AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the Qualcomm ath11k and ath12k wireless drivers (implementing wake_tx_queue callbacks and updating ring selector helpers). These drivers support physical Qualcomm 802.11ax and 802.11be hardware connected via PCIe or AHB buses, which are not emulated in standard virtualized fuzzing environments (QEMU/GCE) and have no software or USB emulation. Thus, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 0b43df42bf8a2d5d652d8b2a237e92807f6e6393\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Sep 18 22:18:20 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c\nindex f389b97acbdd5..2e5978ec2b05b 100644\n--- a/drivers/net/wireless/ath/ath11k/dp.c\n+++ b/drivers/net/wireless/ath/ath11k/dp.c\n@@ -1087,6 +1087,7 @@ int ath11k_dp_alloc(struct ath11k_base *ab)\n \tfor (i = 0; i \u003c ab-\u003ehw_params.hal_params-\u003enum_tx_rings; i++) {\n \t\tidr_init(\u0026dp-\u003etx_ring[i].txbuf_idr);\n \t\tspin_lock_init(\u0026dp-\u003etx_ring[i].tx_idr_lock);\n+\t\tspin_lock_init(\u0026dp-\u003etx_ring[i].wake_tx_lock);\n \t\tdp-\u003etx_ring[i].tcl_data_ring_id = i;\n \n \t\tdp-\u003etx_ring[i].tx_status_head = 0;\ndiff --git a/drivers/net/wireless/ath/ath11k/dp.h b/drivers/net/wireless/ath/ath11k/dp.h\nindex 84f66839f0c6d..6d99501aa269c 100644\n--- a/drivers/net/wireless/ath/ath11k/dp.h\n+++ b/drivers/net/wireless/ath/ath11k/dp.h\n@@ -87,6 +87,8 @@ struct dp_tx_ring {\n \tstruct idr txbuf_idr;\n \t/* Protects txbuf_idr and num_pending */\n \tspinlock_t tx_idr_lock;\n+\t/* Serializes wake_tx_queue operations for this ring */\n+\tspinlock_t wake_tx_lock;\n \tstruct hal_wbm_release_ring *tx_status;\n \tint tx_status_head;\n \tint tx_status_tail;\ndiff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c\nindex cac970c92806a..083aca8ff355b 100644\n--- a/drivers/net/wireless/ath/ath11k/dp_tx.c\n+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c\n@@ -108,7 +108,7 @@ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,\n \n \tpool_id = skb_get_queue_mapping(skb) \u0026 (ATH11K_HW_MAX_QUEUES - 1);\n \n-\tring_selector = ab-\u003ehw_params.hw_ops-\u003eget_ring_selector(skb);\n+\tring_selector = ab-\u003ehw_params.hw_ops-\u003eget_ring_selector(skb_get_queue_mapping(skb));\n \n tcl_ring_sel:\n \ttcl_ring_retry = false;\ndiff --git a/drivers/net/wireless/ath/ath11k/hw.c b/drivers/net/wireless/ath/ath11k/hw.c\nindex 93f9a03c48dc0..8a28c1d4c17b6 100644\n--- a/drivers/net/wireless/ath/ath11k/hw.c\n+++ b/drivers/net/wireless/ath/ath11k/hw.c\n@@ -876,28 +876,14 @@ static bool ath11k_hw_wcn6855_rx_desc_get_ldpc_support(struct hal_rx_desc *desc)\n \t\t\t __le32_to_cpu(desc-\u003eu.wcn6855.msdu_start.info2));\n }\n \n-static u32 ath11k_hw_ipq8074_get_tcl_ring_selector(struct sk_buff *skb)\n-{\n-\t/* Let the default ring selection be based on current processor\n-\t * number, where one of the 3 tcl rings are selected based on\n-\t * the smp_processor_id(). In case that ring\n-\t * is full/busy, we resort to other available rings.\n-\t * If all rings are full, we drop the packet.\n-\t *\n-\t * TODO: Add throttling logic when all rings are full\n-\t */\n+static u32 ath11k_hw_ipq8074_get_tcl_ring_selector(u8 ac)\n+{\n \treturn smp_processor_id();\n }\n \n-static u32 ath11k_hw_wcn6750_get_tcl_ring_selector(struct sk_buff *skb)\n+static u32 ath11k_hw_wcn6750_get_tcl_ring_selector(u8 ac)\n {\n-\t/* Select the TCL ring based on the flow hash of the SKB instead\n-\t * of CPU ID. Since applications pumping the traffic can be scheduled\n-\t * on multiple CPUs, there is a chance that packets of the same flow\n-\t * could end on different TCL rings, this could sometimes results in\n-\t * an out of order arrival of the packets at the receiver.\n-\t */\n-\treturn skb_get_hash(skb);\n+\treturn ac;\n }\n \n const struct ath11k_hw_ops ipq8074_ops = {\ndiff --git a/drivers/net/wireless/ath/ath11k/hw.h b/drivers/net/wireless/ath/ath11k/hw.h\nindex 4996536fbd14f..b6bc8b72d8120 100644\n--- a/drivers/net/wireless/ath/ath11k/hw.h\n+++ b/drivers/net/wireless/ath/ath11k/hw.h\n@@ -273,7 +273,7 @@ struct ath11k_hw_ops {\n \tu16 (*mpdu_info_get_peerid)(struct hal_rx_mpdu_info *mpdu_info);\n \tbool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);\n \tu8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);\n-\tu32 (*get_ring_selector)(struct sk_buff *skb);\n+\tu32 (*get_ring_selector)(u8 ac);\n };\n \n extern const struct ath11k_hw_ops ipq8074_ops;\ndiff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c\nindex 2d55cdc4d165d..ae1e6f1028296 100644\n--- a/drivers/net/wireless/ath/ath11k/mac.c\n+++ b/drivers/net/wireless/ath/ath11k/mac.c\n@@ -10065,9 +10065,56 @@ static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,\n \treturn ret;\n }\n \n+static void ath11k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,\n+\t\t\t\t\tstruct ieee80211_txq *txq)\n+{\n+\tstruct ieee80211_tx_control control = {\n+\t\t.sta = txq-\u003esta,\n+\t};\n+\tstruct ath11k *ar = hw-\u003epriv;\n+\tstruct dp_tx_ring *tx_ring;\n+\tstruct hal_srng *tcl_ring;\n+\tstruct sk_buff *skb;\n+\tu32 ring_selector;\n+\tint num_free;\n+\tu8 ring_id;\n+\n+\tring_selector = ar-\u003eab-\u003ehw_params.hw_ops-\u003eget_ring_selector(txq-\u003eac);\n+\tring_id = ring_selector % ar-\u003eab-\u003ehw_params.hal_params-\u003enum_tx_rings;\n+\ttx_ring = \u0026ar-\u003eab-\u003edp.tx_ring[ring_id];\n+\ttcl_ring = \u0026ar-\u003eab-\u003ehal.srng_list[tx_ring-\u003etcl_data_ring.ring_id];\n+\n+\twhile (1) {\n+\t\tif (unlikely(test_bit(ATH11K_FLAG_CRASH_FLUSH,\n+\t\t\t\t      \u0026ar-\u003eab-\u003edev_flags)))\n+\t\t\tbreak;\n+\n+\t\tspin_lock_bh(\u0026tx_ring-\u003ewake_tx_lock);\n+\n+\t\tspin_lock_bh(\u0026tcl_ring-\u003elock);\n+\t\tnum_free = ath11k_hal_srng_src_num_free(ar-\u003eab, tcl_ring, true);\n+\t\tspin_unlock_bh(\u0026tcl_ring-\u003elock);\n+\n+\t\tif (num_free == 0) {\n+\t\t\tspin_unlock_bh(\u0026tx_ring-\u003ewake_tx_lock);\n+\t\t\tbreak;\n+\t\t}\n+\n+\t\tskb = ieee80211_tx_dequeue(hw, txq);\n+\t\tif (!skb) {\n+\t\t\tspin_unlock_bh(\u0026tx_ring-\u003ewake_tx_lock);\n+\t\t\tbreak;\n+\t\t}\n+\n+\t\tath11k_mac_op_tx(hw, \u0026control, skb);\n+\n+\t\tspin_unlock_bh(\u0026tx_ring-\u003ewake_tx_lock);\n+\t}\n+}\n+\n static const struct ieee80211_ops ath11k_ops = {\n \t.tx\t\t\t\t= ath11k_mac_op_tx,\n-\t.wake_tx_queue\t\t\t= ieee80211_handle_wake_tx_queue,\n+\t.wake_tx_queue\t\t\t= ath11k_mac_op_wake_tx_queue,\n \t.start                          = ath11k_mac_op_start,\n \t.stop                           = ath11k_mac_op_stop,\n \t.reconfig_complete              = ath11k_mac_op_reconfig_complete,\ndiff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c\nindex f9b37d75956d3..e62fa416b992f 100644\n--- a/drivers/net/wireless/ath/ath12k/dp.c\n+++ b/drivers/net/wireless/ath/ath12k/dp.c\n@@ -1537,6 +1537,7 @@ static int ath12k_dp_setup(struct ath12k_base *ab)\n \t}\n \n \tfor (i = 0; i \u003c ab-\u003ehw_params-\u003emax_tx_ring; i++) {\n+\t\tspin_lock_init(\u0026dp-\u003etx_ring[i].wake_tx_lock);\n \t\tdp-\u003etx_ring[i].tcl_data_ring_id = i;\n \n \t\tdp-\u003etx_ring[i].tx_status_head = 0;\ndiff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h\nindex bef0f2ba0560f..4bf8a8a6d76c3 100644\n--- a/drivers/net/wireless/ath/ath12k/dp.h\n+++ b/drivers/net/wireless/ath/ath12k/dp.h\n@@ -58,6 +58,8 @@ struct dp_tx_ring {\n \tu8 tcl_data_ring_id;\n \tstruct dp_srng tcl_data_ring;\n \tstruct dp_srng tcl_comp_ring;\n+\t/* Serializes wake_tx_queue operations for this ring */\n+\tspinlock_t wake_tx_lock;\n \tstruct hal_wbm_completion_ring_tx *tx_status;\n \tint tx_status_head;\n \tint tx_status_tail;\ndiff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c\nindex c0c3d2f047ef0..fbe4dc41e34ba 100644\n--- a/drivers/net/wireless/ath/ath12k/hal.c\n+++ b/drivers/net/wireless/ath/ath12k/hal.c\n@@ -390,6 +390,7 @@ int ath12k_hal_srng_src_num_free(struct ath12k_base *ab, struct hal_srng *srng,\n \telse\n \t\treturn ((srng-\u003ering_size - hp + tp) / srng-\u003eentry_size) - 1;\n }\n+EXPORT_SYMBOL(ath12k_hal_srng_src_num_free);\n \n void *ath12k_hal_srng_src_next_peek(struct ath12k_base *ab,\n \t\t\t\t    struct hal_srng *srng)\ndiff --git a/drivers/net/wireless/ath/ath12k/hw.h b/drivers/net/wireless/ath/ath12k/hw.h\nindex e790de5737db4..b3436bfe006f4 100644\n--- a/drivers/net/wireless/ath/ath12k/hw.h\n+++ b/drivers/net/wireless/ath/ath12k/hw.h\n@@ -245,7 +245,7 @@ struct ath12k_hw_ops {\n \tint (*mac_id_to_pdev_id)(const struct ath12k_hw_params *hw, int mac_id);\n \tint (*mac_id_to_srng_id)(const struct ath12k_hw_params *hw, int mac_id);\n \tint (*rxdma_ring_sel_config)(struct ath12k_base *ab);\n-\tu8 (*get_ring_selector)(struct sk_buff *skb);\n+\tu8 (*get_ring_selector)(u8 ac);\n \tbool (*dp_srng_is_tx_comp_ring)(int ring_num);\n \tbool (*is_frame_link_agnostic)(struct ath12k_link_vif *arvif,\n \t\t\t\t       struct ieee80211_mgmt *mgmt);\ndiff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c\nindex 587d58eeccfa5..f972541637978 100644\n--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c\n+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c\n@@ -155,7 +155,7 @@ int ath12k_wifi7_dp_tx(struct ath12k_pdev_dp *dp_pdev, struct ath12k_link_vif *a\n \t * If all rings are full, we drop the packet.