wireless/ath/ath12k/acpi.c-494-\t\t\t   \"acpi bdf variant longer than the buffer (variant: %s)\\n\",\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-499-\ndrivers/net/wireless/ath/ath12k/acpi.c:500:void ath12k_acpi_stop(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-501-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-506-\t\t\t\t   ACPI_DEVICE_NOTIFY,\ndrivers/net/wireless/ath/ath12k/acpi.c:507:\t\t\t\t   ath12k_acpi_dsm_notify);\ndrivers/net/wireless/ath/ath12k/acpi.c-508-\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-74-\ndrivers/net/wireless/ath/ath12k/acpi.h:75:int ath12k_acpi_start(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:76:void ath12k_acpi_stop(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:77:bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:78:bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:79:void ath12k_acpi_set_dsm_func(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:80:int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h-81-\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-83-\ndrivers/net/wireless/ath/ath12k/acpi.h:84:static inline int ath12k_acpi_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-85-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-88-\ndrivers/net/wireless/ath/ath12k/acpi.h:89:static inline void ath12k_acpi_stop(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-90-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-92-\ndrivers/net/wireless/ath/ath12k/acpi.h:93:static inline bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-94-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-97-\ndrivers/net/wireless/ath/ath12k/acpi.h:98:static inline bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-99-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-102-\ndrivers/net/wireless/ath/ath12k/acpi.h:103:static inline void ath12k_acpi_set_dsm_func(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-104-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-106-\ndrivers/net/wireless/ath/ath12k/acpi.h:107:static inline int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-108-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-21-\ndrivers/net/wireless/ath/ath12k/ahb.c:22:static struct ath12k_ahb_driver *ath12k_ahb_family_drivers[ATH12K_DEVICE_FAMILY_MAX];\ndrivers/net/wireless/ath/ath12k/ahb.c:23:static const char ath12k_userpd_irq[][9] = {\"spawn\",\ndrivers/net/wireless/ath/ath12k/ahb.c-24-\t\t\t\t     \"ready\",\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=83=enum ext_irq_num {\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-122-\ndrivers/net/wireless/ath/ath12k/ahb.c:123:static u32 ath12k_ahb_read32(struct ath12k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-124-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-129-\ndrivers/net/wireless/ath/ath12k/ahb.c:130:static void ath12k_ahb_write32(struct ath12k_base *ab, u32 offset,\ndrivers/net/wireless/ath/ath12k/ahb.c-131-\t\t\t       u32 value)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-138-\ndrivers/net/wireless/ath/ath12k/ahb.c:139:static void ath12k_ahb_cancel_workqueue(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-140-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-143-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:144:\t\tstruct ath12k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-145-\ndrivers/net/wireless/ath/ath12k/ahb.c:146:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-147-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-152-\ndrivers/net/wireless/ath/ath12k/ahb.c:153:static void ath12k_ahb_ext_grp_disable(struct ath12k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath12k/ahb.c-154-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-160-\ndrivers/net/wireless/ath/ath12k/ahb.c:161:static void __ath12k_ahb_ext_irq_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-162-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-165-\tfor (i = 0; i \u003c ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:166:\t\tstruct ath12k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-167-\ndrivers/net/wireless/ath/ath12k/ahb.c:168:\t\tath12k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath12k/ahb.c-169-\t\tif (irq_grp-\u003enapi_enabled) {\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-176-\ndrivers/net/wireless/ath/ath12k/ahb.c:177:static void ath12k_ahb_ext_grp_enable(struct ath12k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath12k/ahb.c-178-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-184-\ndrivers/net/wireless/ath/ath12k/ahb.c:185:static void ath12k_ahb_setbit32(struct ath12k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-186-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-188-\ndrivers/net/wireless/ath/ath12k/ahb.c:189:\tval = ath12k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath12k/ahb.c:190:\tath12k_ahb_write32(ab, offset, val | BIT(bit));\ndrivers/net/wireless/ath/ath12k/ahb.c-191-}\ndrivers/net/wireless/ath/ath12k/ahb.c-192-\ndrivers/net/wireless/ath/ath12k/ahb.c:193:static void ath12k_ahb_clearbit32(struct ath12k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-194-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-196-\ndrivers/net/wireless/ath/ath12k/ahb.c:197:\tval = ath12k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath12k/ahb.c:198:\tath12k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath12k/ahb.c-199-}\ndrivers/net/wireless/ath/ath12k/ahb.c-200-\ndrivers/net/wireless/ath/ath12k/ahb.c:201:static void ath12k_ahb_ce_irq_enable(struct ath12k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath12k/ahb.c-202-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-212-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath12k/ahb.c:213:\t\tath12k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c-214-\ndrivers/net/wireless/ath/ath12k/ahb.c-215-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath12k/ahb.c:216:\t\tath12k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c:217:\t\tath12k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath12k/ahb.c-218-\t\t\t\t    ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-221-\ndrivers/net/wireless/ath/ath12k/ahb.c:222:static void ath12k_ahb_ce_irq_disable(struct ath12k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath12k/ahb.c-223-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-233-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath12k/ahb.c:234:\t\tath12k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c-235-\ndrivers/net/wireless/ath/ath12k/ahb.c-236-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath12k/ahb.c:237:\t\tath12k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c:238:\t\tath12k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath12k/ahb.c-239-\t\t\t\t      ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-242-\ndrivers/net/wireless/ath/ath12k/ahb.c:243:static void ath12k_ahb_sync_ce_irqs(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-244-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-248-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:249:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-250-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-256-\ndrivers/net/wireless/ath/ath12k/ahb.c:257:static void ath12k_ahb_sync_ext_irqs(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-258-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-262-\tfor (i = 0; i \u003c ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:263:\t\tstruct ath12k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-264-\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-271-\ndrivers/net/wireless/ath/ath12k/ahb.c:272:static void ath12k_ahb_ce_irqs_enable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-273-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-276-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:277:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-278-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath12k/ahb.c:279:\t\tath12k_ahb_ce_irq_enable(ab, i);\ndrivers/net/wireless/ath/ath12k/ahb.c-280-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-282-\ndrivers/net/wireless/ath/ath12k/ahb.c:283:static void ath12k_ahb_ce_irqs_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-284-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-287-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:288:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-289-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath12k/ahb.c:290:\t\tath12k_ahb_ce_irq_disable(ab, i);\ndrivers/net/wireless/ath/ath12k/ahb.c-291-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-293-\ndrivers/net/wireless/ath/ath12k/ahb.c:294:static int ath12k_ahb_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-295-{\ndrivers/net/wireless/ath/ath12k/ahb.c:296:\tath12k_ahb_ce_irqs_enable(ab);\ndrivers/net/wireless/ath/ath12k/ahb.c:297:\tath12k_ce_rx_post_buf(ab);\ndrivers/net/wireless/ath/ath12k/ahb.c-298-\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-301-\ndrivers/net/wireless/ath/ath12k/ahb.c:302:static void ath12k_ahb_ext_irq_enable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-303-{\ndrivers/net/wireless/ath/ath12k/ahb.c:304:\tstruct ath12k_ext_irq_grp *irq_grp;\ndrivers/net/wireless/ath/ath12k/ahb.c-305-\tint i;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-312-\t\t}\ndrivers/net/wireless/ath/ath12k/ahb.c:313:\t\tath12k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath12k/ahb.c-314-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-316-\ndrivers/net/wireless/ath/ath12k/ahb.c:317:static void ath12k_ahb_ext_irq_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-318-{\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 18864
							output: 41
							thoughts: 236
						

