| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/11 06:15 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies the AHB (platform) attachment code for the Qualcomm ath12k Wi-Fi driver, specifically adding support for loading shared firmware in a MultiPD architecture. This code relies on Qualcomm-specific SoC features, TrustZone (SCM) calls, remote processors, and specific Device Tree reserved memory regions (\"q6-region\"). These hardware-specific dependencies are not emulated in standard QEMU/GCE environments, making the modified code paths unreachable during fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/08/11 06:15 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 3c91f38de674a06deb87156bdbdd7addd62a0eba\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Aug 11 06:15:01 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath12k/ahb.c b/drivers/net/wireless/ath/ath12k/ahb.c\nindex 0fc55c9169e1a..3985f4e1c067d 100644\n--- a/drivers/net/wireless/ath/ath12k/ahb.c\n+++ b/drivers/net/wireless/ath/ath12k/ahb.c\n@@ -347,35 +347,60 @@ static void ath12k_ahb_stop(struct ath12k_base *ab)\n \tath12k_ce_cleanup_pipes(ab);\n }\n \n+static int ath12k_ahb_get_fw_load_region(struct ath12k_base *ab)\n+{\n+\tstruct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);\n+\tstruct ath12k_ahb_rproc_info *rproc_info = ab_ahb-\u003erproc_info;\n+\tstruct device *dev = ab-\u003edev;\n+\tstruct resource res;\n+\tint ret;\n+\n+\tif (rproc_info-\u003emem_region)\n+\t\treturn 0;\n+\n+\tret = of_reserved_mem_region_to_resource_byname(dev-\u003eof_node, \"q6-region\", \u0026res);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\trproc_info-\u003emem_phys = res.start;\n+\trproc_info-\u003emem_size = resource_size(\u0026res);\n+\trproc_info-\u003emem_region = memremap(rproc_info-\u003emem_phys, rproc_info-\u003emem_size,\n+\t\t\t\t\t MEMREMAP_WC);\n+\tif (!rproc_info-\u003emem_region) {\n+\t\tath12k_err(ab, \"unable to map memory region: %pa+%zx\\n\",\n+\t\t\t \u0026res.start, rproc_info-\u003emem_size);\n+\t\trproc_info-\u003emem_phys = 0;\n+\t\trproc_info-\u003emem_size = 0;\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static void ath12k_ahb_put_fw_load_region(struct ath12k_ahb_rproc_info *rproc_info)\n+{\n+\tmemunmap(rproc_info-\u003emem_region);\n+\trproc_info-\u003emem_region = NULL;\n+\trproc_info-\u003emem_phys = 0;\n+\trproc_info-\u003emem_size = 0;\n+}\n+\n static int ath12k_ahb_power_up(struct ath12k_base *ab)\n {\n \tstruct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);\n+\tstruct ath12k_ahb_rproc_info *rproc_info = ab_ahb-\u003erproc_info;\n \tchar fw_name[ATH12K_USERPD_FW_NAME_LEN];\n \tchar fw2_name[ATH12K_USERPD_FW_NAME_LEN];\n \tstruct device *dev = ab-\u003edev;\n \tconst struct firmware *fw, *fw2;\n \tunsigned long time_left;\n-\tphys_addr_t mem_phys;\n-\tstruct resource res;\n-\tvoid *mem_region;\n-\tsize_t mem_size;\n \tu32 pasid;\n \tint ret;\n \n-\tret = of_reserved_mem_region_to_resource_byname(dev-\u003eof_node, \"q6-region\",\n-\t\t\t\t\t\t\t\u0026res);\n+\tret = ath12k_ahb_get_fw_load_region(ab);\n \tif (ret)\n \t\treturn ret;\n \n-\tmem_phys = res.start;\n-\tmem_size = resource_size(\u0026res);\n-\tmem_region = devm_memremap(dev, mem_phys, mem_size, MEMREMAP_WC);\n-\tif (IS_ERR(mem_region)) {\n-\t\tath12k_err(ab, \"unable