AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/10 22:46	flow	patch-triage	1m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "KMSANReasoning": "", "NeedsKMSAN": false, "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false }
1/1	2026/09/10 22:46	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit fd0959619ae8321f4b20b304324b17cc1fa30a36\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Sep 10 22:46:02 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c\nindex 42e11ba1206ee..02e51b2d42ed8 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c\n@@ -542,8 +542,10 @@ int mt7615_register_ext_phy(struct mt7615_dev dev)\n \n \tmt7615_cap_dbdc_enable(dev);\n \tmphy = mt76_alloc_phy(\u0026dev-\u003emt76, sizeof(phy), \u0026mt7615_ops, MT_BAND1);\n-\tif (!mphy)\n-\t\treturn -ENOMEM;\n+\tif (!mphy) {\n+\t\tret = -ENOMEM;\n+\t\tgoto error;\n+\t}\n \n \tphy = mphy-\u003epriv;\n \tphy-\u003edev = dev;\n@@ -573,7 +575,7 @@ int mt7615_register_ext_phy(struct mt7615_dev dev)\n \n \tret = mt76_eeprom_override(mphy);\n \tif (ret)\n-\t\treturn ret;\n+\t\tgoto error_free_hw;\n \n \t/ second phy can only handle 5 GHz /\n \tmphy-\u003ecap.has_5ghz = true;\n@@ -591,7 +593,14 @@ int mt7615_register_ext_phy(struct mt7615_dev dev)\n \tret = mt76_register_phy(mphy, true, mt76_rates,\n \t\t\t\tARRAY_SIZE(mt76_rates));\n \tif (ret)\n-\t\tieee80211_free_hw(mphy-\u003ehw);\n+\t\tgoto error_free_hw;\n+\n+\treturn 0;\n+\n+error_free_hw:\n+\tieee80211_free_hw(mphy-\u003ehw);\n+error:\n+\tmt7615_cap_dbdc_disable(dev);\n \n \treturn ret;\n }\n" }
2/1	2026/09/10 22:46	agent	patch-evaluator	1m Model: core Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit fd0959619ae8321f4b20b304324b17cc1fa30a36 Author: syz-cluster <triage@syzkaller.com> Date: Thu Sep 10 22:46:02 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c index 42e11ba1206ee..02e51b2d42ed8 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c @@ -542,8 +542,10 @@ int mt7615_register_ext_phy(struct mt7615_dev dev) mt7615_cap_dbdc_enable(dev); mphy = mt76_alloc_phy(&dev->mt76, sizeof(phy), &mt7615_ops, MT_BAND1); - if (!mphy) - return -ENOMEM; + if (!mphy) { + ret = -ENOMEM; + goto error; + } phy = mphy->priv; phy->dev = dev; @@ -573,7 +575,7 @@ int mt7615_register_ext_phy(struct mt7615_dev dev) ret = mt76_eeprom_override(mphy); if (ret) - return ret; + goto error_free_hw; / second phy can only handle 5 GHz / mphy->cap.has_5ghz = true; @@ -591,7 +593,14 @@ int mt7615_register_ext_phy(struct mt7615_dev dev) ret = mt76_register_phy(mphy, true, mt76_rates, ARRAY_SIZE(mt76_rates)); if (ret) - ieee80211_free_hw(mphy->hw); + goto error_free_hw; + + return 0; + +error_free_hw: + ieee80211_free_hw(mphy->hw); +error: + mt7615_cap_dbdc_disable(dev); return ret; }
3/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 3261 output: 37 thoughts: 113 Thoughts: Analyzing a Potential Driver Patch Okay, let's dive into this. First, I need to understand the scope of this patch. My immediate thought is to determine the target environment: is this something that's going to work seamlessly in my typical virtualized setups – think QEMU or GCE – or are we dealing with a driver that's fundamentally tied to physical hardware? I need to know where I can actually test this. The patch itself touches `drivers/net/wireless/mediatek/mt76/mt7615/init.c`, specifically the `mt7615_register_ext_phy` function. That gives me a starting point. Now, I need to get a broader picture. I'm going to search the codebase for "mt7615" to figure out what type of beast this driver actually is. Is it PCI? USB? Platform-specific, like an SoC integration? Knowing that will significantly impact my understanding of potential dependencies, initialization sequences, and testing procedures. Let's see what the codebase reveals.
4/2	2026/09/10 22:46	tool	grepper	0m Args: { "Expression": "mt7615", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "\nFull output is too long, showing 500 out of 4465 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Kconfig=46=source \"drivers/net/wireless/mediatek/mt76/mt7603/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:47:source \"drivers/net/wireless/mediatek/mt76/mt7615/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig-48-source \"drivers/net/wireless/mediatek/mt76/mt7915/Kconfig\"\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=43=obj-$(CONFIG_MT7603E) += mt7603/\ndrivers/net/wireless/mediatek/mt76/Makefile:44:obj-$(CONFIG_MT7615_COMMON) += mt7615/\ndrivers/net/wireless/mediatek/mt76/Makefile-45-obj-$(CONFIG_MT7915E) += mt7915/\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:3:obj-$(CONFIG_MT7615_COMMON) += mt7615-common.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:4:obj-$(CONFIG_MT7615E) += mt7615e.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-5-obj-$(CONFIG_MT7663_USB_SDIO_COMMON) += mt7663-usb-sdio-common.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile=9=CFLAGS_trace.o := -I$(src)\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-10-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:11:mt7615-common-y := main.o init.o mcu.o eeprom.o mac.o \\\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-12-\t\t debugfs.o trace.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:13:mt7615-common-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-14-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:15:mt7615e-y := pci.o pci_init.o dma.o pci_mac.o mmio.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:16:mt7615e-$(CONFIG_MT7622_WMAC) += soc.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-17-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-2-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:3:#include \"mt7615.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-4-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=5=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:6:mt7615_reg_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-7-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:8:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-9-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:10:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-11-\tmt76_wr(dev, dev-\u003emt76.debugfs_reg, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:12:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-13-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=17=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:18:mt7615_reg_get(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-19-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:20:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-21-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:22:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-23-\tval = mt76_rr(dev, dev-\u003emt76.debugfs_reg);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:24:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-25-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-28-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:29:DEFINE_DEBUGFS_ATTRIBUTE(fops_regval, mt7615_reg_get, mt7615_reg_set,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-30-\t\t\t \"0x%08llx\\n\");\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=32=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:33:mt7615_radar_pattern_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-34-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:35:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-36-\tint err;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-37-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:38:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-39-\t\treturn 0;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-40-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:41:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:42:\terr = mt7615_mcu_rdd_send_pattern(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:43:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-44-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=48=DEFINE_DEBUGFS_ATTRIBUTE(fops_radar_pattern, NULL,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:49:\t\t\t mt7615_radar_pattern_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-50-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:51:static int mt7615_config(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-52-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:53:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-54-\tint ret;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-55-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:56:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-57-\tret = mt76_connac_mcu_chip_config(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:58:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-59-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-62-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:63:DEFINE_DEBUGFS_ATTRIBUTE(fops_config, NULL, mt7615_config, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-64-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=65=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:66:mt7615_scs_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-67-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:68:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:69:\tstruct mt7615_phy ext_phy;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-70-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:71:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-72-\t\treturn 0;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-73-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:74:\tmt7615_mac_set_scs(\u0026dev-\u003ephy, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:75:\text_phy = mt7615_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-76-\tif (ext_phy)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:77:\t\tmt7615_mac_set_scs(ext_phy, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-78-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=82=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:83:mt7615_scs_get(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-84-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:85:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-86-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-91-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:92:DEFINE_DEBUGFS_ATTRIBUTE(fops_scs, mt7615_scs_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:93:\t\t\t mt7615_scs_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-94-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=95=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:96:mt7615_pm_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-97-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:98:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-99-\tstruct mt76_connac_pm pm = \u0026dev-\u003epm;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-101-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:102:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-103-\t\treturn 0;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:105:\tif (!mt7615_firmware_offload(dev) \|\| mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-106-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=136=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:137:mt7615_pm_get(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-138-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:139:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-140-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-145-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:146:DEFINE_DEBUGFS_ATTRIBUTE(fops_pm, mt7615_pm_get, mt7615_pm_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-147-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=148=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:149:mt7615_pm_stats(struct seq_file s, void data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-150-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:151:\tstruct mt7615_dev dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-152-\tstruct mt76_connac_pm pm = \u0026dev-\u003epm;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=168=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:169:mt7615_pm_idle_timeout_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-170-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:171:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-172-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=178=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:179:mt7615_pm_idle_timeout_get(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-180-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:181:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-182-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-187-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:188:DEFINE_DEBUGFS_ATTRIBUTE(fops_pm_idle_timeout, mt7615_pm_idle_timeout_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:189:\t\t\t mt7615_pm_idle_timeout_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-190-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=191=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:192:mt7615_dbdc_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-193-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:194:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-195-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:196:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-197-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-199-\tif (val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:200:\t\tmt7615_register_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-201-\telse\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:202:\t\tmt7615_unregister_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-203-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=207=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:208:mt7615_dbdc_get(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-209-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:210:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-211-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:212:\tval = !!mt7615_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-213-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-216-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:217:DEFINE_DEBUGFS_ATTRIBUTE(fops_dbdc, mt7615_dbdc_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:218:\t\t\t mt7615_dbdc_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=220=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:221:mt7615_fw_debug_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-222-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:223:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-224-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:225:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-226-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-229-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:230:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:231:\tmt7615_mcu_fw_log_2_host(dev, dev-\u003efw_debug ? 2 : 0);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:232:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-233-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=237=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:238:mt7615_fw_debug_get(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-239-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:240:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-241-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-246-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:247:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug, mt7615_fw_debug_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:248:\t\t\t mt7615_fw_debug_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-249-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=250=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:251:mt7615_reset_test_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-252-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:253:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-254-\tstruct sk_buff skb;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-255-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:256:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-257-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-264-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:265:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-266-\tmt76_tx_queue_skb_raw(dev, dev-\u003emphy.q_tx[0], skb, 0);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:267:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-268-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=272=DEFINE_DEBUGFS_ATTRIBUTE(fops_reset_test, NULL,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:273:\t\t\t mt7615_reset_test_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-274-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=275=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:276:mt7615_ampdu_stat_read_phy(struct mt7615_phy phy,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-277-\t\t\t struct seq_file file)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-278-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:279:\tstruct mt7615_dev dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-280-\tu32 reg = is_mt7663(\u0026dev-\u003emt76) ? MT_MIB_ARNG(0) : MT_AGG_ASRCR0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=311=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:312:mt7615_ampdu_stat_show(struct seq_file file, void data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-313-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:314:\tstruct mt7615_dev dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-315-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:316:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-317-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:318:\tmt7615_ampdu_stat_read_phy(\u0026dev-\u003ephy, file);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:319:\tmt7615_ampdu_stat_read_phy(mt7615_ext_phy(dev), file);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-320-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:321:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-322-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-325-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:326:DEFINE_SHOW_ATTRIBUTE(mt7615_ampdu_stat);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-327-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=328=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:329:mt7615_radio_read_phy(struct mt7615_phy phy, struct seq_file s)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-330-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:331:\tstruct mt7615_dev dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-332-\tbool ext_phy = phy != \u0026dev-\u003ephy;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=343=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:344:mt7615_radio_read(struct seq_file s, void data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-345-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:346:\tstruct mt7615_dev dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-347-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:348:\tmt7615_radio_read_phy(\u0026dev-\u003ephy, s);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:349:\tmt7615_radio_read_phy(mt7615_ext_phy(dev), s);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-350-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=354=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:355:mt7615_queues_acq(struct seq_file s, void data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-356-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:357:\tstruct mt7615_dev dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-358-\tint i;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-359-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:360:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-361-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-384-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:385:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-386-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=390=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:391:mt7615_queues_read(struct seq_file s, void data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-392-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:393:\tstruct mt7615_dev dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-394-\tstruct {\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=416=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:417:mt7615_rf_reg_set(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-418-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:419:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-420-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:421:\tmt7615_rf_wr(dev, dev-\u003edebugfs_rf_wf, dev-\u003edebugfs_rf_reg, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-422-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=426=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:427:mt7615_rf_reg_get(void data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-428-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:429:\tstruct mt7615_dev dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-430-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:431:\tval = mt7615_rf_rr(dev, dev-\u003edebugfs_rf_wf, dev-\u003edebugfs_rf_reg);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-432-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-435-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:436:DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_reg, mt7615_rf_reg_get, mt7615_rf_reg_set,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-437-\t\t\t \"0x%08llx\\n\");\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=439=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:440:mt7615_ext_mac_addr_read(struct file file, char __user userbuf,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-441-\t\t\t size_t count, loff_t ppos)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-442-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:443:\tstruct mt7615_dev dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-444-\tu32 len = 32 ((ETH_ALEN * 3) + 4) + 1;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=473=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:474:mt7615_ext_mac_addr_write(struct file file, const char __user userbuf,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-475-\t\t\t size_t count, loff_t ppos)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-476-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:477:\tstruct mt7615_dev dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-478-\tunsigned long idx = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=526=static const struct file_operations fops_ext_mac_addr = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-528-\t.llseek = generic_file_llseek,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:529:\t.read = mt7615_ext_mac_addr_read,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:530:\t.write = mt7615_ext_mac_addr_write,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-531-\t.owner = THIS_MODULE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=535=mt7663s_sched_quota_read(struct seq_file s, void data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-536-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:537:\tstruct mt7615_dev dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-538-\tstruct mt76_sdio sdio = \u0026dev-\u003emt76.sdio;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-547-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:548:int mt7615_init_debugfs(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-549-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-555-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:556:\tif (is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-557-\t\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"xmit-queues\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:558:\t\t\t\t\t mt7615_queues_read);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-559-\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-562-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"acq\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:563:\t\t\t\t mt7615_queues_acq);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:564:\tdebugfs_create_file(\"ampdu_stat\", 0400, dir, dev, \u0026mt7615_ampdu_stat_fops);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-565-\tdebugfs_create_file(\"scs\", 0600, dir, dev, \u0026fops_scs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-571-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"runtime_pm_stats\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:572:\t\t\t\t mt7615_pm_stats);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-573-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"radio\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:574:\t\t\t\t mt7615_radio_read);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-575-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:576:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-577-\t\tdebugfs_create_u32(\"dfs_hw_pattern\", 0400, dir,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-608-}\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:609:EXPORT_SYMBOL_GPL(mt7615_init_debugfs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-9-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:10:#include \"mt7615.