AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/07/03 10:19 flow patch-triage
0m Args: 
null

Results: 
{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_pmsr_free_wk",
    "cfg80211_pmsr_wdev_down",
    "cfg80211_release_pmsr",
    "cfg80211_init_wdev"
  ],
  "Reasoning": "The patch changes the pmsr_free_wk work item in struct wireless_dev from a standard work_struct to a wiphy_work. This alters the locking semantics, as wiphy_work is executed with the wiphy lock held, allowing the removal of the explicit guard(wiphy) in the work handler. This is a functional change in the cfg80211 subsystem that is reachable in virtualized environments via mac80211_hwsim.",
  "WorthFuzzing": true
}
1/1 2026/07/03 10:19 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit a902fea092319ef44579c3f9f11a0c2214e6f81e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jul 3 10:19:15 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/net/cfg80211.h b/include/net/cfg80211.h\nindex 8188ad200de539..3751a1d74765ab 100644\n--- a/include/net/cfg80211.h\n+++ b/include/net/cfg80211.h\n@@ -7265,7 +7265,7 @@ struct wireless_dev {\n \n \tstruct list_head pmsr_list;\n \tspinlock_t pmsr_lock;\n-\tstruct work_struct pmsr_free_wk;\n+\tstruct wiphy_work pmsr_free_wk;\n \n \tunsigned long unprot_beacon_reported;\n \ndiff --git a/net/wireless/core.c b/net/wireless/core.c\nindex 3dcf63b04c41db..b6bb25ee89cd2e 100644\n--- a/net/wireless/core.c\n+++ b/net/wireless/core.c\n@@ -1613,7 +1613,7 @@ void cfg80211_init_wdev(struct wireless_dev *wdev)\n \tINIT_LIST_HEAD(\u0026wdev-\u003emgmt_registrations);\n \tINIT_LIST_HEAD(\u0026wdev-\u003epmsr_list);\n \tspin_lock_init(\u0026wdev-\u003epmsr_lock);\n-\tINIT_WORK(\u0026wdev-\u003epmsr_free_wk, cfg80211_pmsr_free_wk);\n+\twiphy_work_init(\u0026wdev-\u003epmsr_free_wk, cfg80211_pmsr_free_wk);\n \n #ifdef CONFIG_CFG80211_WEXT\n \twdev-\u003ewext.default_key = -1;\n@@ -1747,7 +1747,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,\n \t\t\tcfg80211_remove_links(wdev);\n \t\t/* since we just did cfg80211_leave() nothing to do there */\n \t\tcancel_work_sync(\u0026wdev-\u003edisconnect_wk);\n-\t\tcancel_work_sync(\u0026wdev-\u003epmsr_free_wk);\n \t\tbreak;\n \tcase NETDEV_DOWN:\n \t\twiphy_lock(\u0026rdev-\u003ewiphy);\ndiff --git a/net/wireless/core.h b/net/wireless/core.h\nindex df47ed6208a50d..f60c66b8867725 100644\n--- a/net/wireless/core.h\n+++ b/net/wireless/core.h\n@@ -586,7 +586,7 @@ cfg80211_get_6ghz_power_type(const u8 *elems, size_t elems_len,\n \n void cfg80211_release_pmsr(struct wireless_dev *wdev, u32 portid);\n void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev);\n-void cfg80211_pmsr_free_wk(struct work_struct *work);\n+void cfg80211_pmsr_free_wk(struct wiphy *wiphy, struct wiphy_work *work);\n \n void cfg80211_remove_link(struct wireless_dev *wdev, unsigned int link_id);\n void cfg80211_remove_links(struct wireless_dev *wdev);\ndiff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c\nindex c8447448f3a505..2c8db33d9c3098 100644\n--- a/net/wireless/pmsr.c\n+++ b/net/wireless/pmsr.c\n@@ -807,13 +807,11 @@ static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)\n \t}\n }\n \n-void cfg80211_pmsr_free_wk(struct work_struct *work)\n+void cfg80211_pmsr_free_wk(struct wiphy *wiphy, struct wiphy_work *work)\n {\n \tstruct wireless_dev *wdev = container_of(work, struct wireless_dev,\n \t\t\t\t\t\t pmsr_free_wk);\n \n-\tguard(wiphy)(wdev-\u003ewiphy);\n-\n \tcfg80211_pmsr_process_abort(wdev);\n }\n \n@@ -829,7 +827,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)\n \t}\n \tspin_unlock_bh(\u0026wdev-\u003epmsr_lock);\n \n-\tcancel_work_sync(\u0026wdev-\u003epmsr_free_wk);\n+\twiphy_work_cancel(wdev-\u003ewiphy, \u0026wdev-\u003epmsr_free_wk);\n \tif (found)\n \t\tcfg80211_pmsr_process_abort(wdev);\n \n@@ -844,7 +842,7 @@ void cfg80211_release_pmsr(struct wireless_dev *wdev, u32 portid)\n \tlist_for_each_entry(req, \u0026wdev-\u003epmsr_list, list) {\n \t\tif (req-\u003enl_portid == portid) {\n \t\t\treq-\u003enl_portid = 0;\n-\t\t\tschedule_work(\u0026wdev-\u003epmsr_free_wk);\n+\t\t\twiphy_work_queue(wdev-\u003ewiphy, \u0026wdev-\u003epmsr_free_wk);\n \t\t}\n \t}\n \tspin_unlock_bh(\u0026wdev-\u003epmsr_lock);\n"
}
2/1 2026/07/03 10:19 agent patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_pmsr_free_wk",
    "cfg80211_pmsr_wdev_down",
    "cfg80211_release_pmsr",
    "cfg80211_init_wdev"
  ],
  "Reasoning": "The patch changes the pmsr_free_wk work item in struct wireless_dev from a standard work_struct to a wiphy_work. This alters the locking semantics, as wiphy_work is executed with the wiphy lock held, allowing the removal of the explicit guard(wiphy) in the work handler. This is a functional change in the cfg80211 subsystem that is reachable in virtualized environments via mac80211_hwsim.",
  "WorthFuzzing": true
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit a902fea092319ef44579c3f9f11a0c2214e6f81e
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jul 3 10:19:15 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8188ad200de539..3751a1d74765ab 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -7265,7 +7265,7 @@ struct wireless_dev {
 
 	struct list_head pmsr_list;
 	spinlock_t pmsr_lock;
-	struct work_struct pmsr_free_wk;
+	struct wiphy_work pmsr_free_wk;
 
 	unsigned long unprot_beacon_reported;
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 3dcf63b04c41db..b6bb25ee89cd2e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1613,7 +1613,7 @@ void cfg80211_init_wdev(struct wireless_dev *wdev)
 	INIT_LIST_HEAD(&wdev->mgmt_registrations);
 	INIT_LIST_HEAD(&wdev->pmsr_list);
 	spin_lock_init(&wdev->pmsr_lock);
-	INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);
+	wiphy_work_init(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);
 