to map memory region: %pa+%zx\\n\",\n-\t\t\t \u0026res.start, mem_size);\n-\t\treturn PTR_ERR(mem_region);\n-\t}\n-\n \tsnprintf(fw_name, sizeof(fw_name), \"%s/%s/%s%d%s\", ATH12K_FW_DIR,\n \t\t ab-\u003ehw_params-\u003efw.dir, ATH12K_AHB_FW_PREFIX, ab_ahb-\u003euserpd_id,\n \t\t ATH12K_AHB_FW_SUFFIX);\n@@ -400,11 +425,13 @@ static int ath12k_ahb_power_up(struct ath12k_base *ab)\n \n \t/* Load FW image to a reserved memory location */\n \tif (ab_ahb-\u003escm_auth_enabled)\n-\t\tret = qcom_mdt_load(dev, fw, fw_name, pasid, mem_region,\n-\t\t\t\t mem_phys, mem_size, \u0026mem_phys);\n+\t\tret = qcom_mdt_load(dev, fw, fw_name, pasid, rproc_info-\u003emem_region,\n+\t\t\t\t rproc_info-\u003emem_phys, rproc_info-\u003emem_size,\n+\t\t\t\t NULL);\n \telse\n-\t\tret = qcom_mdt_load_no_init(dev, fw, fw_name, mem_region,\n-\t\t\t\t\t mem_phys, mem_size, \u0026mem_phys);\n+\t\tret = qcom_mdt_load_no_init(dev, fw, fw_name, rproc_info-\u003emem_region,\n+\t\t\t\t\t rproc_info-\u003emem_phys, rproc_info-\u003emem_size,\n+\t\t\t\t\t NULL);\n \tif (ret) {\n \t\tath12k_err(ab, \"Failed to load MDT segments: %d\\n\", ret);\n \t\tgoto err_fw;\n@@ -428,8 +455,9 @@ static int ath12k_ahb_power_up(struct ath12k_base *ab)\n \t\tgoto err_fw2;\n \t}\n \n-\tret = qcom_mdt_load_no_init(dev, fw2, fw2_name, mem_region, mem_phys,\n-\t\t\t\t mem_size, \u0026mem_phys);\n+\tret = qcom_mdt_load_no_init(dev, fw2, fw2_name, rproc_info-\u003emem_region,\n+\t\t\t\t rproc_info-\u003emem_phys, rproc_info-\u003emem_size,\n+\t\t\t\t NULL);\n \tif (ret) {\n \t\tath12k_err(ab, \"Failed to load MDT segments: %d\\n\", ret);\n \t\tgoto err_fw2;\n@@ -877,6 +905,7 @@ static struct ath12k_ahb_rproc_info *ath12k_ahb_rproc_info_alloc(struct ath12k_b\n \trproc_info-\u003erootpd_booted_by_driver = false;\n \trproc_info-\u003euserpd[ab_ahb-\u003euserpd_id - 1] = ab_ahb;\n \trproc_info-\u003enum_userpd = 1;\n+\trproc_info-\u003eshared_fw_loaded = false;\n \tinit_completion(\u0026rproc_info-\u003erootpd_ready);\n \tab_ahb-\u003erproc_info = rproc_info;\n \n@@ -961,6 +990,76 @@ static int ath12k_ahb_boot_root_pd(struct ath12k_base *ab)\n \treturn 0;\n }\n \n+static int ath12k_ahb_load_auth_shared_fw(struct ath12k_base *ab,\n+\t\t\t\t\t struct ath12k_ahb_rproc_info *rproc_info,\n+\t\t\t\t\t const char *fw_name, u32 pasid)\n+{\n+\tint ret;\n+\n+\tconst struct firmware *fw __free(firmware) = NULL;\n+\tret = request_firmware(\u0026fw, fw_name, ab-\u003edev);\n+\tif (ret) {\n+\t\tath12k_err(ab, \"failed to request shared firmware %s: %d\\n\",\n+\t\t\t fw_name, ret);\n+\t\treturn ret;\n+\t}\n+\n+\tif (!fw-\u003esize) {\n+\t\tath12k_err(ab, \"Invalid firmware size\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tath12k_dbg(ab, ATH12K_DBG_AHB, \"loading firmware %s, size %zd\\n\", fw_name,\n+\t\t fw-\u003esize);\n+\n+\tret = qcom_mdt_load(ab-\u003edev, fw, fw_name, pasid, rproc_info-\u003emem_region,\n+\t\t\t rproc_info-\u003emem_phys, rproc_info-\u003emem_size, NULL);\n+\tif (ret) {\n+\t\tath12k_err(ab, \"failed to load RO firmware %s: %d\\n\", fw_name, ret);\n+\t\treturn ret;\n+\t}\n+\n+\tret = qcom_pas_auth_and_reset(pasid);\n+\tif (ret)\n+\t\tath12k_err(ab, \"failed to authenticate and boot shared firmware: %d\\n\",\n+\t\t\t ret);\n+\treturn ret;\n+}\n+\n+static int ath12k_ahb_load_shared_firmware(struct ath12k_base *ab)\n+{\n+\tstruct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);\n+\tstruct ath12k_ahb_rproc_info *rproc_info = ab_ahb-\u003erproc_info;\n+\tchar fw_name[ATH12K_USERPD_FW_NAME_LEN];\n+\tu32 pasid;\n+\tint ret;\n+\n+\tlockdep_assert_held(\u0026ath12k_rproc_info_lock);\n+\n+\tif (!ab_ahb-\u003esupports_multipd)\n+\t\treturn 0;\n+\n+\tret = ath12k_ahb_get_fw_load_region(ab);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tsnprintf(fw_name, sizeof(fw_name), \"%s/%s/%s%d%s\", ATH12K_FW_DIR,\n+\t\t ab-\u003ehw_params-\u003efw.dir, ATH12K_AHB_FW_PREFIX, ATH12K_AHB_RO_ID,\n+\t\t ATH12K_AHB_FW_SUFFIX);\n+\n+\tpasid = u32_encode_bits(ATH12K_AHB_RO_ID, ATH12K_USERPD_ID_MASK) |\n+\t\tATH12K_AHB_UPD_SWID;\n+\n+\tret = ath12k_ahb_load_auth_shared_fw(ab, rproc_info, fw_name, pasid);\n+\tif (ret) {\n+\t\tath12k_ahb_put_fw_load_region(rproc_info);\n+\t\treturn ret;\n+\t}\n+\n+\trproc_info-\u003eshared_fw_loaded = true;\n+\treturn 0;\n+}\n+\n static int ath12k_ahb_configure_rproc(struct ath12k_base *ab)\n {\n \tint ret;\n@@ -989,6 +1088,15 @@ static int ath12k_ahb_configure_rproc(struct ath12k_base *ab)\n \t\tg_rproc_info-\u003erootpd_booted_by_driver = true;\n \t}\n \n+\tif (!g_rproc_info-\u003eshared_fw_loaded) {\n+\t\tret = ath12k_ahb_load_shared_firmware(ab);\n+\t\tif (ret) {\n+\t\t\tif (g_rproc_info-\u003erootpd_booted_by_driver)\n+\t\t\t\trproc_shutdown(g_rproc_info-\u003etgt_rproc);\n+\t\t\tgoto err_unreg_notifier;\n+\t\t}\n+\t}\n+\n \tmutex_unlock(\u0026ath12k_rproc_info_lock);\n \treturn 0;\n \n@@ -1012,6 +1120,8 @@ static void ath12k_ahb_deconfigure_rproc(struct ath12k_base *ab)\n {\n \tstruct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);\n \tstruct ath12k_ahb_rproc_info *rproc_info = ab_ahb-\u003erproc_info;\n+\tu32 pasid;\n+\tint ret;\n \n \tlockdep_assert_held(\u0026ath12k_rproc_info_lock);\n \n@@ -1023,6 +1133,20 @@ static void ath12k_ahb_deconfigure_rproc(struct ath12k_base *ab)\n \tif (!g_rproc_info-\u003enum_userpd) {\n \t\tath12k_ahb_unregister_rproc_notifier();\n \n+\t\tif (g_rproc_info-\u003eshared_fw_loaded) {\n+\t\t\tpasid = u32_encode_bits(ATH12K_AHB_RO_ID, ATH12K_USERPD_ID_MASK) |\n+\t\t\t\tATH12K_AHB_UPD_SWID;\n+\t\t\tret = qcom_pas_shutdown(pasid);\n+\t\t\tif (ret)\n+\t\t\t\tath12k_err(ab, \"pas shutdown failed for shared firmware: %d\\n\",\n+\t\t\t\t\t ret);\n+\n+\t\t\tg_rproc_info-\u003eshared_fw_loaded = false;\n+\t\t}\n+\n+\t\tif (g_rproc_info-\u003emem_region)\n+\t\t\tath12k_ahb_put_fw_load_region(g_rproc_info);\n+\n \t\tif (g_rproc_info-\u003erootpd_booted_by_driver \u0026\u0026\n \t\t g_rproc_info-\u003etgt_rproc-\u003estate == RPROC_RUNNING)\n \t\t\trproc_shutdown(g_rproc_info-\u003etgt_rproc);\ndiff --git a/drivers/net/wireless/ath/ath12k/ahb.h b/drivers/net/wireless/ath/ath12k/ahb.h\nindex cdb58b07338fd..46a4420d41bdc 100644\n--- a/drivers/net/wireless/ath/ath12k/ahb.h\n+++ b/drivers/net/wireless/ath/ath12k/ahb.h\n@@ -30,6 +30,9 @@\n #define ATH12K_USERPD_ID_MASK\t\t\tGENMASK(10, 8)\n #define ATH12K_USERPD_FW_NAME_LEN\t\t35\n \n+/* Shared read-only firmware ID, mandated by MultiPD firmware architecture */\n+#define ATH12K_AHB_RO_ID\t\t\t4\n+\n enum ath12k_ahb_userpd_id {\n \tATH12K_AHB_USERPD_ID_0 = 1,\n \tATH12K_AHB_USERPD_ID_1,\n@@ -46,6 +49,7 @@ struct ath12k_ahb_desc {\n \tenum ath12k_hw_rev hw_rev;\n \tbool