AI Trajectory

null

{
  "EnableConfigs": [
    "ATH10K",
    "ATH10K_USB",
    "NL80211_TESTMODE"
  ],
  "FocusSymbols": [
    "ath10k_tm_event_wmi",
    "ath10k_tm_cmd"
  ],
  "Reasoning": "The patch modifies the `ath10k` wireless driver's testmode event handling logic to drop non-UTF WMI events. This is a functional change in the driver's firmware event processing. The driver can be fuzzed via its USB interface by emulating the device and sending WMI events, and the testmode can be activated via nl80211 commands.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 55eb04995730ba0309f5b08f93dc438cea0b907d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jul 31 07:59:40 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath10k/testmode.c b/drivers/net/wireless/ath/ath10k/testmode.c\nindex d3bd385694d6e..282ae6e20c8ef 100644\n--- a/drivers/net/wireless/ath/ath10k/testmode.c\n+++ b/drivers/net/wireless/ath/ath10k/testmode.c\n@@ -156,6 +156,14 @@ static void ath10k_tm_event_segmented(struct ath10k *ar, u32 cmd_id, struct sk_b\n \tcfg80211_testmode_event(nl_skb, GFP_ATOMIC);\n }\n \n+static bool ath10k_tm_is_utf_event(u32 cmd_id)\n+{\n+\treturn cmd_id == WMI_10X_PDEV_UTF_EVENTID ||\n+\t       cmd_id == WMI_10_2_PDEV_UTF_EVENTID ||\n+\t       cmd_id == WMI_10_4_PDEV_UTF_EVENTID ||\n+\t       cmd_id == WMI_TLV_PDEV_UTF_EVENTID;\n+}\n+\n /* Returns true if callee consumes the skb and the skb should be discarded.\n  * Returns false if skb is not used. Does not sleep.\n  */\n@@ -182,6 +190,12 @@ bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb)\n \t */\n \tconsumed = true;\n \n+\tif (!ath10k_tm_is_utf_event(cmd_id)) {\n+\t\tath10k_dbg(ar, ATH10K_DBG_TESTMODE,\n+\t\t\t   \"testmode drop non-utf event cmd_id %u\\n\", cmd_id);\n+\t\tgoto out;\n+\t}\n+\n \tif (ar-\u003etestmode.expected_seq != ATH10K_FTM_SEG_NONE)\n \t\tath10k_tm_event_segmented(ar, cmd_id, skb);\n \telse\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "ATH10K",
    "ATH10K_USB",
    "NL80211_TESTMODE"
  ],
  "FocusSymbols": [
    "ath10k_tm_event_wmi",
    "ath10k_tm_cmd"
  ],
  "Reasoning": "The patch modifies the `ath10k` wireless driver's testmode event handling logic to drop non-UTF WMI events. This is a functional change in the driver's firmware event processing. The driver can be fuzzed via its USB interface by emulating the device and sending WMI events, and the testmode can be activated via nl80211 commands.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 55eb04995730ba0309f5b08f93dc438cea0b907d
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jul 31 07:59:40 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath10k/testmode.c b/drivers/net/wireless/ath/ath10k/testmode.c
index d3bd385694d6e..282ae6e20c8ef 100644
--- a/drivers/net/wireless/ath/ath10k/testmode.c
+++ b/drivers/net/wireless/ath/ath10k/testmode.c
@@ -156,6 +156,14 @@ static void ath10k_tm_event_segmented(struct ath10k *ar, u32 cmd_id, struct sk_b
 	cfg80211_testmode_event(nl_skb, GFP_ATOMIC);
 }
 
+static bool ath10k_tm_is_utf_event(u32 cmd_id)
+{
+	return cmd_id == WMI_10X_PDEV_UTF_EVENTID ||
+	       cmd_id == WMI_10_2_PDEV_UTF_EVENTID ||
+	       cmd_id == WMI_10_4_PDEV_UTF_EVENTID ||
+	       cmd_id == WMI_TLV_PDEV_UTF_EVENTID;
+}
+
 /* Returns true if callee consumes the skb and the skb should be discarded.
  * Returns false if skb is not used. Does not sleep.
  */
@@ -182,6 +190,12 @@ bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb)
 	 */
 	consumed = true;
 
+	if (!ath10k_tm_is_utf_event(cmd_id)) {
+		ath10k_dbg(ar, ATH10K_DBG_TESTMODE,
+			   "testmode drop non-utf event cmd_id %u\n", cmd_id);
+		goto out;
+	}
+
 	if (ar->testmode.expected_seq != ATH10K_FTM_SEG_NONE)
 		ath10k_tm_event_segmented(ar, cmd_id, skb);
 	else

gemini-3.1-pro-preview

null

null

							input: 2392
							output: 39
							thoughts: 216
						

**Fuzzing the ath10k Driver: A Preliminary Assessment**

Okay, so there's a patch in front of me that tweaks `drivers/net/wireless/ath/ath10k/testmode.c`. It looks like it's adding a check, `ath10k_tm_is_utf_event(cmd_id)`, in `ath10k_tm_event_wmi`. Essentially, if it's not a UTF event, the code's dropping it. Fine. My mind immediately jumps to fuzzing this driver. It’s a wireless driver, so potentially vulnerable and interesting.

But wait. *ath10k*... that's the driver for specific Atheros hardware. This raises the critical question of whether I can fuzz it effectively. Can I even get it to run in QEMU? Wireless drivers are often finicky about physical hardware dependencies or specific emulation layers. Is *ath10k* like `mac80211_hwsim`, which is emulated, or is it a true hardware driver (PCI/SDIO/USB)? Seems the latter.

So, how can I even begin to fuzz this? Could I potentially leverage USB emulation? The question is, does `ath10k` have a USB driver path? I need to check that first. That's the key to making any progress here.