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-11-#include \"../dma.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=14=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:15:mt7622_init_tx_queues_multi(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-16-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=44=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:45:mt7615_init_tx_queues(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-46-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-53-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:54:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-55-\t\treturn mt7622_init_tx_queues_multi(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-65-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:66:static int mt7615_poll_tx(struct napi_struct napi, int budget)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-67-{\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:68:\tstruct mt7615_dev dev;\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-69-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-79-\t\tmt76_connac_irq_enable(\u0026dev-\u003emt76,\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:80:\t\t\t\t mt7615_tx_mcu_int_mask(dev));\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-81-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-86-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:87:static int mt7615_poll_rx(struct napi_struct napi, int budget)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-88-{\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:89:\tstruct mt7615_dev dev;\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-90-\tint done;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:105:int mt7615_wait_pdma_busy(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-106-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-110-\t\tu32 mask = MT_PDMA_TX_BUSY \| MT_PDMA_RX_BUSY;\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:111:\t\tu32 reg = mt7615_reg_map(dev, MT_PDMA_BUSY);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-112-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-141-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:142:static void mt7622_dma_sched_init(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-143-{\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:144:\tu32 reg = mt7615_reg_map(dev, MT_DMASHDL_BASE);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-145-\tint i;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-165-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:166:static void mt7663_dma_sched_init(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-167-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:201:void mt7615_dma_start(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-202-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:220:int mt7615_dma_init(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-221-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-244-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:245:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-246-\t\tmt76_set(dev, MT_WPDMA_GLO_CFG,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-259-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:260:\tret = mt7615_init_tx_queues(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-261-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-270-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:271:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-272-\t rx_ring_size /= 2;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-280-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:281:\tret = mt76_init_queues(dev, mt7615_poll_rx);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-282-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-285-\tnetif_napi_add_tx(dev-\u003emt76.tx_napi_dev, \u0026dev-\u003emt76.tx_napi,\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:286:\t\t\t mt7615_poll_tx);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-287-\tnapi_enable(\u0026dev-\u003emt76.tx_napi);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-294-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:295:\tmask = MT_INT_RX_DONE_ALL \| mt7615_tx_mcu_int_mask(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-296-\tif (is_mt7663(\u0026dev-\u003emt76))\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-302-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:303:\tmt7615_dma_start(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-304-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-307-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:308:void mt7615_dma_cleanup(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-309-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-8-#include \u003clinux/of.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:9:#include \"mt7615.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-10-#include \"eeprom.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-11-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:12:static int mt7615_efuse_read(struct mt7615_dev dev, u32 base,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-13-\t\t\t u16 addr, u8 data)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-43-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:44:static int mt7615_efuse_init(struct mt7615_dev dev, u32 base)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-45-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-65-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:66:\t\tret = mt7615_efuse_read(dev, base, i, buf + i);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-67-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-73-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:74:static int mt7615_eeprom_load(struct mt7615_dev dev, u32 addr)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-75-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-83-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:84:\treturn mt7615_efuse_init(dev, addr);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-85-}\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-86-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:87:static int mt7615_check_eeprom(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-88-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=101=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:102:mt7615_eeprom_parse_hw_band_cap(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-103-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-143-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:144:static void mt7615_eeprom_parse_hw_cap(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-145-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-148-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:149:\tmt7615_eeprom_parse_hw_band_cap(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-150-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-172-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:173:static int mt7663_eeprom_get_target_power_index(struct mt7615_dev dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-174-\t\t\t\t\t\tstruct ieee80211_channel chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-184-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:185:\tgroup = mt7615_get_channel_group(chan-\u003ehw_value);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-186-\tif (chain_idx == 1)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-193-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:194:int mt7615_eeprom_get_target_power_index(struct mt7615_dev dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-195-\t\t\t\t\t struct ieee80211_channel chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-207-\t/* TSSI disabled /\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:208:\tif (mt7615_ext_pa_enabled(dev, chan-\u003eband)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-209-\t\tif (chan-\u003eband == NL80211_BAND_2GHZ)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-218-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:219:\t\tint group = mt7615_get_channel_group(chan-\u003ehw_value);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-220-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-241-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:242:int mt7615_eeprom_get_power_delta_index(struct mt7615_dev dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-243-\t\t\t\t\tenum nl80211_band band)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-258-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:259:static void mt7615_apply_cal_free_data(struct mt7615_dev *dev)\n\n" }
5/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 20304 output: 47 thoughts: 47 Thoughts: Investigating MT7615/MT7663 Bus Support Okay, so I need to figure out which buses the MT7615 and MT7663 wireless chips support. My usual first step is to dig into the kernel source, specifically the driver configuration. I'll head straight to `drivers/net/wireless/mediatek/mt76/mt7615/Kconfig`. This Kconfig file should define the dependencies and options related to the chip's bus interfaces, likely pointing me towards the relevant bus drivers (e.g., PCIe, SDIO, USB). From there I can get a clearer picture of the architecture, dependencies, and any other relevant configurations. Time to see what I can find...
6/2	2026/09/10 22:46	tool	read-file	0m Args: { "File": "drivers/net/wireless/mediatek/mt76/mt7615/Kconfig", "FirstLine": 1, "LineCount": 50 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n 2:\t\n 3:\tconfig MT7615_COMMON\n 4:\t\ttristate\n 5:\t\tselect WANT_DEV_COREDUMP\n 6:\t\tselect MT76_CONNAC_LIB\n 7:\t\n 8:\tconfig MT7615E\n 9:\t\ttristate \"MediaTek MT7615E and MT7663E (PCIe) support\"\n 10:\t\tselect MT7615_COMMON\n 11:\t\tdepends on MAC80211\n 12:\t\tdepends on PCI\n 13:\t\thelp\n 14:\t\t This adds support for MT7615-based PCIe wireless devices,\n 15:\t\t which support concurrent dual-band operation at both 5GHz\n 16:\t\t and 2.4GHz, IEEE 802.11ac 4x4:4SS 1733Mbps PHY rate, wave2\n 17:\t\t MU-MIMO up to 4 users/group and 160MHz channels.\n 18:\t\n 19:\t\t To compile this driver as a module, choose M here.\n 20:\t\n 21:\tconfig MT7622_WMAC\n 22:\t\tbool \"MT7622 (SoC) WMAC support\"\n 23:\t\tdepends on MT7615E\n 24:\t\tdepends on ARCH_MEDIATEK \|\| COMPILE_TEST\n 25:\t\tselect REGMAP\n 26:\t\tdefault y\n 27:\t\thelp\n 28:\t\t This adds support for the built-in WMAC on MT7622 SoC devices\n 29:\t\t which has the same feature set as a MT7615, but limited to\n 30:\t\t 2.4 GHz only.\n 31:\t\n 32:\tconfig MT7663_USB_SDIO_COMMON\n 33:\t\ttristate\n 34:\t\tselect MT7615_COMMON\n 35:\t\n 36:\tconfig MT7663U\n 37:\t\ttristate \"MediaTek MT7663U (USB) support\"\n 38:\t\tselect MT76_USB\n 39:\t\tselect MT7663_USB_SDIO_COMMON\n 40:\t\tdepends on MAC80211\n 41:\t\tdepends on USB\n 42:\t\thelp\n 43:\t\t This adds support for MT7663U 802.11ac 2x2:2 wireless devices.\n 44:\t\n 45:\t\t To compile this driver as a module, choose M here.\n 46:\t\n 47:\tconfig MT7663S\n 48:\t\ttristate \"MediaTek MT7663S (SDIO) support\"\n 49:\t\tselect MT76_SDIO\n 50:\t\tselect MT7663_USB_SDIO_COMMON\n" }
7/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 21311 output: 43 thoughts: 147 Thoughts: Analyzing the MT7663U Driver Okay, so I'm looking at this code and immediately see `CONFIG_MT7663U`. Right, that's the USB wireless driver, MediaTek MT7663U. Thinking about it, since it's USB, I can probably fuzz it using USB Raw Gadget or through syzkaller's USB fuzzing capabilities. I could even emulate it in QEMU with syzkaller. The key here is USB. Now, a question is popping into my head: can `mt7615_register_ext_phy` even be called for MT7663U? My initial thought is that it's probably PCIe-specific, but I need to be sure. Could it possibly be exposed through debugfs, or perhaps called during initialization? Or, is it somehow integrated within mac80211 or nl80211? Alright, time to dig into the codebase. I'm going to search for every instance where `mt7615_register_ext_phy` is called. That should give me the context I need to figure out if it's relevant to this USB driver at all. Knowing where it's called will help me determine its purpose and how to approach any potential fuzzing.
8/2	2026/09/10 22:46	tool	grepper	0m Args: { "Expression": "mt7615_register_ext_phy", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=192=mt7615_dbdc_set(void data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-199-\tif (val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:200:\t\tmt7615_register_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-201-\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c=526=EXPORT_SYMBOL_GPL(mt7615_led_set_brightness);\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-527-\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:528:int mt7615_register_ext_phy(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-529-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-606-}\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:607:EXPORT_SYMBOL_GPL(mt7615_register_ext_phy);\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-608-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=383=void mt7615_unregister_device(struct mt7615_dev dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:384:int mt7615_register_ext_phy(struct mt7615_dev dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-385-void mt7615_unregister_ext_phy(struct mt7615_dev dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c=69=int mt7615_register_device(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-103-\tif (dev-\u003edbdc_support) {\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c:104:\t\tret = mt7615_register_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-105-\t\tif (ret)\n" }
9/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 22564 output: 42 thoughts: 99 Thoughts: Debugging the MT7615 Driver Initialization Okay, so I'm trying to figure out how the debug file system is initialized within the MT7615 driver, specifically the USB version. My immediate question is: does `usb_init` trigger the call to `mt7615_init_debugfs`? Or perhaps `mt7615_register_ext_phy`? Alternatively, maybe `mt7663u` itself handles the debugfs initialization. To get to the bottom of this, I need to trace the call paths. First, I need to pinpoint where `mt7615_init_debugfs` is actually called. Then, I'll focus on the USB-specific code within the MT7615 driver, so I'll be looking in the `drivers/net/wireless/mediatek/mt76/mt7615/usb.c` file, or something similarly named within that directory structure, to see if I can find the answer. Let's see what we can find.
10/2	2026/09/10 22:46	tool	grepper	0m Args: { "Expression": "mt7615_init_debugfs", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=535=mt7663s_sched_quota_read(struct seq_file s, void data)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-547-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:548:int mt7615_init_debugfs(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-549-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-608-}\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:609:EXPORT_SYMBOL_GPL(mt7615_init_debugfs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=526=int mt7615_mcu_set_roc(struct mt7615_phy phy, struct ieee80211_vif vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-528-\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:529:int mt7615_init_debugfs(struct mt7615_dev dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-530-int mt7615_mcu_wait_response(struct mt7615_dev dev, int cmd, int seq);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c=69=int mt7615_register_device(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-108-\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c:109:\treturn mt7615_init_debugfs(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-110-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c=306=int mt7663_usb_sdio_register_device(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-345-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:346:\treturn mt7615_init_debugfs(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-347-}\n" }
11/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23749 output: 35 thoughts: 68 Thoughts: Investigating the Mediatek MT7615 USB Driver Okay, let's dive into this. Given the context, my initial thought is to examine the Mediatek MT7615 USB driver implementation. My first point of attack will be either `drivers/net/wireless/mediatek/mt76/mt7615/usb.c` or, if this is an SDIO-based implementation, `usb_sdio.c`. The core issue likely centers around USB driver registration or some USB-specific configuration. Therefore, my primary search focus within the `drivers/net/wireless/mediatek/mt76/mt7615/` directory will be directly related to the USB driver registration process. I need to understand how the USB device is initially initialized and integrated with the kernel, and the `usb.c` file is usually the place.
12/2	2026/09/10 22:46	tool	grepper	0m Args: { "Expression": "usb_driver", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt7615/usb.c=266=MODULE_FIRMWARE(MT7663_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-267-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:268:static struct usb_driver mt7663u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-269-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-280-};\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:281:module_usb_driver(mt7663u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-282-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=346=MODULE_LICENSE(\"GPL\");\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-347-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:348:static struct usb_driver mt76x0_driver = {\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-349-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-358-};\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:359:module_usb_driver(mt76x0_driver);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c=138=MODULE_FIRMWARE(MT7662_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-139-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:140:static struct usb_driver mt76x2u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-141-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-152-};\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:153:module_usb_driver(mt76x2u_driver);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-154-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c=329=MODULE_FIRMWARE(MT7921_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-330-\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:331:static struct usb_driver mt7921u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-332-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-343-};\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:344:module_usb_driver(mt7921u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-345-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c=327=MODULE_FIRMWARE(MT7925_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-328-\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:329:static struct usb_driver mt7925u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-330-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-341-};\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:342:module_usb_driver(mt7925u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-343-\n" }
13/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 25301 output: 50 thoughts: 348 Thoughts: My Analysis of the MT7663U Driver and DBDC Support Okay, so I'm digging into the MT7663U USB driver. From what I'm seeing, it leverages `mt7615-common`, which makes perfect sense. The core of this seems to be the `mt7663_usb_sdio_register_device` function, triggered when a USB device matches "mt7663u." This in turn calls `mt7615_init_debugfs`. Inside `mt7615_init_debugfs`, there's a debugfs entry being created: a file named "dbdc" with permissions 0600. That's immediately interesting. This "dbdc" file uses `fops_dbdc`, which handles file operations related to DBDC. Looking closer at `fops_dbdc`, I see `mt7615_dbdc_set`. That function takes a u64 value and, after a check with `mt7615_wait_for_mcu_init`, it either calls `mt7615_register_ext_phy` or `mt7615_unregister_ext_phy` based on the value. So, if the value provided to `mt7615_dbdc_set` is non-zero, it activates the extended PHY through `mt7615_register_ext_phy(dev)`. Clearly, we're on the right track! The presence of this debugfs entry and its associated functions strongly suggests this is how DBDC is enabled or disabled. Now, I want to confirm how DBDC is used in the wider context of the mt7615 and mt7663 family. The next logical step is to dive into `drivers/net/wireless/mediatek/mt76/mt7615/init.c` and specifically examine the surrounding code of the `mt7615_register_ext_phy` call. That should give me a much clearer picture of how DBDC is initialized, managed, and potentially used in a dual-band dual-concurrent configuration.
