AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the ath11k driver, which is a vendor-specific PCI/AHB driver for Qualcomm Wi-Fi 6 cards. This driver requires physical hardware that is not emulated in standard QEMU or virtualized environments, making the code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 1c9ebd381254cdfd271c089bf1eee186f5f93056\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Aug 12 18:25:23 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c\nindex 2d55cdc4d165d..0baa46df1fb95 100644\n--- a/drivers/net/wireless/ath/ath11k/mac.c\n+++ b/drivers/net/wireless/ath/ath11k/mac.c\n@@ -6699,6 +6699,7 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)\n \tar-\u003enum_started_vdevs = 0;\n \tar-\u003enum_created_vdevs = 0;\n \tar-\u003enum_peers = 0;\n+\tar-\u003enum_stations = 0;\n \tar-\u003eallocated_vdev_map = 0;\n \n \t/* Configure monitor status ring with default rx_filter to get rx status\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath11k driver, which is a vendor-specific PCI/AHB driver for Qualcomm Wi-Fi 6 cards. This driver requires physical hardware that is not emulated in standard QEMU or virtualized environments, making the code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 1c9ebd381254cdfd271c089bf1eee186f5f93056
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Aug 12 18:25:23 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 2d55cdc4d165d..0baa46df1fb95 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6699,6 +6699,7 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 	ar->num_started_vdevs = 0;
 	ar->num_created_vdevs = 0;
 	ar->num_peers = 0;
+	ar->num_stations = 0;
 	ar->allocated_vdev_map = 0;
 
 	/* Configure monitor status ring with default rx_filter to get rx status

gemini-3.1-pro-preview

null

null

							input: 2021
							output: 37
							thoughts: 220
						

**Analyzing the ath11k Driver Modification**

Okay, so I see this patch adding `ar->num_stations = 0;` to `ath11k_mac_op_start` within `drivers/net/wireless/ath/ath11k/mac.c`.  Right away, I recognize this is the driver for those Qualcomm Technologies 802.11ax WLAN devices. My initial thought is, can I even test this thing in QEMU?  That's always the first hurdle with these hardware-specific drivers.

Usually, with `ath11k`, you're dealing with physical hardware or some pretty specific PCI/AHB devices. I need to figure out if there's any emulation possible here, or if this is strictly a physical device driver.  A quick memory jog tells me `ath11k` is indeed a PCI/AHB driver designed for those newer Qualcomm Wi-Fi 6 cards.  That pretty much screams "unlikely to be reachable in a virtualized environment" without specialized physical hardware setups.

Wait, though... is there a trick? I know `mac80211_hwsim` *is* emulated, but `ath11k` is a real hardware driver.  I have to determine if there's any hidden emulation capability or if it's operating as a standard driver. I'll need to dig into the code. Time to fire up grepper and check for instances of `ath11k` within the codebase, that should give me a good indication.