\n \t * TODO: Add throttling logic when all rings are full\n \t */\n-\tring_selector = dp-\u003ehw_params-\u003ehw_ops-\u003eget_ring_selector(skb);\n+\tring_selector = dp-\u003ehw_params-\u003ehw_ops-\u003eget_ring_selector(skb_get_queue_mapping(skb));\n \n tcl_ring_sel:\n \ttcl_ring_retry = false;\ndiff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c\nindex 4ded807763b61..679f32e641fdf 100644\n--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c\n+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c\n@@ -49,7 +49,7 @@ ath12k_wifi7_hw_mac_id_to_srng_id_qcn9274(const struct ath12k_hw_params *hw,\n \treturn 0;\n }\n \n-static u8 ath12k_wifi7_hw_get_ring_selector_qcn9274(struct sk_buff *skb)\n+static u8 ath12k_wifi7_hw_get_ring_selector_qcn9274(u8 ac)\n {\n \treturn smp_processor_id();\n }\n@@ -83,9 +83,9 @@ ath12k_wifi7_hw_mac_id_to_srng_id_wcn7850(const struct ath12k_hw_params *hw,\n \treturn mac_id;\n }\n \n-static u8 ath12k_wifi7_hw_get_ring_selector_wcn7850(struct sk_buff *skb)\n+static u8 ath12k_wifi7_hw_get_ring_selector_wcn7850(u8 ac)\n {\n-\treturn skb_get_queue_mapping(skb);\n+\treturn ac;\n }\n \n static bool ath12k_wifi7_dp_srng_is_comp_ring_wcn7850(int ring_num)\n@@ -1160,9 +1160,76 @@ static void ath12k_wifi7_mac_op_tx(struct ieee80211_hw *hw,\n \t}\n }\n \n+static void ath12k_wifi7_mac_op_wake_tx_queue(struct ieee80211_hw *hw,\n+\t\t\t\t\t      struct ieee80211_txq *txq)\n+{\n+\tstruct ath12k_vif *ahvif = ath12k_vif_to_ahvif(txq-\u003evif);\n+\tstruct ieee80211_tx_control control = {\n+\t\t.sta = txq-\u003esta,\n+\t};\n+\tstruct ieee80211_vif *vif = txq-\u003evif;\n+\tstruct ath12k_link_vif *arvif;\n+\tstruct dp_tx_ring *tx_ring;\n+\tstruct hal_srng *tcl_ring;\n+\tstruct ath12k_sta *ahsta;\n+\tstruct ath12k_dp *dp;\n+\tstruct sk_buff *skb;\n+\tstruct ath12k *ar;\n+\tu8 ring_selector;\n+\tint num_free;\n+\tu8 ring_id;\n+\tu8 link_id;\n+\n+\tif (ieee80211_vif_is_mld(vif) \u0026\u0026 txq-\u003esta) {\n+\t\tahsta = ath12k_sta_to_ahsta(txq-\u003esta);\n+\t\tlink_id = ahsta-\u003eassoc_link_id;\n+\t} else {\n+\t\tlink_id = ahvif-\u003edeflink.link_id;\n+\t}\n+\n+\trcu_read_lock();\n+\n+\tarvif = rcu_dereference(ahvif-\u003elink[link_id]);\n+\tif (!arvif || !arvif-\u003ear) {\n+\t\trcu_read_unlock();\n+\t\treturn;\n+\t}\n+\n+\tar = arvif-\u003ear;\n+\tdp = ar-\u003eab-\u003edp;\n+\n+\tring_selector = dp-\u003ehw_params-\u003ehw_ops-\u003eget_ring_selector(txq-\u003eac);\n+\tring_id = ring_selector % dp-\u003ehw_params-\u003emax_tx_ring;\n+\ttx_ring = \u0026dp-\u003etx_ring[ring_id];\n+\ttcl_ring = \u0026dp-\u003ehal-\u003esrng_list[tx_ring-\u003etcl_data_ring.ring_id];\n+\n+\twhile (1) {\n+\t\tif (unlikely(test_bit(ATH12K_FLAG_CRASH_FLUSH,\n+\t\t\t\t      \u0026ar-\u003eab-\u003edev_flags)))\n+\t\t\tbreak;\n+\n+\t\tguard(spinlock_bh)(\u0026tx_ring-\u003ewake_tx_lock);\n+\n+\t\tspin_lock_bh(\u0026tcl_ring-\u003elock);\n+\t\tnum_free = ath12k_hal_srng_src_num_free(ar-\u003eab, tcl_ring, true);\n+\t\tspin_unlock_bh(\u0026tcl_ring-\u003elock);\n+\n+\t\tif (num_free == 0)\n+\t\t\tbreak;\n+\n+\t\tskb = ieee80211_tx_dequeue(hw, txq);\n+\t\tif (!skb)\n+\t\t\tbreak;\n+\n+\t\tath12k_wifi7_mac_op_tx(hw, \u0026control, skb);\n+\t}\n+\n+\trcu_read_unlock();\n+}\n+\n static const struct ieee80211_ops ath12k_ops_wifi7 = {\n \t.tx\t\t\t\t= ath12k_wifi7_mac_op_tx,\n-\t.wake_tx_queue\t\t\t= ieee80211_handle_wake_tx_queue,\n+\t.wake_tx_queue\t\t\t= ath12k_wifi7_mac_op_wake_tx_queue,\n \t.start                          = ath12k_mac_op_start,\n \t.stop                           = ath12k_mac_op_stop,\n \t.reconfig_complete              = ath12k_mac_op_reconfig_complete,\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Qualcomm ath11k and ath12k wireless drivers (implementing wake_tx_queue callbacks and updating ring selector helpers). These drivers support physical Qualcomm 802.11ax and 802.11be hardware connected via PCIe or AHB buses, which are not emulated in standard virtualized fuzzing environments (QEMU/GCE) and have no software or USB emulation. Thus, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 0b43df42bf8a2d5d652d8b2a237e92807f6e6393
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Sep 18 22:18:20 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c
index f389b97acbdd5..2e5978ec2b05b 100644
--- a/drivers/net/wireless/ath/ath11k/dp.c
+++ b/drivers/net/wireless/ath/ath11k/dp.c
@@ -1087,6 +1087,7 @@ int ath11k_dp_alloc(struct ath11k_base *ab)
 	for (i = 0; i < ab->hw_params.hal_params->num_tx_rings; i++) {
 		idr_init(&dp->tx_ring[i].txbuf_idr);
 		spin_lock_init(&dp->tx_ring[i].tx_idr_lock);
+		spin_lock_init(&dp->tx_ring[i].wake_tx_lock);
 		dp->tx_ring[i].tcl_data_ring_id = i;
 