14/2	2026/09/10 22:46	tool	read-file	0m Args: { "File": "drivers/net/wireless/mediatek/mt76/mt7615/init.c", "FirstLine": 525, "LineCount": 85 } Results: { "Contents": " 525:\t}\n 526:\tEXPORT_SYMBOL_GPL(mt7615_led_set_brightness);\n 527:\t\n 528:\tint mt7615_register_ext_phy(struct mt7615_dev dev)\n 529:\t{\n 530:\t\tstruct mt7615_phy phy = mt7615_ext_phy(dev);\n 531:\t\tstruct mt76_phy mphy;\n 532:\t\tint i, ret;\n 533:\t\n 534:\t\tif (!is_mt7615(\u0026dev-\u003emt76))\n 535:\t\t\treturn -EOPNOTSUPP;\n 536:\t\n 537:\t\tif (test_bit(MT76_STATE_RUNNING, \u0026dev-\u003emphy.state))\n 538:\t\t\treturn -EINVAL;\n 539:\t\n 540:\t\tif (phy)\n 541:\t\t\treturn 0;\n 542:\t\n 543:\t\tmt7615_cap_dbdc_enable(dev);\n 544:\t\tmphy = mt76_alloc_phy(\u0026dev-\u003emt76, sizeof(phy), \u0026mt7615_ops, MT_BAND1);\n 545:\t\tif (!mphy) {\n 546:\t\t\tret = -ENOMEM;\n 547:\t\t\tgoto error;\n 548:\t\t}\n 549:\t\n 550:\t\tphy = mphy-\u003epriv;\n 551:\t\tphy-\u003edev = dev;\n 552:\t\tphy-\u003emt76 = mphy;\n 553:\t\tmphy-\u003echainmask = dev-\u003echainmask \u0026 ~dev-\u003emphy.chainmask;\n 554:\t\tmphy-\u003eantenna_mask = BIT(hweight8(mphy-\u003echainmask)) - 1;\n 555:\t\tmt7615_init_wiphy(mphy-\u003ehw);\n 556:\t\n 557:\t\tINIT_DELAYED_WORK(\u0026mphy-\u003emac_work, mt7615_mac_work);\n 558:\t\tINIT_DELAYED_WORK(\u0026phy-\u003escan_work, mt7615_scan_work);\n 559:\t\tskb_queue_head_init(\u0026phy-\u003escan_event_list);\n 560:\t\n 561:\t\tINIT_WORK(\u0026phy-\u003eroc_work, mt7615_roc_work);\n 562:\t\ttimer_setup(\u0026phy-\u003eroc_timer, mt7615_roc_timer, 0);\n 563:\t\tinit_waitqueue_head(\u0026phy-\u003eroc_wait);\n 564:\t\n 565:\t\tmt7615_mac_set_scs(phy, true);\n 566:\t\n 567:\t\t/\n 568:\t\t Make the secondary PHY MAC address local without overlapping with\n 569:\t\t * the usual MAC address allocation scheme on multiple virtual interfaces\n 570:\t\t /\n 571:\t\tmemcpy(mphy-\u003emacaddr, dev-\u003emt76.eeprom.data + MT_EE_MAC_ADDR,\n 572:\t\t ETH_ALEN);\n 573:\t\tmphy-\u003emacaddr[0] \|= 2;\n 574:\t\tmphy-\u003emacaddr[0] ^= BIT(7);\n 575:\t\n 576:\t\tret = mt76_eeprom_override(mphy);\n 577:\t\tif (ret)\n 578:\t\t\tgoto error_free_hw;\n 579:\t\n 580:\t\t/ second phy can only handle 5 GHz /\n 581:\t\tmphy-\u003ecap.has_5ghz = true;\n 582:\t\n 583:\t\t/ mt7615 second phy shares the same hw queues with the primary one /\n 584:\t\tfor (i = 0; i \u003c= MT_TXQ_PSD ; i++)\n 585:\t\t\tmphy-\u003eq_tx[i] = dev-\u003emphy.q_tx[i];\n 586:\t\n 587:\t\t/ init led callbacks /\n 588:\t\tif (IS_ENABLED(CONFIG_MT76_LEDS)) {\n 589:\t\t\tmphy-\u003eleds.cdev.brightness_set = mt7615_led_set_brightness;\n 590:\t\t\tmphy-\u003eleds.cdev.blink_set = mt7615_led_set_blink;\n 591:\t\t}\n 592:\t\n 593:\t\tret = mt76_register_phy(mphy, true, mt76_rates,\n 594:\t\t\t\t\tARRAY_SIZE(mt76_rates));\n 595:\t\tif (ret)\n 596:\t\t\tgoto error_free_hw;\n 597:\t\n 598:\t\treturn 0;\n 599:\t\n 600:\terror_free_hw:\n 601:\t\tieee80211_free_hw(mphy-\u003ehw);\n 602:\terror:\n 603:\t\tmt7615_cap_dbdc_disable(dev);\n 604:\t\n 605:\t\treturn ret;\n 606:\t}\n 607:\tEXPORT_SYMBOL_GPL(mt7615_register_ext_phy);\n 608:\t\n 609:\tvoid mt7615_unregister_ext_phy(struct mt7615_dev dev)\n" }
15/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 27596 output: 39 thoughts: 73 Thoughts: Analyzing the Code - A Quick Check Okay, hold on a second! My eyes just snagged on line 534 in that C code. Let me parse that... Ah, there's a crucial check right there: `if (!is_mt7615(&dev->mt76))`. My expert brain immediately spots the potential issue: This function appears to be an error path, and it will only get there if a certain chip isn't a certain type. "Wait, what's `is_mt7615` actually checking for?" I need to refresh my memory on what hardware components this function is designed to handle. This demands a closer look at the implementation of the `is_mt7615` function to fully understand its behavior and intended scope. I better track down the definition of that function right now. Let's see...
16/2	2026/09/10 22:46	tool	grepper	0m Args: { "Expression": "is_mt7615", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=548=int mt7615_init_debugfs(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-555-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:556:\tif (is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-557-\t\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"xmit-queues\", dir,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-575-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:576:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-577-\t\tdebugfs_create_u32(\"dfs_hw_pattern\", 0400, dir,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=45=mt7615_init_tx_queues(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-53-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:54:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-55-\t\treturn mt7622_init_tx_queues_multi(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=220=int mt7615_dma_init(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-244-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:245:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-246-\t\tmt76_set(dev, MT_WPDMA_GLO_CFG,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-270-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:271:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-272-\t rx_ring_size /= 2;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c=360=mt7615_init_wiphy(struct ieee80211_hw hw)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-408-\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:409:\tif (is_mt7615(\u0026phy-\u003edev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-410-\t\thw-\u003emax_tx_fragments = MT_TXP_MAX_BUF_NUM;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c=528=int mt7615_register_ext_phy(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-533-\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:534:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-535-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c=1552=static void mt7615_mac_tx_free(struct mt7615_dev dev, void data, int len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1559-\tmt76_queue_tx_cleanup(dev, dev-\u003emphy.q_tx[MT_TXQ_PSD], false);\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c:1560:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1561-\t\tmt76_queue_tx_cleanup(dev, dev-\u003emphy.q_tx[MT_TXQ_BE], false);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1567-\tcount = le16_get_bits(free-\u003ectrl, MT_TX_FREE_MSDU_ID_CNT);\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c:1568:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1569-\t\t__le16 token = tx_token;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c=284=int mt7615_set_channel(struct mt76_phy mphy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-292-\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c:293:\tif (is_mt7615(\u0026dev-\u003emt76) \u0026\u0026 dev-\u003eflash_eeprom) {\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-294-\t\tret = mt7615_mcu_apply_rx_dcoc(phy);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=1332=static int mt7615_load_n9(struct mt7615_dev dev, const char name)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1369-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:1370:\tif (!is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1371-\t\tdev-\u003efw_ver = MT7615_FIRMWARE_V2;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c=60=int mt7615_tx_prepare_skb(struct mt76_dev mdev, void txwi_ptr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c-103-\tmemset(txp, 0, sizeof(struct mt76_connac_txp_common));\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c:104:\tif (is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c-105-\t\tmt7615_write_fw_txp(dev, tx_info, txp, id);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=251=static inline bool is_mt7622(struct mt76_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-258-\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:259:static inline bool is_mt7615(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-260-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=269=static inline bool is_connac_v1(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-270-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:271:\treturn is_mt7615(dev) \|\| is_mt7663(dev) \|\| is_mt7622(dev);\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-272-}\n" }
17/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 30337 output: 49 thoughts: 40 Thoughts: Okay, let's dive into this. Here's how I'd approach that query, as if it were my thought process: Diving into the MT7615 Driver Alright, so someone's asked about the `is_mt7615(dev)` function. Given my expertise in this area, my first thought is to go straight to the source. Specifically, I need to understand what this function actually does. I know from experience that the `drivers/net/wireless/mediatek/mt76` directory is the canonical location for Mediatek WiFi drivers within the kernel tree, and the `mt76_connac.h` header file is a likely candidate for interface-related definitions. So, let's open up that header file and see what `is_mt7615(dev)` is defined as. I need to understand how it identifies an MT7615 device; likely checking some sort of hardware ID or board information against a known value. I expect the definition to be relatively straightforward: either a direct check for a specific ID, or perhaps a more complex macro that incorporates family checks and versioning. Let's get to the code and see.
18/2	2026/09/10 22:46	tool	read-file	0m Args: { "File": "drivers/net/wireless/mediatek/mt76/mt76_connac.h", "FirstLine": 250, "LineCount": 25 } Results: { "Contents": " 250:\t\n 251:\tstatic inline bool is_mt7622(struct mt76_dev dev)\n 252:\t{\n 253:\t\tif (!IS_ENABLED(CONFIG_MT7622_WMAC))\n 254:\t\t\treturn false;\n 255:\t\n 256:\t\treturn mt76_chip(dev) == 0x7622;\n 257:\t}\n 258:\t\n 259:\tstatic inline bool is_mt7615(struct mt76_dev dev)\n 260:\t{\n 261:\t\treturn mt76_chip(dev) == 0x7615 \|\| mt76_chip(dev) == 0x7611;\n 262:\t}\n 263:\t\n 264:\tstatic inline bool is_mt7611(struct mt76_dev dev)\n 265:\t{\n 266:\t\treturn mt76_chip(dev) == 0x7611;\n 267:\t}\n 268:\t\n 269:\tstatic inline bool is_connac_v1(struct mt76_dev dev)\n 270:\t{\n 271:\t\treturn is_mt7615(dev) \|\| is_mt7663(dev) \|\| is_mt7622(dev);\n 272:\t}\n 273:\t\n 274:\tstatic inline bool is_mt76_fw_txp(struct mt76_dev *dev)\n" }
19/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 31105 output: 45 thoughts: 50 Thoughts: Okay, here's my interpretation of those thoughts, summarized from my perspective as an expert in my field: Chip ID Investigation Alright, time to get down to brass tacks. I'm going to start by getting a handle on which devices are currently utilizing either the 0x7615 or 0x7611 chip IDs. It's the most logical first step to understand the current hardware inventory. From there, I need to trace back where these specific chips are being probed within the system. That'll give me the context I need to figure out how these chip IDs are being utilized in practice. Understanding the probe points will likely point the way to the right drivers, configurations, or hardware specifications associated with each of those chips. From there I can determine how I can make changes without breaking anything.
20/2	2026/09/10 22:46	tool	grepper	0m Args: { "Expression": "0x7615\|0x7611", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=87=static int mt7615_check_eeprom(struct mt76_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-91-\tswitch (val) {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:92:\tcase 0x7615:\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-93-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=315=static void mt7615_cal_free_data(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-325-\t\tbreak;\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:326:\tcase 0x7615:\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:327:\tcase 0x7611:\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-328-\t\tmt7615_apply_cal_free_data(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c=15=static const struct pci_device_id mt7615_pci_device_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c:16:\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7615) },\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c-17-\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7663) },\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c:18:\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7611) },\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c-19-\t{ },\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=259=static inline bool is_mt7615(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-260-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:261:\treturn mt76_chip(dev) == 0x7615 \|\| mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-262-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=264=static inline bool is_mt7611(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-265-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:266:\treturn mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-267-}\n" }
21/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 32320 output: 49 thoughts: 89 Thoughts: Investigating the MT7615 PCI Device Table and Related USB Driver Okay, so I'm diving into this `mt7615_pci_device_table` right now. Interesting... it seems to be listing PCI devices, specifically those with the 0x7615 and 0x7611 device IDs. My first thought is to note those IDs; seems like a logical starting point when I'm dealing with MT7615, or even variants. But, hold on a second... what about the `mt7663u` driver? Where does that chip fit into this picture? I need to understand its relationship to the other devices, and which device I am looking for. I should check `drivers/net/wireless/mediatek/mt76/mt7615/usb.c` to see if there are any relationships, or commonalities to be found. Let's see if there's any immediate correlation there... that's where I need to look for now.
22/2	2026/09/10 22:46	tool	read-file	0m Args: { "File": "drivers/net/wireless/mediatek/mt76/mt7615/usb.c", "FirstLine": 1, "LineCount": 100 } Results: { "Contents": " 1:\t// SPDX-License-Identifier: BSD-3-Clause-Clear\n 2:\t/* Copyright (C) 2019 MediaTek Inc.\n 3:\t \n 4:\t Author: Felix Fietkau \u003cnbd@nbd.name\u003e\n 5:\t \t Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\n 6:\t \t Sean Wang \u003csean.wang@mediatek.com\u003e\n 7:\t /\n 8:\t\n 9:\t#include \u003clinux/kernel.h\u003e\n 10:\t#include \u003clinux/module.h\u003e\n 11:\t#include \u003clinux/usb.h\u003e\n 12:\t\n 13:\t#include \"mt7615.h\"\n 14:\t#include \"mac.h\"\n 15:\t#include \"mcu.h\"\n 16:\t#include \"regs.h\"\n 17:\t\n 18:\tstatic const struct usb_device_id mt7615_device_table[] = {\n 19:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7663, 0xff, 0xff, 0xff) },\n 20:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x043e, 0x310c, 0xff, 0xff, 0xff) },\n 21:\t\t{ },\n 22:\t};\n 23:\t\n 24:\tstatic u32 mt7663u_rr(struct mt76_dev dev, u32 addr)\n 25:\t{\n 26:\t\tu32 ret;\n 27:\t\n 28:\t\tmutex_lock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n 29:\t\tret = ___mt76u_rr(dev, MT_VEND_READ_EXT,\n 30:\t\t\t\t USB_DIR_IN \| USB_TYPE_VENDOR, addr);\n 31:\t\tmutex_unlock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n 32:\t\n 33:\t\treturn ret;\n 34:\t}\n 35:\t\n 36:\tstatic void mt7663u_wr(struct mt76_dev dev, u32 addr, u32 val)\n 37:\t{\n 38:\t\tmutex_lock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n 39:\t\t___mt76u_wr(dev, MT_VEND_WRITE_EXT,\n 40:\t\t\t USB_DIR_OUT \| USB_TYPE_VENDOR, addr, val);\n 41:\t\tmutex_unlock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n 42:\t}\n 43:\t\n 44:\tstatic u32 mt7663u_rmw(struct mt76_dev dev, u32 addr,\n 45:\t\t\t u32 mask, u32 val)\n 46:\t{\n 47:\t\tmutex_lock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n 48:\t\tval \|= ___mt76u_rr(dev, MT_VEND_READ_EXT,\n 49:\t\t\t\t USB_DIR_IN \| USB_TYPE_VENDOR, addr) \u0026 ~mask;\n 50:\t\t___mt76u_wr(dev, MT_VEND_WRITE_EXT,\n 51:\t\t\t USB_DIR_OUT \| USB_TYPE_VENDOR, addr, val);\n 52:\t\tmutex_unlock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n 53:\t\n 54:\t\treturn val;\n 55:\t}\n 56:\t\n 57:\tstatic void mt7663u_copy(struct mt76_dev dev, u32 offset,\n 58:\t\t\t\t const void data, int len)\n 59:\t{\n 60:\t\tstruct mt76_usb usb = \u0026dev-\u003eusb;\n 61:\t\tint ret, i = 0, batch_len;\n 62:\t\tconst u8 val = data;\n 63:\t\n 64:\t\tlen = round_up(len, 4);\n 65:\t\n 66:\t\tmutex_lock(\u0026usb-\u003eusb_ctrl_mtx);\n 67:\t\twhile (i \u003c len) {\n 68:\t\t\tbatch_len = min_t(int, usb-\u003edata_len, len - i);\n 69:\t\t\tmemcpy(usb-\u003edata, val + i, batch_len);\n 70:\t\t\tret = __mt76u_vendor_request(dev, MT_VEND_WRITE_EXT,\n 71:\t\t\t\t\t\t USB_DIR_OUT \| USB_TYPE_VENDOR,\n 72:\t\t\t\t\t\t (offset + i) \u003e\u003e 16, offset + i,\n 73:\t\t\t\t\t\t usb-\u003edata, batch_len);\n 74:\t\t\tif (ret \u003c 0)\n 75:\t\t\t\tbreak;\n 76:\t\n 77:\t\t\ti += batch_len;\n 78:\t\t}\n 79:\t\tmutex_unlock(\u0026usb-\u003eusb_ctrl_mtx);\n 80:\t}\n 81:\t\n 82:\tstatic void mt7663u_stop(struct ieee80211_hw hw, bool suspend)\n 83:\t{\n 84:\t\tstruct mt7615_phy phy = mt7615_hw_phy(hw);\n 85:\t\tstruct mt7615_dev dev = hw-\u003epriv;\n 86:\t\n 87:\t\tclear_bit(MT76_STATE_RUNNING, \u0026dev-\u003emphy.state);\n 88:\t\ttimer_delete_sync(\u0026phy-\u003eroc_timer);\n 89:\t\tcancel_work_sync(\u0026phy-\u003eroc_work);\n 90:\t\tcancel_delayed_work_sync(\u0026phy-\u003escan_work);\n 91:\t\tcancel_delayed_work_sync(\u0026phy-\u003emt76-\u003emac_work);\n 92:\t\tmt76u_stop_tx(\u0026dev-\u003emt76);\n 93:\t}\n 94:\t\n 95:\tstatic void mt7663u_cleanup(struct mt7615_dev dev)\n 96:\t{\n 97:\t\tclear_bit(MT76_STATE_INITIALIZED, \u0026dev-\u003emphy.state);\n 98:\t\tmt76u_queues_deinit(\u0026dev-\u003emt76);\n 99:\t}\n 100:\t\n" }
23/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 34318 output: 50 thoughts: 33 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: Diving Deeper into the MT7615 USB Driver Alright, so we've been focusing on that specific area of the MT7615 USB driver, but it's time to broaden the scope. I need to get a more comprehensive view of how this all functions. I should definitely examine the whole of `drivers/net/wireless/mediatek/mt76/mt7615/usb.c`. I need to understand the relationship between the pieces, where the control flow originates, and how it all hangs together. There could be critical clues within the seemingly "unimportant" sections, details that affect the module behavior. This deeper dive will expose how this particular module is integrated into the rest of the larger MT76 framework, and the implications of certain design choices. That broader context will be crucial for the problem I'm working on. Let's see what we can find.
24/2	2026/09/10 22:46	tool	read-file	0m Args: { "File": "drivers/net/wireless/mediatek/mt76/mt7615/usb.c", "FirstLine": 180, "LineCount": 90 } Results: { "Contents": " 180:\t\tif (ret)\n 181:\t\t\tgoto error;\n 182:\t\n 183:\t\tret = mt76u_alloc_queues(\u0026dev-\u003emt76);\n 184:\t\tif (ret)\n 185:\t\t\tgoto error;\n 186:\t\n 187:\t\tret = mt7663_usb_sdio_register_device(dev);\n 188:\t\tif (ret)\n 189:\t\t\tgoto error;\n 190:\t\n 191:\t\treturn 0;\n 192:\t\n 193:\terror:\n 194:\t\tmt76u_queues_deinit(\u0026dev-\u003emt76);\n 195:\t\tusb_set_intfdata(usb_intf, NULL);\n 196:\t\tusb_put_dev(interface_to_usbdev(usb_intf));\n 197:\t\n 198:\t\tmt76_free_device(\u0026dev-\u003emt76);\n 199:\t\n 200:\t\treturn ret;\n 201:\t}\n 202:\t\n 203:\tstatic void mt7663u_disconnect(struct usb_interface usb_intf)\n 204:\t{\n 205:\t\tstruct mt7615_dev dev = usb_get_intfdata(usb_intf);\n 206:\t\n 207:\t\tif (!test_bit(MT76_STATE_INITIALIZED, \u0026dev-\u003emphy.state))\n 208:\t\t\treturn;\n 209:\t\n 210:\t\tieee80211_unregister_hw(dev-\u003emt76.hw);\n 211:\t\tmt7663u_cleanup(dev);\n 212:\t\n 213:\t\tusb_set_intfdata(usb_intf, NULL);\n 214:\t\tusb_put_dev(interface_to_usbdev(usb_intf));\n 215:\t\n 216:\t\tmt76_free_device(\u0026dev-\u003emt76);\n 217:\t}\n 218:\t\n 219:\t#ifdef CONFIG_PM\n 220:\tstatic int mt7663u_suspend(struct usb_interface intf, pm_message_t state)\n 221:\t{\n 222:\t\tstruct mt7615_dev dev = usb_get_intfdata(intf);\n 223:\t\n 224:\t\tif (!test_bit(MT76_STATE_SUSPEND, \u0026dev-\u003emphy.state) \u0026\u0026\n 225:\t\t mt7615_firmware_offload(dev)) {\n 226:\t\t\tint err;\n 227:\t\n 228:\t\t\terr = mt76_connac_mcu_set_hif_suspend(\u0026dev-\u003emt76, true, true);\n 229:\t\t\tif (err \u003c 0)\n 230:\t\t\t\treturn err;\n 231:\t\t}\n 232:\t\n 233:\t\tmt76u_stop_rx(\u0026dev-\u003emt76);\n 234:\t\tmt76u_stop_tx(\u0026dev-\u003emt76);\n 235:\t\n 236:\t\treturn 0;\n 237:\t}\n 238:\t\n 239:\tstatic int mt7663u_resume(struct usb_interface intf)\n 240:\t{\n 241:\t\tstruct mt7615_dev dev = usb_get_intfdata(intf);\n 242:\t\tint err;\n 243:\t\n 244:\t\terr = mt76u_vendor_request(\u0026dev-\u003emt76, MT_VEND_FEATURE_SET,\n 245:\t\t\t\t\t USB_DIR_OUT \| USB_TYPE_VENDOR,\n 246:\t\t\t\t\t 0x5, 0x0, NULL, 0);\n 247:\t\tif (err)\n 248:\t\t\treturn err;\n 249:\t\n 250:\t\terr = mt76u_resume_rx(\u0026dev-\u003emt76);\n 251:\t\tif (err \u003c 0)\n 252:\t\t\treturn err;\n 253:\t\n 254:\t\tif (!test_bit(MT76_STATE_SUSPEND, \u0026dev-\u003emphy.state) \u0026\u0026\n 255:\t\t mt7615_firmware_offload(dev))\n 256:\t\t\terr = mt76_connac_mcu_set_hif_suspend(\u0026dev-\u003emt76, false, true);\n 257:\t\n 258:\t\treturn err;\n 259:\t}\n 260:\t#endif /* CONFIG_PM */\n 261:\t\n 262:\tMODULE_DEVICE_TABLE(usb, mt7615_device_table);\n 263:\tMODULE_FIRMWARE(MT7663_OFFLOAD_FIRMWARE_N9);\n 264:\tMODULE_FIRMWARE(MT7663_OFFLOAD_ROM_PATCH);\n 265:\tMODULE_FIRMWARE(MT7663_FIRMWARE_N9);\n 266:\tMODULE_FIRMWARE(MT7663_ROM_PATCH);\n 267:\t\n 268:\tstatic struct usb_driver mt7663u_driver = {\n 269:\t\t.name\t\t= KBUILD_MODNAME,\n" }
25/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 36045 output: 38 thoughts: 613 Thoughts: Analyzing the MT7663U and mt7615 Driver Interaction Okay, let's break this down. For the MT7663U, the chip ID is 0x7663. I was looking at how the `mt7615_register_ext_phy` function handles this, and I see a problem right away. The function includes this check: ```c if (!is_mt7615(&dev->mt76)) return -EOPNOTSUPP; ``` `is_mt7615` checks for `mt76_chip(dev) == 0x7615 \|\| mt76_chip(dev) == 0x7611`. But wait, the MT7663 has a chip ID of 0x7663. So, for the MT7663U (the USB version), `mt7615_register_ext_phy` is immediately returning `-EOPNOTSUPP`! This happens before any of the logic I'm interested in! Now, I need to understand why this is happening. I need to verify that `mt7615` (0x7615 / 0x7611) even exists as a USB device, or if it's strictly PCIe. Let's see... I'll search the `mt7615` driver for device information. Okay, let's dig into the `drivers/net/wireless/mediatek/mt76/mt7615/` directory. * `pci.c`: Ah, there's a `mt7615_pci_device_table` that includes devices with the vendor ID and 0x7615, 0x7663, and 0x7611 chip IDs. This clearly defines PCIe devices. * `usb.c`: Excellent. The `mt7615_device_table` includes USB devices: the USB device `0x0e8d, 0x7663` and `0x043e, 0x310c` which is also an MT7663U! * `sdio.c`: Found a device here for `mt7663s` (SDIO). * `soc.c`: Contains code for `MT7622_WMAC` (built-in WMAC on MT7622 SoC, ARM / ARCH_MEDIATEK). Alright, I see a clear delineation. The MT7615/MT7611 drivers are not only for PCIe devices, since USB and SDIO are covered. The `usb.c` file confirms that there is support for these chips over USB. So, the issue isn't that `mt7615` is only PCIe. Now I need to figure out why the driver is rejecting the MT7663U based on that check. I'll need to look more closely at how the driver identifies these specific devices and where this code might be used.
26/2	2026/09/10 22:46	tool	grepper	0m Args: { "Expression": "sdio_device_id", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt7615/sdio.c-21-\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:22:static const struct sdio_device_id mt7663s_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-23-\t{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7603) },\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c=76=static int mt7663s_probe(struct sdio_func func,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:77:\t\t\t const struct sdio_device_id id)\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-78-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c-18-\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c:19:static const struct sdio_device_id mt7921s_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c-20-\t{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901),\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c=90=static int mt7921s_probe(struct sdio_func func,\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c:91:\t\t\t const struct sdio_device_id id)\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c-92-{\n" }