auth_enabled;\n \tconst struct ath12k_hif_ops *ops;\n+\tbool supports_multipd;\n };\n \n enum ath12k_ahb_smp2p_msg_id {\n@@ -77,6 +81,10 @@ struct ath12k_ahb_rproc_info {\n \tu8 num_userpd;\n \tbool rootpd_booted_by_driver;\n \tstruct ath12k_ahb *userpd[ATH12K_MAX_DEVICES];\n+\tbool shared_fw_loaded;\n+\tphys_addr_t mem_phys;\n+\tsize_t mem_size;\n+\tvoid *mem_region;\n };\n \n struct ath12k_ahb {\n@@ -95,6 +103,7 @@ struct ath12k_ahb {\n \tconst struct ath12k_ahb_device_family_ops *device_family_ops;\n \tbool scm_auth_enabled;\n \tstruct ath12k_ahb_rproc_info *rproc_info;\n+\tbool supports_multipd;\n };\n \n struct ath12k_ahb_driver {\ndiff --git a/drivers/net/wireless/ath/ath12k/wifi7/ahb.c b/drivers/net/wireless/ath/ath12k/wifi7/ahb.c\nindex 98a6606ffd76a..a8f5cf8cc2a63 100644\n--- a/drivers/net/wireless/ath/ath12k/wifi7/ahb.c\n+++ b/drivers/net/wireless/ath/ath12k/wifi7/ahb.c\n@@ -35,11 +35,13 @@ static const struct ath12k_ahb_desc ath12k_wifi7_ahb_desc[] = {\n \t\t.hw_rev = ATH12K_HW_IPQ5332_HW10,\n \t\t.auth_enabled = true,\n \t\t.ops = \u0026ath12k_ahb_hif_ops,\n+\t\t.supports_multipd = true,\n \t},\n \t[ATH12K_HW_IPQ5424_HW10] = {\n \t\t.hw_rev = ATH12K_HW_IPQ5424_HW10,\n \t\t.auth_enabled = false,\n \t\t.ops = \u0026ath12k_ahb_hif_ops,\n+\t\t.supports_multipd = false,\n \t},\n };\n \n@@ -106,6 +108,7 @@ static int ath12k_wifi7_ahb_probe(struct platform_device *pdev)\n \tab-\u003ehw_rev = desc-\u003ehw_rev;\n \tab-\u003ehif.ops = desc-\u003eops;\n \tab_ahb-\u003escm_auth_enabled = desc-\u003eauth_enabled;\n+\tab_ahb-\u003esupports_multipd = desc-\u003esupports_multipd;\n \tab_ahb-\u003euserpd_id = ath12k_wifi7_ahb_get_userpd_id(ab);\n \tif (!ab_ahb-\u003euserpd_id)\n \t\treturn -EOPNOTSUPP;\n"
} |
| 2/1 | 2026/08/11 06:15 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the AHB (platform) attachment code for the Qualcomm ath12k Wi-Fi driver, specifically adding support for loading shared firmware in a MultiPD architecture. This code relies on Qualcomm-specific SoC features, TrustZone (SCM) calls, remote processors, and specific Device Tree reserved memory regions (\"q6-region\"). These hardware-specific dependencies are not emulated in standard QEMU/GCE environments, making the modified code paths unreachable during fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 3c91f38de674a06deb87156bdbdd7addd62a0eba
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Aug 11 06:15:01 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/ath/ath12k/ahb.c b/drivers/net/wireless/ath/ath12k/ahb.c
index 0fc55c9169e1a..3985f4e1c067d 100644
--- a/drivers/net/wireless/ath/ath12k/ahb.c
+++ b/drivers/net/wireless/ath/ath12k/ahb.c
@@ -347,35 +347,60 @@ static void ath12k_ahb_stop(struct ath12k_base *ab)
ath12k_ce_cleanup_pipes(ab);
}
+static int ath12k_ahb_get_fw_load_region(struct ath12k_base *ab)
+{
+ struct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);
+ struct ath12k_ahb_rproc_info *rproc_info = ab_ahb->rproc_info;
+ struct device *dev = ab->dev;
+ struct resource res;
+ int ret;
+
+ if (rproc_info->mem_region)
+ return 0;
+
+ ret = of_reserved_mem_region_to_resource_byname(dev->of_node, "q6-region", &res);
+ if (ret)
+ return ret;
+
+ rproc_info->mem_phys = res.start;
+ rproc_info->mem_size = resource_size(&res);
+ rproc_info->mem_region = memremap(rproc_info->mem_phys, rproc_info->mem_size,
