AI Trajectory

null

{
  "EnableConfigs": [
    "MT76_CORE",
    "MT792x_LIB",
    "MT7921U",
    "MAC80211",
    "CFG80211"
  ],
  "FocusSymbols": [
    "mt792x_init_wiphy",
    "mt76_register_device",
    "mt76_register_phy"
  ],
  "KMSANReasoning": "The patch enables the NL80211_FEATURE_ACTIVE_MONITOR feature flag unconditionally for all mt76 wireless devices by removing the `no_active_monitor` flag from `struct mt76_phy` and the override in `mt792x_init_wiphy`.\n\nThis change only modifies a feature bitmask flag on the wiphy device and removes a struct field. It does not introduce new data structures, uninitialized stack or heap allocations, uninitialized padding/fields copied to userspace, or branching on uninitialized variables. Therefore, there are no uninitialized memory or information leak risks that would require KMSAN fuzzing, and standard KASAN/syzkaller testing is sufficient.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch removes the no_active_monitor flag and unconditionally enables NL80211_FEATURE_ACTIVE_MONITOR for MediaTek mt76 / mt792x wireless drivers. These drivers are reachable in virtualized environments via USB emulation (e.g. mt7921u), allowing active monitor interface creation and handling via nl80211.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 0b63453db8701f8912125d5acfc250d54507beca\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Sep 5 04:42:14 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c\nindex abbe65cbcd89e..f92277770488a 100644\n--- a/drivers/net/wireless/mediatek/mt76/mac80211.c\n+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c\n@@ -439,9 +439,8 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)\n \tSET_IEEE80211_DEV(hw, dev-\u003edev);\n \tSET_IEEE80211_PERM_ADDR(hw, phy-\u003emacaddr);\n \n-\twiphy-\u003efeatures |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;\n-\tif (!phy-\u003eno_active_monitor)\n-\t\twiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR;\n+\twiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR |\n+\t\t\t   NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;\n \twiphy-\u003eflags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |\n \t\t\tWIPHY_FLAG_SUPPORTS_TDLS |\n \t\t\tWIPHY_FLAG_AP_UAPSD;\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h\nindex 62b41c8bb7c0d..61ef1b80feb85 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt76.h\n+++ b/drivers/net/wireless/mediatek/mt76/mt76.h\n@@ -873,7 +873,6 @@ struct mt76_phy {\n \tstruct cfg80211_chan_def main_chandef;\n \tbool offchannel;\n \tbool radar_enabled;\n-\tbool no_active_monitor;\n \n \tstruct delayed_work roc_work;\n \tstruct ieee80211_vif *roc_vif;\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c\nindex 0ad33f74c2285..837d7af984e86 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c\n@@ -820,7 +820,6 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)\n \n \twiphy-\u003efeatures |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |\n \t\t\t   NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;\n-\tphy-\u003emt76-\u003eno_active_monitor = true;\n \twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_SET_SCAN_DWELL);\n \twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);\n \twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HT);\n"
}

core

null

{
  "EnableConfigs": [
    "MT76_CORE",
    "MT792x_LIB",
    "MT7921U",
    "MAC80211",
    "CFG80211"
  ],
  "FocusSymbols": [
    "mt792x_init_wiphy",
    "mt76_register_device",
    "mt76_register_phy"
  ],
  "Reasoning": "The patch removes the no_active_monitor flag and unconditionally enables NL80211_FEATURE_ACTIVE_MONITOR for MediaTek mt76 / mt792x wireless drivers. These drivers are reachable in virtualized environments via USB emulation (e.g. mt7921u), allowing active monitor interface creation and handling via nl80211.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 0b63453db8701f8912125d5acfc250d54507beca
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Sep 5 04:42:14 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index abbe65cbcd89e..f92277770488a 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -439,9 +439,8 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
 	SET_IEEE80211_DEV(hw, dev->dev);
 	SET_IEEE80211_PERM_ADDR(hw, phy->macaddr);
 
-	wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
-	if (!phy->no_active_monitor)
-		wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+	wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
+			   NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
 	wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |
 			WIPHY_FLAG_SUPPORTS_TDLS |
 			WIPHY_FLAG_AP_UAPSD;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 62b41c8bb7c0d..61ef1b80feb85 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -873,7 +873,6 @@ struct mt76_phy {
 	struct cfg80211_chan_def main_chandef;
 	bool offchannel;
 	bool radar_enabled;
-	bool no_active_monitor;
 
 	struct delayed_work roc_work;
 	struct ieee80211_vif *roc_vif;
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index 0ad33f74c2285..837d7af984e86 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -820,7 +820,6 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)
 
 	wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
 			   NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
-	phy->mt76->no_active_monitor = true;
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HT);

gemini-3.7-flash

null

null

							input: 3608
							output: 38
							thoughts: 409
						

**Analyzing This Patch for Syzkaller Fuzzing Potential**

Okay, let's break this down. First, I need to figure out if this patch is a good candidate for fuzzing with syzkaller. From the summary, it looks like it touches the MediaTek wireless drivers: `mt76` and `mt792x`. Specifically, `mac80211.c`, `mt76.h`, and `mt792x_core.c` have been modified. It seems like the patch removes a check and a variable related to active monitoring in the `mt76_phy_init` and `mt792x_init_wiphy` functions. This might change how active monitoring features are handled.

Now, the critical question is: can these drivers be fuzzed in a standard virtualized environment with syzkaller? Are these drivers tied to specific hardware, or are there emulated or virtual interfaces I can leverage? My immediate thought is, are the `mt76` devices USB, PCIe, or something virtual? I remember seeing `mt76` USB drivers, like `mt76x0u`, `mt76x2u`, and `mt7921u`, but I need to confirm if those are relevant. Are these drivers purely hardware-dependent, or can I reach them through USB Raw Gadget or `mac80211_hwsim` for fuzzing?

Wait, hold on...I need to clarify: `mt76` drivers are for MediaTek hardware (MT76xx / MT792x). I need to check if those devices are USB based, and if USB fuzzing reaches them. Since I'm not entirely clear on the bus interface for this hardware, I'll need to search the kernel tree for `mt76` and `mt792x` more thoroughly to understand exactly how they are reached and their overall reachability. That will dictate the best approach for syzkaller integration.