27/2	2026/09/10 22:46	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 37898 output: 41 thoughts: 842 Thoughts: Analyzing the Potential for Fuzzing `mt7615_register_ext_phy` Okay, let's break this down systematically. The question is whether we should consider fuzzing the code within `mt7615_register_ext_phy`. The first hurdle is that this function, on the face of it, seems tightly coupled to physical hardware. Specifically, the function logic is used only when an external PHY is registered. `is_mt7615` checks for Mediatek chip IDs 0x7615 or 0x7611. I know from experience that these are found in the `mt7615_pci_device_table`, which strongly suggests PCIe devices. The key negative criterion in the prompt is about "structurally unreachable hardware," specifically vendor-specific PCIe cards not emulated in standard QEMU. That's a red flag! Standard QEMU, as far as I know, doesn't emulate the MediaTek MT7615/MT7611 PCIe hardware. This would automatically exclude it from being fuzzable. But we have to be absolutely certain. Let's trace the callers of `mt7615_register_ext_phy`. We've got two callers: 1. `mt7615_register_device` (via `mt7615_pci_probe`): This is called during the PCIe probe. So, a Mediatek MT7615 PCIe card probe. That's a physical card probe. 2. `mt7615_dbdc_set`: This is called via a debugfs entry. However, to create the debugfs entry, you'd have to initialize a `mt7615` device (either via `mt7615_register_device`, or by a USB or SDIO device registering). This is potentially interesting. If it was created by `mt7663u` (USB), and someone writes to `dbdc`, `mt7615_register_ext_phy` will execute. However, because MT7663 has chip ID 0x7663 (`!is_mt7615`), `mt7615_register_ext_phy` immediately returns `-EOPNOTSUPP`. The modified code is never reached in this scenario! Also, for the MT7615 PCIe device (which IS `is_mt7615`), the device cannot be probed in standard virtualized environments (QEMU / GCE) because MT7615 is physical MediaTek PCIe hardware. So, in the first calling path, you need physical hardware. In the second calling path, if it executes with a USB or SDIO device, you have an early return from `mt7615_register_ext_phy` that skips the modified code. The final question: is there any virtual or mock interface for `mt76`? Maybe some `mac80211_hwsim` or similar? Let me do a quick search... No, nothing immediately apparent. That would be the only chance of running this in a VM. Based on the evidence, the modified code in `mt7615_register_ext_phy` is only reachable on physical hardware. It seems we should return `WorthFuzzing=false`.
28/2	2026/09/10 22:47	tool	grepper	0m Error: no matches Args: { "Expression": "mt76_", "PathPrefix": "drivers/net/wireless/mac80211_hwsim.c" } Results: { "error": "no matches" }
29/2	2026/09/10 22:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 39524 output: 38 thoughts: 95 Thoughts: Okay, here's my breakdown of this. Investigating the `mt76_chip` Context Right, so I'm trying to figure out if there's any connection between this `mac80211_hwsim` driver and the `mt76` framework. The initial thought is that they are completely separate; `mac80211_hwsim` is explicitly a software simulation of the hardware and has no inherent link to MediaTek's `mt76` drivers. It's designed to be independent. However, I need to be absolutely sure. The question is: could there be some unforeseen interaction, perhaps a subtle dependency, or even a misconfiguration that could lead to something being incorrectly set? Specifically, I'm thinking about the boolean `is_mt7615`. Can that ever be true in the context of a USB device, or a virtual device like `mac80211_hwsim`? Seems unlikely on the face of it, but better to confirm. Therefore, my next step is to drill into the `drivers/net/wireless/mediatek/mt76/` directory. That's the logical place to check where the `mt76_chip` data structure is being initialized and set. I'm going to look for any logic that might potentially misidentify a device, or any code paths that could lead to unexpected behavior in a virtualized or USB-connected scenario. I'm looking for clues in the initial setup of this chip identification.
30/2	2026/09/10 22:47	tool	grepper	0m Error: no matches Args: { "Expression": "-\u003echip.dev_id", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "error": "no matches" }
31/2	2026/09/10 22:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 39998 output: 37 thoughts: 30 Thoughts: Here's my thought process, as if I were analyzing that code: Finding the Origin of mt76_chip and Related Variables Okay, so I need to track down the definition of `mt76_chip`, and understand where `dev->chip` and `chip_id` are being assigned their values. This usually means starting with a grep search across the relevant source code. I need to figure out the context. Is this a specific driver? Is `mt76_chip` a structure, a macro, or something else? I'll probably start with a broader search for `mt76_chip` and its uses. Then, I need to understand the relationship between `dev->chip` (which is likely a member of a device structure) and `chip_id`. Is `chip_id` some kind of identifier? Is `dev->chip` a pointer to something else? Understanding this will be key to understanding the device initialization and configuration flow. I'll need to follow the code paths where these are used and/or set, looking for initialization routines, probe functions, and any other places where hardware identification or setup is likely occurring. Understanding how these variables relate and where they are set is essential to understanding the design and operation of this driver. Let's dig in.
32/2	2026/09/10 22:47	tool	grepper	0m Args: { "Expression": "mt76_chip", "PathPrefix": "drivers/net/wireless/mediatek/mt76" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt76.h=1227=bool mt76_pci_aspm_supported(struct pci_dev pdev);\ndrivers/net/wireless/mediatek/mt76/mt76.h-1228-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1229:static inline u16 mt76_chip(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76.h-1230-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1261=static inline int mt76_wed_dma_setup(struct mt76_dev dev, struct mt76_queue q,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1267-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1268:#define mt76xx_chip(dev) mt76_chip(\u0026((dev)-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt76.h-1269-#define mt76xx_rev(dev) mt76_rev(\u0026((dev)-\u003emt76))\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=315=static void mt7615_cal_free_data(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-321-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:322:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-323-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=1696=int mt7615_mcu_init(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1710-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:1711:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1712-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=1747=int mt7615_mcu_set_eeprom(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1759-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:1760:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1761-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=175=static inline bool is_mt7925(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-176-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:177:\treturn mt76_chip(dev) == 0x7925;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-178-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=180=static inline bool is_mt7920(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-181-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:182:\treturn mt76_chip(dev) == 0x7920;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-183-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=185=static inline bool is_mt7902(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-186-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:187:\treturn mt76_chip(dev) == 0x7902;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-188-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=190=static inline bool is_mt7922(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-191-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:192:\treturn mt76_chip(dev) == 0x7922;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-193-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=195=static inline bool is_connac2(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-196-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:197:\treturn mt76_chip(dev) == 0x7961 \|\| is_mt7922(dev) \|\| is_mt7920(dev) \|\|\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-198-\t\t\t\tis_mt7902(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=201=static inline bool is_mt7663(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-202-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:203:\treturn mt76_chip(dev) == 0x7663;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-204-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=206=static inline bool is_mt7915(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-207-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:208:\treturn mt76_chip(dev) == 0x7915;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-209-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=211=static inline bool is_mt7916(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-212-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:213:\treturn mt76_chip(dev) == 0x7906;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-214-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=216=static inline bool is_mt7981(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-217-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:218:\treturn mt76_chip(dev) == 0x7981;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-219-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=221=static inline bool is_mt7986(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-222-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:223:\treturn mt76_chip(dev) == 0x7986;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-224-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=231=static inline bool is_mt7996(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-232-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:233:\treturn mt76_chip(dev) == 0x7990;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-234-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=236=static inline bool is_mt7992(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-237-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:238:\treturn mt76_chip(dev) == 0x7992;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-239-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=241=static inline bool is_mt7990(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-242-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:243:\treturn mt76_chip(dev) == 0x7993;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-244-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=251=static inline bool is_mt7622(struct mt76_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-255-\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:256:\treturn mt76_chip(dev) == 0x7622;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-257-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=259=static inline bool is_mt7615(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-260-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:261:\treturn mt76_chip(dev) == 0x7615 \|\| mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-262-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=264=static inline bool is_mt7611(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-265-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:266:\treturn mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-267-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=274=static inline bool is_mt76_fw_txp(struct mt76_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-275-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:276:\tswitch (mt76_chip(dev)) {\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-277-\tcase 0x7961:\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h=31=static inline bool is_mt7610e(struct mt76x02_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-35-\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h:36:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7610;\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-37-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h=39=static inline bool is_mt7630(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-40-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h:41:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7630;\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-42-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c=95=static int mt76x0e_init_hardware(struct mt76x02_dev dev, bool resume)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c-119-\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c:120:\tif (mt76_chip(\u0026dev-\u003emt76) == 0x7610) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c-121-\t\tu16 val;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c=13=static int mt76x0e_load_firmware(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c-14-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c:15:\tbool is_combo_chip = mt76_chip(\u0026dev-\u003emt76) != 0x7610;\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c-16-\tu32 val, ilm_len, dlm_len, offset = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02.h=227=static inline bool is_mt76x0(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-228-{\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:229:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7610 \|\|\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:230:\t mt76_chip(\u0026dev-\u003emt76) == 0x7630 \|\|\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:231:\t mt76_chip(\u0026dev-\u003emt76) == 0x7650;\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-232-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02.h=234=static inline bool is_mt76x2(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-235-{\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:236:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7612 \|\|\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:237:\t mt76_chip(\u0026dev-\u003emt76) == 0x7632 \|\|\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:238:\t mt76_chip(\u0026dev-\u003emt76) == 0x7662 \|\|\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:239:\t mt76_chip(\u0026dev-\u003emt76) == 0x7602;\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-240-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c=824=void mt76x02_dfs_init_params(struct mt76x02_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c-839-\t\tmt76_wr(dev, MT_BBP(DFS, 1), 0xf);\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c:840:\t\tif (mt76_chip(\u0026dev-\u003emt76) == 0x7610 \|\|\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c:841:\t\t mt76_chip(\u0026dev-\u003emt76) == 0x7630)\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c-842-\t\t\tmt76_wr(dev, MT_BBP(IBI, 11), 0xfde8081);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h=26=static inline bool is_mt7612(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-27-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:28:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7612;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-29-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c=89=mt7915_coredump_get_mem_layout(struct mt7915_dev dev, u32 num)\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-90-{\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c:91:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-92-\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c=302=static struct mt7915_coredump mt7915_coredump_build(struct mt7915_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-338-\tdump-\u003etv_nsec = crash_data-\u003etimestamp.tv_nsec;\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c:339:\tdump-\u003edevice_id = mt76_chip(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-340-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c=67=static char mt7915_eeprom_name(struct mt7915_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-68-{\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c:69:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-70-\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c=363=mt7915_eeprom_has_background_radar(struct mt7915_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-368-\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c:369:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-370-\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c=555=mt7915_init_led_mux(struct mt7915_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-560-\tif (dev-\u003edbdc_support) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c:561:\t\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-562-\t\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-583-\t} else if (dev-\u003emphy.leds.pin) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c:584:\t\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-585-\t\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-600-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c:601:\t\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-602-\t\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-11-\tchar _fw;\t\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:12:\tswitch (mt76_chip(\u0026(_dev)-\u003emt76)) {\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-13-\tcase 0x7915:\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt792x.h=451=static inline char mt792x_ram_name(struct mt792x_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt792x.h-452-{\ndrivers/net/wireless/mediatek/mt76/mt792x.h:453:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt792x.h-454-\tcase 0x7902:\n--\ndrivers/net/wireless/mediatek/mt76/mt792x.h=467=static inline char mt792x_patch_name(struct mt792x_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt792x.h-468-{\ndrivers/net/wireless/mediatek/mt76/mt792x.h:469:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt792x.h-470-\tcase 0x7902:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=48=mt7996_coredump_get_mem_layout(struct mt7996_dev dev, u32 num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-49-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:50:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-51-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=162=static struct mt7996_coredump mt7996_coredump_build(struct mt7996_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-198-\tdump-\u003etv_nsec = crash_data-\u003etimestamp.tv_nsec;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:199:\tdump-\u003edevice_id = mt76_chip(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-200-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=46=static void mt7996_dma_config(struct mt7996_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-67-\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:68:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-69-\tcase MT7992_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=27=static char mt7996_eeprom_name(struct mt7996_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-28-{\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:29:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-30-\tcase MT7992_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=389=bool mt7996_eeprom_has_background_radar(struct mt7996_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-390-{\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:391:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-392-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=1182=static int mt7996_variant_type_init(struct mt7996_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1186-\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:1187:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1188-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-14-\tchar _fw;\t\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:15:\tswitch (mt76_chip(\u0026(_dev)-\u003emt76)) {\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-16-\tcase MT7992_DEVICE_ID:\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c=4108=mt7996_mcu_get_cal_free_data(struct mt7996_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-4162-\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:4163:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-4164-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/usb.c=910=mt76u_ac_to_hwq(struct mt76_dev dev, struct mt76_queue q, u8 qid)\n--\ndrivers/net/wireless/mediatek/mt76/usb.c-913-\ndrivers/net/wireless/mediatek/mt76/usb.c:914:\tswitch (mt76_chip(dev)) {\ndrivers/net/wireless/mediatek/mt76/usb.c-915-\tcase 0x7663: {\n" }
33/2	2026/09/10 22:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 48573 output: 196 thoughts: 708 Thoughts: Analysis of MT7615 Driver Patch Reachability Okay, so I've looked into this patch and determined its reachability for fuzzing. The key is that the modification affects the `mt7615_register_ext_phy` function, found in `drivers/net/wireless/mediatek/mt76/mt7615/init.c`. Right off the bat, the function begins with a check using `is_mt7615(&dev->mt76)`. This is the crux of the issue. This function only returns true for the MediaTek MT7615 and MT7611 chipsets, specifically the PCIe variants. Now, consider the environment we're working with. Syzkaller and standard virtualized setups like QEMU and GCE don't emulate the physical hardware required by these PCIe wireless NICs. These are real, tangible PCIe cards that need to be plugged into a physical system. There's no emulation for that level of detail. Consequently, any USB or SDIO devices using MediaTek chips (like the MT7663U) will immediately get rejected. Their chip IDs will trigger the `!is_mt7615` condition and lead to a `-EOPNOTSUPP` return before hitting any of the modified code, including the error handling and DBDC cleanup paths. So, that modified section, the target of this patch, is structurally unreachable under those conditions. Essentially, the patch targets hardware that is fundamentally unavailable in the target fuzzing environment. The patch requires that MediaTek MT7615/MT7611 PCIe hardware is instantiated, which is impossible in our current setup. Therefore, because this code is structurally unreachable, I'm going to set `WorthFuzzing=false`.
34/2	2026/09/10 22:47	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.", "WorthFuzzing": false }
35/1	2026/09/10 22:47	action	If	0m Args: { "WorthFuzzing": false } Results: null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "PatchDiff": "commit fd0959619ae8321f4b20b304324b17cc1fa30a36\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Sep 10 22:46:02 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c\nindex 42e11ba1206ee..02e51b2d42ed8 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c\n@@ -542,8 +542,10 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)\n \n \tmt7615_cap_dbdc_enable(dev);\n \tmphy = mt76_alloc_phy(\u0026dev-\u003emt76, sizeof(*phy), \u0026mt7615_ops, MT_BAND1);\n-\tif (!mphy)\n-\t\treturn -ENOMEM;\n+\tif (!mphy) {\n+\t\tret = -ENOMEM;\n+\t\tgoto error;\n+\t}\n \n \tphy = mphy-\u003epriv;\n \tphy-\u003edev = dev;\n@@ -573,7 +575,7 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)\n \n \tret = mt76_eeprom_override(mphy);\n \tif (ret)\n-\t\treturn ret;\n+\t\tgoto error_free_hw;\n \n \t/* second phy can only handle 5 GHz */\n \tmphy-\u003ecap.has_5ghz = true;\n@@ -591,7 +593,14 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)\n \tret = mt76_register_phy(mphy, true, mt76_rates,\n \t\t\t\tARRAY_SIZE(mt76_rates));\n \tif (ret)\n-\t\tieee80211_free_hw(mphy-\u003ehw);\n+\t\tgoto error_free_hw;\n+\n+\treturn 0;\n+\n+error_free_hw:\n+\tieee80211_free_hw(mphy-\u003ehw);\n+error:\n+\tmt7615_cap_dbdc_disable(dev);\n \n \treturn ret;\n }\n"
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit fd0959619ae8321f4b20b304324b17cc1fa30a36
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Sep 10 22:46:02 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
index 42e11ba1206ee..02e51b2d42ed8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -542,8 +542,10 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
 