**Fuzzing the `ath12k` Driver: A Thought Process**

Okay, so I'm looking at this `ath12k` driver. It's a hardware driver, which usually presents a challenge for fuzzing. Unless it's a USB driver, or we have a solid emulator, fuzzing these things is typically a dead end. But, wait... `ath12k` is a PCI/AHB driver, which *could* be promising. Is there some hidden test mode or debug flag I can leverage?

Let me see… aha! There it is: `ath12k-$(CONFIG_NL80211_TESTMODE) += testmode.o`. But I’ve dealt with testmode before; It’s generally for passing commands, not a full-blown hardware emulator. It's not a silver bullet. 

Also, the patch is touching `ath12k_bss_assoc`. This function gets called during association, so how am I going to get to it in the first place? If the hardware isn't physically present, the driver won’t even probe, and `ath12k_bss_assoc` remains untouched.

Right. I know `mac80211_hwsim` emulates MAC80211, but the `ath12k` driver is a full MAC driver, or at least it registers to mac80211, but fundamentally relies on the real hardware for probing. So the usual tricks won't work.

Alright, time to get practical. The question is, can I trick the system into probing `ath12k` without the physical hardware being present? I'll need to figure out how to load this thing in a controlled environment. Let's see...

no matches

{
  "Expression": "ath12k_core_probe",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 19536
							output: 42
							thoughts: 27
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Checking the Probe Functions**

Alright, let's get down to brass tacks. I'm thinking, "Where do we start troubleshooting this particular ath12k issue?" My immediate thought is to zero in on the core of the device initialization. So, the first place I'm going to look is either `ath12k_pci_probe` or `ath12k_ahb_probe`. These are the entry points – the functions that are called when the driver is attempting to initialize a PCI or AHB-based ath12k device, respectively. Knowing which one is relevant is crucial to understanding the path of execution. From there I can follow the control flow, look at the error codes and logs, and piece together the sequence that is failing. It's the first step to narrowing down the root cause.

{
  "Expression": "ath12k_pci_probe",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/pci.c=1513=ath12k_get_device_family(const struct pci_device_id *pci_dev)\n--\ndrivers/net/wireless/ath/ath12k/pci.c-1533-\ndrivers/net/wireless/ath/ath12k/pci.c:1534:static int ath12k_pci_probe(struct pci_dev *pdev,\ndrivers/net/wireless/ath/ath12k/pci.c-1535-\t\t\t    const struct pci_device_id *pci_dev)\n--\ndrivers/net/wireless/ath/ath12k/pci.c=1814=int ath12k_pci_register_driver(const enum ath12k_device_family device_id,\n--\ndrivers/net/wireless/ath/ath12k/pci.c-1835-\tpci_driver-\u003eid_table = driver-\u003eid_table;\ndrivers/net/wireless/ath/ath12k/pci.c:1836:\tpci_driver-\u003eprobe = ath12k_pci_probe;\ndrivers/net/wireless/ath/ath12k/pci.c-1837-\tpci_driver-\u003eremove = ath12k_pci_remove;\n"
}

gemini-3.1-pro-preview

null

null

							input: 20153
							output: 41
							thoughts: 149
						

**My Assessment of the ath12k Driver in a Virtualized Environment**

Okay, so I'm looking at this driver, and it's pretty clear: it's a standard PCI driver. Nothing unusual there. The problem is, without the actual physical PCI device present, the `probe` function, the one that kicks off the whole initialization process, isn't going to be called. That means none of the code within, including the important `ath12k_bss_assoc` function, is going to be reachable in a purely virtualized setup. Environments like Google Compute Engine or QEMU without PCI passthrough, where we're not directly exposing the Qualcomm Wi-Fi 7 hardware, are going to prevent that code from running.

Therefore, given the constraint of *no* physical device and a *virtual* environment, setting `WorthFuzzing` to `false` is the right call here. The conditions for fuzzing just aren't met.

But, I should probably double-check that assumption just to be certain. Let me quickly scour the codebase to see if there's any form of software emulation for `ath12k`. I'll focus my search on likely areas, like the `tools/testing/` directory or perhaps something similar to `mac80211_hwsim.c` in the wireless drivers. Just want to be absolutely sure there isn't some backdoor emulation that would change my conclusion. I can't think of any off the top of my head, but best to be thorough.

no matches

{
  "Expression": "ath12k",
  "PathPrefix": "drivers/net/wireless/mac80211_hwsim.c"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 20683
							output: 39
							thoughts: 39
						

**Investigating Potential Test Mode Implementations**

Okay, so I'm looking for a specific capability, and my initial search in `mac80211_hwsim.c` yielded nothing. That's a bit surprising, given the usual association of hardware simulation with test modes. Alright, let's broaden the scope. My next thought is to investigate the `drivers/net/wireless/ath/ath12k/testmode.c` file. Given the `ath12k` is a recent and complex wireless driver, and 'testmode' is explicitly in the filename, there's a good chance that's where any relevant functionality might reside. It's a sensible next step in the process.