 #ifdef CONFIG_CFG80211_WEXT
 	wdev->wext.default_key = -1;
@@ -1747,7 +1747,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
 			cfg80211_remove_links(wdev);
 		/* since we just did cfg80211_leave() nothing to do there */
 		cancel_work_sync(&wdev->disconnect_wk);
-		cancel_work_sync(&wdev->pmsr_free_wk);
 		break;
 	case NETDEV_DOWN:
 		wiphy_lock(&rdev->wiphy);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index df47ed6208a50d..f60c66b8867725 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -586,7 +586,7 @@ cfg80211_get_6ghz_power_type(const u8 *elems, size_t elems_len,
 
 void cfg80211_release_pmsr(struct wireless_dev *wdev, u32 portid);
 void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev);
-void cfg80211_pmsr_free_wk(struct work_struct *work);
+void cfg80211_pmsr_free_wk(struct wiphy *wiphy, struct wiphy_work *work);
 
 void cfg80211_remove_link(struct wireless_dev *wdev, unsigned int link_id);
 void cfg80211_remove_links(struct wireless_dev *wdev);
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index c8447448f3a505..2c8db33d9c3098 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -807,13 +807,11 @@ static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)
 	}
 }
 
-void cfg80211_pmsr_free_wk(struct work_struct *work)
+void cfg80211_pmsr_free_wk(struct wiphy *wiphy, struct wiphy_work *work)
 {
 	struct wireless_dev *wdev = container_of(work, struct wireless_dev,
 						 pmsr_free_wk);
 
-	guard(wiphy)(wdev->wiphy);
-
 	cfg80211_pmsr_process_abort(wdev);
 }
 
@@ -829,7 +827,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
 	}
 	spin_unlock_bh(&wdev->pmsr_lock);
 
-	cancel_work_sync(&wdev->pmsr_free_wk);
+	wiphy_work_cancel(wdev->wiphy, &wdev->pmsr_free_wk);
 	if (found)
 		cfg80211_pmsr_process_abort(wdev);
 
@@ -844,7 +842,7 @@ void cfg80211_release_pmsr(struct wireless_dev *wdev, u32 portid)
 	list_for_each_entry(req, &wdev->pmsr_list, list) {
 		if (req->nl_portid == portid) {
 			req->nl_portid = 0;
-			schedule_work(&wdev->pmsr_free_wk);
+			wiphy_work_queue(wdev->wiphy, &wdev->pmsr_free_wk);
 		}
 	}
 	spin_unlock_bh(&wdev->pmsr_lock);

3/2 2026/07/03 10:19 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 3110
							output: 38
							thoughts: 370

Thoughts: 
**My Assessment of the Patch**

Okay, so this patch is a straightforward but important change within the `cfg80211` subsystem, specifically touching how Peer Measurement Survey Reports (PMSR) are handled. It's essentially refactoring the `pmsr_free_wk` work queue in the `wireless_dev` struct. I see they're upgrading from a standard `struct work_struct` to a `struct wiphy_work`, which is generally a good move for better integration and potentially more controlled execution within the Wi-Fi subsystem.

The changes to the work queue macros, `INIT_WORK` becoming `wiphy_work_init`, `cancel_work_sync` evolving into `wiphy_work_cancel`, and `schedule_work` now being `wiphy_work_queue`, confirm this work queue refactoring and are standard procedure for this type of change. The signature change for `cfg80211_pmsr_free_wk` to accept the `wiphy` pointer directly is logical, given the `wiphy_work` context and the removal of the redundant lock guarding. They're correctly ensuring the `wiphy` lock is held, which simplifies the code.

This touches `cfg80211`, a subsystem that's directly accessible through `mac80211_hwsim`, which I know from experience is crucial in virtualized testing environments. This means this change is functionally significant for testing and debugging, therefore I will set `WorthFuzzing=true`.

Now, to make sure I understand the full scope of this change, I need to focus on a few key symbols: `cfg80211_pmsr_free_wk`, of course, but also `cfg80211_pmsr_wdev_down` and `cfg80211_release_pmsr` to get a complete picture of the PMSR handling flow. I'll need to enable a few configs to replicate and test the environment properly. `CFG80211` is obvious, and I'll need `MAC80211`, which is generally a pre-requisite for `MAC80211_HWSIM`.

Finally, to see if there's anything else related to PMSR that I might be missing, I'll run a quick grep on the `net/wireless/` directory for either `cfg80211_pmsr_free_wk` or just `pmsr`. This will help me ensure that there are no obscure PMSR-related configurations that I'm overlooking.

4/2 2026/07/03 10:19 tool grepper
0m Args: 
{
  "Expression": "cfg80211_pmsr_free_wk",
  "PathPrefix": "net/wireless/"
}

Results: 
{
  "Output": "net/wireless/core.c=1609=void cfg80211_init_wdev(struct wireless_dev *wdev)\n--\nnet/wireless/core.c-1615-\tspin_lock_init(\u0026wdev-\u003epmsr_lock);\nnet/wireless/core.c:1616:\twiphy_work_init(\u0026wdev-\u003epmsr_free_wk, cfg80211_pmsr_free_wk);\nnet/wireless/core.c-1617-\n--\nnet/wireless/core.h=588=void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev);\nnet/wireless/core.h:589:void cfg80211_pmsr_free_wk(struct wiphy *wiphy, struct wiphy_work *work);\nnet/wireless/core.h-590-\n--\nnet/wireless/pmsr.c=787=static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)\n--\nnet/wireless/pmsr.c-809-\nnet/wireless/pmsr.c:810:void cfg80211_pmsr_free_wk(struct wiphy *wiphy, struct wiphy_work *work)\nnet/wireless/pmsr.c-811-{\n"
}
5/2 2026/07/03 10:19 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 4438
							output: 26
							thoughts: 16

Thoughts: 
Here's my thought process, summarized as you requested:

**Kconfig Dive for PMSR**

Okay, so I need to find out about PMSR. My first instinct is to go straight to the source, the core of how the wireless configuration is structured. That means diving into the `net/wireless/Kconfig` file. It's the central configuration file for anything and everything wireless related in the kernel. This is where I'd expect to find the configuration options related to PMSR. Hopefully, it's clearly named or has some obvious dependencies that will point me in the right direction. It's a bit of a data-mining exercise, but this is the logical first step for understanding the configuration options available. I need to understand if PMSR is enabled by default, how it is exposed to the user, and if it's dependent on any other options. Let's see what's in there.