 	mt7615_cap_dbdc_enable(dev);
 	mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7615_ops, MT_BAND1);
-	if (!mphy)
-		return -ENOMEM;
+	if (!mphy) {
+		ret = -ENOMEM;
+		goto error;
+	}
 
 	phy = mphy->priv;
 	phy->dev = dev;
@@ -573,7 +575,7 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
 
 	ret = mt76_eeprom_override(mphy);
 	if (ret)
-		return ret;
+		goto error_free_hw;
 
 	/* second phy can only handle 5 GHz */
 	mphy->cap.has_5ghz = true;
@@ -591,7 +593,14 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
 	ret = mt76_register_phy(mphy, true, mt76_rates,
 				ARRAY_SIZE(mt76_rates));
 	if (ret)
-		ieee80211_free_hw(mphy->hw);
+		goto error_free_hw;
+
+	return 0;
+
+error_free_hw:
+	ieee80211_free_hw(mphy->hw);
+error:
+	mt7615_cap_dbdc_disable(dev);
 
 	return ret;
 }

							input: 3261
							output: 37
							thoughts: 113

**Analyzing a Potential Driver Patch**

Okay, let's dive into this. First, I need to understand the scope of this patch. My immediate thought is to determine the target environment: is this something that's going to work seamlessly in my typical virtualized setups – think QEMU or GCE – or are we dealing with a driver that's fundamentally tied to physical hardware? I need to know where I can actually test this.

The patch itself touches `drivers/net/wireless/mediatek/mt76/mt7615/init.c`, specifically the `mt7615_register_ext_phy` function. That gives me a starting point. Now, I need to get a broader picture. I'm going to search the codebase for "mt7615" to figure out what type of beast this driver actually is. Is it PCI? USB? Platform-specific, like an SoC integration? Knowing that will significantly impact my understanding of potential dependencies, initialization sequences, and testing procedures. Let's see what the codebase reveals.

{
  "Expression": "mt7615",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "\nFull output is too long, showing 500 out of 4465 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Kconfig=46=source \"drivers/net/wireless/mediatek/mt76/mt7603/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:47:source \"drivers/net/wireless/mediatek/mt76/mt7615/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig-48-source \"drivers/net/wireless/mediatek/mt76/mt7915/Kconfig\"\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=43=obj-$(CONFIG_MT7603E) += mt7603/\ndrivers/net/wireless/mediatek/mt76/Makefile:44:obj-$(CONFIG_MT7615_COMMON) += mt7615/\ndrivers/net/wireless/mediatek/mt76/Makefile-45-obj-$(CONFIG_MT7915E) += mt7915/\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:3:obj-$(CONFIG_MT7615_COMMON) += mt7615-common.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:4:obj-$(CONFIG_MT7615E) += mt7615e.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-5-obj-$(CONFIG_MT7663_USB_SDIO_COMMON) += mt7663-usb-sdio-common.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile=9=CFLAGS_trace.o := -I$(src)\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-10-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:11:mt7615-common-y := main.o init.o mcu.o eeprom.o mac.o \\\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-12-\t\t   debugfs.o trace.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:13:mt7615-common-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-14-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:15:mt7615e-y := pci.o pci_init.o dma.o pci_mac.o mmio.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:16:mt7615e-$(CONFIG_MT7622_WMAC) += soc.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-17-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-2-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:3:#include \"mt7615.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-4-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=5=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:6:mt7615_reg_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-7-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:8:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-9-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:10:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-11-\tmt76_wr(dev, dev-\u003emt76.debugfs_reg, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:12:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-13-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=17=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:18:mt7615_reg_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-19-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:20:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-21-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:22:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-23-\t*val = mt76_rr(dev, dev-\u003emt76.debugfs_reg);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:24:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-25-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-28-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:29:DEFINE_DEBUGFS_ATTRIBUTE(fops_regval, mt7615_reg_get, mt7615_reg_set,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-30-\t\t\t \"0x%08llx\\n\");\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=32=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:33:mt7615_radar_pattern_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-34-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:35:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-36-\tint err;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-37-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:38:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-39-\t\treturn 0;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-40-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:41:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:42:\terr = mt7615_mcu_rdd_send_pattern(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:43:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-44-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=48=DEFINE_DEBUGFS_ATTRIBUTE(fops_radar_pattern, NULL,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:49:\t\t\t mt7615_radar_pattern_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-50-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:51:static int mt7615_config(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-52-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:53:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-54-\tint ret;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-55-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:56:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-57-\tret = mt76_connac_mcu_chip_config(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:58:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-59-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-62-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:63:DEFINE_DEBUGFS_ATTRIBUTE(fops_config, NULL, mt7615_config, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-64-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=65=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:66:mt7615_scs_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-67-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:68:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:69:\tstruct mt7615_phy *ext_phy;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-70-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:71:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-72-\t\treturn 0;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-73-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:74:\tmt7615_mac_set_scs(\u0026dev-\u003ephy, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:75:\text_phy = mt7615_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-76-\tif (ext_phy)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:77:\t\tmt7615_mac_set_scs(ext_phy, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-78-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=82=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:83:mt7615_scs_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-84-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:85:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-86-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-91-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:92:DEFINE_DEBUGFS_ATTRIBUTE(fops_scs, mt7615_scs_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:93:\t\t\t mt7615_scs_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-94-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=95=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:96:mt7615_pm_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-97-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:98:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-99-\tstruct mt76_connac_pm *pm = \u0026dev-\u003epm;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-101-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:102:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-103-\t\treturn 0;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:105:\tif (!mt7615_firmware_offload(dev) || mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-106-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=136=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:137:mt7615_pm_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-138-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:139:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-140-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-145-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:146:DEFINE_DEBUGFS_ATTRIBUTE(fops_pm, mt7615_pm_get, mt7615_pm_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-147-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=148=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:149:mt7615_pm_stats(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-150-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:151:\tstruct mt7615_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-152-\tstruct mt76_connac_pm *pm = \u0026dev-\u003epm;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=168=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:169:mt7615_pm_idle_timeout_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-170-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:171:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-172-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=178=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:179:mt7615_pm_idle_timeout_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-180-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:181:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-182-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-187-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:188:DEFINE_DEBUGFS_ATTRIBUTE(fops_pm_idle_timeout, mt7615_pm_idle_timeout_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:189:\t\t\t mt7615_pm_idle_timeout_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-190-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=191=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:192:mt7615_dbdc_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-193-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:194:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-195-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:196:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-197-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-199-\tif (val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:200:\t\tmt7615_register_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-201-\telse\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:202:\t\tmt7615_unregister_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-203-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=207=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:208:mt7615_dbdc_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-209-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:210:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-211-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:212:\t*val = !!mt7615_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-213-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-216-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:217:DEFINE_DEBUGFS_ATTRIBUTE(fops_dbdc, mt7615_dbdc_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:218:\t\t\t mt7615_dbdc_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=220=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:221:mt7615_fw_debug_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-222-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:223:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-224-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:225:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-226-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-229-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:230:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:231:\tmt7615_mcu_fw_log_2_host(dev, dev-\u003efw_debug ? 2 : 0);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:232:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-233-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=237=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:238:mt7615_fw_debug_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-239-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:240:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-241-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-246-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:247:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug, mt7615_fw_debug_get,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:248:\t\t\t mt7615_fw_debug_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-249-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=250=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:251:mt7615_reset_test_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-252-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:253:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-254-\tstruct sk_buff *skb;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-255-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:256:\tif (!mt7615_wait_for_mcu_init(dev))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-257-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-264-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:265:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-266-\tmt76_tx_queue_skb_raw(dev, dev-\u003emphy.q_tx[0], skb, 0);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:267:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-268-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=272=DEFINE_DEBUGFS_ATTRIBUTE(fops_reset_test, NULL,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:273:\t\t\t mt7615_reset_test_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-274-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=275=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:276:mt7615_ampdu_stat_read_phy(struct mt7615_phy *phy,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-277-\t\t\t   struct seq_file *file)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-278-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:279:\tstruct mt7615_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-280-\tu32 reg = is_mt7663(\u0026dev-\u003emt76) ? MT_MIB_ARNG(0) : MT_AGG_ASRCR0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=311=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:312:mt7615_ampdu_stat_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-313-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:314:\tstruct mt7615_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-315-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:316:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-317-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:318:\tmt7615_ampdu_stat_read_phy(\u0026dev-\u003ephy, file);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:319:\tmt7615_ampdu_stat_read_phy(mt7615_ext_phy(dev), file);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-320-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:321:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-322-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-325-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:326:DEFINE_SHOW_ATTRIBUTE(mt7615_ampdu_stat);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-327-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=328=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:329:mt7615_radio_read_phy(struct mt7615_phy *phy, struct seq_file *s)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-330-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:331:\tstruct mt7615_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-332-\tbool ext_phy = phy != \u0026dev-\u003ephy;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=343=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:344:mt7615_radio_read(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-345-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:346:\tstruct mt7615_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-347-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:348:\tmt7615_radio_read_phy(\u0026dev-\u003ephy, s);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:349:\tmt7615_radio_read_phy(mt7615_ext_phy(dev), s);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-350-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=354=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:355:mt7615_queues_acq(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-356-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:357:\tstruct mt7615_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-358-\tint i;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-359-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:360:\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-361-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-384-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:385:\tmt7615_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-386-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=390=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:391:mt7615_queues_read(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-392-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:393:\tstruct mt7615_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-394-\tstruct {\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=416=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:417:mt7615_rf_reg_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-418-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:419:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-420-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:421:\tmt7615_rf_wr(dev, dev-\u003edebugfs_rf_wf, dev-\u003edebugfs_rf_reg, val);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-422-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=426=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:427:mt7615_rf_reg_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-428-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:429:\tstruct mt7615_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-430-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:431:\t*val = mt7615_rf_rr(dev, dev-\u003edebugfs_rf_wf, dev-\u003edebugfs_rf_reg);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-432-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-435-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:436:DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_reg, mt7615_rf_reg_get, mt7615_rf_reg_set,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-437-\t\t\t \"0x%08llx\\n\");\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=439=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:440:mt7615_ext_mac_addr_read(struct file *file, char __user *userbuf,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-441-\t\t\t size_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-442-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:443:\tstruct mt7615_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-444-\tu32 len = 32 * ((ETH_ALEN * 3) + 4) + 1;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=473=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:474:mt7615_ext_mac_addr_write(struct file *file, const char __user *userbuf,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-475-\t\t\t  size_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-476-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:477:\tstruct mt7615_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-478-\tunsigned long idx = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=526=static const struct file_operations fops_ext_mac_addr = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-528-\t.llseek = generic_file_llseek,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:529:\t.read = mt7615_ext_mac_addr_read,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:530:\t.write = mt7615_ext_mac_addr_write,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-531-\t.owner = THIS_MODULE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=535=mt7663s_sched_quota_read(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-536-{\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:537:\tstruct mt7615_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-538-\tstruct mt76_sdio *sdio = \u0026dev-\u003emt76.sdio;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-547-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:548:int mt7615_init_debugfs(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-549-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-555-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:556:\tif (is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-557-\t\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"xmit-queues\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:558:\t\t\t\t\t    mt7615_queues_read);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-559-\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-562-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"acq\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:563:\t\t\t\t    mt7615_queues_acq);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:564:\tdebugfs_create_file(\"ampdu_stat\", 0400, dir, dev, \u0026mt7615_ampdu_stat_fops);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-565-\tdebugfs_create_file(\"scs\", 0600, dir, dev, \u0026fops_scs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-571-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"runtime_pm_stats\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:572:\t\t\t\t    mt7615_pm_stats);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-573-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"radio\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:574:\t\t\t\t    mt7615_radio_read);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-575-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:576:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-577-\t\tdebugfs_create_u32(\"dfs_hw_pattern\", 0400, dir,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-608-}\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:609:EXPORT_SYMBOL_GPL(mt7615_init_debugfs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-9-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:10:#include \"mt7615.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-11-#include \"../dma.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=14=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:15:mt7622_init_tx_queues_multi(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-16-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=44=static int\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:45:mt7615_init_tx_queues(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-46-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-53-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:54:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-55-\t\treturn mt7622_init_tx_queues_multi(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-65-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:66:static int mt7615_poll_tx(struct napi_struct *napi, int budget)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-67-{\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:68:\tstruct mt7615_dev *dev;\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-69-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-79-\t\tmt76_connac_irq_enable(\u0026dev-\u003emt76,\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:80:\t\t\t\t       mt7615_tx_mcu_int_mask(dev));\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-81-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-86-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:87:static int mt7615_poll_rx(struct napi_struct *napi, int budget)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-88-{\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:89:\tstruct mt7615_dev *dev;\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-90-\tint done;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:105:int mt7615_wait_pdma_busy(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-106-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-110-\t\tu32 mask = MT_PDMA_TX_BUSY | MT_PDMA_RX_BUSY;\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:111:\t\tu32 reg = mt7615_reg_map(dev, MT_PDMA_BUSY);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-112-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-141-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:142:static void mt7622_dma_sched_init(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-143-{\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:144:\tu32 reg = mt7615_reg_map(dev, MT_DMASHDL_BASE);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-145-\tint i;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-165-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:166:static void mt7663_dma_sched_init(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-167-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:201:void mt7615_dma_start(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-202-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:220:int mt7615_dma_init(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-221-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-244-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:245:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-246-\t\tmt76_set(dev, MT_WPDMA_GLO_CFG,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-259-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:260:\tret = mt7615_init_tx_queues(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-261-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-270-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:271:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-272-\t    rx_ring_size /= 2;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-280-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:281:\tret = mt76_init_queues(dev, mt7615_poll_rx);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-282-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-285-\tnetif_napi_add_tx(dev-\u003emt76.tx_napi_dev, \u0026dev-\u003emt76.tx_napi,\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:286:\t\t\t  mt7615_poll_tx);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-287-\tnapi_enable(\u0026dev-\u003emt76.tx_napi);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-294-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:295:\tmask = MT_INT_RX_DONE_ALL | mt7615_tx_mcu_int_mask(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-296-\tif (is_mt7663(\u0026dev-\u003emt76))\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-302-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:303:\tmt7615_dma_start(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-304-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-307-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:308:void mt7615_dma_cleanup(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-309-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-8-#include \u003clinux/of.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:9:#include \"mt7615.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-10-#include \"eeprom.h\"\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-11-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:12:static int mt7615_efuse_read(struct mt7615_dev *dev, u32 base,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-13-\t\t\t     u16 addr, u8 *data)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-43-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:44:static int mt7615_efuse_init(struct mt7615_dev *dev, u32 base)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-45-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-65-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:66:\t\tret = mt7615_efuse_read(dev, base, i, buf + i);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-67-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-73-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:74:static int mt7615_eeprom_load(struct mt7615_dev *dev, u32 addr)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-75-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-83-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:84:\treturn mt7615_efuse_init(dev, addr);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-85-}\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-86-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:87:static int mt7615_check_eeprom(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-88-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=101=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:102:mt7615_eeprom_parse_hw_band_cap(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-103-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-143-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:144:static void mt7615_eeprom_parse_hw_cap(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-145-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-148-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:149:\tmt7615_eeprom_parse_hw_band_cap(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-150-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-172-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:173:static int mt7663_eeprom_get_target_power_index(struct mt7615_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-174-\t\t\t\t\t\tstruct ieee80211_channel *chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-184-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:185:\tgroup = mt7615_get_channel_group(chan-\u003ehw_value);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-186-\tif (chain_idx == 1)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-193-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:194:int mt7615_eeprom_get_target_power_index(struct mt7615_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-195-\t\t\t\t\t struct ieee80211_channel *chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-207-\t/* TSSI disabled */\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:208:\tif (mt7615_ext_pa_enabled(dev, chan-\u003eband)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-209-\t\tif (chan-\u003eband == NL80211_BAND_2GHZ)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-218-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:219:\t\tint group = mt7615_get_channel_group(chan-\u003ehw_value);\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-220-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-241-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:242:int mt7615_eeprom_get_power_delta_index(struct mt7615_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-243-\t\t\t\t\tenum nl80211_band band)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-258-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:259:static void mt7615_apply_cal_free_data(struct mt7615_dev *dev)\n\n"
}

							input: 20304
							output: 47
							thoughts: 47

**Investigating MT7615/MT7663 Bus Support**

Okay, so I need to figure out which buses the MT7615 and MT7663 wireless chips support. My usual first step is to dig into the kernel source, specifically the driver configuration. I'll head straight to `drivers/net/wireless/mediatek/mt76/mt7615/Kconfig`. This Kconfig file should define the dependencies and options related to the chip's bus interfaces, likely pointing me towards the relevant bus drivers (e.g., PCIe, SDIO, USB). From there I can get a clearer picture of the architecture, dependencies, and any other relevant configurations. Time to see what I can find...