{
  "Expression": "testmode",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/testmode.c"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/testmode.c-6-\ndrivers/net/wireless/ath/ath12k/testmode.c:7:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath12k/testmode.c-8-#include \u003cnet/netlink.h\u003e\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-13-#include \"hif.h\"\ndrivers/net/wireless/ath/ath12k/testmode.c:14:#include \"../testmode_i.h\"\ndrivers/net/wireless/ath/ath12k/testmode.c-15-\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=45=void ath12k_tm_wmi_event_unsegmented(struct ath12k_base *ab, u32 cmd_id,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-51-\tath12k_dbg(ab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:52:\t\t   \"testmode event wmi cmd_id %d skb length %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-53-\t\t   cmd_id, skb-\u003elen);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-58-\tif (!ar) {\ndrivers/net/wireless/ath/ath12k/testmode.c:59:\t\tath12k_warn(ab, \"testmode event not handled due to invalid pdev\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-60-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-64-\ndrivers/net/wireless/ath/ath12k/testmode.c:65:\tnl_skb = cfg80211_testmode_alloc_event_skb(ar-\u003eah-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath12k/testmode.c-66-\t\t\t\t\t\t   2 * nla_total_size(sizeof(u32)) +\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-72-\t\tath12k_warn(ab,\ndrivers/net/wireless/ath/ath12k/testmode.c:73:\t\t\t    \"failed to allocate skb for unsegmented testmode wmi event\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-74-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-79-\t    nla_put(nl_skb, ATH_TM_ATTR_DATA, skb-\u003elen, skb-\u003edata)) {\ndrivers/net/wireless/ath/ath12k/testmode.c:80:\t\tath12k_warn(ab, \"failed to populate testmode unsegmented event\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-81-\t\tkfree_skb(nl_skb);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-84-\ndrivers/net/wireless/ath/ath12k/testmode.c:85:\tcfg80211_testmode_event(nl_skb, GFP_ATOMIC);\ndrivers/net/wireless/ath/ath12k/testmode.c-86-}\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=88=void ath12k_tm_process_event(struct ath12k_base *ab, u32 cmd_id,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-99-\tath12k_dbg(ab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:100:\t\t   \"testmode event wmi cmd_id %d ftm event msg %p datalen %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-101-\t\t   cmd_id, ftm_msg, length);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-105-\tif (pdev_id \u003e= ab-\u003enum_radios) {\ndrivers/net/wireless/ath/ath12k/testmode.c:106:\t\tath12k_warn(ab, \"testmode event not handled due to invalid pdev id\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-107-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-112-\tif (!ar) {\ndrivers/net/wireless/ath/ath12k/testmode.c:113:\t\tath12k_warn(ab, \"testmode event not handled due to absence of pdev\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-114-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-153-\tspin_lock_bh(\u0026ar-\u003edata_lock);\ndrivers/net/wireless/ath/ath12k/testmode.c:154:\tnl_skb = cfg80211_testmode_alloc_event_skb(ar-\u003eah-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath12k/testmode.c-155-\t\t\t\t\t\t   2 * nla_total_size(sizeof(u32)) +\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-161-\t\tath12k_warn(ab,\ndrivers/net/wireless/ath/ath12k/testmode.c:162:\t\t\t    \"failed to allocate skb for testmode wmi event\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-163-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-170-\t\t    \u0026ab-\u003eftm_event_obj.eventdata[0])) {\ndrivers/net/wireless/ath/ath12k/testmode.c:171:\t\tath12k_warn(ab, \"failed to populate testmode event\");\ndrivers/net/wireless/ath/ath12k/testmode.c-172-\t\tkfree_skb(nl_skb);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-175-\ndrivers/net/wireless/ath/ath12k/testmode.c:176:\tcfg80211_testmode_event(nl_skb, GFP_ATOMIC);\ndrivers/net/wireless/ath/ath12k/testmode.c-177-}\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=179=static int ath12k_tm_cmd_get_version(struct ath12k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-183-\tath12k_dbg(ar-\u003eab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:184:\t\t   \"testmode cmd get version_major %d version_minor %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-185-\t\t   ATH_TESTMODE_VERSION_MAJOR,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-188-\tspin_lock_bh(\u0026ar-\u003edata_lock);\ndrivers/net/wireless/ath/ath12k/testmode.c:189:\tskb = cfg80211_testmode_alloc_reply_skb(ar-\u003eah-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath12k/testmode.c-190-\t\t\t\t\t\t2 * nla_total_size(sizeof(u32)));\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-203-\ndrivers/net/wireless/ath/ath12k/testmode.c:204:\treturn cfg80211_testmode_reply(skb);\ndrivers/net/wireless/ath/ath12k/testmode.c-205-}\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=207=static int ath12k_tm_cmd_process_ftm(struct ath12k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-229-\tath12k_dbg(ar-\u003eab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:230:\t\t   \"testmode cmd wmi cmd_id %d buf %p buf_len %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-231-\t\t   cmd_id, buf, buf_len);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-280-\ndrivers/net/wireless/ath/ath12k/testmode.c:281:static int ath12k_tm_cmd_testmode_start(struct ath12k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath12k/testmode.c-282-{\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=300=static int ath12k_tm_cmd_wmi(struct ath12k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-318-\tif (!buf_len) {\ndrivers/net/wireless/ath/ath12k/testmode.c:319:\t\tath12k_warn(ar-\u003eab, \"No data present in testmode command\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-320-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-331-\tath12k_dbg(ar-\u003eab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:332:\t\t   \"testmode cmd wmi cmd_id %d  buf length %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-333-\t\t   cmd_id, buf_len);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-346-\t\tdev_kfree_skb(skb);\ndrivers/net/wireless/ath/ath12k/testmode.c:347:\t\tath12k_warn(ar-\u003eab, \"failed to transmit wmi command (testmode): %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-348-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=354=int ath12k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-385-\tcase ATH_TM_CMD_TESTMODE_START:\ndrivers/net/wireless/ath/ath12k/testmode.c:386:\t\treturn ath12k_tm_cmd_testmode_start(ar, tb);\ndrivers/net/wireless/ath/ath12k/testmode.c-387-\tcase ATH_TM_CMD_GET_VERSION:\n"
}

