AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/07/30 07:49	flow	patch-triage	1m Args: null Results: { "EnableConfigs": [ "ZD1211RW", "MAC80211", "USB" ], "FocusSymbols": [ "zd_mac_alloc_hw" ], "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).", "WorthFuzzing": true }
1/1	2026/07/30 07:49	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 8747faa29a4f22bb799381e1bc0ae618a9e7b6e5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jul 30 07:49:15 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c\nindex 966d8ccb0dbcd..98102c663434b 100644\n--- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c\n+++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c\n@@ -1353,6 +1353,14 @@ static int probe(struct usb_interface intf, const struct usb_device_id id)\n \tstruct zd_usb usb;\n \tstruct ieee80211_hw hw = NULL;\n \n+\t/\n+\t ZD1211 devices are single-function. Reject secondary interfaces\n+\t * to prevent multiple instances from conflicting on hardcoded endpoints\n+\t * and triggering recursive locking warnings.\n+\t */\n+\tif (intf-\u003ecur_altsetting-\u003edesc.bInterfaceNumber != 0)\n+\t\treturn -ENODEV;\n+\n \tprint_id(udev);\n \n \tif (id-\u003edriver_info \u0026 DEVICE_INSTALLER)\n" }
2/1	2026/07/30 07:49	agent	patch-evaluator	1m Model: best-expensive Args: null Results: { "EnableConfigs": [ "ZD1211RW", "MAC80211", "USB" ], "FocusSymbols": [ "zd_mac_alloc_hw" ], "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 8747faa29a4f22bb799381e1bc0ae618a9e7b6e5 Author: syz-cluster <triage@syzkaller.com> Date: Thu Jul 30 07:49:15 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c index 966d8ccb0dbcd..98102c663434b 100644 --- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c +++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c @@ -1353,6 +1353,14 @@ static int probe(struct usb_interface intf, const struct usb_device_id id) struct zd_usb usb; struct ieee80211_hw hw = NULL; + /* + * ZD1211 devices are single-function. Reject secondary interfaces + * to prevent multiple instances from conflicting on hardcoded endpoints + * and triggering recursive locking warnings. + */ + if (intf->cur_altsetting->desc.bInterfaceNumber != 0) + return -ENODEV; + print_id(udev); if (id->driver_info & DEVICE_INSTALLER)
3/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2158 output: 47 thoughts: 136 Thoughts: Fuzzing Target: zd1211rw USB Wireless Driver Okay, so there's a new patch in `drivers/net/wireless/zydas/zd1211rw/zd_usb.c` that's making a functional change. It seems they've added a check within the `probe` function, specifically rejecting secondary interfaces (`intf->cur_altsetting->desc.bInterfaceNumber != 0`). That's interesting, and immediately triggers some thoughts about fuzzing. This `zd1211rw` driver is for USB wireless, which means it should be pretty accessible for fuzzing. Since we can emulate USB devices using gadgets or `dummy_hcd`, and syzkaller supports USB fuzzing, this is definitely reachable. This is a solid candidate for some in-depth fuzzing. My first thought is to check the Kconfig for `zd1211rw` to get more context and figure out how to best target it.
4/2	2026/07/30 07:49	tool	grepper	0m Args: { "Expression": "config ZD1211RW", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/Kconfig" } Results: { "Output": "drivers/net/wireless/zydas/zd1211rw/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/zydas/zd1211rw/Kconfig:2:config ZD1211RW\ndrivers/net/wireless/zydas/zd1211rw/Kconfig-3-\ttristate \"ZyDAS ZD1211/ZD1211B USB-wireless support\"\n--\ndrivers/net/wireless/zydas/zd1211rw/Kconfig-12-\ndrivers/net/wireless/zydas/zd1211rw/Kconfig:13:config ZD1211RW_DEBUG\ndrivers/net/wireless/zydas/zd1211rw/Kconfig-14-\tbool \"ZyDAS ZD1211 debugging\"\n" }
5/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2776 output: 45 thoughts: 15 Thoughts: Here's my thought process, summarized as you requested: Assessing ZD1211RW Dependencies Okay, so the initial prompt involves ZD1211RW. Immediately, my mind jumps to the need to understand its dependencies. Before I even consider anything else about the ZD1211RW, I need a clear picture of what other components, libraries, or systems it relies on. This is a crucial first step in any analysis. I need to know the potential ripple effects if I'm going to modify it, troubleshoot it, or even just assess its current state. I need to identify its direct and indirect dependencies. What modules call it, what does it call? What are the implications of those dependencies? This investigation is critical.
6/2	2026/07/30 07:49	tool	read-file	0m Args: { "File": "drivers/net/wireless/zydas/zd1211rw/Kconfig", "FirstLine": 1, "LineCount": 20 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\tconfig ZD1211RW\n 3:\t\ttristate \"ZyDAS ZD1211/ZD1211B USB-wireless support\"\n 4:\t\tdepends on USB \u0026\u0026 MAC80211\n 5:\t\tselect FW_LOADER\n 6:\t\thelp\n 7:\t\t This is a driver for the ZyDAS ZD1211/ZD1211B wireless\n 8:\t\t chip, present in many USB-wireless adapters.\n 9:\t\n 10:\t\t Device firmware is required alongside this driver. You can download\n 11:\t\t the firmware distribution from http://sf.net/projects/zd1211/files/\n 12:\t\n 13:\tconfig ZD1211RW_DEBUG\n 14:\t\tbool \"ZyDAS ZD1211 debugging\"\n 15:\t\tdepends on ZD1211RW\n 16:\t\thelp\n 17:\t\t ZD1211 debugging messages. Choosing Y will result in additional debug\n 18:\t\t messages being saved to your kernel logs, which may help debug any\n 19:\t\t problems.\n 20:\t\n" }
7/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3314 output: 45 thoughts: 83 Thoughts: Analyzing the ZD1211RW Driver Okay, let's break this down. It looks like I'm dealing with the `ZD1211RW` driver, specifically its USB implementation, since the dependencies listed are `USB` and `MAC80211`. Right, so I need to enable the `ZD1211RW` configuration. Now, it looks like a function within the driver is being modified, specifically the `probe` function. The file path points me to `drivers/net/wireless/zydas/zd1211rw/zd_usb.c`, which makes sense. I have a hunch it's a static function, let me just double-check the code real quick and verify its declaration.
8/2	2026/07/30 07:49	tool	grepper	0m Args: { "Expression": "static int probe", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c" } Results: { "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1317=int zd_usb_init_hw(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1348-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1349:static int probe(struct usb_interface intf, const struct usb_device_id *id)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1350-{\n" }
9/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3773 output: 48 thoughts: 44 Thoughts: Analyzing the USB Driver Probe Function Okay, so I'm looking at this `probe` function. The code tells me it's a `static` function, which immediately clues me in to its purpose: it's likely a callback function used within the `struct usb_driver` structure. My next thought is to figure out the exact naming conventions of this structure. I need to understand the larger context to understand the `probe` function's role in the USB device driver architecture. Knowing the structure's name is the crucial first step.
10/2	2026/07/30 07:49	tool	grepper	0m Args: { "Expression": "struct usb_driver .=", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c" } Results:* { "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1517=static int post_reset(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1535-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1536:static struct usb_driver driver = {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1537-\t.name\t\t= KBUILD_MODNAME,\n" }
11/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4143 output: 51 thoughts: 130 Thoughts: Analyzing the USB Driver Entry Point Okay, so I'm looking at this `driver` code. My initial thought is to just focus on that, but wait… the `probe` function is potentially problematic as a focus symbol, especially if it's static and called `probe`. We need something less generic. Let's see. I need to scan `zd_usb.c` and look for any other non-static functions that might be a better entry point, or perhaps `zd_usb_init_hw` would be more appropriate? Ah, right. The `probe` function is, in fact, the standard entry point for USB device probing. It would be silly to discount it. Alright, a quick check… is `probe` the only function that's been modified? Yes, that answers that. So, since I seem to be stuck on `probe`, are there any related functions around it in `zd_usb.c` that might provide more context or insights? Let's take a look at the surrounding code to see what's happening.
12/2	2026/07/30 07:49	tool	read-file	0m Args: { "File": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c", "FirstLine": 1340, "LineCount": 50 } Results: { "Contents": "1340:\t\t\tdev_dbg_f(zd_usb_dev(usb),\n1341:\t\t\t \"couldn't initialize mac. Error number %d\\n\", r);\n1342:\t\t\treturn r;\n1343:\t\t}\n1344:\t\n1345:\t\tusb-\u003einitialized = 1;\n1346:\t\treturn 0;\n1347:\t}\n1348:\t\n1349:\tstatic int probe(struct usb_interface intf, const struct usb_device_id id)\n1350:\t{\n1351:\t\tint r;\n1352:\t\tstruct usb_device udev = interface_to_usbdev(intf);\n1353:\t\tstruct zd_usb usb;\n1354:\t\tstruct ieee80211_hw hw = NULL;\n1355:\t\n1356:\t\t/\n1357:\t\t * ZD1211 devices are single-function. Reject secondary interfaces\n1358:\t\t * to prevent multiple instances from conflicting on hardcoded endpoints\n1359:\t\t * and triggering recursive locking warnings.\n1360:\t\t */\n1361:\t\tif (intf-\u003ecur_altsetting-\u003edesc.bInterfaceNumber != 0)\n1362:\t\t\treturn -ENODEV;\n1363:\t\n1364:\t\tprint_id(udev);\n1365:\t\n1366:\t\tif (id-\u003edriver_info \u0026 DEVICE_INSTALLER)\n1367:\t\t\treturn eject_installer(intf);\n1368:\t\n1369:\t\tswitch (udev-\u003espeed) {\n1370:\t\tcase USB_SPEED_LOW:\n1371:\t\tcase USB_SPEED_FULL:\n1372:\t\tcase USB_SPEED_HIGH:\n1373:\t\t\tbreak;\n1374:\t\tdefault:\n1375:\t\t\tdev_dbg_f(\u0026intf-\u003edev, \"Unknown USB speed\\n\");\n1376:\t\t\tr = -ENODEV;\n1377:\t\t\tgoto error;\n1378:\t\t}\n1379:\t\n1380:\t\tr = usb_reset_device(udev);\n1381:\t\tif (r) {\n1382:\t\t\tdev_err(\u0026intf-\u003edev,\n1383:\t\t\t\t\"couldn't reset usb device. Error number %d\\n\", r);\n1384:\t\t\tgoto error;\n1385:\t\t}\n1386:\t\n1387:\t\thw = zd_mac_alloc_hw(intf);\n1388:\t\tif (hw == NULL) {\n1389:\t\t\tr = -ENOMEM;\n" }
13/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 5254 output: 51 thoughts: 47 Thoughts: Analyzing the Driver Probe Function Okay, so the `probe` function is defined as `static`, which means it's internal to this driver file. It's the primary entry point for the probing process, but the fact that it's static is potentially limiting. I need to see if there's an alternative to it. Hmm, let me scroll to the end of `zd_usb.c`. Perhaps there's a non-static function exposed that I can utilize instead. Gotta be thorough.
14/2	2026/07/30 07:49	tool	read-file	0m Args: { "File": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c", "FirstLine": 1530, "LineCount": 50 } Results: { "Contents": "1530:\t\n1531:\t\tif (usb-\u003ewas_running)\n1532:\t\t\tzd_usb_resume(usb);\n1533:\t\treturn 0;\n1534:\t}\n1535:\t\n1536:\tstatic struct usb_driver driver = {\n1537:\t\t.name\t\t= KBUILD_MODNAME,\n1538:\t\t.id_table\t= usb_ids,\n1539:\t\t.probe\t\t= probe,\n1540:\t\t.disconnect\t= disconnect,\n1541:\t\t.pre_reset\t= pre_reset,\n1542:\t\t.post_reset\t= post_reset,\n1543:\t\t.disable_hub_initiated_lpm = 1,\n1544:\t};\n1545:\t\n1546:\tstruct workqueue_struct *zd_workqueue;\n1547:\t\n1548:\tstatic int __init usb_init(void)\n1549:\t{\n1550:\t\tint r;\n1551:\t\n1552:\t\tpr_debug(\"%s usb_init()\\n\", driver.name);\n1553:\t\n1554:\t\tzd_workqueue = create_singlethread_workqueue(driver.name);\n1555:\t\tif (zd_workqueue == NULL) {\n1556:\t\t\tpr_err(\"%s couldn't create workqueue\\n\", driver.name);\n1557:\t\t\treturn -ENOMEM;\n1558:\t\t}\n1559:\t\n1560:\t\tr = usb_register(\u0026driver);\n1561:\t\tif (r) {\n1562:\t\t\tdestroy_workqueue(zd_workqueue);\n1563:\t\t\tpr_err(\"%s usb_register() failed. Error number %d\\n\",\n1564:\t\t\t driver.name, r);\n1565:\t\t\treturn r;\n1566:\t\t}\n1567:\t\n1568:\t\tpr_debug(\"%s initialized\\n\", driver.name);\n1569:\t\treturn 0;\n1570:\t}\n1571:\t\n1572:\tstatic void __exit usb_exit(void)\n1573:\t{\n1574:\t\tpr_debug(\"%s usb_exit()\\n\", driver.name);\n1575:\t\tusb_deregister(\u0026driver);\n1576:\t\tdestroy_workqueue(zd_workqueue);\n1577:\t}\n1578:\t\n1579:\tmodule_init(usb_init);\n" }
15/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6131 output: 44 thoughts: 89 Thoughts: Okay, here's my breakdown of this. Navigating the Driver Initialization Right, so I'm digging into this driver code. The core of it seems to be initialized with `usb_register(&driver)`. That's standard USB driver stuff. Now, I'm trying to trace the initialization sequence and get a handle on the key functions. Okay, so `probe` is marked as `static` which gives me pause. That makes it harder to jump to from outside the file. Perhaps I should focus my attention on `probe` itself, or `zd_mac_alloc_hw`, or `zd_usb_init_hw`? Let me see. Ah, wait a minute, `zd_mac_alloc_hw` is called from `probe`. So, that's key. It's likely involved with actual hardware initialization, and if it's called from probe, I need to understand that. Let's see if `zd_mac_alloc_hw` is static - that would make this harder to test or debug outside of the `probe` context.
16/2	2026/07/30 07:49	tool	grepper	0m Args: { "Expression": "zd_mac_alloc_hw", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/" } Results: { "Output": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c=1348=static const struct ieee80211_ops zd_ops = {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-1365-\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c:1366:struct ieee80211_hw zd_mac_alloc_hw(struct usb_interface intf)\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-1367-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h=288=static inline u8 zd_mac_get_perm_addr(struct zd_mac mac)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h-294-\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h:295:struct ieee80211_hw zd_mac_alloc_hw(struct usb_interface intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h-296-void zd_mac_clear(struct zd_mac mac);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1349=static int probe(struct usb_interface intf, const struct usb_device_id *id)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1386-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1387:\thw = zd_mac_alloc_hw(intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1388-\tif (hw == NULL) {\n" }
17/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7013 output: 44 thoughts: 47 Thoughts: Okay, here's my take on those thoughts, framed as a first-person expert summary: Identifying Potential Focus Symbols in the Kernel Module Right, so I'm looking at this kernel module, and my initial thought is that `zd_mac_alloc_hw` seems like a solid candidate for a focus symbol. The key thing is that it's not static, which immediately makes it a viable target for symbolic analysis. The whole point is to find things that the linker can see from outside the file. That's good. Hmm, while I'm at it, I should quickly check `zd_usb_init_hw`. It has a similar naming convention, and that might also be a non-static function that we could use to get a handle on this particular piece of code. I'll need to confirm if it's visible, but it's worth checking right away. Let's see...
18/2	2026/07/30 07:49	tool	grepper	0m Args: { "Expression": "zd_usb_init_hw", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/" } Results: { "Output": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c=269=int zd_op_start(struct ieee80211_hw hw)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-276-\tif (!usb-\u003einitialized) {\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c:277:\t\tr = zd_usb_init_hw(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-278-\t\tif (r)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h=235=void zd_usb_init(struct zd_usb usb, struct ieee80211_hw hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-236-\t struct usb_interface intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h:237:int zd_usb_init_hw(struct zd_usb usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-238-void zd_usb_clear(struct zd_usb usb);\n" }
19/2	2026/07/30 07:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7804 output: 47 thoughts: 470 Thoughts: Analyzing the Patch's Impact and Fuzzing Strategy Okay, so I'm digging into this patch. I see that `zd_usb_init_hw` and `zd_usb_init` are non-static functions, which is good. But the actual modified function is `probe`. The patch is adding a check to reject secondary interfaces within `probe`. My initial thought was to jump to `zd_mac_alloc_hw` since it's called right after the check. Hold on, let me break this down further. The check itself is this: `if (intf->cur_altsetting->desc.bInterfaceNumber != 0) return -ENODEV;`. If we want to focus specifically on testing that check, I can't really prioritize a function called after the check, unless it's to ensure the execution path is taken. Now, `probe` is static, which is a consideration. I need to keep in mind the instructions: avoid generic hot-path functions and prefer non-static, non-inlined API entrypoints. That static-ness throws a wrench into the works. Is `probe` inlined? It's used as a function pointer in `struct usb_driver`, so the compiler won't be able to inline it, and it definitely has a distinct symbol address. However, the name `probe` is incredibly generic. The fuzzer might get confused with other similarly named functions if it relies on name matching, which is not ideal. So, here's my revised strategy. `zd_mac_alloc_hw` is non-static, called from `probe`, and is specific to this driver's functionality. It's a much better proxy for fuzzing the execution path I'm interested in, which is the code after the interface check passes. I'll use it as the `FocusSymbol`. It's a unique non-static function called from `probe`. I also know `zd_usb_init` is called from `probe`. I should probably make sure it's called from probe as well.
20/2	2026/07/30 07:50	tool	grepper	0m Args: { "Expression": "zd_usb_init", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c" } Results: { "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb usb, struct ieee80211_hw hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\n" }
