AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/07/28 00:14	flow	patch-triage	1m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.", "WorthFuzzing": false }
1/1	2026/07/28 00:14	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 8183b63b5e9315810d2df873cdb3ad0f1c51b101\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Jul 28 00:14:18 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c\nindex f389b97acbdd5d..c3a16da1cba7d9 100644\n--- a/drivers/net/wireless/ath/ath11k/dp.c\n+++ b/drivers/net/wireless/ath/ath11k/dp.c\n@@ -324,6 +324,7 @@ int ath11k_dp_srng_setup(struct ath11k_base ab, struct dp_srng ring,\n \n \tret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, \u0026params);\n \tif (ret \u003c 0) {\n+\t\tath11k_dp_srng_cleanup(ab, ring);\n \t\tath11k_warn(ab, \"failed to setup srng: %d ring_id %d\\n\",\n \t\t\t ret, ring_num);\n \t\treturn ret;\n" }
2/1	2026/07/28 00:14	agent	patch-evaluator	1m Model: best-expensive Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 8183b63b5e9315810d2df873cdb3ad0f1c51b101 Author: syz-cluster <triage@syzkaller.com> Date: Tue Jul 28 00:14:18 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c index f389b97acbdd5d..c3a16da1cba7d9 100644 --- a/drivers/net/wireless/ath/ath11k/dp.c +++ b/drivers/net/wireless/ath/ath11k/dp.c @@ -324,6 +324,7 @@ int ath11k_dp_srng_setup(struct ath11k_base ab, struct dp_srng ring, ret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, &params); if (ret < 0) { + ath11k_dp_srng_cleanup(ab, ring); ath11k_warn(ab, "failed to setup srng: %d ring_id %d\n", ret, ring_num); return ret;
3/2	2026/07/28 00:14	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2109 output: 39 thoughts: 262 Thoughts: Analyzing a Driver Patch for Fuzzing Potential Okay, so there's a patch in `drivers/net/wireless/ath/ath11k/dp.c`. This patch calls `ath11k_dp_srng_cleanup` within `ath11k_dp_srng_setup` if `ath11k_hal_srng_setup` fails. My immediate thought is, can we fuzz this? Let's figure out if this `ath11k` driver is even a viable target for QEMU fuzzing. Right, `ath11k` typically deals with Qualcomm 802.11ax WLAN devices, usually PCIe or AHB based. I know it's not going to be fuzzable via mac80211_hwsim or similar, it's hardware specific, a specialized driver. Hold on, though... isn't there some PCI and USB device fuzzing support in syzkaller? It's not the usual approach to fuzz PCIe Wi-Fi drivers, but... the potential is there. We only fuzz those if there is emulation or use PCI fuzzing. Okay, yes, syzkaller does have PCI fuzzing capabilities. Time to determine if `ath11k` is actually a PCI driver. Let's run a `grep` for `pci_register_driver` within the `drivers/net/wireless/ath/ath11k/` directory. That should give me a solid answer.
4/2	2026/07/28 00:14	tool	grepper	0m Args: { "Expression": "pci_register_driver", "PathPrefix": "drivers/net/wireless/ath/ath11k/" } Results: { "Output": "drivers/net/wireless/ath/ath11k/pci.c=1303=static int ath11k_pci_init(void)\n--\ndrivers/net/wireless/ath/ath11k/pci.c-1306-\ndrivers/net/wireless/ath/ath11k/pci.c:1307:\tret = pci_register_driver(\u0026ath11k_pci_driver);\ndrivers/net/wireless/ath/ath11k/pci.c-1308-\tif (ret)\n" }
5/2	2026/07/28 00:14	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2883 output: 44 thoughts: 305 Thoughts: Analyzing the Suitability of ath11k for Fuzzing Okay, so the initial assessment is that this code relates to a PCI driver. The immediate question then becomes whether syzkaller even targets `ath11k` for fuzzing. The prompt mentions a specific context: "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU". I need to determine if `ath11k` fits this description. Well, it's a driver for Qualcomm Atheros 802.11ax Wi-Fi, which is vendor-specific. And, yes, it likely does require specific hardware. Syzkaller can fuzz PCI, I know that, but typically it involves either generic PCI devices or those emulated in the fuzzing environment, right? The prompt makes a very clear distinction: if physical hardware is needed and not emulated, then `WorthFuzzing=false`. So, the crucial question is whether `ath11k` falls into this category of requiring physical hardware, or if it has some path that could be taken by the fuzzer that does not require the hardware. I know it's a Wi-Fi driver, linked to a specific Qualcomm hardware, which strongly suggests that it does. But, I should verify this assumption. I'll need to check if there's a way to reach the target function without needing the specialized hardware. Let's see how `ath11k_dp_srng_setup` is called. That should give me the information I require to determine if this piece of code is a good target for fuzzing.
6/2	2026/07/28 00:14	tool	grepper	0m Args: { "Expression": "ath11k_dp_srng_setup", "PathPrefix": "drivers/net/wireless/ath/ath11k/" } Results: { "Output": "drivers/net/wireless/ath/ath11k/dbring.c=237=int ath11k_dbring_srng_setup(struct ath11k ar, struct ath11k_dbring ring,\n--\ndrivers/net/wireless/ath/ath11k/dbring.c-241-\ndrivers/net/wireless/ath/ath11k/dbring.c:242:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026ring-\u003erefill_srng, HAL_RXDMA_DIR_BUF,\ndrivers/net/wireless/ath/ath11k/dbring.c-243-\t\t\t\t ring_num, ar-\u003epdev_idx, num_entries);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=181=static void ath11k_dp_srng_msi_setup(struct ath11k_base ab,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-220-\ndrivers/net/wireless/ath/ath11k/dp.c:221:int ath11k_dp_srng_setup(struct ath11k_base ab, struct dp_srng ring,\ndrivers/net/wireless/ath/ath11k/dp.c-222-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp.c=371=static int ath11k_dp_srng_common_setup(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-377-\ndrivers/net/wireless/ath/ath11k/dp.c:378:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_desc_rel_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-379-\t\t\t\t HAL_SW2WBM_RELEASE, 0, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-386-\ndrivers/net/wireless/ath/ath11k/dp.c:387:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_cmd_ring, HAL_TCL_CMD, 0, 0,\ndrivers/net/wireless/ath/ath11k/dp.c-388-\t\t\t\t DP_TCL_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-393-\ndrivers/net/wireless/ath/ath11k/dp.c:394:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_status_ring, HAL_TCL_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-395-\t\t\t\t 0, 0, DP_TCL_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-404-\ndrivers/net/wireless/ath/ath11k/dp.c:405:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_data_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-406-\t\t\t\t\t HAL_TCL_DATA, tcl_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-413-\ndrivers/net/wireless/ath/ath11k/dp.c:414:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_comp_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-415-\t\t\t\t\t HAL_WBM2SW_RELEASE, wbm_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-430-\ndrivers/net/wireless/ath/ath11k/dp.c:431:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_reinject_ring, HAL_REO_REINJECT,\ndrivers/net/wireless/ath/ath11k/dp.c-432-\t\t\t\t 0, 0, DP_REO_REINJECT_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-438-\ndrivers/net/wireless/ath/ath11k/dp.c:439:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003erx_rel_ring, HAL_WBM2SW_RELEASE,\ndrivers/net/wireless/ath/ath11k/dp.c-440-\t\t\t\t DP_RX_RELEASE_RING_NUM, 0, DP_RX_RELEASE_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-445-\ndrivers/net/wireless/ath/ath11k/dp.c:446:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_except_ring, HAL_REO_EXCEPTION,\ndrivers/net/wireless/ath/ath11k/dp.c-447-\t\t\t\t 0, 0, DP_REO_EXCEPTION_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-453-\ndrivers/net/wireless/ath/ath11k/dp.c:454:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_cmd_ring, HAL_REO_CMD,\ndrivers/net/wireless/ath/ath11k/dp.c-455-\t\t\t\t 0, 0, DP_REO_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-467-\ndrivers/net/wireless/ath/ath11k/dp.c:468:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_status_ring, HAL_REO_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-469-\t\t\t\t 0, 0, DP_REO_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=647=static int ath11k_wbm_idle_ring_setup(struct ath11k_base ab, u32 n_link_desc)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-673-\ndrivers/net/wireless/ath/ath11k/dp.c:674:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_idle_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-675-\t\t\t\t HAL_WBM_IDLE_LINK, 0, 0, n_link_desc);\n--\ndrivers/net/wireless/ath/ath11k/dp.h=1672=void ath11k_dp_srng_cleanup(struct ath11k_base ab, struct dp_srng ring);\ndrivers/net/wireless/ath/ath11k/dp.h:1673:int ath11k_dp_srng_setup(struct ath11k_base ab, struct dp_srng ring,\ndrivers/net/wireless/ath/ath11k/dp.h-1674-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=546=int ath11k_dp_pdev_reo_setup(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-552-\tfor (i = 0; i \u003c DP_REO_DST_RING_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:553:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-554-\t\t\t\t\t HAL_REO_DST, i, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=570=static int ath11k_dp_rx_pdev_srng_alloc(struct ath11k *ar)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-577-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:578:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-579-\t\t\t\t \u0026dp-\u003erx_refill_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-588-\t\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:589:\t\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-590-\t\t\t\t\t\t \u0026dp-\u003erx_mac_buf_ring[i],\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-601-\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:602:\t\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_err_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-603-\t\t\t\t\t HAL_RXDMA_DST, 0, dp-\u003emac_id + i,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-612-\t\tsrng = \u0026dp-\u003erx_mon_status_refill_ring[i].refill_buf_ring;\ndrivers/net/wireless/ath/ath11k/dp_rx.c:613:\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-614-\t\t\t\t\t srng,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-635-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:636:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-637-\t\t\t\t \u0026dp-\u003erxdma_mon_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-645-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:646:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_dst_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-647-\t\t\t\t HAL_RXDMA_MONITOR_DST, 0, dp-\u003emac_id,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-654-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:655:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_desc_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-656-\t\t\t\t HAL_RXDMA_MONITOR_DESC, 0, dp-\u003emac_id,\n" }
7/2	2026/07/28 00:14	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6672 output: 37 thoughts: 832 Thoughts: Analyzing the Fuzzability of the ath11k Wi-Fi Driver Okay, so the prompt is very specific about excluding certain code paths from being considered "worth fuzzing," particularly those requiring physical PCIe hardware not emulated in standard QEMU. My initial thought is, "Wait, ath11k is a vendor-specific PCIe Wi-Fi driver, right?" Yes, Qualcomm Atheros 802.11ax. The next question is whether it needs physical hardware. It seems like it does, based on my understanding. Can I fuzz it with `mac80211_hwsim`? No, that's a separate driver, not applicable here. USB? No, no ath11k USB driver exists. AHB? Possibly, but that's SOC specific and less relevant. So, it's PCIe or AHB, which points towards the need for real hardware. The prompt lists `mlxsw`, `pds_core`, `qed`, `ionic`, and `amdgpu` as examples of drivers that fall into this exclusion category. So, is ath11k a SmartNIC, GPU, or PCIe switch? Definitely not. But the core of the exclusion is the need for physical hardware not emulated in QEMU. Are Wi-Fi PCIe cards emulated in QEMU? No. But syzkaller does fuzz Wi-Fi drivers, some via USB (`ath9k_htc`, `carl9170`, etc.) or `mac80211_hwsim`. Does syzkaller fuzz PCI devices in general? Yes, it does. It has a PCI fuzzer that injects PCI config and memory space. However, the prompt then states this also includes any code impossible to reach in virtualized environments like GCE or QEMU, even with emulated hardware. If ath11k is a hardware-specific driver, and it doesn't have an emulation, this makes it impossible to reach in QEMU. But wait a minute... does syzkaller fuzz ath11k? I need to check. I seem to recall seeing syzkaller reports for ath11k bugs. Let me check my notes, and look for any recent reports. Oh right, it looks like syzkaller does fuzz PCI devices using a virtual PCI device, not by emulating. The question is, does it work for all drivers, or just the simpler ones that can be probed and initialized easily? The driver doesn't need to be fully emulated. I remember this. Then I should really check whether syzkaller actually fuzzed ath11k. I need to check for syzkaller annotations in the kernel for ath11k.
8/2	2026/07/28 00:14	tool	grepper	0m Args: { "Expression": "ath11k", "PathPrefix": "drivers/net/wireless/ath/ath11k/" } Results: { "Output": "\nFull output is too long, showing 500 out of 26669 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath11k/Kconfig=2=config ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-10-\ndrivers/net/wireless/ath/ath11k/Kconfig:11:\t If you choose to build a module, it'll be called ath11k.\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig=13=config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig:14:\ttristate \"Atheros ath11k AHB support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-15-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=20=config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig:21:\ttristate \"Atheros ath11k PCI support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-22-\tdepends on ATH11K \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=30=config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig:31:\tbool \"QCA ath11k debugging\"\ndrivers/net/wireless/ath/ath11k/Kconfig-32-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=38=config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig:39:\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-40-\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-41-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:42:\t Enable ath11k debugfs support\ndrivers/net/wireless/ath/ath11k/Kconfig-43-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=46=config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig:47:\tbool \"ath11k tracing support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-48-\tdepends on ATH11K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-49-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:50:\t Select this to use ath11k tracing infrastructure.\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig=52=config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig:53:\tbool \"QCA ath11k spectral scan support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-54-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-56-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:57:\t Enable ath11k spectral scan support\ndrivers/net/wireless/ath/ath11k/Kconfig-58-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=61=config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig:62:\tbool \"ath11k channel frequency response support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-63-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-65-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:66:\t Enable ath11k channel frequency response dump support.\ndrivers/net/wireless/ath/ath11k/Kconfig-67-\t This option exposes debugfs nodes that will allow the user\n--\ndrivers/net/wireless/ath/ath11k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Makefile:2:obj-$(CONFIG_ATH11K) += ath11k.o\ndrivers/net/wireless/ath/ath11k/Makefile:3:ath11k-y += core.o \\\ndrivers/net/wireless/ath/ath11k/Makefile-4-\t hal.o \\\n--\ndrivers/net/wireless/ath/ath11k/Makefile-23-\ndrivers/net/wireless/ath/ath11k/Makefile:24:ath11k-$(CONFIG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath11k/Makefile:25:ath11k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath11k/Makefile:26:ath11k-$(CONFIG_ATH11K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath11k/Makefile:27:ath11k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath11k/Makefile:28:ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath11k/Makefile:29:ath11k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath11k/Makefile:30:ath11k-$(CONFIG_DEV_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath11k/Makefile:31:ath11k-$(CONFIG_ATH11K_CFR) += cfr.o\ndrivers/net/wireless/ath/ath11k/Makefile-32-\ndrivers/net/wireless/ath/ath11k/Makefile:33:obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile:34:ath11k_ahb-y += ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-35-\ndrivers/net/wireless/ath/ath11k/Makefile:36:obj-$(CONFIG_ATH11K_PCI) += ath11k_pci.o\ndrivers/net/wireless/ath/ath11k/Makefile:37:ath11k_pci-y += mhi.o pci.o\ndrivers/net/wireless/ath/ath11k/Makefile-38-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-23-\ndrivers/net/wireless/ath/ath11k/ahb.c:24:static const struct of_device_id ath11k_ahb_of_match[] = {\ndrivers/net/wireless/ath/ath11k/ahb.c-25-\t/* TODO: Should we change the compatible string to something similar\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-42-\ndrivers/net/wireless/ath/ath11k/ahb.c:43:MODULE_DEVICE_TABLE(of, ath11k_ahb_of_match);\ndrivers/net/wireless/ath/ath11k/ahb.c-44-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=144=static int\ndrivers/net/wireless/ath/ath11k/ahb.c:145:ath11k_ahb_get_msi_irq_wcn6750(struct ath11k_base ab, unsigned int vector)\ndrivers/net/wireless/ath/ath11k/ahb.c-146-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=150=static inline u32\ndrivers/net/wireless/ath/ath11k/ahb.c:151:ath11k_ahb_get_window_start_wcn6750(struct ath11k_base ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-152-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=166=static void\ndrivers/net/wireless/ath/ath11k/ahb.c:167:ath11k_ahb_window_write32_wcn6750(struct ath11k_base ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-168-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-171-\t/ WCN6750 uses static window based register access/\ndrivers/net/wireless/ath/ath11k/ahb.c:172:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-173-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-177-\ndrivers/net/wireless/ath/ath11k/ahb.c:178:static u32 ath11k_ahb_window_read32_wcn6750(struct ath11k_base ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-179-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-183-\t/* WCN6750 uses static window based register access /\ndrivers/net/wireless/ath/ath11k/ahb.c:184:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-185-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-190-\ndrivers/net/wireless/ath/ath11k/ahb.c:191:static const struct ath11k_pci_ops ath11k_ahb_pci_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c-192-\t.wakeup = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c-193-\t.release = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:194:\t.get_msi_irq = ath11k_ahb_get_msi_irq_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:195:\t.window_write32 = ath11k_ahb_window_write32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:196:\t.window_read32 = ath11k_ahb_window_read32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c-197-};\ndrivers/net/wireless/ath/ath11k/ahb.c-198-\ndrivers/net/wireless/ath/ath11k/ahb.c:199:static inline u32 ath11k_ahb_read32(struct ath11k_base ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-200-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-203-\ndrivers/net/wireless/ath/ath11k/ahb.c:204:static inline void ath11k_ahb_write32(struct ath11k_base ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-205-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-208-\ndrivers/net/wireless/ath/ath11k/ahb.c:209:static void ath11k_ahb_kill_tasklets(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-210-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-213-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:214:\t\tstruct ath11k_ce_pipe ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-215-\ndrivers/net/wireless/ath/ath11k/ahb.c:216:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-217-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-222-\ndrivers/net/wireless/ath/ath11k/ahb.c:223:static void ath11k_ahb_ext_grp_disable(struct ath11k_ext_irq_grp irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-224-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-230-\ndrivers/net/wireless/ath/ath11k/ahb.c:231:static void __ath11k_ahb_ext_irq_disable(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-232-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-235-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:236:\t\tstruct ath11k_ext_irq_grp irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-237-\ndrivers/net/wireless/ath/ath11k/ahb.c:238:\t\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-239-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-247-\ndrivers/net/wireless/ath/ath11k/ahb.c:248:static void ath11k_ahb_ext_grp_enable(struct ath11k_ext_irq_grp irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-249-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-255-\ndrivers/net/wireless/ath/ath11k/ahb.c:256:static void ath11k_ahb_setbit32(struct ath11k_base ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-257-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-259-\ndrivers/net/wireless/ath/ath11k/ahb.c:260:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:261:\tath11k_ahb_write32(ab, offset, val \| BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-262-}\ndrivers/net/wireless/ath/ath11k/ahb.c-263-\ndrivers/net/wireless/ath/ath11k/ahb.c:264:static void ath11k_ahb_clearbit32(struct ath11k_base ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-265-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-267-\ndrivers/net/wireless/ath/ath11k/ahb.c:268:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:269:\tath11k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-270-}\ndrivers/net/wireless/ath/ath11k/ahb.c-271-\ndrivers/net/wireless/ath/ath11k/ahb.c:272:static void ath11k_ahb_ce_irq_enable(struct ath11k_base ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-273-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-283-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:284:\t\tath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-285-\ndrivers/net/wireless/ath/ath11k/ahb.c-286-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:287:\t\tath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:288:\t\tath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-289-\t\t\t\t ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-292-\ndrivers/net/wireless/ath/ath11k/ahb.c:293:static void ath11k_ahb_ce_irq_disable(struct ath11k_base ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-294-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-304-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:305:\t\tath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-306-\ndrivers/net/wireless/ath/ath11k/ahb.c-307-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:308:\t\tath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:309:\t\tath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-310-\t\t\t\t ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-313-\ndrivers/net/wireless/ath/ath11k/ahb.c:314:static void ath11k_ahb_sync_ce_irqs(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-315-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-319-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:320:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-321-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-327-\ndrivers/net/wireless/ath/ath11k/ahb.c:328:static void ath11k_ahb_sync_ext_irqs(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-329-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-333-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:334:\t\tstruct ath11k_ext_irq_grp irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-335-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-342-\ndrivers/net/wireless/ath/ath11k/ahb.c:343:static void ath11k_ahb_ce_irqs_enable(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-344-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-347-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:348:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-349-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:350:\t\tath11k_ahb_ce_irq_enable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-351-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-353-\ndrivers/net/wireless/ath/ath11k/ahb.c:354:static void ath11k_ahb_ce_irqs_disable(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-355-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-358-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:359:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-360-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:361:\t\tath11k_ahb_ce_irq_disable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-362-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-364-\ndrivers/net/wireless/ath/ath11k/ahb.c:365:static int ath11k_ahb_start(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-366-{\ndrivers/net/wireless/ath/ath11k/ahb.c:367:\tath11k_ahb_ce_irqs_enable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:368:\tath11k_ce_rx_post_buf(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-369-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-372-\ndrivers/net/wireless/ath/ath11k/ahb.c:373:static void ath11k_ahb_ext_irq_enable(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-374-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-377-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:378:\t\tstruct ath11k_ext_irq_grp irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-379-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-383-\t\t}\ndrivers/net/wireless/ath/ath11k/ahb.c:384:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-385-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-387-\ndrivers/net/wireless/ath/ath11k/ahb.c:388:static void ath11k_ahb_ext_irq_disable(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-389-{\ndrivers/net/wireless/ath/ath11k/ahb.c:390:\t__ath11k_ahb_ext_irq_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:391:\tath11k_ahb_sync_ext_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-392-}\ndrivers/net/wireless/ath/ath11k/ahb.c-393-\ndrivers/net/wireless/ath/ath11k/ahb.c:394:static void ath11k_ahb_stop(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-395-{\ndrivers/net/wireless/ath/ath11k/ahb.c-396-\tif (!test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ahb.c:397:\t\tath11k_ahb_ce_irqs_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:398:\tath11k_ahb_sync_ce_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:399:\tath11k_ahb_kill_tasklets(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-400-\ttimer_delete_sync(\u0026ab-\u003erx_replenish_retry);\ndrivers/net/wireless/ath/ath11k/ahb.c:401:\tath11k_ce_cleanup_pipes(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-402-}\ndrivers/net/wireless/ath/ath11k/ahb.c-403-\ndrivers/net/wireless/ath/ath11k/ahb.c:404:static int ath11k_ahb_power_up(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-405-{\ndrivers/net/wireless/ath/ath11k/ahb.c:406:\tstruct ath11k_ahb ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-407-\tint ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-410-\tif (ret)\ndrivers/net/wireless/ath/ath11k/ahb.c:411:\t\tath11k_err(ab, \"failed to boot the remote processor Q6\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-412-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-415-\ndrivers/net/wireless/ath/ath11k/ahb.c:416:static void ath11k_ahb_power_down(struct ath11k_base ab, bool is_suspend)\ndrivers/net/wireless/ath/ath11k/ahb.c-417-{\ndrivers/net/wireless/ath/ath11k/ahb.c:418:\tstruct ath11k_ahb ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-419-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-422-\ndrivers/net/wireless/ath/ath11k/ahb.c:423:static void ath11k_ahb_init_qmi_ce_config(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-424-{\ndrivers/net/wireless/ath/ath11k/ahb.c:425:\tstruct ath11k_qmi_ce_cfg cfg = \u0026ab-\u003eqmi.ce_cfg;\ndrivers/net/wireless/ath/ath11k/ahb.c-426-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-433-\ndrivers/net/wireless/ath/ath11k/ahb.c:434:static void ath11k_ahb_free_ext_irq(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-435-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-438-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:439:\t\tstruct ath11k_ext_irq_grp irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-440-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-448-\ndrivers/net/wireless/ath/ath11k/ahb.c:449:static void ath11k_ahb_free_irq(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-450-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-454-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:455:\t\treturn ath11k_pcic_free_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-456-\ndrivers/net/wireless/ath/ath11k/ahb.c-457-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:458:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-459-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-463-\ndrivers/net/wireless/ath/ath11k/ahb.c:464:\tath11k_ahb_free_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-465-}\ndrivers/net/wireless/ath/ath11k/ahb.c-466-\ndrivers/net/wireless/ath/ath11k/ahb.c:467:static void ath11k_ahb_ce_tasklet(struct tasklet_struct t)\ndrivers/net/wireless/ath/ath11k/ahb.c-468-{\ndrivers/net/wireless/ath/ath11k/ahb.c:469:\tstruct ath11k_ce_pipe ce_pipe = from_tasklet(ce_pipe, t, intr_tq);\ndrivers/net/wireless/ath/ath11k/ahb.c-470-\ndrivers/net/wireless/ath/ath11k/ahb.c:471:\tath11k_ce_per_engine_service(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-472-\ndrivers/net/wireless/ath/ath11k/ahb.c:473:\tath11k_ahb_ce_irq_enable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-474-}\ndrivers/net/wireless/ath/ath11k/ahb.c-475-\ndrivers/net/wireless/ath/ath11k/ahb.c:476:static irqreturn_t ath11k_ahb_ce_interrupt_handler(int irq, void arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-477-{\ndrivers/net/wireless/ath/ath11k/ahb.c:478:\tstruct ath11k_ce_pipe ce_pipe = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-479-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-482-\ndrivers/net/wireless/ath/ath11k/ahb.c:483:\tath11k_ahb_ce_irq_disable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-484-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-489-\ndrivers/net/wireless/ath/ath11k/ahb.c:490:static int ath11k_ahb_ext_grp_napi_poll(struct napi_struct napi, int budget)\ndrivers/net/wireless/ath/ath11k/ahb.c-491-{\ndrivers/net/wireless/ath/ath11k/ahb.c:492:\tstruct ath11k_ext_irq_grp irq_grp = container_of(napi,\ndrivers/net/wireless/ath/ath11k/ahb.c:493:\t\t\t\t\t\tstruct ath11k_ext_irq_grp,\ndrivers/net/wireless/ath/ath11k/ahb.c-494-\t\t\t\t\t\tnapi);\ndrivers/net/wireless/ath/ath11k/ahb.c:495:\tstruct ath11k_base ab = irq_grp-\u003eab;\ndrivers/net/wireless/ath/ath11k/ahb.c-496-\tint work_done;\ndrivers/net/wireless/ath/ath11k/ahb.c-497-\ndrivers/net/wireless/ath/ath11k/ahb.c:498:\twork_done = ath11k_dp_service_srng(ab, irq_grp, budget);\ndrivers/net/wireless/ath/ath11k/ahb.c-499-\tif (work_done \u003c budget) {\ndrivers/net/wireless/ath/ath11k/ahb.c-500-\t\tnapi_complete_done(napi, work_done);\ndrivers/net/wireless/ath/ath11k/ahb.c:501:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-502-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-509-\ndrivers/net/wireless/ath/ath11k/ahb.c:510:static irqreturn_t ath11k_ahb_ext_interrupt_handler(int irq, void arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-511-{\ndrivers/net/wireless/ath/ath11k/ahb.c:512:\tstruct ath11k_ext_irq_grp irq_grp = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-513-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-516-\ndrivers/net/wireless/ath/ath11k/ahb.c:517:\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-518-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-523-\ndrivers/net/wireless/ath/ath11k/ahb.c:524:static int ath11k_ahb_config_ext_irq(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-525-{\ndrivers/net/wireless/ath/ath11k/ahb.c:526:\tstruct ath11k_hw_params hw = \u0026ab-\u003ehw_params;\ndrivers/net/wireless/ath/ath11k/ahb.c-527-\tint i, j;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-531-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:532:\t\tstruct ath11k_ext_irq_grp irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-533-\t\tu32 num_irq = 0;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-542-\t\tnetif_napi_add(irq_grp-\u003enapi_ndev, \u0026irq_grp-\u003enapi,\ndrivers/net/wireless/ath/ath11k/ahb.c:543:\t\t\t ath11k_ahb_ext_grp_napi_poll);\ndrivers/net/wireless/ath/ath11k/ahb.c-544-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-568-\t\t\t\t\t\trxdma2host_destination_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:569:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-570-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-574-\t\t\t\t\t\thost2rxdma_host_buf_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:575:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-576-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-580-\t\t\t\t\t\tppdu_end_interrupts_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:581:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-582-\t\t\t\t\tirq_grp-\u003eirqs[num_irq++] =\ndrivers/net/wireless/ath/ath11k/ahb.c-583-\t\t\t\t\t\trxdma2host_monitor_status_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:584:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-585-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-596-\t\t\tirq_set_status_flags(irq, IRQ_NOAUTOEN \| IRQ_DISABLE_UNLAZY);\ndrivers/net/wireless/ath/ath11k/ahb.c:597:\t\t\tret = request_irq(irq, ath11k_ahb_ext_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-598-\t\t\t\t\t IRQF_TRIGGER_RISING,\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-600-\t\t\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:601:\t\t\t\tath11k_err(ab, \"failed request_irq for %d\\n\",\ndrivers/net/wireless/ath/ath11k/ahb.c-602-\t\t\t\t\t irq);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-609-\ndrivers/net/wireless/ath/ath11k/ahb.c:610:static int ath11k_ahb_config_irq(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-611-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-615-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:616:\t\treturn ath11k_pcic_config_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-617-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-619-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:620:\t\tstruct ath11k_ce_pipe ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-621-\ndrivers/net/wireless/ath/ath11k/ahb.c:622:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-623-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-626-\ndrivers/net/wireless/ath/ath11k/ahb.c:627:\t\ttasklet_setup(\u0026ce_pipe-\u003eintr_tq, ath11k_ahb_ce_tasklet);\ndrivers/net/wireless/ath/ath11k/ahb.c-628-\t\tirq = platform_get_irq_byname(ab-\u003epdev, irq_name[irq_idx]);\ndrivers/net/wireless/ath/ath11k/ahb.c:629:\t\tret = request_irq(irq, ath11k_ahb_ce_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-630-\t\t\t\t IRQF_TRIGGER_RISING, irq_name[irq_idx],\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-638-\t/* Configure external interrupts /\ndrivers/net/wireless/ath/ath11k/ahb.c:639:\tret = ath11k_ahb_config_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-640-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-643-\ndrivers/net/wireless/ath/ath11k/ahb.c:644:static int ath11k_ahb_map_service_to_pipe(struct ath11k_base ab, u16 service_id,\ndrivers/net/wireless/ath/ath11k/ahb.c-645-\t\t\t\t\t u8 ul_pipe, u8 dl_pipe)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-686-\ndrivers/net/wireless/ath/ath11k/ahb.c:687:static int ath11k_ahb_hif_suspend(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-688-{\ndrivers/net/wireless/ath/ath11k/ahb.c:689:\tstruct ath11k_ahb ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-690-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-700-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:701:\t\tath11k_err(ab, \"failed to enable wakeup irq :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-702-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-712-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:713:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-714-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-716-\ndrivers/net/wireless/ath/ath11k/ahb.c:717:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device suspended\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-718-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-721-\ndrivers/net/wireless/ath/ath11k/ahb.c:722:static int ath11k_ahb_hif_resume(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-723-{\ndrivers/net/wireless/ath/ath11k/ahb.c:724:\tstruct ath11k_ahb ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-725-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-735-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:736:\t\tath11k_err(ab, \"failed to disable wakeup irq: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-737-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-749-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:750:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-751-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-755-\tif (ret == 0) {\ndrivers/net/wireless/ath/ath11k/ahb.c:756:\t\tath11k_warn(ab, \"timed out while waiting for wow wakeup completion\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-757-\t\treturn -ETIMEDOUT;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-759-\ndrivers/net/wireless/ath/ath11k/ahb.c:760:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device resumed\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-761-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-764-\ndrivers/net/wireless/ath/ath11k/ahb.c:765:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_ipq8074 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:766:\t.start = ath11k_ahb_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:767:\t.stop = ath11k_ahb_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:768:\t.read32 = ath11k_ahb_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:769:\t.write32 = ath11k_ahb_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-770-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:771:\t.irq_enable = ath11k_ahb_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:772:\t.irq_disable = ath11k_ahb_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:773:\t.map_service_to_pipe = ath11k_ahb_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:774:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:775:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c-776-};\ndrivers/net/wireless/ath/ath11k/ahb.c-777-\ndrivers/net/wireless/ath/ath11k/ahb.c:778:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:779:\t.start = ath11k_pcic_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:780:\t.stop = ath11k_pcic_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:781:\t.read32 = ath11k_pcic_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:782:\t.write32 = ath11k_pcic_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-783-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:784:\t.irq_enable = ath11k_pcic_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:785:\t.irq_disable = ath11k_pcic_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:786:\t.get_msi_address = ath11k_pcic_get_msi_address,\ndrivers/net/wireless/ath/ath11k/ahb.c:787:\t.get_user_msi_vector = ath11k_pcic_get_user_msi_assignment,\ndrivers/net/wireless/ath/ath11k/ahb.c:788:\t.map_service_to_pipe = ath11k_pcic_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:789:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:790:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c:791:\t.suspend = ath11k_ahb_hif_suspend,\ndrivers/net/wireless/ath/ath11k/ahb.c:792:\t.resume = ath11k_ahb_hif_resume,\ndrivers/net/wireless/ath/ath11k/ahb.c:793:\t.ce_irq_enable = ath11k_pci_enable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c:794:\t.ce_irq_disable = ath11k_pci_disable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c-795-};\ndrivers/net/wireless/ath/ath11k/ahb.c-796-\ndrivers/net/wireless/ath/ath11k/ahb.c:797:static int ath11k_core_get_rproc(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-798-{\ndrivers/net/wireless/ath/ath11k/ahb.c:799:\tstruct ath11k_ahb ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-800-\tstruct device dev = ab-\u003edev;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-804-\tif (of_property_read_u32(dev-\u003eof_node, \"qcom,rproc\", \u0026rproc_phandle)) {\ndrivers/net/wireless/ath/ath11k/ahb.c:805:\t\tath11k_err(ab, \"failed to get q6_rproc handle\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-806-\t\treturn -ENOENT;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-816-\ndrivers/net/wireless/ath/ath11k/ahb.c:817:static int ath11k_ahb_setup_msi_resources(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-818-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-826-\ndrivers/net/wireless/ath/ath11k/ahb.c:827:\tret = ath11k_pcic_init_msi_config(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-828-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:829:\t\tath11k_err(ab, \"failed to init msi config: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-830-\t\treturn ret;\n--\n\n" }
9/2	2026/07/28 00:14	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 23007 output: 35 thoughts: 378 Thoughts: Fuzzing the `ath11k` Wi-Fi Driver: A Preliminary Assessment Okay, so I see `ath11k_ahb.c` and `ath11k_pci.c`. My initial thought is, can I leverage a virtual PCI device to fuzz this `ath11k` driver? Syzkaller does have a PCI fuzzer that can inject PCI configuration and memory space, so the idea has merit. But hold on, the prompt is rather specific: it mentions vendor-specific PCIe switch, SmartNIC, or GPU drivers. Things like `mlxsw`, `pds_core`, `qed`, `ionic`, and `amdgpu`. Is `ath11k` a SmartNIC, GPU, or PCIe switch? No, it's a Wi-Fi driver, so at face value, it might not be relevant. But does it require physical hardware? Yes, it depends on a Qualcomm Atheros 802.11ax device, so a physical card is needed. The prompt, however, does use "e.g., ...", so there might be a grey area here, because it does not explicitly mention Wi-Fi drivers, but Wi-Fi drivers that require physical PCIe hardware cards not emulated in standard QEMU are similar to the cases mentioned. Okay, so Syzkaller does fuzz Wi-Fi drivers, but through `mac80211_hwsim`. But `ath11k` is a hardware driver, which is different. Syzkaller has functions like `syz_80211_inject_frame` and the like, but those are for `mac80211_hwsim`, which I don't think would apply here. So, does Syzkaller fuzz `ath11k` at all? Let me check. I need to look for any syzkaller annotations within the `ath11k` codebase itself. I'll search the `drivers/net/wireless/ath/ath11k/` directory for "syzkaller" or "syz" and see what comes up.
10/2	2026/07/28 00:14	tool	grepper	0m Error: no matches Args: { "Expression": "syz", "PathPrefix": "drivers/net/wireless/ath/ath11k/" } Results: { "error": "no matches" }
11/2	2026/07/28 00:14	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 23898 output: 34 thoughts: 459 Thoughts: My Reasoning on Fuzzing Ath11k Okay, so I'm looking at this and thinking, "No dice, no immediate matches." But wait, didn't I see something about syzkaller having a PCI fuzzer? Could it fuzz the ath11k driver? I need to check. Ideally, I'd search syzkaller reports for "ath11k," but, in this scenario, I can't. Hmm, can I even reach ath11k in a QEMU environment? The prompt just brought up a crucial point: "Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware." Okay, so is ath11k reachable in standard QEMU? No, QEMU doesn't emulate the necessary Qualcomm Atheros 802.11ax hardware. Now, let's circle back to that PCI fuzzing angle. Syzkaller's PCI fuzzer simulates PCI devices, right? It either hooks into the PCI subsystem directly or uses something like `vfio` or `pci-stub`? Actually, no, syzkaller uses a custom PCI device in QEMU or injects via `syz_pci_device`. If syzkaller's PCI fuzzer can hit it, then it is reachable. But the prompt states quite explicitly: "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU." This seems to be the critical distinction. Those drivers, requiring physical hardware not emulated, should be marked as WorthFuzzing=false. Is ath11k a vendor-specific PCIe driver? Yes, it's Qualcomm Atheros, absolutely. Does it require physical hardware? Yes, it does. Is it emulated in standard QEMU? No. So, it appears to fall squarely into that "WorthFuzzing=false" category. Hold on, what about USB? I know USB drivers can be fuzzed through USB gadget (dummy_hcd). But, ath11k is PCI, also AHB... I should check, though, if ath11k even has any USB support.
12/2	2026/07/28 00:14	tool	grepper	0m Error: no matches Args: { "Expression": "usb", "PathPrefix": "drivers/net/wireless/ath/ath11k/" } Results: { "error": "no matches" }
13/2	2026/07/28 00:14	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 24923 output: 44 thoughts: 763 Thoughts: Analyzing the WorthFuzzing Status of an ath11k Patch Okay, first things first, no USB support is relevant here, so let's set that aside. I'm focusing on this `ath11k` driver fix, and my initial thought was that it deals with AHB, which is normally an SoC internal bus and not something emulated in standard QEMU. If it needed a specific SoC like IPQ8074, that would be a problem. But, I need to look closer at the code. Alright, the patch I'm examining is in `ath11k_dp_srng_setup`. Ah, it's a simple fix. It cleans up the SRNG if `ath11k_hal_srng_setup` fails. This looks like it's addressing a memory leak or a similar issue. The original instructions suggest that since `ath11k` is a hardware-specific driver, one that requires physical PCIe/AHB hardware not emulated by standard QEMU, this should be considered `WorthFuzzing=false`. That seems logical at first glance. But wait, I need to double-check something. Does syzkaller actually fuzz `ath11k`? This is critical! Let's see... Ah, the commit message: "Author: syz-cluster <triage@syzkaller.com>". Hold on! "syz-cluster" is the author! That means syzkaller did find a bug here! How is this even possible? Okay, the pieces are falling into place! Syzkaller has a PCI fuzzer. It can fuzz ANY PCI driver by simulating PCI devices! Aha! If syzkaller found a bug in `ath11k`, that means this code must be reachable within syzkaller's environment. I need to confirm how syzkaller approaches this. Let me check. Does syzkaller use a virtual PCI device to fuzz `ath11k`? Yes, syzkaller's `syz_pci_device` or a similar tool can probe any PCI driver by matching vendor/device IDs and then fuzzing the MMIO/PIO/DMA accesses. The original prompt talks about "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU". This gives me pause. Is `ath11k` a SmartNIC, a GPU, or a PCIe switch? No, it's a WLAN driver. But did the prompt mean all vendor-specific PCIe drivers? If syzkaller is finding bugs, then it means these parts are reachable. The wording is important. It highlights vendor-specific code that requires physical cards. I see now! The key is that syzkaller fakes the PCI device! It presents the vendor/device ID, the kernel probes the driver, and the driver maps BARs. Then, when the driver reads from those BARs, the PCI fuzzer provides fuzzed values! This means the driver's initialization code – the probe, setup functions, etc. – IS reachable and heavily fuzzed by syzkaller. The initial setup, like `ath11k_dp_srng_setup`, is likely called during the probe. I need to verify that.
14/2	2026/07/28 00:15	tool	grepper	0m Args: { "Expression": "ath11k_dp_srng_setup", "PathPrefix": "drivers/net/wireless/ath/ath11k/" } Results: { "Output": "drivers/net/wireless/ath/ath11k/dbring.c=237=int ath11k_dbring_srng_setup(struct ath11k ar, struct ath11k_dbring ring,\n--\ndrivers/net/wireless/ath/ath11k/dbring.c-241-\ndrivers/net/wireless/ath/ath11k/dbring.c:242:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026ring-\u003erefill_srng, HAL_RXDMA_DIR_BUF,\ndrivers/net/wireless/ath/ath11k/dbring.c-243-\t\t\t\t ring_num, ar-\u003epdev_idx, num_entries);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=181=static void ath11k_dp_srng_msi_setup(struct ath11k_base ab,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-220-\ndrivers/net/wireless/ath/ath11k/dp.c:221:int ath11k_dp_srng_setup(struct ath11k_base ab, struct dp_srng ring,\ndrivers/net/wireless/ath/ath11k/dp.c-222-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp.c=371=static int ath11k_dp_srng_common_setup(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-377-\ndrivers/net/wireless/ath/ath11k/dp.c:378:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_desc_rel_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-379-\t\t\t\t HAL_SW2WBM_RELEASE, 0, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-386-\ndrivers/net/wireless/ath/ath11k/dp.c:387:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_cmd_ring, HAL_TCL_CMD, 0, 0,\ndrivers/net/wireless/ath/ath11k/dp.c-388-\t\t\t\t DP_TCL_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-393-\ndrivers/net/wireless/ath/ath11k/dp.c:394:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_status_ring, HAL_TCL_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-395-\t\t\t\t 0, 0, DP_TCL_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-404-\ndrivers/net/wireless/ath/ath11k/dp.c:405:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_data_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-406-\t\t\t\t\t HAL_TCL_DATA, tcl_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-413-\ndrivers/net/wireless/ath/ath11k/dp.c:414:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_comp_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-415-\t\t\t\t\t HAL_WBM2SW_RELEASE, wbm_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-430-\ndrivers/net/wireless/ath/ath11k/dp.c:431:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_reinject_ring, HAL_REO_REINJECT,\ndrivers/net/wireless/ath/ath11k/dp.c-432-\t\t\t\t 0, 0, DP_REO_REINJECT_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-438-\ndrivers/net/wireless/ath/ath11k/dp.c:439:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003erx_rel_ring, HAL_WBM2SW_RELEASE,\ndrivers/net/wireless/ath/ath11k/dp.c-440-\t\t\t\t DP_RX_RELEASE_RING_NUM, 0, DP_RX_RELEASE_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-445-\ndrivers/net/wireless/ath/ath11k/dp.c:446:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_except_ring, HAL_REO_EXCEPTION,\ndrivers/net/wireless/ath/ath11k/dp.c-447-\t\t\t\t 0, 0, DP_REO_EXCEPTION_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-453-\ndrivers/net/wireless/ath/ath11k/dp.c:454:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_cmd_ring, HAL_REO_CMD,\ndrivers/net/wireless/ath/ath11k/dp.c-455-\t\t\t\t 0, 0, DP_REO_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-467-\ndrivers/net/wireless/ath/ath11k/dp.c:468:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_status_ring, HAL_REO_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-469-\t\t\t\t 0, 0, DP_REO_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=647=static int ath11k_wbm_idle_ring_setup(struct ath11k_base ab, u32 n_link_desc)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-673-\ndrivers/net/wireless/ath/ath11k/dp.c:674:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_idle_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-675-\t\t\t\t HAL_WBM_IDLE_LINK, 0, 0, n_link_desc);\n--\ndrivers/net/wireless/ath/ath11k/dp.h=1672=void ath11k_dp_srng_cleanup(struct ath11k_base ab, struct dp_srng ring);\ndrivers/net/wireless/ath/ath11k/dp.h:1673:int ath11k_dp_srng_setup(struct ath11k_base ab, struct dp_srng ring,\ndrivers/net/wireless/ath/ath11k/dp.h-1674-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=546=int ath11k_dp_pdev_reo_setup(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-552-\tfor (i = 0; i \u003c DP_REO_DST_RING_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:553:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-554-\t\t\t\t\t HAL_REO_DST, i, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=570=static int ath11k_dp_rx_pdev_srng_alloc(struct ath11k *ar)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-577-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:578:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-579-\t\t\t\t \u0026dp-\u003erx_refill_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-588-\t\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:589:\t\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-590-\t\t\t\t\t\t \u0026dp-\u003erx_mac_buf_ring[i],\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-601-\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:602:\t\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_err_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-603-\t\t\t\t\t HAL_RXDMA_DST, 0, dp-\u003emac_id + i,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-612-\t\tsrng = \u0026dp-\u003erx_mon_status_refill_ring[i].refill_buf_ring;\ndrivers/net/wireless/ath/ath11k/dp_rx.c:613:\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-614-\t\t\t\t\t srng,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-635-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:636:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-637-\t\t\t\t \u0026dp-\u003erxdma_mon_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-645-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:646:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_dst_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-647-\t\t\t\t HAL_RXDMA_MONITOR_DST, 0, dp-\u003emac_id,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-654-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:655:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_desc_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-656-\t\t\t\t HAL_RXDMA_MONITOR_DESC, 0, dp-\u003emac_id,\n" }
15/2	2026/07/28 00:15	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 29536 output: 93 thoughts: 2042 Thoughts: My Analysis of the Patch's Fuzzing Worthiness Okay, here's my thought process on this. I'm looking at these functions: `ath11k_dp_srng_common_setup`, `ath11k_dp_pdev_reo_setup`, `ath11k_dp_rx_pdev_srng_alloc`. These are initialization functions, and the fact that syzkaller's PCI fuzzer can trigger them is what's making this tricky. The core question is whether or not this patch is worth fuzzing, based on the provided prompt instructions. The prompt specifically says to return `WorthFuzzing=false` if the patch only includes code that falls into certain categories. The key one here is: "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU." My initial thought is to compare `ath11k` to those exclusion cases. Is `ath11k` a vendor-specific PCIe driver? Yes, it is. Does it require specific hardware? Absolutely; it's a Wi-Fi driver, so it needs Qualcomm Atheros hardware. And does QEMU emulate that? Nope, not even close. So, on the face of it, it looks like `WorthFuzzing=false`. However, syzkaller can reach it via PCI fuzzing. That seems contradictory. But the prompt explicitly mentions that this kind of access is what should be excluded, because it leads to shallow coverage or false positives, as the fuzzer doesn't understand the complex state machine of the device. Now, let's carefully go through the wording again. Is `ath11k` a "PCIe switch, SmartNIC, or GPU"? No, it's a Wi-Fi driver. That said, it is a vendor-specific PCIe driver that needs actual hardware. So, am I being too narrow by getting hung up on "PCIe switch, SmartNIC, or GPU" in the exclusion list? Is the intent to exclude any vendor-specific PCIe device? The prompt also says to return `WorthFuzzing=false` for "Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware". Now, since `ath11k` is not emulated by mac80211_hwsim or QEMU, it's virtually impossible to reach in standard QEMU. That matches. The only way it is reached is through syzkaller's PCI fuzzer. The core of the issue: if syzkaller found this, then should I ignore the prompt? Is the prompt saying I should exclude this even if syzkaller finds it? Yes, I believe that is the case. The fact the driver is vendor-specific and depends on physical hardware not emulated in QEMU is the core reason for the exclusion. The logic within the driver, especially the initialization parts being touched here ( `ath11k_dp_srng_setup` ) are functionally inaccessible in a virtualized environment. Even if the fuzzer gets a "hit", it's the equivalent of random reads in MMIO space, which the prompt asks to exclude. I'm going to return `WorthFuzzing=false`. Specifically, since the patch fixes the error path of `ath11k_dp_srng_setup`, but `ath11k_dp_srng_setup` is functionally inaccessible in a virtualized environment, I still think this should be excluded. Final Decision * `WorthFuzzing`: `false` * Reasoning: The patch modifies the `ath11k` driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this hardware is not emulated in standard QEMU, the code paths are impossible to reach and functionally test in virtualized environments. The prompt specifically instructs to exclude vendor-specific PCIe drivers that require physical hardware not emulated in QEMU, and this patch falls under that category, even if syzkaller can trigger some of the code.
16/2	2026/07/28 00:15	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.", "WorthFuzzing": false }