{
  "Expression": "ath11k",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 26701 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath11k/Kconfig=2=config ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-10-\ndrivers/net/wireless/ath/ath11k/Kconfig:11:\t  If you choose to build a module, it'll be called ath11k.\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig=13=config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig:14:\ttristate \"Atheros ath11k AHB support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-15-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=20=config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig:21:\ttristate \"Atheros ath11k PCI support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-22-\tdepends on ATH11K \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=30=config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig:31:\tbool \"QCA ath11k debugging\"\ndrivers/net/wireless/ath/ath11k/Kconfig-32-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=38=config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig:39:\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-40-\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-41-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:42:\t  Enable ath11k debugfs support\ndrivers/net/wireless/ath/ath11k/Kconfig-43-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=46=config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig:47:\tbool \"ath11k tracing support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-48-\tdepends on ATH11K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-49-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:50:\t  Select this to use ath11k tracing infrastructure.\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig=52=config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig:53:\tbool \"QCA ath11k spectral scan support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-54-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-56-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:57:\t  Enable ath11k spectral scan support\ndrivers/net/wireless/ath/ath11k/Kconfig-58-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=61=config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig:62:\tbool \"ath11k channel frequency response support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-63-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-65-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:66:\t  Enable ath11k channel frequency response dump support.\ndrivers/net/wireless/ath/ath11k/Kconfig-67-\t  This option exposes debugfs nodes that will allow the user\n--\ndrivers/net/wireless/ath/ath11k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Makefile:2:obj-$(CONFIG_ATH11K) += ath11k.o\ndrivers/net/wireless/ath/ath11k/Makefile:3:ath11k-y += core.o \\\ndrivers/net/wireless/ath/ath11k/Makefile-4-\t    hal.o \\\n--\ndrivers/net/wireless/ath/ath11k/Makefile-23-\ndrivers/net/wireless/ath/ath11k/Makefile:24:ath11k-$(CONFIG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath11k/Makefile:25:ath11k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath11k/Makefile:26:ath11k-$(CONFIG_ATH11K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath11k/Makefile:27:ath11k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath11k/Makefile:28:ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath11k/Makefile:29:ath11k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath11k/Makefile:30:ath11k-$(CONFIG_DEV_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath11k/Makefile:31:ath11k-$(CONFIG_ATH11K_CFR) += cfr.o\ndrivers/net/wireless/ath/ath11k/Makefile-32-\ndrivers/net/wireless/ath/ath11k/Makefile:33:obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile:34:ath11k_ahb-y += ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-35-\ndrivers/net/wireless/ath/ath11k/Makefile:36:obj-$(CONFIG_ATH11K_PCI) += ath11k_pci.o\ndrivers/net/wireless/ath/ath11k/Makefile:37:ath11k_pci-y += mhi.o pci.o\ndrivers/net/wireless/ath/ath11k/Makefile-38-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-23-\ndrivers/net/wireless/ath/ath11k/ahb.c:24:static const struct of_device_id ath11k_ahb_of_match[] = {\ndrivers/net/wireless/ath/ath11k/ahb.c-25-\t/* TODO: Should we change the compatible string to something similar\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-42-\ndrivers/net/wireless/ath/ath11k/ahb.c:43:MODULE_DEVICE_TABLE(of, ath11k_ahb_of_match);\ndrivers/net/wireless/ath/ath11k/ahb.c-44-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=144=static int\ndrivers/net/wireless/ath/ath11k/ahb.c:145:ath11k_ahb_get_msi_irq_wcn6750(struct ath11k_base *ab, unsigned int vector)\ndrivers/net/wireless/ath/ath11k/ahb.c-146-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=150=static inline u32\ndrivers/net/wireless/ath/ath11k/ahb.c:151:ath11k_ahb_get_window_start_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-152-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=166=static void\ndrivers/net/wireless/ath/ath11k/ahb.c:167:ath11k_ahb_window_write32_wcn6750(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-168-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-171-\t/* WCN6750 uses static window based register access*/\ndrivers/net/wireless/ath/ath11k/ahb.c:172:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-173-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-177-\ndrivers/net/wireless/ath/ath11k/ahb.c:178:static u32 ath11k_ahb_window_read32_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-179-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-183-\t/* WCN6750 uses static window based register access */\ndrivers/net/wireless/ath/ath11k/ahb.c:184:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-185-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-190-\ndrivers/net/wireless/ath/ath11k/ahb.c:191:static