21/2	2026/07/30 07:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9102 output: 47 thoughts: 18 Thoughts: Okay, here's my summary, taking the perspective of someone deeply familiar with embedded systems and driver development, focusing on the specific function and context provided. Analyzing Driver Initialization in the Probe Function Alright, let me quickly run through this in my head. I need to figure out exactly how this USB device driver is initialized. The question at hand is whether the `zd_usb_init` function is called directly from within the `probe` function. This is critical for understanding the driver's instantiation sequence. If `zd_usb_init` is called from `probe`, it indicates a direct, synchronous initialization. That implies a specific timing relationship, and will probably involve specific hardware register settings in the probe function. The implication is also that if the probe function fails then `zd_usb_init` will not be called. Alternatively, it might be called asynchronously, perhaps later on in a workqueue or in a dedicated thread triggered by some other event. I need to trace the call graph to be certain. Knowing this is the first crucial step in understanding the device's setup and how it integrates with the USB stack.
22/2	2026/07/30 07:50	tool	grepper	0m Args: { "Expression": "zd_usb_init", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c" } Results: { "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb usb, struct ieee80211_hw hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\n" }
23/2	2026/07/30 07:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9732 output: 43 thoughts: 17 Thoughts: Here's my thought process, summarized as you requested: Tracing the Execution Path Okay, I need to understand the execution flow that leads to `zd_usb_init`. That function is crucial, but without knowing where it's triggered, its purpose is going to be opaque. I need to find all the places in the codebase where `zd_usb_init` is invoked. From there, I can reverse engineer the flow and figure out its context. Knowing the call sites will be critical to grasping the bigger picture. Let's start the search...
24/2	2026/07/30 07:50	tool	grepper	0m Args: { "Expression": "zd_usb_init\\(", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/" } Results: { "Output": "drivers/net/wireless/zydas/zd1211rw/zd_chip.c=22=void zd_chip_init(struct zd_chip chip,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_chip.c-27-\tmutex_init(\u0026chip-\u003emutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_chip.c:28:\tzd_usb_init(\u0026chip-\u003eusb, hw, intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_chip.c-29-\tzd_rf_init(\u0026chip-\u003erf);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb usb, struct ieee80211_hw hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h=230=static inline struct ieee80211_hw zd_usb_to_hw(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-234-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h:235:void zd_usb_init(struct zd_usb usb, struct ieee80211_hw hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-236-\t struct usb_interface intf);\n" }
25/2	2026/07/30 07:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10436 output: 46 thoughts: 599 Thoughts: My Analysis of the ZyDAS ZD1211/ZD1211B USB-Wireless Driver Patch Okay, let's break this down. First, this patch is called from `zd_chip_init`. The critical symbol here seems to be `zd_mac_alloc_hw`. I checked where it's called, and it's directly called from `probe`. So, `zd_mac_alloc_hw` is a strong candidate for a focus symbol. Now, let's verify the necessary configurations. The Kconfig file states that we need `ZD1211RW`, `USB`, and `MAC80211`. `USB` and `MAC80211` are standard subsystems, but we should include them anyway, or just `ZD1211RW`, as per the instructions to ensure everything compiles statically. The instruction also said to list any parent subsystems, so, definitely include `MAC80211` and `USB`. Thus, our EnableConfigs should be `ZD1211RW`, `MAC80211`, and `USB`. Ah, the patch itself. It's a functional change. It prevents multiple interfaces on the same device from conflicting due to hardcoded endpoints. The code rejects secondary interfaces (`bInterfaceNumber != 0`) and returns `-ENODEV`. This is reachable through USB fuzzing, a potential vulnerability, so it's WorthFuzzing. My initial FocusSymbols: `zd_mac_alloc_hw`. EnableConfigs: `ZD1211RW`, `MAC80211`, `USB`. Let's double-check the focus symbol. Should we consider `zd_usb_init_hw`? No, because `zd_usb_init_hw` is called from `zd_op_start` and this is a mac80211 callback. The bug lies in `probe`, so, focusing on `zd_mac_alloc_hw` which is directly called from `probe` seems optimal because it's within the relevant execution path. Now, let me just quickly scan `zd_usb.c` for any other non-static functions called from `probe`, just to be certain.
26/2	2026/07/30 07:50	tool	grepper	0m Args: { "Expression": "zd_.\\(", "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c" } Results:* { "Output": "\nFull output is too long, showing 500 out of 563 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=224=static int handle_version_mismatch(struct zd_usb usb,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-226-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:227:\tstruct usb_device udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-228-\tconst struct firmware ur_fw = NULL;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=257=static int upload_firmware(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-261-\tu16 bcdDevice;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:262:\tstruct usb_device udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-263-\tconst struct firmware ub_fw = NULL;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=320=MODULE_FIRMWARE(FW_ZD1211_PREFIX \"uphr\");\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-323- * not require firmware to be loaded. /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:324:int zd_usb_read_fw(struct zd_usb usb, zd_addr_t addr, u8 data, u16 len)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-325-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-326-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:327:\tstruct usb_device udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-328-\tu8 buf;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=372=static inline void handle_regs_int(struct urb urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-383-\tif (int_num == (u16)CR_INTERRUPT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:384:\t\tstruct zd_mac mac = zd_hw_mac(zd_usb_to_hw(urb-\u003econtext));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-385-\t\tspin_lock(\u0026mac-\u003elock);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=424=static void int_urb_complete(struct urb urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-470-\tcase USB_INT_ID_RETRY_FAILED:\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:471:\t\tzd_mac_tx_failed(urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-472-\t\tbreak;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=502=static inline int usb_int_enabled(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-513-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:514:int zd_usb_enable_int(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-515-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-516-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:517:\tstruct usb_device udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-518-\tstruct zd_usb_interrupt intr = \u0026usb-\u003eintr;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-520-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:521:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-522-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-542-\tif (!intr-\u003ebuffer) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:543:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-544-\t\t\t\"couldn't allocate transfer_buffer\\n\");\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-554-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:555:\tdev_dbg_f(zd_usb_dev(usb), \"submit urb %p\\n\", intr-\u003eurb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-556-\tr = usb_submit_urb(urb, GFP_KERNEL);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-557-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:558:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-559-\t\t\t \"Couldn't submit urb. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-576-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:577:void zd_usb_disable_int(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-578-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-579-\tunsigned long flags;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:580:\tstruct usb_device udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-581-\tstruct zd_usb_interrupt intr = \u0026usb-\u003eintr;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-598-\tusb_kill_urb(urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:599:\tdev_dbg_f(zd_usb_dev(usb), \"urb %p killed\\n\", urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-600-\tusb_free_urb(urb);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=605=static void handle_rx_packet(struct zd_usb usb, const u8 buffer,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-612-\t\t/ It's not a complete packet anyhow. /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:613:\t\tdev_dbg_f(zd_usb_dev(usb), \"invalid, small RX packet : %d\\n\",\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-614-\t\t\t\t\t length);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-637-\t\t\t\treturn;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:638:\t\t\tzd_mac_rx(zd_usb_to_hw(usb), buffer+l, k);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-639-\t\t\tif (i \u003e= 2)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-643-\t} else {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:644:\t\tzd_mac_rx(zd_usb_to_hw(usb), buffer, length);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-645-\t}\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=713=static struct urb alloc_rx_urb(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-714-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:715:\tstruct usb_device udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-716-\tstruct urb urb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=737=static void free_rx_urb(struct urb urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-745-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:746:static int __zd_usb_enable_rx(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-747-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-751-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:752:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-753-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-798-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:799:int zd_usb_enable_rx(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-800-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-804-\tmutex_lock(\u0026rx-\u003esetup_mutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:805:\tr = __zd_usb_enable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-806-\tmutex_unlock(\u0026rx-\u003esetup_mutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-807-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:808:\tzd_usb_reset_rx_idle_timer(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-809-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-812-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:813:static void __zd_usb_disable_rx(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-814-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-839-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:840:void zd_usb_disable_rx(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-841-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-844-\tmutex_lock(\u0026rx-\u003esetup_mutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:845:\t__zd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-846-\tmutex_unlock(\u0026rx-\u003esetup_mutex);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-851-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:852:static void zd_usb_reset_rx(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-853-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-864-\tif (do_reset) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:865:\t\t__zd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:866:\t\t__zd_usb_enable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-867-\t}\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-871-\tif (do_reset)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:872:\t\tzd_usb_reset_rx_idle_timer(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-873-}\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-880- /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:881:void zd_usb_disable_tx(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-882-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-897-\t/ The stopped state is ignored, relying on ieee80211_wake_queues()\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:898:\t * in a potentionally following zd_usb_enable_tx().\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-899-\t /\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-908- /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:909:void zd_usb_enable_tx(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-910-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-916-\ttx-\u003esubmitted_urbs = 0;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:917:\tieee80211_wake_queues(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-918-\ttx-\u003estopped = 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=922=static void tx_dec_submitted_urbs(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-929-\tif (tx-\u003estopped \u0026\u0026 tx-\u003esubmitted_urbs \u003c= ZD_USB_TX_LOW) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:930:\t\tieee80211_wake_queues(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-931-\t\ttx-\u003estopped = 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=936=static void tx_inc_submitted_urbs(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-943-\tif (!tx-\u003estopped \u0026\u0026 tx-\u003esubmitted_urbs \u003e ZD_USB_TX_HIGH) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:944:\t\tieee80211_stop_queues(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-945-\t\ttx-\u003estopped = 1;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=957=static void tx_urb_complete(struct urb urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-970-\t /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:971:\tusb = \u0026zd_hw_mac(info-\u003erate_driver_data[0])-\u003echip.usb;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-972-\ttx = \u0026usb-\u003etx;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-990-\tskb_unlink(skb, \u0026usb-\u003etx.submitted_skbs);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:991:\tzd_mac_tx_to_dev(skb, urb-\u003estatus);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-992-\tusb_free_urb(urb);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1016- /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1017:int zd_usb_tx(struct zd_usb usb, struct sk_buff skb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1018-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1020-\tstruct ieee80211_tx_info info = IEEE80211_SKB_CB(skb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1021:\tstruct usb_device udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1022-\tstruct urb urb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1044-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1045:\t\tdev_dbg_f(zd_usb_dev(usb), \"error submit urb %p %d\\n\", urb, r);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1046-\t\tusb_unanchor_urb(urb);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1057-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1058:static bool zd_tx_timeout(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1059-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1081-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1082:static void zd_tx_watchdog_handler(struct work_struct work)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1083-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1089-\t\tgoto out;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1090:\tif (!zd_tx_timeout(usb))\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1091-\t\tgoto out;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1093-\t/ TX halted, try reset /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1094:\tdev_warn(zd_usb_dev(usb), \"TX-stall detected, resetting device...