 		dp->tx_ring[i].tx_status_head = 0;
diff --git a/drivers/net/wireless/ath/ath11k/dp.h b/drivers/net/wireless/ath/ath11k/dp.h
index 84f66839f0c6d..6d99501aa269c 100644
--- a/drivers/net/wireless/ath/ath11k/dp.h
+++ b/drivers/net/wireless/ath/ath11k/dp.h
@@ -87,6 +87,8 @@ struct dp_tx_ring {
 	struct idr txbuf_idr;
 	/* Protects txbuf_idr and num_pending */
 	spinlock_t tx_idr_lock;
+	/* Serializes wake_tx_queue operations for this ring */
+	spinlock_t wake_tx_lock;
 	struct hal_wbm_release_ring *tx_status;
 	int tx_status_head;
 	int tx_status_tail;
diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c
index cac970c92806a..083aca8ff355b 100644
--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -108,7 +108,7 @@ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 
 	pool_id = skb_get_queue_mapping(skb) & (ATH11K_HW_MAX_QUEUES - 1);
 
-	ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb);
+	ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb_get_queue_mapping(skb));
 
 tcl_ring_sel:
 	tcl_ring_retry = false;
diff --git a/drivers/net/wireless/ath/ath11k/hw.c b/drivers/net/wireless/ath/ath11k/hw.c
index 93f9a03c48dc0..8a28c1d4c17b6 100644
--- a/drivers/net/wireless/ath/ath11k/hw.c
+++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -876,28 +876,14 @@ static bool ath11k_hw_wcn6855_rx_desc_get_ldpc_support(struct hal_rx_desc *desc)
 			 __le32_to_cpu(desc->u.wcn6855.msdu_start.info2));
 }
 
-static u32 ath11k_hw_ipq8074_get_tcl_ring_selector(struct sk_buff *skb)
-{
-	/* Let the default ring selection be based on current processor
-	 * number, where one of the 3 tcl rings are selected based on
-	 * the smp_processor_id(). In case that ring
-	 * is full/busy, we resort to other available rings.
-	 * If all rings are full, we drop the packet.
-	 *
-	 * TODO: Add throttling logic when all rings are full
-	 */
+static u32 ath11k_hw_ipq8074_get_tcl_ring_selector(u8 ac)
+{
 	return smp_processor_id();
 }
 
-static u32 ath11k_hw_wcn6750_get_tcl_ring_selector(struct sk_buff *skb)
+static u32 ath11k_hw_wcn6750_get_tcl_ring_selector(u8 ac)
 {
-	/* Select the TCL ring based on the flow hash of the SKB instead
-	 * of CPU ID. Since applications pumping the traffic can be scheduled
-	 * on multiple CPUs, there is a chance that packets of the same flow
-	 * could end on different TCL rings, this could sometimes results in
-	 * an out of order arrival of the packets at the receiver.
-	 */
-	return skb_get_hash(skb);
+	return ac;
 }
 
 const struct ath11k_hw_ops ipq8074_ops = {
diff --git a/drivers/net/wireless/ath/ath11k/hw.h b/drivers/net/wireless/ath/ath11k/hw.h
index 4996536fbd14f..b6bc8b72d8120 100644
--- a/drivers/net/wireless/ath/ath11k/hw.h
+++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -273,7 +273,7 @@ struct ath11k_hw_ops {
 	u16 (*mpdu_info_get_peerid)(struct hal_rx_mpdu_info *mpdu_info);
 	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
 	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
-	u32 (*get_ring_selector)(struct sk_buff *skb);
+	u32 (*get_ring_selector)(u8 ac);
 };
 
 extern const struct ath11k_hw_ops ipq8074_ops;
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 2d55cdc4d165d..ae1e6f1028296 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -10065,9 +10065,56 @@ static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
 	return ret;
 }
 
+static void ath11k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
+					struct ieee80211_txq *txq)
+{
+	struct ieee80211_tx_control control = {
+		.sta = txq->sta,
+	};
+	struct ath11k *ar = hw->priv;
+	struct dp_tx_ring *tx_ring;
+	struct hal_srng *tcl_ring;
+	struct sk_buff *skb;
+	u32 ring_selector;
+	int num_free;
+	u8 ring_id;
+
+	ring_selector = ar->ab->hw_params.hw_ops->get_ring_selector(txq->ac);
+	ring_id = ring_selector % ar->ab->hw_params.hal_params->num_tx_rings;
+	tx_ring = &ar->ab->dp.tx_ring[ring_id];
+	tcl_ring = &ar->ab->hal.srng_list[tx_ring->tcl_data_ring.ring_id];
+
+	while (1) {
+		if (unlikely(test_bit(ATH11K_FLAG_CRASH_FLUSH,
+				      &ar->ab->dev_flags)))
+			break;
+
+		spin_lock_bh(&tx_ring->wake_tx_lock);
+
+		spin_lock_bh(&tcl_ring->lock);
+		num_free = ath11k_hal_srng_src_num_free(ar->ab, tcl_ring, true);
+		spin_unlock_bh(&tcl_ring->lock);
+
+		if (num_free == 0) {
+			spin_unlock_bh(&tx_ring->wake_tx_lock);
+			break;
+		}
+
+		skb = ieee80211_tx_dequeue(hw, txq);
+		if (!skb) {
+			spin_unlock_bh(&tx_ring->wake_tx_lock);
+			break;
+		}
+
+		ath11k_mac_op_tx(hw, &control, skb);
+
+		spin_unlock_bh(&tx_ring->wake_tx_lock);
+	}
+}
+
 static const struct ieee80211_ops ath11k_ops = {
 	.tx				= ath11k_mac_op_tx,
-	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
+	.wake_tx_queue			= ath11k_mac_op_wake_tx_queue,
 	.start                          = ath11k_mac_op_start,
 	.stop                           = ath11k_mac_op_stop,
 	.reconfig_complete              = ath11k_mac_op_reconfig_complete,
diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index f9b37d75956d3..e62fa416b992f 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -1537,6 +1537,7 @@ static int ath12k_dp_setup(struct ath12k_base *ab)
 	}
 