{
  "Expression": "ath10k.*usb",
  "PathPrefix": "drivers/net/wireless/ath/ath10k/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 504 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath10k/Makefile=34=ath10k_sdio-y += sdio.o\ndrivers/net/wireless/ath/ath10k/Makefile-35-\ndrivers/net/wireless/ath/ath10k/Makefile:36:obj-$(CONFIG_ATH10K_USB) += ath10k_usb.o\ndrivers/net/wireless/ath/ath10k/Makefile:37:ath10k_usb-y += usb.o\ndrivers/net/wireless/ath/ath10k/Makefile-38-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-17-\ndrivers/net/wireless/ath/ath10k/usb.c:18:static void ath10k_usb_post_recv_transfers(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c:19:\t\t\t\t\t   struct ath10k_usb_pipe *recv_pipe);\ndrivers/net/wireless/ath/ath10k/usb.c-20-\n--\ndrivers/net/wireless/ath/ath10k/usb.c=35=static struct ath10k_urb_context *\ndrivers/net/wireless/ath/ath10k/usb.c:36:ath10k_usb_alloc_urb_from_pipe(struct ath10k_usb_pipe *pipe)\ndrivers/net/wireless/ath/ath10k/usb.c-37-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-56-\ndrivers/net/wireless/ath/ath10k/usb.c:57:static void ath10k_usb_free_urb_to_pipe(struct ath10k_usb_pipe *pipe,\ndrivers/net/wireless/ath/ath10k/usb.c-58-\t\t\t\t\tstruct ath10k_urb_context *urb_context)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-73-\ndrivers/net/wireless/ath/ath10k/usb.c:74:static void ath10k_usb_cleanup_recv_urb(struct ath10k_urb_context *urb_context)\ndrivers/net/wireless/ath/ath10k/usb.c-75-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-78-\ndrivers/net/wireless/ath/ath10k/usb.c:79:\tath10k_usb_free_urb_to_pipe(urb_context-\u003epipe, urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-80-}\ndrivers/net/wireless/ath/ath10k/usb.c-81-\ndrivers/net/wireless/ath/ath10k/usb.c:82:static void ath10k_usb_free_pipe_resources(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c:83:\t\t\t\t\t   struct ath10k_usb_pipe *pipe)\ndrivers/net/wireless/ath/ath10k/usb.c-84-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-104-\tfor (;;) {\ndrivers/net/wireless/ath/ath10k/usb.c:105:\t\turb_context = ath10k_usb_alloc_urb_from_pipe(pipe);\ndrivers/net/wireless/ath/ath10k/usb.c-106-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-113-\ndrivers/net/wireless/ath/ath10k/usb.c:114:static void ath10k_usb_cleanup_pipe_resources(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-115-{\ndrivers/net/wireless/ath/ath10k/usb.c:116:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-117-\tint i;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-119-\tfor (i = 0; i \u003c ATH10K_USB_PIPE_MAX; i++)\ndrivers/net/wireless/ath/ath10k/usb.c:120:\t\tath10k_usb_free_pipe_resources(ar, \u0026ar_usb-\u003epipes[i]);\ndrivers/net/wireless/ath/ath10k/usb.c-121-}\n--\ndrivers/net/wireless/ath/ath10k/usb.c-124-\ndrivers/net/wireless/ath/ath10k/usb.c:125:static void ath10k_usb_recv_complete(struct urb *urb)\ndrivers/net/wireless/ath/ath10k/usb.c-126-{\ndrivers/net/wireless/ath/ath10k/usb.c-127-\tstruct ath10k_urb_context *urb_context = urb-\u003econtext;\ndrivers/net/wireless/ath/ath10k/usb.c:128:\tstruct ath10k_usb_pipe *pipe = urb_context-\u003epipe;\ndrivers/net/wireless/ath/ath10k/usb.c:129:\tstruct ath10k *ar = pipe-\u003ear_usb-\u003ear;\ndrivers/net/wireless/ath/ath10k/usb.c-130-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-172-cleanup_recv_urb:\ndrivers/net/wireless/ath/ath10k/usb.c:173:\tath10k_usb_cleanup_recv_urb(urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-174-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-177-\t\t/* our free urbs are piling up, post more transfers */\ndrivers/net/wireless/ath/ath10k/usb.c:178:\t\tath10k_usb_post_recv_transfers(ar, pipe);\ndrivers/net/wireless/ath/ath10k/usb.c-179-\t}\n--\ndrivers/net/wireless/ath/ath10k/usb.c-181-\ndrivers/net/wireless/ath/ath10k/usb.c:182:static void ath10k_usb_transmit_complete(struct urb *urb)\ndrivers/net/wireless/ath/ath10k/usb.c-183-{\ndrivers/net/wireless/ath/ath10k/usb.c-184-\tstruct ath10k_urb_context *urb_context = urb-\u003econtext;\ndrivers/net/wireless/ath/ath10k/usb.c:185:\tstruct ath10k_usb_pipe *pipe = urb_context-\u003epipe;\ndrivers/net/wireless/ath/ath10k/usb.c:186:\tstruct ath10k *ar = pipe-\u003ear_usb-\u003ear;\ndrivers/net/wireless/ath/ath10k/usb.c-187-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-196-\turb_context-\u003eskb = NULL;\ndrivers/net/wireless/ath/ath10k/usb.c:197:\tath10k_usb_free_urb_to_pipe(urb_context-\u003epipe, urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-198-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-204-/* pipe operations */\ndrivers/net/wireless/ath/ath10k/usb.c:205:static void ath10k_usb_post_recv_transfers(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c:206:\t\t\t\t\t   struct ath10k_usb_pipe *recv_pipe)\ndrivers/net/wireless/ath/ath10k/usb.c-207-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-212-\tfor (;;) {\ndrivers/net/wireless/ath/ath10k/usb.c:213:\t\turb_context = ath10k_usb_alloc_urb_from_pipe(recv_pipe);\ndrivers/net/wireless/ath/ath10k/usb.c-214-\t\tif (!urb_context)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-229-\t\t\t\t  ATH10K_USB_RX_BUFFER_SIZE,\ndrivers/net/wireless/ath/ath10k/usb.c:230:\t\t\t\t  ath10k_usb_recv_complete, urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-231-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-254-err:\ndrivers/net/wireless/ath/ath10k/usb.c:255:\tath10k_usb_cleanup_recv_urb(urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-256-}\ndrivers/net/wireless/ath/ath10k/usb.c-257-\ndrivers/net/wireless/ath/ath10k/usb.c:258:static void ath10k_usb_flush_all(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-259-{\ndrivers/net/wireless/ath/ath10k/usb.c:260:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-261-\tint i;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-270-\ndrivers/net/wireless/ath/ath10k/usb.c:271:static void ath10k_usb_start_recv_pipes(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-272-{\ndrivers/net/wireless/ath/ath10k/usb.c:273:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-274-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-276-\ndrivers/net/wireless/ath/ath10k/usb.c:277:\tath10k_usb_post_recv_transfers(ar,\ndrivers/net/wireless/ath/ath10k/usb.c-278-\t\t\t\t       \u0026ar_usb-\u003epipes[ATH10K_USB_PIPE_RX_DATA]);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-280-\ndrivers/net/wireless/ath/ath10k/usb.c:281:static void ath10k_usb_tx_complete(struct ath10k *ar, struct sk_buff *skb)\ndrivers/net/wireless/ath/ath10k/usb.c-282-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-291-\ndrivers/net/wireless/ath/ath10k/usb.c:292:static void ath10k_usb_rx_complete(struct ath10k *ar, struct sk_buff *skb)\ndrivers/net/wireless/ath/ath10k/usb.c-293-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-359-\ndrivers/net/wireless/ath/ath10k/usb.c:360:static void ath10k_usb_io_comp_work(struct work_struct *work)\ndrivers/net/wireless/ath/ath10k/usb.c-361-{\ndrivers/net/wireless/ath/ath10k/usb.c:362:\tstruct ath10k_usb_pipe *pipe = container_of(work,\ndrivers/net/wireless/ath/ath10k/usb.c:363:\t\t\t\t\t\t    struct ath10k_usb_pipe,\ndrivers/net/wireless/ath/ath10k/usb.c-364-\t\t\t\t\t\t    io_complete_work);\ndrivers/net/wireless/ath/ath10k/usb.c:365:\tstruct ath10k *ar = pipe-\u003ear_usb-\u003ear;\ndrivers/net/wireless/ath/ath10k/usb.c-366-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-369-\t\tif (pipe-\u003eflags \u0026 ATH10K_USB_PIPE_FLAG_TX)\ndrivers/net/wireless/ath/ath10k/usb.c:370:\t\t\tath10k_usb_tx_complete(ar, skb);\ndrivers/net/wireless/ath/ath10k/usb.c-371-\t\telse\ndrivers/net/wireless/ath/ath10k/usb.c:372:\t\t\tath10k_usb_rx_complete(ar, skb);\ndrivers/net/wireless/ath/ath10k/usb.c-373-\t}\n--\ndrivers/net/wireless/ath/ath10k/usb.c-375-\ndrivers/net/wireless/ath/ath10k/usb.c:376:#define ATH10K_USB_MAX_DIAG_CMD (sizeof(struct ath10k_usb_ctrl_diag_cmd_write))\ndrivers/net/wireless/ath/ath10k/usb.c:377:#define ATH10K_USB_MAX_DIAG_RESP (sizeof(struct ath10k_usb_ctrl_diag_resp_read))\ndrivers/net/wireless/ath/ath10k/usb.c-378-\ndrivers/net/wireless/ath/ath10k/usb.c:379:static void ath10k_usb_destroy(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-380-{\ndrivers/net/wireless/ath/ath10k/usb.c:381:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-382-\ndrivers/net/wireless/ath/ath10k/usb.c:383:\tath10k_usb_flush_all(ar);\ndrivers/net/wireless/ath/ath10k/usb.c:384:\tath10k_usb_cleanup_pipe_resources(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-385-\tusb_set_intfdata(ar_usb-\u003einterface, NULL);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-390-\ndrivers/net/wireless/ath/ath10k/usb.c:391:static int ath10k_usb_hif_start(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-392-{\ndrivers/net/wireless/ath/ath10k/usb.c-393-\tint i;\ndrivers/net/wireless/ath/ath10k/usb.c:394:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-395-\ndrivers/net/wireless/ath/ath10k/usb.c-396-\tath10k_core_napi_enable(ar);\ndrivers/net/wireless/ath/ath10k/usb.c:397:\tath10k_usb_start_recv_pipes(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-398-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-408-\ndrivers/net/wireless/ath/ath10k/usb.c:409:static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,\ndrivers/net/wireless/ath/ath10k/usb.c-410-\t\t\t\tstruct ath10k_hif_sg_item *items, int n_items)\ndrivers/net/wireless/ath/ath10k/usb.c-411-{\ndrivers/net/wireless/ath/ath10k/usb.c:412:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c:413:\tstruct ath10k_usb_pipe *pipe = \u0026ar_usb-\u003epipes[pipe_id];\ndrivers/net/wireless/ath/ath10k/usb.c-414-\tstruct ath10k_urb_context *urb_context;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-419-\tfor (i = 0; i \u003c n_items; i++) {\ndrivers/net/wireless/ath/ath10k/usb.c:420:\t\turb_context = ath10k_usb_alloc_urb_from_pipe(pipe);\ndrivers/net/wireless/ath/ath10k/usb.c-421-\t\tif (!urb_context) {\n--\ndrivers/net/wireless/ath/ath10k/usb.c-439-\t\t\t\t  skb-\u003elen,\ndrivers/net/wireless/ath/ath10k/usb.c:440:\t\t\t\t  ath10k_usb_transmit_complete, urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-441-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-463-err_free_urb_to_pipe:\ndrivers/net/wireless/ath/ath10k/usb.c:464:\tath10k_usb_free_urb_to_pipe(urb_context-\u003epipe, urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-465-err:\n--\ndrivers/net/wireless/ath/ath10k/usb.c-468-\ndrivers/net/wireless/ath/ath10k/usb.c:469:static void ath10k_usb_hif_stop(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-470-{\ndrivers/net/wireless/ath/ath10k/usb.c:471:\tath10k_usb_flush_all(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-472-\tath10k_core_napi_sync_disable(ar);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-474-\ndrivers/net/wireless/ath/ath10k/usb.c:475:static u16 ath10k_usb_hif_get_free_queue_number(struct ath10k *ar, u8 pipe_id)\ndrivers/net/wireless/ath/ath10k/usb.c-476-{\ndrivers/net/wireless/ath/ath10k/usb.c:477:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-478-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-481-\ndrivers/net/wireless/ath/ath10k/usb.c:482:static int ath10k_usb_submit_ctrl_out(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-483-\t\t\t\t      u8 req, u16 value, u16 index, void *data,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-485-{\ndrivers/net/wireless/ath/ath10k/usb.c:486:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-487-\tu8 *buf = NULL;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-504-\tif (ret \u003c 0) {\ndrivers/net/wireless/ath/ath10k/usb.c:505:\t\tath10k_warn(ar, \"Failed to submit usb control message: %d\\n\",\ndrivers/net/wireless/ath/ath10k/usb.c-506-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-515-\ndrivers/net/wireless/ath/ath10k/usb.c:516:static int ath10k_usb_submit_ctrl_in(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-517-\t\t\t\t     u8 req, u16 value, u16 index, void *data,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-519-{\ndrivers/net/wireless/ath/ath10k/usb.c:520:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-521-\tu8 *buf = NULL;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-538-\tif (ret \u003c 0) {\ndrivers/net/wireless/ath/ath10k/usb.c:539:\t\tath10k_warn(ar, \"Failed to read usb control message: %d\\n\",\ndrivers/net/wireless/ath/ath10k/usb.c-540-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-551-\ndrivers/net/wireless/ath/ath10k/usb.c:552:static int ath10k_usb_ctrl_msg_exchange(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-553-\t\t\t\t\tu8 req_val, u8 *req_buf, u32 req_len,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-559-\t/* send command */\ndrivers/net/wireless/ath/ath10k/usb.c:560:\tret = ath10k_usb_submit_ctrl_out(ar, req_val, 0, 0,\ndrivers/net/wireless/ath/ath10k/usb.c-561-\t\t\t\t\t req_buf, req_len);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-566-\tif (resp_buf) {\ndrivers/net/wireless/ath/ath10k/usb.c:567:\t\tret = ath10k_usb_submit_ctrl_in(ar, resp_val, 0, 0,\ndrivers/net/wireless/ath/ath10k/usb.c-568-\t\t\t\t\t\tresp_buf, *resp_len);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-577-\ndrivers/net/wireless/ath/ath10k/usb.c:578:static int ath10k_usb_hif_diag_read(struct ath10k *ar, u32 address, void *buf,\ndrivers/net/wireless/ath/ath10k/usb.c-579-\t\t\t\t    size_t buf_len)\ndrivers/net/wireless/ath/ath10k/usb.c-580-{\ndrivers/net/wireless/ath/ath10k/usb.c:581:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c:582:\tstruct ath10k_usb_ctrl_diag_cmd_read *cmd;\ndrivers/net/wireless/ath/ath10k/usb.c-583-\tu32 resp_len;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-585-\ndrivers/net/wireless/ath/ath10k/usb.c:586:\tif (buf_len \u003c sizeof(struct ath10k_usb_ctrl_diag_resp_read))\ndrivers/net/wireless/ath/ath10k/usb.c-587-\t\treturn -EINVAL;\ndrivers/net/wireless/ath/ath10k/usb.c-588-\ndrivers/net/wireless/ath/ath10k/usb.c:589:\tcmd = (struct ath10k_usb_ctrl_diag_cmd_read *)ar_usb-\u003ediag_cmd_buffer;\ndrivers/net/wireless/ath/ath10k/usb.c-590-\tmemset(cmd, 0, sizeof(*cmd));\n--\ndrivers/net/wireless/ath/ath10k/usb.c-592-\tcmd-\u003eaddress = cpu_to_le32(address);\ndrivers/net/wireless/ath/ath10k/usb.c:593:\tresp_len = sizeof(struct ath10k_usb_ctrl_diag_resp_read);\ndrivers/net/wireless/ath/ath10k/usb.c-594-\ndrivers/net/wireless/ath/ath10k/usb.c:595:\tret = ath10k_usb_ctrl_msg_exchange(ar,\ndrivers/net/wireless/ath/ath10k/usb.c-596-\t\t\t\t\t   ATH10K_USB_CONTROL_REQ_DIAG_CMD,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-603-\ndrivers/net/wireless/ath/ath10k/usb.c:604:\tif (resp_len != sizeof(struct ath10k_usb_ctrl_diag_resp_read))\ndrivers/net/wireless/ath/ath10k/usb.c-605-\t\treturn -EMSGSIZE;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-607-\tmemcpy(buf, ar_usb-\u003ediag_resp_buffer,\ndrivers/net/wireless/ath/ath10k/usb.c:608:\t       sizeof(struct ath10k_usb_ctrl_diag_resp_read));\ndrivers/net/wireless/ath/ath10k/usb.c-609-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-612-\ndrivers/net/wireless/ath/ath10k/usb.c:613:static int ath10k_usb_hif_diag_write(struct ath10k *ar, u32 address,\ndrivers/net/wireless/ath/ath10k/usb.c-614-\t\t\t\t     