\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1095-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1104-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1105:void zd_tx_watchdog_enable(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1106-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1109-\tif (!tx-\u003ewatchdog_enabled) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1110:\t\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1111-\t\tqueue_delayed_work(zd_workqueue, \u0026tx-\u003ewatchdog_work,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1116-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1117:void zd_tx_watchdog_disable(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1118-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1121-\tif (tx-\u003ewatchdog_enabled) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1122:\t\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1123-\t\ttx-\u003ewatchdog_enabled = 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1127-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1128:static void zd_rx_idle_timer_handler(struct work_struct work)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1129-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1131-\t\tcontainer_of(work, struct zd_usb, rx.idle_work.work);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1132:\tstruct zd_mac mac = zd_usb_to_mac(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1133-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1136-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1137:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1138-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1139-\t/ 30 seconds since last rx, reset rx /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1140:\tzd_usb_reset_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1141-}\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1142-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1143:static void zd_usb_reset_rx_idle_timer_tasklet(struct tasklet_struct t)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1144-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1145:\tstruct zd_usb usb = from_tasklet(usb, t, rx.reset_timer_tasklet);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1146-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1147:\tzd_usb_reset_rx_idle_timer(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1148-}\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1149-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1150:void zd_usb_reset_rx_idle_timer(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1151-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1157=static inline void init_usb_interrupt(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1161-\tspin_lock_init(\u0026intr-\u003elock);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1162:\tintr-\u003einterval = int_urb_interval(zd_usb_to_usbdev(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1163-\tinit_completion(\u0026intr-\u003eread_regs.completion);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb usb, struct ieee80211_hw hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1211-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1212:void zd_usb_clear(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1213-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1234=static int scnprint_id(struct usb_device udev, char buffer, size_t size)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1242-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1243:int zd_usb_scnprint_id(struct zd_usb usb, char buffer, size_t size)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1244-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1319-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1320:\tstruct zd_mac mac = zd_usb_to_mac(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1321-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1322:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1323-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1325-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1326:\t\tdev_err(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1327-\t\t \"couldn't load firmware. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1330-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1331:\tr = usb_reset_configuration(zd_usb_to_usbdev(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1332-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1333:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1334-\t\t\t\"couldn't reset configuration. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1337-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1338:\tr = zd_mac_init_hw(mac-\u003ehw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1339-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1340:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1341-\t\t \"couldn't initialize mac. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1349=static int probe(struct usb_interface intf, const struct usb_device_id id)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1386-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1387:\thw = zd_mac_alloc_hw(intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1388-\tif (hw == NULL) {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1392-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1393:\tusb = \u0026zd_hw_mac(hw)-\u003echip.usb;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1394-\tusb-\u003eis_zd1211b = (id-\u003edriver_info == DEVICE_ZD1211B) != 0;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1395-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1396:\tr = zd_mac_preinit_hw(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1397-\tif (r) {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1415-\tif (hw) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1416:\t\tzd_mac_clear(zd_hw_mac(hw));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1417-\t\tieee80211_free_hw(hw);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1422=static void disconnect(struct usb_interface intf)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1423-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1424:\tstruct ieee80211_hw hw = zd_intf_to_hw(intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1425-\tstruct zd_mac mac;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1432-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1433:\tmac = zd_hw_mac(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1434-\tusb = \u0026mac-\u003echip.usb;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1435-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1436:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1437-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1440-\t/* Just in case something has gone wrong! /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1441:\tzd_usb_disable_tx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1442:\tzd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1443:\tzd_usb_disable_int(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1444-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1451-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1452:\tzd_mac_clear(mac);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1453-\tieee80211_free_hw(hw);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1456-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1457:static void zd_usb_resume(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1458-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1459:\tstruct zd_mac mac = zd_usb_to_mac(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1460-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1461-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1462:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1463-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1464:\tr = zd_op_start(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1465-\tif (r \u003c 0) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1466:\t\tdev_warn(zd_usb_dev(usb), \"Device resume failed \"\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1467-\t\t\t \"with error code %d. Retrying...\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1474-\tif (mac-\u003etype != NL80211_IFTYPE_UNSPECIFIED) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1475:\t\tr = zd_restore_settings(mac);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1476-\t\tif (r \u003c 0) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1477:\t\t\tdev_dbg(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1478-\t\t\t\t\"failed to restore settings, %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1483-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1484:static void zd_usb_stop(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1485-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1486:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1487-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1488:\tzd_op_stop(zd_usb_to_hw(usb), false);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1489-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1490:\tzd_usb_disable_tx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1491:\tzd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1492:\tzd_usb_disable_int(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1493-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1497=static int pre_reset(struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1505-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1506:\tmac = zd_hw_mac(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1507-\tusb = \u0026mac-\u003echip.usb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1510-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1511:\tzd_usb_stop(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1512-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1517=static int post_reset(struct usb_interface intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1525-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1526:\tmac = zd_hw_mac(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1527-\tusb = \u0026mac-\u003echip.usb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1531-\tif (usb-\u003ewas_running)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1532:\t\tzd_usb_resume(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1533-\treturn 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1548=static int __init usb_init(void)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1553-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1554:\tzd_workqueue = create_singlethread_workqueue(driver.name);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1555-\tif (zd_workqueue == NULL) {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1580=module_exit(usb_exit);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1581-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1582:static int zd_ep_regs_out_msg(struct usb_device udev, void data, int len,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1583-\t\t\t int actual_length, int timeout)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1630=static bool check_read_regs(struct zd_usb usb, struct usb_req_read_regs req,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1641-\tif (rr-\u003elength \u003c struct_size(regs, regs, count)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1642:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1643-\t\t\t \"error: actual length %d less than expected %zu\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1648-\tif (rr-\u003elength \u003e sizeof(rr-\u003ebuffer)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1649:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1650-\t\t\t \"error: actual length %d exceeds buffer size %zu\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1657-\t\tif (rd-\u003eaddr != req-\u003eaddr[i]) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1658:\t\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1659-\t\t\t\t \"rd[%d] addr %#06hx expected %#06hx\\n\", i,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1669=static int get_results(struct zd_usb usb, u16 values,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1688-\tif (!check_read_regs(usb, req, count)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1689:\t\tdev_dbg_f(zd_usb_dev(usb), \"error: invalid read regs\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1690-\t\tgoto error_unlock;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1703-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1704:int zd_usb_ioread16v(struct zd_usb usb, u16 values,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1705-\t const zd_addr_t addresses, unsigned int count)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1713-\tif (count \u003c 1) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1714:\t\tdev_dbg_f(zd_usb_dev(usb), \"error: count is zero\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1715-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1717-\tif (count \u003e USB_MAX_IOREAD16_COUNT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1718:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1719-\t\t\t \"error: count %u exceeds possible max %u\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1723-\tif (!usb_int_enabled(usb)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1724:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1725-\t\t\t \"error: usb interrupt not enabled\\n\");\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1728-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1729:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1730-\tBUILD_BUG_ON(sizeof(struct usb_req_read_regs) + USB_MAX_IOREAD16_COUNT \n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1743-\ttry_count++;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1744:\tudev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1745-\tprepare_read_regs_int(usb, req, count);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1746:\tr = zd_ep_regs_out_msg(udev, req, req_len, \u0026actual_req_len, 50 /ms/);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1747-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1748:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1749:\t\t\t\"error in zd_ep_regs_out_msg(). Error number %d\\n\", r);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1750-\t\tgoto error;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1752-\tif (req_len != actual_req_len) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1753:\t\tdev_dbg_f(zd_usb_dev(usb), \"error in zd_ep_regs_out_msg()\\n\"\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1754-\t\t\t\" req_len %d != actual_req_len %d\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1763-\t\tdisable_read_regs_int(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1764:\t\tdev_dbg_f(zd_usb_dev(usb), \"read timed out\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1765-\t\tr = -ETIMEDOUT;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1770-\tif (retry \u0026\u0026 try_count \u003c 20) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1771:\t\tdev_dbg_f(zd_usb_dev(usb), \"read retry, tries so far: %d\\n\",\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1772-\t\t\t\ttry_count);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1779=static void iowrite16v_urb_complete(struct urb urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1790-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1791:static int zd_submit_waiting_urb(struct zd_usb usb, bool last)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1792-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1807-\t\tusb_unanchor_urb(urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1808:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1809-\t\t\t\"error in usb_submit_urb(). Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1818-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1819:void zd_usb_iowrite16v_async_start(struct zd_usb usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1820-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1824-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1825:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1826-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1831-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1832:int zd_usb_iowrite16v_async_end(struct zd_usb usb, unsigned int timeout)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1833-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1835-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1836:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1837-\tZD_ASSERT(usb-\u003ein_async);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1839-\t/ Submit last iowrite16v URB /\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1840:\tr = zd_submit_waiting_urb(usb, true);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1841-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1842:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1843:\t\t\t\"error in zd_submit_waiting_usb(). \"\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1844-\t\t\t\"Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1855-\t\tif (usb-\u003ecmd_error == -ENOENT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1856:\t\t\tdev_dbg_f(zd_usb_dev(usb), \"timed out\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1857-\t\t\tr = -ETIMEDOUT;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1867-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1868:int zd_usb_iowrite16v_async(struct zd_usb usb, const struct zd_ioreq16 *ioreqs,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1869-\t\t\t unsigned int count)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1877-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1878:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1879-\tZD_ASSERT(usb-\u003ein_async);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1883-\tif (count \u003e USB_MAX_IOWRITE16_COUNT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1884:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1885-\t\t\t\"error: count %u exceeds possible max %u\\n\",\n--\n\n" }
27/2	2026/07/30 07:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27010 output: 116 thoughts: 114 Thoughts: My Assessment of the ZD1211RW Patch Okay, so `zd_mac_alloc_hw` looks solid, it seems like we have a good fix here. I'm going to go ahead and output the relevant information, making sure everything is clear for the next steps. Based on my analysis, this patch warrants fuzzing, so I'm setting `WorthFuzzing` to true. The critical function to focus on is `zd_mac_alloc_hw`, so that's in `FocusSymbols`. We'll be sure to enable these configurations: `ZD1211RW`, `MAC80211`, and `USB`. The reasoning here is pretty straightforward: this patch specifically addresses a conflict issue that arose with secondary interfaces on ZD1211 devices. The patch introduces a check in the probe function to prevent these conflicts by rejecting secondary interfaces. Since it's changing the driver initialization, specifically related to interface probing, it's definitely reachable via USB fuzzing. We can and should try to find any regressions with these settings.
28/2	2026/07/30 07:50	tool	set-results	0m Args: { "EnableConfigs": [ "ZD1211RW", "MAC80211", "USB" ], "FocusSymbols": [ "zd_mac_alloc_hw" ], "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).", "WorthFuzzing": true } Results: { "EnableConfigs": [ "ZD1211RW", "MAC80211", "USB" ], "FocusSymbols": [ "zd_mac_alloc_hw" ], "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).", "WorthFuzzing": true }