{
  "Expression": "mt792x_",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "\nFull output is too long, showing 500 out of 6242 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Makefile=28=CFLAGS_mt76x02_trace.o := -I$(src)\ndrivers/net/wireless/mediatek/mt76/Makefile:29:CFLAGS_mt792x_trace.o := -I$(src)\ndrivers/net/wireless/mediatek/mt76/Makefile-30-\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=38=mt76-connac-lib-y := mt76_connac_mcu.o mt76_connac_mac.o mt76_connac3_mac.o\ndrivers/net/wireless/mediatek/mt76/Makefile-39-\ndrivers/net/wireless/mediatek/mt76/Makefile:40:mt792x-lib-y := mt792x_core.o mt792x_mac.o mt792x_trace.o \\\ndrivers/net/wireless/mediatek/mt76/Makefile:41:\t\tmt792x_debugfs.o mt792x_dma.o\ndrivers/net/wireless/mediatek/mt76/Makefile:42:mt792x-lib-$(CONFIG_ACPI) += mt792x_acpi_sar.o\ndrivers/net/wireless/mediatek/mt76/Makefile:43:mt792x-usb-y := mt792x_usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-44-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-6-#include \"mt76_connac_mcu.h\"\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:7:#include \"mt792x_regs.h\"\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-8-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=7=mt7921_reg_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-8-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:9:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-10-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:11:\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-12-\tmt76_wr(dev, dev-\u003emt76.debugfs_reg, val);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:13:\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-14-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=19=mt7921_reg_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-20-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:21:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-22-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:23:\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-24-\t*val = mt76_rr(dev, dev-\u003emt76.debugfs_reg);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:25:\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-26-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=33=mt7921_fw_debug_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-34-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:35:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-36-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:37:\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-38-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-41-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:42:\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-43-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=48=mt7921_fw_debug_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-49-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:50:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-51-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=57=DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug, mt7921_fw_debug_get,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-59-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:60:DEFINE_SHOW_ATTRIBUTE(mt792x_tx_stats);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-61-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=91=mt7921_txpwr(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-92-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:93:\tstruct mt792x_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-94-\tstruct mt7921_txpwr txpwr;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-96-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:97:\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-98-\tret = mt7921_get_txpwr_info(dev, \u0026txpwr);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:99:\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-100-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=143=mt7921_pm_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-144-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:145:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-146-\tstruct mt76_connac_pm *pm = \u0026dev-\u003epm;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=176=mt7921_pm_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-177-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:178:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-179-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=188=mt7921_deep_sleep_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-189-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:190:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-191-\tstruct mt76_connac_pm *pm = \u0026dev-\u003epm;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-197-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:198:\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-199-\tif (pm-\u003eds_enable_user == enable)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-205-out:\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:206:\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-207-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=212=mt7921_deep_sleep_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-213-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:214:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-215-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=221=DEFINE_DEBUGFS_ATTRIBUTE(fops_ds, mt7921_deep_sleep_get,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-223-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:224:DEFINE_DEBUGFS_ATTRIBUTE(fops_pm_idle_timeout, mt792x_pm_idle_timeout_get,\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:225:\t\t\t mt792x_pm_idle_timeout_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-226-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=227=static int mt7921_chip_reset(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-228-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:229:\tstruct mt792x_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-230-\tint ret = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-234-\t\t/* Reset wifisys directly. */\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:235:\t\tmt792x_reset(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-236-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-238-\t\t/* Collect the core dump before reset wifisys. */\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:239:\t\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-240-\t\tret = mt76_connac_mcu_chip_config(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:241:\t\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-242-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=251=mt7921s_sched_quota_read(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-252-{\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:253:\tstruct mt792x_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-254-\tstruct mt76_sdio *sdio = \u0026dev-\u003emt76.sdio;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-263-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:264:int mt7921_init_debugfs(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-265-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-271-\t\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"xmit-queues\",\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:272:\t\t\t\t\t    dir, mt792x_queues_read);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-273-\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-277-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"acq\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:278:\t\t\t\t    mt792x_queues_acq);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-279-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"txpower_sku\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-280-\t\t\t\t    mt7921_txpwr);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:281:\tdebugfs_create_file(\"tx_stats\", 0400, dir, dev, \u0026mt792x_tx_stats_fops);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-282-\tdebugfs_create_file(\"fw_debug\", 0600, dir, dev, \u0026fops_fw_debug);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-287-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"runtime_pm_stats\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:288:\t\t\t\t    mt792x_pm_stats);\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-289-\tdebugfs_create_file(\"deep-sleep\", 0600, dir, dev, \u0026fops_ds);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c=14=static ssize_t mt7921_thermal_temp_show(struct device *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-19-\tcase 0: {\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:20:\t\tstruct mt792x_phy *phy = dev_get_drvdata(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:21:\t\tstruct mt792x_dev *mdev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-22-\t\tint temperature;\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-23-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:24:\t\tmt792x_mutex_acquire(mdev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-25-\t\ttemperature = mt7921_mcu_get_temperature(phy);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:26:\t\tmt792x_mutex_release(mdev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-27-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c=43=ATTRIBUTE_GROUPS(mt7921_hwmon);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-44-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:45:static int mt7921_thermal_init(struct mt792x_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-46-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-63-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:64:int mt7921_mac_init(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-65-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-77-\tfor (i = 0; i \u003c 2; i++)\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:78:\t\tmt792x_mac_init_band(dev, i);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-79-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c=82=EXPORT_SYMBOL_GPL(mt7921_mac_init);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-83-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:84:static int __mt7921_init_hardware(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-85-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-91-\tmt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:92:\tret = mt792x_mcu_init(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-93-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-108-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:109:static int mt7921_init_hardware(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-110-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-119-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:120:\t\tmt792x_init_reset(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-121-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c=131=static void mt7921_init_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-132-{\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:133:\tstruct mt792x_dev *dev = container_of(work, struct mt792x_dev,\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-134-\t\t\t\t\t      init_work);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-142-\tmt7921_set_stream_he_caps(\u0026dev-\u003ephy);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:143:\tmt792x_config_mac_addr_list(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-144-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-169-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:170:int mt7921_register_device(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-171-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-177-\tdev-\u003emt76.phy.priv = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:178:\tdev-\u003emt76.tx_worker.fn = mt792x_tx_worker;\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-179-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:180:\tINIT_DELAYED_WORK(\u0026dev-\u003epm.ps_work, mt792x_pm_power_save_work);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:181:\tINIT_WORK(\u0026dev-\u003epm.wake_work, mt792x_pm_wake_work);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-182-\tspin_lock_init(\u0026dev-\u003epm.wake.lock);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-188-\tspin_lock_init(\u0026dev-\u003epm.txq_lock);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:189:\tINIT_DELAYED_WORK(\u0026dev-\u003emphy.mac_work, mt792x_mac_work);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-190-\tINIT_DELAYED_WORK(\u0026dev-\u003ephy.scan_work, mt7921_scan_work);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-202-\tINIT_WORK(\u0026dev-\u003ephy.roc_work, mt7921_roc_work);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:203:\ttimer_setup(\u0026dev-\u003ephy.roc_timer, mt792x_roc_timer, 0);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-204-\tinit_waitqueue_head(\u0026dev-\u003ephy.roc_wait);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-220-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:221:\tmt792x_init_acpi_sar(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-222-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:223:\tret = mt792x_init_wcid(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-224-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-226-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:227:\tret = mt792x_init_wiphy(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-228-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-18-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:19:bool mt7921_mac_wtbl_update(struct mt792x_dev *dev, int idx, u32 mask)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-20-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=28=static u32 mt7921_mac_wtbl_lmac_addr(int idx, u8 offset)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-32-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:33:static void mt7921_mac_sta_poll(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-34-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-41-\tstruct ieee80211_sta *sta;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:42:\tstruct mt792x_sta *msta;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:43:\tstruct mt792x_link_sta *mlink;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-44-\tu32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-65-\t\tmlink = list_first_entry(\u0026sta_poll_list,\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:66:\t\t\t\t\t struct mt792x_link_sta,\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-67-\t\t\t\t\t wcid.poll_list);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:68:\t\tmsta = container_of(mlink, struct mt792x_sta, deflink);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-69-\t\tlist_del_init(\u0026mlink-\u003ewcid.poll_list);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=168=static int\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:169:mt7921_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-170-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-177-\tstruct mt76_phy *mphy = \u0026dev-\u003emt76.phy;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:178:\tstruct mt792x_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-179-\tstruct ieee80211_supported_band *sband;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-185-\tu32 rxd4 = le32_to_cpu(rxd[4]);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:186:\tstruct mt792x_sta *msta = NULL;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:187:\tstruct mt792x_link_sta *mlink;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-188-\tu16 seq_ctrl = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-214-\tidx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:215:\tstatus-\u003ewcid = mt792x_rx_get_wcid(dev, idx, unicast);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-216-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-217-\tif (status-\u003ewcid) {\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:218:\t\tmlink = container_of(status-\u003ewcid, struct mt792x_link_sta, wcid);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:219:\t\tmsta = container_of(mlink, struct mt792x_sta, deflink);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-220-\t\tmt76_wcid_add_poll(\u0026dev-\u003emt76, \u0026mlink-\u003ewcid);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-222-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:223:\tmt792x_get_status_freq_info(status, chfreq);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-224-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-431-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:432:\tmt792x_mac_assoc_rssi(dev, skb);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-433-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-446-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:447:void mt7921_mac_add_txs(struct mt792x_dev *dev, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-448-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:449:\tstruct mt792x_link_sta *mlink;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-450-\tstruct mt76_wcid *wcid;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-472-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:473:\tmlink = container_of(wcid, struct mt792x_link_sta, wcid);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-474-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-484-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:485:static void mt7921_mac_tx_free(struct mt792x_dev *dev, void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-486-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-514-\t\tif (info \u0026 MT_TX_FREE_PAIR) {\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:515:\t\t\tstruct mt792x_link_sta *mlink;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-516-\t\t\tu16 idx;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-524-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:525:\t\t\tmlink = container_of(wcid, struct mt792x_link_sta, wcid);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-526-\t\t\tmt76_wcid_add_poll(\u0026dev-\u003emt76, \u0026mlink-\u003ewcid);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=562=bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-563-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:564:\tstruct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-565-\t__le32 *rxd = (__le32 *)data;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=587=void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-589-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:590:\tstruct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-591-\t__le32 *rxd = (__le32 *)skb-\u003edata;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=634=mt7921_vif_connect_iter(void *priv, u8 *mac,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-636-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:637:\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:638:\tstruct mt792x_dev *dev = mvif-\u003ephy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-639-\tstruct ieee80211_hw *hw = mt76_hw(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=659=void mt7921_mac_reset_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-660-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:661:\tstruct mt792x_dev *dev = container_of(work, struct mt792x_dev,\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-662-\t\t\t\t\t      reset_work);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-680-\t\tmutex_lock(\u0026dev-\u003emt76.mutex);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:681:\t\tret = mt792x_dev_reset(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-682-\t\tmutex_unlock(\u0026dev-\u003emt76.mutex);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=715=void mt7921_coredump_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-716-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:717:\tstruct mt792x_dev *dev;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-718-\tchar *dump, *data;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-719-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:720:\tdev = (struct mt792x_dev *)container_of(work, struct mt792x_dev,\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-721-\t\t\t\t\t\tcoredump.work.work);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-758-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:759:\tmt792x_reset(\u0026dev-\u003emt76);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-760-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=763=static void\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:764:mt7921_usb_sdio_write_txwi(struct mt792x_dev *dev, struct mt76_wcid *wcid,\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-765-\t\t\t   enum mt76_txq_id qid, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=776=int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-780-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:781:\tstruct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-782-\tstruct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info-\u003eskb);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-797-\tif (sta) {\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:798:\t\tstruct mt792x_sta *msta = (struct mt792x_sta *)sta-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-799-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-809-\ttype = mt76_is_sdio(mdev) ? MT7921_SDIO_DATA : 0;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:810:\tmt792x_skb_add_usb_sdio_hdr(dev, skb, type);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-811-\tpad = round_up(skb-\u003elen, 4) - skb-\u003elen;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=845=bool mt7921_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-846-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:847:\tstruct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-848-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:849:\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-850-\tmt7921_mac_sta_poll(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:851:\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-852-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=858=void mt7921_set_ipv6_ns_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-859-{\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:860:\tstruct mt792x_dev *dev = container_of(work, struct mt792x_dev,\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-861-\t\t\t\t\t      ipv6_ns_work);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-870-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:871:\t\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-872-\t\tret = mt76_mcu_skb_send_msg(\u0026dev-\u003emt76, skb,\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-873-\t\t\t\t\t    MCU_UNI_CMD(OFFLOAD), true);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:874:\t\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-875-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=13=static int\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:14:mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band,\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-15-\t\t    struct ieee80211_sband_iftype_data *data)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-195-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:196:void mt7921_set_stream_he_caps(struct mt792x_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-197-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-226-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:227:int __mt7921_start(struct mt792x_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-228-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-247-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:248:\tmt792x_mac_reset_counters(phy);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-249-\tset_bit(MT76_STATE_RUNNING, \u0026mphy-\u003estate);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=272=static int mt7921_start(struct ieee80211_hw *hw)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-273-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:274:\tstruct mt792x_phy *phy = mt792x_hw_phy(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-275-\tint err;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-276-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:277:\tmt792x_mutex_acquire(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-278-\terr = __mt7921_start(phy);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:279:\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-280-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=284=static void mt7921_stop(struct ieee80211_hw *hw, bool suspend)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-285-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:286:\tstruct mt792x_dev *dev = mt792x_hw_dev(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-287-\tint err = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-289-\tif (mt76_is_mmio(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:290:\t\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-291-\t\terr = mt7921_mcu_radio_led_ctrl(dev, EXT_CMD_RADIO_OFF_LED);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:292:\t\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-293-\t\tif (err)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-296-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:297:\tmt792x_stop(hw, false);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-298-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=301=mt7921_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-302-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:303:\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:304:\tstruct mt792x_dev *dev = mt792x_hw_dev(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:305:\tstruct mt792x_phy *phy = mt792x_hw_phy(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-306-\tstruct mt76_txq *mtxq;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-308-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:309:\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-310-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-354-\tINIT_WORK(\u0026mvif-\u003ecsa_work, mt7921_csa_work);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:355:\ttimer_setup(\u0026mvif-\u003ecsa_timer, mt792x_csa_timer, 0);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-356-out:\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:357:\tmt792x_mutex_release(dev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-358-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=362=static void mt7921_roc_iter(void *priv, u8 *mac,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-364-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:365:\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:366:\tstruct mt792x_phy *phy = priv;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-367-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-370-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:371:void mt7921_roc_abort_sync(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-372-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:373:\tstruct mt792x_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-374-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=387=void mt7921_roc_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-388-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:389:\tstruct mt792x_phy *phy;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-390-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:391:\tphy = (struct mt792x_phy *)container_of(work, struct mt792x_phy,\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-392-\t\t\t\t\t\troc_work);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-393-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:394:\tmt792x_mutex_acquire(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-395-\tif (!test_and_clear_bit(MT76_STATE_ROC, \u0026phy-\u003emt76-\u003estate)) {\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:396:\t\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-397-\t\treturn;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-401-\t\t\t\t\t    mt7921_roc_iter, phy);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:402:\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-403-\tieee80211_remain_on_channel_expired(phy-\u003emt76-\u003ehw);\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-405-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:406:static int mt7921_abort_roc(struct mt792x_phy *phy, struct mt792x_vif *vif)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-407-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-412-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:413:\tmt792x_mutex_acquire(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-414-\tif (test_and_clear_bit(MT76_STATE_ROC, \u0026phy-\u003emt76-\u003estate))\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-415-\t\terr = mt7921_mcu_abort_roc(phy, vif, phy-\u003eroc_token_id);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:416:\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-417-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-420-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:421:static int mt7921_set_roc(struct mt792x_phy *phy,\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:422:\t\t\t  struct mt792x_vif *vif,\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-423-\t\t\t  struct ieee80211_channel *chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=451=static int mt7921_remain_on_channel(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-456-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:457:\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:458:\tstruct mt792x_phy *phy = mt792x_hw_phy(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-459-\tint err;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-460-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:461:\tmt792x_mutex_acquire(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-462-\terr = mt7921_set_roc(phy, mvif, chan, duration, MT7921_ROC_REQ_ROC);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:463:\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-464-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=468=static int mt7921_cancel_remain_on_channel(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-470-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:471:\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:472:\tstruct mt792x_phy *phy = mt792x_hw_phy(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-473-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=477=int mt7921_set_channel(struct mt76_phy *mphy)\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-478-{\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:479:\tstruct mt792x_phy *phy = mphy-\u003epriv;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:480:\tstruct mt792x_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-481-\tint ret;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-487-\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:488:\tmt792x_mac_set_timeing(phy);\n\n"
}

gemini-3.7-flash

null

null

							input: 21028
							output: 41
							thoughts: 174
						

**My Initial Assessment of the MT7921U Driver**

Okay, so I'm looking at `mt7921u`, which I know is the USB driver for the MT7921 chipset. My first thought is: can we fuzz this thing effectively with syzkaller? Specifically, does syzkaller have good coverage for USB wireless devices? I'm thinking about the standard methods – the `usb raw gadget` and the `vhci` approach.

Right, syzkaller *does* have USB fuzzing capabilities, including the emulation of USB devices. That’s a good starting point. So, when a USB device is "attached," whether through a USB gadget setup or using `syz_usb_connect`, the kernel probe functions for the attached device will be called. I need to dig deeper into what happens in that probe.

My immediate next step is to see if the `mt7921u` probe function handles emulated USB descriptors and requests correctly. Are there any obvious areas where the emulation might fail? I want to understand what's happening specifically within `mt76_phy_init` and `mt792x_init_wiphy` – these are likely key to the wireless interface initialization. I'll need to follow the execution path to see if any assumptions are being made that would be broken by an emulated environment.

To get started, I'll need to dive into the code. I'll start with `drivers/net/wireless/mediatek/mt76/mt7921/usb.c`, or really any other relevant USB driver within the `mt76` directory. I'll need to correlate the descriptor definitions to the initialization steps to get a sense of where fuzzing might be most effective.

{
  "Expression": "module_usb_driver|usb_register",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7615/usb.c=265=static struct usb_driver mt7663u_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-277-};\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:278:module_usb_driver(mt7663u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-279-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=345=static struct usb_driver mt76x0_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-355-};\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:356:module_usb_driver(mt76x0_driver);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c=137=static struct usb_driver mt76x2u_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-149-};\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:150:module_usb_driver(mt76x2u_driver);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-151-\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c=338=static struct usb_driver mt7921u_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-350-};\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:351:module_usb_driver(mt7921u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-352-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c=355=static struct usb_driver mt7925u_driver = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-367-};\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:368:module_usb_driver(mt7925u_driver);\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-369-\n"
}

gemini-3.7-flash

null

null

							input: 22335
							output: 49
							thoughts: 107
						

**Diving into the Mediatek Driver Code**

Alright, let's get down to brass tacks. I need to get a handle on this Mediatek Wi-Fi situation. My initial thought is to zero in on the core of the problem. That means cracking open the driver source code, specifically focusing on the `mac80211.c` and `mt792x_core.c` files within the `drivers/net/wireless/mediatek/mt76` directory. I'm going to start by taking a close look at `mac80211.c` around line 439, and then shift my attention to `mt792x_core.c`, specifically around line 820. Hopefully, the information I find in these specific sections will illuminate the issue. I'm hoping to understand how these elements interrelate.