const void *data, int nbytes)\ndrivers/net/wireless/ath/ath10k/usb.c-615-{\ndrivers/net/wireless/ath/ath10k/usb.c:616:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c:617:\tstruct ath10k_usb_ctrl_diag_cmd_write *cmd;\ndrivers/net/wireless/ath/ath10k/usb.c-618-\tint ret;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-622-\ndrivers/net/wireless/ath/ath10k/usb.c:623:\tcmd = (struct ath10k_usb_ctrl_diag_cmd_write *)ar_usb-\u003ediag_cmd_buffer;\ndrivers/net/wireless/ath/ath10k/usb.c-624-\tmemset(cmd, 0, sizeof(*cmd));\n--\ndrivers/net/wireless/ath/ath10k/usb.c-628-\ndrivers/net/wireless/ath/ath10k/usb.c:629:\tret = ath10k_usb_ctrl_msg_exchange(ar,\ndrivers/net/wireless/ath/ath10k/usb.c-630-\t\t\t\t\t   ATH10K_USB_CONTROL_REQ_DIAG_CMD,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-639-\ndrivers/net/wireless/ath/ath10k/usb.c:640:static int ath10k_usb_bmi_exchange_msg(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-641-\t\t\t\t       void *req, u32 req_len,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-646-\tif (req) {\ndrivers/net/wireless/ath/ath10k/usb.c:647:\t\tret = ath10k_usb_submit_ctrl_out(ar,\ndrivers/net/wireless/ath/ath10k/usb.c-648-\t\t\t\t\t\t ATH10K_USB_CONTROL_REQ_SEND_BMI_CMD,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-658-\tif (resp) {\ndrivers/net/wireless/ath/ath10k/usb.c:659:\t\tret = ath10k_usb_submit_ctrl_in(ar,\ndrivers/net/wireless/ath/ath10k/usb.c-660-\t\t\t\t\t\tATH10K_USB_CONTROL_REQ_RECV_BMI_RESP,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-672-\ndrivers/net/wireless/ath/ath10k/usb.c:673:static void ath10k_usb_hif_get_default_pipe(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-674-\t\t\t\t\t    u8 *ul_pipe, u8 *dl_pipe)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-679-\ndrivers/net/wireless/ath/ath10k/usb.c:680:static int ath10k_usb_hif_map_service_to_pipe(struct ath10k *ar, u16 svc_id,\ndrivers/net/wireless/ath/ath10k/usb.c-681-\t\t\t\t\t      u8 *ul_pipe, u8 *dl_pipe)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-703-\ndrivers/net/wireless/ath/ath10k/usb.c:704:static int ath10k_usb_hif_power_up(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-705-\t\t\t\t   enum ath10k_firmware_mode fw_mode)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-709-\ndrivers/net/wireless/ath/ath10k/usb.c:710:static void ath10k_usb_hif_power_down(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-711-{\ndrivers/net/wireless/ath/ath10k/usb.c:712:\tath10k_usb_flush_all(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-713-}\n--\ndrivers/net/wireless/ath/ath10k/usb.c-716-\ndrivers/net/wireless/ath/ath10k/usb.c:717:static int ath10k_usb_hif_suspend(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-718-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-721-\ndrivers/net/wireless/ath/ath10k/usb.c:722:static int ath10k_usb_hif_resume(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-723-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-727-\ndrivers/net/wireless/ath/ath10k/usb.c:728:static const struct ath10k_hif_ops ath10k_usb_hif_ops = {\ndrivers/net/wireless/ath/ath10k/usb.c:729:\t.tx_sg\t\t\t= ath10k_usb_hif_tx_sg,\ndrivers/net/wireless/ath/ath10k/usb.c:730:\t.diag_read\t\t= ath10k_usb_hif_diag_read,\ndrivers/net/wireless/ath/ath10k/usb.c:731:\t.diag_write\t\t= ath10k_usb_hif_diag_write,\ndrivers/net/wireless/ath/ath10k/usb.c:732:\t.exchange_bmi_msg\t= ath10k_usb_bmi_exchange_msg,\ndrivers/net/wireless/ath/ath10k/usb.c:733:\t.start\t\t\t= ath10k_usb_hif_start,\ndrivers/net/wireless/ath/ath10k/usb.c:734:\t.stop\t\t\t= ath10k_usb_hif_stop,\ndrivers/net/wireless/ath/ath10k/usb.c:735:\t.map_service_to_pipe\t= ath10k_usb_hif_map_service_to_pipe,\ndrivers/net/wireless/ath/ath10k/usb.c:736:\t.get_default_pipe\t= ath10k_usb_hif_get_default_pipe,\ndrivers/net/wireless/ath/ath10k/usb.c:737:\t.get_free_queue_number\t= ath10k_usb_hif_get_free_queue_number,\ndrivers/net/wireless/ath/ath10k/usb.c:738:\t.power_up\t\t= ath10k_usb_hif_power_up,\ndrivers/net/wireless/ath/ath10k/usb.c:739:\t.power_down\t\t= ath10k_usb_hif_power_down,\ndrivers/net/wireless/ath/ath10k/usb.c-740-#ifdef CONFIG_PM\ndrivers/net/wireless/ath/ath10k/usb.c:741:\t.suspend\t\t= ath10k_usb_hif_suspend,\ndrivers/net/wireless/ath/ath10k/usb.c:742:\t.resume\t\t\t= ath10k_usb_hif_resume,\ndrivers/net/wireless/ath/ath10k/usb.c-743-#endif\n--\ndrivers/net/wireless/ath/ath10k/usb.c-745-\ndrivers/net/wireless/ath/ath10k/usb.c:746:static u8 ath10k_usb_get_logical_pipe_num(u8 ep_address, int *urb_count)\ndrivers/net/wireless/ath/ath10k/usb.c-747-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-790-\ndrivers/net/wireless/ath/ath10k/usb.c:791:static int ath10k_usb_alloc_pipe_resources(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c:792:\t\t\t\t\t   struct ath10k_usb_pipe *pipe,\ndrivers/net/wireless/ath/ath10k/usb.c-793-\t\t\t\t\t   int urb_cnt)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-811-\t\tpipe-\u003eurb_alloc++;\ndrivers/net/wireless/ath/ath10k/usb.c:812:\t\tath10k_usb_free_urb_to_pipe(pipe, urb_context);\ndrivers/net/wireless/ath/ath10k/usb.c-813-\t}\n--\ndrivers/net/wireless/ath/ath10k/usb.c-822-\ndrivers/net/wireless/ath/ath10k/usb.c:823:static int ath10k_usb_setup_pipe_resources(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-824-\t\t\t\t\t   struct usb_interface *interface)\ndrivers/net/wireless/ath/ath10k/usb.c-825-{\ndrivers/net/wireless/ath/ath10k/usb.c:826:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-827-\tstruct usb_host_interface *iface_desc = interface-\u003ecur_altsetting;\ndrivers/net/wireless/ath/ath10k/usb.c-828-\tstruct usb_endpoint_descriptor *endpoint;\ndrivers/net/wireless/ath/ath10k/usb.c:829:\tstruct ath10k_usb_pipe *pipe;\ndrivers/net/wireless/ath/ath10k/usb.c-830-\tint ret, i, urbcount;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-832-\ndrivers/net/wireless/ath/ath10k/usb.c:833:\tath10k_dbg(ar, ATH10K_DBG_USB, \"usb setting up pipes using interface\\n\");\ndrivers/net/wireless/ath/ath10k/usb.c-834-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-871-\t\tpipe_num =\ndrivers/net/wireless/ath/ath10k/usb.c:872:\t\t    ath10k_usb_get_logical_pipe_num(endpoint-\u003ebEndpointAddress,\ndrivers/net/wireless/ath/ath10k/usb.c-873-\t\t\t\t\t\t    \u0026urbcount);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-924-\ndrivers/net/wireless/ath/ath10k/usb.c:925:\t\tret = ath10k_usb_alloc_pipe_resources(ar, pipe, urbcount);\ndrivers/net/wireless/ath/ath10k/usb.c-926-\t\tif (ret)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-932-\ndrivers/net/wireless/ath/ath10k/usb.c:933:static int ath10k_usb_create(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-934-\t\t\t     struct usb_interface *interface)\ndrivers/net/wireless/ath/ath10k/usb.c-935-{\ndrivers/net/wireless/ath/ath10k/usb.c:936:\tstruct ath10k_usb *ar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-937-\tstruct usb_device *dev = interface_to_usbdev(interface);\ndrivers/net/wireless/ath/ath10k/usb.c:938:\tstruct ath10k_usb_pipe *pipe;\ndrivers/net/wireless/ath/ath10k/usb.c-939-\tint ret, i;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-948-\t\tINIT_WORK(\u0026pipe-\u003eio_complete_work,\ndrivers/net/wireless/ath/ath10k/usb.c:949:\t\t\t  ath10k_usb_io_comp_work);\ndrivers/net/wireless/ath/ath10k/usb.c-950-\t\tskb_queue_head_init(\u0026pipe-\u003eio_comp_queue);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-965-\ndrivers/net/wireless/ath/ath10k/usb.c:966:\tret = ath10k_usb_setup_pipe_resources(ar, interface);\ndrivers/net/wireless/ath/ath10k/usb.c-967-\tif (ret)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-972-err:\ndrivers/net/wireless/ath/ath10k/usb.c:973:\tath10k_usb_destroy(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-974-\treturn ret;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-976-\ndrivers/net/wireless/ath/ath10k/usb.c:977:static int ath10k_usb_napi_poll(struct napi_struct *ctx, int budget)\ndrivers/net/wireless/ath/ath10k/usb.c-978-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c-990-\ndrivers/net/wireless/ath/ath10k/usb.c:991:/* ath10k usb driver registered functions */\ndrivers/net/wireless/ath/ath10k/usb.c:992:static int ath10k_usb_probe(struct usb_interface *interface,\ndrivers/net/wireless/ath/ath10k/usb.c-993-\t\t\t    const struct usb_device_id *id)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-995-\tstruct ath10k *ar;\ndrivers/net/wireless/ath/ath10k/usb.c:996:\tstruct ath10k_usb *ar_usb;\ndrivers/net/wireless/ath/ath10k/usb.c-997-\tstruct usb_device *dev = interface_to_usbdev(interface);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1009-\ndrivers/net/wireless/ath/ath10k/usb.c:1010:\tar = ath10k_core_create(sizeof(*ar_usb), \u0026dev-\u003edev, ATH10K_BUS_USB,\ndrivers/net/wireless/ath/ath10k/usb.c:1011:\t\t\t\thw_rev, \u0026ath10k_usb_hif_ops);\ndrivers/net/wireless/ath/ath10k/usb.c-1012-\tif (!ar) {\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1016-\ndrivers/net/wireless/ath/ath10k/usb.c:1017:\tnetif_napi_add(ar-\u003enapi_dev, \u0026ar-\u003enapi, ath10k_usb_napi_poll);\ndrivers/net/wireless/ath/ath10k/usb.c-1018-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1025-\ndrivers/net/wireless/ath/ath10k/usb.c:1026:\tar_usb = ath10k_usb_priv(ar);\ndrivers/net/wireless/ath/ath10k/usb.c:1027:\tret = ath10k_usb_create(ar, interface);\ndrivers/net/wireless/ath/ath10k/usb.c-1028-\tif (ret)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1051-err_usb_destroy:\ndrivers/net/wireless/ath/ath10k/usb.c:1052:\tath10k_usb_destroy(ar);\ndrivers/net/wireless/ath/ath10k/usb.c-1053-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1059-\ndrivers/net/wireless/ath/ath10k/usb.c:1060:static void ath10k_usb_disconnect(struct usb_interface *interface)\ndrivers/net/wireless/ath/ath10k/usb.c-1061-{\ndrivers/net/wireless/ath/ath10k/usb.c:1062:\tstruct ath10k_usb *ar_usb;\ndrivers/net/wireless/ath/ath10k/usb.c-1063-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1067-\ndrivers/net/wireless/ath/ath10k/usb.c:1068:\tath10k_core_unregister(ar_usb-\u003ear);\ndrivers/net/wireless/ath/ath10k/usb.c-1069-\tnetif_napi_del(\u0026ar_usb-\u003ear-\u003enapi);\ndrivers/net/wireless/ath/ath10k/usb.c:1070:\tath10k_usb_destroy(ar_usb-\u003ear);\ndrivers/net/wireless/ath/ath10k/usb.c:1071:\tath10k_core_destroy(ar_usb-\u003ear);\ndrivers/net/wireless/ath/ath10k/usb.c-1072-}\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1075-\ndrivers/net/wireless/ath/ath10k/usb.c:1076:static int ath10k_usb_pm_suspend(struct usb_interface *interface,\ndrivers/net/wireless/ath/ath10k/usb.c-1077-\t\t\t\t pm_message_t message)\ndrivers/net/wireless/ath/ath10k/usb.c-1078-{\ndrivers/net/wireless/ath/ath10k/usb.c:1079:\tstruct ath10k_usb *ar_usb = usb_get_intfdata(interface);\ndrivers/net/wireless/ath/ath10k/usb.c-1080-\ndrivers/net/wireless/ath/ath10k/usb.c:1081:\tath10k_usb_flush_all(ar_usb-\u003ear);\ndrivers/net/wireless/ath/ath10k/usb.c-1082-\treturn 0;\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1084-\ndrivers/net/wireless/ath/ath10k/usb.c:1085:static int ath10k_usb_pm_resume(struct usb_interface *interface)\ndrivers/net/wireless/ath/ath10k/usb.c-1086-{\ndrivers/net/wireless/ath/ath10k/usb.c:1087:\tstruct ath10k_usb *ar_usb = usb_get_intfdata(interface);\ndrivers/net/wireless/ath/ath10k/usb.c:1088:\tstruct ath10k *ar = ar_usb-\u003ear;\ndrivers/net/wireless/ath/ath10k/usb.c-1089-\ndrivers/net/wireless/ath/ath10k/usb.c:1090:\tath10k_usb_post_recv_transfers(ar,\ndrivers/net/wireless/ath/ath10k/usb.c-1091-\t\t\t\t       \u0026ar_usb-\u003epipes[ATH10K_USB_PIPE_RX_DATA]);\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1097-\ndrivers/net/wireless/ath/ath10k/usb.c:1098:#define ath10k_usb_pm_suspend NULL\ndrivers/net/wireless/ath/ath10k/usb.c:1099:#define ath10k_usb_pm_resume NULL\ndrivers/net/wireless/ath/ath10k/usb.c-1100-\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1103-/* table of devices that work with this driver */\ndrivers/net/wireless/ath/ath10k/usb.c:1104:static struct usb_device_id ath10k_usb_ids[] = {\ndrivers/net/wireless/ath/ath10k/usb.c-1105-\t{USB_DEVICE(0x13b1, 0x0042)}, /* Linksys WUSB6100M */\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1108-\ndrivers/net/wireless/ath/ath10k/usb.c:1109:MODULE_DEVICE_TABLE(usb, ath10k_usb_ids);\ndrivers/net/wireless/ath/ath10k/usb.c-1110-\ndrivers/net/wireless/ath/ath10k/usb.c:1111:static struct usb_driver ath10k_usb_driver = {\ndrivers/net/wireless/ath/ath10k/usb.c:1112:\t.name = \"ath10k_usb\",\ndrivers/net/wireless/ath/ath10k/usb.c:1113:\t.probe = ath10k_usb_probe,\ndrivers/net/wireless/ath/ath10k/usb.c:1114:\t.suspend = ath10k_usb_pm_suspend,\ndrivers/net/wireless/ath/ath10k/usb.c:1115:\t.resume = ath10k_usb_pm_resume,\ndrivers/net/wireless/ath/ath10k/usb.c:1116:\t.disconnect = ath10k_usb_disconnect,\ndrivers/net/wireless/ath/ath10k/usb.c:1117:\t.id_table = ath10k_usb_ids,\ndrivers/net/wireless/ath/ath10k/usb.c-1118-\t.supports_autosuspend = true,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-1121-\ndrivers/net/wireless/ath/ath10k/usb.c:1122:module_usb_driver(ath10k_usb_driver);\ndrivers/net/wireless/ath/ath10k/usb.c-1123-\n--\ndrivers/net/wireless/ath/ath10k/usb.h-43-\ndrivers/net/wireless/ath/ath10k/usb.h:44:struct ath10k_usb_ctrl_diag_cmd_write {\ndrivers/net/wireless/ath/ath10k/usb.h-45-\t__le32 cmd;\n--\ndrivers/net/wireless/ath/ath10k/usb.h-50-\ndrivers/net/wireless/ath/ath10k/usb.h:51:struct ath10k_usb_ctrl_diag_cmd_read {\ndrivers/net/wireless/ath/ath10k/usb.h-52-\t__le32 cmd;\n--\ndrivers/net/wireless/ath/ath10k/usb.h-55-\ndrivers/net/wireless/ath/ath10k/usb.h:56:struct ath10k_usb_ctrl_diag_resp_read {\ndrivers/net/wireless/ath/ath10k/usb.h-57-\tu8 value[4];\n--\ndrivers/net/wireless/ath/ath10k/usb.h-60-/* tx/rx pipes for usb */\ndrivers/net/wireless/ath/ath10k/usb.h:61:enum ath10k_usb_pipe_id {\ndrivers/net/wireless/ath/ath10k/usb.h-62-\tATH10K_USB_PIPE_TX_CTRL = 0,\n--\ndrivers/net/wireless/ath/ath10k/usb.h-72-\ndrivers/net/wireless/ath/ath10k/usb.h:73:struct ath10k_usb_pipe {\ndrivers/net/wireless/ath/ath10k/usb.h-74-\tstruct list_head urb_list_head;\n--\ndrivers/net/wireless/ath/ath10k/usb.h-82-\tu8 logical_pipe_num;\ndrivers/net/wireless/ath/ath10k/usb.h:83:\tstruct ath10k_usb *ar_usb;\ndrivers/net/wireless/ath/ath10k/usb.h-84-\tu16 max_packet_size;\n--\ndrivers/net/wireless/ath/ath10k/usb.h-92-/* usb device object */\ndrivers/net/wireless/ath/ath10k/usb.h:93:struct ath10k_usb {\ndrivers/net/wireless/ath/ath10k/usb.h-94-\t/* protects pipe-\u003eurb_list_head and  pipe-\u003eurb_cnt */\n--\ndrivers/net/wireless/ath/ath10k/usb.h-98-\tstruct usb_interface *interface;\ndrivers/net/wireless/ath/ath10k/usb.h:99:\tstruct ath10k_usb_pipe pipes[ATH10K_USB_PIPE_MAX];\ndrivers/net/wireless/ath/ath10k/usb.h-100-\tu8 *diag_cmd_buffer;\n--\ndrivers/net/wireless/ath/ath10k/usb.h=106=struct ath10k_urb_context {\ndrivers/net/wireless/ath/ath10k/usb.h-107-\tstruct list_head link;\ndrivers/net/wireless/ath/ath10k/usb.h:108:\tstruct ath10k_usb_pipe *pipe;\ndrivers/net/wireless/ath/ath10k/usb.h-109-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/ath/ath10k/usb.h-112-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 16760
							output: 35
							thoughts: 89
						