{
  "EnableConfigs": [
    "ZD1211RW",
    "MAC80211",
    "USB"
  ],
  "FocusSymbols": [
    "zd_mac_alloc_hw"
  ],
  "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit 8747faa29a4f22bb799381e1bc0ae618a9e7b6e5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 30 07:49:15 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c\nindex 966d8ccb0dbcd..98102c663434b 100644\n--- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c\n+++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c\n@@ -1353,6 +1353,14 @@ static int probe(struct usb_interface *intf, const struct usb_device_id *id)\n \tstruct zd_usb *usb;\n \tstruct ieee80211_hw *hw = NULL;\n \n+\t/*\n+\t * ZD1211 devices are single-function. Reject secondary interfaces\n+\t * to prevent multiple instances from conflicting on hardcoded endpoints\n+\t * and triggering recursive locking warnings.\n+\t */\n+\tif (intf-\u003ecur_altsetting-\u003edesc.bInterfaceNumber != 0)\n+\t\treturn -ENODEV;\n+\n \tprint_id(udev);\n \n \tif (id-\u003edriver_info \u0026 DEVICE_INSTALLER)\n"
}

{
  "EnableConfigs": [
    "ZD1211RW",
    "MAC80211",
    "USB"
  ],
  "FocusSymbols": [
    "zd_mac_alloc_hw"
  ],
  "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 8747faa29a4f22bb799381e1bc0ae618a9e7b6e5
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 30 07:49:15 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
index 966d8ccb0dbcd..98102c663434b 100644
--- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
@@ -1353,6 +1353,14 @@ static int probe(struct usb_interface *intf, const struct usb_device_id *id)
 	struct zd_usb *usb;
 	struct ieee80211_hw *hw = NULL;
 