const struct ath11k_pci_ops ath11k_ahb_pci_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c-192-\t.wakeup = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c-193-\t.release = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:194:\t.get_msi_irq = ath11k_ahb_get_msi_irq_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:195:\t.window_write32 = ath11k_ahb_window_write32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:196:\t.window_read32 = ath11k_ahb_window_read32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c-197-};\ndrivers/net/wireless/ath/ath11k/ahb.c-198-\ndrivers/net/wireless/ath/ath11k/ahb.c:199:static inline u32 ath11k_ahb_read32(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-200-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-203-\ndrivers/net/wireless/ath/ath11k/ahb.c:204:static inline void ath11k_ahb_write32(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-205-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-208-\ndrivers/net/wireless/ath/ath11k/ahb.c:209:static void ath11k_ahb_kill_tasklets(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-210-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-213-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:214:\t\tstruct ath11k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-215-\ndrivers/net/wireless/ath/ath11k/ahb.c:216:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-217-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-222-\ndrivers/net/wireless/ath/ath11k/ahb.c:223:static void ath11k_ahb_ext_grp_disable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-224-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-230-\ndrivers/net/wireless/ath/ath11k/ahb.c:231:static void __ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-232-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-235-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:236:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-237-\ndrivers/net/wireless/ath/ath11k/ahb.c:238:\t\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-239-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-247-\ndrivers/net/wireless/ath/ath11k/ahb.c:248:static void ath11k_ahb_ext_grp_enable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-249-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-255-\ndrivers/net/wireless/ath/ath11k/ahb.c:256:static void ath11k_ahb_setbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-257-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-259-\ndrivers/net/wireless/ath/ath11k/ahb.c:260:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:261:\tath11k_ahb_write32(ab, offset, val | BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-262-}\ndrivers/net/wireless/ath/ath11k/ahb.c-263-\ndrivers/net/wireless/ath/ath11k/ahb.c:264:static void ath11k_ahb_clearbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-265-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-267-\ndrivers/net/wireless/ath/ath11k/ahb.c:268:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:269:\tath11k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-270-}\ndrivers/net/wireless/ath/ath11k/ahb.c-271-\ndrivers/net/wireless/ath/ath11k/ahb.c:272:static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-273-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-283-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:284:\t\tath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-285-\ndrivers/net/wireless/ath/ath11k/ahb.c-286-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:287:\t\tath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:288:\t\tath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-289-\t\t\t\t    ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-292-\ndrivers/net/wireless/ath/ath11k/ahb.c:293:static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-294-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-304-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:305:\t\tath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-306-\ndrivers/net/wireless/ath/ath11k/ahb.c-307-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:308:\t\tath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:309:\t\tath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-310-\t\t\t\t      ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-313-\ndrivers/net/wireless/ath/ath11k/ahb.c:314:static void ath11k_ahb_sync_ce_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-315-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-319-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:320:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-321-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-327-\ndrivers/net/wireless/ath/ath11k/ahb.c:328:static void ath11k_ahb_sync_ext_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-329-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-333-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:334:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-335-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-342-\ndrivers/net/wireless/ath/ath11k/ahb.c:343:static void ath11k_ahb_ce_irqs_enable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-344-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-347-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:348:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-349-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:350:\t\tath11k_ahb_ce_irq_enable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-351-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-353-\ndrivers/net/wireless/ath/ath11k/ahb.c:354:static void