{
  "File": "drivers/net/wireless/mediatek/mt76/mac80211.c",
  "FirstLine": 425,
  "LineCount": 40
}

{
  "Contents": " 425:\t\n 426:\tstatic int\n 427:\tmt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)\n 428:\t{\n 429:\t\tstruct mt76_dev *dev = phy-\u003edev;\n 430:\t\tstruct wiphy *wiphy = hw-\u003ewiphy;\n 431:\t\n 432:\t\tINIT_LIST_HEAD(\u0026phy-\u003etx_list);\n 433:\t\tspin_lock_init(\u0026phy-\u003etx_lock);\n 434:\t\tINIT_DELAYED_WORK(\u0026phy-\u003eroc_work, mt76_roc_complete_work);\n 435:\t\n 436:\t\tif ((void *)phy != hw-\u003epriv)\n 437:\t\t\treturn 0;\n 438:\t\n 439:\t\tSET_IEEE80211_DEV(hw, dev-\u003edev);\n 440:\t\tSET_IEEE80211_PERM_ADDR(hw, phy-\u003emacaddr);\n 441:\t\n 442:\t\twiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR |\n 443:\t\t\t\t   NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;\n 444:\t\twiphy-\u003eflags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |\n 445:\t\t\t\tWIPHY_FLAG_SUPPORTS_TDLS |\n 446:\t\t\t\tWIPHY_FLAG_AP_UAPSD;\n 447:\t\n 448:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);\n 449:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AIRTIME_FAIRNESS);\n 450:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AQL);\n 451:\t\n 452:\t\tif (!wiphy-\u003emax_remain_on_channel_duration)\n 453:\t\t\twiphy-\u003emax_remain_on_channel_duration = 5000;\n 454:\t\tif (!wiphy-\u003eavailable_antennas_tx)\n 455:\t\t\twiphy-\u003eavailable_antennas_tx = phy-\u003eantenna_mask;\n 456:\t\tif (!wiphy-\u003eavailable_antennas_rx)\n 457:\t\t\twiphy-\u003eavailable_antennas_rx = phy-\u003eantenna_mask;\n 458:\t\n 459:\t\twiphy-\u003esar_capa = \u0026mt76_sar_capa;\n 460:\t\tphy-\u003efrp = devm_kcalloc(dev-\u003edev, wiphy-\u003esar_capa-\u003enum_freq_ranges,\n 461:\t\t\t\t\tsizeof(struct mt76_freq_range_power),\n 462:\t\t\t\t\tGFP_KERNEL);\n 463:\t\tif (!phy-\u003efrp)\n 464:\t\t\treturn -ENOMEM;\n"
}

gemini-3.7-flash

null

null

							input: 23469
							output: 50
							thoughts: 43
						

Here's my summary, as if I were thinking these thoughts:

**Diving into the MT792x Initialization**

Okay, so we need to thoroughly understand how this MT792x driver is initializing the Wi-Fi PHY. I should definitely check out `mt792x_init_wiphy` to grasp this. That function, within `drivers/net/wireless/mediatek/mt76/mt792x_core.c`, is the logical starting point for understanding how the core Wi-Fi functionality is being set up. I'm expecting to see things like the registration of the Wi-Fi device with the kernel's wireless subsystem, and configuration of the radio and MAC layers. Understanding this initialization sequence is critical for any troubleshooting or modification efforts further down the line. I want to see exactly how they're handling the hardware and what the initial state is. Time to dig in!

{
  "File": "drivers/net/wireless/mediatek/mt76/mt792x_core.c",
  "FirstLine": 805,
  "LineCount": 40
}

{
  "Contents": " 805:\t\t\twiphy-\u003enan_capa.max_channel_switch_time = 12;\n 806:\t\t\twiphy-\u003enan_capa.dev_capabilities = NAN_DEV_CAPA_EXT_KEY_ID_SUPPORTED;\n 807:\t\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_SECURE_NAN);\n 808:\t\t}\n 809:\t\n 810:\t\twiphy-\u003emax_scan_ie_len = MT76_CONNAC_SCAN_IE_LEN;\n 811:\t\twiphy-\u003emax_scan_ssids = 4;\n 812:\t\twiphy-\u003emax_sched_scan_plan_interval =\n 813:\t\t\tMT76_CONNAC_MAX_TIME_SCHED_SCAN_INTERVAL;\n 814:\t\twiphy-\u003emax_sched_scan_ie_len = IEEE80211_MAX_DATA_LEN;\n 815:\t\twiphy-\u003emax_sched_scan_ssids = MT76_CONNAC_MAX_SCHED_SCAN_SSID;\n 816:\t\twiphy-\u003emax_match_sets = MT76_CONNAC_MAX_SCAN_MATCH;\n 817:\t\twiphy-\u003emax_sched_scan_reqs = 1;\n 818:\t\twiphy-\u003eflags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |\n 819:\t\t\t\tWIPHY_FLAG_SPLIT_SCAN_6GHZ;\n 820:\t\n 821:\t\twiphy-\u003efeatures |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |\n 822:\t\t\t\t   NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;\n 823:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_SET_SCAN_DWELL);\n 824:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);\n 825:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HT);\n 826:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_VHT);\n 827:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HE);\n 828:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);\n 829:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);\n 830:\t\twiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);\n 831:\t\n 832:\t\tieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);\n 833:\t\tieee80211_hw_set(hw, HAS_RATE_CONTROL);\n 834:\t\tieee80211_hw_set(hw, SUPPORTS_TX_ENCAP_OFFLOAD);\n 835:\t\tieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD);\n 836:\t\tif (is_mt7927(\u0026dev-\u003emt76))\n 837:\t\t\tieee80211_hw_set(hw, NO_VIRTUAL_MONITOR);\n 838:\t\telse\n 839:\t\t\tieee80211_hw_set(hw, WANT_MONITOR_VIF);\n 840:\t\tieee80211_hw_set(hw, SUPPORTS_PS);\n 841:\t\tieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);\n 842:\t\tieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);\n 843:\t\tieee80211_hw_set(hw, CONNECTION_MONITOR);\n 844:\t\tieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);\n"
}

gemini-3.7-flash

null

null

							input: 24873
							output: 19
							thoughts: 44
						

Okay, here's my take on those thoughts, framed as my own:

**Analyzing a Code Commit**

Alright, before I dive too deep, I need to understand the *why* behind this commit. My initial instinct is to jump straight into the code changes, see what's different and how, but that's often a shortcut to misunderstanding. I need context first. I'm going to quickly check the commit message and dig through the git history. Maybe this is a quick fix, maybe a larger refactor – context is king here. The message should ideally tell me the story. Let's see if the log can give me some recent commits or surrounding context. This will hopefully save me some time and allow me to determine the true nature of this commit.

no matches

{
  "Expression": "no_active_monitor"
}

{
  "error": "no matches"
}

gemini-3.7-flash

null

null

							input: 25111
							output: 21
							thoughts: 47
						

**Analyzing the Kernel Patch: Dissecting the Removal of `no_active_monitor`**

Okay, so this patch nuked `no_active_monitor` from the kernel tree, basically everywhere. Interesting. Time to dig in and understand the impact. I need to see *where* this variable was being used and how its removal changes the landscape. Let's start with the calls to `mt76_phy_init` and `mt792x_init_wiphy`. Those seem like logical entry points for monitor mode functionality and initialization, so I'm guessing that's where the ramifications of removing this variable will be most readily apparent. I'm already anticipating some potential ramifications on the driver's ability to properly handle monitor mode. Depending on *how* `no_active_monitor` was used, it could represent a change in behavior, functionality or, potentially, a bug. I need to determine if this was a cleanup, a refactor, or something more. Alright, let's see what the code says.

{
  "Expression": "mt76_phy_init"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mac80211.c=426=static int\ndrivers/net/wireless/mediatek/mt76/mac80211.c:427:mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)\ndrivers/net/wireless/mediatek/mt76/mac80211.c-428-{\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=550=int mt76_register_phy(struct mt76_phy *phy, bool vht,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-554-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:555:\tret = mt76_phy_init(phy, phy-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-556-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=747=int mt76_register_device(struct mt76_dev *dev, bool vht,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-755-\tmt76_wcid_init(\u0026dev-\u003eglobal_wcid, phy-\u003eband_idx);\ndrivers/net/wireless/mediatek/mt76/mac80211.c:756:\tret = mt76_phy_init(phy, hw);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-757-\tif (ret)\n"
}

gemini-3.7-flash

null

null

							input: 25856
							output: 24
							thoughts: 20
						

Here's my summary, as if I were thinking these thoughts:

**Tracing the Initialization of mt792x_wiphy**

Okay, time to dig in. I need to understand how the `mt792x_wiphy` is initialized. My first step is to figure out the call chain, where does the `mt792x_init_wiphy` function come into play? I need to find all the places it's actually invoked. Knowing the points of entry will give me the context I need to really understand the initialization sequence and the broader system behavior that relies on it. I need to locate all references to that function. Time to start searching the code base.

{
  "Expression": "mt792x_init_wiphy"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7921/init.c=170=int mt7921_register_device(struct mt792x_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-226-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:227:\tret = mt792x_init_wiphy(hw);\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-228-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c=243=int mt7925_register_device(struct mt792x_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-297-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:298:\tret = mt792x_init_wiphy(hw);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-299-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt792x.h=521=int mt792x_pm_idle_timeout_get(void *data, u64 *val);\ndrivers/net/wireless/mediatek/mt76/mt792x.h:522:int mt792x_init_wiphy(struct ieee80211_hw *hw);\ndrivers/net/wireless/mediatek/mt76/mt792x.h-523-struct ieee80211_ops *\n--\ndrivers/net/wireless/mediatek/mt76/mt792x_core.c=748=EXPORT_SYMBOL_GPL(mt792x_set_coverage_class);\ndrivers/net/wireless/mediatek/mt76/mt792x_core.c-749-\ndrivers/net/wireless/mediatek/mt76/mt792x_core.c:750:int mt792x_init_wiphy(struct ieee80211_hw *hw)\ndrivers/net/wireless/mediatek/mt76/mt792x_core.c-751-{\n--\ndrivers/net/wireless/mediatek/mt76/mt792x_core.c-856-}\ndrivers/net/wireless/mediatek/mt76/mt792x_core.c:857:EXPORT_SYMBOL_GPL(mt792x_init_wiphy);\ndrivers/net/wireless/mediatek/mt76/mt792x_core.c-858-\n"
}

gemini-3.7-flash

null

null

							input: 26778
							output: 50
							thoughts: 101
						

**Analyzing the `mt7921` Driver Registration**

Okay, so I'm looking at how the `mt7921` driver gets initialized. The core function here, `mt7921_register_device`, is triggered based on the bus type: USB (`mt7921u`), PCIe (`mt7921e`), or SDIO (`mt7921s`). Now, I'm getting a little curious about the fuzzing potential. Specifically, I'm wondering if a USB-based probe using `mt7921u` could be a viable target for fuzzing. I need to take a closer look at the USB implementation to assess the attack surface. Time to dive into `drivers/net/wireless/mediatek/mt76/mt7921/usb.c` and see what's happening there.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7921/usb.c",
  "FirstLine": 290,
  "LineCount": 65
}

{
  "Contents": " 290:\t\n 291:\tstatic int mt7921u_resume(struct usb_interface *intf)\n 292:\t{\n 293:\t\tstruct mt792x_dev *dev = usb_get_intfdata(intf);\n 294:\t\tstruct mt76_connac_pm *pm = \u0026dev-\u003epm;\n 295:\t\tbool reinit = true;\n 296:\t\tint err, i;\n 297:\t\n 298:\t\tfor (i = 0; i \u003c 10; i++) {\n 299:\t\t\tu32 val = mt76_rr(dev, MT_WF_SW_DEF_CR_USB_MCU_EVENT);\n 300:\t\n 301:\t\t\tif (!(val \u0026 MT_WF_SW_SER_TRIGGER_SUSPEND)) {\n 302:\t\t\t\treinit = false;\n 303:\t\t\t\tbreak;\n 304:\t\t\t}\n 305:\t\t\tif (val \u0026 MT_WF_SW_SER_DONE_SUSPEND) {\n 306:\t\t\t\tmt76_wr(dev, MT_WF_SW_DEF_CR_USB_MCU_EVENT, 0);\n 307:\t\t\t\tbreak;\n 308:\t\t\t}\n 309:\t\n 310:\t\t\tmsleep(20);\n 311:\t\t}\n 312:\t\n 313:\t\tif (reinit || mt792x_dma_need_reinit(dev)) {\n 314:\t\t\terr = mt792xu_dma_init(dev, true);\n 315:\t\t\tif (err)\n 316:\t\t\t\tgoto failed;\n 317:\t\t}\n 318:\t\n 319:\t\terr = mt76u_resume_rx(\u0026dev-\u003emt76);\n 320:\t\tif (err \u003c 0)\n 321:\t\t\tgoto failed;\n 322:\t\n 323:\t\terr = mt76_connac_mcu_set_hif_suspend(\u0026dev-\u003emt76, false, true);\n 324:\tfailed:\n 325:\t\tpm-\u003esuspended = false;\n 326:\t\n 327:\t\tif (err \u003c 0)\n 328:\t\t\tmt792x_reset(\u0026dev-\u003emt76);\n 329:\t\n 330:\t\treturn err;\n 331:\t}\n 332:\t#endif /* CONFIG_PM */\n 333:\t\n 334:\tMODULE_DEVICE_TABLE(usb, mt7921u_device_table);\n 335:\tMODULE_FIRMWARE(MT7921_FIRMWARE_WM);\n 336:\tMODULE_FIRMWARE(MT7921_ROM_PATCH);\n 337:\t\n 338:\tstatic struct usb_driver mt7921u_driver = {\n 339:\t\t.name\t\t= KBUILD_MODNAME,\n 340:\t\t.id_table\t= mt7921u_device_table,\n 341:\t\t.probe\t\t= mt7921u_probe,\n 342:\t\t.disconnect\t= mt792xu_disconnect,\n 343:\t#ifdef CONFIG_PM\n 344:\t\t.suspend\t= mt7921u_suspend,\n 345:\t\t.resume\t\t= mt7921u_resume,\n 346:\t\t.reset_resume\t= mt7921u_resume,\n 347:\t#endif /* CONFIG_PM */\n 348:\t\t.soft_unbind\t= 1,\n 349:\t\t.disable_hub_initiated_lpm = 1,\n 350:\t};\n 351:\tmodule_usb_driver(mt7921u_driver);\n 352:\t\n 353:\tMODULE_DESCRIPTION(\"MediaTek MT7921U (USB) wireless driver\");\n 354:\tMODULE_AUTHOR(\"Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\");\n"
}

gemini-3.7-flash

null

null

							input: 28171
							output: 50
							thoughts: 14
						

Okay, let's dive into this `mt7921u_probe` function...