+	/*
+	 * ZD1211 devices are single-function. Reject secondary interfaces
+	 * to prevent multiple instances from conflicting on hardcoded endpoints
+	 * and triggering recursive locking warnings.
+	 */
+	if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
+		return -ENODEV;
+
 	print_id(udev);
 
 	if (id->driver_info & DEVICE_INSTALLER)

gemini-3.1-pro-preview

							input: 2158
							output: 47
							thoughts: 136

**Fuzzing Target: zd1211rw USB Wireless Driver**

Okay, so there's a new patch in `drivers/net/wireless/zydas/zd1211rw/zd_usb.c` that's making a functional change. It seems they've added a check within the `probe` function, specifically rejecting secondary interfaces (`intf->cur_altsetting->desc.bInterfaceNumber != 0`). That's interesting, and immediately triggers some thoughts about fuzzing.

This `zd1211rw` driver is for USB wireless, which means it should be pretty accessible for fuzzing. Since we can emulate USB devices using gadgets or `dummy_hcd`, and syzkaller supports USB fuzzing, this is definitely reachable. This is a solid candidate for some in-depth fuzzing. My first thought is to check the Kconfig for `zd1211rw` to get more context and figure out how to best target it.

{
  "Expression": "config ZD1211RW",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/Kconfig"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/zydas/zd1211rw/Kconfig:2:config ZD1211RW\ndrivers/net/wireless/zydas/zd1211rw/Kconfig-3-\ttristate \"ZyDAS ZD1211/ZD1211B USB-wireless support\"\n--\ndrivers/net/wireless/zydas/zd1211rw/Kconfig-12-\ndrivers/net/wireless/zydas/zd1211rw/Kconfig:13:config ZD1211RW_DEBUG\ndrivers/net/wireless/zydas/zd1211rw/Kconfig-14-\tbool \"ZyDAS ZD1211 debugging\"\n"
}

gemini-3.1-pro-preview

							input: 2776
							output: 45
							thoughts: 15

Here's my thought process, summarized as you requested:

**Assessing ZD1211RW Dependencies**

Okay, so the initial prompt involves ZD1211RW. Immediately, my mind jumps to the need to understand its dependencies. Before I even consider anything else about the ZD1211RW, I need a clear picture of what other components, libraries, or systems it relies on. This is a crucial first step in any analysis. I need to know the potential ripple effects if I'm going to modify it, troubleshoot it, or even just assess its current state. I need to identify its direct and indirect dependencies. What modules call it, what does it call? What are the implications of those dependencies? This investigation is critical.

{
  "File": "drivers/net/wireless/zydas/zd1211rw/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tconfig ZD1211RW\n   3:\t\ttristate \"ZyDAS ZD1211/ZD1211B USB-wireless support\"\n   4:\t\tdepends on USB \u0026\u0026 MAC80211\n   5:\t\tselect FW_LOADER\n   6:\t\thelp\n   7:\t\t  This is a driver for the ZyDAS ZD1211/ZD1211B wireless\n   8:\t\t  chip, present in many USB-wireless adapters.\n   9:\t\n  10:\t\t  Device firmware is required alongside this driver. You can download\n  11:\t\t  the firmware distribution from http://sf.net/projects/zd1211/files/\n  12:\t\n  13:\tconfig ZD1211RW_DEBUG\n  14:\t\tbool \"ZyDAS ZD1211 debugging\"\n  15:\t\tdepends on ZD1211RW\n  16:\t\thelp\n  17:\t\t  ZD1211 debugging messages. Choosing Y will result in additional debug\n  18:\t\t  messages being saved to your kernel logs, which may help debug any\n  19:\t\t  problems.\n  20:\t\n"
}

gemini-3.1-pro-preview

							input: 3314
							output: 45
							thoughts: 83

**Analyzing the ZD1211RW Driver**

Okay, let's break this down. It looks like I'm dealing with the `ZD1211RW` driver, specifically its USB implementation, since the dependencies listed are `USB` and `MAC80211`. Right, so I need to enable the `ZD1211RW` configuration. Now, it looks like a function within the driver is being modified, specifically the `probe` function. The file path points me to `drivers/net/wireless/zydas/zd1211rw/zd_usb.c`, which makes sense. I have a hunch it's a static function, let me just double-check the code real quick and verify its declaration.

{
  "Expression": "static int probe",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1317=int zd_usb_init_hw(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1348-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1349:static int probe(struct usb_interface *intf, const struct usb_device_id *id)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1350-{\n"
}

gemini-3.1-pro-preview

							input: 3773
							output: 48
							thoughts: 44

**Analyzing the USB Driver Probe Function**

Okay, so I'm looking at this `probe` function. The code tells me it's a `static` function, which immediately clues me in to its purpose: it's likely a callback function used within the `struct usb_driver` structure. My next thought is to figure out the exact naming conventions of this structure. I need to understand the larger context to understand the `probe` function's role in the USB device driver architecture. Knowing the structure's name is the crucial first step.

{
  "Expression": "struct usb_driver .*=",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1517=static int post_reset(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1535-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1536:static struct usb_driver driver = {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1537-\t.name\t\t= KBUILD_MODNAME,\n"
}

gemini-3.1-pro-preview

							input: 4143
							output: 51
							thoughts: 130

**Analyzing the USB Driver Entry Point**

Okay, so I'm looking at this `driver` code. My initial thought is to just focus on that, but wait… the `probe` function is potentially problematic as a focus symbol, especially if it's static and *called* `probe`. We need something less generic.

Let's see. I need to scan `zd_usb.c` and look for any other non-static functions that might be a better entry point, or perhaps `zd_usb_init_hw` would be more appropriate?

Ah, right. The `probe` function is, in fact, the standard entry point for USB device probing. It would be silly to discount it.

Alright, a quick check… is `probe` the *only* function that's been modified? Yes, that answers that.

So, since I seem to be stuck on `probe`, are there any related functions around it in `zd_usb.c` that might provide more context or insights? Let's take a look at the surrounding code to see what's happening.

{
  "File": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c",
  "FirstLine": 1340,
  "LineCount": 50
}

{
  "Contents": "1340:\t\t\tdev_dbg_f(zd_usb_dev(usb),\n1341:\t\t\t         \"couldn't initialize mac. Error number %d\\n\", r);\n1342:\t\t\treturn r;\n1343:\t\t}\n1344:\t\n1345:\t\tusb-\u003einitialized = 1;\n1346:\t\treturn 0;\n1347:\t}\n1348:\t\n1349:\tstatic int probe(struct usb_interface *intf, const struct usb_device_id *id)\n1350:\t{\n1351:\t\tint r;\n1352:\t\tstruct usb_device *udev = interface_to_usbdev(intf);\n1353:\t\tstruct zd_usb *usb;\n1354:\t\tstruct ieee80211_hw *hw = NULL;\n1355:\t\n1356:\t\t/*\n1357:\t\t * ZD1211 devices are single-function. Reject secondary interfaces\n1358:\t\t * to prevent multiple instances from conflicting on hardcoded endpoints\n1359:\t\t * and triggering recursive locking warnings.\n1360:\t\t */\n1361:\t\tif (intf-\u003ecur_altsetting-\u003edesc.bInterfaceNumber != 0)\n1362:\t\t\treturn -ENODEV;\n1363:\t\n1364:\t\tprint_id(udev);\n1365:\t\n1366:\t\tif (id-\u003edriver_info \u0026 DEVICE_INSTALLER)\n1367:\t\t\treturn eject_installer(intf);\n1368:\t\n1369:\t\tswitch (udev-\u003espeed) {\n1370:\t\tcase USB_SPEED_LOW:\n1371:\t\tcase USB_SPEED_FULL:\n1372:\t\tcase USB_SPEED_HIGH:\n1373:\t\t\tbreak;\n1374:\t\tdefault:\n1375:\t\t\tdev_dbg_f(\u0026intf-\u003edev, \"Unknown USB speed\\n\");\n1376:\t\t\tr = -ENODEV;\n1377:\t\t\tgoto error;\n1378:\t\t}\n1379:\t\n1380:\t\tr = usb_reset_device(udev);\n1381:\t\tif (r) {\n1382:\t\t\tdev_err(\u0026intf-\u003edev,\n1383:\t\t\t\t\"couldn't reset usb device. Error number %d\\n\", r);\n1384:\t\t\tgoto error;\n1385:\t\t}\n1386:\t\n1387:\t\thw = zd_mac_alloc_hw(intf);\n1388:\t\tif (hw == NULL) {\n1389:\t\t\tr = -ENOMEM;\n"
}

gemini-3.1-pro-preview

							input: 5254
							output: 51
							thoughts: 47

**Analyzing the Driver Probe Function**

Okay, so the `probe` function is defined as `static`, which means it's internal to this driver file. It's the primary entry point for the probing process, but the fact that it's static is potentially limiting. I need to see if there's an alternative to it. Hmm, let me scroll to the end of `zd_usb.c`. Perhaps there's a non-static function exposed that I can utilize instead. Gotta be thorough.