6/2 2026/07/03 10:19 tool grepper
0m Args: 
{
  "Expression": "PMSR",
  "PathPrefix": "net/wireless/"
}

Results: 
{
  "Output": "\nFull output is too long, showing 500 out of 568 lines.\nUse more precise expression if possible.\n\nnet/wireless/nl80211.c=461=static const struct nla_policy\nnet/wireless/nl80211.c:462:nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {\nnet/wireless/nl80211.c:463:\t[NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c:464:\t[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },\nnet/wireless/nl80211.c:465:\t[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =\nnet/wireless/nl80211.c-466-\t\tNLA_POLICY_MAX(NLA_U8, 15),\nnet/wireless/nl80211.c:467:\t[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },\nnet/wireless/nl80211.c:468:\t[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =\nnet/wireless/nl80211.c-469-\t\tNLA_POLICY_MAX(NLA_U8, 15),\nnet/wireless/nl80211.c:470:\t[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },\nnet/wireless/nl80211.c:471:\t[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },\nnet/wireless/nl80211.c:472:\t[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c:473:\t[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c:474:\t[NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c:475:\t[NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c:476:\t[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c:477:\t[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },\nnet/wireless/nl80211.c:478:\t[NL80211_PMSR_FTM_REQ_ATTR_RSTA] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c:479:\t[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS] = {\nnet/wireless/nl80211.c-480-\t\t.type = NLA_U32\nnet/wireless/nl80211.c-481-\t},\nnet/wireless/nl80211.c:482:\t[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS] = {\nnet/wireless/nl80211.c-483-\t\t.type = NLA_U32\nnet/wireless/nl80211.c-484-\t},\nnet/wireless/nl80211.c:485:\t[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },\nnet/wireless/nl80211.c:486:\t[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION] = NLA_POLICY_MAX(NLA_U32, 255),\nnet/wireless/nl80211.c:487:\t[NL80211_PMSR_FTM_REQ_ATTR_NUM_MEASUREMENTS] = { .type = NLA_U32 },\nnet/wireless/nl80211.c:488:\t[NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },\nnet/wireless/nl80211.c:489:\t[NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },\nnet/wireless/nl80211.c:490:\t[NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c-491-};\n--\nnet/wireless/nl80211.c=493=static const struct nla_policy\nnet/wireless/nl80211.c:494:nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {\nnet/wireless/nl80211.c:495:\t[NL80211_PMSR_TYPE_FTM] =\nnet/wireless/nl80211.c-496-\t\tNLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),\n--\nnet/wireless/nl80211.c=499=static const struct nla_policy\nnet/wireless/nl80211.c:500:nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {\nnet/wireless/nl80211.c:501:\t[NL80211_PMSR_REQ_ATTR_DATA] =\nnet/wireless/nl80211.c-502-\t\tNLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),\nnet/wireless/nl80211.c:503:\t[NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },\nnet/wireless/nl80211.c-504-};\n--\nnet/wireless/nl80211.c=506=static const struct nla_policy\nnet/wireless/nl80211.c:507:nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {\nnet/wireless/nl80211.c:508:\t[NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,\nnet/wireless/nl80211.c:509:\t[NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),\nnet/wireless/nl80211.c:510:\t[NL80211_PMSR_PEER_ATTR_REQ] =\nnet/wireless/nl80211.c-511-\t\tNLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),\nnet/wireless/nl80211.c:512:\t[NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },\nnet/wireless/nl80211.c:513:\t[NL80211_PMSR_PEER_ATTR_REQ_TYPE] =\nnet/wireless/nl80211.c:514:\t\tNLA_POLICY_MAX(NLA_U32, NL80211_PMSR_FTM_REQ_TYPE_MAX),\nnet/wireless/nl80211.c-515-};\n--\nnet/wireless/nl80211.c=517=static const struct nla_policy\nnet/wireless/nl80211.c:518:nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {\nnet/wireless/nl80211.c:519:\t[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },\nnet/wireless/nl80211.c:520:\t[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },\nnet/wireless/nl80211.c:521:\t[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },\nnet/wireless/nl80211.c:522:\t[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },\nnet/wireless/nl80211.c:523:\t[NL80211_PMSR_ATTR_PEERS] =\nnet/wireless/nl80211.c-524-\t\tNLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),\n--\nnet/wireless/nl80211.c=2478=nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,\n--\nnet/wireless/nl80211.c-2485-\nnet/wireless/nl80211.c:2486:\tftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);\nnet/wireless/nl80211.c-2487-\tif (!ftm)\n--\nnet/wireless/nl80211.c-2489-\nnet/wireless/nl80211.c:2490:\tif (cap-\u003eftm.asap \u0026\u0026 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))\nnet/wireless/nl80211.c-2491-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2492-\tif (cap-\u003eftm.non_asap \u0026\u0026\nnet/wireless/nl80211.c:2493:\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))\nnet/wireless/nl80211.c-2494-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2495-\tif (cap-\u003eftm.request_lci \u0026\u0026\nnet/wireless/nl80211.c:2496:\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))\nnet/wireless/nl80211.c-2497-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2498-\tif (cap-\u003eftm.request_civicloc \u0026\u0026\nnet/wireless/nl80211.c:2499:\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))\nnet/wireless/nl80211.c-2500-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c:2501:\tif (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,\nnet/wireless/nl80211.c-2502-\t\t\tcap-\u003eftm.preambles))\nnet/wireless/nl80211.c-2503-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c:2504:\tif (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,\nnet/wireless/nl80211.c-2505-\t\t\tcap-\u003eftm.bandwidths))\n--\nnet/wireless/nl80211.c-2507-\tif (cap-\u003eftm.max_bursts_exponent \u003e= 0 \u0026\u0026\nnet/wireless/nl80211.c:2508:\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,\nnet/wireless/nl80211.c-2509-\t\t\tcap-\u003eftm.max_bursts_exponent))\n--\nnet/wireless/nl80211.c-2511-\tif (cap-\u003eftm.max_ftms_per_burst \u0026\u0026\nnet/wireless/nl80211.c:2512:\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,\nnet/wireless/nl80211.c-2513-\t\t\tcap-\u003eftm.max_ftms_per_burst))\n--\nnet/wireless/nl80211.c-2515-\tif (cap-\u003eftm.trigger_based \u0026\u0026\nnet/wireless/nl80211.c:2516:\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))\nnet/wireless/nl80211.c-2517-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2518-\tif (cap-\u003eftm.non_trigger_based \u0026\u0026\nnet/wireless/nl80211.c:2519:\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))\nnet/wireless/nl80211.c-2520-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2521-\tif (cap-\u003eftm.support_6ghz \u0026\u0026\nnet/wireless/nl80211.c:2522:\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_6GHZ_SUPPORT))\nnet/wireless/nl80211.c-2523-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c:2524:\tif (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_TX_LTF_REP,\nnet/wireless/nl80211.c-2525-\t\t\tcap-\u003eftm.max_tx_ltf_rep))\nnet/wireless/nl80211.c-2526-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c:2527:\tif (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_RX_LTF_REP,\nnet/wireless/nl80211.c-2528-\t\t\tcap-\u003eftm.max_rx_ltf_rep))\nnet/wireless/nl80211.c-2529-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c:2530:\tif (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_TX_STS,\nnet/wireless/nl80211.c-2531-\t\t\tcap-\u003eftm.max_tx_sts))\nnet/wireless/nl80211.c-2532-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c:2533:\tif (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_RX_STS,\nnet/wireless/nl80211.c-2534-\t\t\tcap-\u003eftm.max_rx_sts))\n--\nnet/wireless/nl80211.c-2536-\tif (cap-\u003eftm.max_total_ltf_tx \u003e 0 \u0026\u0026\nnet/wireless/nl80211.c:2537:\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_TX,\nnet/wireless/nl80211.c-2538-\t\t\tcap-\u003eftm.max_total_ltf_tx))\n--\nnet/wireless/nl80211.c-2540-\tif (cap-\u003eftm.max_total_ltf_rx \u003e 0 \u0026\u0026\nnet/wireless/nl80211.c:2541:\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_RX,\nnet/wireless/nl80211.c-2542-\t\t\tcap-\u003eftm.max_total_ltf_rx))\n--\nnet/wireless/nl80211.c-2549-\t\tista_caps = nla_nest_start_noflag(msg,\nnet/wireless/nl80211.c:2550:\t\t\t\t\t\t  NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS);\nnet/wireless/nl80211.c-2551-\t\tif (!ista_caps)\n--\nnet/wireless/nl80211.c-2553-\t\tif (cap-\u003eftm.ista.support_ntb \u0026\u0026\nnet/wireless/nl80211.c:2554:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_NTB))\nnet/wireless/nl80211.c-2555-\t\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2556-\t\tif (cap-\u003eftm.ista.support_tb \u0026\u0026\nnet/wireless/nl80211.c:2557:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_TB))\nnet/wireless/nl80211.c-2558-\t\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2559-\t\tif (cap-\u003eftm.ista.support_edca \u0026\u0026\nnet/wireless/nl80211.c:2560:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_EDCA))\nnet/wireless/nl80211.c-2561-\t\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2562-\t\tif (cap-\u003eftm.ista.max_peers \u0026\u0026\nnet/wireless/nl80211.c:2563:\t\t    nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE,\nnet/wireless/nl80211.c-2564-\t\t\t\tcap-\u003eftm.ista.max_peers))\n--\nnet/wireless/nl80211.c-2577-\t\t */\nnet/wireless/nl80211.c:2578:\t\tif (nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT))\nnet/wireless/nl80211.c-2579-\t\t\treturn -ENOBUFS;\n--\nnet/wireless/nl80211.c-2581-\t\trsta_caps = nla_nest_start_noflag(msg,\nnet/wireless/nl80211.c:2582:\t\t\t\t\t\t  NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS);\nnet/wireless/nl80211.c-2583-\t\tif (!rsta_caps)\n--\nnet/wireless/nl80211.c-2585-\t\tif (cap-\u003eftm.rsta.support_ntb \u0026\u0026\nnet/wireless/nl80211.c:2586:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_NTB))\nnet/wireless/nl80211.c-2587-\t\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2588-\t\tif (cap-\u003eftm.rsta.support_tb \u0026\u0026\nnet/wireless/nl80211.c:2589:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_TB))\nnet/wireless/nl80211.c-2590-\t\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2591-\t\tif (cap-\u003eftm.rsta.support_edca \u0026\u0026\nnet/wireless/nl80211.c:2592:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_EDCA))\nnet/wireless/nl80211.c-2593-\t\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2594-\t\tif (cap-\u003eftm.rsta.max_peers \u0026\u0026\nnet/wireless/nl80211.c:2595:\t\t    nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE,\nnet/wireless/nl80211.c-2596-\t\t\t\tcap-\u003eftm.rsta.max_peers))\n--\nnet/wireless/nl80211.c-2601-\tif (cap-\u003eftm.max_no_of_tx_antennas \u0026\u0026\nnet/wireless/nl80211.c:2602:\t    nla_put_u8(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS,\nnet/wireless/nl80211.c-2603-\t\t       cap-\u003eftm.max_no_of_tx_antennas))\n--\nnet/wireless/nl80211.c-2606-\tif (cap-\u003eftm.max_no_of_rx_antennas \u0026\u0026\nnet/wireless/nl80211.c:2607:\t    nla_put_u8(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS,\nnet/wireless/nl80211.c-2608-\t\t       cap-\u003eftm.max_no_of_rx_antennas))\n--\nnet/wireless/nl80211.c-2611-\tif (cap-\u003eftm.min_allowed_ranging_interval_edca \u0026\u0026\nnet/wireless/nl80211.c:2612:\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA,\nnet/wireless/nl80211.c-2613-\t\t\tcap-\u003eftm.min_allowed_ranging_interval_edca))\n--\nnet/wireless/nl80211.c-2616-\tif (cap-\u003eftm.min_allowed_ranging_interval_ntb \u0026\u0026\nnet/wireless/nl80211.c:2617:\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,\nnet/wireless/nl80211.c-2618-\t\t\tcap-\u003eftm.min_allowed_ranging_interval_ntb))\n--\nnet/wireless/nl80211.c-2624-\t\tpd_caps = nla_nest_start_noflag(msg,\nnet/wireless/nl80211.c:2625:\t\t\t\t\t\tNL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS);\nnet/wireless/nl80211.c-2626-\t\tif (!pd_caps)\n--\nnet/wireless/nl80211.c-2629-\t\tif (cap-\u003eftm.type.infra_support \u0026\u0026\nnet/wireless/nl80211.c:2630:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INFRA_SUPPORT))\nnet/wireless/nl80211.c-2631-\t\t\treturn -ENOBUFS;\n--\nnet/wireless/nl80211.c-2633-\t\tif (cap-\u003eftm.type.pd_support \u0026\u0026\nnet/wireless/nl80211.c:2634:\t\t    nla_put_flag(msg, NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT))\nnet/wireless/nl80211.c-2635-\t\t\treturn -ENOBUFS;\n--\nnet/wireless/nl80211.c-2640-\tif (cap-\u003eftm.concurrent_ista_rsta_support \u0026\u0026\nnet/wireless/nl80211.c:2641:\t    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_CONCURRENT_ISTA_RSTA_SUPPORT))\nnet/wireless/nl80211.c-2642-\t\treturn -ENOBUFS;\n--\nnet/wireless/nl80211.c-2645-\t\tif (cap-\u003eftm.pd_preambles \u0026\u0026\nnet/wireless/nl80211.c:2646:\t\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_PREAMBLES,\nnet/wireless/nl80211.c-2647-\t\t\t\tcap-\u003eftm.pd_preambles))\n--\nnet/wireless/nl80211.c-2649-\t\tif (cap-\u003eftm.pd_bandwidths \u0026\u0026\nnet/wireless/nl80211.c:2650:\t\t    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_BANDWIDTHS,\nnet/wireless/nl80211.c-2651-\t\t\t\tcap-\u003eftm.pd_bandwidths))\n--\nnet/wireless/nl80211.c=2659=static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,\n--\nnet/wireless/nl80211.c-2676-\nnet/wireless/nl80211.c:2677:\tif (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap-\u003emax_peers))\nnet/wireless/nl80211.c-2678-\t\treturn -ENOBUFS;\n--\nnet/wireless/nl80211.c-2680-\tif (cap-\u003ereport_ap_tsf \u0026\u0026\nnet/wireless/nl80211.c:2681:\t    nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))\nnet/wireless/nl80211.c-2682-\t\treturn -ENOBUFS;\n--\nnet/wireless/nl80211.c-2684-\tif (cap-\u003erandomize_mac_addr \u0026\u0026\nnet/wireless/nl80211.c:2685:\t    nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))\nnet/wireless/nl80211.c-2686-\t\treturn -ENOBUFS;\nnet/wireless/nl80211.c-2687-\nnet/wireless/nl80211.c:2688:\tcaps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);\nnet/wireless/nl80211.c-2689-\tif (!caps)\n--\nnet/wireless/pmsr.c=10=static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,\n--\nnet/wireless/pmsr.c-15-\tconst struct cfg80211_pmsr_capabilities *capa = rdev-\u003ewiphy.pmsr_capa;\nnet/wireless/pmsr.c:16:\tstruct nlattr *tb[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1];\nnet/wireless/pmsr.c-17-\tu32 preamble = NL80211_PREAMBLE_DMG; /* only optional in DMG */\n--\nnet/wireless/pmsr.c-19-\t/* validate existing data */\nnet/wireless/pmsr.c:20:\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_INFRA \u0026\u0026\nnet/wireless/pmsr.c-21-\t    !(capa-\u003eftm.bandwidths \u0026 BIT(out-\u003echandef.width))) {\n--\nnet/wireless/pmsr.c-25-\nnet/wireless/pmsr.c:26:\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_PD \u0026\u0026\nnet/wireless/pmsr.c-27-\t    !(capa-\u003eftm.pd_bandwidths \u0026 BIT(out-\u003echandef.width))) {\n--\nnet/wireless/pmsr.c-33-\t/* no validation needed - was already done via nested policy */\nnet/wireless/pmsr.c:34:\tnla_parse_nested_deprecated(tb, NL80211_PMSR_FTM_REQ_ATTR_MAX, ftmreq,\nnet/wireless/pmsr.c-35-\t\t\t\t    NULL, NULL);\nnet/wireless/pmsr.c-36-\nnet/wireless/pmsr.c:37:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE])\nnet/wireless/pmsr.c:38:\t\tpreamble = nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE]);\nnet/wireless/pmsr.c-39-\n--\nnet/wireless/pmsr.c-47-\tdefault:\nnet/wireless/pmsr.c:48:\t\tif (!tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE]) {\nnet/wireless/pmsr.c-49-\t\t\tNL_SET_ERR_MSG(info-\u003eextack,\n--\nnet/wireless/pmsr.c-54-\nnet/wireless/pmsr.c:55:\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_INFRA \u0026\u0026\nnet/wireless/pmsr.c-56-\t    !(capa-\u003eftm.preambles \u0026 BIT(preamble))) {\nnet/wireless/pmsr.c-57-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:58:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE],\nnet/wireless/pmsr.c-59-\t\t\t\t    \"FTM: invalid preamble\");\n--\nnet/wireless/pmsr.c-62-\nnet/wireless/pmsr.c:63:\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_PD \u0026\u0026\nnet/wireless/pmsr.c-64-\t    !(capa-\u003eftm.pd_preambles \u0026 BIT(preamble))) {\nnet/wireless/pmsr.c-65-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:66:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE],\nnet/wireless/pmsr.c-67-\t\t\t\t    \"FTM: invalid preamble for PD request\");\n--\nnet/wireless/pmsr.c-73-\tout-\u003eftm.burst_period = 0;\nnet/wireless/pmsr.c:74:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD])\nnet/wireless/pmsr.c-75-\t\tout-\u003eftm.burst_period =\nnet/wireless/pmsr.c:76:\t\t\tnla_get_u16(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD]);\nnet/wireless/pmsr.c-77-\nnet/wireless/pmsr.c:78:\tout-\u003eftm.asap = !!tb[NL80211_PMSR_FTM_REQ_ATTR_ASAP];\nnet/wireless/pmsr.c-79-\tif (out-\u003eftm.asap \u0026\u0026 !capa-\u003eftm.asap) {\nnet/wireless/pmsr.c-80-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:81:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_ASAP],\nnet/wireless/pmsr.c-82-\t\t\t\t    \"FTM: ASAP mode not supported\");\n--\nnet/wireless/pmsr.c-92-\tout-\u003eftm.num_bursts_exp = 0;\nnet/wireless/pmsr.c:93:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP])\nnet/wireless/pmsr.c-94-\t\tout-\u003eftm.num_bursts_exp =\nnet/wireless/pmsr.c:95:\t\t\tnla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP]);\nnet/wireless/pmsr.c-96-\n--\nnet/wireless/pmsr.c-99-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:100:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP],\nnet/wireless/pmsr.c-101-\t\t\t\t    \"FTM: max NUM_BURSTS_EXP must be set lower than the device limit\");\n--\nnet/wireless/pmsr.c-105-\tout-\u003eftm.ftms_per_burst = 0;\nnet/wireless/pmsr.c:106:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST])\nnet/wireless/pmsr.c-107-\t\tout-\u003eftm.ftms_per_burst =\nnet/wireless/pmsr.c:108:\t\t\tnla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST]);\nnet/wireless/pmsr.c-109-\n--\nnet/wireless/pmsr.c-112-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:113:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],\nnet/wireless/pmsr.c-114-\t\t\t\t    \"FTM: FTMs per burst must be set lower than the device limit\");\n--\nnet/wireless/pmsr.c-118-\tout-\u003eftm.ftmr_retries = 3;\nnet/wireless/pmsr.c:119:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES])\nnet/wireless/pmsr.c-120-\t\tout-\u003eftm.ftmr_retries =\nnet/wireless/pmsr.c:121:\t\t\tnla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES]);\nnet/wireless/pmsr.c-122-\nnet/wireless/pmsr.c:123:\tout-\u003eftm.request_lci = !!tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI];\nnet/wireless/pmsr.c-124-\tif (out-\u003eftm.request_lci \u0026\u0026 !capa-\u003eftm.request_lci) {\nnet/wireless/pmsr.c-125-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:126:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI],\nnet/wireless/pmsr.c-127-\t\t\t\t    \"FTM: LCI request not supported\");\n--\nnet/wireless/pmsr.c-130-\tout-\u003eftm.request_civicloc =\nnet/wireless/pmsr.c:131:\t\t!!tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC];\nnet/wireless/pmsr.c-132-\tif (out-\u003eftm.request_civicloc \u0026\u0026 !capa-\u003eftm.request_civicloc) {\nnet/wireless/pmsr.c-133-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:134:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC],\nnet/wireless/pmsr.c-135-\t\t\t    \"FTM: civic location request not supported\");\n--\nnet/wireless/pmsr.c-138-\tout-\u003eftm.trigger_based =\nnet/wireless/pmsr.c:139:\t\t!!tb[NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED];\nnet/wireless/pmsr.c-140-\tif (out-\u003eftm.trigger_based \u0026\u0026 !capa-\u003eftm.trigger_based) {\nnet/wireless/pmsr.c-141-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:142:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED],\nnet/wireless/pmsr.c-143-\t\t\t\t    \"FTM: trigger based ranging is not supported\");\n--\nnet/wireless/pmsr.c-146-\nnet/wireless/pmsr.c:147:\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_PD \u0026\u0026\nnet/wireless/pmsr.c-148-\t    out-\u003eftm.trigger_based) {\n--\nnet/wireless/pmsr.c-155-\tout-\u003eftm.non_trigger_based =\nnet/wireless/pmsr.c:156:\t\t!!tb[NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED];\nnet/wireless/pmsr.c-157-\tif (out-\u003eftm.non_trigger_based \u0026\u0026 !capa-\u003eftm.non_trigger_based) {\nnet/wireless/pmsr.c-158-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:159:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED],\nnet/wireless/pmsr.c-160-\t\t\t\t    \"FTM: trigger based ranging is not supported\");\n--\nnet/wireless/pmsr.c-169-\nnet/wireless/pmsr.c:170:\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_PD \u0026\u0026\nnet/wireless/pmsr.c-171-\t    out-\u003eftm.non_trigger_based \u0026\u0026 out-\u003eftm.ftms_per_burst \u003e 4) {\nnet/wireless/pmsr.c-172-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:173:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],\nnet/wireless/pmsr.c-174-\t\t\t\t    \"FTM: FTMs per burst must not exceed 4 for PD NTB ranging\");\n--\nnet/wireless/pmsr.c-180-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:181:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],\nnet/wireless/pmsr.c-182-\t\t\t\t    \"FTM: FTMs per burst must be set lower than 31\");\n--\nnet/wireless/pmsr.c-188-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:189:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE],\nnet/wireless/pmsr.c-190-\t\t\t\t    \"FTM: non EDCA based ranging must use HE preamble\");\n--\nnet/wireless/pmsr.c-193-\nnet/wireless/pmsr.c:194:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION])\nnet/wireless/pmsr.c-195-\t\tout-\u003eftm.burst_duration =\nnet/wireless/pmsr.c:196:\t\t\tnla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION]);\nnet/wireless/pmsr.c-197-\telse if (!out-\u003eftm.non_trigger_based \u0026\u0026 !out-\u003eftm.trigger_based)\n--\nnet/wireless/pmsr.c-200-\tout-\u003eftm.lmr_feedback =\nnet/wireless/pmsr.c:201:\t\t!!tb[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK];\nnet/wireless/pmsr.c-202-\tif (!out-\u003eftm.trigger_based \u0026\u0026 !out-\u003eftm.non_trigger_based \u0026\u0026\n--\nnet/wireless/pmsr.c-204-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:205:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK],\nnet/wireless/pmsr.c-206-\t\t\t\t    \"FTM: LMR feedback set for EDCA based ranging\");\n--\nnet/wireless/pmsr.c-209-\nnet/wireless/pmsr.c:210:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR]) {\nnet/wireless/pmsr.c-211-\t\tif (!out-\u003eftm.non_trigger_based \u0026\u0026 !out-\u003eftm.trigger_based) {\nnet/wireless/pmsr.c-212-\t\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:213:\t\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR],\nnet/wireless/pmsr.c-214-\t\t\t\t\t    \"FTM: BSS color set for EDCA based ranging\");\n--\nnet/wireless/pmsr.c-218-\t\tout-\u003eftm.bss_color =\nnet/wireless/pmsr.c:219:\t\t\tnla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR]);\nnet/wireless/pmsr.c-220-\t}\nnet/wireless/pmsr.c-221-\nnet/wireless/pmsr.c:222:\tout-\u003eftm.rsta = !!tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA];\nnet/wireless/pmsr.c-223-\tif (out-\u003eftm.rsta \u0026\u0026 out-\u003eftm.non_trigger_based \u0026\u0026\n--\nnet/wireless/pmsr.c-225-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:226:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],\nnet/wireless/pmsr.c-227-\t\t\t\t    \"FTM: NTB RSTA not supported by device\");\n--\nnet/wireless/pmsr.c-233-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:234:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],\nnet/wireless/pmsr.c-235-\t\t\t\t    \"FTM: TB RSTA not supported by device\");\n--\nnet/wireless/pmsr.c-242-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:243:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],\nnet/wireless/pmsr.c-244-\t\t\t\t    \"FTM: EDCA RSTA not supported by device\");\n--\nnet/wireless/pmsr.c-251-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:252:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],\nnet/wireless/pmsr.c-253-\t\t\t\t    \"FTM: RSTA set without LMR feedback\");\n--\nnet/wireless/pmsr.c-257-\tif (out-\u003eftm.non_trigger_based) {\nnet/wireless/pmsr.c:258:\t\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_PD \u0026\u0026\nnet/wireless/pmsr.c:259:\t\t    !tb[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME]) {\nnet/wireless/pmsr.c-260-\t\t\tNL_SET_ERR_MSG(info-\u003eextack,\n--\nnet/wireless/pmsr.c-264-\t\tout-\u003eftm.nominal_time =\nnet/wireless/pmsr.c:265:\t\t\tnla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME]);\nnet/wireless/pmsr.c-266-\nnet/wireless/pmsr.c:267:\t\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS])\nnet/wireless/pmsr.c-268-\t\t\tout-\u003eftm.min_time_between_measurements =\nnet/wireless/pmsr.c:269:\t\t\tnla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS]);\nnet/wireless/pmsr.c-270-\nnet/wireless/pmsr.c:271:\t\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS])\nnet/wireless/pmsr.c-272-\t\t\tout-\u003eftm.max_time_between_measurements =\nnet/wireless/pmsr.c:273:\t\t\tnla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS]);\nnet/wireless/pmsr.c-274-\nnet/wireless/pmsr.c:275:\t\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION])\nnet/wireless/pmsr.c-276-\t\t\tout-\u003eftm.availability_window =\nnet/wireless/pmsr.c:277:\t\t\t\tnla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION]);\nnet/wireless/pmsr.c-278-\nnet/wireless/pmsr.c:279:\t\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_MEASUREMENTS])\nnet/wireless/pmsr.c-280-\t\t\tout-\u003eftm.num_measurements =\nnet/wireless/pmsr.c:281:\t\t\t\tnla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_MEASUREMENTS]);\nnet/wireless/pmsr.c-282-\t}\nnet/wireless/pmsr.c-283-\nnet/wireless/pmsr.c:284:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS])\nnet/wireless/pmsr.c-285-\t\tout-\u003eftm.ingress_distance =\nnet/wireless/pmsr.c:286:\t\t\tnla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS]);\nnet/wireless/pmsr.c-287-\nnet/wireless/pmsr.c:288:\tif (tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS])\nnet/wireless/pmsr.c-289-\t\tout-\u003eftm.egress_distance =\nnet/wireless/pmsr.c:290:\t\t\tnla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS]);\nnet/wireless/pmsr.c-291-\nnet/wireless/pmsr.c-292-\tout-\u003eftm.pd_suppress_range_results =\nnet/wireless/pmsr.c:293:\t\tnla_get_flag(tb[NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS]);\nnet/wireless/pmsr.c-294-\nnet/wireless/pmsr.c:295:\tif (out-\u003eftm.request_type != NL80211_PMSR_FTM_REQ_TYPE_PD \u0026\u0026\nnet/wireless/pmsr.c-296-\t    out-\u003eftm.pd_suppress_range_results) {\nnet/wireless/pmsr.c-297-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:298:\t\t\t\t    tb[NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS],\nnet/wireless/pmsr.c-299-\t\t\t\t    \"FTM: suppress range result flag only valid for PD requests\");\n--\nnet/wireless/pmsr.c=306=static int pmsr_parse_peer(struct cfg80211_registered_device *rdev,\n--\nnet/wireless/pmsr.c-310-{\nnet/wireless/pmsr.c:311:\tstruct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];\nnet/wireless/pmsr.c:312:\tstruct nlattr *req[NL80211_PMSR_REQ_ATTR_MAX + 1];\nnet/wireless/pmsr.c-313-\tstruct nlattr *treq;\n--\nnet/wireless/pmsr.c-316-\t/* no validation needed - was already done via nested policy */\nnet/wireless/pmsr.c:317:\tnla_parse_nested_deprecated(tb, NL80211_PMSR_PEER_ATTR_MAX, peer,\nnet/wireless/pmsr.c-318-\t\t\t\t    NULL, NULL);\nnet/wireless/pmsr.c-319-\nnet/wireless/pmsr.c:320:\tif (!tb[NL80211_PMSR_PEER_ATTR_ADDR] ||\nnet/wireless/pmsr.c:321:\t    !tb[NL80211_PMSR_PEER_ATTR_CHAN] ||\nnet/wireless/pmsr.c:322:\t    !tb[NL80211_PMSR_PEER_ATTR_REQ]) {\nnet/wireless/pmsr.c-323-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack, peer,\n--\nnet/wireless/pmsr.c-327-\nnet/wireless/pmsr.c:328:\tmemcpy(out-\u003eaddr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]), ETH_ALEN);\nnet/wireless/pmsr.c-329-\nnet/wireless/pmsr.c:330:\tif (tb[NL80211_PMSR_PEER_ATTR_REQ_TYPE])\nnet/wireless/pmsr.c-331-\t\tout-\u003eftm.request_type =\nnet/wireless/pmsr.c:332:\t\t\tnla_get_u32(tb[NL80211_PMSR_PEER_ATTR_REQ_TYPE]);\nnet/wireless/pmsr.c-333-\telse\nnet/wireless/pmsr.c:334:\t\tout-\u003eftm.request_type = NL80211_PMSR_FTM_REQ_TYPE_INFRA;\nnet/wireless/pmsr.c-335-\nnet/wireless/pmsr.c:336:\tif (out-\u003eftm.request_type == NL80211_PMSR_FTM_REQ_TYPE_PD \u0026\u0026\nnet/wireless/pmsr.c-337-\t    !rdev-\u003ewiphy.pmsr_capa-\u003eftm.type.pd_support) {\nnet/wireless/pmsr.c-338-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:339:\t\t\t\t    tb[NL80211_PMSR_PEER_ATTR_REQ_TYPE],\nnet/wireless/pmsr.c-340-\t\t\t\t    \"FTM: PD request type not supported by device\");\n--\nnet/wireless/pmsr.c-345-\terr = nla_parse_nested_deprecated(info-\u003eattrs, NL80211_ATTR_MAX,\nnet/wireless/pmsr.c:346:\t\t\t\t\t  tb[NL80211_PMSR_PEER_ATTR_CHAN],\nnet/wireless/pmsr.c-347-\t\t\t\t\t  NULL, info-\u003eextack);\n--\nnet/wireless/pmsr.c-356-\t/* no validation needed - was already done via nested policy */\nnet/wireless/pmsr.c:357:\tnla_parse_nested_deprecated(req, NL80211_PMSR_REQ_ATTR_MAX,\nnet/wireless/pmsr.c:358:\t\t\t\t    tb[NL80211_PMSR_PEER_ATTR_REQ], NULL,\nnet/wireless/pmsr.c-359-\t\t\t\t    NULL);\nnet/wireless/pmsr.c-360-\nnet/wireless/pmsr.c:361:\tif (!req[NL80211_PMSR_REQ_ATTR_DATA]) {\nnet/wireless/pmsr.c-362-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:363:\t\t\t\t    tb[NL80211_PMSR_PEER_ATTR_REQ],\nnet/wireless/pmsr.c-364-\t\t\t\t    \"missing request type/data\");\n--\nnet/wireless/pmsr.c-367-\nnet/wireless/pmsr.c:368:\tif (req[NL80211_PMSR_REQ_ATTR_GET_AP_TSF])\nnet/wireless/pmsr.c-369-\t\tout-\u003ereport_ap_tsf = true;\n--\nnet/wireless/pmsr.c-372-\t\tNL_SET_ERR_MSG_ATTR(info-\u003eextack,\nnet/wireless/pmsr.c:373:\t\t\t\t    req[NL80211_PMSR_REQ_ATTR_GET_AP_TSF],\nnet/wireless/pmsr.c-374-\t\t\t\t    \"reporting AP TSF is not supported\");\n--\nnet/wireless/pmsr.c-377-\nnet/wireless/pmsr.c:378:\tnla_for_each_nested(treq, req[NL80211_PMSR_REQ_ATTR_DATA], rem) {\nnet/wireless/pmsr.c-379-\t\tswitch (nla_type(treq)) {\nnet/wireless/pmsr.c:380:\t\tcase NL80211_PMSR_TYPE_FTM:\nnet/wireless/pmsr.c-381-\t\t\terr = pmsr_parse_ftm(rdev, treq, out, info);\n--\nnet/wireless/pmsr.c=396=int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/pmsr.c-414-\tpeers = nla_find(nla_data(reqattr), nla_len(reqattr),\nnet/wireless/pmsr.c:415:\t\t\t NL80211_PMSR_ATTR_PEERS);\nnet/wireless/pmsr.c-416-\tif (!peers)\n--\nnet/wireless/pmsr.c=568=static int nl80211_pmsr_send_ftm_res(struct sk_buff *msg,\n--\nnet/wireless/pmsr.c-570-{\nnet/wireless/pmsr.c:571:\tif (res-\u003estatus == NL80211_PMSR_STATUS_FAILURE) {\nnet/wireless/pmsr.c:572:\t\tif (nla_put_u32(msg, NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON,\nnet/wireless/pmsr.c-573-\t\t\t\tres-\u003eftm.failure_reason))\n--\n\n"
}
7/2 2026/07/03 10:19 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 20301
							output: 27
							thoughts: 109