**My Initial Assessment of `mt7921u_probe`**

Alright, I'm looking at `mt7921u_probe`. That naming convention suggests this is likely the probe function for a MediaTek MT7921U-based USB device.  Given my experience with similar drivers, I'm already anticipating a few key things I'll be looking for. I expect to see the typical USB device initialization flow:  device descriptor acquisition, endpoint configuration, resource allocation, and, ideally, some sort of sanity check to ensure the USB device is actually a compatible MT7921U variant and isn't something masquerading as one.  There's also going to be interaction with the device-specific registers. I'll expect to see this function responsible for setting up the necessary workqueues, initializing mutexes or spinlocks for concurrent access if necessary. Hopefully, they haven't forgotten error handling – good probe functions are resilient. I'm keen to observe how they handle potential failure scenarios during initialization, like USB transfer errors or hardware malfunctions.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7921/usb.c",
  "FirstLine": 230,
  "LineCount": 60
}

{
  "Contents": " 230:\t\tret = mt76u_alloc_mcu_queue(\u0026dev-\u003emt76);\n 231:\t\tif (ret)\n 232:\t\t\tgoto error;\n 233:\t\n 234:\t\tret = mt76u_alloc_queues(\u0026dev-\u003emt76);\n 235:\t\tif (ret)\n 236:\t\t\tgoto error;\n 237:\t\n 238:\t\tret = mt792xu_dma_init(dev, false);\n 239:\t\tif (ret)\n 240:\t\t\tgoto error;\n 241:\t\n 242:\t\thw = mt76_hw(dev);\n 243:\t\t/* check hw sg support in order to enable AMSDU */\n 244:\t\thw-\u003emax_tx_fragments = mdev-\u003eusb.sg_en ? MT_HW_TXP_MAX_BUF_NUM : 1;\n 245:\t\n 246:\t\tret = mt7921_register_device(dev);\n 247:\t\tif (ret)\n 248:\t\t\tgoto error;\n 249:\t\n 250:\t\treturn 0;\n 251:\t\n 252:\terror:\n 253:\t\tmt76u_queues_deinit(\u0026dev-\u003emt76);\n 254:\t\tmt792xu_reset_work_cleanup(dev);\n 255:\t\n 256:\t\tusb_set_intfdata(usb_intf, NULL);\n 257:\t\n 258:\t\tmt76_free_device(\u0026dev-\u003emt76);\n 259:\t\n 260:\t\treturn ret;\n 261:\t}\n 262:\t\n 263:\t#ifdef CONFIG_PM\n 264:\tstatic int mt7921u_suspend(struct usb_interface *intf, pm_message_t state)\n 265:\t{\n 266:\t\tstruct mt792x_dev *dev = usb_get_intfdata(intf);\n 267:\t\tstruct mt76_connac_pm *pm = \u0026dev-\u003epm;\n 268:\t\tint err;\n 269:\t\n 270:\t\tpm-\u003esuspended = true;\n 271:\t\tflush_work(\u0026dev-\u003ereset_work);\n 272:\t\n 273:\t\terr = mt76_connac_mcu_set_hif_suspend(\u0026dev-\u003emt76, true, true);\n 274:\t\tif (err)\n 275:\t\t\tgoto failed;\n 276:\t\n 277:\t\tmt76u_stop_rx(\u0026dev-\u003emt76);\n 278:\t\tmt76u_stop_tx(\u0026dev-\u003emt76);\n 279:\t\n 280:\t\treturn 0;\n 281:\t\n 282:\tfailed:\n 283:\t\tpm-\u003esuspended = false;\n 284:\t\n 285:\t\tif (err \u003c 0)\n 286:\t\t\tmt792x_reset(\u0026dev-\u003emt76);\n 287:\t\n 288:\t\treturn err;\n 289:\t}\n"
}

gemini-3.7-flash

null

null

							input: 29330
							output: 50
							thoughts: 17
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Diving Deeper into the mt7921u Probe**

Alright, so we're looking at the remainder of the `mt7921u_probe` function. I already have a decent grasp of the overall driver architecture for this MediaTek chip, and I've probably already identified key aspects of the function's initial setup. Now, I'm thinking, "Let's dig in and examine the nitty-gritty details of how this function sets up the USB device." I need to understand how the hardware is initialized, how the device is configured, and what resources are allocated. What error handling is present? Are there any potentially problematic areas in the initial probing sequence? I'm probably mentally checking for things like DMA setup, endpoint initialization, and the registration of interrupt handlers. I'm also looking for any early indications of power management configuration or firmware loading procedures. This "rest of `mt7921u_probe`" is critical, because it's where the rubber meets the road. It's the launchpad for the entire device operation, and any mistakes here will cascade into major problems later on. I need to understand how this probe establishes a solid foundation for everything that follows.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7921/usb.c",
  "FirstLine": 180,
  "LineCount": 55
}

{
  "Contents": " 180:\t\t\t.read_copy = mt76u_read_copy,\n 181:\t\t\t.write_copy = mt792xu_copy,\n 182:\t\t\t.type = MT76_BUS_USB,\n 183:\t\t};\n 184:\t\tstruct usb_device *udev = interface_to_usbdev(usb_intf);\n 185:\t\tstruct ieee80211_ops *ops;\n 186:\t\tstruct ieee80211_hw *hw;\n 187:\t\tstruct mt792x_dev *dev;\n 188:\t\tstruct mt76_dev *mdev;\n 189:\t\tu8 features;\n 190:\t\tint ret;\n 191:\t\n 192:\t\tops = mt792x_get_mac80211_ops(\u0026usb_intf-\u003edev, \u0026mt7921_ops,\n 193:\t\t\t\t\t      (void *)id-\u003edriver_info, \u0026features);\n 194:\t\tif (!ops)\n 195:\t\t\treturn -ENOMEM;\n 196:\t\n 197:\t\tops-\u003estop = mt792xu_stop;\n 198:\t\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(*dev), ops, \u0026drv_ops);\n 199:\t\tif (!mdev)\n 200:\t\t\treturn -ENOMEM;\n 201:\t\n 202:\t\tdev = container_of(mdev, struct mt792x_dev, mt76);\n 203:\t\tdev-\u003efw_features = features;\n 204:\t\tdev-\u003ehif_ops = \u0026hif_ops;\n 205:\t\tatomic_set(\u0026dev-\u003emt76.bus_hung, false);\n 206:\t\tmt792xu_reset_work_init(dev);\n 207:\t\n 208:\t\tusb_reset_device(udev);\n 209:\t\n 210:\t\tusb_set_intfdata(usb_intf, dev);\n 211:\t\n 212:\t\tret = __mt76u_init(mdev, usb_intf, \u0026bus_ops);\n 213:\t\tif (ret \u003c 0)\n 214:\t\t\tgoto error;\n 215:\t\n 216:\t\tmdev-\u003erev = (mt76_rr(dev, MT_HW_CHIPID) \u003c\u003c 16) |\n 217:\t\t\t    (mt76_rr(dev, MT_HW_REV) \u0026 0xff);\n 218:\t\tdev_dbg(mdev-\u003edev, \"ASIC revision: %04x\\n\", mdev-\u003erev);\n 219:\t\n 220:\t\tif (mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY)) {\n 221:\t\t\tret = mt792xu_wfsys_reset(dev);\n 222:\t\t\tif (ret)\n 223:\t\t\t\tgoto error;\n 224:\t\t}\n 225:\t\n 226:\t\tret = mt792xu_mcu_power_on(dev);\n 227:\t\tif (ret)\n 228:\t\t\tgoto error;\n 229:\t\n 230:\t\tret = mt76u_alloc_mcu_queue(\u0026dev-\u003emt76);\n 231:\t\tif (ret)\n 232:\t\t\tgoto error;\n 233:\t\n 234:\t\tret = mt76u_alloc_queues(\u0026dev-\u003emt76);\n"
}

gemini-3.7-flash

null

null

							input: 30633
							output: 42
							thoughts: 17
						

Here's my thought process, summarized as you requested:

**Kconfig Inspection for mt76 and mt7921**

Okay, time to dive in. I need to make sure I'm up-to-date on the configurations for those MTK wireless drivers. Specifically, I need to check the Kconfig files related to `mt76` and `mt7921`. These Kconfig files are the heart of the kernel's configuration system. They define the build options, dependencies, and help text that determine whether a particular driver or feature is enabled during the build process. I need to understand how these drivers are being managed – are they modules, built-in, or optionally included? Are there any conditional dependencies I should be aware of, perhaps on other kernel subsystems or board support packages? I need to look for any default settings that might impact my current project or any potential conflicts. I also have to keep an eye out for any recent changes or additions that may have been introduced in upstream kernels. This is about making sure everything will work as expected with my target configuration.

{
  "Expression": "config MT76|config MT792",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/Kconfig:2:config MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/Kconfig:6:config MT76_LEDS\ndrivers/net/wireless/mediatek/mt76/Kconfig-7-\tbool\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/Kconfig:16:config MT76_SDIO\ndrivers/net/wireless/mediatek/mt76/Kconfig-17-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-19-\ndrivers/net/wireless/mediatek/mt76/Kconfig:20:config MT76x02_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-21-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-23-\ndrivers/net/wireless/mediatek/mt76/Kconfig:24:config MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-25-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/Kconfig:28:config MT76_CONNAC_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-29-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/Kconfig:32:config MT792x_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-33-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/Kconfig:36:config MT792x_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-37-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-39-\ndrivers/net/wireless/mediatek/mt76/Kconfig:40:config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig:2:config MT7603E\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig-3-\ttristate \"MediaTek MT7603E (PCIe) and MT76x8 WLAN support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-2-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:3:config MT7615_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-4-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-7-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:8:config MT7615E\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-9-\ttristate \"MediaTek MT7615E and MT7663E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-20-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:21:config MT7622_WMAC\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-22-\tbool \"MT7622 (SoC) WMAC support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:32:config MT7663_USB_SDIO_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-33-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:36:config MT7663U\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-37-\ttristate \"MediaTek MT7663U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-46-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:47:config MT7663S\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-48-\ttristate \"MediaTek MT7663S (SDIO) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:2:config MT76x0_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:6:config MT76x0U\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-7-\ttristate \"MediaTek MT76x0U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:19:config MT76x0E\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-20-\ttristate \"MediaTek MT76x0E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:2:config MT76x2_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:6:config MT76x2E\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-7-\ttristate \"MediaTek MT76x2E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-17-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:18:config MT76x2U\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-19-\ttristate \"MediaTek MT76x2U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:2:config MT7921_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-6-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:7:config MT7921E\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-8-\ttristate \"MediaTek MT7921E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-16-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:17:config MT7921S\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-18-\ttristate \"MediaTek MT7921S (SDIO) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:28:config MT7921U\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-29-\ttristate \"MediaTek MT7921U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:2:config MT7925_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-6-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:7:config MT7925E\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-8-\ttristate \"MediaTek MT7925E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:19:config MT7925U\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-20-\ttristate \"MediaTek MT7925U (USB) support\"\n"
}

gemini-3.7-flash

null

null

							input: 33751
							output: 27
							thoughts: 306
						

**My Analysis of the mt76 Driver Initialization**

Okay, let's break this down. My initial thought is to trace the initialization flow of these mt76 drivers, specifically focusing on the `mt76_phy_init` function. It seems it's the core of bringing the hardware online, called by `mt76_register_phy` and `mt76_register_device`. This makes perfect sense; the PHY initialization is fundamental. All the mt76 drivers I'm familiar with – the MT76x0U, MT76x2U, MT7663U, MT7921U, MT7925U families – they all build on the mt76 core, so this approach is consistent.

Now, considering the context of USB device attachment, specifically when we're using something like syzkaller for fuzzing, I'm trying to visualize the registration process. With `syz_usb_connect` leveraging those specific vendor/product IDs for mt76x0u, mt76x2u, etc., I need to ascertain *exactly* how the device registers with mac80211 and cfg80211. This is critical for understanding the subsequent behavior under fuzzing.

Hang on. There's a flag being set within `mt76_phy_init`, namely: `wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR | NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;`. This immediately flags something interesting. And in `mt792x_core.c` I see the line that removes the flag `phy->mt76->no_active_monitor = true`.

I need to understand what `NL80211_FEATURE_ACTIVE_MONITOR` *actually* does. It warrants a deep dive into the kernel, mac80211, cfg80211, and the nl80211 subsystem. This is where the magic happens, and understanding the role of this feature is key to anticipating how the driver will handle monitored traffic and its interaction with the broader wireless stack, especially under fuzzing conditions. I need to be sure the monitor mode isn't interfering with our test scenario.