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.",
  "WorthFuzzing": false
}

{
  "PatchDiff": "commit 8183b63b5e9315810d2df873cdb3ad0f1c51b101\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Jul 28 00:14:18 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c\nindex f389b97acbdd5d..c3a16da1cba7d9 100644\n--- a/drivers/net/wireless/ath/ath11k/dp.c\n+++ b/drivers/net/wireless/ath/ath11k/dp.c\n@@ -324,6 +324,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,\n \n \tret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, \u0026params);\n \tif (ret \u003c 0) {\n+\t\tath11k_dp_srng_cleanup(ab, ring);\n \t\tath11k_warn(ab, \"failed to setup srng: %d ring_id %d\\n\",\n \t\t\t    ret, ring_num);\n \t\treturn ret;\n"
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 8183b63b5e9315810d2df873cdb3ad0f1c51b101
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Jul 28 00:14:18 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c
index f389b97acbdd5d..c3a16da1cba7d9 100644
--- a/drivers/net/wireless/ath/ath11k/dp.c
+++ b/drivers/net/wireless/ath/ath11k/dp.c
@@ -324,6 +324,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
 
 	ret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, &params);
 	if (ret < 0) {
+		ath11k_dp_srng_cleanup(ab, ring);
 		ath11k_warn(ab, "failed to setup srng: %d ring_id %d\n",
 			    ret, ring_num);
 		return ret;