{
  "File": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c",
  "FirstLine": 1530,
  "LineCount": 50
}

{
  "Contents": "1530:\t\n1531:\t\tif (usb-\u003ewas_running)\n1532:\t\t\tzd_usb_resume(usb);\n1533:\t\treturn 0;\n1534:\t}\n1535:\t\n1536:\tstatic struct usb_driver driver = {\n1537:\t\t.name\t\t= KBUILD_MODNAME,\n1538:\t\t.id_table\t= usb_ids,\n1539:\t\t.probe\t\t= probe,\n1540:\t\t.disconnect\t= disconnect,\n1541:\t\t.pre_reset\t= pre_reset,\n1542:\t\t.post_reset\t= post_reset,\n1543:\t\t.disable_hub_initiated_lpm = 1,\n1544:\t};\n1545:\t\n1546:\tstruct workqueue_struct *zd_workqueue;\n1547:\t\n1548:\tstatic int __init usb_init(void)\n1549:\t{\n1550:\t\tint r;\n1551:\t\n1552:\t\tpr_debug(\"%s usb_init()\\n\", driver.name);\n1553:\t\n1554:\t\tzd_workqueue = create_singlethread_workqueue(driver.name);\n1555:\t\tif (zd_workqueue == NULL) {\n1556:\t\t\tpr_err(\"%s couldn't create workqueue\\n\", driver.name);\n1557:\t\t\treturn -ENOMEM;\n1558:\t\t}\n1559:\t\n1560:\t\tr = usb_register(\u0026driver);\n1561:\t\tif (r) {\n1562:\t\t\tdestroy_workqueue(zd_workqueue);\n1563:\t\t\tpr_err(\"%s usb_register() failed. Error number %d\\n\",\n1564:\t\t\t       driver.name, r);\n1565:\t\t\treturn r;\n1566:\t\t}\n1567:\t\n1568:\t\tpr_debug(\"%s initialized\\n\", driver.name);\n1569:\t\treturn 0;\n1570:\t}\n1571:\t\n1572:\tstatic void __exit usb_exit(void)\n1573:\t{\n1574:\t\tpr_debug(\"%s usb_exit()\\n\", driver.name);\n1575:\t\tusb_deregister(\u0026driver);\n1576:\t\tdestroy_workqueue(zd_workqueue);\n1577:\t}\n1578:\t\n1579:\tmodule_init(usb_init);\n"
}

gemini-3.1-pro-preview

							input: 6131
							output: 44
							thoughts: 89

Okay, here's my breakdown of this.

**Navigating the Driver Initialization**

Right, so I'm digging into this driver code. The core of it seems to be initialized with `usb_register(&driver)`. That's standard USB driver stuff. Now, I'm trying to trace the initialization sequence and get a handle on the key functions. Okay, so `probe` is marked as `static` which gives me pause. That makes it harder to jump to from outside the file. Perhaps I should focus my attention on `probe` itself, or `zd_mac_alloc_hw`, or `zd_usb_init_hw`? Let me see. Ah, wait a minute, `zd_mac_alloc_hw` is *called* from `probe`. So, that's key. It's likely involved with actual hardware initialization, and if it's called from probe, I need to understand that. Let's see if `zd_mac_alloc_hw` is static - that would make this harder to test or debug outside of the `probe` context.

{
  "Expression": "zd_mac_alloc_hw",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c=1348=static const struct ieee80211_ops zd_ops = {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-1365-\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c:1366:struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-1367-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h=288=static inline u8 *zd_mac_get_perm_addr(struct zd_mac *mac)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h-294-\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h:295:struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.h-296-void zd_mac_clear(struct zd_mac *mac);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1349=static int probe(struct usb_interface *intf, const struct usb_device_id *id)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1386-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1387:\thw = zd_mac_alloc_hw(intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1388-\tif (hw == NULL) {\n"
}

gemini-3.1-pro-preview

							input: 7013
							output: 44
							thoughts: 47

Okay, here's my take on those thoughts, framed as a first-person expert summary:

**Identifying Potential Focus Symbols in the Kernel Module**

Right, so I'm looking at this kernel module, and my initial thought is that `zd_mac_alloc_hw` seems like a solid candidate for a focus symbol. The key thing is that it's *not* static, which immediately makes it a viable target for symbolic analysis. The whole point is to find things that the linker can see from outside the file. That's good.

Hmm, while I'm at it, I should quickly check `zd_usb_init_hw`. It has a similar naming convention, and that might also be a non-static function that we could use to get a handle on this particular piece of code. I'll need to confirm if it's visible, but it's worth checking right away. Let's see...

{
  "Expression": "zd_usb_init_hw",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c=269=int zd_op_start(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-276-\tif (!usb-\u003einitialized) {\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c:277:\t\tr = zd_usb_init_hw(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_mac.c-278-\t\tif (r)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h=235=void zd_usb_init(struct zd_usb *usb, struct ieee80211_hw *hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-236-\t         struct usb_interface *intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h:237:int zd_usb_init_hw(struct zd_usb *usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-238-void zd_usb_clear(struct zd_usb *usb);\n"
}

gemini-3.1-pro-preview

							input: 7804
							output: 47
							thoughts: 470

**Analyzing the Patch's Impact and Fuzzing Strategy**

Okay, so I'm digging into this patch. I see that `zd_usb_init_hw` and `zd_usb_init` are non-static functions, which is good. But the actual modified function is `probe`. The patch is adding a check to reject secondary interfaces within `probe`. My initial thought was to jump to `zd_mac_alloc_hw` since it's called right after the check.

Hold on, let me break this down further. The check itself is this: `if (intf->cur_altsetting->desc.bInterfaceNumber != 0) return -ENODEV;`. If we want to focus specifically on *testing* that check, I can't really prioritize a function called *after* the check, unless it's to ensure the execution path is taken.

Now, `probe` is static, which is a consideration. I need to keep in mind the instructions: avoid generic hot-path functions and prefer non-static, non-inlined API entrypoints. That static-ness throws a wrench into the works. Is `probe` inlined? It's used as a function pointer in `struct usb_driver`, so the compiler won't be able to inline it, and it definitely has a distinct symbol address. However, the name `probe` is incredibly generic. The fuzzer might get confused with other similarly named functions if it relies on name matching, which is not ideal.

So, here's my revised strategy. `zd_mac_alloc_hw` is non-static, called *from* `probe`, and is specific to this driver's functionality. It's a much better proxy for fuzzing the execution path I'm interested in, which is the code *after* the interface check passes. I'll use it as the `FocusSymbol`. It's a unique non-static function called from `probe`. I also know `zd_usb_init` is called from `probe`. I should probably make sure it's called from probe as well.

{
  "Expression": "zd_usb_init",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb *usb, struct ieee80211_hw *hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t         struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\n"
}

gemini-3.1-pro-preview

							input: 9102
							output: 47
							thoughts: 18

Okay, here's my summary, taking the perspective of someone deeply familiar with embedded systems and driver development, focusing on the specific function and context provided.

**Analyzing Driver Initialization in the Probe Function**

Alright, let me quickly run through this in my head. I need to figure out exactly how this USB device driver is initialized. The question at hand is whether the `zd_usb_init` function is called directly from within the `probe` function. This is critical for understanding the driver's instantiation sequence. If `zd_usb_init` is called from `probe`, it indicates a direct, synchronous initialization. That implies a specific timing relationship, and will probably involve specific hardware register settings in the probe function. The implication is also that if the probe function fails then `zd_usb_init` will not be called. Alternatively, it might be called asynchronously, perhaps later on in a workqueue or in a dedicated thread triggered by some other event. I need to trace the call graph to be certain. Knowing this is the first crucial step in understanding the device's setup and how it integrates with the USB stack.

{
  "Expression": "zd_usb_init",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb *usb, struct ieee80211_hw *hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t         struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\n"
}

gemini-3.1-pro-preview

							input: 9732
							output: 43
							thoughts: 17

Here's my thought process, summarized as you requested:

**Tracing the Execution Path**

Okay, I need to understand the execution flow that leads to `zd_usb_init`. That function is crucial, but without knowing where it's triggered, its purpose is going to be opaque. I need to find all the places in the codebase where `zd_usb_init` is invoked. From there, I can reverse engineer the flow and figure out its context. Knowing the call sites will be critical to grasping the bigger picture. Let's start the search...

{
  "Expression": "zd_usb_init\\(",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/"
}

{
  "Output": "drivers/net/wireless/zydas/zd1211rw/zd_chip.c=22=void zd_chip_init(struct zd_chip *chip,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_chip.c-27-\tmutex_init(\u0026chip-\u003emutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_chip.c:28:\tzd_usb_init(\u0026chip-\u003eusb, hw, intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_chip.c-29-\tzd_rf_init(\u0026chip-\u003erf);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb *usb, struct ieee80211_hw *hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t         struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h=230=static inline struct ieee80211_hw *zd_usb_to_hw(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-234-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h:235:void zd_usb_init(struct zd_usb *usb, struct ieee80211_hw *hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.h-236-\t         struct usb_interface *intf);\n"
}

gemini-3.1-pro-preview

							input: 10436
							output: 46
							thoughts: 599

**My Analysis of the ZyDAS ZD1211/ZD1211B USB-Wireless Driver Patch**

Okay, let's break this down. First, this patch is called from `zd_chip_init`. The critical symbol here seems to be `zd_mac_alloc_hw`. I checked where it's called, and it's directly called from `probe`. So, `zd_mac_alloc_hw` is a strong candidate for a focus symbol.