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7615/Kconfig",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\t\n   3:\tconfig MT7615_COMMON\n   4:\t\ttristate\n   5:\t\tselect WANT_DEV_COREDUMP\n   6:\t\tselect MT76_CONNAC_LIB\n   7:\t\n   8:\tconfig MT7615E\n   9:\t\ttristate \"MediaTek MT7615E and MT7663E (PCIe) support\"\n  10:\t\tselect MT7615_COMMON\n  11:\t\tdepends on MAC80211\n  12:\t\tdepends on PCI\n  13:\t\thelp\n  14:\t\t  This adds support for MT7615-based PCIe wireless devices,\n  15:\t\t  which support concurrent dual-band operation at both 5GHz\n  16:\t\t  and 2.4GHz, IEEE 802.11ac 4x4:4SS 1733Mbps PHY rate, wave2\n  17:\t\t  MU-MIMO up to 4 users/group and 160MHz channels.\n  18:\t\n  19:\t\t  To compile this driver as a module, choose M here.\n  20:\t\n  21:\tconfig MT7622_WMAC\n  22:\t\tbool \"MT7622 (SoC) WMAC support\"\n  23:\t\tdepends on MT7615E\n  24:\t\tdepends on ARCH_MEDIATEK || COMPILE_TEST\n  25:\t\tselect REGMAP\n  26:\t\tdefault y\n  27:\t\thelp\n  28:\t\t  This adds support for the built-in WMAC on MT7622 SoC devices\n  29:\t\t  which has the same feature set as a MT7615, but limited to\n  30:\t\t  2.4 GHz only.\n  31:\t\n  32:\tconfig MT7663_USB_SDIO_COMMON\n  33:\t\ttristate\n  34:\t\tselect MT7615_COMMON\n  35:\t\n  36:\tconfig MT7663U\n  37:\t\ttristate \"MediaTek MT7663U (USB) support\"\n  38:\t\tselect MT76_USB\n  39:\t\tselect MT7663_USB_SDIO_COMMON\n  40:\t\tdepends on MAC80211\n  41:\t\tdepends on USB\n  42:\t\thelp\n  43:\t\t  This adds support for MT7663U 802.11ac 2x2:2 wireless devices.\n  44:\t\n  45:\t\t  To compile this driver as a module, choose M here.\n  46:\t\n  47:\tconfig MT7663S\n  48:\t\ttristate \"MediaTek MT7663S (SDIO) support\"\n  49:\t\tselect MT76_SDIO\n  50:\t\tselect MT7663_USB_SDIO_COMMON\n"
}

							input: 21311
							output: 43
							thoughts: 147

**Analyzing the MT7663U Driver**

Okay, so I'm looking at this code and immediately see `CONFIG_MT7663U`. Right, that's the USB wireless driver, MediaTek MT7663U. Thinking about it, since it's USB, I can probably fuzz it using USB Raw Gadget or through syzkaller's USB fuzzing capabilities. I could even emulate it in QEMU with syzkaller. The key here is USB.

Now, a question is popping into my head: can `mt7615_register_ext_phy` even be called for MT7663U? My initial thought is that it's probably PCIe-specific, but I need to be sure. Could it possibly be exposed through debugfs, or perhaps called during initialization? Or, is it somehow integrated within mac80211 or nl80211?

Alright, time to dig into the codebase. I'm going to search for every instance where `mt7615_register_ext_phy` is called. That should give me the context I need to figure out if it's relevant to this USB driver at all. Knowing where it's called will help me determine its purpose and how to approach any potential fuzzing.

{
  "Expression": "mt7615_register_ext_phy",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=192=mt7615_dbdc_set(void *data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-199-\tif (val)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:200:\t\tmt7615_register_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-201-\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c=526=EXPORT_SYMBOL_GPL(mt7615_led_set_brightness);\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-527-\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:528:int mt7615_register_ext_phy(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-529-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-606-}\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:607:EXPORT_SYMBOL_GPL(mt7615_register_ext_phy);\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-608-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=383=void mt7615_unregister_device(struct mt7615_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:384:int mt7615_register_ext_phy(struct mt7615_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-385-void mt7615_unregister_ext_phy(struct mt7615_dev *dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c=69=int mt7615_register_device(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-103-\tif (dev-\u003edbdc_support) {\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c:104:\t\tret = mt7615_register_ext_phy(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-105-\t\tif (ret)\n"
}

							input: 22564
							output: 42
							thoughts: 99

**Debugging the MT7615 Driver Initialization**

Okay, so I'm trying to figure out how the debug file system is initialized within the MT7615 driver, specifically the USB version. My immediate question is: does `usb_init` trigger the call to `mt7615_init_debugfs`? Or perhaps `mt7615_register_ext_phy`? Alternatively, maybe `mt7663u` itself handles the debugfs initialization.

To get to the bottom of this, I need to trace the call paths. First, I need to pinpoint where `mt7615_init_debugfs` is actually *called*. Then, I'll focus on the USB-specific code within the MT7615 driver, so I'll be looking in the `drivers/net/wireless/mediatek/mt76/mt7615/usb.c` file, or something similarly named within that directory structure, to see if I can find the answer. Let's see what we can find.

{
  "Expression": "mt7615_init_debugfs",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=535=mt7663s_sched_quota_read(struct seq_file *s, void *data)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-547-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:548:int mt7615_init_debugfs(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-549-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-608-}\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:609:EXPORT_SYMBOL_GPL(mt7615_init_debugfs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=526=int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-528-\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:529:int mt7615_init_debugfs(struct mt7615_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-530-int mt7615_mcu_wait_response(struct mt7615_dev *dev, int cmd, int seq);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c=69=int mt7615_register_device(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-108-\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c:109:\treturn mt7615_init_debugfs(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_init.c-110-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c=306=int mt7663_usb_sdio_register_device(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-345-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:346:\treturn mt7615_init_debugfs(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-347-}\n"
}

							input: 23749
							output: 35
							thoughts: 68

**Investigating the Mediatek MT7615 USB Driver**

Okay, let's dive into this. Given the context, my initial thought is to examine the Mediatek MT7615 USB driver implementation. My first point of attack will be either `drivers/net/wireless/mediatek/mt76/mt7615/usb.c` or, if this is an SDIO-based implementation, `usb_sdio.c`. The core issue likely centers around USB driver registration or some USB-specific configuration. Therefore, my primary search focus within the `drivers/net/wireless/mediatek/mt76/mt7615/` directory will be directly related to the USB driver registration process. I need to understand how the USB device is initially initialized and integrated with the kernel, and the `usb.c` file is usually the place.

{
  "Expression": "usb_driver",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7615/usb.c=266=MODULE_FIRMWARE(MT7663_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-267-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:268:static struct usb_driver mt7663u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-269-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-280-};\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:281:module_usb_driver(mt7663u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-282-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=346=MODULE_LICENSE(\"GPL\");\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-347-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:348:static struct usb_driver mt76x0_driver = {\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-349-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-358-};\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:359:module_usb_driver(mt76x0_driver);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c=138=MODULE_FIRMWARE(MT7662_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-139-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:140:static struct usb_driver mt76x2u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-141-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-152-};\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:153:module_usb_driver(mt76x2u_driver);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-154-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c=329=MODULE_FIRMWARE(MT7921_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-330-\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:331:static struct usb_driver mt7921u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-332-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-343-};\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:344:module_usb_driver(mt7921u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-345-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c=327=MODULE_FIRMWARE(MT7925_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-328-\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:329:static struct usb_driver mt7925u_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-330-\t.name\t\t= KBUILD_MODNAME,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-341-};\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:342:module_usb_driver(mt7925u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-343-\n"
}

							input: 25301
							output: 50
							thoughts: 348

**My Analysis of the MT7663U Driver and DBDC Support**

Okay, so I'm digging into the MT7663U USB driver. From what I'm seeing, it leverages `mt7615-common`, which makes perfect sense. The core of this seems to be the `mt7663_usb_sdio_register_device` function, triggered when a USB device matches "mt7663u." This in turn calls `mt7615_init_debugfs`.

Inside `mt7615_init_debugfs`, there's a debugfs entry being created: a file named "dbdc" with permissions 0600. That's immediately interesting. This "dbdc" file uses `fops_dbdc`, which handles file operations related to DBDC. Looking closer at `fops_dbdc`, I see `mt7615_dbdc_set`. That function takes a u64 value and, after a check with `mt7615_wait_for_mcu_init`, it either calls `mt7615_register_ext_phy` or `mt7615_unregister_ext_phy` based on the value.

So, if the value provided to `mt7615_dbdc_set` is non-zero, it activates the extended PHY through `mt7615_register_ext_phy(dev)`. Clearly, we're on the right track! The presence of this debugfs entry and its associated functions strongly suggests this is how DBDC is enabled or disabled.

Now, I want to confirm how DBDC is used in the wider context of the mt7615 and mt7663 family. The next logical step is to dive into `drivers/net/wireless/mediatek/mt76/mt7615/init.c` and specifically examine the surrounding code of the `mt7615_register_ext_phy` call. That should give me a much clearer picture of how DBDC is initialized, managed, and potentially used in a dual-band dual-concurrent configuration.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7615/init.c",
  "FirstLine": 525,
  "LineCount": 85
}

{
  "Contents": " 525:\t}\n 526:\tEXPORT_SYMBOL_GPL(mt7615_led_set_brightness);\n 527:\t\n 528:\tint mt7615_register_ext_phy(struct mt7615_dev *dev)\n 529:\t{\n 530:\t\tstruct mt7615_phy *phy = mt7615_ext_phy(dev);\n 531:\t\tstruct mt76_phy *mphy;\n 532:\t\tint i, ret;\n 533:\t\n 534:\t\tif (!is_mt7615(\u0026dev-\u003emt76))\n 535:\t\t\treturn -EOPNOTSUPP;\n 536:\t\n 537:\t\tif (test_bit(MT76_STATE_RUNNING, \u0026dev-\u003emphy.state))\n 538:\t\t\treturn -EINVAL;\n 539:\t\n 540:\t\tif (phy)\n 541:\t\t\treturn 0;\n 542:\t\n 543:\t\tmt7615_cap_dbdc_enable(dev);\n 544:\t\tmphy = mt76_alloc_phy(\u0026dev-\u003emt76, sizeof(*phy), \u0026mt7615_ops, MT_BAND1);\n 545:\t\tif (!mphy) {\n 546:\t\t\tret = -ENOMEM;\n 547:\t\t\tgoto error;\n 548:\t\t}\n 549:\t\n 550:\t\tphy = mphy-\u003epriv;\n 551:\t\tphy-\u003edev = dev;\n 552:\t\tphy-\u003emt76 = mphy;\n 553:\t\tmphy-\u003echainmask = dev-\u003echainmask \u0026 ~dev-\u003emphy.chainmask;\n 554:\t\tmphy-\u003eantenna_mask = BIT(hweight8(mphy-\u003echainmask)) - 1;\n 555:\t\tmt7615_init_wiphy(mphy-\u003ehw);\n 556:\t\n 557:\t\tINIT_DELAYED_WORK(\u0026mphy-\u003emac_work, mt7615_mac_work);\n 558:\t\tINIT_DELAYED_WORK(\u0026phy-\u003escan_work, mt7615_scan_work);\n 559:\t\tskb_queue_head_init(\u0026phy-\u003escan_event_list);\n 560:\t\n 561:\t\tINIT_WORK(\u0026phy-\u003eroc_work, mt7615_roc_work);\n 562:\t\ttimer_setup(\u0026phy-\u003eroc_timer, mt7615_roc_timer, 0);\n 563:\t\tinit_waitqueue_head(\u0026phy-\u003eroc_wait);\n 564:\t\n 565:\t\tmt7615_mac_set_scs(phy, true);\n 566:\t\n 567:\t\t/*\n 568:\t\t * Make the secondary PHY MAC address local without overlapping with\n 569:\t\t * the usual MAC address allocation scheme on multiple virtual interfaces\n 570:\t\t */\n 571:\t\tmemcpy(mphy-\u003emacaddr, dev-\u003emt76.eeprom.data + MT_EE_MAC_ADDR,\n 572:\t\t       ETH_ALEN);\n 573:\t\tmphy-\u003emacaddr[0] |= 2;\n 574:\t\tmphy-\u003emacaddr[0] ^= BIT(7);\n 575:\t\n 576:\t\tret = mt76_eeprom_override(mphy);\n 577:\t\tif (ret)\n 578:\t\t\tgoto error_free_hw;\n 579:\t\n 580:\t\t/* second phy can only handle 5 GHz */\n 581:\t\tmphy-\u003ecap.has_5ghz = true;\n 582:\t\n 583:\t\t/* mt7615 second phy shares the same hw queues with the primary one */\n 584:\t\tfor (i = 0; i \u003c= MT_TXQ_PSD ; i++)\n 585:\t\t\tmphy-\u003eq_tx[i] = dev-\u003emphy.q_tx[i];\n 586:\t\n 587:\t\t/* init led callbacks */\n 588:\t\tif (IS_ENABLED(CONFIG_MT76_LEDS)) {\n 589:\t\t\tmphy-\u003eleds.cdev.brightness_set = mt7615_led_set_brightness;\n 590:\t\t\tmphy-\u003eleds.cdev.blink_set = mt7615_led_set_blink;\n 591:\t\t}\n 592:\t\n 593:\t\tret = mt76_register_phy(mphy, true, mt76_rates,\n 594:\t\t\t\t\tARRAY_SIZE(mt76_rates));\n 595:\t\tif (ret)\n 596:\t\t\tgoto error_free_hw;\n 597:\t\n 598:\t\treturn 0;\n 599:\t\n 600:\terror_free_hw:\n 601:\t\tieee80211_free_hw(mphy-\u003ehw);\n 602:\terror:\n 603:\t\tmt7615_cap_dbdc_disable(dev);\n 604:\t\n 605:\t\treturn ret;\n 606:\t}\n 607:\tEXPORT_SYMBOL_GPL(mt7615_register_ext_phy);\n 608:\t\n 609:\tvoid mt7615_unregister_ext_phy(struct mt7615_dev *dev)\n"
}

							input: 27596
							output: 39
							thoughts: 73

**Analyzing the Code - A Quick Check**

Okay, hold on a second! My eyes just snagged on line 534 in that C code. Let me parse that... Ah, there's a crucial check right there: `if (!is_mt7615(&dev->mt76))`. My expert brain immediately spots the potential issue: This function appears to be an error path, and it will only get there if a certain chip isn't a certain type. "Wait, what's `is_mt7615` actually checking for?" I need to refresh my memory on what hardware components this function is designed to handle. This demands a closer look at the implementation of the `is_mt7615` function to fully understand its behavior and intended scope. I better track down the definition of that function right now. Let's see...