ath11k_ahb_ce_irqs_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-355-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-358-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:359:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-360-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:361:\t\tath11k_ahb_ce_irq_disable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-362-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-364-\ndrivers/net/wireless/ath/ath11k/ahb.c:365:static int ath11k_ahb_start(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-366-{\ndrivers/net/wireless/ath/ath11k/ahb.c:367:\tath11k_ahb_ce_irqs_enable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:368:\tath11k_ce_rx_post_buf(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-369-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-372-\ndrivers/net/wireless/ath/ath11k/ahb.c:373:static void ath11k_ahb_ext_irq_enable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-374-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-377-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:378:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-379-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-383-\t\t}\ndrivers/net/wireless/ath/ath11k/ahb.c:384:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-385-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-387-\ndrivers/net/wireless/ath/ath11k/ahb.c:388:static void ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-389-{\ndrivers/net/wireless/ath/ath11k/ahb.c:390:\t__ath11k_ahb_ext_irq_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:391:\tath11k_ahb_sync_ext_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-392-}\ndrivers/net/wireless/ath/ath11k/ahb.c-393-\ndrivers/net/wireless/ath/ath11k/ahb.c:394:static void ath11k_ahb_stop(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-395-{\ndrivers/net/wireless/ath/ath11k/ahb.c-396-\tif (!test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ahb.c:397:\t\tath11k_ahb_ce_irqs_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:398:\tath11k_ahb_sync_ce_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:399:\tath11k_ahb_kill_tasklets(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-400-\ttimer_delete_sync(\u0026ab-\u003erx_replenish_retry);\ndrivers/net/wireless/ath/ath11k/ahb.c:401:\tath11k_ce_cleanup_pipes(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-402-}\ndrivers/net/wireless/ath/ath11k/ahb.c-403-\ndrivers/net/wireless/ath/ath11k/ahb.c:404:static int ath11k_ahb_power_up(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-405-{\ndrivers/net/wireless/ath/ath11k/ahb.c:406:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-407-\tint ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-410-\tif (ret)\ndrivers/net/wireless/ath/ath11k/ahb.c:411:\t\tath11k_err(ab, \"failed to boot the remote processor Q6\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-412-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-415-\ndrivers/net/wireless/ath/ath11k/ahb.c:416:static void ath11k_ahb_power_down(struct ath11k_base *ab, bool is_suspend)\ndrivers/net/wireless/ath/ath11k/ahb.c-417-{\ndrivers/net/wireless/ath/ath11k/ahb.c:418:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-419-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-422-\ndrivers/net/wireless/ath/ath11k/ahb.c:423:static void ath11k_ahb_init_qmi_ce_config(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-424-{\ndrivers/net/wireless/ath/ath11k/ahb.c:425:\tstruct ath11k_qmi_ce_cfg *cfg = \u0026ab-\u003eqmi.ce_cfg;\ndrivers/net/wireless/ath/ath11k/ahb.c-426-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-433-\ndrivers/net/wireless/ath/ath11k/ahb.c:434:static void ath11k_ahb_free_ext_irq_grp(struct ath11k_base *ab,\ndrivers/net/wireless/ath/ath11k/ahb.c:435:\t\t\t\t\tstruct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-436-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-445-\ndrivers/net/wireless/ath/ath11k/ahb.c:446:static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-447-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-450-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++)\ndrivers/net/wireless/ath/ath11k/ahb.c:451:\t\tath11k_ahb_free_ext_irq_grp(ab, \u0026ab-\u003eext_irq_grp[i]);\ndrivers/net/wireless/ath/ath11k/ahb.c-452-}\ndrivers/net/wireless/ath/ath11k/ahb.c-453-\ndrivers/net/wireless/ath/ath11k/ahb.c:454:static void ath11k_ahb_free_ce_irqs(struct ath11k_base *ab, int max_idx)\ndrivers/net/wireless/ath/ath11k/ahb.c-455-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-458-\tfor (i = 0; i \u003c max_idx; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:459:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-460-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-465-\ndrivers/net/wireless/ath/ath11k/ahb.c:466:static void ath11k_ahb_free_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-467-{\ndrivers/net/wireless/ath/ath11k/ahb.c-468-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:469:\t\treturn ath11k_pcic_free_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-470-\ndrivers/net/wireless/ath/ath11k/ahb.c:471:\tath11k_ahb_free_ce_irqs(ab, ab-\u003ehw_params.ce_count);\ndrivers/net/wireless/ath/ath11k/ahb.c:472:\tath11k_ahb_free_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-473-}\ndrivers/net/wireless/ath/ath11k/ahb.c-474-\ndrivers/net/wireless/ath/ath11k/ahb.c:475:static void ath11k_ahb_ce_tasklet(struct tasklet_struct *t)\ndrivers/net/wireless/ath/ath11k/ahb.c-476-{\ndrivers/net/wireless/ath/ath11k/ahb.c:477:\tstruct ath11k_ce_pipe *ce_pipe = from_tasklet(ce_pipe, t, intr_tq);\ndrivers/net/wireless/ath/ath11k/ahb.c-478-\ndrivers/net/wireless/ath/ath11k/ahb.c:479:\tath11k_ce_per_engine_service(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-480-\ndrivers/net/wireless/ath/ath11k/ahb.c:481:\tath11k_ahb_ce_irq_enable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-482-}\ndrivers/net/wireless/ath/ath11k/ahb.c-483-\ndrivers/net/wireless/ath/ath11k/ahb.c:484:static