Now, let's verify the necessary configurations. The Kconfig file states that we need `ZD1211RW`, `USB`, and `MAC80211`. `USB` and `MAC80211` are standard subsystems, but we should include them anyway, or just `ZD1211RW`, as per the instructions to ensure everything compiles statically. The instruction also said to list any parent subsystems, so, definitely include `MAC80211` and `USB`. Thus, our EnableConfigs should be `ZD1211RW`, `MAC80211`, and `USB`.

Ah, the patch itself. It's a functional change. It prevents multiple interfaces on the same device from conflicting due to hardcoded endpoints. The code rejects secondary interfaces (`bInterfaceNumber != 0`) and returns `-ENODEV`. This is reachable through USB fuzzing, a potential vulnerability, so it's WorthFuzzing.

My initial FocusSymbols: `zd_mac_alloc_hw`. EnableConfigs: `ZD1211RW`, `MAC80211`, `USB`.

Let's double-check the focus symbol. Should we consider `zd_usb_init_hw`? No, because `zd_usb_init_hw` is called from `zd_op_start` and this is a mac80211 callback. The bug lies in `probe`, so, focusing on `zd_mac_alloc_hw` which is directly called from `probe` seems optimal because it's within the relevant execution path.

Now, let me just quickly scan `zd_usb.c` for any other non-static functions called from `probe`, just to be certain.

{
  "Expression": "zd_.*\\(",
  "PathPrefix": "drivers/net/wireless/zydas/zd1211rw/zd_usb.c"
}

{
  "Output": "\nFull output is too long, showing 500 out of 563 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=224=static int handle_version_mismatch(struct zd_usb *usb,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-226-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:227:\tstruct usb_device *udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-228-\tconst struct firmware *ur_fw = NULL;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=257=static int upload_firmware(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-261-\tu16 bcdDevice;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:262:\tstruct usb_device *udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-263-\tconst struct firmware *ub_fw = NULL;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=320=MODULE_FIRMWARE(FW_ZD1211_PREFIX \"uphr\");\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-323- * not require firmware to be loaded. */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:324:int zd_usb_read_fw(struct zd_usb *usb, zd_addr_t addr, u8 *data, u16 len)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-325-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-326-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:327:\tstruct usb_device *udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-328-\tu8 *buf;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=372=static inline void handle_regs_int(struct urb *urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-383-\tif (int_num == (u16)CR_INTERRUPT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:384:\t\tstruct zd_mac *mac = zd_hw_mac(zd_usb_to_hw(urb-\u003econtext));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-385-\t\tspin_lock(\u0026mac-\u003elock);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=424=static void int_urb_complete(struct urb *urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-470-\tcase USB_INT_ID_RETRY_FAILED:\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:471:\t\tzd_mac_tx_failed(urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-472-\t\tbreak;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=502=static inline int usb_int_enabled(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-513-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:514:int zd_usb_enable_int(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-515-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-516-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:517:\tstruct usb_device *udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-518-\tstruct zd_usb_interrupt *intr = \u0026usb-\u003eintr;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-520-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:521:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-522-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-542-\tif (!intr-\u003ebuffer) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:543:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-544-\t\t\t\"couldn't allocate transfer_buffer\\n\");\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-554-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:555:\tdev_dbg_f(zd_usb_dev(usb), \"submit urb %p\\n\", intr-\u003eurb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-556-\tr = usb_submit_urb(urb, GFP_KERNEL);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-557-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:558:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-559-\t\t\t \"Couldn't submit urb. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-576-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:577:void zd_usb_disable_int(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-578-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-579-\tunsigned long flags;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:580:\tstruct usb_device *udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-581-\tstruct zd_usb_interrupt *intr = \u0026usb-\u003eintr;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-598-\tusb_kill_urb(urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:599:\tdev_dbg_f(zd_usb_dev(usb), \"urb %p killed\\n\", urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-600-\tusb_free_urb(urb);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=605=static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-612-\t\t/* It's not a complete packet anyhow. */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:613:\t\tdev_dbg_f(zd_usb_dev(usb), \"invalid, small RX packet : %d\\n\",\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-614-\t\t\t\t\t   length);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-637-\t\t\t\treturn;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:638:\t\t\tzd_mac_rx(zd_usb_to_hw(usb), buffer+l, k);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-639-\t\t\tif (i \u003e= 2)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-643-\t} else {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:644:\t\tzd_mac_rx(zd_usb_to_hw(usb), buffer, length);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-645-\t}\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=713=static struct urb *alloc_rx_urb(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-714-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:715:\tstruct usb_device *udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-716-\tstruct urb *urb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=737=static void free_rx_urb(struct urb *urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-745-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:746:static int __zd_usb_enable_rx(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-747-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-751-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:752:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-753-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-798-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:799:int zd_usb_enable_rx(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-800-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-804-\tmutex_lock(\u0026rx-\u003esetup_mutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:805:\tr = __zd_usb_enable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-806-\tmutex_unlock(\u0026rx-\u003esetup_mutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-807-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:808:\tzd_usb_reset_rx_idle_timer(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-809-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-812-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:813:static void __zd_usb_disable_rx(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-814-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-839-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:840:void zd_usb_disable_rx(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-841-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-844-\tmutex_lock(\u0026rx-\u003esetup_mutex);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:845:\t__zd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-846-\tmutex_unlock(\u0026rx-\u003esetup_mutex);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-851-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:852:static void zd_usb_reset_rx(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-853-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-864-\tif (do_reset) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:865:\t\t__zd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:866:\t\t__zd_usb_enable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-867-\t}\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-871-\tif (do_reset)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:872:\t\tzd_usb_reset_rx_idle_timer(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-873-}\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-880- */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:881:void zd_usb_disable_tx(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-882-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-897-\t/* The stopped state is ignored, relying on ieee80211_wake_queues()\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:898:\t * in a potentionally following zd_usb_enable_tx().\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-899-\t */\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-908- */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:909:void zd_usb_enable_tx(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-910-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-916-\ttx-\u003esubmitted_urbs = 0;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:917:\tieee80211_wake_queues(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-918-\ttx-\u003estopped = 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=922=static void tx_dec_submitted_urbs(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-929-\tif (tx-\u003estopped \u0026\u0026 tx-\u003esubmitted_urbs \u003c= ZD_USB_TX_LOW) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:930:\t\tieee80211_wake_queues(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-931-\t\ttx-\u003estopped = 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=936=static void tx_inc_submitted_urbs(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-943-\tif (!tx-\u003estopped \u0026\u0026 tx-\u003esubmitted_urbs \u003e ZD_USB_TX_HIGH) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:944:\t\tieee80211_stop_queues(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-945-\t\ttx-\u003estopped = 1;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=957=static void tx_urb_complete(struct urb *urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-970-\t */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:971:\tusb = \u0026zd_hw_mac(info-\u003erate_driver_data[0])-\u003echip.usb;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-972-\ttx = \u0026usb-\u003etx;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-990-\tskb_unlink(skb, \u0026usb-\u003etx.submitted_skbs);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:991:\tzd_mac_tx_to_dev(skb, urb-\u003estatus);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-992-\tusb_free_urb(urb);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1016- */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1017:int zd_usb_tx(struct zd_usb *usb, struct sk_buff *skb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1018-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1020-\tstruct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1021:\tstruct usb_device *udev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1022-\tstruct urb *urb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1044-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1045:\t\tdev_dbg_f(zd_usb_dev(usb), \"error submit urb %p %d\\n\", urb, r);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1046-\t\tusb_unanchor_urb(urb);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1057-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1058:static bool zd_tx_timeout(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1059-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1081-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1082:static void zd_tx_watchdog_handler(struct work_struct *work)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1083-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1089-\t\tgoto out;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1090:\tif (!zd_tx_timeout(usb))\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1091-\t\tgoto out;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1093-\t/* TX halted, try reset */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1094:\tdev_warn(zd_usb_dev(usb), \"TX-stall detected, resetting device...\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1095-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1104-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1105:void zd_tx_watchdog_enable(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1106-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1109-\tif (!tx-\u003ewatchdog_enabled) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1110:\t\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1111-\t\tqueue_delayed_work(zd_workqueue, \u0026tx-\u003ewatchdog_work,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1116-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1117:void zd_tx_watchdog_disable(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1118-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1121-\tif (tx-\u003ewatchdog_enabled) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1122:\t\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1123-\t\ttx-\u003ewatchdog_enabled = 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1127-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1128:static void zd_rx_idle_timer_handler(struct work_struct *work)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1129-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1131-\t\tcontainer_of(work, struct zd_usb, rx.idle_work.work);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1132:\tstruct zd_mac *mac = zd_usb_to_mac(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1133-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1136-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1137:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1138-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1139-\t/* 30 seconds since last rx, reset rx */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1140:\tzd_usb_reset_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1141-}\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1142-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1143:static void zd_usb_reset_rx_idle_timer_tasklet(struct tasklet_struct *t)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1144-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1145:\tstruct zd_usb *usb = from_tasklet(usb, t, rx.reset_timer_tasklet);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1146-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1147:\tzd_usb_reset_rx_idle_timer(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1148-}\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1149-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1150:void zd_usb_reset_rx_idle_timer(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1151-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1157=static inline void init_usb_interrupt(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1161-\tspin_lock_init(\u0026intr-\u003elock);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1162:\tintr-\u003einterval = int_urb_interval(zd_usb_to_usbdev(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1163-\tinit_completion(\u0026intr-\u003eread_regs.completion);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1186=static inline void init_usb_tx(struct zd_usb *usb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1199-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1200:void zd_usb_init(struct zd_usb *usb, struct ieee80211_hw *hw,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1201-\t         struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1211-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1212:void zd_usb_clear(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1213-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1234=static int scnprint_id(struct usb_device *udev, char *buffer, size_t size)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1242-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1243:int zd_usb_scnprint_id(struct zd_usb *usb, char *buffer, size_t size)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1244-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1262=static int eject_installer(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1316-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1317:int zd_usb_init_hw(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1318-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1319-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1320:\tstruct zd_mac *mac = zd_usb_to_mac(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1321-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1322:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1323-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1325-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1326:\t\tdev_err(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1327-\t\t       \"couldn't load firmware. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1330-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1331:\tr = usb_reset_configuration(zd_usb_to_usbdev(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1332-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1333:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1334-\t\t\t\"couldn't reset configuration. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1337-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1338:\tr = zd_mac_init_hw(mac-\u003ehw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1339-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1340:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1341-\t\t         \"couldn't initialize mac. Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1349=static int probe(struct usb_interface *intf, const struct usb_device_id *id)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1386-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1387:\thw = zd_mac_alloc_hw(intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1388-\tif (hw == NULL) {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1392-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1393:\tusb = \u0026zd_hw_mac(hw)-\u003echip.usb;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1394-\tusb-\u003eis_zd1211b = (id-\u003edriver_info == DEVICE_ZD1211B) != 0;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1395-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1396:\tr = zd_mac_preinit_hw(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1397-\tif (r) {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1415-\tif (hw) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1416:\t\tzd_mac_clear(zd_hw_mac(hw));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1417-\t\tieee80211_free_hw(hw);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1422=static void disconnect(struct usb_interface *intf)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1423-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1424:\tstruct ieee80211_hw *hw = zd_intf_to_hw(intf);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1425-\tstruct zd_mac *mac;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1432-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1433:\tmac = zd_hw_mac(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1434-\tusb = \u0026mac-\u003echip.usb;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1435-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1436:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1437-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1440-\t/* Just in case something has gone wrong! */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1441:\tzd_usb_disable_tx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1442:\tzd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1443:\tzd_usb_disable_int(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1444-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1451-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1452:\tzd_mac_clear(mac);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1453-\tieee80211_free_hw(hw);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1456-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1457:static void zd_usb_resume(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1458-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1459:\tstruct zd_mac *mac = zd_usb_to_mac(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1460-\tint r;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1461-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1462:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1463-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1464:\tr = zd_op_start(zd_usb_to_hw(usb));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1465-\tif (r \u003c 0) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1466:\t\tdev_warn(zd_usb_dev(usb), \"Device resume failed \"\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1467-\t\t\t \"with error code %d. Retrying...\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1474-\tif (mac-\u003etype != NL80211_IFTYPE_UNSPECIFIED) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1475:\t\tr = zd_restore_settings(mac);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1476-\t\tif (r \u003c 0) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1477:\t\t\tdev_dbg(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1478-\t\t\t\t\"failed to restore settings, %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1483-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1484:static void zd_usb_stop(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1485-{\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1486:\tdev_dbg_f(zd_usb_dev(usb), \"\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1487-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1488:\tzd_op_stop(zd_usb_to_hw(usb), false);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1489-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1490:\tzd_usb_disable_tx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1491:\tzd_usb_disable_rx(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1492:\tzd_usb_disable_int(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1493-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1497=static int pre_reset(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1505-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1506:\tmac = zd_hw_mac(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1507-\tusb = \u0026mac-\u003echip.usb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1510-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1511:\tzd_usb_stop(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1512-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1517=static int post_reset(struct usb_interface *intf)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1525-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1526:\tmac = zd_hw_mac(hw);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1527-\tusb = \u0026mac-\u003echip.usb;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1531-\tif (usb-\u003ewas_running)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1532:\t\tzd_usb_resume(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1533-\treturn 0;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1548=static int __init usb_init(void)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1553-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1554:\tzd_workqueue = create_singlethread_workqueue(driver.name);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1555-\tif (zd_workqueue == NULL) {\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1580=module_exit(usb_exit);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1581-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1582:static int zd_ep_regs_out_msg(struct usb_device *udev, void *data, int len,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1583-\t\t\t      int *actual_length, int timeout)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1630=static bool check_read_regs(struct zd_usb *usb, struct usb_req_read_regs *req,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1641-\tif (rr-\u003elength \u003c struct_size(regs, regs, count)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1642:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1643-\t\t\t \"error: actual length %d less than expected %zu\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1648-\tif (rr-\u003elength \u003e sizeof(rr-\u003ebuffer)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1649:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1650-\t\t\t \"error: actual length %d exceeds buffer size %zu\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1657-\t\tif (rd-\u003eaddr != req-\u003eaddr[i]) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1658:\t\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1659-\t\t\t\t \"rd[%d] addr %#06hx expected %#06hx\\n\", i,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1669=static int get_results(struct zd_usb *usb, u16 *values,\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1688-\tif (!check_read_regs(usb, req, count)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1689:\t\tdev_dbg_f(zd_usb_dev(usb), \"error: invalid read regs\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1690-\t\tgoto error_unlock;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1703-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1704:int zd_usb_ioread16v(struct zd_usb *usb, u16 *values,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1705-\t             const zd_addr_t *addresses, unsigned int count)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1713-\tif (count \u003c 1) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1714:\t\tdev_dbg_f(zd_usb_dev(usb), \"error: count is zero\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1715-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1717-\tif (count \u003e USB_MAX_IOREAD16_COUNT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1718:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1719-\t\t\t \"error: count %u exceeds possible max %u\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1723-\tif (!usb_int_enabled(usb)) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1724:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1725-\t\t\t  \"error: usb interrupt not enabled\\n\");\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1728-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1729:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1730-\tBUILD_BUG_ON(sizeof(struct usb_req_read_regs) + USB_MAX_IOREAD16_COUNT *\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1743-\ttry_count++;\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1744:\tudev = zd_usb_to_usbdev(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1745-\tprepare_read_regs_int(usb, req, count);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1746:\tr = zd_ep_regs_out_msg(udev, req, req_len, \u0026actual_req_len, 50 /*ms*/);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1747-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1748:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1749:\t\t\t\"error in zd_ep_regs_out_msg(). Error number %d\\n\", r);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1750-\t\tgoto error;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1752-\tif (req_len != actual_req_len) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1753:\t\tdev_dbg_f(zd_usb_dev(usb), \"error in zd_ep_regs_out_msg()\\n\"\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1754-\t\t\t\" req_len %d != actual_req_len %d\\n\",\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1763-\t\tdisable_read_regs_int(usb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1764:\t\tdev_dbg_f(zd_usb_dev(usb), \"read timed out\\n\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1765-\t\tr = -ETIMEDOUT;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1770-\tif (retry \u0026\u0026 try_count \u003c 20) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1771:\t\tdev_dbg_f(zd_usb_dev(usb), \"read retry, tries so far: %d\\n\",\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1772-\t\t\t\ttry_count);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c=1779=static void iowrite16v_urb_complete(struct urb *urb)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1790-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1791:static int zd_submit_waiting_urb(struct zd_usb *usb, bool last)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1792-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1807-\t\tusb_unanchor_urb(urb);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1808:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1809-\t\t\t\"error in usb_submit_urb(). Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1818-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1819:void zd_usb_iowrite16v_async_start(struct zd_usb *usb)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1820-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1824-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1825:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1826-\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1831-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1832:int zd_usb_iowrite16v_async_end(struct zd_usb *usb, unsigned int timeout)\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1833-{\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1835-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1836:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1837-\tZD_ASSERT(usb-\u003ein_async);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1839-\t/* Submit last iowrite16v URB */\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1840:\tr = zd_submit_waiting_urb(usb, true);\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1841-\tif (r) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1842:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1843:\t\t\t\"error in zd_submit_waiting_usb(). \"\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1844-\t\t\t\"Error number %d\\n\", r);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1855-\t\tif (usb-\u003ecmd_error == -ENOENT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1856:\t\t\tdev_dbg_f(zd_usb_dev(usb), \"timed out\");\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1857-\t\t\tr = -ETIMEDOUT;\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1867-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1868:int zd_usb_iowrite16v_async(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1869-\t\t\t    unsigned int count)\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1877-\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1878:\tZD_ASSERT(mutex_is_locked(\u0026zd_usb_to_chip(usb)-\u003emutex));\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1879-\tZD_ASSERT(usb-\u003ein_async);\n--\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1883-\tif (count \u003e USB_MAX_IOWRITE16_COUNT) {\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c:1884:\t\tdev_dbg_f(zd_usb_dev(usb),\ndrivers/net/wireless/zydas/zd1211rw/zd_usb.c-1885-\t\t\t\"error: count %u exceeds possible max %u\\n\",\n--\n\n"
}