Here's my thought process, as it stands:

**Initial Assessment of `ath10k` Fuzzing Potential**

Okay, so I'm trying to figure out the best approach to fuzzing the `ath10k` driver. Good, it looks like `ath10k` *does* have a USB driver (`ath10k_usb`), which means I have a potential avenue for fuzzing via USB emulation, which is great. That opens up a lot of possibilities. Now, I need to dig deeper...
Hang on a minute! I vaguely recall something about a test mode... specifically, `ath10k_tm_event_wmi`. I think I saw that in `testmode.c`. The question is, is that test mode enabled by default, or is it contingent on some kind of configuration setting? I need to figure out how to trigger that `testmode` path, it might expose a lot of useful test points. Alright, time to check the Kconfig. I'll need to look at `drivers/net/wireless/ath/ath10k/Kconfig` to see how test mode is handled.

{
  "Expression": "testmode",
  "PathPrefix": "drivers/net/wireless/ath/ath10k/"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/Makefile=18=ath10k_core-$(CONFIG_ATH10K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath10k/Makefile:19:ath10k_core-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath10k/Makefile-20-ath10k_core-$(CONFIG_ATH10K_TRACING) += trace.o\n--\ndrivers/net/wireless/ath/ath10k/core.c-27-#include \"htt.h\"\ndrivers/net/wireless/ath/ath10k/core.c:28:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath10k/core.c-29-#include \"wmi-ops.h\"\n--\ndrivers/net/wireless/ath/ath10k/core.c=57=MODULE_PARM_DESC(uart_print, \"Uart target debugging\");\ndrivers/net/wireless/ath/ath10k/core.c:58:MODULE_PARM_DESC(skip_otp, \"Skip otp failure for calibration in testmode\");\ndrivers/net/wireless/ath/ath10k/core.c-59-MODULE_PARM_DESC(cryptmode, \"Crypto mode: 0-hardware, 1-software\");\n--\ndrivers/net/wireless/ath/ath10k/core.c=3586=void ath10k_core_unregister(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/core.c-3607-\ndrivers/net/wireless/ath/ath10k/core.c:3608:\tath10k_testmode_destroy(ar);\ndrivers/net/wireless/ath/ath10k/core.c-3609-\n--\ndrivers/net/wireless/ath/ath10k/core.h=1011=struct ath10k {\n--\ndrivers/net/wireless/ath/ath10k/core.h-1268-\t\tu8 *eventdata;\ndrivers/net/wireless/ath/ath10k/core.h:1269:\t} testmode;\ndrivers/net/wireless/ath/ath10k/core.h-1270-\n--\ndrivers/net/wireless/ath/ath10k/debug.c=42=void ath10k_debug_print_hwfw_info(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/debug.c-55-\ndrivers/net/wireless/ath/ath10k/debug.c:56:\tath10k_info(ar, \"kconfig debug %d debugfs %d tracing %d dfs %d testmode %d\\n\",\ndrivers/net/wireless/ath/ath10k/debug.c-57-\t\t    IS_ENABLED(CONFIG_ATH10K_DEBUG),\n--\ndrivers/net/wireless/ath/ath10k/mac.c-25-#include \"txrx.h\"\ndrivers/net/wireless/ath/ath10k/mac.c:26:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath10k/mac.c-27-#include \"wmi-tlv.h\"\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-6-\ndrivers/net/wireless/ath/ath10k/testmode.c:7:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath10k/testmode.c-8-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-18-\ndrivers/net/wireless/ath/ath10k/testmode.c:19:#include \"testmode_i.h\"\ndrivers/net/wireless/ath/ath10k/testmode.c-20-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=34=static void ath10k_tm_event_unsegmented(struct ath10k *ar, u32 cmd_id,\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-39-\ndrivers/net/wireless/ath/ath10k/testmode.c:40:\tnl_skb = cfg80211_testmode_alloc_event_skb(ar-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath10k/testmode.c-41-\t\t\t\t\t\t   2 * sizeof(u32) + skb-\u003elen,\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-44-\t\tath10k_warn(ar,\ndrivers/net/wireless/ath/ath10k/testmode.c:45:\t\t\t    \"failed to allocate skb for testmode wmi event\\n\");\ndrivers/net/wireless/ath/ath10k/testmode.c-46-\t\treturn;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-51-\t\tath10k_warn(ar,\ndrivers/net/wireless/ath/ath10k/testmode.c:52:\t\t\t    \"failed to put testmode wmi event cmd attribute: %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-53-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-60-\t\tath10k_warn(ar,\ndrivers/net/wireless/ath/ath10k/testmode.c:61:\t\t\t    \"failed to put testmode wmi event cmd_id: %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-62-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-69-\t\tath10k_warn(ar,\ndrivers/net/wireless/ath/ath10k/testmode.c:70:\t\t\t    \"failed to copy skb to testmode wmi event: %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-71-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-75-\ndrivers/net/wireless/ath/ath10k/testmode.c:76:\tcfg80211_testmode_event(nl_skb, GFP_ATOMIC);\ndrivers/net/wireless/ath/ath10k/testmode.c-77-}\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=79=static void ath10k_tm_event_segmented(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-101-\tif (current_seq == 0) {\ndrivers/net/wireless/ath/ath10k/testmode.c:102:\t\tar-\u003etestmode.expected_seq = 0;\ndrivers/net/wireless/ath/ath10k/testmode.c:103:\t\tar-\u003etestmode.data_pos = 0;\ndrivers/net/wireless/ath/ath10k/testmode.c-104-\t}\ndrivers/net/wireless/ath/ath10k/testmode.c-105-\ndrivers/net/wireless/ath/ath10k/testmode.c:106:\tdata_pos = ar-\u003etestmode.data_pos;\ndrivers/net/wireless/ath/ath10k/testmode.c-107-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-114-\ndrivers/net/wireless/ath/ath10k/testmode.c:115:\tmemcpy(\u0026ar-\u003etestmode.eventdata[data_pos], buf_pos, datalen);\ndrivers/net/wireless/ath/ath10k/testmode.c-116-\tdata_pos += datalen;\ndrivers/net/wireless/ath/ath10k/testmode.c-117-\ndrivers/net/wireless/ath/ath10k/testmode.c:118:\tif (++ar-\u003etestmode.expected_seq != total_segments) {\ndrivers/net/wireless/ath/ath10k/testmode.c:119:\t\tar-\u003etestmode.data_pos = data_pos;\ndrivers/net/wireless/ath/ath10k/testmode.c-120-\t\tath10k_dbg(ar, ATH10K_DBG_TESTMODE, \"partial data received %u/%u\\n\",\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-126-\ndrivers/net/wireless/ath/ath10k/testmode.c:127:\tnl_skb = cfg80211_testmode_alloc_event_skb(ar-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath10k/testmode.c-128-\t\t\t\t\t\t   2 * sizeof(u32) + data_pos,\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-130-\tif (!nl_skb) {\ndrivers/net/wireless/ath/ath10k/testmode.c:131:\t\tath10k_warn(ar, \"failed to allocate skb for testmode wmi event\\n\");\ndrivers/net/wireless/ath/ath10k/testmode.c-132-\t\treturn;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-136-\tif (ret) {\ndrivers/net/wireless/ath/ath10k/testmode.c:137:\t\tath10k_warn(ar, \"failed to put testmode wmi event attribute: %d\\n\", ret);\ndrivers/net/wireless/ath/ath10k/testmode.c-138-\t\tkfree_skb(nl_skb);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-143-\tif (ret) {\ndrivers/net/wireless/ath/ath10k/testmode.c:144:\t\tath10k_warn(ar, \"failed to put testmode wmi event cmd_id: %d\\n\", ret);\ndrivers/net/wireless/ath/ath10k/testmode.c-145-\t\tkfree_skb(nl_skb);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-148-\ndrivers/net/wireless/ath/ath10k/testmode.c:149:\tret = nla_put(nl_skb, ATH10K_TM_ATTR_DATA, data_pos, \u0026ar-\u003etestmode.eventdata[0]);\ndrivers/net/wireless/ath/ath10k/testmode.c-150-\tif (ret) {\ndrivers/net/wireless/ath/ath10k/testmode.c:151:\t\tath10k_warn(ar, \"failed to copy skb to testmode wmi event: %d\\n\", ret);\ndrivers/net/wireless/ath/ath10k/testmode.c-152-\t\tkfree_skb(nl_skb);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-155-\ndrivers/net/wireless/ath/ath10k/testmode.c:156:\tcfg80211_testmode_event(nl_skb, GFP_ATOMIC);\ndrivers/net/wireless/ath/ath10k/testmode.c-157-}\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=170=bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-174-\tath10k_dbg(ar, ATH10K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath10k/testmode.c:175:\t\t   \"testmode event wmi cmd_id %d skb %p skb-\u003elen %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-176-\t\t   cmd_id, skb, skb-\u003elen);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-181-\ndrivers/net/wireless/ath/ath10k/testmode.c:182:\tif (!ar-\u003etestmode.utf_monitor) {\ndrivers/net/wireless/ath/ath10k/testmode.c-183-\t\tconsumed = false;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-186-\ndrivers/net/wireless/ath/ath10k/testmode.c:187:\t/* Only testmode.c should be handling events from utf firmware,\ndrivers/net/wireless/ath/ath10k/testmode.c-188-\t * otherwise all sort of problems will arise as mac80211 operations\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-194-\t\tath10k_dbg(ar, ATH10K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath10k/testmode.c:195:\t\t\t   \"testmode drop non-utf event cmd_id %u\\n\", cmd_id);\ndrivers/net/wireless/ath/ath10k/testmode.c-196-\t\tgoto out;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-198-\ndrivers/net/wireless/ath/ath10k/testmode.c:199:\tif (ar-\u003etestmode.expected_seq != ATH10K_FTM_SEG_NONE)\ndrivers/net/wireless/ath/ath10k/testmode.c-200-\t\tath10k_tm_event_segmented(ar, cmd_id, skb);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=210=static int ath10k_tm_cmd_get_version(struct ath10k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-215-\tath10k_dbg(ar, ATH10K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath10k/testmode.c:216:\t\t   \"testmode cmd get version_major %d version_minor %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-217-\t\t   ATH10K_TESTMODE_VERSION_MAJOR,\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-219-\ndrivers/net/wireless/ath/ath10k/testmode.c:220:\tskb = cfg80211_testmode_alloc_reply_skb(ar-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath10k/testmode.c-221-\t\t\t\t\t\tnla_total_size(sizeof(u32)));\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-245-\ndrivers/net/wireless/ath/ath10k/testmode.c:246:\treturn cfg80211_testmode_reply(skb);\ndrivers/net/wireless/ath/ath10k/testmode.c-247-}\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=249=static int ath10k_tm_fetch_utf_firmware_api_1(struct ath10k *ar,\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-259-\tret = firmware_request_nowarn(\u0026fw_file-\u003efirmware, filename, ar-\u003edev);\ndrivers/net/wireless/ath/ath10k/testmode.c:260:\tath10k_dbg(ar, ATH10K_DBG_TESTMODE, \"testmode fw request '%s': %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-261-\t\t   filename, ret);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=283=static int ath10k_tm_fetch_firmware(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-303-\tret = ath10k_core_fetch_firmware_api_n(ar, fw_name,\ndrivers/net/wireless/ath/ath10k/testmode.c:304:\t\t\t\t\t       \u0026ar-\u003etestmode.utf_mode_fw.fw_file);\ndrivers/net/wireless/ath/ath10k/testmode.c-305-\tif (ret == 0) {\ndrivers/net/wireless/ath/ath10k/testmode.c:306:\t\tath10k_dbg(ar, ATH10K_DBG_TESTMODE, \"testmode using fw utf api 2\");\ndrivers/net/wireless/ath/ath10k/testmode.c-307-\t\tgoto out;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-309-\ndrivers/net/wireless/ath/ath10k/testmode.c:310:\tret = ath10k_tm_fetch_utf_firmware_api_1(ar, \u0026ar-\u003etestmode.utf_mode_fw.fw_file);\ndrivers/net/wireless/ath/ath10k/testmode.c-311-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-315-\ndrivers/net/wireless/ath/ath10k/testmode.c:316:\tath10k_dbg(ar, ATH10K_DBG_TESTMODE, \"testmode using utf api 1\");\ndrivers/net/wireless/ath/ath10k/testmode.c-317-\ndrivers/net/wireless/ath/ath10k/testmode.c-318-out:\ndrivers/net/wireless/ath/ath10k/testmode.c:319:\tutf_mode_fw = \u0026ar-\u003etestmode.utf_mode_fw;\ndrivers/net/wireless/ath/ath10k/testmode.c-320-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=336=static int ath10k_tm_cmd_utf_start(struct ath10k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-340-\ndrivers/net/wireless/ath/ath10k/testmode.c:341:\tath10k_dbg(ar, ATH10K_DBG_TESTMODE, \"testmode cmd utf start\\n\");\ndrivers/net/wireless/ath/ath10k/testmode.c-342-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-355-\ndrivers/net/wireless/ath/ath10k/testmode.c:356:\tif (WARN_ON(ar-\u003etestmode.utf_mode_fw.fw_file.firmware != NULL)) {\ndrivers/net/wireless/ath/ath10k/testmode.c-357-\t\t/* utf image is already downloaded, it shouldn't be */\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-367-\ndrivers/net/wireless/ath/ath10k/testmode.c:368:\tif (ar-\u003etestmode.utf_mode_fw.fw_file.codeswap_data \u0026\u0026\ndrivers/net/wireless/ath/ath10k/testmode.c:369:\t    ar-\u003etestmode.utf_mode_fw.fw_file.codeswap_len) {\ndrivers/net/wireless/ath/ath10k/testmode.c-370-\t\tret = ath10k_swap_code_seg_init(ar,\ndrivers/net/wireless/ath/ath10k/testmode.c:371:\t\t\t\t\t\t\u0026ar-\u003etestmode.utf_mode_fw.fw_file);\ndrivers/net/wireless/ath/ath10k/testmode.c-372-\t\tif (ret) {\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-380-\tspin_lock_bh(\u0026ar-\u003edata_lock);\ndrivers/net/wireless/ath/ath10k/testmode.c:381:\tar-\u003etestmode.utf_monitor = true;\ndrivers/net/wireless/ath/ath10k/testmode.c-382-\tspin_unlock_bh(\u0026ar-\u003edata_lock);\ndrivers/net/wireless/ath/ath10k/testmode.c-383-\ndrivers/net/wireless/ath/ath10k/testmode.c:384:\tath10k_dbg(ar, ATH10K_DBG_TESTMODE, \"testmode wmi version %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c:385:\t\t   ar-\u003etestmode.utf_mode_fw.fw_file.wmi_op_version);\ndrivers/net/wireless/ath/ath10k/testmode.c-386-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-388-\tif (ret) {\ndrivers/net/wireless/ath/ath10k/testmode.c:389:\t\tath10k_err(ar, \"failed to power up hif (testmode): %d\\n\", ret);\ndrivers/net/wireless/ath/ath10k/testmode.c-390-\t\tar-\u003estate = ATH10K_STATE_OFF;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-393-\ndrivers/net/wireless/ath/ath10k/testmode.c:394:\tar-\u003etestmode.eventdata = kzalloc(ATH_FTM_EVENT_MAX_BUF_LENGTH, GFP_KERNEL);\ndrivers/net/wireless/ath/ath10k/testmode.c:395:\tif (!ar-\u003etestmode.eventdata) {\ndrivers/net/wireless/ath/ath10k/testmode.c-396-\t\tret = -ENOMEM;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-400-\tret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_UTF,\ndrivers/net/wireless/ath/ath10k/testmode.c:401:\t\t\t\t\u0026ar-\u003etestmode.utf_mode_fw);\ndrivers/net/wireless/ath/ath10k/testmode.c-402-\tif (ret) {\ndrivers/net/wireless/ath/ath10k/testmode.c:403:\t\tath10k_err(ar, \"failed to start core (testmode): %d\\n\", ret);\ndrivers/net/wireless/ath/ath10k/testmode.c-404-\t\tar-\u003estate = ATH10K_STATE_OFF;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-409-\ndrivers/net/wireless/ath/ath10k/testmode.c:410:\tif (strlen(ar-\u003etestmode.utf_mode_fw.fw_file.fw_version) \u003e 0)\ndrivers/net/wireless/ath/ath10k/testmode.c:411:\t\tver = ar-\u003etestmode.utf_mode_fw.fw_file.fw_version;\ndrivers/net/wireless/ath/ath10k/testmode.c-412-\telse\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-421-err_release_eventdata:\ndrivers/net/wireless/ath/ath10k/testmode.c:422:\tkfree(ar-\u003etestmode.eventdata);\ndrivers/net/wireless/ath/ath10k/testmode.c:423:\tar-\u003etestmode.eventdata = NULL;\ndrivers/net/wireless/ath/ath10k/testmode.c-424-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-428-err_release_utf_mode_fw:\ndrivers/net/wireless/ath/ath10k/testmode.c:429:\tif (ar-\u003etestmode.utf_mode_fw.fw_file.codeswap_data \u0026\u0026\ndrivers/net/wireless/ath/ath10k/testmode.c:430:\t    ar-\u003etestmode.utf_mode_fw.fw_file.codeswap_len)\ndrivers/net/wireless/ath/ath10k/testmode.c-431-\t\tath10k_swap_code_seg_release(ar,\ndrivers/net/wireless/ath/ath10k/testmode.c:432:\t\t\t\t\t     \u0026ar-\u003etestmode.utf_mode_fw.fw_file);\ndrivers/net/wireless/ath/ath10k/testmode.c-433-\ndrivers/net/wireless/ath/ath10k/testmode.c:434:\trelease_firmware(ar-\u003etestmode.utf_mode_fw.fw_file.firmware);\ndrivers/net/wireless/ath/ath10k/testmode.c:435:\tar-\u003etestmode.utf_mode_fw.fw_file.firmware = NULL;\ndrivers/net/wireless/ath/ath10k/testmode.c-436-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=443=static void __ath10k_tm_cmd_utf_stop(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-451-\ndrivers/net/wireless/ath/ath10k/testmode.c:452:\tar-\u003etestmode.utf_monitor = false;\ndrivers/net/wireless/ath/ath10k/testmode.c-453-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-455-\ndrivers/net/wireless/ath/ath10k/testmode.c:456:\tif (ar-\u003etestmode.utf_mode_fw.fw_file.codeswap_data \u0026\u0026\ndrivers/net/wireless/ath/ath10k/testmode.c:457:\t    ar-\u003etestmode.utf_mode_fw.fw_file.codeswap_len)\ndrivers/net/wireless/ath/ath10k/testmode.c-458-\t\tath10k_swap_code_seg_release(ar,\ndrivers/net/wireless/ath/ath10k/testmode.c:459:\t\t\t\t\t     \u0026ar-\u003etestmode.utf_mode_fw.fw_file);\ndrivers/net/wireless/ath/ath10k/testmode.c-460-\ndrivers/net/wireless/ath/ath10k/testmode.c:461:\trelease_firmware(ar-\u003etestmode.utf_mode_fw.fw_file.firmware);\ndrivers/net/wireless/ath/ath10k/testmode.c:462:\tar-\u003etestmode.utf_mode_fw.fw_file.firmware = NULL;\ndrivers/net/wireless/ath/ath10k/testmode.c-463-\ndrivers/net/wireless/ath/ath10k/testmode.c:464:\tkfree(ar-\u003etestmode.eventdata);\ndrivers/net/wireless/ath/ath10k/testmode.c:465:\tar-\u003etestmode.eventdata = NULL;\ndrivers/net/wireless/ath/ath10k/testmode.c-466-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=470=static int ath10k_tm_cmd_utf_stop(struct ath10k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-473-\ndrivers/net/wireless/ath/ath10k/testmode.c:474:\tath10k_dbg(ar, ATH10K_DBG_TESTMODE, \"testmode cmd utf stop\\n\");\ndrivers/net/wireless/ath/ath10k/testmode.c-475-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=494=static int ath10k_tm_cmd_wmi(struct ath10k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-522-\tath10k_dbg(ar, ATH10K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath10k/testmode.c:523:\t\t   \"testmode cmd wmi cmd_id %d buf %p buf_len %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-524-\t\t   cmd_id, buf, buf_len);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-537-\tif (ret) {\ndrivers/net/wireless/ath/ath10k/testmode.c:538:\t\tath10k_warn(ar, \"failed to transmit wmi command (testmode): %d\\n\",\ndrivers/net/wireless/ath/ath10k/testmode.c-539-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=550=static int ath10k_tm_cmd_tlv(struct ath10k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-577-\tnum_segments = total_bytes / MAX_WMI_UTF_LEN;\ndrivers/net/wireless/ath/ath10k/testmode.c:578:\tar-\u003etestmode.expected_seq = 0;\ndrivers/net/wireless/ath/ath10k/testmode.c-579-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-602-\t\tftm_cmd-\u003eseg_hdr.len = __cpu_to_le32(total_bytes);\ndrivers/net/wireless/ath/ath10k/testmode.c:603:\t\tftm_cmd-\u003eseg_hdr.msgref = __cpu_to_le32(ar-\u003etestmode.ftm_msgref);\ndrivers/net/wireless/ath/ath10k/testmode.c-604-\t\tseginfo = FIELD_PREP(ATH10K_FTM_SEGHDR_TOTAL_SEGMENTS, num_segments) |\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-620-\ndrivers/net/wireless/ath/ath10k/testmode.c:621:\tar-\u003etestmode.ftm_msgref++;\ndrivers/net/wireless/ath/ath10k/testmode.c-622-\tret = 0;\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=629=int ath10k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-643-\ndrivers/net/wireless/ath/ath10k/testmode.c:644:\tar-\u003etestmode.expected_seq = ATH10K_FTM_SEG_NONE;\ndrivers/net/wireless/ath/ath10k/testmode.c-645-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-662-\ndrivers/net/wireless/ath/ath10k/testmode.c:663:void ath10k_testmode_destroy(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/testmode.c-664-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.h-9-\ndrivers/net/wireless/ath/ath10k/testmode.h:10:void ath10k_testmode_destroy(struct ath10k *ar);\ndrivers/net/wireless/ath/ath10k/testmode.h-11-\n--\ndrivers/net/wireless/ath/ath10k/testmode.h=13=int ath10k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath10k/testmode.h-17-\ndrivers/net/wireless/ath/ath10k/testmode.h:18:static inline void ath10k_testmode_destroy(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/testmode.h-19-{\n--\ndrivers/net/wireless/ath/ath10k/testmode_i.h-6-\ndrivers/net/wireless/ath/ath10k/testmode_i.h:7:/* \"API\" level of the ath10k testmode interface. Bump it after every\ndrivers/net/wireless/ath/ath10k/testmode_i.h-8- * incompatible interface change.\n--\ndrivers/net/wireless/ath/ath10k/testmode_i.h=20=enum ath10k_tm_attr {\n--\ndrivers/net/wireless/ath/ath10k/testmode_i.h-33-\ndrivers/net/wireless/ath/ath10k/testmode_i.h:34:/* All ath10k testmode interface commands specified in\ndrivers/net/wireless/ath/ath10k/testmode_i.h-35- * ATH10K_TM_ATTR_CMD\n--\ndrivers/net/wireless/ath/ath10k/testmode_i.h=37=enum ath10k_tm_cmd {\ndrivers/net/wireless/ath/ath10k/testmode_i.h:38:\t/* Returns the supported ath10k testmode interface version in\ndrivers/net/wireless/ath/ath10k/testmode_i.h-39-\t * ATH10K_TM_ATTR_VERSION. Always guaranteed to work. User space\ndrivers/net/wireless/ath/ath10k/testmode_i.h-40-\t * uses this to verify it's using the correct version of the\ndrivers/net/wireless/ath/ath10k/testmode_i.h:41:\t * testmode interface\ndrivers/net/wireless/ath/ath10k/testmode_i.h-42-\t */\n--\ndrivers/net/wireless/ath/ath10k/testmode_i.h-69-\t *\ndrivers/net/wireless/ath/ath10k/testmode_i.h:70:\t * This legacy testmode command shares the same value as the get-version\ndrivers/net/wireless/ath/ath10k/testmode_i.h-71-\t * command. To distinguish between them, we check whether the data attribute\n--\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c-15-#include \"p2p.h\"\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c:16:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c-17-#include \"txrx.h\"\n--\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c=639=static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c-656-\t * know the UTF firmware has booted, others we are just bypass WMI\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c:657:\t * events to testmode.\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c-658-\t */\n--\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c-660-\t\tath10k_dbg(ar, ATH10K_DBG_WMI,\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c:661:\t\t\t   \"wmi tlv testmode consumed 0x%x\\n\", id);\ndrivers/net/wireless/ath/ath10k/wmi-tlv.c-662-\t\tgoto out;\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-17-#include \"mac.h\"\ndrivers/net/wireless/ath/ath10k/wmi.c:18:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath10k/wmi.c-19-#include \"wmi-ops.h\"\n--\ndrivers/net/wireless/ath/ath10k/wmi.c=6003=static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-6020-\t * know the UTF firmware has booted, others we are just bypass WMI\ndrivers/net/wireless/ath/ath10k/wmi.c:6021:\t * events to testmode.\ndrivers/net/wireless/ath/ath10k/wmi.c-6022-\t */\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-6024-\t\tath10k_dbg(ar, ATH10K_DBG_WMI,\ndrivers/net/wireless/ath/ath10k/wmi.c:6025:\t\t\t   \"wmi testmode consumed 0x%x\\n\", id);\ndrivers/net/wireless/ath/ath10k/wmi.c-6026-\t\tgoto out;\n--\ndrivers/net/wireless/ath/ath10k/wmi.c=6134=static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-6151-\t * know the UTF firmware has booted, others we are just bypass WMI\ndrivers/net/wireless/ath/ath10k/wmi.c:6152:\t * events to testmode.\ndrivers/net/wireless/ath/ath10k/wmi.c-6153-\t */\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-6155-\t\tath10k_dbg(ar, ATH10K_DBG_WMI,\ndrivers/net/wireless/ath/ath10k/wmi.c:6156:\t\t\t   \"wmi testmode consumed 0x%x\\n\", id);\ndrivers/net/wireless/ath/ath10k/wmi.c-6157-\t\tgoto out;\n--\ndrivers/net/wireless/ath/ath10k/wmi.c=6283=static void ath10k_wmi_10_4_op_rx(struct ath10k *ar, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-6300-\t * know the UTF firmware has booted, others we are just bypass WMI\ndrivers/net/wireless/ath/ath10k/wmi.c:6301:\t * events to testmode.\ndrivers/net/wireless/ath/ath10k/wmi.c-6302-\t */\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-6304-\t\tath10k_dbg(ar, ATH10K_DBG_WMI,\ndrivers/net/wireless/ath/ath10k/wmi.c:6305:\t\t\t   \"wmi testmode consumed 0x%x\\n\", id);\ndrivers/net/wireless/ath/ath10k/wmi.c-6306-\t\tgoto out;\n"
}