gemini-3.1-pro-preview

							input: 2109
							output: 39
							thoughts: 262

**Analyzing a Driver Patch for Fuzzing Potential**

Okay, so there's a patch in `drivers/net/wireless/ath/ath11k/dp.c`. This patch calls `ath11k_dp_srng_cleanup` within `ath11k_dp_srng_setup` if `ath11k_hal_srng_setup` fails. My immediate thought is, can we fuzz this? Let's figure out if this `ath11k` driver is even a viable target for QEMU fuzzing.

Right, `ath11k` typically deals with Qualcomm 802.11ax WLAN devices, usually PCIe or AHB based. I know it's not going to be fuzzable via mac80211_hwsim or similar, it's hardware specific, a specialized driver. Hold on, though... isn't there some PCI and USB device fuzzing support in syzkaller? It's not the *usual* approach to fuzz PCIe Wi-Fi drivers, but... the potential is there. We only fuzz those if there is emulation or use PCI fuzzing.

Okay, yes, syzkaller *does* have PCI fuzzing capabilities. Time to determine if `ath11k` is actually a PCI driver. Let's run a `grep` for `pci_register_driver` within the `drivers/net/wireless/ath/ath11k/` directory. That should give me a solid answer.

{
  "Expression": "pci_register_driver",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/pci.c=1303=static int ath11k_pci_init(void)\n--\ndrivers/net/wireless/ath/ath11k/pci.c-1306-\ndrivers/net/wireless/ath/ath11k/pci.c:1307:\tret = pci_register_driver(\u0026ath11k_pci_driver);\ndrivers/net/wireless/ath/ath11k/pci.c-1308-\tif (ret)\n"
}

gemini-3.1-pro-preview

							input: 2883
							output: 44
							thoughts: 305

**Analyzing the Suitability of ath11k for Fuzzing**

Okay, so the initial assessment is that this code relates to a PCI driver. The immediate question then becomes whether syzkaller even targets `ath11k` for fuzzing. The prompt mentions a specific context: "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU".

I need to determine if `ath11k` fits this description. Well, it's a driver for Qualcomm Atheros 802.11ax Wi-Fi, which *is* vendor-specific. And, yes, it likely *does* require specific hardware. Syzkaller can fuzz PCI, I know that, but typically it involves either generic PCI devices or those emulated in the fuzzing environment, right? The prompt makes a very clear distinction: if physical hardware is needed and not emulated, then `WorthFuzzing=false`.

So, the crucial question is whether `ath11k` falls into this category of requiring physical hardware, or if it has some path that could be taken by the fuzzer that does not require the hardware. I know it's a Wi-Fi driver, linked to a specific Qualcomm hardware, which strongly suggests that it does.

But, I should verify this assumption. I'll need to check if there's a way to reach the target function without needing the specialized hardware. Let's see how `ath11k_dp_srng_setup` is called. That should give me the information I require to determine if this piece of code is a good target for fuzzing.

{
  "Expression": "ath11k_dp_srng_setup",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/dbring.c=237=int ath11k_dbring_srng_setup(struct ath11k *ar, struct ath11k_dbring *ring,\n--\ndrivers/net/wireless/ath/ath11k/dbring.c-241-\ndrivers/net/wireless/ath/ath11k/dbring.c:242:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026ring-\u003erefill_srng, HAL_RXDMA_DIR_BUF,\ndrivers/net/wireless/ath/ath11k/dbring.c-243-\t\t\t\t   ring_num, ar-\u003epdev_idx, num_entries);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=181=static void ath11k_dp_srng_msi_setup(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-220-\ndrivers/net/wireless/ath/ath11k/dp.c:221:int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,\ndrivers/net/wireless/ath/ath11k/dp.c-222-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp.c=371=static int ath11k_dp_srng_common_setup(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-377-\ndrivers/net/wireless/ath/ath11k/dp.c:378:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_desc_rel_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-379-\t\t\t\t   HAL_SW2WBM_RELEASE, 0, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-386-\ndrivers/net/wireless/ath/ath11k/dp.c:387:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_cmd_ring, HAL_TCL_CMD, 0, 0,\ndrivers/net/wireless/ath/ath11k/dp.c-388-\t\t\t\t   DP_TCL_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-393-\ndrivers/net/wireless/ath/ath11k/dp.c:394:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_status_ring, HAL_TCL_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-395-\t\t\t\t   0, 0, DP_TCL_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-404-\ndrivers/net/wireless/ath/ath11k/dp.c:405:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_data_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-406-\t\t\t\t\t   HAL_TCL_DATA, tcl_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-413-\ndrivers/net/wireless/ath/ath11k/dp.c:414:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_comp_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-415-\t\t\t\t\t   HAL_WBM2SW_RELEASE, wbm_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-430-\ndrivers/net/wireless/ath/ath11k/dp.c:431:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_reinject_ring, HAL_REO_REINJECT,\ndrivers/net/wireless/ath/ath11k/dp.c-432-\t\t\t\t   0, 0, DP_REO_REINJECT_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-438-\ndrivers/net/wireless/ath/ath11k/dp.c:439:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003erx_rel_ring, HAL_WBM2SW_RELEASE,\ndrivers/net/wireless/ath/ath11k/dp.c-440-\t\t\t\t   DP_RX_RELEASE_RING_NUM, 0, DP_RX_RELEASE_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-445-\ndrivers/net/wireless/ath/ath11k/dp.c:446:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_except_ring, HAL_REO_EXCEPTION,\ndrivers/net/wireless/ath/ath11k/dp.c-447-\t\t\t\t   0, 0, DP_REO_EXCEPTION_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-453-\ndrivers/net/wireless/ath/ath11k/dp.c:454:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_cmd_ring, HAL_REO_CMD,\ndrivers/net/wireless/ath/ath11k/dp.c-455-\t\t\t\t   0, 0, DP_REO_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-467-\ndrivers/net/wireless/ath/ath11k/dp.c:468:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_status_ring, HAL_REO_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-469-\t\t\t\t   0, 0, DP_REO_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=647=static int ath11k_wbm_idle_ring_setup(struct ath11k_base *ab, u32 *n_link_desc)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-673-\ndrivers/net/wireless/ath/ath11k/dp.c:674:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_idle_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-675-\t\t\t\t   HAL_WBM_IDLE_LINK, 0, 0, *n_link_desc);\n--\ndrivers/net/wireless/ath/ath11k/dp.h=1672=void ath11k_dp_srng_cleanup(struct ath11k_base *ab, struct dp_srng *ring);\ndrivers/net/wireless/ath/ath11k/dp.h:1673:int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,\ndrivers/net/wireless/ath/ath11k/dp.h-1674-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=546=int ath11k_dp_pdev_reo_setup(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-552-\tfor (i = 0; i \u003c DP_REO_DST_RING_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:553:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-554-\t\t\t\t\t   HAL_REO_DST, i, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=570=static int ath11k_dp_rx_pdev_srng_alloc(struct ath11k *ar)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-577-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:578:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-579-\t\t\t\t   \u0026dp-\u003erx_refill_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-588-\t\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:589:\t\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-590-\t\t\t\t\t\t   \u0026dp-\u003erx_mac_buf_ring[i],\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-601-\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:602:\t\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_err_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-603-\t\t\t\t\t   HAL_RXDMA_DST, 0, dp-\u003emac_id + i,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-612-\t\tsrng = \u0026dp-\u003erx_mon_status_refill_ring[i].refill_buf_ring;\ndrivers/net/wireless/ath/ath11k/dp_rx.c:613:\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-614-\t\t\t\t\t   srng,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-635-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:636:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-637-\t\t\t\t   \u0026dp-\u003erxdma_mon_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-645-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:646:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_dst_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-647-\t\t\t\t   HAL_RXDMA_MONITOR_DST, 0, dp-\u003emac_id,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-654-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:655:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_desc_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-656-\t\t\t\t   HAL_RXDMA_MONITOR_DESC, 0, dp-\u003emac_id,\n"
}

gemini-3.1-pro-preview

							input: 6672
							output: 37
							thoughts: 832

**Analyzing the Fuzzability of the ath11k Wi-Fi Driver**

Okay, so the prompt is very specific about excluding certain code paths from being considered "worth fuzzing," particularly those requiring physical PCIe hardware not emulated in standard QEMU. My initial thought is, "Wait, ath11k is a vendor-specific PCIe Wi-Fi driver, right?" Yes, Qualcomm Atheros 802.11ax. The next question is whether it *needs* physical hardware. It seems like it does, based on my understanding.

Can I fuzz it with `mac80211_hwsim`? No, that's a separate driver, not applicable here. USB? No, no ath11k USB driver exists. AHB? Possibly, but that's SOC specific and less relevant. So, it's PCIe or AHB, which points towards the need for real hardware.

The prompt lists `mlxsw`, `pds_core`, `qed`, `ionic`, and `amdgpu` as examples of drivers that fall into this exclusion category. So, is ath11k a SmartNIC, GPU, or PCIe switch? Definitely not. But the core of the exclusion is the need for physical hardware not emulated in QEMU. Are Wi-Fi PCIe cards emulated in QEMU? No.

But syzkaller does fuzz Wi-Fi drivers, some via USB (`ath9k_htc`, `carl9170`, etc.) or `mac80211_hwsim`. Does syzkaller fuzz PCI devices in general? Yes, it does. It has a PCI fuzzer that injects PCI config and memory space. However, the prompt then states this also includes any code impossible to reach in virtualized environments like GCE or QEMU, even with emulated hardware. If ath11k is a hardware-specific driver, and it doesn't have an emulation, this makes it impossible to reach in QEMU.

But wait a minute... does syzkaller fuzz ath11k? I need to check. I seem to recall seeing syzkaller reports for ath11k bugs. Let me check my notes, and look for any recent reports.

Oh right, it looks like syzkaller *does* fuzz PCI devices using a virtual PCI device, not by emulating. The question is, does it work for all drivers, or just the simpler ones that can be probed and initialized easily? The driver doesn't need to be fully emulated. I remember this.
Then I should really check whether syzkaller actually fuzzed ath11k.
I need to check for syzkaller annotations in the kernel for ath11k.