Thoughts: 
**PMSR Contextualization and Configuration Strategy**

Okay, so I'm looking at `cfg80211_pmsr_free_wk` here, which immediately tells me this is related to Peer Measurement, or PMSR. That makes sense; I'm pretty familiar with the PMSR framework. Now, a key point to remember, and it's easy to overlook, is that the configuration for PMSR isn't isolated. It's deeply intertwined with the broader `CFG80211` and `NL80211` infrastructure.

To ensure proper enablement, I'll need to explicitly specify `CFG80211`, `MAC80211`, and `MAC80211_HWSIM` as EnableConfigs. This is the foundation I need to build upon. I'm taking the right steps here by thinking about this as a direct dependency on the higher-level configurations.

Just a moment, I should probably do a quick sanity check. Let me just scan to make absolutely sure there aren't any other subtly related configurations that I'm missing. Always a good practice to be thorough.

8/2 2026/07/03 10:19 tool grepper
0m Error: 
no matches

Args: 
{
  "Expression": "config PMSR",
  "PathPrefix": "net/wireless/"
}

Results: 
{
  "error": "no matches"
}
9/2 2026/07/03 10:19 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 20700
							output: 224
							thoughts: 432

Thoughts: 
**Analyzing the PMSR Patch**

Okay, so there isn't any specific configuration item directly related to PMSR in this patch, which is good to note up front. My focus needs to be on the code modifications themselves, specifically within the `cfg80211` subsystem. The patch primarily touches `cfg80211_pmsr_free_wk`, `cfg80211_pmsr_wdev_down`, and `cfg80211_release_pmsr`. I'll immediately add these to my FocusSymbols list – those are the key functions to dig into. I'll also add `cfg80211_init_wdev`, it seems related, and it's always good to have that function in mind as the wireless device is being initialized.

Now, let me review the change to `cfg80211_pmsr_free_wk` more closely. The snippet shows the work queue item and its execution context:

```c
void cfg80211_pmsr_free_wk(struct wiphy *wiphy, struct wiphy_work *work)
{
	struct wireless_dev *wdev = container_of(work, struct wireless_dev,
						 pmsr_free_wk);

	cfg80211_pmsr_process_abort(wdev);
}
```

Ah, right. The key here is the switch from a plain `work_struct` to a `wiphy_work`. This is *significant*. It means that the `wiphy` lock is now held *during* the execution of this work item. Consequently, the explicit guard condition that was previously present can be safely removed. This is a functional change, a refinement of the locking semantics within the `cfg80211` layer. It's a subtle but important change.

Considering the environment, this is relevant in the context of virtualization, particularly if using `mac80211_hwsim`. This change will be reachable in the simulator, so I need to make sure to build with the appropriate configurations to properly assess. My enabling configurations are going to be: `CFG80211`, `MAC80211`, and `MAC80211_HWSIM`.

With that analysis complete, I'm comfortable that I have a clear understanding of the patch's impact. Time to `set-results`.

10/2 2026/07/03 10:20 tool set-results
0m Args: 
{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_pmsr_free_wk",
    "cfg80211_pmsr_wdev_down",
    "cfg80211_release_pmsr",
    "cfg80211_init_wdev"
  ],
  "Reasoning": "The patch changes the pmsr_free_wk work item in struct wireless_dev from a standard work_struct to a wiphy_work. This alters the locking semantics, as wiphy_work is executed with the wiphy lock held, allowing the removal of the explicit guard(wiphy) in the work handler. This is a functional change in the cfg80211 subsystem that is reachable in virtualized environments via mac80211_hwsim.",
  "WorthFuzzing": true
}

Results: 
{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_pmsr_free_wk",
    "cfg80211_pmsr_wdev_down",
    "cfg80211_release_pmsr",
    "cfg80211_init_wdev"
  ],
  "Reasoning": "The patch changes the pmsr_free_wk work item in struct wireless_dev from a standard work_struct to a wiphy_work. This alters the locking semantics, as wiphy_work is executed with the wiphy lock held, allowing the removal of the explicit guard(wiphy) in the work handler. This is a functional change in the cfg80211 subsystem that is reachable in virtualized environments via mac80211_hwsim.",
  "WorthFuzzing": true
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)