{
  "Expression": "NL80211_FEATURE_ACTIVE_MONITOR"
}

{
  "Output": "drivers/net/wireless/ath/ath9k/init.c=903=static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/ath/ath9k/init.c-932-\ndrivers/net/wireless/ath/ath9k/init.c:933:\thw-\u003ewiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR |\ndrivers/net/wireless/ath/ath9k/init.c-934-\t\t\t       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=427=mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-441-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:442:\twiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR |\ndrivers/net/wireless/mediatek/mt76/mac80211.c-443-\t\t\t   NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;\n--\ndrivers/net/wireless/mediatek/mt7601u/init.c=574=int mt7601u_register_device(struct mt7601u_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt7601u/init.c-610-\ndrivers/net/wireless/mediatek/mt7601u/init.c:611:\twiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR;\ndrivers/net/wireless/mediatek/mt7601u/init.c-612-\twiphy-\u003einterface_modes = BIT(NL80211_IFTYPE_STATION);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=5674=static int mac80211_hwsim_new_radio(struct genl_info *info,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5943-\thw-\u003ewiphy-\u003eflags |= WIPHY_FLAG_IBSS_RSN;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:5944:\thw-\u003ewiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR |\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5945-\t\t\t       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |\n--\ninclude/uapi/linux/nl80211.h=6739=enum nl80211_ap_sme_features {\n--\ninclude/uapi/linux/nl80211.h-6786- *\tstill generated by the driver.\ninclude/uapi/linux/nl80211.h:6787: * @NL80211_FEATURE_ACTIVE_MONITOR: This driver supports an active monitor\ninclude/uapi/linux/nl80211.h-6788- *\tinterface. An active monitor interface behaves like a normal monitor\n--\ninclude/uapi/linux/nl80211.h=6836=enum nl80211_feature_flags {\n--\ninclude/uapi/linux/nl80211.h-6853-\tNL80211_FEATURE_USERSPACE_MPM\t\t\t= 1 \u003c\u003c 16,\ninclude/uapi/linux/nl80211.h:6854:\tNL80211_FEATURE_ACTIVE_MONITOR\t\t\t= 1 \u003c\u003c 17,\ninclude/uapi/linux/nl80211.h-6855-\tNL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE\t= 1 \u003c\u003c 18,\n--\nnet/wireless/nl80211.c=4934=static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,\n--\nnet/wireless/nl80211.c-4958-\tif (params-\u003eflags \u0026 MONITOR_FLAG_ACTIVE \u0026\u0026\nnet/wireless/nl80211.c:4959:\t    !(rdev-\u003ewiphy.features \u0026 NL80211_FEATURE_ACTIVE_MONITOR))\nnet/wireless/nl80211.c-4960-\t\treturn -EOPNOTSUPP;\n"
}

gemini-3.7-flash

null

null

							input: 35792
							output: 35
							thoughts: 367
						

**My Analysis of the MT7921/MT7925 Active Monitor Implementation**

Okay, let's break this down. It looks like we're enabling `NL80211_FEATURE_ACTIVE_MONITOR` for the MT7921 and MT7925 devices, allowing userspace control of monitor interfaces with the `MONITOR_FLAG_ACTIVE` flag via nl80211. Previously, the `no_active_monitor = true` setting effectively blocked this. I recall that `mt76_phy_init` was where this was handled, but the initialization of the wiphy in `mt792x_init_wiphy` was setting this flag to true before `mt76_phy_init` was called. That seems straightforward enough.

Now, I need to verify how `no_active_monitor` was used prior to this change. Scanning `mac80211.c`, I see that `mt76_phy_init` used to check `phy->no_active_monitor` and only enable `NL80211_FEATURE_ACTIVE_MONITOR` if it was false. The change now unconditionally adds `NL80211_FEATURE_ACTIVE_MONITOR`, along with `NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE`. Okay, that's a key detail – the feature is now unconditionally enabled. And in `mt792x_core.c` and specifically `mt792x_init_wiphy` I can clearly see where `phy->mt76->no_active_monitor = true` was set.

The question then is, *why* was `no_active_monitor` set to true in the first place for the MT792x series? My hypothesis is that these chips either didn't support active monitor, or that they did but it wasn't yet enabled. I need to confirm if active monitor is actually supported now, or if this commit simply enables it. Time to dive into the commit history or do a quick git search within the mt76 repo to shed some light on this. The history should tell me exactly when this limitation was introduced, and if it was lifted due to a specific hardware change or new driver capabilities. That will confirm what's really happening here.

no matches

{
  "Expression": "active_monitor",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "error": "no matches"
}

gemini-3.7-flash

null

null

							input: 36712
							output: 47
							thoughts: 1041
						

**MT76/MT792x USB Driver Reachability Analysis for Syzkaller**

Okay, let's break this down. My goal is to determine if the MT76 and MT792x USB drivers are reachable by syzkaller. The key is that syzkaller can emulate USB devices using `syz_usb_connect`, which offers a potential entry point.

I need to confirm if these drivers are accessible via a virtual bus, specifically USB, within a standard syzkaller environment. The presence of `MT76_CORE`, `MT792x_LIB`, `MT7921U`, `MT7925U`, `MT76x0U`, `MT76x2U`, and `MT7663U` points to a relevant driver landscape.

A quick review of `mt7921u_probe` is essential. The driver initializes a device via `mt792x_get_mac80211_ops`, allocates memory using `mt76_alloc_device`, then initializes with `__mt76u_init`. This probing process then interacts with hardware (chip ID, revision) and hardware resources, which suggests a hardware dependence that needs careful analysis. It also calls functions like `mt792xu_mcu_power_on`, `mt76u_alloc_mcu_queue`, `mt76u_alloc_queues`, `mt792xu_dma_init`, and finally registers the device via `mt7921_register_device`. The latter calls `mt792x_init_wiphy` and `mt76_register_device`, eventually reaching `mt76_phy_init`.

The critical question is, does this rely on a real USB connection, or is it a virtual bus? The relevant criteria for determining whether this is worth fuzzing are the positive and negative criteria. In the positive criteria, drivers accessible via virtual buses (like USB) are worth fuzzing. The negative criteria give examples of what is not worth fuzzing, such as unreachable hardware, vendor-specific devices, etc.

Since USB is a virtual bus in the syzkaller context (leveraging `raw_gadget` / `vhci`), and the MT76 drivers (`MT76x0U`, etc.) are USB device drivers in the kernel, I am inclined to conclude that it is reachable. The fact that `mt76_phy_init` is called during device initialization for all MT76 devices, including the USB ones, and `mt792x_init_wiphy` is called for the MT7921/MT7925 including USB variants confirms my assessment. Furthermore, after registration, the `cfg80211 / nl80211` interfaces interact with the wiphy features.

Therefore, the MT76 / MT792x drivers _are_ likely reachable via USB within syzkaller.

To confirm, I'll need to double-check that `MT76_CORE`, `MT7921U`, etc., are standard drivers (not some vendor-specific abstraction) by examining the `Kconfig` files in `drivers/net/wireless/mediatek/mt76/Kconfig` and `drivers/net/wireless/mediatek/mt76/mt7921/Kconfig`.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7921/Kconfig",
  "FirstLine": 1,
  "LineCount": 40
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\tconfig MT7921_COMMON\n   3:\t\ttristate\n   4:\t\tselect MT792x_LIB\n   5:\t\tselect WANT_DEV_COREDUMP\n   6:\t\n   7:\tconfig MT7921E\n   8:\t\ttristate \"MediaTek MT7921E (PCIe) support\"\n   9:\t\tselect MT7921_COMMON\n  10:\t\tdepends on MAC80211\n  11:\t\tdepends on PCI\n  12:\t\thelp\n  13:\t\t  This adds support for MT7921E 802.11ax 2x2:2SS wireless devices.\n  14:\t\n  15:\t\t  To compile this driver as a module, choose M here.\n  16:\t\n  17:\tconfig MT7921S\n  18:\t\ttristate \"MediaTek MT7921S (SDIO) support\"\n  19:\t\tselect MT76_SDIO\n  20:\t\tselect MT7921_COMMON\n  21:\t\tdepends on MAC80211\n  22:\t\tdepends on MMC\n  23:\t\thelp\n  24:\t\t  This adds support for MT7921S 802.11ax 2x2:2SS wireless devices.\n  25:\t\n  26:\t\t  To compile this driver as a module, choose M here.\n  27:\t\n  28:\tconfig MT7921U\n  29:\t\ttristate \"MediaTek MT7921U (USB) support\"\n  30:\t\tselect MT792x_USB\n  31:\t\tselect MT7921_COMMON\n  32:\t\tdepends on MAC80211\n  33:\t\tdepends on USB\n  34:\t\thelp\n  35:\t\t  This adds support for MT7921U 802.11ax 2x2:2SS wireless devices.\n  36:\t\n  37:\t\t  To compile this driver as a module, choose M here.\n"
}

gemini-3.7-flash

null

null

							input: 39074
							output: 41
							thoughts: 21
						

Here's my take on those thoughts:

**Analyzing the Mediatek Wireless Driver Configuration**

Okay, so I need to dive into the Mediatek wireless driver situation. My immediate instinct is to look at the configuration file, `drivers/net/wireless/mediatek/mt76/Kconfig`. That's where all the build options and dependencies for that specific driver should be defined. From the Kconfig, I can determine which features are enabled by default, what modules are available, how to enable/disable specific hardware support, and what other kernel components it might depend on. This will give me a solid base understanding of how this driver is structured and how to control it during the build process. It's the logical starting point for understanding how this driver integrates into the kernel configuration. Knowing how it's configured is key to making any progress.

{
  "File": "drivers/net/wireless/mediatek/mt76/Kconfig",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\tconfig MT76_CORE\n   3:\t\ttristate\n   4:\t\tselect PAGE_POOL\n   5:\t\n   6:\tconfig MT76_LEDS\n   7:\t\tbool\n   8:\t\tdepends on MT76_CORE\n   9:\t\tdepends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS\n  10:\t\tdefault y\n  11:\t\n  12:\tconfig MT76_USB\n  13:\t\ttristate\n  14:\t\tdepends on MT76_CORE\n  15:\t\n  16:\tconfig MT76_SDIO\n  17:\t\ttristate\n  18:\t\tdepends on MT76_CORE\n  19:\t\n  20:\tconfig MT76x02_LIB\n  21:\t\ttristate\n  22:\t\tselect MT76_CORE\n  23:\t\n  24:\tconfig MT76x02_USB\n  25:\t\ttristate\n  26:\t\tselect MT76_USB\n  27:\t\n  28:\tconfig MT76_CONNAC_LIB\n  29:\t\ttristate\n  30:\t\tselect MT76_CORE\n  31:\t\n  32:\tconfig MT792x_LIB\n  33:\t\ttristate\n  34:\t\tselect MT76_CONNAC_LIB\n  35:\t\n  36:\tconfig MT792x_USB\n  37:\t\ttristate\n  38:\t\tselect MT76_USB\n  39:\t\n  40:\tconfig MT76_NPU\n  41:\t\ttristate\n  42:\t\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\n  43:\t\n  44:\tsource \"drivers/net/wireless/mediatek/mt76/mt76x0/Kconfig\"\n  45:\tsource \"drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig\"\n  46:\tsource \"drivers/net/wireless/mediatek/mt76/mt7603/Kconfig\"\n  47:\tsource \"drivers/net/wireless/mediatek/mt76/mt7615/Kconfig\"\n  48:\tsource \"drivers/net/wireless/mediatek/mt76/mt7915/Kconfig\"\n  49:\tsource \"drivers/net/wireless/mediatek/mt76/mt7921/Kconfig\"\n  50:\tsource \"drivers/net/wireless/mediatek/mt76/mt7996/Kconfig\"\n"
}

gemini-3.7-flash

null

null

							input: 40010
							output: 31
							thoughts: 17
						

Here's my take on those thoughts, tailored for an expert audience:

**Diving into the Mediatek Wireless Configuration**

Okay, time to get my hands dirty. I need to take a look at `drivers/net/wireless/mediatek/Kconfig`. This is where the magic happens, the heart of the Mediatek wireless driver's configuration. I'm going to start by getting a clear picture of what's been defined and how the options are structured. I'm especially interested in dependencies, defaults, and any unusual configurations that might be worth further investigation. I'll need to see how the features are enabled/disabled at compile time. I need to understand what variables are going to be set by the kernel build, and the implications of those variables for the performance and robustness of the driver. Let's see what gems are hidden in this configuration file.