irqreturn_t ath11k_ahb_ce_interrupt_handler(int irq, void *arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-485-{\ndrivers/net/wireless/ath/ath11k/ahb.c:486:\tstruct ath11k_ce_pipe *ce_pipe = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-487-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-490-\ndrivers/net/wireless/ath/ath11k/ahb.c:491:\tath11k_ahb_ce_irq_disable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-492-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-497-\ndrivers/net/wireless/ath/ath11k/ahb.c:498:static int ath11k_ahb_ext_grp_napi_poll(struct napi_struct *napi, int budget)\ndrivers/net/wireless/ath/ath11k/ahb.c-499-{\ndrivers/net/wireless/ath/ath11k/ahb.c:500:\tstruct ath11k_ext_irq_grp *irq_grp = container_of(napi,\ndrivers/net/wireless/ath/ath11k/ahb.c:501:\t\t\t\t\t\tstruct ath11k_ext_irq_grp,\ndrivers/net/wireless/ath/ath11k/ahb.c-502-\t\t\t\t\t\tnapi);\ndrivers/net/wireless/ath/ath11k/ahb.c:503:\tstruct ath11k_base *ab = irq_grp-\u003eab;\ndrivers/net/wireless/ath/ath11k/ahb.c-504-\tint work_done;\ndrivers/net/wireless/ath/ath11k/ahb.c-505-\ndrivers/net/wireless/ath/ath11k/ahb.c:506:\twork_done = ath11k_dp_service_srng(ab, irq_grp, budget);\ndrivers/net/wireless/ath/ath11k/ahb.c-507-\tif (work_done \u003c budget) {\ndrivers/net/wireless/ath/ath11k/ahb.c-508-\t\tnapi_complete_done(napi, work_done);\ndrivers/net/wireless/ath/ath11k/ahb.c:509:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-510-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-517-\ndrivers/net/wireless/ath/ath11k/ahb.c:518:static irqreturn_t ath11k_ahb_ext_interrupt_handler(int irq, void *arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-519-{\ndrivers/net/wireless/ath/ath11k/ahb.c:520:\tstruct ath11k_ext_irq_grp *irq_grp = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-521-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-524-\ndrivers/net/wireless/ath/ath11k/ahb.c:525:\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-526-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-531-\ndrivers/net/wireless/ath/ath11k/ahb.c:532:static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-533-{\ndrivers/net/wireless/ath/ath11k/ahb.c:534:\tstruct ath11k_hw_params *hw = \u0026ab-\u003ehw_params;\ndrivers/net/wireless/ath/ath11k/ahb.c:535:\tstruct ath11k_ext_irq_grp *irq_grp;\ndrivers/net/wireless/ath/ath11k/ahb.c-536-\tint i, j;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-555-\t\tnetif_napi_add(irq_grp-\u003enapi_ndev, \u0026irq_grp-\u003enapi,\ndrivers/net/wireless/ath/ath11k/ahb.c:556:\t\t\t       ath11k_ahb_ext_grp_napi_poll);\ndrivers/net/wireless/ath/ath11k/ahb.c-557-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-581-\t\t\t\t\t\trxdma2host_destination_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:582:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-583-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-587-\t\t\t\t\t\thost2rxdma_host_buf_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:588:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-589-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-593-\t\t\t\t\t\tppdu_end_interrupts_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:594:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-595-\t\t\t\t\tirq_grp-\u003eirqs[num_irq++] =\ndrivers/net/wireless/ath/ath11k/ahb.c-596-\t\t\t\t\t\trxdma2host_monitor_status_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:597:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-598-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-606-\t\t\tirq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY);\ndrivers/net/wireless/ath/ath11k/ahb.c:607:\t\t\tret = request_irq(irq, ath11k_ahb_ext_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-608-\t\t\t\t\t  IRQF_TRIGGER_RISING,\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-610-\t\t\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:611:\t\t\t\tath11k_err(ab, \"failed request_irq for %d\\n\",\ndrivers/net/wireless/ath/ath11k/ahb.c-612-\t\t\t\t\t   irq);\ndrivers/net/wireless/ath/ath11k/ahb.c-613-\t\t\t\tirq_grp-\u003enum_irq = j;\ndrivers/net/wireless/ath/ath11k/ahb.c:614:\t\t\t\tath11k_ahb_free_ext_irq_grp(ab, irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-615-\t\t\t\tgoto err_request_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-627-\t\tirq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c:628:\t\tath11k_ahb_free_ext_irq_grp(ab, irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-629-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-632-\ndrivers/net/wireless/ath/ath11k/ahb.c:633:static int ath11k_ahb_config_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-634-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-638-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:639:\t\treturn ath11k_pcic_config_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-640-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-642-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:643:\t\tstruct ath11k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-644-\ndrivers/net/wireless/ath/ath11k/ahb.c:645:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-646-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-649-\ndrivers/net/wireless/ath/ath11k/ahb.c:650:\t\ttasklet_setup(\u0026ce_pipe-\u003eintr_tq, ath11k_ahb_ce_tasklet);\ndrivers/net/wireless/ath/ath11k/ahb.c-651-\t\tirq = platform_get_irq_byname(ab-\u003epdev, irq_name[irq_idx]);\ndrivers/net/wireless/ath/ath11k/ahb.c:652:\t\tret = request_irq(irq, ath11k_ahb_ce_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-653-\t\t\t\t  