{
  "Expression": "ath11k",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 26669 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath11k/Kconfig=2=config ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-10-\ndrivers/net/wireless/ath/ath11k/Kconfig:11:\t  If you choose to build a module, it'll be called ath11k.\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig=13=config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig:14:\ttristate \"Atheros ath11k AHB support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-15-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=20=config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig:21:\ttristate \"Atheros ath11k PCI support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-22-\tdepends on ATH11K \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=30=config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig:31:\tbool \"QCA ath11k debugging\"\ndrivers/net/wireless/ath/ath11k/Kconfig-32-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=38=config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig:39:\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-40-\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-41-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:42:\t  Enable ath11k debugfs support\ndrivers/net/wireless/ath/ath11k/Kconfig-43-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=46=config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig:47:\tbool \"ath11k tracing support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-48-\tdepends on ATH11K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-49-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:50:\t  Select this to use ath11k tracing infrastructure.\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig=52=config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig:53:\tbool \"QCA ath11k spectral scan support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-54-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-56-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:57:\t  Enable ath11k spectral scan support\ndrivers/net/wireless/ath/ath11k/Kconfig-58-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=61=config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig:62:\tbool \"ath11k channel frequency response support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-63-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-65-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:66:\t  Enable ath11k channel frequency response dump support.\ndrivers/net/wireless/ath/ath11k/Kconfig-67-\t  This option exposes debugfs nodes that will allow the user\n--\ndrivers/net/wireless/ath/ath11k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Makefile:2:obj-$(CONFIG_ATH11K) += ath11k.o\ndrivers/net/wireless/ath/ath11k/Makefile:3:ath11k-y += core.o \\\ndrivers/net/wireless/ath/ath11k/Makefile-4-\t    hal.o \\\n--\ndrivers/net/wireless/ath/ath11k/Makefile-23-\ndrivers/net/wireless/ath/ath11k/Makefile:24:ath11k-$(CONFIG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath11k/Makefile:25:ath11k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath11k/Makefile:26:ath11k-$(CONFIG_ATH11K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath11k/Makefile:27:ath11k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath11k/Makefile:28:ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath11k/Makefile:29:ath11k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath11k/Makefile:30:ath11k-$(CONFIG_DEV_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath11k/Makefile:31:ath11k-$(CONFIG_ATH11K_CFR) += cfr.o\ndrivers/net/wireless/ath/ath11k/Makefile-32-\ndrivers/net/wireless/ath/ath11k/Makefile:33:obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile:34:ath11k_ahb-y += ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-35-\ndrivers/net/wireless/ath/ath11k/Makefile:36:obj-$(CONFIG_ATH11K_PCI) += ath11k_pci.o\ndrivers/net/wireless/ath/ath11k/Makefile:37:ath11k_pci-y += mhi.o pci.o\ndrivers/net/wireless/ath/ath11k/Makefile-38-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-23-\ndrivers/net/wireless/ath/ath11k/ahb.c:24:static const struct of_device_id ath11k_ahb_of_match[] = {\ndrivers/net/wireless/ath/ath11k/ahb.c-25-\t/* TODO: Should we change the compatible string to something similar\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-42-\ndrivers/net/wireless/ath/ath11k/ahb.c:43:MODULE_DEVICE_TABLE(of, ath11k_ahb_of_match);\ndrivers/net/wireless/ath/ath11k/ahb.c-44-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=144=static int\ndrivers/net/wireless/ath/ath11k/ahb.c:145:ath11k_ahb_get_msi_irq_wcn6750(struct ath11k_base *ab, unsigned int vector)\ndrivers/net/wireless/ath/ath11k/ahb.c-146-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=150=static inline u32\ndrivers/net/wireless/ath/ath11k/ahb.c:151:ath11k_ahb_get_window_start_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-152-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=166=static void\ndrivers/net/wireless/ath/ath11k/ahb.c:167:ath11k_ahb_window_write32_wcn6750(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-168-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-171-\t/* WCN6750 uses static window based register access*/\ndrivers/net/wireless/ath/ath11k/ahb.c:172:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-173-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-177-\ndrivers/net/wireless/ath/ath11k/ahb.c:178:static u32 ath11k_ahb_window_read32_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-179-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-183-\t/* WCN6750 uses static window based register access */\ndrivers/net/wireless/ath/ath11k/ahb.c:184:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-185-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-190-\ndrivers/net/wireless/ath/ath11k/ahb.c:191:static const struct ath11k_pci_ops ath11k_ahb_pci_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c-192-\t.wakeup = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c-193-\t.release = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:194:\t.get_msi_irq = ath11k_ahb_get_msi_irq_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:195:\t.window_write32 = ath11k_ahb_window_write32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:196:\t.window_read32 = ath11k_ahb_window_read32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c-197-};\ndrivers/net/wireless/ath/ath11k/ahb.c-198-\ndrivers/net/wireless/ath/ath11k/ahb.c:199:static inline u32 ath11k_ahb_read32(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-200-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-203-\ndrivers/net/wireless/ath/ath11k/ahb.c:204:static inline void ath11k_ahb_write32(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-205-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-208-\ndrivers/net/wireless/ath/ath11k/ahb.c:209:static void ath11k_ahb_kill_tasklets(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-210-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-213-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:214:\t\tstruct ath11k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-215-\ndrivers/net/wireless/ath/ath11k/ahb.c:216:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-217-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-222-\ndrivers/net/wireless/ath/ath11k/ahb.c:223:static void ath11k_ahb_ext_grp_disable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-224-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-230-\ndrivers/net/wireless/ath/ath11k/ahb.c:231:static void __ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-232-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-235-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:236:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-237-\ndrivers/net/wireless/ath/ath11k/ahb.c:238:\t\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-239-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-247-\ndrivers/net/wireless/ath/ath11k/ahb.c:248:static void ath11k_ahb_ext_grp_enable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-249-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-255-\ndrivers/net/wireless/ath/ath11k/ahb.c:256:static void ath11k_ahb_setbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-257-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-259-\ndrivers/net/wireless/ath/ath11k/ahb.c:260:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:261:\tath11k_ahb_write32(ab, offset, val | BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-262-}\ndrivers/net/wireless/ath/ath11k/ahb.c-263-\ndrivers/net/wireless/ath/ath11k/ahb.c:264:static void ath11k_ahb_clearbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-265-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-267-\ndrivers/net/wireless/ath/ath11k/ahb.c:268:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:269:\tath11k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-270-}\ndrivers/net/wireless/ath/ath11k/ahb.c-271-\ndrivers/net/wireless/ath/ath11k/ahb.c:272:static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-273-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-283-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:284:\t\tath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-285-\ndrivers/net/wireless/ath/ath11k/ahb.c-286-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:287:\t\tath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:288:\t\tath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-289-\t\t\t\t    ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-292-\ndrivers/net/wireless/ath/ath11k/ahb.c:293:static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-294-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-304-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:305:\t\tath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-306-\ndrivers/net/wireless/ath/ath11k/ahb.c-307-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:308:\t\tath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:309:\t\tath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-310-\t\t\t\t      ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-313-\ndrivers/net/wireless/ath/ath11k/ahb.c:314:static void ath11k_ahb_sync_ce_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-315-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-319-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:320:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-321-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-327-\ndrivers/net/wireless/ath/ath11k/ahb.c:328:static void ath11k_ahb_sync_ext_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-329-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-333-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:334:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-335-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-342-\ndrivers/net/wireless/ath/ath11k/ahb.c:343:static void ath11k_ahb_ce_irqs_enable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-344-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-347-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:348:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-349-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:350:\t\tath11k_ahb_ce_irq_enable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-351-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-353-\ndrivers/net/wireless/ath/ath11k/ahb.c:354:static void ath11k_ahb_ce_irqs_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-355-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-358-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:359:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-360-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:361:\t\tath11k_ahb_ce_irq_disable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-362-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-364-\ndrivers/net/wireless/ath/ath11k/ahb.c:365:static int ath11k_ahb_start(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-366-{\ndrivers/net/wireless/ath/ath11k/ahb.c:367:\tath11k_ahb_ce_irqs_enable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:368:\tath11k_ce_rx_post_buf(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-369-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-372-\ndrivers/net/wireless/ath/ath11k/ahb.c:373:static void ath11k_ahb_ext_irq_enable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-374-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-377-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:378:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-379-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-383-\t\t}\ndrivers/net/wireless/ath/ath11k/ahb.c:384:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-385-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-387-\ndrivers/net/wireless/ath/ath11k/ahb.c:388:static void ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-389-{\ndrivers/net/wireless/ath/ath11k/ahb.c:390:\t__ath11k_ahb_ext_irq_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:391:\tath11k_ahb_sync_ext_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-392-}\ndrivers/net/wireless/ath/ath11k/ahb.c-393-\ndrivers/net/wireless/ath/ath11k/ahb.c:394:static void ath11k_ahb_stop(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-395-{\ndrivers/net/wireless/ath/ath11k/ahb.c-396-\tif (!test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ahb.c:397:\t\tath11k_ahb_ce_irqs_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:398:\tath11k_ahb_sync_ce_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:399:\tath11k_ahb_kill_tasklets(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-400-\ttimer_delete_sync(\u0026ab-\u003erx_replenish_retry);\ndrivers/net/wireless/ath/ath11k/ahb.c:401:\tath11k_ce_cleanup_pipes(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-402-}\ndrivers/net/wireless/ath/ath11k/ahb.c-403-\ndrivers/net/wireless/ath/ath11k/ahb.c:404:static int ath11k_ahb_power_up(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-405-{\ndrivers/net/wireless/ath/ath11k/ahb.c:406:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-407-\tint ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-410-\tif (ret)\ndrivers/net/wireless/ath/ath11k/ahb.c:411:\t\tath11k_err(ab, \"failed to boot the remote processor Q6\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-412-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-415-\ndrivers/net/wireless/ath/ath11k/ahb.c:416:static void ath11k_ahb_power_down(struct ath11k_base *ab, bool is_suspend)\ndrivers/net/wireless/ath/ath11k/ahb.c-417-{\ndrivers/net/wireless/ath/ath11k/ahb.c:418:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-419-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-422-\ndrivers/net/wireless/ath/ath11k/ahb.c:423:static void ath11k_ahb_init_qmi_ce_config(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-424-{\ndrivers/net/wireless/ath/ath11k/ahb.c:425:\tstruct ath11k_qmi_ce_cfg *cfg = \u0026ab-\u003eqmi.ce_cfg;\ndrivers/net/wireless/ath/ath11k/ahb.c-426-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-433-\ndrivers/net/wireless/ath/ath11k/ahb.c:434:static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-435-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-438-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:439:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-440-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-448-\ndrivers/net/wireless/ath/ath11k/ahb.c:449:static void ath11k_ahb_free_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-450-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-454-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:455:\t\treturn ath11k_pcic_free_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-456-\ndrivers/net/wireless/ath/ath11k/ahb.c-457-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:458:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-459-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-463-\ndrivers/net/wireless/ath/ath11k/ahb.c:464:\tath11k_ahb_free_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-465-}\ndrivers/net/wireless/ath/ath11k/ahb.c-466-\ndrivers/net/wireless/ath/ath11k/ahb.c:467:static void ath11k_ahb_ce_tasklet(struct tasklet_struct *t)\ndrivers/net/wireless/ath/ath11k/ahb.c-468-{\ndrivers/net/wireless/ath/ath11k/ahb.c:469:\tstruct ath11k_ce_pipe *ce_pipe = from_tasklet(ce_pipe, t, intr_tq);\ndrivers/net/wireless/ath/ath11k/ahb.c-470-\ndrivers/net/wireless/ath/ath11k/ahb.c:471:\tath11k_ce_per_engine_service(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-472-\ndrivers/net/wireless/ath/ath11k/ahb.c:473:\tath11k_ahb_ce_irq_enable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-474-}\ndrivers/net/wireless/ath/ath11k/ahb.c-475-\ndrivers/net/wireless/ath/ath11k/ahb.c:476:static irqreturn_t ath11k_ahb_ce_interrupt_handler(int irq, void *arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-477-{\ndrivers/net/wireless/ath/ath11k/ahb.c:478:\tstruct ath11k_ce_pipe *ce_pipe = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-479-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-482-\ndrivers/net/wireless/ath/ath11k/ahb.c:483:\tath11k_ahb_ce_irq_disable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-484-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-489-\ndrivers/net/wireless/ath/ath11k/ahb.c:490:static int ath11k_ahb_ext_grp_napi_poll(struct napi_struct *napi, int budget)\ndrivers/net/wireless/ath/ath11k/ahb.c-491-{\ndrivers/net/wireless/ath/ath11k/ahb.c:492:\tstruct ath11k_ext_irq_grp *irq_grp = container_of(napi,\ndrivers/net/wireless/ath/ath11k/ahb.c:493:\t\t\t\t\t\tstruct ath11k_ext_irq_grp,\ndrivers/net/wireless/ath/ath11k/ahb.c-494-\t\t\t\t\t\tnapi);\ndrivers/net/wireless/ath/ath11k/ahb.c:495:\tstruct ath11k_base *ab = irq_grp-\u003eab;\ndrivers/net/wireless/ath/ath11k/ahb.c-496-\tint work_done;\ndrivers/net/wireless/ath/ath11k/ahb.c-497-\ndrivers/net/wireless/ath/ath11k/ahb.c:498:\twork_done = ath11k_dp_service_srng(ab, irq_grp, budget);\ndrivers/net/wireless/ath/ath11k/ahb.c-499-\tif (work_done \u003c budget) {\ndrivers/net/wireless/ath/ath11k/ahb.c-500-\t\tnapi_complete_done(napi, work_done);\ndrivers/net/wireless/ath/ath11k/ahb.c:501:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-502-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-509-\ndrivers/net/wireless/ath/ath11k/ahb.c:510:static irqreturn_t ath11k_ahb_ext_interrupt_handler(int irq, void *arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-511-{\ndrivers/net/wireless/ath/ath11k/ahb.c:512:\tstruct ath11k_ext_irq_grp *irq_grp = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-513-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-516-\ndrivers/net/wireless/ath/ath11k/ahb.c:517:\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-518-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-523-\ndrivers/net/wireless/ath/ath11k/ahb.c:524:static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-525-{\ndrivers/net/wireless/ath/ath11k/ahb.c:526:\tstruct ath11k_hw_params *hw = \u0026ab-\u003ehw_params;\ndrivers/net/wireless/ath/ath11k/ahb.c-527-\tint i, j;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-531-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:532:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-533-\t\tu32 num_irq = 0;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-542-\t\tnetif_napi_add(irq_grp-\u003enapi_ndev, \u0026irq_grp-\u003enapi,\ndrivers/net/wireless/ath/ath11k/ahb.c:543:\t\t\t       ath11k_ahb_ext_grp_napi_poll);\ndrivers/net/wireless/ath/ath11k/ahb.c-544-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-568-\t\t\t\t\t\trxdma2host_destination_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:569:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-570-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-574-\t\t\t\t\t\thost2rxdma_host_buf_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:575:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-576-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-580-\t\t\t\t\t\tppdu_end_interrupts_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:581:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-582-\t\t\t\t\tirq_grp-\u003eirqs[num_irq++] =\ndrivers/net/wireless/ath/ath11k/ahb.c-583-\t\t\t\t\t\trxdma2host_monitor_status_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:584:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-585-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-596-\t\t\tirq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY);\ndrivers/net/wireless/ath/ath11k/ahb.c:597:\t\t\tret = request_irq(irq, ath11k_ahb_ext_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-598-\t\t\t\t\t  IRQF_TRIGGER_RISING,\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-600-\t\t\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:601:\t\t\t\tath11k_err(ab, \"failed request_irq for %d\\n\",\ndrivers/net/wireless/ath/ath11k/ahb.c-602-\t\t\t\t\t   irq);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-609-\ndrivers/net/wireless/ath/ath11k/ahb.c:610:static int ath11k_ahb_config_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-611-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-615-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:616:\t\treturn ath11k_pcic_config_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-617-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-619-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:620:\t\tstruct ath11k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-621-\ndrivers/net/wireless/ath/ath11k/ahb.c:622:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-623-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-626-\ndrivers/net/wireless/ath/ath11k/ahb.c:627:\t\ttasklet_setup(\u0026ce_pipe-\u003eintr_tq, ath11k_ahb_ce_tasklet);\ndrivers/net/wireless/ath/ath11k/ahb.c-628-\t\tirq = platform_get_irq_byname(ab-\u003epdev, irq_name[irq_idx]);\ndrivers/net/wireless/ath/ath11k/ahb.c:629:\t\tret = request_irq(irq, ath11k_ahb_ce_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-630-\t\t\t\t  IRQF_TRIGGER_RISING, irq_name[irq_idx],\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-638-\t/* Configure external interrupts */\ndrivers/net/wireless/ath/ath11k/ahb.c:639:\tret = ath11k_ahb_config_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-640-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-643-\ndrivers/net/wireless/ath/ath11k/ahb.c:644:static int ath11k_ahb_map_service_to_pipe(struct ath11k_base *ab, u16 service_id,\ndrivers/net/wireless/ath/ath11k/ahb.c-645-\t\t\t\t\t  u8 *ul_pipe, u8 *dl_pipe)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-686-\ndrivers/net/wireless/ath/ath11k/ahb.c:687:static int ath11k_ahb_hif_suspend(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-688-{\ndrivers/net/wireless/ath/ath11k/ahb.c:689:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-690-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-700-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:701:\t\tath11k_err(ab, \"failed to enable wakeup irq :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-702-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-712-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:713:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-714-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-716-\ndrivers/net/wireless/ath/ath11k/ahb.c:717:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device suspended\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-718-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-721-\ndrivers/net/wireless/ath/ath11k/ahb.c:722:static int ath11k_ahb_hif_resume(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-723-{\ndrivers/net/wireless/ath/ath11k/ahb.c:724:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-725-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-735-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:736:\t\tath11k_err(ab, \"failed to disable wakeup irq: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-737-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-749-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:750:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-751-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-755-\tif (ret == 0) {\ndrivers/net/wireless/ath/ath11k/ahb.c:756:\t\tath11k_warn(ab, \"timed out while waiting for wow wakeup completion\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-757-\t\treturn -ETIMEDOUT;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-759-\ndrivers/net/wireless/ath/ath11k/ahb.c:760:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device resumed\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-761-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-764-\ndrivers/net/wireless/ath/ath11k/ahb.c:765:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_ipq8074 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:766:\t.start = ath11k_ahb_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:767:\t.stop = ath11k_ahb_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:768:\t.read32 = ath11k_ahb_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:769:\t.write32 = ath11k_ahb_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-770-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:771:\t.irq_enable = ath11k_ahb_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:772:\t.irq_disable = ath11k_ahb_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:773:\t.map_service_to_pipe = ath11k_ahb_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:774:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:775:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c-776-};\ndrivers/net/wireless/ath/ath11k/ahb.c-777-\ndrivers/net/wireless/ath/ath11k/ahb.c:778:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:779:\t.start = ath11k_pcic_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:780:\t.stop = ath11k_pcic_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:781:\t.read32 = ath11k_pcic_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:782:\t.write32 = ath11k_pcic_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-783-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:784:\t.irq_enable = ath11k_pcic_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:785:\t.irq_disable = ath11k_pcic_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:786:\t.get_msi_address =  ath11k_pcic_get_msi_address,\ndrivers/net/wireless/ath/ath11k/ahb.c:787:\t.get_user_msi_vector = ath11k_pcic_get_user_msi_assignment,\ndrivers/net/wireless/ath/ath11k/ahb.c:788:\t.map_service_to_pipe = ath11k_pcic_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:789:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:790:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c:791:\t.suspend = ath11k_ahb_hif_suspend,\ndrivers/net/wireless/ath/ath11k/ahb.c:792:\t.resume = ath11k_ahb_hif_resume,\ndrivers/net/wireless/ath/ath11k/ahb.c:793:\t.ce_irq_enable = ath11k_pci_enable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c:794:\t.ce_irq_disable = ath11k_pci_disable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c-795-};\ndrivers/net/wireless/ath/ath11k/ahb.c-796-\ndrivers/net/wireless/ath/ath11k/ahb.c:797:static int ath11k_core_get_rproc(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-798-{\ndrivers/net/wireless/ath/ath11k/ahb.c:799:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-800-\tstruct device *dev = ab-\u003edev;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-804-\tif (of_property_read_u32(dev-\u003eof_node, \"qcom,rproc\", \u0026rproc_phandle)) {\ndrivers/net/wireless/ath/ath11k/ahb.c:805:\t\tath11k_err(ab, \"failed to get q6_rproc handle\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-806-\t\treturn -ENOENT;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-816-\ndrivers/net/wireless/ath/ath11k/ahb.c:817:static int ath11k_ahb_setup_msi_resources(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-818-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-826-\ndrivers/net/wireless/ath/ath11k/ahb.c:827:\tret = ath11k_pcic_init_msi_config(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-828-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:829:\t\tath11k_err(ab, \"failed to init msi config: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-830-\t\treturn ret;\n--\n\n"
}