{
  "Expression": "MT76",
  "PathPrefix": "drivers/net/wireless/mediatek"
}

{
  "Output": "\nFull output is too long, showing 500 out of 5948 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/mediatek/Makefile:2:obj-$(CONFIG_MT7601U)\t+= mt7601u/\ndrivers/net/wireless/mediatek/Makefile:3:obj-$(CONFIG_MT76_CORE)\t+= mt76/\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/Kconfig:2:config MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/Kconfig:6:config MT76_LEDS\ndrivers/net/wireless/mediatek/mt76/Kconfig-7-\tbool\ndrivers/net/wireless/mediatek/mt76/Kconfig:8:\tdepends on MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig:9:\tdepends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS\ndrivers/net/wireless/mediatek/mt76/Kconfig-10-\tdefault y\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:14:\tdepends on MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/Kconfig:16:config MT76_SDIO\ndrivers/net/wireless/mediatek/mt76/Kconfig-17-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:18:\tdepends on MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-19-\ndrivers/net/wireless/mediatek/mt76/Kconfig:20:config MT76x02_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-21-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:22:\tselect MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-23-\ndrivers/net/wireless/mediatek/mt76/Kconfig:24:config MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-25-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:26:\tselect MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/Kconfig:28:config MT76_CONNAC_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-29-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:30:\tselect MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/Kconfig=32=config MT792x_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-33-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:34:\tselect MT76_CONNAC_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/Kconfig=36=config MT792x_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-37-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:38:\tselect MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-39-\ndrivers/net/wireless/mediatek/mt76/Kconfig:40:config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:42:\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-43-\n--\ndrivers/net/wireless/mediatek/mt76/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/Makefile:2:obj-$(CONFIG_MT76_CORE) += mt76.o\ndrivers/net/wireless/mediatek/mt76/Makefile:3:obj-$(CONFIG_MT76_USB) += mt76-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile:4:obj-$(CONFIG_MT76_SDIO) += mt76-sdio.o\ndrivers/net/wireless/mediatek/mt76/Makefile:5:obj-$(CONFIG_MT76x02_LIB) += mt76x02-lib.o\ndrivers/net/wireless/mediatek/mt76/Makefile:6:obj-$(CONFIG_MT76x02_USB) += mt76x02-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile:7:obj-$(CONFIG_MT76_CONNAC_LIB) += mt76-connac-lib.o\ndrivers/net/wireless/mediatek/mt76/Makefile-8-obj-$(CONFIG_MT792x_LIB) += mt792x-lib.o\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=11=mt76-y := \\\n--\ndrivers/net/wireless/mediatek/mt76/Makefile-14-\ndrivers/net/wireless/mediatek/mt76/Makefile:15:ifdef CONFIG_MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Makefile:16:# CONFIG_MT76_NPU is tristate to simplify dependency tracking,\ndrivers/net/wireless/mediatek/mt76/Makefile-17-# but it behaves as a bool symbol here.\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=43=mt792x-usb-y := mt792x_usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-44-\ndrivers/net/wireless/mediatek/mt76/Makefile:45:obj-$(CONFIG_MT76x0_COMMON) += mt76x0/\ndrivers/net/wireless/mediatek/mt76/Makefile:46:obj-$(CONFIG_MT76x2_COMMON) += mt76x2/\ndrivers/net/wireless/mediatek/mt76/Makefile:47:obj-$(CONFIG_MT7603E) += mt7603/\ndrivers/net/wireless/mediatek/mt76/Makefile:48:obj-$(CONFIG_MT7615_COMMON) += mt7615/\ndrivers/net/wireless/mediatek/mt76/Makefile-49-obj-$(CONFIG_MT7915E) += mt7915/\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=319=void mt76_roc_complete(struct mt76_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-329-\tif (phy-\u003echanctx \u0026\u0026 phy-\u003emain_chandef.chan \u0026\u0026 phy-\u003eoffchannel \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/channel.c:330:\t    !test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)) {\ndrivers/net/wireless/mediatek/mt76/channel.c-331-\t\t__mt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-336-\tphy-\u003eroc_link = NULL;\ndrivers/net/wireless/mediatek/mt76/channel.c:337:\tif (!test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state))\ndrivers/net/wireless/mediatek/mt76/channel.c-338-\t\tieee80211_remain_on_channel_expired(phy-\u003ehw);\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=363=int mt76_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-382-\tif (phy-\u003eroc_vif || dev-\u003escan.phy == phy ||\ndrivers/net/wireless/mediatek/mt76/channel.c:383:\t    test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)) {\ndrivers/net/wireless/mediatek/mt76/channel.c-384-\t\tret = -EBUSY;\n--\ndrivers/net/wireless/mediatek/mt76/dma.c=634=mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,\n--\ndrivers/net/wireless/mediatek/mt76/dma.c-639-\ndrivers/net/wireless/mediatek/mt76/dma.c:640:\tif (test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state))\ndrivers/net/wireless/mediatek/mt76/dma.c-641-\t\tgoto error;\n--\ndrivers/net/wireless/mediatek/mt76/dma.c=667=mt76_dma_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,\n--\ndrivers/net/wireless/mediatek/mt76/dma.c-684-\ndrivers/net/wireless/mediatek/mt76/dma.c:685:\tif (test_bit(MT76_RESET, \u0026phy-\u003estate))\ndrivers/net/wireless/mediatek/mt76/dma.c-686-\t\tgoto free_skb;\n--\ndrivers/net/wireless/mediatek/mt76/dma.h-4- */\ndrivers/net/wireless/mediatek/mt76/dma.h:5:#ifndef __MT76_DMA_H\ndrivers/net/wireless/mediatek/mt76/dma.h:6:#define __MT76_DMA_H\ndrivers/net/wireless/mediatek/mt76/dma.h-7-\n--\ndrivers/net/wireless/mediatek/mt76/dma.h=52=mt76_dma_handle_read(struct mt76_queue *q, u32 offset, u32 *val)\n--\ndrivers/net/wireless/mediatek/mt76/dma.h-60-#endif\ndrivers/net/wireless/mediatek/mt76/dma.h:61:#if IS_ENABLED(CONFIG_MT76_NPU)\ndrivers/net/wireless/mediatek/mt76/dma.h-62-\tif (q-\u003eflags \u0026 MT_QFLAG_NPU) {\n--\ndrivers/net/wireless/mediatek/mt76/dma.h=80=mt76_dma_handle_write(struct mt76_queue *q, u32 offset, u32 val)\n--\ndrivers/net/wireless/mediatek/mt76/dma.h-88-#endif\ndrivers/net/wireless/mediatek/mt76/dma.h:89:#if IS_ENABLED(CONFIG_MT76_NPU)\ndrivers/net/wireless/mediatek/mt76/dma.h-90-\tif (q-\u003eflags \u0026 MT_QFLAG_NPU) {\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c=14=enum mt76_sku_type {\ndrivers/net/wireless/mediatek/mt76/eeprom.c:15:\tMT76_SKU_RATE,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:16:\tMT76_SKU_BACKOFF,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:17:\tMT76_SKU_BACKOFF_BF_OFFSET,\ndrivers/net/wireless/mediatek/mt76/eeprom.c-18-};\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c=330=mt76_apply_array_limit(struct mt76_dev *dev, s8 *pwr, size_t pwr_len,\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-345-\t\tswitch (type) {\ndrivers/net/wireless/mediatek/mt76/eeprom.c:346:\t\tcase MT76_SKU_RATE:\ndrivers/net/wireless/mediatek/mt76/eeprom.c-347-\t\t\tdelta = 0;\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-350-\t\t\tbreak;\ndrivers/net/wireless/mediatek/mt76/eeprom.c:351:\t\tcase MT76_SKU_BACKOFF_BF_OFFSET:\ndrivers/net/wireless/mediatek/mt76/eeprom.c-352-\t\t\tbackoff_chain_idx += 1;\ndrivers/net/wireless/mediatek/mt76/eeprom.c-353-\t\t\tfallthrough;\ndrivers/net/wireless/mediatek/mt76/eeprom.c:354:\t\tcase MT76_SKU_BACKOFF:\ndrivers/net/wireless/mediatek/mt76/eeprom.c-355-\t\t\tdelta = mt76_tx_power_path_delta(n_chains);\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-369-\t\t/* only consider backoff value for the configured chain number */\ndrivers/net/wireless/mediatek/mt76/eeprom.c:370:\t\tif (type != MT76_SKU_RATE \u0026\u0026 n_chains != backoff_n_chains)\ndrivers/net/wireless/mediatek/mt76/eeprom.c-371-\t\t\tcontinue;\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c=378=mt76_apply_multi_array_limit(struct mt76_dev *dev, s8 *pwr, size_t pwr_len,\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-406-\t\t */\ndrivers/net/wireless/mediatek/mt76/eeprom.c:407:\t\tif (!is_mt799x(dev) \u0026\u0026 type == MT76_SKU_BACKOFF \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/eeprom.c-408-\t\t    i \u003e connac2_backoff_ru_idx)\ndrivers/net/wireless/mediatek/mt76/eeprom.c:409:\t\t\ttype = MT76_SKU_BACKOFF_BF_OFFSET;\ndrivers/net/wireless/mediatek/mt76/eeprom.c-410-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c=426=s8 mt76_get_rate_power_limits(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-477-\tmt76_apply_array_limit(dev, dest-\u003ecck, ARRAY_SIZE(dest-\u003ecck), val,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:478:\t\t\t       target_power, txs_delta, \u0026max_power, n_chains, MT76_SKU_RATE);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-479-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-481-\tmt76_apply_array_limit(dev, dest-\u003eofdm, ARRAY_SIZE(dest-\u003eofdm), val,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:482:\t\t\t       target_power, txs_delta, \u0026max_power, n_chains, MT76_SKU_RATE);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-483-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-486-\t\t\t\t     ARRAY_SIZE(dest-\u003emcs), val, len, target_power,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:487:\t\t\t\t     txs_delta, \u0026max_power, n_chains, MT76_SKU_RATE);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-488-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-491-\t\t\t\t     ARRAY_SIZE(dest-\u003eru), val, len, target_power,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:492:\t\t\t\t     txs_delta, \u0026max_power, n_chains, MT76_SKU_RATE);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-493-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-495-\tmt76_apply_array_limit(dev, dest-\u003epath.cck, ARRAY_SIZE(dest-\u003epath.cck), val,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:496:\t\t\t       target_power, txs_delta, \u0026max_power, n_chains, MT76_SKU_BACKOFF);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-497-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-499-\tmt76_apply_array_limit(dev, dest-\u003epath.ofdm, ARRAY_SIZE(dest-\u003epath.ofdm), val,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:500:\t\t\t       target_power, txs_delta, \u0026max_power, n_chains, MT76_SKU_BACKOFF);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-501-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-504-\t\t\t       target_power, txs_delta, \u0026max_power, n_chains,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:505:\t\t\t       MT76_SKU_BACKOFF_BF_OFFSET);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-506-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-509-\t\t\t\t     ARRAY_SIZE(dest-\u003epath.ru), val, len, target_power,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:510:\t\t\t\t     txs_delta, \u0026max_power, n_chains, MT76_SKU_BACKOFF);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-511-\n--\ndrivers/net/wireless/mediatek/mt76/eeprom.c-514-\t\t\t\t     ARRAY_SIZE(dest-\u003epath.ru_bf), val, len, target_power,\ndrivers/net/wireless/mediatek/mt76/eeprom.c:515:\t\t\t\t     txs_delta, \u0026max_power, n_chains, MT76_SKU_BACKOFF);\ndrivers/net/wireless/mediatek/mt76/eeprom.c-516-\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=550=int mt76_register_phy(struct mt76_phy *phy, bool vht,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-576-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:577:\tif (IS_ENABLED(CONFIG_MT76_LEDS)) {\ndrivers/net/wireless/mediatek/mt76/mac80211.c-578-\t\tret = mt76_led_init(phy);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-593-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:594:\tset_bit(MT76_STATE_REGISTERED, \u0026phy-\u003estate);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-595-\tphy-\u003edev-\u003ephys[phy-\u003eband_idx] = phy;\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=601=void mt76_unregister_phy(struct mt76_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-604-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:605:\tif (!test_bit(MT76_STATE_REGISTERED, \u0026phy-\u003estate))\ndrivers/net/wireless/mediatek/mt76/mac80211.c-606-\t\treturn;\ndrivers/net/wireless/mediatek/mt76/mac80211.c-607-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:608:\tif (IS_ENABLED(CONFIG_MT76_LEDS))\ndrivers/net/wireless/mediatek/mt76/mac80211.c-609-\t\tmt76_led_cleanup(phy);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=747=int mt76_register_device(struct mt76_dev *dev, bool vht,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-788-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:789:\tif (IS_ENABLED(CONFIG_MT76_LEDS)) {\ndrivers/net/wireless/mediatek/mt76/mac80211.c-790-\t\tret = mt76_led_init(phy);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-799-\tWARN_ON(mt76_worker_setup(hw, \u0026dev-\u003etx_worker, NULL, \"tx\"));\ndrivers/net/wireless/mediatek/mt76/mac80211.c:800:\tset_bit(MT76_STATE_REGISTERED, \u0026phy-\u003estate);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-801-\tsched_set_fifo_low(dev-\u003etx_worker.task);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=807=void mt76_unregister_device(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-810-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:811:\tif (!test_bit(MT76_STATE_REGISTERED, \u0026dev-\u003ephy.state))\ndrivers/net/wireless/mediatek/mt76/mac80211.c-812-\t\treturn;\ndrivers/net/wireless/mediatek/mt76/mac80211.c-813-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:814:\tif (IS_ENABLED(CONFIG_MT76_LEDS))\ndrivers/net/wireless/mediatek/mt76/mac80211.c-815-\t\tmt76_led_cleanup(\u0026dev-\u003ephy);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=891=static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-928-\t */\ndrivers/net/wireless/mediatek/mt76/mac80211.c:929:\tif (mt76_queue_is_wed_rro_data(rxq) \u0026\u0026 dev-\u003ehwrro_mode == MT76_HWRRO_V3)\ndrivers/net/wireless/mediatek/mt76/mac80211.c-930-\t\tq = MT_RXQ_RRO_IND;\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=958=void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-962-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:963:\tif (!test_bit(MT76_STATE_RUNNING, \u0026phy-\u003estate)) {\ndrivers/net/wireless/mediatek/mt76/mac80211.c-964-\t\tdev_kfree_skb(skb);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-968-#ifdef CONFIG_NL80211_TESTMODE\ndrivers/net/wireless/mediatek/mt76/mac80211.c:969:\tif (phy-\u003etest.state == MT76_TM_STATE_RX_FRAMES) {\ndrivers/net/wireless/mediatek/mt76/mac80211.c-970-\t\tphy-\u003etest.rx_stats.packets[q]++;\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1047=int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1056-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1057:\tset_bit(MT76_RESET, \u0026phy-\u003estate);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1058-\twait_event_timeout(dev-\u003etx_wait, !mt76_has_tx_pending(phy), timeout);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1076-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1077:\tclear_bit(MT76_RESET, \u0026phy-\u003estate);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1078-\tmt76_worker_enable(\u0026dev-\u003etx_worker);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1666=int