gemini-3.1-pro-preview

null

null

							input: 27373
							output: 45
							thoughts: 439
						

**Fuzzing the `ath10k` Driver in Testmode**

Okay, so I'm looking at this patch and thinking about the implications for fuzzing the `ath10k` driver. The core of this is the `CONFIG_NL80211_TESTMODE` config option. The key question is whether test mode is exposed to userspace – and it looks like it is, via `nl80211`. That opens up some interesting possibilities.

I see that `ath10k` *can* be fuzzed using USB emulation. The interesting thing here is `ath10k_tm_event_wmi`. That function is triggered when the driver receives a WMI event from the firmware. In a fuzzing scenario, this means that the fuzzer can emulate a USB device and inject these WMI events directly into the driver.

The patch seems to add a check, `ath10k_tm_is_utf_event(cmd_id)`, which drops non-UTF events specifically when in testmode. This is a clear functional change, altering how the driver handles firmware events. That's a target! Because the fuzzer can emulate USB devices, it can definitely trigger this code path by sending a WMI event while in testmode.

Now, the natural question is, has this already been fuzzed? I know Syzkaller has USB fuzzing capabilities, so let's see if there's any existing coverage. The code location is `drivers/net/wireless/ath/ath10k/testmode.c`. Good, let's explore.

`ath10k_tm_event_wmi` is the main target. It's called by `ath10k_wmi_10_1_op_rx`, `ath10k_wmi_10_2_op_rx`, `ath10k_wmi_10_4_op_rx`, and `ath10k_wmi_tlv_op_rx`. These are all RX handlers for WMI events coming from the firmware. Precisely what the fuzzer can control by emulating the USB device!

So, the conclusion is this patch is definitely fuzzable and offers a new attack surface. Time to identify the key symbols for fuzzing focus. Clearly, `ath10k_tm_event_wmi` is the main one. The static helper `ath10k_tm_is_utf_event` isn't as critical, so I won't focus on it. Let's dig into the signature of `ath10k_tm_event_wmi`.

{
  "Expression": "bool ath10k_tm_event_wmi",
  "PathPrefix": "drivers/net/wireless/ath/ath10k/"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/testmode.c=159=static bool ath10k_tm_is_utf_event(u32 cmd_id)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-169- */\ndrivers/net/wireless/ath/ath10k/testmode.c:170:bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb)\ndrivers/net/wireless/ath/ath10k/testmode.c-171-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.h=10=void ath10k_testmode_destroy(struct ath10k *ar);\ndrivers/net/wireless/ath/ath10k/testmode.h-11-\ndrivers/net/wireless/ath/ath10k/testmode.h:12:bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb);\ndrivers/net/wireless/ath/ath10k/testmode.h-13-int ath10k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath10k/testmode.h=18=static inline void ath10k_testmode_destroy(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/testmode.h-21-\ndrivers/net/wireless/ath/ath10k/testmode.h:22:static inline bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id,\ndrivers/net/wireless/ath/ath10k/testmode.h-23-\t\t\t\t       struct sk_buff *skb)\n"
}

gemini-3.1-pro-preview

null

null

							input: 28931
							output: 38
							thoughts: 164
						

**Analyzing the `ath10k_tm_event_wmi` Function for Research**

Okay, so I see that the `ath10k_tm_event_wmi` function is defined and *not* static, and it's even exported or at least, not static in `testmode.c`. Interesting. And, hang on...it's *also* called from `wmi.c` and `wmi-tlv.c`. This makes it a prime candidate for further investigation - a good, central focus point for digging into the Atheros driver's test mode functionality.

Right, so to make sure I have the environment set up right, I need to check the required configurations. I'm assuming, obviously, that `CONFIG_ATH10K` is needed, but I should also ensure `CONFIG_ATH10K_USB` is enabled, just in case I want to explore USB fuzzing. Of course, `CONFIG_NL80211_TESTMODE` is critical because it directly enables the `testmode.c` file.

Now, let me just confirm those config options by quickly referencing the `drivers/net/wireless/ath/ath10k/Kconfig` file. I need to be absolutely sure I'm working with the correct configuration.