gemini-3.1-pro-preview

							input: 23007
							output: 35
							thoughts: 378

**Fuzzing the `ath11k` Wi-Fi Driver: A Preliminary Assessment**

Okay, so I see `ath11k_ahb.c` and `ath11k_pci.c`. My initial thought is, can I leverage a virtual PCI device to fuzz this `ath11k` driver? Syzkaller *does* have a PCI fuzzer that can inject PCI configuration and memory space, so the idea has merit. But hold on, the prompt is rather specific: it mentions vendor-specific PCIe switch, SmartNIC, or GPU drivers. Things like `mlxsw`, `pds_core`, `qed`, `ionic`, and `amdgpu`.

Is `ath11k` a SmartNIC, GPU, or PCIe switch? No, it's a Wi-Fi driver, so at face value, it might not be relevant. But does it *require* physical hardware? Yes, it depends on a Qualcomm Atheros 802.11ax device, so a physical card is needed.

The prompt, however, *does* use "e.g., ...", so there might be a grey area here, because it does not explicitly mention Wi-Fi drivers, but Wi-Fi drivers that require physical PCIe hardware cards not emulated in standard QEMU are similar to the cases mentioned.

Okay, so Syzkaller *does* fuzz Wi-Fi drivers, but through `mac80211_hwsim`. But `ath11k` is a hardware driver, which is different. Syzkaller has functions like `syz_80211_inject_frame` and the like, but those are for `mac80211_hwsim`, which I don't think would apply here.

So, *does* Syzkaller fuzz `ath11k` at all?

Let me check. I need to look for any syzkaller annotations within the `ath11k` codebase itself. I'll search the `drivers/net/wireless/ath/ath11k/` directory for "syzkaller" or "syz" and see what comes up.

{
  "Expression": "syz",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 23898
							output: 34
							thoughts: 459

**My Reasoning on Fuzzing Ath11k**

Okay, so I'm looking at this and thinking, "No dice, no immediate matches." But wait, didn't I see something about syzkaller having a PCI fuzzer? Could it fuzz the ath11k driver? I need to check. Ideally, I'd search syzkaller reports for "ath11k," but, in this scenario, I can't. Hmm, can I even *reach* ath11k in a QEMU environment?

The prompt just brought up a crucial point: "Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware." Okay, so is ath11k reachable in standard QEMU? No, QEMU doesn't emulate the necessary Qualcomm Atheros 802.11ax hardware.

Now, let's circle back to that PCI fuzzing angle. Syzkaller's PCI fuzzer *simulates* PCI devices, right? It either hooks into the PCI subsystem directly or uses something like `vfio` or `pci-stub`? Actually, no, syzkaller uses a custom PCI device in QEMU or injects via `syz_pci_device`. If syzkaller's PCI fuzzer can hit it, then it *is* reachable.

But the prompt states quite explicitly: "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU." This seems to be the critical distinction. Those drivers, requiring physical hardware not emulated, should be marked as WorthFuzzing=false.

Is ath11k a *vendor-specific* PCIe driver? Yes, it's Qualcomm Atheros, absolutely. Does it *require* physical hardware? Yes, it does. Is it emulated in standard QEMU? No. So, it *appears* to fall squarely into that "WorthFuzzing=false" category.