+ MEMREMAP_WC);
+ if (!rproc_info->mem_region) {
+ ath12k_err(ab, "unable to map memory region: %pa+%zx\n",
+ &res.start, rproc_info->mem_size);
+ rproc_info->mem_phys = 0;
+ rproc_info->mem_size = 0;
+ return -ENOMEM;
+ }
+
+ return 0;
+}
+
+static void ath12k_ahb_put_fw_load_region(struct ath12k_ahb_rproc_info *rproc_info)
+{
+ memunmap(rproc_info->mem_region);
+ rproc_info->mem_region = NULL;
+ rproc_info->mem_phys = 0;
+ rproc_info->mem_size = 0;
+}
+
static int ath12k_ahb_power_up(struct ath12k_base *ab)
{
struct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);
+ struct ath12k_ahb_rproc_info *rproc_info = ab_ahb->rproc_info;
char fw_name[ATH12K_USERPD_FW_NAME_LEN];
char fw2_name[ATH12K_USERPD_FW_NAME_LEN];
struct device *dev = ab->dev;
const struct firmware *fw, *fw2;
unsigned long time_left;
- phys_addr_t mem_phys;
- struct resource res;
- void *mem_region;
- size_t mem_size;
u32 pasid;
int ret;
- ret = of_reserved_mem_region_to_resource_byname(dev->of_node, "q6-region",
- &res);
+ ret = ath12k_ahb_get_fw_load_region(ab);
if (ret)
return ret;
- mem_phys = res.start;
- mem_size = resource_size(&res);
- mem_region = devm_memremap(dev, mem_phys, mem_size, MEMREMAP_WC);
- if (IS_ERR(mem_region)) {
- ath12k_err(ab, "unable to map memory region: %pa+%zx\n",
- &res.start, mem_size);
- return PTR_ERR(mem_region);
- }
-
snprintf(fw_name, sizeof(fw_name), "%s/%s/%s%d%s", ATH12K_FW_DIR,
ab->hw_params->fw.dir, ATH12K_AHB_FW_PREFIX, ab_ahb->userpd_id,
ATH12K_AHB_FW_SUFFIX);
@@ -400,11 +425,13 @@ static int ath12k_ahb_power_up(struct ath12k_base *ab)
/* Load FW image to a reserved memory location */
if (ab_ahb->scm_auth_enabled)
- ret = qcom_mdt_load(dev, fw, fw_name, pasid, mem_region,
- mem_phys, mem_size, &mem_phys);
+ ret = qcom_mdt_load(dev, fw, fw_name, pasid, rproc_info->mem_region,
+ rproc_info->mem_phys, rproc_info->mem_size,
+ NULL);
else
- ret = qcom_mdt_load_no_init(dev, fw, fw_name, mem_region,
- mem_phys, mem_size, &mem_phys);
+ ret = qcom_mdt_load_no_init(dev, fw, fw_name, rproc_info->mem_region,
+ rproc_info->mem_phys, rproc_info->mem_size,
+ NULL);
if (ret) {
ath12k_err(ab, "Failed to load MDT segments: %d\n", ret);
goto err_fw;
@@ -428,8 +455,9 @@ static int ath12k_ahb_power_up(struct ath12k_base *ab)
goto err_fw2;
}
- ret = qcom_mdt_load_no_init(dev, fw2, fw2_name, mem_region, mem_phys,
- mem_size, &mem_phys);
+ ret = qcom_mdt_load_no_init(dev, fw2, fw2_name, rproc_info->mem_region,
+ rproc_info->mem_phys, rproc_info->mem_size,
+ NULL);
if (ret) {
ath12k_err(ab, "Failed to load MDT segments: %d\n", ret);
goto err_fw2;
@@ -877,6 +905,7 @@ static struct ath12k_ahb_rproc_info *ath12k_ahb_rproc_info_alloc(struct ath12k_b
rproc_info->rootpd_booted_by_driver = false;
rproc_info->userpd[ab_ahb->userpd_id - 1] = ab_ahb;
rproc_info->num_userpd = 1;
+ rproc_info->shared_fw_loaded = false;
init_completion(&rproc_info->rootpd_ready);
ab_ahb->rproc_info = rproc_info;
@@ -961,6 +990,76 @@ static int ath12k_ahb_boot_root_pd(struct ath12k_base *ab)
return 0;
}
+static int ath12k_ahb_load_auth_shared_fw(struct ath12k_base *ab,
+ struct ath12k_ahb_rproc_info *rproc_info,
+ const char *fw_name, u32 pasid)
+{
+ int ret;
+
+ const struct firmware *fw __free(firmware) = NULL;
+ ret = request_firmware(&fw, fw_name, ab->dev);