mt76_sta_state(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1691-\t    new_state == IEEE80211_STA_ASSOC)\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1692:\t\tev = MT76_STA_EVENT_ASSOC;\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1693-\telse if (old_state == IEEE80211_STA_ASSOC \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1694-\t\t new_state == IEEE80211_STA_AUTHORIZED)\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1695:\t\tev = MT76_STA_EVENT_AUTHORIZE;\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1696-\telse if (old_state == IEEE80211_STA_ASSOC \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1697-\t\t new_state == IEEE80211_STA_AUTH)\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1698:\t\tev = MT76_STA_EVENT_DISASSOC;\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1699-\telse\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1782=void mt76_wcid_add_poll(struct mt76_dev *dev, struct mt76_wcid *wcid)\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1783-{\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1784:\tif (test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state) || !wcid-\u003esta)\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1785-\t\treturn;\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1969=void mt76_sw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1973-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1974:\tset_bit(MT76_SCANNING, \u0026phy-\u003estate);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1975-}\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1978=void mt76_sw_scan_complete(struct ieee80211_hw *hw, struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1981-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1982:\tclear_bit(MT76_SCANNING, \u0026phy-\u003estate);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1983-}\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=2078=enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-2083-\tif (dev-\u003eregion == NL80211_DFS_UNSET ||\ndrivers/net/wireless/mediatek/mt76/mac80211.c:2084:\t    test_bit(MT76_SCANNING, \u0026phy-\u003estate))\ndrivers/net/wireless/mediatek/mt76/mac80211.c-2085-\t\treturn MT_DFS_STATE_DISABLED;\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=2337=static void mt76_beacon_mon_iter(void *data, u8 *mac,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-2360-\t\t\t       READ_ONCE(mlink-\u003ebeacon_mon_last) +\ndrivers/net/wireless/mediatek/mt76/mac80211.c:2361:\t\t\t       MT76_BEACON_MON_MAX_MISS * mlink-\u003ebeacon_mon_interval))\ndrivers/net/wireless/mediatek/mt76/mac80211.c-2362-\t\t\tieee80211_beacon_loss(vif);\n--\ndrivers/net/wireless/mediatek/mt76/mcu.c=32=struct sk_buff *mt76_mcu_get_response(struct mt76_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mcu.c-42-\t\t\t   (!skb_queue_empty(\u0026dev-\u003emcu.res_q) ||\ndrivers/net/wireless/mediatek/mt76/mcu.c:43:\t\t\t    test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)),\ndrivers/net/wireless/mediatek/mt76/mcu.c-44-\t\t\t   timeout);\n--\ndrivers/net/wireless/mediatek/mt76/mcu.c=72=int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mcu.c-86-\tif ((mt76_is_mmio(dev) \u0026\u0026 atomic_read(\u0026dev-\u003ebus_hung)) ||\ndrivers/net/wireless/mediatek/mt76/mcu.c:87:\t    (mt76_is_sdio(dev) \u0026\u0026 test_bit(MT76_RESET, \u0026dev-\u003ephy.state) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mcu.c-88-\t    atomic_read(\u0026dev-\u003ebus_hung))) {\n--\ndrivers/net/wireless/mediatek/mt76/mcu.c-117-\t\tskb = mt76_mcu_get_response(dev, expires);\ndrivers/net/wireless/mediatek/mt76/mcu.c:118:\t\tif (!skb \u0026\u0026 !test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mcu.c-119-\t\t    orig_skb \u0026\u0026 retry++ \u003c dev-\u003emcu_ops-\u003emax_retry) {\n--\ndrivers/net/wireless/mediatek/mt76/mmio.c=110=void mt76_mmio_init(struct mt76_dev *dev, void __iomem *regs)\n--\ndrivers/net/wireless/mediatek/mt76/mmio.c-119-\t\t.rd_rp = mt76_mmio_rd_rp,\ndrivers/net/wireless/mediatek/mt76/mmio.c:120:\t\t.type = MT76_BUS_MMIO,\ndrivers/net/wireless/mediatek/mt76/mmio.c-121-\t};\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-5-\ndrivers/net/wireless/mediatek/mt76/mt76.h:6:#ifndef __MT76_H\ndrivers/net/wireless/mediatek/mt76/mt76.h:7:#define __MT76_H\ndrivers/net/wireless/mediatek/mt76/mt76.h-8-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-29-\ndrivers/net/wireless/mediatek/mt76/mt76.h:30:#define MT76_TOKEN_FREE_THR\t64\ndrivers/net/wireless/mediatek/mt76/mt76.h-31-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-44-\ndrivers/net/wireless/mediatek/mt76/mt76.h:45:#define MT_WED_Q_TX(_n)\t\t__MT_WED_Q(MT76_WED_Q_TX, _n)\ndrivers/net/wireless/mediatek/mt76/mt76.h:46:#define MT_WED_Q_RX(_n)\t\t__MT_WED_Q(MT76_WED_Q_RX, _n)\ndrivers/net/wireless/mediatek/mt76/mt76.h:47:#define MT_WED_Q_TXFREE\t\t__MT_WED_Q(MT76_WED_Q_TXFREE, 0)\ndrivers/net/wireless/mediatek/mt76/mt76.h:48:#define MT_WED_RRO_Q_DATA(_n)\t__MT_WED_RRO_Q(MT76_WED_RRO_Q_DATA, _n)\ndrivers/net/wireless/mediatek/mt76/mt76.h:49:#define MT_WED_RRO_Q_MSDU_PG(_n)\t__MT_WED_RRO_Q(MT76_WED_RRO_Q_MSDU_PG, _n)\ndrivers/net/wireless/mediatek/mt76/mt76.h:50:#define MT_WED_RRO_Q_IND\t__MT_WED_RRO_Q(MT76_WED_RRO_Q_IND, 0)\ndrivers/net/wireless/mediatek/mt76/mt76.h:51:#define MT_WED_RRO_Q_RXDMAD_C\t__MT_WED_RRO_Q(MT76_WED_RRO_Q_RXDMAD_C, 0)\ndrivers/net/wireless/mediatek/mt76/mt76.h-52-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-55-\t\t\t\t FIELD_PREP(MT_QFLAG_WED_RING, _n))\ndrivers/net/wireless/mediatek/mt76/mt76.h:56:#define MT_NPU_Q_TX(_n)\t\t__MT_NPU_Q(MT76_WED_Q_TX, _n)\ndrivers/net/wireless/mediatek/mt76/mt76.h:57:#define MT_NPU_Q_RX(_n)\t\t__MT_NPU_Q(MT76_WED_Q_RX, _n)\ndrivers/net/wireless/mediatek/mt76/mt76.h:58:#define MT_NPU_Q_TXFREE(_n)\t(FIELD_PREP(MT_QFLAG_WED_TYPE, MT76_WED_Q_TXFREE) | \\\ndrivers/net/wireless/mediatek/mt76/mt76.h-59-\t\t\t\t FIELD_PREP(MT_QFLAG_WED_RING, _n))\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=73=enum mt76_bus_type {\ndrivers/net/wireless/mediatek/mt76/mt76.h:74:\tMT76_BUS_MMIO,\ndrivers/net/wireless/mediatek/mt76/mt76.h:75:\tMT76_BUS_USB,\ndrivers/net/wireless/mediatek/mt76/mt76.h:76:\tMT76_BUS_SDIO,\ndrivers/net/wireless/mediatek/mt76/mt76.h-77-};\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=79=enum mt76_wed_type {\ndrivers/net/wireless/mediatek/mt76/mt76.h:80:\tMT76_WED_Q_TX,\ndrivers/net/wireless/mediatek/mt76/mt76.h:81:\tMT76_WED_Q_TXFREE,\ndrivers/net/wireless/mediatek/mt76/mt76.h:82:\tMT76_WED_Q_RX,\ndrivers/net/wireless/mediatek/mt76/mt76.h:83:\tMT76_WED_RRO_Q_DATA,\ndrivers/net/wireless/mediatek/mt76/mt76.h:84:\tMT76_WED_RRO_Q_MSDU_PG,\ndrivers/net/wireless/mediatek/mt76/mt76.h:85:\tMT76_WED_RRO_Q_IND,\ndrivers/net/wireless/mediatek/mt76/mt76.h:86:\tMT76_WED_RRO_Q_RXDMAD_C,\ndrivers/net/wireless/mediatek/mt76/mt76.h-87-};\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=89=enum mt76_hwrro_mode {\ndrivers/net/wireless/mediatek/mt76/mt76.h:90:\tMT76_HWRRO_OFF,\ndrivers/net/wireless/mediatek/mt76/mt76.h:91:\tMT76_HWRRO_V3,\ndrivers/net/wireless/mediatek/mt76/mt76.h:92:\tMT76_HWRRO_V3_1,\ndrivers/net/wireless/mediatek/mt76/mt76.h-93-};\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=95=struct mt76_bus_ops {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-109-\ndrivers/net/wireless/mediatek/mt76/mt76.h:110:#define mt76_is_usb(dev) ((dev)-\u003ebus-\u003etype == MT76_BUS_USB)\ndrivers/net/wireless/mediatek/mt76/mt76.h:111:#define mt76_is_mmio(dev) ((dev)-\u003ebus-\u003etype == MT76_BUS_MMIO)\ndrivers/net/wireless/mediatek/mt76/mt76.h:112:#define mt76_is_sdio(dev) ((dev)-\u003ebus-\u003etype == MT76_BUS_SDIO)\ndrivers/net/wireless/mediatek/mt76/mt76.h-113-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=180=enum mt76_dfs_state {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-186-\ndrivers/net/wireless/mediatek/mt76/mt76.h:187:#define MT76_RNR_SCAN_MAX_BSSIDS       16\ndrivers/net/wireless/mediatek/mt76/mt76.h-188-struct mt76_scan_rnr_param {\ndrivers/net/wireless/mediatek/mt76/mt76.h:189:\tu8 bssid[MT76_RNR_SCAN_MAX_BSSIDS][ETH_ALEN];\ndrivers/net/wireless/mediatek/mt76/mt76.h:190:\tu8 channel[MT76_RNR_SCAN_MAX_BSSIDS];\ndrivers/net/wireless/mediatek/mt76/mt76.h-191-\tu8 random_mac[ETH_ALEN];\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=359=enum mt76_wcid_flags {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-366-\ndrivers/net/wireless/mediatek/mt76/mt76.h:367:#define MT76_N_WCIDS 1088\ndrivers/net/wireless/mediatek/mt76/mt76.h:368:#define MT76_BEACON_MON_MAX_MISS\t7\ndrivers/net/wireless/mediatek/mt76/mt76.h-369-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=503=enum {\ndrivers/net/wireless/mediatek/mt76/mt76.h:504:\tMT76_STATE_INITIALIZED,\ndrivers/net/wireless/mediatek/mt76/mt76.h:505:\tMT76_STATE_REGISTERED,\ndrivers/net/wireless/mediatek/mt76/mt76.h:506:\tMT76_STATE_RUNNING,\ndrivers/net/wireless/mediatek/mt76/mt76.h:507:\tMT76_STATE_MCU_RUNNING,\ndrivers/net/wireless/mediatek/mt76/mt76.h:508:\tMT76_SCANNING,\ndrivers/net/wireless/mediatek/mt76/mt76.h:509:\tMT76_HW_SCANNING,\ndrivers/net/wireless/mediatek/mt76/mt76.h:510:\tMT76_HW_SCHED_SCANNING,\ndrivers/net/wireless/mediatek/mt76/mt76.h:511:\tMT76_RESTART,\ndrivers/net/wireless/mediatek/mt76/mt76.h:512:\tMT76_RESET,\ndrivers/net/wireless/mediatek/mt76/mt76.h:513:\tMT76_MCU_RESET,\ndrivers/net/wireless/mediatek/mt76/mt76.h:514:\tMT76_REMOVED,\ndrivers/net/wireless/mediatek/mt76/mt76.h:515:\tMT76_READING_STATS,\ndrivers/net/wireless/mediatek/mt76/mt76.h:516:\tMT76_STATE_POWER_OFF,\ndrivers/net/wireless/mediatek/mt76/mt76.h:517:\tMT76_STATE_SUSPEND,\ndrivers/net/wireless/mediatek/mt76/mt76.h:518:\tMT76_STATE_ROC,\ndrivers/net/wireless/mediatek/mt76/mt76.h:519:\tMT76_STATE_PM,\ndrivers/net/wireless/mediatek/mt76/mt76.h:520:\tMT76_STATE_WED_RESET,\ndrivers/net/wireless/mediatek/mt76/mt76.h-521-};\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=523=enum mt76_sta_event {\ndrivers/net/wireless/mediatek/mt76/mt76.h:524:\tMT76_STA_EVENT_ASSOC,\ndrivers/net/wireless/mediatek/mt76/mt76.h:525:\tMT76_STA_EVENT_AUTHORIZE,\ndrivers/net/wireless/mediatek/mt76/mt76.h:526:\tMT76_STA_EVENT_DISASSOC,\ndrivers/net/wireless/mediatek/mt76/mt76.h-527-};\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=664=struct mt76_usb {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-687-\ndrivers/net/wireless/mediatek/mt76/mt76.h:688:#define MT76S_XMIT_BUF_SZ\t0x3fe00\ndrivers/net/wireless/mediatek/mt76/mt76.h:689:#define MT76S_NUM_TX_ENTRIES\t256\ndrivers/net/wireless/mediatek/mt76/mt76.h:690:#define MT76S_NUM_RX_ENTRIES\t512\ndrivers/net/wireless/mediatek/mt76/mt76.h-691-struct mt76_sdio {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=787=struct mt76_testmode_data {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-789-\ndrivers/net/wireless/mediatek/mt76/mt76.h:790:\tu32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];\ndrivers/net/wireless/mediatek/mt76/mt76.h-791-\tstruct sk_buff *tx_skb;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=923=struct mt76_dev {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-985-\ndrivers/net/wireless/mediatek/mt76/mt76.h:986:\tu32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];\ndrivers/net/wireless/mediatek/mt76/mt76.h-987-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-990-\tstruct mt76_wcid global_wcid;\ndrivers/net/wireless/mediatek/mt76/mt76.h:991:\tstruct mt76_wcid __rcu *wcid[MT76_N_WCIDS];\ndrivers/net/wireless/mediatek/mt76/mt76.h-992-\tstruct list_head wcid_list;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1498=static inline bool mt76_testmode_enabled(struct mt76_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1500-#ifdef CONFIG_NL80211_TESTMODE\ndrivers/net/wireless/mediatek/mt76/mt76.h:1501:\treturn phy-\u003etest.state != MT76_TM_STATE_OFF;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1502-#else\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1655=int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);\ndrivers/net/wireless/mediatek/mt76/mt76.h-1656-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1657:#if IS_ENABLED(CONFIG_MT76_NPU)\ndrivers/net/wireless/mediatek/mt76/mt76.h-1658-void mt76_npu_check_ppe(struct mt76_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1736=static inline int mt76_npu_send_txrx_addr(struct mt76_dev *dev, int ifindex,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1741-}\ndrivers/net/wireless/mediatek/mt76/mt76.h:1742:#endif /* CONFIG_MT76_NPU */\ndrivers/net/wireless/mediatek/mt76/mt76.h-1743-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1770=static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1772-#ifdef CONFIG_NL80211_TESTMODE\ndrivers/net/wireless/mediatek/mt76/mt76.h:1773:\tenum mt76_testmode_state state = MT76_TM_STATE_IDLE;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1774-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1775:\tif (disable || phy-\u003etest.state == MT76_TM_STATE_OFF)\ndrivers/net/wireless/mediatek/mt76/mt76.h:1776:\t\tstate = MT76_TM_STATE_OFF;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1777-\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1977=static inline bool mt76_queue_is_wed_tx_free(struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1979-\treturn (q-\u003eflags \u0026 MT_QFLAG_WED) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76.h:1980:\t       FIELD_GET(MT_QFLAG_WED_TYPE, q-\u003eflags) == MT76_WED_Q_TXFREE;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1981-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1988=static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1990-\treturn mt76_queue_is_wed_rro(q) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76.h:1991:\t       FIELD_GET(MT_QFLAG_WED_TYPE, q-\u003eflags) == MT76_WED_RRO_Q_IND;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1992-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1994=static inline bool mt76_queue_is_wed_rro_rxdmad_c(struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1996-\treturn mt76_queue_is_wed_rro(q) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76.h:1997:\t       FIELD_GET(MT_QFLAG_WED_TYPE, q-\u003eflags) == MT76_WED_RRO_Q_RXDMAD_C;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1998-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=2000=static inline bool mt76_queue_is_wed_rro_data(struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-2002-\treturn mt76_queue_is_wed_rro(q) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76.h:2003:\t       FIELD_GET(MT_QFLAG_WED_TYPE, q-\u003eflags) == MT76_WED_RRO_Q_DATA;\ndrivers/net/wireless/mediatek/mt76/mt76.h-2004-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=2006=static inline bool mt76_queue_is_wed_rro_msdu_pg(struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-2009-\t       FIELD_GET(MT_QFLAG_WED_TYPE, q-\u003eflags) ==\ndrivers/net/wireless/mediatek/mt76/mt76.h:2010:\t       MT76_WED_RRO_Q_MSDU_PG;\ndrivers/net/wireless/mediatek/mt76/mt76.h-2011-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=2013=static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-2015-\treturn (q-\u003eflags \u0026 MT_QFLAG_WED) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76.h:2016:\t       FIELD_GET(MT_QFLAG_WED_TYPE, q-\u003eflags) == MT76_WED_Q_RX;\ndrivers/net/wireless/mediatek/mt76/mt76.h-2017-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=2029=static inline bool mt76_queue_is_npu_tx(struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-2031-\treturn mt76_queue_is_npu(q) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76.h:2032:\t       FIELD_GET(MT_QFLAG_WED_TYPE, q-\u003eflags) == MT76_WED_Q_TX;\n\n"
}