{
  "Expression": "config ATH10K",
  "PathPrefix": "drivers/net/wireless/ath/ath10k/"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/Kconfig-1-# SPDX-License-Identifier: ISC\ndrivers/net/wireless/ath/ath10k/Kconfig:2:config ATH10K\ndrivers/net/wireless/ath/ath10k/Kconfig-3-\ttristate \"Atheros 802.11ac wireless cards support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-14-\ndrivers/net/wireless/ath/ath10k/Kconfig:15:config ATH10K_CE\ndrivers/net/wireless/ath/ath10k/Kconfig-16-\tbool\ndrivers/net/wireless/ath/ath10k/Kconfig-17-\ndrivers/net/wireless/ath/ath10k/Kconfig:18:config ATH10K_PCI\ndrivers/net/wireless/ath/ath10k/Kconfig-19-\ttristate \"Atheros ath10k PCI support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-23-\ndrivers/net/wireless/ath/ath10k/Kconfig:24:config ATH10K_AHB\ndrivers/net/wireless/ath/ath10k/Kconfig-25-\tbool \"Atheros ath10k AHB support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-29-\ndrivers/net/wireless/ath/ath10k/Kconfig:30:config ATH10K_SDIO\ndrivers/net/wireless/ath/ath10k/Kconfig-31-\ttristate \"Atheros ath10k SDIO support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-35-\ndrivers/net/wireless/ath/ath10k/Kconfig:36:config ATH10K_USB\ndrivers/net/wireless/ath/ath10k/Kconfig-37-\ttristate \"Atheros ath10k USB support (EXPERIMENTAL)\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-42-\ndrivers/net/wireless/ath/ath10k/Kconfig:43:config ATH10K_SNOC\ndrivers/net/wireless/ath/ath10k/Kconfig-44-\ttristate \"Qualcomm ath10k SNOC support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-55-\ndrivers/net/wireless/ath/ath10k/Kconfig:56:config ATH10K_DEBUG\ndrivers/net/wireless/ath/ath10k/Kconfig-57-\tbool \"Atheros ath10k debugging\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-63-\ndrivers/net/wireless/ath/ath10k/Kconfig:64:config ATH10K_DEBUGFS\ndrivers/net/wireless/ath/ath10k/Kconfig-65-\tbool \"Atheros ath10k debugfs support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-71-\ndrivers/net/wireless/ath/ath10k/Kconfig:72:config ATH10K_LEDS\ndrivers/net/wireless/ath/ath10k/Kconfig-73-\tbool\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-77-\ndrivers/net/wireless/ath/ath10k/Kconfig:78:config ATH10K_SPECTRAL\ndrivers/net/wireless/ath/ath10k/Kconfig-79-\tbool \"Atheros ath10k spectral scan support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-85-\ndrivers/net/wireless/ath/ath10k/Kconfig:86:config ATH10K_TRACING\ndrivers/net/wireless/ath/ath10k/Kconfig-87-\tbool \"Atheros ath10k tracing support\"\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-92-\ndrivers/net/wireless/ath/ath10k/Kconfig:93:config ATH10K_DFS_CERTIFIED\ndrivers/net/wireless/ath/ath10k/Kconfig-94-\tbool \"Atheros DFS support for certified platforms\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 30495
							output: 30
							thoughts: 17
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Checking `CONFIG_NL80211_TESTMODE` - My Initial Assessment**

Right, let's dive straight in. My first thought is to verify the status of `CONFIG_NL80211_TESTMODE`. It's a key kernel configuration option, and its presence or absence fundamentally shapes how I'm going to approach this investigation or debugging session. I instantly think of its implications – does it unlock specific, potentially risky, test interfaces in nl80211? Does it impact the way certain wireless drivers behave? And critically, is this a development system or a production environment? That immediately frames the level of caution I'm going to apply. I'm already anticipating the potential for unintended side effects if the setting is enabled, and the constraints if it's disabled, because both have very clear impacts on diagnostic options. It's the lynchpin, the first thing I need to know before moving forward.

{
  "Expression": "config NL80211_TESTMODE",
  "PathPrefix": ""
}

{
  "Output": "net/wireless/Kconfig=36=if CFG80211\nnet/wireless/Kconfig-37-\nnet/wireless/Kconfig:38:config NL80211_TESTMODE\nnet/wireless/Kconfig-39-\tbool \"nl80211 testmode command\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 30846
							output: 40
							thoughts: 64
						

**Examining the Wireless Driver Configurations**

Okay, so I'm looking at these configurations: `ATH10K`, `ATH10K_USB`, and `NL80211_TESTMODE`. Immediately, I'm noting that `ATH10K_USB` is present, but I need to be sure. I'm recalling that `ATH10K_USB` likely has a dependency on `USB` itself, so I should confirm that relationship. Let's dig into the dependencies for `ATH10K_USB` to ensure this is understood completely.

{
  "Expression": "config ATH10K_USB",
  "PathPrefix": "drivers/net/wireless/ath/ath10k/"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/Kconfig=30=config ATH10K_SDIO\n--\ndrivers/net/wireless/ath/ath10k/Kconfig-35-\ndrivers/net/wireless/ath/ath10k/Kconfig:36:config ATH10K_USB\ndrivers/net/wireless/ath/ath10k/Kconfig-37-\ttristate \"Atheros ath10k USB support (EXPERIMENTAL)\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 31201
							output: 42
							thoughts: 27
						

Here's my take on the thought process, from an expert's perspective:

**Diving into the Atheros Configuration**

Okay, I need to get a handle on how this ath10k driver is configured. Let's start with the basics, so I'm heading directly to the `Kconfig` file within the driver's directory. Specifically, I'm thinking about line 36. That's a reasonable place to start getting a feel for the fundamental configuration options that are exposed to the user and how they're structured. This will help me understand the dependencies, default values, and the overall design philosophy behind the module configuration. Knowing the Kconfig is key to debugging build issues, understanding module behavior and even adding features.

{
  "File": "drivers/net/wireless/ath/ath10k/Kconfig",
  "FirstLine": 30,
  "LineCount": 20
}

{
  "Contents": "  30:\tconfig ATH10K_SDIO\n  31:\t\ttristate \"Atheros ath10k SDIO support\"\n  32:\t\tdepends on ATH10K \u0026\u0026 MMC\n  33:\t\thelp\n  34:\t\t  This module adds support for SDIO/MMC bus.\n  35:\t\n  36:\tconfig ATH10K_USB\n  37:\t\ttristate \"Atheros ath10k USB support (EXPERIMENTAL)\"\n  38:\t\tdepends on ATH10K \u0026\u0026 USB\n  39:\t\thelp\n  40:\t\t  This module adds experimental support for USB bus. Currently\n  41:\t\t  work in progress and will not fully work.\n  42:\t\n  43:\tconfig ATH10K_SNOC\n  44:\t\ttristate \"Qualcomm ath10k SNOC support\"\n  45:\t\tdepends on ATH10K\n  46:\t\tdepends on ARCH_QCOM || COMPILE_TEST\n  47:\t\tdepends on QCOM_SMEM\n  48:\t\tdepends on QCOM_RPROC_COMMON || QCOM_RPROC_COMMON=n\n  49:\t\tselect POWER_SEQUENCING\n"
}

gemini-3.1-pro-preview

null

null

							input: 31728
							output: 41
							thoughts: 59
						

**Dependency Deep Dive**

Okay, so I'm digging into this `ATH10K_USB` thing, and it looks like it's built on a pretty straightforward dependency chain. First, `ATH10K_USB` needs both `ATH10K` and `USB`. Pretty logical, right? It's a USB implementation of something built on `ATH10K`. Now, the interesting bit. `ATH10K` itself, the core of this, relies on `MAC80211` and `HAS_IOMEM`. That makes perfect sense; `MAC80211` is the 802.11 stack it’s built on, and `HAS_IOMEM` is likely crucial for the hardware interaction.

Time to drill down and check the `ATH10K` dependencies directly. Gotta make sure those foundations are solid.

{
  "File": "drivers/net/wireless/ath/ath10k/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: ISC\n   2:\tconfig ATH10K\n   3:\t\ttristate \"Atheros 802.11ac wireless cards support\"\n   4:\t\tdepends on MAC80211 \u0026\u0026 HAS_DMA\n   5:\t\tselect ATH_COMMON\n   6:\t\tselect CRC32\n   7:\t\tselect WANT_DEV_COREDUMP\n   8:\t\tselect ATH10K_CE\n   9:\t\thelp\n  10:\t\t  This module adds support for wireless adapters based on\n  11:\t\t  Atheros IEEE 802.11ac family of chipsets.\n  12:\t\n  13:\t\t  If you choose to build a module, it'll be called ath10k.\n  14:\t\n  15:\tconfig ATH10K_CE\n  16:\t\tbool\n  17:\t\n  18:\tconfig ATH10K_PCI\n  19:\t\ttristate \"Atheros ath10k PCI support\"\n  20:\t\tdepends on ATH10K \u0026\u0026 PCI\n"
}

gemini-3.1-pro-preview

null

null

							input: 32295
							output: 46
							thoughts: 265
						

**My Analysis of the ATH10K Driver and Fuzzing Potential**

Alright, let's break this down. My understanding is that the `ATH10K` driver is reliant on `MAC80211` and `HAS_DMA`, so those are prerequisites. To enable the relevant functionality, I'll need to configure `ATH10K`, `ATH10K_USB`, and `NL80211_TESTMODE`.

Hang on, `ATH10K_USB` is marked as experimental, but the kernel includes it, and, crucially, syzkaller can target it for fuzzing. This is interesting. The patch I'm looking at specifically modifies `ath10k_tm_event_wmi`. So the core of my analysis comes down to how reachable the function is.

The key is determining the call flow. It looks like when the fuzzer successfully emulates the USB device and then sends WMI events, the function `ath10k_wmi_10_1_op_rx` (or a similar variant) gets invoked. And that, in turn, calls `ath10k_tm_event_wmi`. So we have a path.

But, a closer look at `ath10k_tm_event_wmi` reveals it's only executed under specific conditions: either if `ar->testmode.utf_monitor` is true or if it is a testmode event. This highlights some important preconditions for triggering this codepath. So now I need to dive into `ath10k_wmi_10_1_op_rx` to understand precisely under what conditions it calls `ath10k_tm_event_wmi`. This will be key to understanding the potential for fuzzing.

{
  "File": "drivers/net/wireless/ath/ath10k/wmi.c",
  "FirstLine": 6003,
  "LineCount": 30
}

{
  "Contents": "6003:\tstatic void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)\n6004:\t{\n6005:\t\tstruct wmi_cmd_hdr *cmd_hdr;\n6006:\t\tenum wmi_10x_event_id id;\n6007:\t\tbool consumed;\n6008:\t\n6009:\t\tcmd_hdr = (struct wmi_cmd_hdr *)skb-\u003edata;\n6010:\t\tid = MS(__le32_to_cpu(cmd_hdr-\u003ecmd_id), WMI_CMD_HDR_CMD_ID);\n6011:\t\n6012:\t\tif (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)\n6013:\t\t\tgoto out;\n6014:\t\n6015:\t\ttrace_ath10k_wmi_event(ar, id, skb-\u003edata, skb-\u003elen);\n6016:\t\n6017:\t\tconsumed = ath10k_tm_event_wmi(ar, id, skb);\n6018:\t\n6019:\t\t/* Ready event must be handled normally also in UTF mode so that we\n6020:\t\t * know the UTF firmware has booted, others we are just bypass WMI\n6021:\t\t * events to testmode.\n6022:\t\t */\n6023:\t\tif (consumed \u0026\u0026 id != WMI_10X_READY_EVENTID) {\n6024:\t\t\tath10k_dbg(ar, ATH10K_DBG_WMI,\n6025:\t\t\t\t   \"wmi testmode consumed 0x%x\\n\", id);\n6026:\t\t\tgoto out;\n6027:\t\t}\n6028:\t\n6029:\t\tswitch (id) {\n6030:\t\tcase WMI_10X_MGMT_RX_EVENTID:\n6031:\t\t\tath10k_wmi_event_mgmt_rx(ar, skb);\n6032:\t\t\t/* mgmt_rx() owns the skb now! */\n"
}

gemini-3.1-pro-preview

null

null

							input: 33547
							output: 45
							thoughts: 38
						

Okay, here's my interpretation of that thought process, assuming I'm already deep in the weeds of this ath10k driver:

**Analyzing ath10k_tm_event_wmi**

Right, so `ath10k_tm_event_wmi`. That's the function called for *every single* WMI (Wireless Management Interface) event. That's a key observation – understanding that it's the central point for WMI event handling gives me an important point of reference. I need to understand what's happening *inside* that function because it’s handling every event, so it's critical to performance and debuggability. I need to now focus on the internal logic to get the picture of what's happening.