 	for (i = 0; i < ab->hw_params->max_tx_ring; i++) {
+		spin_lock_init(&dp->tx_ring[i].wake_tx_lock);
 		dp->tx_ring[i].tcl_data_ring_id = i;
 
 		dp->tx_ring[i].tx_status_head = 0;
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index bef0f2ba0560f..4bf8a8a6d76c3 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -58,6 +58,8 @@ struct dp_tx_ring {
 	u8 tcl_data_ring_id;
 	struct dp_srng tcl_data_ring;
 	struct dp_srng tcl_comp_ring;
+	/* Serializes wake_tx_queue operations for this ring */
+	spinlock_t wake_tx_lock;
 	struct hal_wbm_completion_ring_tx *tx_status;
 	int tx_status_head;
 	int tx_status_tail;
diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c
index c0c3d2f047ef0..fbe4dc41e34ba 100644
--- a/drivers/net/wireless/ath/ath12k/hal.c
+++ b/drivers/net/wireless/ath/ath12k/hal.c
@@ -390,6 +390,7 @@ int ath12k_hal_srng_src_num_free(struct ath12k_base *ab, struct hal_srng *srng,
 	else
 		return ((srng->ring_size - hp + tp) / srng->entry_size) - 1;
 }
+EXPORT_SYMBOL(ath12k_hal_srng_src_num_free);
 
 void *ath12k_hal_srng_src_next_peek(struct ath12k_base *ab,
 				    struct hal_srng *srng)
diff --git a/drivers/net/wireless/ath/ath12k/hw.h b/drivers/net/wireless/ath/ath12k/hw.h
index e790de5737db4..b3436bfe006f4 100644
--- a/drivers/net/wireless/ath/ath12k/hw.h
+++ b/drivers/net/wireless/ath/ath12k/hw.h
@@ -245,7 +245,7 @@ struct ath12k_hw_ops {
 	int (*mac_id_to_pdev_id)(const struct ath12k_hw_params *hw, int mac_id);
 	int (*mac_id_to_srng_id)(const struct ath12k_hw_params *hw, int mac_id);
 	int (*rxdma_ring_sel_config)(struct ath12k_base *ab);
-	u8 (*get_ring_selector)(struct sk_buff *skb);
+	u8 (*get_ring_selector)(u8 ac);
 	bool (*dp_srng_is_tx_comp_ring)(int ring_num);
 	bool (*is_frame_link_agnostic)(struct ath12k_link_vif *arvif,
 				       struct ieee80211_mgmt *mgmt);
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
index 587d58eeccfa5..f972541637978 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c
@@ -155,7 +155,7 @@ int ath12k_wifi7_dp_tx(struct ath12k_pdev_dp *dp_pdev, struct ath12k_link_vif *a
 	 * If all rings are full, we drop the packet.
 	 * TODO: Add throttling logic when all rings are full
 	 */
-	ring_selector = dp->hw_params->hw_ops->get_ring_selector(skb);
+	ring_selector = dp->hw_params->hw_ops->get_ring_selector(skb_get_queue_mapping(skb));
 
 tcl_ring_sel:
 	tcl_ring_retry = false;
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
index 4ded807763b61..679f32e641fdf 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
@@ -49,7 +49,7 @@ ath12k_wifi7_hw_mac_id_to_srng_id_qcn9274(const struct ath12k_hw_params *hw,
 	return 0;
 }
 
-static u8 ath12k_wifi7_hw_get_ring_selector_qcn9274(struct sk_buff *skb)
+static u8 ath12k_wifi7_hw_get_ring_selector_qcn9274(u8 ac)
 {
 	return smp_processor_id();
 }
@@ -83,9 +83,9 @@ ath12k_wifi7_hw_mac_id_to_srng_id_wcn7850(const struct ath12k_hw_params *hw,
 	return mac_id;
 }
 
-static u8 ath12k_wifi7_hw_get_ring_selector_wcn7850(struct sk_buff *skb)
+static u8 ath12k_wifi7_hw_get_ring_selector_wcn7850(u8 ac)
 {
-	return skb_get_queue_mapping(skb);
+	return ac;
 }
 
 static bool ath12k_wifi7_dp_srng_is_comp_ring_wcn7850(int ring_num)
@@ -1160,9 +1160,76 @@ static void ath12k_wifi7_mac_op_tx(struct ieee80211_hw *hw,
 	}
 }
 
+static void ath12k_wifi7_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
+					      struct ieee80211_txq *txq)
+{
+	struct ath12k_vif *ahvif = ath12k_vif_to_ahvif(txq->vif);
+	struct ieee80211_tx_control control = {
+		.sta = txq->sta,
+	};
+	struct ieee80211_vif *vif = txq->vif;
+	struct ath12k_link_vif *arvif;
+	struct dp_tx_ring *tx_ring;
+	struct hal_srng *tcl_ring;
+	struct ath12k_sta *ahsta;
+	struct ath12k_dp *dp;
+	struct sk_buff *skb;
+	struct ath12k *ar;
+	u8 ring_selector;
+	int num_free;
+	u8 ring_id;
+	u8 link_id;
+
+	if (ieee80211_vif_is_mld(vif) && txq->sta) {
+		ahsta = ath12k_sta_to_ahsta(txq->sta);
+		link_id = ahsta->assoc_link_id;
+	} else {
+		link_id = ahvif->deflink.link_id;
+	}
+
+	rcu_read_lock();
+
+	arvif = rcu_dereference(ahvif->link[link_id]);
+	if (!arvif || !arvif->ar) {
+		rcu_read_unlock();
+		return;
+	}
+
+	ar = arvif->ar;
+	dp = ar->ab->dp;
+
+	ring_selector = dp->hw_params->hw_ops->get_ring_selector(txq->ac);
+	ring_id = ring_selector % dp->hw_params->max_tx_ring;
+	tx_ring = &dp->tx_ring[ring_id];
+	tcl_ring = &dp->hal->srng_list[tx_ring->tcl_data_ring.ring_id];
+
+	while (1) {
+		if (unlikely(test_bit(ATH12K_FLAG_CRASH_FLUSH,
+				      &ar->ab->dev_flags)))
+			break;
+
+		guard(spinlock_bh)(&tx_ring->wake_tx_lock);
+
+		spin_lock_bh(&tcl_ring->lock);
+		num_free = ath12k_hal_srng_src_num_free(ar->ab, tcl_ring, true);
+		spin_unlock_bh(&tcl_ring->lock);
+
+		if (num_free == 0)
+			break;
+
+		skb = ieee80211_tx_dequeue(hw, txq);
+		if (!skb)
+			break;
+
+		ath12k_wifi7_mac_op_tx(hw, &control, skb);
+	}
+
+	rcu_read_unlock();
+}
+
 static const struct ieee80211_ops ath12k_ops_wifi7 = {
 	.tx				= ath12k_wifi7_mac_op_tx,
-	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
+	.wake_tx_queue			= ath12k_wifi7_mac_op_wake_tx_queue,
 	.start                          = ath12k_mac_op_start,
 	.stop                           = ath12k_mac_op_stop,
 	.reconfig_complete              = ath12k_mac_op_reconfig_complete,