IRQF_TRIGGER_RISING, irq_name[irq_idx],\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-655-\t\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:656:\t\t\tath11k_err(ab, \"failed request_irq for %d\\n\", irq);\ndrivers/net/wireless/ath/ath11k/ahb.c:657:\t\t\tath11k_ahb_free_ce_irqs(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-658-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-664-\t/* Configure external interrupts */\ndrivers/net/wireless/ath/ath11k/ahb.c:665:\tret = ath11k_ahb_config_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-666-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:667:\t\tath11k_err(ab, \"failed to configure ext irq: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c:668:\t\tath11k_ahb_free_ce_irqs(ab, ab-\u003ehw_params.ce_count);\ndrivers/net/wireless/ath/ath11k/ahb.c-669-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-674-\ndrivers/net/wireless/ath/ath11k/ahb.c:675:static int ath11k_ahb_map_service_to_pipe(struct ath11k_base *ab, u16 service_id,\ndrivers/net/wireless/ath/ath11k/ahb.c-676-\t\t\t\t\t  u8 *ul_pipe, u8 *dl_pipe)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-717-\ndrivers/net/wireless/ath/ath11k/ahb.c:718:static int ath11k_ahb_hif_suspend(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-719-{\ndrivers/net/wireless/ath/ath11k/ahb.c:720:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-721-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-731-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:732:\t\tath11k_err(ab, \"failed to enable wakeup irq :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-733-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-743-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:744:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-745-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-747-\ndrivers/net/wireless/ath/ath11k/ahb.c:748:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device suspended\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-749-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-752-\ndrivers/net/wireless/ath/ath11k/ahb.c:753:static int ath11k_ahb_hif_resume(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-754-{\ndrivers/net/wireless/ath/ath11k/ahb.c:755:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-756-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-766-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:767:\t\tath11k_err(ab, \"failed to disable wakeup irq: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-768-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-780-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:781:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-782-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-786-\tif (ret == 0) {\ndrivers/net/wireless/ath/ath11k/ahb.c:787:\t\tath11k_warn(ab, \"timed out while waiting for wow wakeup completion\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-788-\t\treturn -ETIMEDOUT;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-790-\ndrivers/net/wireless/ath/ath11k/ahb.c:791:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device resumed\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-792-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-795-\ndrivers/net/wireless/ath/ath11k/ahb.c:796:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_ipq8074 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:797:\t.start = ath11k_ahb_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:798:\t.stop = ath11k_ahb_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:799:\t.read32 = ath11k_ahb_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:800:\t.write32 = ath11k_ahb_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-801-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:802:\t.irq_enable = ath11k_ahb_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:803:\t.irq_disable = ath11k_ahb_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:804:\t.map_service_to_pipe = ath11k_ahb_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:805:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:806:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c-807-};\ndrivers/net/wireless/ath/ath11k/ahb.c-808-\ndrivers/net/wireless/ath/ath11k/ahb.c:809:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:810:\t.start = ath11k_pcic_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:811:\t.stop = ath11k_pcic_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:812:\t.read32 = ath11k_pcic_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:813:\t.write32 = ath11k_pcic_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-814-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:815:\t.irq_enable = ath11k_pcic_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:816:\t.irq_disable = ath11k_pcic_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:817:\t.get_msi_address =  ath11k_pcic_get_msi_address,\ndrivers/net/wireless/ath/ath11k/ahb.c:818:\t.get_user_msi_vector = ath11k_pcic_get_user_msi_assignment,\ndrivers/net/wireless/ath/ath11k/ahb.c:819:\t.map_service_to_pipe = ath11k_pcic_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:820:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:821:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c:822:\t.suspend = ath11k_ahb_hif_suspend,\ndrivers/net/wireless/ath/ath11k/ahb.c:823:\t.resume = ath11k_ahb_hif_resume,\ndrivers/net/wireless/ath/ath11k/ahb.c:824:\t.ce_irq_enable = ath11k_pci_enable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c:825:\t.ce_irq_disable = ath11k_pci_disable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c-826-};\ndrivers/net/wireless/ath/ath11k/ahb.c-827-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 17609
							output: 42
							thoughts: 319
						