gemini-3.1-pro-preview

							input: 27010
							output: 116
							thoughts: 114

**My Assessment of the ZD1211RW Patch**

Okay, so `zd_mac_alloc_hw` looks solid, it seems like we have a good fix here. I'm going to go ahead and output the relevant information, making sure everything is clear for the next steps.

Based on my analysis, this patch warrants fuzzing, so I'm setting `WorthFuzzing` to true. The critical function to focus on is `zd_mac_alloc_hw`, so that's in `FocusSymbols`.

We'll be sure to enable these configurations: `ZD1211RW`, `MAC80211`, and `USB`. The reasoning here is pretty straightforward: this patch specifically addresses a conflict issue that arose with secondary interfaces on ZD1211 devices. The patch introduces a check in the probe function to prevent these conflicts by rejecting secondary interfaces. Since it's changing the driver initialization, specifically related to interface probing, it's definitely reachable via USB fuzzing. We can and should try to find any regressions with these settings.

{
  "EnableConfigs": [
    "ZD1211RW",
    "MAC80211",
    "USB"
  ],
  "FocusSymbols": [
    "zd_mac_alloc_hw"
  ],
  "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "ZD1211RW",
    "MAC80211",
    "USB"
  ],
  "FocusSymbols": [
    "zd_mac_alloc_hw"
  ],
  "Reasoning": "The patch adds a check in the driver's probe function to reject secondary interfaces on ZD1211 devices, preventing conflicts and recursive locking warnings. This modifies the driver initialization logic and is reachable via USB fuzzing (e.g., dummy_hcd).",
  "WorthFuzzing": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)