gemini-3.1-pro-preview

null

null

							input: 23919
							output: 140
							thoughts: 315
						

**WorthFuzzing Decision for ath12k_bss_assoc**

Okay, after thinking this through, I'm going to set `WorthFuzzing` to `false`. The testmode is really only for sending WMI commands from userspace, it doesn't even begin to emulate the underlying hardware. Since `ath12k` is a PCI/AHB driver, and there's no kernel-level software emulation for it, that means the code I modified, specifically in `ath12k_bss_assoc`, is simply unreachable in a virtualized environment like GCE or QEMU. That logic relies on the hardware being present.

Let me just double-check, though, to make absolutely sure there's no other path to this function. Right, it's a static function in `drivers/net/wireless/ath/ath12k/mac.c`. I recall it's assigned to `mac80211_ops->bss_assoc`. But here's the kicker: the `ath12k` driver won't even *register* with `mac80211` if the hardware isn't there. `ath12k_pci_probe` fails early if it can't find a matching PCI device. So the `mac80211` subsystem won't even have any `ath12k` interfaces, and therefore `ath12k_bss_assoc` *will* never get called.

Therefore, setting `WorthFuzzing` to false is the correct call, given that this module is hardware-specific, and there's no code path that allows it to be executed in a virtualized fuzzing environment.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific PCI/AHB driver for Qualcomm Wi-Fi 7 devices. Since there is no software emulation for this hardware in the kernel (like mac80211_hwsim for generic mac80211), the driver will fail to probe in virtualized environments like GCE or QEMU without the physical hardware. Consequently, the modified code in `ath12k_bss_assoc` is unreachable and cannot be fuzzed.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific PCI/AHB driver for Qualcomm Wi-Fi 7 devices. Since there is no software emulation for this hardware in the kernel (like mac80211_hwsim for generic mac80211), the driver will fail to probe in virtualized environments like GCE or QEMU without the physical hardware. Consequently, the modified code in `ath12k_bss_assoc` is unreachable and cannot be fuzzed.",
  "WorthFuzzing": false
}