{
  "Expression": "is_mt7615",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=548=int mt7615_init_debugfs(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-555-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:556:\tif (is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-557-\t\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"xmit-queues\", dir,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-575-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:576:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-577-\t\tdebugfs_create_u32(\"dfs_hw_pattern\", 0400, dir,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=45=mt7615_init_tx_queues(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-53-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:54:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-55-\t\treturn mt7622_init_tx_queues_multi(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c=220=int mt7615_dma_init(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-244-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:245:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-246-\t\tmt76_set(dev, MT_WPDMA_GLO_CFG,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-270-\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c:271:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/dma.c-272-\t    rx_ring_size /= 2;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c=360=mt7615_init_wiphy(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-408-\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:409:\tif (is_mt7615(\u0026phy-\u003edev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-410-\t\thw-\u003emax_tx_fragments = MT_TXP_MAX_BUF_NUM;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c=528=int mt7615_register_ext_phy(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-533-\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c:534:\tif (!is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/init.c-535-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c=1552=static void mt7615_mac_tx_free(struct mt7615_dev *dev, void *data, int len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1559-\tmt76_queue_tx_cleanup(dev, dev-\u003emphy.q_tx[MT_TXQ_PSD], false);\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c:1560:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1561-\t\tmt76_queue_tx_cleanup(dev, dev-\u003emphy.q_tx[MT_TXQ_BE], false);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1567-\tcount = le16_get_bits(free-\u003ectrl, MT_TX_FREE_MSDU_ID_CNT);\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c:1568:\tif (is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mac.c-1569-\t\t__le16 *token = tx_token;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c=284=int mt7615_set_channel(struct mt76_phy *mphy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-292-\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c:293:\tif (is_mt7615(\u0026dev-\u003emt76) \u0026\u0026 dev-\u003eflash_eeprom) {\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-294-\t\tret = mt7615_mcu_apply_rx_dcoc(phy);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=1332=static int mt7615_load_n9(struct mt7615_dev *dev, const char *name)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1369-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:1370:\tif (!is_mt7615(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1371-\t\tdev-\u003efw_ver = MT7615_FIRMWARE_V2;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c=60=int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c-103-\tmemset(txp, 0, sizeof(struct mt76_connac_txp_common));\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c:104:\tif (is_mt7615(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c-105-\t\tmt7615_write_fw_txp(dev, tx_info, txp, id);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=251=static inline bool is_mt7622(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-258-\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:259:static inline bool is_mt7615(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-260-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=269=static inline bool is_connac_v1(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-270-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:271:\treturn is_mt7615(dev) || is_mt7663(dev) || is_mt7622(dev);\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-272-}\n"
}

							input: 30337
							output: 49
							thoughts: 40

Okay, let's dive into this. Here's how I'd approach that query, as if it were my thought process:

**Diving into the MT7615 Driver**

Alright, so someone's asked about the `is_mt7615(dev)` function. Given my expertise in this area, my first thought is to go straight to the source. Specifically, I need to understand what this function actually *does*. I know from experience that the `drivers/net/wireless/mediatek/mt76` directory is the canonical location for Mediatek WiFi drivers within the kernel tree, and the `mt76_connac.h` header file is a likely candidate for interface-related definitions. So, let's open up that header file and see what `is_mt7615(dev)` is defined as. I need to understand how it identifies an MT7615 device; likely checking some sort of hardware ID or board information against a known value. I expect the definition to be relatively straightforward: either a direct check for a specific ID, or perhaps a more complex macro that incorporates family checks and versioning. Let's get to the code and see.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt76_connac.h",
  "FirstLine": 250,
  "LineCount": 25
}

{
  "Contents": " 250:\t\n 251:\tstatic inline bool is_mt7622(struct mt76_dev *dev)\n 252:\t{\n 253:\t\tif (!IS_ENABLED(CONFIG_MT7622_WMAC))\n 254:\t\t\treturn false;\n 255:\t\n 256:\t\treturn mt76_chip(dev) == 0x7622;\n 257:\t}\n 258:\t\n 259:\tstatic inline bool is_mt7615(struct mt76_dev *dev)\n 260:\t{\n 261:\t\treturn mt76_chip(dev) == 0x7615 || mt76_chip(dev) == 0x7611;\n 262:\t}\n 263:\t\n 264:\tstatic inline bool is_mt7611(struct mt76_dev *dev)\n 265:\t{\n 266:\t\treturn mt76_chip(dev) == 0x7611;\n 267:\t}\n 268:\t\n 269:\tstatic inline bool is_connac_v1(struct mt76_dev *dev)\n 270:\t{\n 271:\t\treturn is_mt7615(dev) || is_mt7663(dev) || is_mt7622(dev);\n 272:\t}\n 273:\t\n 274:\tstatic inline bool is_mt76_fw_txp(struct mt76_dev *dev)\n"
}

							input: 31105
							output: 45
							thoughts: 50

Okay, here's my interpretation of those thoughts, summarized from my perspective as an expert in my field:

**Chip ID Investigation**

Alright, time to get down to brass tacks. I'm going to start by getting a handle on which devices are currently utilizing either the 0x7615 or 0x7611 chip IDs. It's the most logical first step to understand the current hardware inventory. From there, I need to trace back where these specific chips are being probed within the system. That'll give me the context I need to figure out how these chip IDs are being utilized in practice. Understanding the probe points will likely point the way to the right drivers, configurations, or hardware specifications associated with each of those chips. From there I can determine how I can make changes without breaking anything.

{
  "Expression": "0x7615|0x7611",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=87=static int mt7615_check_eeprom(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-91-\tswitch (val) {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:92:\tcase 0x7615:\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-93-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=315=static void mt7615_cal_free_data(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-325-\t\tbreak;\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:326:\tcase 0x7615:\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:327:\tcase 0x7611:\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-328-\t\tmt7615_apply_cal_free_data(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c=15=static const struct pci_device_id mt7615_pci_device_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c:16:\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7615) },\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c-17-\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7663) },\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c:18:\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7611) },\ndrivers/net/wireless/mediatek/mt76/mt7615/pci.c-19-\t{ },\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=259=static inline bool is_mt7615(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-260-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:261:\treturn mt76_chip(dev) == 0x7615 || mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-262-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=264=static inline bool is_mt7611(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-265-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:266:\treturn mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-267-}\n"
}

							input: 32320
							output: 49
							thoughts: 89

**Investigating the MT7615 PCI Device Table and Related USB Driver**

Okay, so I'm diving into this `mt7615_pci_device_table` right now. Interesting... it seems to be listing PCI devices, specifically those with the 0x7615 and 0x7611 device IDs. My first thought is to note those IDs; seems like a logical starting point when I'm dealing with MT7615, or even variants. But, hold on a second... what about the `mt7663u` driver? Where does that chip fit into this picture? I need to understand its relationship to the other devices, and which device I am looking for. I should check `drivers/net/wireless/mediatek/mt76/mt7615/usb.c` to see if there are any relationships, or commonalities to be found. Let's see if there's any immediate correlation there... that's where I need to look for now.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7615/usb.c",
  "FirstLine": 1,
  "LineCount": 100
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\t/* Copyright (C) 2019 MediaTek Inc.\n   3:\t *\n   4:\t * Author: Felix Fietkau \u003cnbd@nbd.name\u003e\n   5:\t *\t   Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\n   6:\t *\t   Sean Wang \u003csean.wang@mediatek.com\u003e\n   7:\t */\n   8:\t\n   9:\t#include \u003clinux/kernel.h\u003e\n  10:\t#include \u003clinux/module.h\u003e\n  11:\t#include \u003clinux/usb.h\u003e\n  12:\t\n  13:\t#include \"mt7615.h\"\n  14:\t#include \"mac.h\"\n  15:\t#include \"mcu.h\"\n  16:\t#include \"regs.h\"\n  17:\t\n  18:\tstatic const struct usb_device_id mt7615_device_table[] = {\n  19:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7663, 0xff, 0xff, 0xff) },\n  20:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x043e, 0x310c, 0xff, 0xff, 0xff) },\n  21:\t\t{ },\n  22:\t};\n  23:\t\n  24:\tstatic u32 mt7663u_rr(struct mt76_dev *dev, u32 addr)\n  25:\t{\n  26:\t\tu32 ret;\n  27:\t\n  28:\t\tmutex_lock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n  29:\t\tret = ___mt76u_rr(dev, MT_VEND_READ_EXT,\n  30:\t\t\t\t  USB_DIR_IN | USB_TYPE_VENDOR, addr);\n  31:\t\tmutex_unlock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n  32:\t\n  33:\t\treturn ret;\n  34:\t}\n  35:\t\n  36:\tstatic void mt7663u_wr(struct mt76_dev *dev, u32 addr, u32 val)\n  37:\t{\n  38:\t\tmutex_lock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n  39:\t\t___mt76u_wr(dev, MT_VEND_WRITE_EXT,\n  40:\t\t\t    USB_DIR_OUT | USB_TYPE_VENDOR, addr, val);\n  41:\t\tmutex_unlock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n  42:\t}\n  43:\t\n  44:\tstatic u32 mt7663u_rmw(struct mt76_dev *dev, u32 addr,\n  45:\t\t\t       u32 mask, u32 val)\n  46:\t{\n  47:\t\tmutex_lock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n  48:\t\tval |= ___mt76u_rr(dev, MT_VEND_READ_EXT,\n  49:\t\t\t\t   USB_DIR_IN | USB_TYPE_VENDOR, addr) \u0026 ~mask;\n  50:\t\t___mt76u_wr(dev, MT_VEND_WRITE_EXT,\n  51:\t\t\t    USB_DIR_OUT | USB_TYPE_VENDOR, addr, val);\n  52:\t\tmutex_unlock(\u0026dev-\u003eusb.usb_ctrl_mtx);\n  53:\t\n  54:\t\treturn val;\n  55:\t}\n  56:\t\n  57:\tstatic void mt7663u_copy(struct mt76_dev *dev, u32 offset,\n  58:\t\t\t\t const void *data, int len)\n  59:\t{\n  60:\t\tstruct mt76_usb *usb = \u0026dev-\u003eusb;\n  61:\t\tint ret, i = 0, batch_len;\n  62:\t\tconst u8 *val = data;\n  63:\t\n  64:\t\tlen = round_up(len, 4);\n  65:\t\n  66:\t\tmutex_lock(\u0026usb-\u003eusb_ctrl_mtx);\n  67:\t\twhile (i \u003c len) {\n  68:\t\t\tbatch_len = min_t(int, usb-\u003edata_len, len - i);\n  69:\t\t\tmemcpy(usb-\u003edata, val + i, batch_len);\n  70:\t\t\tret = __mt76u_vendor_request(dev, MT_VEND_WRITE_EXT,\n  71:\t\t\t\t\t\t     USB_DIR_OUT | USB_TYPE_VENDOR,\n  72:\t\t\t\t\t\t     (offset + i) \u003e\u003e 16, offset + i,\n  73:\t\t\t\t\t\t     usb-\u003edata, batch_len);\n  74:\t\t\tif (ret \u003c 0)\n  75:\t\t\t\tbreak;\n  76:\t\n  77:\t\t\ti += batch_len;\n  78:\t\t}\n  79:\t\tmutex_unlock(\u0026usb-\u003eusb_ctrl_mtx);\n  80:\t}\n  81:\t\n  82:\tstatic void mt7663u_stop(struct ieee80211_hw *hw, bool suspend)\n  83:\t{\n  84:\t\tstruct mt7615_phy *phy = mt7615_hw_phy(hw);\n  85:\t\tstruct mt7615_dev *dev = hw-\u003epriv;\n  86:\t\n  87:\t\tclear_bit(MT76_STATE_RUNNING, \u0026dev-\u003emphy.state);\n  88:\t\ttimer_delete_sync(\u0026phy-\u003eroc_timer);\n  89:\t\tcancel_work_sync(\u0026phy-\u003eroc_work);\n  90:\t\tcancel_delayed_work_sync(\u0026phy-\u003escan_work);\n  91:\t\tcancel_delayed_work_sync(\u0026phy-\u003emt76-\u003emac_work);\n  92:\t\tmt76u_stop_tx(\u0026dev-\u003emt76);\n  93:\t}\n  94:\t\n  95:\tstatic void mt7663u_cleanup(struct mt7615_dev *dev)\n  96:\t{\n  97:\t\tclear_bit(MT76_STATE_INITIALIZED, \u0026dev-\u003emphy.state);\n  98:\t\tmt76u_queues_deinit(\u0026dev-\u003emt76);\n  99:\t}\n 100:\t\n"
}

							input: 34318
							output: 50
							thoughts: 33

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Diving Deeper into the MT7615 USB Driver**

Alright, so we've been focusing on that specific area of the MT7615 USB driver, but it's time to broaden the scope. I need to get a more comprehensive view of how this all functions. I should definitely examine the whole of `drivers/net/wireless/mediatek/mt76/mt7615/usb.c`. I need to understand the relationship between the pieces, where the control flow originates, and how it all hangs together. There could be critical clues within the seemingly "unimportant" sections, details that affect the module behavior. This deeper dive will expose how this particular module is integrated into the rest of the larger MT76 framework, and the implications of certain design choices. That broader context will be crucial for the problem I'm working on. Let's see what we can find.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7615/usb.c",
  "FirstLine": 180,
  "LineCount": 90
}

{
  "Contents": " 180:\t\tif (ret)\n 181:\t\t\tgoto error;\n 182:\t\n 183:\t\tret = mt76u_alloc_queues(\u0026dev-\u003emt76);\n 184:\t\tif (ret)\n 185:\t\t\tgoto error;\n 186:\t\n 187:\t\tret = mt7663_usb_sdio_register_device(dev);\n 188:\t\tif (ret)\n 189:\t\t\tgoto error;\n 190:\t\n 191:\t\treturn 0;\n 192:\t\n 193:\terror:\n 194:\t\tmt76u_queues_deinit(\u0026dev-\u003emt76);\n 195:\t\tusb_set_intfdata(usb_intf, NULL);\n 196:\t\tusb_put_dev(interface_to_usbdev(usb_intf));\n 197:\t\n 198:\t\tmt76_free_device(\u0026dev-\u003emt76);\n 199:\t\n 200:\t\treturn ret;\n 201:\t}\n 202:\t\n 203:\tstatic void mt7663u_disconnect(struct usb_interface *usb_intf)\n 204:\t{\n 205:\t\tstruct mt7615_dev *dev = usb_get_intfdata(usb_intf);\n 206:\t\n 207:\t\tif (!test_bit(MT76_STATE_INITIALIZED, \u0026dev-\u003emphy.state))\n 208:\t\t\treturn;\n 209:\t\n 210:\t\tieee80211_unregister_hw(dev-\u003emt76.hw);\n 211:\t\tmt7663u_cleanup(dev);\n 212:\t\n 213:\t\tusb_set_intfdata(usb_intf, NULL);\n 214:\t\tusb_put_dev(interface_to_usbdev(usb_intf));\n 215:\t\n 216:\t\tmt76_free_device(\u0026dev-\u003emt76);\n 217:\t}\n 218:\t\n 219:\t#ifdef CONFIG_PM\n 220:\tstatic int mt7663u_suspend(struct usb_interface *intf, pm_message_t state)\n 221:\t{\n 222:\t\tstruct mt7615_dev *dev = usb_get_intfdata(intf);\n 223:\t\n 224:\t\tif (!test_bit(MT76_STATE_SUSPEND, \u0026dev-\u003emphy.state) \u0026\u0026\n 225:\t\t    mt7615_firmware_offload(dev)) {\n 226:\t\t\tint err;\n 227:\t\n 228:\t\t\terr = mt76_connac_mcu_set_hif_suspend(\u0026dev-\u003emt76, true, true);\n 229:\t\t\tif (err \u003c 0)\n 230:\t\t\t\treturn err;\n 231:\t\t}\n 232:\t\n 233:\t\tmt76u_stop_rx(\u0026dev-\u003emt76);\n 234:\t\tmt76u_stop_tx(\u0026dev-\u003emt76);\n 235:\t\n 236:\t\treturn 0;\n 237:\t}\n 238:\t\n 239:\tstatic int mt7663u_resume(struct usb_interface *intf)\n 240:\t{\n 241:\t\tstruct mt7615_dev *dev = usb_get_intfdata(intf);\n 242:\t\tint err;\n 243:\t\n 244:\t\terr = mt76u_vendor_request(\u0026dev-\u003emt76, MT_VEND_FEATURE_SET,\n 245:\t\t\t\t\t   USB_DIR_OUT | USB_TYPE_VENDOR,\n 246:\t\t\t\t\t   0x5, 0x0, NULL, 0);\n 247:\t\tif (err)\n 248:\t\t\treturn err;\n 249:\t\n 250:\t\terr = mt76u_resume_rx(\u0026dev-\u003emt76);\n 251:\t\tif (err \u003c 0)\n 252:\t\t\treturn err;\n 253:\t\n 254:\t\tif (!test_bit(MT76_STATE_SUSPEND, \u0026dev-\u003emphy.state) \u0026\u0026\n 255:\t\t    mt7615_firmware_offload(dev))\n 256:\t\t\terr = mt76_connac_mcu_set_hif_suspend(\u0026dev-\u003emt76, false, true);\n 257:\t\n 258:\t\treturn err;\n 259:\t}\n 260:\t#endif /* CONFIG_PM */\n 261:\t\n 262:\tMODULE_DEVICE_TABLE(usb, mt7615_device_table);\n 263:\tMODULE_FIRMWARE(MT7663_OFFLOAD_FIRMWARE_N9);\n 264:\tMODULE_FIRMWARE(MT7663_OFFLOAD_ROM_PATCH);\n 265:\tMODULE_FIRMWARE(MT7663_FIRMWARE_N9);\n 266:\tMODULE_FIRMWARE(MT7663_ROM_PATCH);\n 267:\t\n 268:\tstatic struct usb_driver mt7663u_driver = {\n 269:\t\t.name\t\t= KBUILD_MODNAME,\n"
}

							input: 36045
							output: 38
							thoughts: 613

**Analyzing the MT7663U and mt7615 Driver Interaction**

Okay, let's break this down. For the MT7663U, the chip ID is 0x7663. I was looking at how the `mt7615_register_ext_phy` function handles this, and I see a problem right away. The function includes this check:

```c
	if (!is_mt7615(&dev->mt76))
		return -EOPNOTSUPP;
```

`is_mt7615` checks for `mt76_chip(dev) == 0x7615 || mt76_chip(dev) == 0x7611`. But wait, the MT7663 has a chip ID of 0x7663. So, for the MT7663U (the USB version), `mt7615_register_ext_phy` is immediately returning `-EOPNOTSUPP`! This happens *before* any of the logic I'm interested in!