**My Approach to Testing the ath11k Driver**

Okay, so I'm looking at the `ath11k` driver for Qualcomm Atheros, and it supports both AHB and PCI. The immediate question is, can I get this tested, particularly within a QEMU environment?

Initially, I thought about `CONFIG_NL80211_TESTMODE` and `mac80211_hwsim` – those are the usual suspects for testing, but that's really for the mac80211 framework itself. `ath11k` *is* a hardware driver, so I'm thinking, can I fake it out? Can I use a virtual PCI device somehow to trick the system?

Now, I know syzkaller isn't set up to directly fuzz hardware drivers like this, unless there's a specific emulation or a software interface for it. Wait, actually, syzkaller does fuzz Wi-Fi drivers, but it uses `mac80211_hwsim` or `vhci` for USB. For PCI and AHB drivers, though, it lacks that generic emulation method unless there's a specific QEMU device available or it's a virtual driver.

Hold on a second... I remember there are `syz_80211_...` pseudo-syscalls. Those interact with `mac80211` and `cfg80211` directly. That might be useful. The key issue, though, is that if `ath11k` isn't loaded because there's no hardware to work with, things like `ath11k_mac_op_start` will never be called. So I need to see if there's a way to load the thing without real hardware being present.

My next step is to see if I can force it to load and initialize. I will start by checking the `ath11k_pci_probe` or `ath11k_ahb_probe` functions to see how that's done.

{
  "Expression": "ath11k_pci_probe",
  "PathPrefix": "drivers/net/wireless/ath/ath11k/"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/pci.c=940=static int ath11k_pci_set_irq_affinity_hint(struct ath11k_pci *ab_pci,\n--\ndrivers/net/wireless/ath/ath11k/pci.c-948-\ndrivers/net/wireless/ath/ath11k/pci.c:949:static int ath11k_pci_probe(struct pci_dev *pdev,\ndrivers/net/wireless/ath/ath11k/pci.c-950-\t\t\t    const struct pci_device_id *pci_dev)\n--\ndrivers/net/wireless/ath/ath11k/pci.c=1296=static struct pci_driver ath11k_pci_driver = {\n--\ndrivers/net/wireless/ath/ath11k/pci.c-1298-\t.id_table = ath11k_pci_id_table,\ndrivers/net/wireless/ath/ath11k/pci.c:1299:\t.probe = ath11k_pci_probe,\ndrivers/net/wireless/ath/ath11k/pci.c-1300-\t.remove = ath11k_pci_remove,\n"
}

gemini-3.1-pro-preview

null

null

							input: 18749
							output: 25
							thoughts: 201
						

**My Initial Assessment of the PCI Driver's Probable Fuzzing Obstacles**

Okay, so I'm looking at this PCI driver. The first thing that jumps out is the dependency on a very specific PCI device - a Qualcomm device identified by its vendor and device IDs. Right, and that means if QEMU isn't set up to specifically *emulate* that particular Qualcomm device, the driver's never going to probe, which is a big hurdle for fuzzing.

Now, my initial thought is, does syzkaller handle that situation? Does it emulate ath11k PCI devices? No, I quickly remember that syzkaller generally doesn’t emulate those specific Wi-Fi PCI cards. It leans on `mac80211_hwsim` for Wi-Fi fuzzing, which is a different approach entirely.

Hold on, I thought I’d seen something about PCI devices… Does syzkaller offer pseudo-syscalls like `syz_pci_...`? No, I don't believe so. It has those `syz_usb_...` for USB devices, but I don’t recall a corresponding set for PCI. Unless I’m mistaken... Wait, doesn't it have those `syz_kvm_...` calls and some PCI fuzzing support through `vfio` or similar? It might... Maybe there is `syz_pci_...`? I should probably double-check that, just to be sure. It's best not to assume. Let me go back and verify.

no matches

{
  "Expression": "syz_pci",
  "PathPrefix": ""
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 19320
							output: 90
							thoughts: 206
						

**WorthFuzzing Decision for ath11k**

Okay, first things first, I can't just blindly search the kernel sources for `syz_` – those are Syzkaller pseudo-syscalls. But the prompt… the prompt is key. It's asking about vendor-specific code that needs *real* PCIe hardware, stuff that isn't replicated in standard QEMU. That list includes mlxsw, pds_core, qed, ionic, and amdgpu, specifically calling out the need for physical hardware cards.

Now, *ath11k*... that's a PCIe/AHB Wi-Fi driver, and vendor-specific. And the prompt is clear: any code relying on that physical hardware *cannot* be reached in a virtualized QEMU environment. Since `ath11k` is explicitly in this category, and specifically requires that physical hardware, it follows that any changes, if they rely on the need for that hardware, are impossible to reach in my tests. Therefore, I will return `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath11k driver, which is a vendor-specific PCI/AHB driver for Qualcomm Wi-Fi 6 cards. This driver requires physical hardware that is not emulated in standard QEMU or virtualized environments, making the code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath11k driver, which is a vendor-specific PCI/AHB driver for Qualcomm Wi-Fi 6 cards. This driver requires physical hardware that is not emulated in standard QEMU or virtualized environments, making the code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null