gemini-3.8-flash

null

null

							input: 8195
							output: 37
							thoughts: 515
						

**Evaluating the Patch's Suitability for Syzkaller Fuzzing**

Okay, so I need to decide if this patch is a good candidate for fuzzing with syzkaller. The first step is to look at the diff. Hmm, it touches `drivers/net/wireless/ath/ath11k/...` and `drivers/net/wireless/ath/ath12k/...`. That triggers a critical question: Can these drivers, ath11k and ath12k, actually *run* in a standard virtualized environment like QEMU or GCE? The instructions are clear: if the code is unreachable in these environments, no fuzzing, no matter how complex the logic or how many assertions it adds. "Reachability is the primary gate," they say.

So, let's consult the documentation. Section 2 highlights structurally unreachable hardware. We're talking vendor-specific PCIe switches, SmartNICs, GPU drivers – the stuff that needs a real ASIC or PCIe card that QEMU doesn't emulate. Where do ath11k and ath12k fit? Are they emulated somehow?

Time to dig into the Kconfig and driver buses. What hardware are we talking about here? Are they emulated, or do they *only* support physical Qualcomm WiFi chips via PCI/AHB? Does mac80211_hwsim support ath11k? No, that's just a software simulator. Looks like ath11k and ath12k are drivers for Qualcomm 802.11ax / 802.11be chipsets, things like IPQ8074, QCA6390, and so on.

The question is, does QEMU, virt_wifi, or *anything* emulate those? Is there any USB, virtual bus, or other means to reach those drivers without the dedicated physical hardware? Let's check using `grepper` or further examination of the Kconfig. The answer to *that* question will decide whether we can even consider fuzzing this patch.

{
  "Expression": "config ATH11K",
  "PathPrefix": "drivers/net/wireless/ath/ath11k"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Kconfig:2:config ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-3-\ttristate \"Qualcomm 802.11ax chipset support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig:13:config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig-14-\ttristate \"Atheros ath11k AHB support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-19-\ndrivers/net/wireless/ath/ath11k/Kconfig:20:config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig-21-\ttristate \"Atheros ath11k PCI support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-29-\ndrivers/net/wireless/ath/ath11k/Kconfig:30:config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig-31-\tbool \"QCA ath11k debugging\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-37-\ndrivers/net/wireless/ath/ath11k/Kconfig:38:config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-39-\tbool \"QCA ath11k debugfs support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-45-\ndrivers/net/wireless/ath/ath11k/Kconfig:46:config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-47-\tbool \"ath11k tracing support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig:52:config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig-53-\tbool \"QCA ath11k spectral scan support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-60-\ndrivers/net/wireless/ath/ath11k/Kconfig:61:config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig-62-\tbool \"ath11k channel frequency response support\"\n"
}

gemini-3.8-flash

null

null

							input: 9868
							output: 37
							thoughts: 13
						

Here's my take on the thoughts, rendered as though they are my own:

**Diving into `ath12k/Kconfig`**

Okay, time to dig into the `ath12k/Kconfig` file. I'm going to take a look at the configuration options for the ath12k driver. I'm primarily interested in seeing how the features and settings are structured. It's crucial for me to understand the configuration points to tailor the driver properly for a specific hardware setup or use case. I need to get a high-level view of what aspects of the ath12k driver I can influence and how that influence is presented to the user during the kernel build process. So, I will begin by examining the layout of the Kconfig file: the menu structures, dependencies, default values, help texts, and any other relevant metadata. Hopefully, this file provides good context for tailoring this wireless driver. Let's see what we can find!

{
  "Expression": "config ATH12K",
  "PathPrefix": "drivers/net/wireless/ath/ath12k"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath12k/Kconfig:2:config ATH12K\ndrivers/net/wireless/ath/ath12k/Kconfig-3-\ttristate \"Qualcomm Wi-Fi 7 support (ath12k)\"\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-16-\ndrivers/net/wireless/ath/ath12k/Kconfig:17:config ATH12K_AHB\ndrivers/net/wireless/ath/ath12k/Kconfig-18-\tbool \"Qualcomm ath12k AHB support\"\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-24-\ndrivers/net/wireless/ath/ath12k/Kconfig:25:config ATH12K_DEBUG\ndrivers/net/wireless/ath/ath12k/Kconfig-26-\tbool \"ath12k debugging\"\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-34-\ndrivers/net/wireless/ath/ath12k/Kconfig:35:config ATH12K_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig-36-\tbool \"Qualcomm ath12k debugfs support\"\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-43-\ndrivers/net/wireless/ath/ath12k/Kconfig:44:config ATH12K_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig-45-\tbool \"ath12k tracing support\"\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-52-\ndrivers/net/wireless/ath/ath12k/Kconfig:53:config ATH12K_COREDUMP\ndrivers/net/wireless/ath/ath12k/Kconfig-54-\tbool \"ath12k coredump\"\n"
}

gemini-3.8-flash

null

null

							input: 10633
							output: 33
							thoughts: 78
						

**Considering the Hardware Interface and USB Support of Atheros Wireless Drivers**

Okay, so I'm thinking about these Atheros wireless drivers, specifically the ath11k and ath12k. The initial architecture is clear: both utilize AHB and PCI interfaces, though with ath12k, it seems its PCI implementation might have some dependencies.