+ if (ret) {
+ ath12k_err(ab, "failed to request shared firmware %s: %d\n",
+ fw_name, ret);
+ return ret;
+ }
+
+ if (!fw->size) {
+ ath12k_err(ab, "Invalid firmware size\n");
+ return -EINVAL;
+ }
+
+ ath12k_dbg(ab, ATH12K_DBG_AHB, "loading firmware %s, size %zd\n", fw_name,
+ fw->size);
+
+ ret = qcom_mdt_load(ab->dev, fw, fw_name, pasid, rproc_info->mem_region,
+ rproc_info->mem_phys, rproc_info->mem_size, NULL);
+ if (ret) {
+ ath12k_err(ab, "failed to load RO firmware %s: %d\n", fw_name, ret);
+ return ret;
+ }
+
+ ret = qcom_pas_auth_and_reset(pasid);
+ if (ret)
+ ath12k_err(ab, "failed to authenticate and boot shared firmware: %d\n",
+ ret);
+ return ret;
+}
+
+static int ath12k_ahb_load_shared_firmware(struct ath12k_base *ab)
+{
+ struct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);
+ struct ath12k_ahb_rproc_info *rproc_info = ab_ahb->rproc_info;
+ char fw_name[ATH12K_USERPD_FW_NAME_LEN];
+ u32 pasid;
+ int ret;
+
+ lockdep_assert_held(&ath12k_rproc_info_lock);
+
+ if (!ab_ahb->supports_multipd)
+ return 0;
+
+ ret = ath12k_ahb_get_fw_load_region(ab);
+ if (ret)
+ return ret;
+
+ snprintf(fw_name, sizeof(fw_name), "%s/%s/%s%d%s", ATH12K_FW_DIR,
+ ab->hw_params->fw.dir, ATH12K_AHB_FW_PREFIX, ATH12K_AHB_RO_ID,
+ ATH12K_AHB_FW_SUFFIX);
+
+ pasid = u32_encode_bits(ATH12K_AHB_RO_ID, ATH12K_USERPD_ID_MASK) |
+ ATH12K_AHB_UPD_SWID;
+
+ ret = ath12k_ahb_load_auth_shared_fw(ab, rproc_info, fw_name, pasid);
+ if (ret) {
+ ath12k_ahb_put_fw_load_region(rproc_info);
+ return ret;
+ }
+
+ rproc_info->shared_fw_loaded = true;
+ return 0;
+}
+
static int ath12k_ahb_configure_rproc(struct ath12k_base *ab)
{
int ret;
@@ -989,6 +1088,15 @@ static int ath12k_ahb_configure_rproc(struct ath12k_base *ab)
g_rproc_info->rootpd_booted_by_driver = true;
}
+ if (!g_rproc_info->shared_fw_loaded) {
+ ret = ath12k_ahb_load_shared_firmware(ab);
+ if (ret) {
+ if (g_rproc_info->rootpd_booted_by_driver)
+ rproc_shutdown(g_rproc_info->tgt_rproc);
+ goto err_unreg_notifier;
+ }
+ }
+
mutex_unlock(&ath12k_rproc_info_lock);
return 0;
@@ -1012,6 +1120,8 @@ static void ath12k_ahb_deconfigure_rproc(struct ath12k_base *ab)
{
struct ath12k_ahb *ab_ahb = ath12k_ab_to_ahb(ab);
struct ath12k_ahb_rproc_info *rproc_info = ab_ahb->rproc_info;
+ u32 pasid;
+ int ret;
lockdep_assert_held(&ath12k_rproc_info_lock);
@@ -1023,6 +1133,20 @@ static void ath12k_ahb_deconfigure_rproc(struct ath12k_base *ab)
if (!g_rproc_info->num_userpd) {
ath12k_ahb_unregister_rproc_notifier();
+ if (g_rproc_info->shared_fw_loaded) {
+ pasid = u32_encode_bits(ATH12K_AHB_RO_ID, ATH12K_USERPD_ID_MASK) |
+ ATH12K_AHB_UPD_SWID;
+ ret = qcom_pas_shutdown(pasid);
+ if (ret)
+ ath12k_err(ab, "pas shutdown failed for shared firmware: %d\n",
+ ret);
+
+ g_rproc_info->shared_fw_loaded = false;
+ }
+
+ if (g_rproc_info->mem_region)
+ ath12k_ahb_put_fw_load_region(g_rproc_info);
+
if (g_rproc_info->rootpd_booted_by_driver &&
g_rproc_info->tgt_rproc->state == RPROC_RUNNING)
rproc_shutdown(g_rproc_info->tgt_rproc);
diff --git a/drivers/net/wireless/ath/ath12k/ahb.h b/drivers/net/wireless/ath/ath12k/ahb.h
index cdb58b07338fd..46a4420d41bdc 100644
--- a/drivers/net/wireless/ath/ath12k/ahb.h
+++ b/drivers/net/wireless/ath/ath12k/ahb.h
@@ -30,6 +30,9 @@
#define ATH12K_USERPD_ID_MASK GENMASK(10, 8)
#define ATH12K_USERPD_FW_NAME_LEN 35