Hold on, what about USB? I know USB drivers can be fuzzed through USB gadget (dummy_hcd). But, ath11k is PCI, also AHB... I should check, though, if ath11k even has any USB support.

{
  "Expression": "usb",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 24923
							output: 44
							thoughts: 763

**Analyzing the WorthFuzzing Status of an ath11k Patch**

Okay, first things first, no USB support is relevant here, so let's set that aside. I'm focusing on this `ath11k` driver fix, and my initial thought was that it deals with AHB, which is normally an SoC internal bus and not something emulated in standard QEMU. If it needed a specific SoC like IPQ8074, that would be a problem. But, I need to look closer at the code.

Alright, the patch I'm examining is in `ath11k_dp_srng_setup`. Ah, it's a simple fix. It cleans up the SRNG if `ath11k_hal_srng_setup` fails. This looks like it's addressing a memory leak or a similar issue. The original instructions suggest that since `ath11k` is a hardware-specific driver, one that *requires* physical PCIe/AHB hardware not emulated by standard QEMU, this should be considered `WorthFuzzing=false`. That seems logical at first glance.

But wait, I need to double-check something. *Does* syzkaller actually fuzz `ath11k`? This is critical! Let's see... Ah, the commit message: "Author: syz-cluster <triage@syzkaller.com>". Hold on! "syz-cluster" is the author! That means syzkaller did find a bug here! How is this even possible?

Okay, the pieces are falling into place! Syzkaller has a PCI fuzzer. It *can* fuzz ANY PCI driver by simulating PCI devices! Aha! If syzkaller found a bug in `ath11k`, that means this code *must* be reachable within syzkaller's environment. I need to confirm how syzkaller approaches this.

Let me check. Does syzkaller use a virtual PCI device to fuzz `ath11k`? Yes, syzkaller's `syz_pci_device` or a similar tool can probe *any* PCI driver by matching vendor/device IDs and then fuzzing the MMIO/PIO/DMA accesses.

The original prompt talks about "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU". This gives me pause. Is `ath11k` a SmartNIC, a GPU, or a PCIe switch? No, it's a WLAN driver. But did the prompt mean *all* vendor-specific PCIe drivers?

If syzkaller is finding bugs, then it means these parts *are* reachable. The wording is important. It highlights vendor-specific code that requires physical cards. I see now! The key is that syzkaller *fakes* the PCI device! It presents the vendor/device ID, the kernel probes the driver, and the driver maps BARs. Then, when the driver reads from those BARs, the PCI fuzzer provides fuzzed values!

This means the driver's initialization code – the probe, setup functions, etc. – IS reachable and heavily fuzzed by syzkaller. The initial setup, like `ath11k_dp_srng_setup`, is likely called during the probe. I need to verify that.

{
  "Expression": "ath11k_dp_srng_setup",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/dbring.c=237=int ath11k_dbring_srng_setup(struct ath11k *ar, struct ath11k_dbring *ring,\n--\ndrivers/net/wireless/ath/ath11k/dbring.c-241-\ndrivers/net/wireless/ath/ath11k/dbring.c:242:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026ring-\u003erefill_srng, HAL_RXDMA_DIR_BUF,\ndrivers/net/wireless/ath/ath11k/dbring.c-243-\t\t\t\t   ring_num, ar-\u003epdev_idx, num_entries);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=181=static void ath11k_dp_srng_msi_setup(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-220-\ndrivers/net/wireless/ath/ath11k/dp.c:221:int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,\ndrivers/net/wireless/ath/ath11k/dp.c-222-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp.c=371=static int ath11k_dp_srng_common_setup(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-377-\ndrivers/net/wireless/ath/ath11k/dp.c:378:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_desc_rel_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-379-\t\t\t\t   HAL_SW2WBM_RELEASE, 0, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-386-\ndrivers/net/wireless/ath/ath11k/dp.c:387:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_cmd_ring, HAL_TCL_CMD, 0, 0,\ndrivers/net/wireless/ath/ath11k/dp.c-388-\t\t\t\t   DP_TCL_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-393-\ndrivers/net/wireless/ath/ath11k/dp.c:394:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etcl_status_ring, HAL_TCL_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-395-\t\t\t\t   0, 0, DP_TCL_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-404-\ndrivers/net/wireless/ath/ath11k/dp.c:405:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_data_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-406-\t\t\t\t\t   HAL_TCL_DATA, tcl_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-413-\ndrivers/net/wireless/ath/ath11k/dp.c:414:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003etx_ring[i].tcl_comp_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-415-\t\t\t\t\t   HAL_WBM2SW_RELEASE, wbm_num, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp.c-430-\ndrivers/net/wireless/ath/ath11k/dp.c:431:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_reinject_ring, HAL_REO_REINJECT,\ndrivers/net/wireless/ath/ath11k/dp.c-432-\t\t\t\t   0, 0, DP_REO_REINJECT_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-438-\ndrivers/net/wireless/ath/ath11k/dp.c:439:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003erx_rel_ring, HAL_WBM2SW_RELEASE,\ndrivers/net/wireless/ath/ath11k/dp.c-440-\t\t\t\t   DP_RX_RELEASE_RING_NUM, 0, DP_RX_RELEASE_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-445-\ndrivers/net/wireless/ath/ath11k/dp.c:446:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_except_ring, HAL_REO_EXCEPTION,\ndrivers/net/wireless/ath/ath11k/dp.c-447-\t\t\t\t   0, 0, DP_REO_EXCEPTION_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-453-\ndrivers/net/wireless/ath/ath11k/dp.c:454:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_cmd_ring, HAL_REO_CMD,\ndrivers/net/wireless/ath/ath11k/dp.c-455-\t\t\t\t   0, 0, DP_REO_CMD_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c-467-\ndrivers/net/wireless/ath/ath11k/dp.c:468:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_status_ring, HAL_REO_STATUS,\ndrivers/net/wireless/ath/ath11k/dp.c-469-\t\t\t\t   0, 0, DP_REO_STATUS_RING_SIZE);\n--\ndrivers/net/wireless/ath/ath11k/dp.c=647=static int ath11k_wbm_idle_ring_setup(struct ath11k_base *ab, u32 *n_link_desc)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-673-\ndrivers/net/wireless/ath/ath11k/dp.c:674:\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ewbm_idle_ring,\ndrivers/net/wireless/ath/ath11k/dp.c-675-\t\t\t\t   HAL_WBM_IDLE_LINK, 0, 0, *n_link_desc);\n--\ndrivers/net/wireless/ath/ath11k/dp.h=1672=void ath11k_dp_srng_cleanup(struct ath11k_base *ab, struct dp_srng *ring);\ndrivers/net/wireless/ath/ath11k/dp.h:1673:int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,\ndrivers/net/wireless/ath/ath11k/dp.h-1674-\t\t\t enum hal_ring_type type, int ring_num,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=546=int ath11k_dp_pdev_reo_setup(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-552-\tfor (i = 0; i \u003c DP_REO_DST_RING_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:553:\t\tret = ath11k_dp_srng_setup(ab, \u0026dp-\u003ereo_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-554-\t\t\t\t\t   HAL_REO_DST, i, 0,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c=570=static int ath11k_dp_rx_pdev_srng_alloc(struct ath11k *ar)\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-577-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:578:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-579-\t\t\t\t   \u0026dp-\u003erx_refill_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-588-\t\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:589:\t\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-590-\t\t\t\t\t\t   \u0026dp-\u003erx_mac_buf_ring[i],\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-601-\tfor (i = 0; i \u003c ab-\u003ehw_params.num_rxdma_per_pdev; i++) {\ndrivers/net/wireless/ath/ath11k/dp_rx.c:602:\t\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_err_dst_ring[i],\ndrivers/net/wireless/ath/ath11k/dp_rx.c-603-\t\t\t\t\t   HAL_RXDMA_DST, 0, dp-\u003emac_id + i,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-612-\t\tsrng = \u0026dp-\u003erx_mon_status_refill_ring[i].refill_buf_ring;\ndrivers/net/wireless/ath/ath11k/dp_rx.c:613:\t\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-614-\t\t\t\t\t   srng,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-635-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:636:\tret = ath11k_dp_srng_setup(ar-\u003eab,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-637-\t\t\t\t   \u0026dp-\u003erxdma_mon_buf_ring.refill_buf_ring,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-645-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:646:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_dst_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-647-\t\t\t\t   HAL_RXDMA_MONITOR_DST, 0, dp-\u003emac_id,\n--\ndrivers/net/wireless/ath/ath11k/dp_rx.c-654-\ndrivers/net/wireless/ath/ath11k/dp_rx.c:655:\tret = ath11k_dp_srng_setup(ar-\u003eab, \u0026dp-\u003erxdma_mon_desc_ring,\ndrivers/net/wireless/ath/ath11k/dp_rx.c-656-\t\t\t\t   HAL_RXDMA_MONITOR_DESC, 0, dp-\u003emac_id,\n"
}

gemini-3.1-pro-preview

							input: 29536
							output: 93
							thoughts: 2042

**My Analysis of the Patch's Fuzzing Worthiness**

Okay, here's my thought process on this. I'm looking at these functions: `ath11k_dp_srng_common_setup`, `ath11k_dp_pdev_reo_setup`, `ath11k_dp_rx_pdev_srng_alloc`. These are initialization functions, and the fact that syzkaller's PCI fuzzer can trigger them is what's making this tricky. The core question is whether or not this patch is worth fuzzing, based on the provided prompt instructions.

The prompt specifically says to return `WorthFuzzing=false` if the patch only includes code that falls into certain categories. The key one here is: "Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers... that require physical PCIe hardware cards not emulated in standard QEMU."

My initial thought is to compare `ath11k` to those exclusion cases. Is `ath11k` a vendor-specific PCIe driver? Yes, it is. Does it require specific hardware? Absolutely; it's a Wi-Fi driver, so it needs Qualcomm Atheros hardware. And does QEMU emulate that? Nope, not even close. So, on the face of it, it looks like `WorthFuzzing=false`.

However, syzkaller *can* reach it via PCI fuzzing. That seems contradictory. But the prompt explicitly mentions that this kind of access is what *should* be excluded, because it leads to shallow coverage or false positives, as the fuzzer doesn't understand the complex state machine of the device.

Now, let's carefully go through the wording again. Is `ath11k` a "PCIe switch, SmartNIC, or GPU"? No, it's a Wi-Fi driver. That said, it *is* a vendor-specific PCIe driver that needs actual hardware. So, am I being too narrow by getting hung up on "PCIe switch, SmartNIC, or GPU" in the exclusion list? Is the intent to exclude any vendor-specific PCIe device?

The prompt also says to return `WorthFuzzing=false` for "Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware". Now, since `ath11k` is not emulated by mac80211_hwsim or QEMU, it's virtually impossible to reach in standard QEMU. That matches. The only way it is reached is through syzkaller's PCI fuzzer.

The core of the issue: if syzkaller found this, then *should* I ignore the prompt? Is the prompt saying I should exclude this *even if* syzkaller finds it? Yes, I believe that is the case.

The fact the driver is vendor-specific and depends on physical hardware not emulated in QEMU is the core reason for the exclusion. The logic *within* the driver, especially the initialization parts being touched here ( `ath11k_dp_srng_setup` ) are functionally inaccessible in a virtualized environment. Even if the fuzzer gets a "hit", it's the equivalent of random reads in MMIO space, which the prompt asks to exclude. I'm going to return `WorthFuzzing=false`.

Specifically, since the patch fixes the error path of `ath11k_dp_srng_setup`, but `ath11k_dp_srng_setup` is functionally inaccessible in a virtualized environment, I still think this should be excluded.

**Final Decision**

* `WorthFuzzing`: `false`
* Reasoning: The patch modifies the `ath11k` driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this hardware is not emulated in standard QEMU, the code paths are impossible to reach and functionally test in virtualized environments. The prompt specifically instructs to exclude vendor-specific PCIe drivers that require physical hardware not emulated in QEMU, and this patch falls under that category, even if syzkaller can trigger some of the code.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath11k driver, which is a hardware-specific PCIe/AHB Wi-Fi driver for Qualcomm Atheros devices. Since this physical hardware is not emulated in standard QEMU, the driver's code paths are impossible to reach and functionally test in virtualized environments.",
  "WorthFuzzing": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)