My primary question now centers on USB support. Do either of these drivers, ath11k or ath12k, offer native USB functionality? Or, perhaps more subtly, is there any form of virtual device emulation present, that could potentially enable a USB connection through either of these driver sets? It's time to dig into the driver code and see what's actually available. Let's see what the code reveals about USB support.

no matches

{
  "Expression": "usb",
  "PathPrefix": "drivers/net/wireless/ath/ath11k"
}

{
  "error": "no matches"
}

gemini-3.8-flash

null

null

							input: 10922
							output: 33
							thoughts: 16
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Investigating USB Support in Qualcomm Atheros WiFi Drivers**

Hmm, so no USB support in the ath11k driver, that's interesting. I was under the impression it was intended to support a broader range of hardware interfaces, not just PCIe. It definitely narrows down the potential hardware configurations for that generation. It makes me wonder about the specific design choices behind that decision – power constraints, maybe? Or perhaps a push towards more integrated solutions? It really constrains the potential for some applications.

Alright, moving on, the next logical question is, what about the newer ath12k driver? Has that driver added USB support? Is it a focus or not? That would be the place I would look for added functionality. I need to dig into the documentation and see if they've expanded the hardware support for that next-generation platform. A lot hinges on that because USB would enable a variety of different test setups.

no matches

{
  "Expression": "usb",
  "PathPrefix": "drivers/net/wireless/ath/ath12k"
}

{
  "error": "no matches"
}

gemini-3.8-flash

null

null

							input: 11197
							output: 40
							thoughts: 283
						

**My Analysis of ath11k and ath12k Driver Capabilities**

Okay, so the initial understanding is clear: both the ath11k and ath12k drivers are specifically designed for Qualcomm hardware. We're talking about the real-deal PCIe or AHB-based platforms like the IPQ8074, QCA6390, and so on – those Wi-Fi 6, 6E, and 7 chipsets. They're physical devices, no ifs, ands, or buts about it. This means, as far as I know, you can't just spin up a standard QEMU instance and expect either driver to magically work, nor can you access them via a virtual bus or some software interface without the actual hardware present.

But, hold on a second. Before I draw any definitive conclusions, I need to confirm this. I need to be *absolutely* certain there isn't some clever virtual bus trickery or software emulation path that I'm overlooking. I need to know: can the mac80211 layer *actually* invoke these operations, the `ath11k_ops` or the `ath12k_ops_wifi7` functions, without the underlying hardware being probed and present?

In mac80211, the way these things are registered is when a driver initializes and calls `ieee80211_register_hw(hw)`. So, the critical question becomes: does ath11k or ath12k register itself with mac80211 if the hardware isn't detected or probed? I need to verify how these ops are being registered. Time to dig into the source and track down where `ieee80211_register_hw` or `ath11k_mac_register` is being called and under what conditions. Let's see what the code reveals.

{
  "Expression": "ath11k_mac_register",
  "PathPrefix": "drivers/net/wireless/ath/ath11k"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/core.c=2031=static int ath11k_core_pdev_create(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/core.c-2046-\ndrivers/net/wireless/ath/ath11k/core.c:2047:\tret = ath11k_mac_register(ab);\ndrivers/net/wireless/ath/ath11k/core.c-2048-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath11k/mac.c=10471=void ath11k_mac_unregister(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/mac.c-10488-\ndrivers/net/wireless/ath/ath11k/mac.c:10489:static int __ath11k_mac_register(struct ath11k *ar)\ndrivers/net/wireless/ath/ath11k/mac.c-10490-{\n--\ndrivers/net/wireless/ath/ath11k/mac.c-10739-\ndrivers/net/wireless/ath/ath11k/mac.c:10740:int ath11k_mac_register(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/mac.c-10741-{\n--\ndrivers/net/wireless/ath/ath11k/mac.c-10776-\ndrivers/net/wireless/ath/ath11k/mac.c:10777:\t\tret = __ath11k_mac_register(ar);\ndrivers/net/wireless/ath/ath11k/mac.c-10778-\t\tif (ret)\n--\ndrivers/net/wireless/ath/ath11k/mac.h=140=void ath11k_mac_unregister(struct ath11k_base *ab);\ndrivers/net/wireless/ath/ath11k/mac.h:141:int ath11k_mac_register(struct ath11k_base *ab);\ndrivers/net/wireless/ath/ath11k/mac.h-142-int ath11k_mac_allocate(struct ath11k_base *ab);\n"
}

gemini-3.8-flash

null

null

							input: 12530
							output: 43
							thoughts: 18
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Tracing the Call Chain of `ath11k_core_pdev_create`**

Okay, so I'm trying to figure out the calling context of `ath11k_core_pdev_create`.  I need to understand where this core function for the Qualcomm Atheros 11ax (ath11k) driver is getting invoked. It's crucial for understanding the device bring-up and how the physical device (pdev) is initialized within the driver's framework.  I'm thinking I'll need to trace the call chain. I'll probably start by grepping the kernel sources to pinpoint the exact location(s) where the function is called. Then, I’ll need to analyze the calling function's context – what's the driver state, what are the relevant device structures, and what sequence of events leads to this particular call. Understanding the parameters passed to `ath11k_core_pdev_create` is equally important, as they will provide clues to the kind of platform initialization being requested. I’ll be particularly interested in whether it's called during the probe sequence, or potentially as part of a runtime reconfiguration event. Knowing the context of this function will really help in troubleshooting any issues with the driver or its interaction with the hardware.

{
  "Expression": "ath11k_core_pdev_create",
  "PathPrefix": "drivers/net/wireless/ath/ath11k"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/core.c=2023=static void ath11k_core_soc_destroy(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/core.c-2030-\ndrivers/net/wireless/ath/ath11k/core.c:2031:static int ath11k_core_pdev_create(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/core.c-2032-{\n--\ndrivers/net/wireless/ath/ath11k/core.c=2263=int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/core.c-2308-\ndrivers/net/wireless/ath/ath11k/core.c:2309:\tret = ath11k_core_pdev_create(ab);\ndrivers/net/wireless/ath/ath11k/core.c-2310-\tif (ret) {\n"
}

gemini-3.8-flash

null

null

							input: 13180
							output: 46
							thoughts: 21
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Tracing the Firmware Ready Function**

Okay, so I'm digging into this `ath11k` driver, and I need to figure out the control flow for the QMI firmware readiness. I'm specifically trying to track down all calls to `ath11k_core_qmi_firmware_ready`. I'm guessing that understanding where this function is triggered is key to understanding the overall initialization and bring-up sequence of the QMI firmware on this platform.