+/* Shared read-only firmware ID, mandated by MultiPD firmware architecture */
+#define ATH12K_AHB_RO_ID 4
+
enum ath12k_ahb_userpd_id {
ATH12K_AHB_USERPD_ID_0 = 1,
ATH12K_AHB_USERPD_ID_1,
@@ -46,6 +49,7 @@ struct ath12k_ahb_desc {
enum ath12k_hw_rev hw_rev;
bool auth_enabled;
const struct ath12k_hif_ops *ops;
+ bool supports_multipd;
};
enum ath12k_ahb_smp2p_msg_id {
@@ -77,6 +81,10 @@ struct ath12k_ahb_rproc_info {
u8 num_userpd;
bool rootpd_booted_by_driver;
struct ath12k_ahb *userpd[ATH12K_MAX_DEVICES];
+ bool shared_fw_loaded;
+ phys_addr_t mem_phys;
+ size_t mem_size;
+ void *mem_region;
};
struct ath12k_ahb {
@@ -95,6 +103,7 @@ struct ath12k_ahb {
const struct ath12k_ahb_device_family_ops *device_family_ops;
bool scm_auth_enabled;
struct ath12k_ahb_rproc_info *rproc_info;
+ bool supports_multipd;
};
struct ath12k_ahb_driver {
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/ahb.c b/drivers/net/wireless/ath/ath12k/wifi7/ahb.c
index 98a6606ffd76a..a8f5cf8cc2a63 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/ahb.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/ahb.c
@@ -35,11 +35,13 @@ static const struct ath12k_ahb_desc ath12k_wifi7_ahb_desc[] = {
.hw_rev = ATH12K_HW_IPQ5332_HW10,
.auth_enabled = true,
.ops = &ath12k_ahb_hif_ops,
+ .supports_multipd = true,
},
[ATH12K_HW_IPQ5424_HW10] = {
.hw_rev = ATH12K_HW_IPQ5424_HW10,
.auth_enabled = false,
.ops = &ath12k_ahb_hif_ops,
+ .supports_multipd = false,
},
};
@@ -106,6 +108,7 @@ static int ath12k_wifi7_ahb_probe(struct platform_device *pdev)
ab->hw_rev = desc->hw_rev;
ab->hif.ops = desc->ops;
ab_ahb->scm_auth_enabled = desc->auth_enabled;
+ ab_ahb->supports_multipd = desc->supports_multipd;
ab_ahb->userpd_id = ath12k_wifi7_ahb_get_userpd_id(ab);
if (!ab_ahb->userpd_id)
return -EOPNOTSUPP;
|
| 3/2 | 2026/08/11 06:15 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6483 output: 130 thoughts: 1182 Thoughts: **WorthFuzzing Assessment: ath12k AHB Firmware Loading** Okay, let's break this down. We have a patch touching `ath12k/ahb.c` and related files, specifically dealing with loading shared firmware for the `ath12k` driver in a MultiPD architecture. This looks like it's adding or modifying functions like `ath12k_ahb_get_fw_load_region`, `ath12k_ahb_load_shared_firmware`, etc., and also modifying power and configuration functions. My immediate concern is reachability in a virtualized environment. `ath12k` is a Qualcomm Wi-Fi 7 driver, and this `ahb` part strongly suggests it's for AHB (Advanced High-performance Bus) devices, typically found in SoCs like IPQ5332 or IPQ5424. Can we even *get* to this in QEMU? These AHB devices are usually probed via Device Tree. Now, unless we have a specific machine model for an IPQ5332-like device in QEMU, or we can inject DT nodes, it's going to be a struggle to probe this. I recall that syzkaller *might* be able to inject DT nodes if it's supported, or perhaps we could use virtual devices. However, this `ath12k` AHB driver depends on either `ARCH_QCOM` or `COMPILE_TEST`. Let's think about syzkaller fuzzing. `ath12k_ahb_probe` is a platform driver probe function. Syzkaller can generate platform devices (via `syz_gen_platform_device` or DT modification), but the real red flags are the interactions this driver has with `qcom_mdt_load`, `qcom_pas_auth_and_reset`, and `rproc_shutdown`. These are Qualcomm-specific remote processor and TrustZone APIs. Without the actual hardware or a QEMU model that supports these TrustZone calls (SCM - Secure Channel Manager), `qcom_pas_auth_and_reset` will almost certainly fail or simply not be reachable. Wait a second, `qcom_mdt_load` and `qcom_pas_auth_and_reset` are part of Qualcomm's PIL (Peripheral Image Loader)/SCM (Secure Channel Manager), so they are part of Qualcomm's security features. This brings into question the fuzzability of these features through Syzkaller. Is it worth fuzzing `ath12k` at all? Wi-Fi drivers (mac80211) *can* often be fuzzed via `mac80211_hwsim`. But this is a specific *hardware* driver (`ath12k`). Hardware-specific Wi-Fi drivers like this, or `iwlwifi`, are generally not fuzzable in QEMU unless they are USB or PCI and we have a way to emulate them. We don't have a generic emulator for AHB like we do for USB (dummy_hcd) or PCI. Syzkaller does have *some* support for platform devices, but for complex devices like this `ath12k` AHB that require specific memory regions (`q6-region`), SCM calls, and a remote processor, it's highly unlikely to get past the probe function. Let's examine `ath12k_ahb_get_fw_load_region` closer: ```c ret = of_reserved_mem_region_to_resource_byname(dev->of_node, "q6-region", &res); ``` This requires a specific device tree node with a reserved memory region named "q6-region". *Without this,* `ath12k_ahb_power_up` will fail early. Can syzkaller *provide* this kind of detailed DT node? No, syzkaller doesn't dynamically generate those complex nodes with reserved memory regions for specific drivers. Therefore, I'm confident that this code is impossible to reach in standard virtualized environments like GCE or QEMU. Let's confirm there are no PCI changes, just to be sure. Nope, it's all in the `ahb.c` files, specifically AHB. So, not reachable. Checking the rules: "Return WorthFuzzing=false if the patch only contains: ... - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware". This is a vendor-specific SoC Wi-Fi driver (Qualcomm ath12k AHB) requiring specific hardware (IPQ5332/IPQ5424) and Trust |
| 4/2 | 2026/08/11 06:15 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the AHB (platform) attachment code for the Qualcomm ath12k Wi-Fi driver, specifically adding support for loading shared firmware in a MultiPD architecture. This code relies on Qualcomm-specific SoC features, TrustZone (SCM) calls, remote processors, and specific Device Tree reserved memory regions (\"q6-region\"). These hardware-specific dependencies are not emulated in standard QEMU/GCE environments, making the modified code paths unreachable during fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the AHB (platform) attachment code for the Qualcomm ath12k Wi-Fi driver, specifically adding support for loading shared firmware in a MultiPD architecture. This code relies on Qualcomm-specific SoC features, TrustZone (SCM) calls, remote processors, and specific Device Tree reserved memory regions (\"q6-region\"). These hardware-specific dependencies are not emulated in standard QEMU/GCE environments, making the modified code paths unreachable during fuzzing.",
"WorthFuzzing": false
} |
| 5/1 | 2026/08/11 06:15 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|