{
  "File": "drivers/net/wireless/ath/ath10k/testmode.c",
  "FirstLine": 170,
  "LineCount": 30
}

{
  "Contents": " 170:\tbool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb)\n 171:\t{\n 172:\t\tbool consumed;\n 173:\t\n 174:\t\tath10k_dbg(ar, ATH10K_DBG_TESTMODE,\n 175:\t\t\t   \"testmode event wmi cmd_id %d skb %p skb-\u003elen %d\\n\",\n 176:\t\t\t   cmd_id, skb, skb-\u003elen);\n 177:\t\n 178:\t\tath10k_dbg_dump(ar, ATH10K_DBG_TESTMODE, NULL, \"\", skb-\u003edata, skb-\u003elen);\n 179:\t\n 180:\t\tspin_lock_bh(\u0026ar-\u003edata_lock);\n 181:\t\n 182:\t\tif (!ar-\u003etestmode.utf_monitor) {\n 183:\t\t\tconsumed = false;\n 184:\t\t\tgoto out;\n 185:\t\t}\n 186:\t\n 187:\t\t/* Only testmode.c should be handling events from utf firmware,\n 188:\t\t * otherwise all sort of problems will arise as mac80211 operations\n 189:\t\t * are not initialised.\n 190:\t\t */\n 191:\t\tconsumed = true;\n 192:\t\n 193:\t\tif (!ath10k_tm_is_utf_event(cmd_id)) {\n 194:\t\t\tath10k_dbg(ar, ATH10K_DBG_TESTMODE,\n 195:\t\t\t\t   \"testmode drop non-utf event cmd_id %u\\n\", cmd_id);\n 196:\t\t\tgoto out;\n 197:\t\t}\n 198:\t\n 199:\t\tif (ar-\u003etestmode.expected_seq != ATH10K_FTM_SEG_NONE)\n"
}

gemini-3.1-pro-preview

null

null

							input: 34306
							output: 45
							thoughts: 293
						

**Vulnerability Assessment: UTF Monitor in ath10k Driver**

Okay, so I'm looking at this code and immediately see a potential vulnerability. The UTF monitor functionality, specifically, is only activated when `ar->testmode.utf_monitor` is set to true. This is controlled by the `ath10k_tm_cmd_utf_start` function, which is triggered through a nl80211 testmode command. The beauty (from a fuzzer's perspective!) is that fuzzing nl80211 testmode commands is straightforward, especially when paired with USB-based WMI event injections. That's a low barrier to entry for potential attacks.

The key functions to focus on here, the prime "attack surfaces," are `ath10k_tm_event_wmi` since the patch modifies it. Also, `ath10k_tm_cmd_utf_start` is important to hit the setup path. I should also note I need to ensure the fuzzer can trigger `ath10k_tm_cmd_utf_stop`, since this must be present on the fuzzer as well. I'll need to check if the `ath10k_tm_cmd_utf_start` function is static; it would make things more complicated if it were, but I can work around that. Ultimately, I'm going to have to make sure the fuzzer hits `ath10k_tm_event_wmi`, but in order to do that, I'll have to consider how to prepare the state with `ath10k_tm_cmd_utf_start`.

{
  "Expression": "ath10k_tm_cmd_utf_start",
  "PathPrefix": "drivers/net/wireless/ath/ath10k/"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/testmode.c=283=static int ath10k_tm_fetch_firmware(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-335-\ndrivers/net/wireless/ath/ath10k/testmode.c:336:static int ath10k_tm_cmd_utf_start(struct ath10k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath10k/testmode.c-337-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=629=int ath10k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-652-\tcase ATH10K_TM_CMD_UTF_START:\ndrivers/net/wireless/ath/ath10k/testmode.c:653:\t\treturn ath10k_tm_cmd_utf_start(ar, tb);\ndrivers/net/wireless/ath/ath10k/testmode.c-654-\tcase ATH10K_TM_CMD_UTF_STOP:\n"
}

gemini-3.1-pro-preview

null

null

							input: 35336
							output: 41
							thoughts: 19
						

Here's my analysis of the provided information, as if these were my internal thoughts:

**Analyzing the Static Nature of a Kernel Command**

Okay, so I'm looking at this kernel code and it's immediately clear that it's *static*. This `ath10k_tm_cmd` function...it's the exported one, the one that's actually visible and usable outside the module. That's a key observation. Knowing it's static implies certain things about its scope and potential for modification, or, conversely, how *limited* it is in its interaction with the rest of the kernel, based on its definition. Given my expertise, I am looking for the implications of that: access control, optimization, potential issues regarding modularity. It will likely impact how I integrate it into the larger system. The fact that it's *the* exported command is important too, because it's the gateway for certain device commands. Time to dig deeper and see what those commands are.

{
  "Expression": "ath10k_tm_cmd",
  "PathPrefix": "drivers/net/wireless/ath/ath10k/"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/mac.c=9472=static const struct ieee80211_ops ath10k_ops = {\n--\ndrivers/net/wireless/ath/ath10k/mac.c-9518-\ndrivers/net/wireless/ath/ath10k/mac.c:9519:\tCFG80211_TESTMODE_CMD(ath10k_tm_cmd)\ndrivers/net/wireless/ath/ath10k/mac.c-9520-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=170=bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-209-\ndrivers/net/wireless/ath/ath10k/testmode.c:210:static int ath10k_tm_cmd_get_version(struct ath10k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath10k/testmode.c-211-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=283=static int ath10k_tm_fetch_firmware(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-335-\ndrivers/net/wireless/ath/ath10k/testmode.c:336:static int ath10k_tm_cmd_utf_start(struct ath10k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath10k/testmode.c-337-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-442-\ndrivers/net/wireless/ath/ath10k/testmode.c:443:static void __ath10k_tm_cmd_utf_stop(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/testmode.c-444-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-469-\ndrivers/net/wireless/ath/ath10k/testmode.c:470:static int ath10k_tm_cmd_utf_stop(struct ath10k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath10k/testmode.c-471-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-482-\ndrivers/net/wireless/ath/ath10k/testmode.c:483:\t__ath10k_tm_cmd_utf_stop(ar);\ndrivers/net/wireless/ath/ath10k/testmode.c-484-\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-493-\ndrivers/net/wireless/ath/ath10k/testmode.c:494:static int ath10k_tm_cmd_wmi(struct ath10k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath10k/testmode.c-495-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-549-\ndrivers/net/wireless/ath/ath10k/testmode.c:550:static int ath10k_tm_cmd_tlv(struct ath10k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath10k/testmode.c-551-{\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-628-\ndrivers/net/wireless/ath/ath10k/testmode.c:629:int ath10k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/ath/ath10k/testmode.c-630-\t\t  void *data, int len)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-648-\t\tif (!tb[ATH10K_TM_ATTR_DATA])\ndrivers/net/wireless/ath/ath10k/testmode.c:649:\t\t\treturn ath10k_tm_cmd_get_version(ar, tb);\ndrivers/net/wireless/ath/ath10k/testmode.c-650-\t\telse /* ATH10K_TM_CMD_TLV */\ndrivers/net/wireless/ath/ath10k/testmode.c:651:\t\t\treturn ath10k_tm_cmd_tlv(ar, tb);\ndrivers/net/wireless/ath/ath10k/testmode.c-652-\tcase ATH10K_TM_CMD_UTF_START:\ndrivers/net/wireless/ath/ath10k/testmode.c:653:\t\treturn ath10k_tm_cmd_utf_start(ar, tb);\ndrivers/net/wireless/ath/ath10k/testmode.c-654-\tcase ATH10K_TM_CMD_UTF_STOP:\ndrivers/net/wireless/ath/ath10k/testmode.c:655:\t\treturn ath10k_tm_cmd_utf_stop(ar, tb);\ndrivers/net/wireless/ath/ath10k/testmode.c-656-\tcase ATH10K_TM_CMD_WMI:\ndrivers/net/wireless/ath/ath10k/testmode.c:657:\t\treturn ath10k_tm_cmd_wmi(ar, tb);\ndrivers/net/wireless/ath/ath10k/testmode.c-658-\tdefault:\n--\ndrivers/net/wireless/ath/ath10k/testmode.c=663=void ath10k_testmode_destroy(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/testmode.c-671-\ndrivers/net/wireless/ath/ath10k/testmode.c:672:\t__ath10k_tm_cmd_utf_stop(ar);\ndrivers/net/wireless/ath/ath10k/testmode.c-673-\n--\ndrivers/net/wireless/ath/ath10k/testmode.h=12=bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id, struct sk_buff *skb);\ndrivers/net/wireless/ath/ath10k/testmode.h:13:int ath10k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/ath/ath10k/testmode.h-14-\t\t  void *data, int len);\n--\ndrivers/net/wireless/ath/ath10k/testmode.h=22=static inline bool ath10k_tm_event_wmi(struct ath10k *ar, u32 cmd_id,\n--\ndrivers/net/wireless/ath/ath10k/testmode.h-27-\ndrivers/net/wireless/ath/ath10k/testmode.h:28:static inline int ath10k_tm_cmd(struct ieee80211_hw *hw,\ndrivers/net/wireless/ath/ath10k/testmode.h-29-\t\t\t\tstruct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath10k/testmode_i.h=20=enum ath10k_tm_attr {\n--\ndrivers/net/wireless/ath/ath10k/testmode_i.h-36- */\ndrivers/net/wireless/ath/ath10k/testmode_i.h:37:enum ath10k_tm_cmd {\ndrivers/net/wireless/ath/ath10k/testmode_i.h-38-\t/* Returns the supported ath10k testmode interface version in\n"
}

gemini-3.1-pro-preview

null

null

							input: 37668
							output: 162
							thoughts: 971
						

**Reasoning for Fuzzing the ath10k Testmode Event Handling**

Okay, so I'm looking at this patch and immediately, `ath10k_tm_cmd` and `ath10k_tm_event_wmi` stand out. The former seems to be the entry point for the nl80211 testmode commands, and the latter is the handler for WMI events. Those are definitely my focus symbols here. They handle distinct paths into the test mode functionality.

I need to confirm which configurations are relevant. I know that `ATH10K` is a must, and since this involves USB interaction, `ATH10K_USB` is also likely required. Also since this deals with test mode, `NL80211_TESTMODE` is another obvious candidate. I need to make sure the configurations are right. I know that `ATH10K_USB` depends on `USB` and `ATH10K`, which in turn depend on `MAC80211`. But the fuzzer base config usually takes care of those dependencies, so just listing the direct ones is safe.

Reviewing the patch itself, it's clear the changes within `ath10k_tm_event_wmi` are functional. The code is adding a check to drop non-UTF events. This modification to the WMI event handling logic in test mode is definitely something I want to fuzz. It introduces a new code path (the drop) and modifies existing logic. So the fuzzing target here is the `ath10k` wireless driver, specifically its event processing within test mode. I can fuzz it through the USB interface (`CONFIG_ATH10K_USB`) by emulating the device and sending WMI events. The test mode itself can be activated using nl80211 commands (`CONFIG_NL80211_TESTMODE`).

So, I think I've got it:

Focus Symbols:
*   `ath10k_tm_event_wmi`
*   `ath10k_tm_cmd`

Configs:
*   `ATH10K`
*   `ATH10K_USB`
*   `NL80211_TESTMODE`

I am ready to call `set-results`.

{
  "EnableConfigs": [
    "ATH10K",
    "ATH10K_USB",
    "NL80211_TESTMODE"
  ],
  "FocusSymbols": [
    "ath10k_tm_event_wmi",
    "ath10k_tm_cmd"
  ],
  "Reasoning": "The patch modifies the `ath10k` wireless driver's testmode event handling logic to drop non-UTF WMI events. This is a functional change in the driver's firmware event processing. The driver can be fuzzed via its USB interface by emulating the device and sending WMI events, and the testmode can be activated via nl80211 commands.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "ATH10K",
    "ATH10K_USB",
    "NL80211_TESTMODE"
  ],
  "FocusSymbols": [
    "ath10k_tm_event_wmi",
    "ath10k_tm_cmd"
  ],
  "Reasoning": "The patch modifies the `ath10k` wireless driver's testmode event handling logic to drop non-UTF WMI events. This is a functional change in the driver's firmware event processing. The driver can be fuzzed via its USB interface by emulating the device and sending WMI events, and the testmode can be activated via nl80211 commands.",
  "WorthFuzzing": true
}