Now, I need to understand why this is happening. I need to verify that `mt7615` (0x7615 / 0x7611) even *exists* as a USB device, or if it's strictly PCIe. Let's see... I'll search the `mt7615` driver for device information.

Okay, let's dig into the `drivers/net/wireless/mediatek/mt76/mt7615/` directory.

*   `pci.c`: Ah, there's a `mt7615_pci_device_table` that includes devices with the vendor ID and 0x7615, 0x7663, and 0x7611 chip IDs. This clearly defines PCIe devices.
*   `usb.c`: Excellent. The `mt7615_device_table` includes USB devices: the USB device `0x0e8d, 0x7663` *and* `0x043e, 0x310c` which is also an MT7663U!
*   `sdio.c`: Found a device here for `mt7663s` (SDIO).
*   `soc.c`: Contains code for `MT7622_WMAC` (built-in WMAC on MT7622 SoC, ARM / ARCH_MEDIATEK).

Alright, I see a clear delineation. The MT7615/MT7611 drivers are not *only* for PCIe devices, since USB and SDIO are covered. The `usb.c` file confirms that there is support for these chips over USB. So, the issue isn't that `mt7615` is *only* PCIe. Now I need to figure out why the driver is rejecting the MT7663U based on that check. I'll need to look more closely at how the driver identifies these specific devices and where this code might be used.

{
  "Expression": "sdio_device_id",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7615/sdio.c-21-\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:22:static const struct sdio_device_id mt7663s_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-23-\t{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7603) },\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c=76=static int mt7663s_probe(struct sdio_func *func,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:77:\t\t\t const struct sdio_device_id *id)\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-78-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c-18-\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c:19:static const struct sdio_device_id mt7921s_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c-20-\t{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901),\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c=90=static int mt7921s_probe(struct sdio_func *func,\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c:91:\t\t\t const struct sdio_device_id *id)\ndrivers/net/wireless/mediatek/mt76/mt7921/sdio.c-92-{\n"
}

							input: 37898
							output: 41
							thoughts: 842

**Analyzing the Potential for Fuzzing `mt7615_register_ext_phy`**

Okay, let's break this down systematically. The question is whether we should consider fuzzing the code within `mt7615_register_ext_phy`. The first hurdle is that this function, on the face of it, seems tightly coupled to physical hardware. Specifically, the function logic is used only when an external PHY is registered. `is_mt7615` checks for Mediatek chip IDs 0x7615 or 0x7611. I know from experience that these are found in the `mt7615_pci_device_table`, which strongly suggests PCIe devices.

The key negative criterion in the prompt is about "structurally unreachable hardware," specifically vendor-specific PCIe cards not emulated in standard QEMU. That's a red flag! Standard QEMU, as far as I know, doesn't emulate the MediaTek MT7615/MT7611 PCIe hardware. This would automatically exclude it from being fuzzable.

But we have to be absolutely certain. Let's trace the callers of `mt7615_register_ext_phy`. We've got two callers:

1.  `mt7615_register_device` (via `mt7615_pci_probe`): This is called during the PCIe probe. So, a Mediatek MT7615 PCIe card probe. That's a physical card probe.
2.  `mt7615_dbdc_set`:  This is called via a debugfs entry. However, to *create* the debugfs entry, you'd have to initialize a `mt7615` device (either via `mt7615_register_device`, or by a USB or SDIO device registering). This is potentially interesting. If it was created by `mt7663u` (USB), and someone writes to `dbdc`, `mt7615_register_ext_phy` will execute. However, because MT7663 has chip ID 0x7663 (`!is_mt7615`), `mt7615_register_ext_phy` immediately returns `-EOPNOTSUPP`. The modified code is never reached in this scenario! Also, for the MT7615 PCIe device (which IS `is_mt7615`), the device cannot be probed in standard virtualized environments (QEMU / GCE) because MT7615 is physical MediaTek PCIe hardware.

So, in the first calling path, you need physical hardware. In the second calling path, if it executes with a USB or SDIO device, you have an early return from `mt7615_register_ext_phy` that skips the modified code.

The final question: is there any virtual or mock interface for `mt76`? Maybe some `mac80211_hwsim` or similar? Let me do a quick search... No, nothing immediately apparent. That would be the only chance of running this in a VM.

Based on the evidence, the modified code in `mt7615_register_ext_phy` is only reachable on physical hardware. It seems we should return `WorthFuzzing=false`.

{
  "Expression": "mt76_",
  "PathPrefix": "drivers/net/wireless/mac80211_hwsim.c"
}

{
  "error": "no matches"
}

							input: 39524
							output: 38
							thoughts: 95

Okay, here's my breakdown of this.

**Investigating the `mt76_chip` Context**

Right, so I'm trying to figure out if there's any connection between this `mac80211_hwsim` driver and the `mt76` framework. The initial thought is that they are completely separate; `mac80211_hwsim` is explicitly a software simulation of the hardware and has no inherent link to MediaTek's `mt76` drivers. It's designed to be independent.

However, I need to be *absolutely* sure. The question is: could there be some unforeseen interaction, perhaps a subtle dependency, or even a misconfiguration that could lead to something being incorrectly set? Specifically, I'm thinking about the boolean `is_mt7615`. Can that ever be true in the context of a USB device, or a virtual device like `mac80211_hwsim`? Seems unlikely on the face of it, but better to confirm.

Therefore, my next step is to drill into the `drivers/net/wireless/mediatek/mt76/` directory. That's the logical place to check where the `mt76_chip` data structure is being initialized and set. I'm going to look for any logic that might potentially misidentify a device, or any code paths that could lead to unexpected behavior in a virtualized or USB-connected scenario. I'm looking for clues in the initial setup of this chip identification.

{
  "Expression": "-\u003echip.dev_id",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "error": "no matches"
}

							input: 39998
							output: 37
							thoughts: 30

Here's my thought process, as if I were analyzing that code:

**Finding the Origin of mt76_chip and Related Variables**

Okay, so I need to track down the definition of `mt76_chip`, and understand where `dev->chip` and `chip_id` are being assigned their values. This usually means starting with a grep search across the relevant source code. I need to figure out the context. Is this a specific driver? Is `mt76_chip` a structure, a macro, or something else? I'll probably start with a broader search for `mt76_chip` and its uses. Then, I need to understand the relationship between `dev->chip` (which is likely a member of a device structure) and `chip_id`. Is `chip_id` some kind of identifier? Is `dev->chip` a pointer to something else? Understanding this will be key to understanding the device initialization and configuration flow. I'll need to follow the code paths where these are used and/or set, looking for initialization routines, probe functions, and any other places where hardware identification or setup is likely occurring. Understanding how these variables relate and where they are set is essential to understanding the design and operation of this driver. Let's dig in.

{
  "Expression": "mt76_chip",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76.h=1227=bool mt76_pci_aspm_supported(struct pci_dev *pdev);\ndrivers/net/wireless/mediatek/mt76/mt76.h-1228-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1229:static inline u16 mt76_chip(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76.h-1230-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1261=static inline int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1267-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1268:#define mt76xx_chip(dev) mt76_chip(\u0026((dev)-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt76.h-1269-#define mt76xx_rev(dev) mt76_rev(\u0026((dev)-\u003emt76))\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c=315=static void mt7615_cal_free_data(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-321-\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c:322:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/eeprom.c-323-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=1696=int mt7615_mcu_init(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1710-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:1711:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1712-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=1747=int mt7615_mcu_set_eeprom(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1759-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:1760:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1761-\tcase 0x7622:\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=175=static inline bool is_mt7925(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-176-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:177:\treturn mt76_chip(dev) == 0x7925;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-178-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=180=static inline bool is_mt7920(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-181-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:182:\treturn mt76_chip(dev) == 0x7920;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-183-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=185=static inline bool is_mt7902(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-186-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:187:\treturn mt76_chip(dev) == 0x7902;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-188-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=190=static inline bool is_mt7922(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-191-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:192:\treturn mt76_chip(dev) == 0x7922;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-193-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=195=static inline bool is_connac2(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-196-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:197:\treturn mt76_chip(dev) == 0x7961 || is_mt7922(dev) || is_mt7920(dev) ||\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-198-\t\t\t\tis_mt7902(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=201=static inline bool is_mt7663(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-202-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:203:\treturn mt76_chip(dev) == 0x7663;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-204-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=206=static inline bool is_mt7915(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-207-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:208:\treturn mt76_chip(dev) == 0x7915;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-209-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=211=static inline bool is_mt7916(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-212-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:213:\treturn mt76_chip(dev) == 0x7906;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-214-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=216=static inline bool is_mt7981(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-217-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:218:\treturn mt76_chip(dev) == 0x7981;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-219-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=221=static inline bool is_mt7986(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-222-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:223:\treturn mt76_chip(dev) == 0x7986;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-224-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=231=static inline bool is_mt7996(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-232-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:233:\treturn mt76_chip(dev) == 0x7990;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-234-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=236=static inline bool is_mt7992(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-237-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:238:\treturn mt76_chip(dev) == 0x7992;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-239-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=241=static inline bool is_mt7990(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-242-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:243:\treturn mt76_chip(dev) == 0x7993;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-244-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=251=static inline bool is_mt7622(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-255-\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:256:\treturn mt76_chip(dev) == 0x7622;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-257-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=259=static inline bool is_mt7615(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-260-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:261:\treturn mt76_chip(dev) == 0x7615 || mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-262-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=264=static inline bool is_mt7611(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-265-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:266:\treturn mt76_chip(dev) == 0x7611;\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-267-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=274=static inline bool is_mt76_fw_txp(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-275-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:276:\tswitch (mt76_chip(dev)) {\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-277-\tcase 0x7961:\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h=31=static inline bool is_mt7610e(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-35-\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h:36:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7610;\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-37-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h=39=static inline bool is_mt7630(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-40-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h:41:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7630;\ndrivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h-42-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c=95=static int mt76x0e_init_hardware(struct mt76x02_dev *dev, bool resume)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c-119-\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c:120:\tif (mt76_chip(\u0026dev-\u003emt76) == 0x7610) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci.c-121-\t\tu16 val;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c=13=static int mt76x0e_load_firmware(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c-14-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c:15:\tbool is_combo_chip = mt76_chip(\u0026dev-\u003emt76) != 0x7610;\ndrivers/net/wireless/mediatek/mt76/mt76x0/pci_mcu.c-16-\tu32 val, ilm_len, dlm_len, offset = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02.h=227=static inline bool is_mt76x0(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-228-{\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:229:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7610 ||\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:230:\t       mt76_chip(\u0026dev-\u003emt76) == 0x7630 ||\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:231:\t       mt76_chip(\u0026dev-\u003emt76) == 0x7650;\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-232-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02.h=234=static inline bool is_mt76x2(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-235-{\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:236:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7612 ||\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:237:\t       mt76_chip(\u0026dev-\u003emt76) == 0x7632 ||\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:238:\t       mt76_chip(\u0026dev-\u003emt76) == 0x7662 ||\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:239:\t       mt76_chip(\u0026dev-\u003emt76) == 0x7602;\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-240-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c=824=void mt76x02_dfs_init_params(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c-839-\t\tmt76_wr(dev, MT_BBP(DFS, 1), 0xf);\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c:840:\t\tif (mt76_chip(\u0026dev-\u003emt76) == 0x7610 ||\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c:841:\t\t    mt76_chip(\u0026dev-\u003emt76) == 0x7630)\ndrivers/net/wireless/mediatek/mt76/mt76x02_dfs.c-842-\t\t\tmt76_wr(dev, MT_BBP(IBI, 11), 0xfde8081);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h=26=static inline bool is_mt7612(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-27-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:28:\treturn mt76_chip(\u0026dev-\u003emt76) == 0x7612;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-29-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c=89=mt7915_coredump_get_mem_layout(struct mt7915_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-90-{\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c:91:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-92-\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c=302=static struct mt7915_coredump *mt7915_coredump_build(struct mt7915_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-338-\tdump-\u003etv_nsec = crash_data-\u003etimestamp.tv_nsec;\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c:339:\tdump-\u003edevice_id = mt76_chip(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7915/coredump.c-340-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c=67=static char *mt7915_eeprom_name(struct mt7915_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-68-{\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c:69:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-70-\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c=363=mt7915_eeprom_has_background_radar(struct mt7915_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-368-\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c:369:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/eeprom.c-370-\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c=555=mt7915_init_led_mux(struct mt7915_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-560-\tif (dev-\u003edbdc_support) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c:561:\t\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-562-\t\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-583-\t} else if (dev-\u003emphy.leds.pin) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c:584:\t\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-585-\t\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-600-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c:601:\t\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7915/init.c-602-\t\tcase 0x7915:\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-11-\tchar *_fw;\t\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:12:\tswitch (mt76_chip(\u0026(_dev)-\u003emt76)) {\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-13-\tcase 0x7915:\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt792x.h=451=static inline char *mt792x_ram_name(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt792x.h-452-{\ndrivers/net/wireless/mediatek/mt76/mt792x.h:453:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt792x.h-454-\tcase 0x7902:\n--\ndrivers/net/wireless/mediatek/mt76/mt792x.h=467=static inline char *mt792x_patch_name(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt792x.h-468-{\ndrivers/net/wireless/mediatek/mt76/mt792x.h:469:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt792x.h-470-\tcase 0x7902:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=48=mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-49-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:50:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-51-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=162=static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-198-\tdump-\u003etv_nsec = crash_data-\u003etimestamp.tv_nsec;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:199:\tdump-\u003edevice_id = mt76_chip(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-200-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=46=static void mt7996_dma_config(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-67-\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:68:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-69-\tcase MT7992_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=27=static char *mt7996_eeprom_name(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-28-{\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:29:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-30-\tcase MT7992_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=389=bool mt7996_eeprom_has_background_radar(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-390-{\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:391:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-392-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=1182=static int mt7996_variant_type_init(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1186-\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:1187:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1188-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-14-\tchar *_fw;\t\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:15:\tswitch (mt76_chip(\u0026(_dev)-\u003emt76)) {\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-16-\tcase MT7992_DEVICE_ID:\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c=4108=mt7996_mcu_get_cal_free_data(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-4162-\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:4163:\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-4164-\tcase MT7996_DEVICE_ID:\n--\ndrivers/net/wireless/mediatek/mt76/usb.c=910=mt76u_ac_to_hwq(struct mt76_dev *dev, struct mt76_queue *q, u8 qid)\n--\ndrivers/net/wireless/mediatek/mt76/usb.c-913-\ndrivers/net/wireless/mediatek/mt76/usb.c:914:\tswitch (mt76_chip(dev)) {\ndrivers/net/wireless/mediatek/mt76/usb.c-915-\tcase 0x7663: {\n"
}

							input: 48573
							output: 196
							thoughts: 708

**Analysis of MT7615 Driver Patch Reachability**

Okay, so I've looked into this patch and determined its reachability for fuzzing. The key is that the modification affects the `mt7615_register_ext_phy` function, found in `drivers/net/wireless/mediatek/mt76/mt7615/init.c`.

Right off the bat, the function begins with a check using `is_mt7615(&dev->mt76)`. This is the crux of the issue. This function *only* returns true for the MediaTek MT7615 and MT7611 chipsets, specifically the *PCIe* variants.

Now, consider the environment we're working with. Syzkaller and standard virtualized setups like QEMU and GCE *don't* emulate the physical hardware required by these PCIe wireless NICs. These are real, tangible PCIe cards that need to be plugged into a physical system. There's no emulation for that level of detail.

Consequently, any USB or SDIO devices using MediaTek chips (like the MT7663U) will immediately get rejected. Their chip IDs will trigger the `!is_mt7615` condition and lead to a `-EOPNOTSUPP` return *before* hitting any of the modified code, including the error handling and DBDC cleanup paths. So, that modified section, the target of this patch, is structurally unreachable under those conditions.

Essentially, the patch targets hardware that is fundamentally unavailable in the target fuzzing environment. The patch requires that MediaTek MT7615/MT7611 PCIe hardware is instantiated, which is impossible in our current setup.

Therefore, because this code is structurally unreachable, I'm going to set `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The modified function mt7615_register_ext_phy in drivers/net/wireless/mediatek/mt76/mt7615/init.c explicitly checks `if (!is_mt7615(\u0026dev-\u003emt76)) return -EOPNOTSUPP;` before executing any modified logic. The is_mt7615 check only succeeds for MT7615 and MT7611 devices, which are physical PCIe wireless NICs not emulated in standard QEMU/GCE virtualized test environments. USB/SDIO variants (such as MT7663) bail out immediately at the is_mt7615 check and cannot execute the modified code. Therefore, the modified code is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)