I suspect that the critical path here likely involves an interaction between the core driver and some kind of hardware abstraction layer (HAL) or possibly a transport mechanism responsible for loading the firmware in the first place. I need to trace this call to figure out:

1.  *Where* in the boot process the firmware is considered ready. Is it during the hardware probe, or later during the device's functional initialization?
2.  *What* triggers this readiness? Is it a hardware signal, a successful firmware download, or a specific event from the QMI interface?
3.  *What happens* after this function is called? I'm curious about the subsequent actions, like device registration, QMI service initialization, or any other necessary control steps after firmware readiness.

{
  "Expression": "ath11k_core_qmi_firmware_ready",
  "PathPrefix": "drivers/net/wireless/ath/ath11k"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/core.c=2246=static int ath11k_core_start_firmware(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/core.c-2262-\ndrivers/net/wireless/ath/ath11k/core.c:2263:int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/core.c-2264-{\n--\ndrivers/net/wireless/ath/ath11k/core.c=2331=static int ath11k_core_reconfigure_on_crash(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/core.c-2351-\ndrivers/net/wireless/ath/ath11k/core.c:2352:\tret = ath11k_core_qmi_firmware_ready(ab);\ndrivers/net/wireless/ath/ath11k/core.c-2353-\tif (ret)\n--\ndrivers/net/wireless/ath/ath11k/core.h=1268=extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_qcn9074[];\ndrivers/net/wireless/ath/ath11k/core.h:1269:int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab);\ndrivers/net/wireless/ath/ath11k/core.h-1270-int ath11k_core_pre_init(struct ath11k_base *ab);\n--\ndrivers/net/wireless/ath/ath11k/qmi.c=3207=static void ath11k_qmi_driver_event_work(struct work_struct *work)\n--\ndrivers/net/wireless/ath/ath11k/qmi.c-3275-\t\t\t\tclear_bit(ATH11K_FLAG_RECOVERY, \u0026ab-\u003edev_flags);\ndrivers/net/wireless/ath/ath11k/qmi.c:3276:\t\t\t\tret = ath11k_core_qmi_firmware_ready(ab);\ndrivers/net/wireless/ath/ath11k/qmi.c-3277-\t\t\t\tif (ret) {\n--\ndrivers/net/wireless/ath/ath11k/qmi.c-3297-\t\t\tif (!test_bit(ATH11K_FLAG_REGISTERED, \u0026ab-\u003edev_flags)) {\ndrivers/net/wireless/ath/ath11k/qmi.c:3298:\t\t\t\tret = ath11k_core_qmi_firmware_ready(ab);\ndrivers/net/wireless/ath/ath11k/qmi.c-3299-\t\t\t\tif (ret) {\n"
}

gemini-3.8-flash

null

null

							input: 14276
							output: 130
							thoughts: 854
						

**My Assessment: Unfuzzable Code – ath11k/ath12k Drivers**

Okay, so this is about determining if the changes in these drivers are even *worth* fuzzing. We're talking about the ath11k and ath12k Qualcomm wireless drivers, and my initial thought is that we're dealing with hardware bringup here, QMI messaging, PCIe/AHB device probing, and firmware interaction. My concern is whether this code can actually be *reached* in a standard fuzzing environment.

I need to refer back to the instructions; specifically, Section 2 is key. The primary gate is reachability. The instructions are clear: if the modified code is structurally unreachable within standard virtualized environments (GCE or QEMU using software-emulated devices), it's a no-go for fuzzing. We can only fuzz code that *executes* in those environments. This whole "WorthFuzzing=false" scenario hinges on negative criteria.

The crucial negative criterion here? "Structurally unreachable hardware." Specifically: vendor-specific PCIe switches, SmartNICs, GPU drivers – the instructions even call out examples that aren't emulated in standard QEMU.

And that's what we have! I know ath11k and ath12k are Qualcomm 802.11ax and 802.11be drivers – they are *physical* hardware (PCIe/AHB platform devices). QEMU and GCE just don't emulate this; they don't simulate this hardware. The only emulated wireless devices I'm aware of in those environments are mac80211_hwsim, maybe virt_wifi, and USB wireless devices via Raw Gadget emulation (ath9k_htc, mt7601u, rtl8xxxu, etc.). Neither of those ath drivers has support for USB, they're PCI and AHB only!

Now, let's look at the files: `drivers/net/wireless/ath/ath11k/*` and `drivers/net/wireless/ath/ath12k/*`. Every single modified file is *exclusively* within those directories. No deviation. None of this code can be reached without actual physical Qualcomm ath11k or ath12k hardware. And as we know, that hardware isn't emulated.

Therefore, for this fuzzing effort:

*   **WorthFuzzing: false** – Strictly unreachable.
*   **FocusSymbols: \[\]** – No symbols to prioritize.
*   **EnableConfigs: \[\]** – No configurations to activate.
*   **Reasoning:** The changes are contained within the Qualcomm ath11k and ath12k Wi-Fi drivers, requiring physical Qualcomm PCIe/AHB hardware that isn't emulated in standard virtualized environments. The code is structurally unreachable, making fuzzing unproductive.

Let me just double-check, but I believe the results expect either an empty array `[]` or a null value in some places, so let's call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Qualcomm ath11k and ath12k wireless drivers (implementing wake_tx_queue callbacks and updating ring selector helpers). These drivers support physical Qualcomm 802.11ax and 802.11be hardware connected via PCIe or AHB buses, which are not emulated in standard virtualized fuzzing environments (QEMU/GCE) and have no software or USB emulation. Thus, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Qualcomm ath11k and ath12k wireless drivers (implementing wake_tx_queue callbacks and updating ring selector helpers). These drivers support physical Qualcomm 802.11ax and 802.11be hardware connected via PCIe or AHB buses, which are not emulated in standard virtualized fuzzing environments (QEMU/GCE) and have no software or USB emulation. Thus, the modified code is structurally unreachable.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null