gemini-3.7-flash

null

null

							input: 54939
							output: 187
							thoughts: 935
						

**Analysis of MediaTek Wireless Driver Changes for Fuzzing**

Okay, let's break this down. My initial thought is to identify potential fuzzing targets, and this patch immediately catches my attention.

First, I need to know where we're working. I see `mt76_phy_init` and `mt792x_init_wiphy` are the key functions. Specifically, `mt76_phy_init` is a static function within `mac80211.c`, called by `mt76_register_phy` and `mt76_register_device`. `mt792x_init_wiphy` is in `mt792x_core.c`. These are crucial entry points into the MediaTek wireless driver stack.

The patch's core modification seems to involve enabling the `NL80211_FEATURE_ACTIVE_MONITOR` feature. It affects MediaTek wireless drivers directly, especially USB variants like `mt7921u`, `mt76x0u`, and others – the ones that are likely accessible in a virtualized USB gadget environment.  When these USB devices are connected, the mentioned functions (`mt76_phy_init` and `mt792x_init_wiphy`) are executed during initialization. This sets the stage for creating and configuring active monitor mode interfaces using netlink (nl80211).

Therefore, from a fuzzing perspective, this looks promising. My assessment is:

*   **WorthFuzzing: True.** The modification directly enables new functionality related to active monitoring, which increases the attack surface for fuzzing.
*   **Focus Symbols:** My focus should be on the entry points:
    *   `mt792x_init_wiphy`
    *   `mt76_register_device`
    *   `mt76_register_phy`
*   **EnableConfigs:** I need to make sure the right configuration options are set.  The relevant configs are: `MT76_CORE`, `MT792x_LIB`, `MT7921U`, `MAC80211`, `CFG80211`. Specifically, `MT76_CORE` seems to be selected by things like `MT76_CONNAC_LIB`, `MT76x02_LIB`. `MT7921U` selects `MT792x_USB` and `MT7921_COMMON`.
*   Double-checking this, I confirm that the `FocusSymbols` and `EnableConfigs` above are correct.

My reasoning is straightforward: The patch removes a limitation and unconditionally enables the active monitor feature. This means userspace can configure active monitor interfaces via nl80211 on MediaTek wireless devices, especially the USB-based ones, so this is worth fuzzing.
Alright, time to call `set-results` with this information.

{
  "EnableConfigs": [
    "MT76_CORE",
    "MT792x_LIB",
    "MT7921U",
    "MAC80211",
    "CFG80211"
  ],
  "FocusSymbols": [
    "mt792x_init_wiphy",
    "mt76_register_device",
    "mt76_register_phy"
  ],
  "Reasoning": "The patch removes the no_active_monitor flag and unconditionally enables NL80211_FEATURE_ACTIVE_MONITOR for MediaTek mt76 / mt792x wireless drivers. These drivers are reachable in virtualized environments via USB emulation (e.g. mt7921u), allowing active monitor interface creation and handling via nl80211.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MT76_CORE",
    "MT792x_LIB",
    "MT7921U",
    "MAC80211",
    "CFG80211"
  ],
  "FocusSymbols": [
    "mt792x_init_wiphy",
    "mt76_register_device",
    "mt76_register_phy"
  ],
  "Reasoning": "The patch removes the no_active_monitor flag and unconditionally enables NL80211_FEATURE_ACTIVE_MONITOR for MediaTek mt76 / mt792x wireless drivers. These drivers are reachable in virtualized environments via USB emulation (e.g. mt7921u), allowing active monitor interface creation and handling via nl80211.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

core

null

{
  "KMSANReasoning": "The patch enables the NL80211_FEATURE_ACTIVE_MONITOR feature flag unconditionally for all mt76 wireless devices by removing the `no_active_monitor` flag from `struct mt76_phy` and the override in `mt792x_init_wiphy`.\n\nThis change only modifies a feature bitmask flag on the wiphy device and removes a struct field. It does not introduce new data structures, uninitialized stack or heap allocations, uninitialized padding/fields copied to userspace, or branching on uninitialized variables. Therefore, there are no uninitialized memory or information leak risks that would require KMSAN fuzzing, and standard KASAN/syzkaller testing is sufficient.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 0b63453db8701f8912125d5acfc250d54507beca
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Sep 5 04:42:14 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index abbe65cbcd89e..f92277770488a 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -439,9 +439,8 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
 	SET_IEEE80211_DEV(hw, dev->dev);
 	SET_IEEE80211_PERM_ADDR(hw, phy->macaddr);
 
-	wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
-	if (!phy->no_active_monitor)
-		wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+	wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
+			   NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
 	wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |
 			WIPHY_FLAG_SUPPORTS_TDLS |
 			WIPHY_FLAG_AP_UAPSD;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 62b41c8bb7c0d..61ef1b80feb85 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -873,7 +873,6 @@ struct mt76_phy {
 	struct cfg80211_chan_def main_chandef;
 	bool offchannel;
 	bool radar_enabled;
-	bool no_active_monitor;
 
 	struct delayed_work roc_work;
 	struct ieee80211_vif *roc_vif;
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index 0ad33f74c2285..837d7af984e86 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -820,7 +820,6 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)
 
 	wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
 			   NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
-	phy->mt76->no_active_monitor = true;
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HT);

gemini-3.7-flash

null

null

							input: 2820
							output: 45
							thoughts: 263
						

**Analyzing the MT76 Wireless Driver Patch**

Okay, so this patch is clearly targeting the MediaTek wireless driver, specifically the `mt76` family. Let's break down the changes. The first thing that jumps out is the modification to `drivers/net/wireless/mediatek/mt76/mac80211.c`. They've removed a condition related to `NL80211_FEATURE_ACTIVE_MONITOR` and `NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE`. Specifically, that `if (!phy->no_active_monitor)` check is gone. Right away, that says *something* about active monitor support is changing across the board, or perhaps for *all* MediaTek devices now.

Then, looking at `drivers/net/wireless/mediatek/mt76/mt76.h`, they've completely removed the `bool no_active_monitor;` member from the `struct mt76_phy`. That's a significant indicator. Essentially, the driver seems to have lost the capability to explicitly disable active monitoring.

And lastly, in `drivers/net/wireless/mediatek/mt76/mt792x_core.c`, they've removed the line that was setting `phy->mt76->no_active_monitor = true;` within the `mt792x_init_wiphy` function. This confirms that a specific model was being explicitly told *not* to use active monitor. This is all coming together now - they're making a strong change in the default behavior.

Now, I need to check for any deeper implications. We'll need to run a quick grep to understand how `active_monitor` is handled in `mt76`, now that it's potentially enabled for all instances. Are there any assumptions based on its previous disabled state? Are there any potential regressions? Let's get that grepper fired up and see what it reveals. This patch could be a big deal for those using these chips in monitor mode or in access point mode, and we need to understand the side effects.

{
  "Expression": "NL80211_FEATURE_ACTIVE_MONITOR",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mac80211.c=427=mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-441-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:442:\twiphy-\u003efeatures |= NL80211_FEATURE_ACTIVE_MONITOR |\ndrivers/net/wireless/mediatek/mt76/mac80211.c-443-\t\t\t   NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;\n"
}

gemini-3.7-flash

null

null

							input: 3779
							output: 35
							thoughts: 64
						

Okay, let's dive into this code.

**Investigating a Network Wireless Patch**

Alright, I need to understand the reasoning behind this patch, or perhaps I'm trying to get a better grasp on what this `NL80211_FEATURE_ACTIVE_MONITOR` feature actually *does*. My instinct is to trace its usage. I'll initiate a search across the relevant kernel directories. Specifically, I should be looking in `net/wireless/` and `net/mac80211/`. I'm expecting to find the implementation, its use cases, and likely, any associated configuration or API calls. From there, I can determine how this feature impacts the wireless subsystem and hopefully determine why this patch was made.

{
  "Expression": "NL80211_FEATURE_ACTIVE_MONITOR",
  "PathPrefix": "net/"
}

{
  "Output": "net/wireless/nl80211.c=4934=static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,\n--\nnet/wireless/nl80211.c-4958-\tif (params-\u003eflags \u0026 MONITOR_FLAG_ACTIVE \u0026\u0026\nnet/wireless/nl80211.c:4959:\t    !(rdev-\u003ewiphy.features \u0026 NL80211_FEATURE_ACTIVE_MONITOR))\nnet/wireless/nl80211.c-4960-\t\treturn -EOPNOTSUPP;\n"
}

gemini-3.7-flash

null

null

							input: 4202
							output: 175
							thoughts: 572
						

**My Assessment of the Active Monitor Feature Flag Change**

Okay, so this change in the mt76 wireless driver, specifically regarding `NL80211_FEATURE_ACTIVE_MONITOR`, has caught my eye. The core of it seems to be about enabling the `MONITOR_FLAG_ACTIVE` flag when creating or setting up monitor interfaces, which is a departure from how mt792x used to handle it, where it disabled active monitor. Now, all mt76 devices are going to advertise this feature.

My immediate concern, as always with these kinds of changes, is whether this introduces any uninitialized memory risks. Let's break it down:

*   **Kernel -> Userspace:** My first thought is always, are we sending any potentially uninitialized data to user space? We have to consider how data is communicated (copy\_to\_user, netlink, ioctls, etc.). But no, in this case, it's just a feature flag – `NL80211_FEATURE_ACTIVE_MONITOR` being added to `wiphy->features`. It's a simple advertisement. No direct data exposure.

*   **Conditional Logic:** The second thing I check is branching based on potentially uninitialized variables. This is a big area for potential issues. The good news is that the change *removes* a field `no_active_monitor` from `struct mt76_phy`. This simplifies things, actually. No new conditional logic is being introduced, and existing logic is being cleaned up.

*   **Data Structure Initialization:** What about allocated data structures? Could we be leaving some fields uninitialized and then reading them later? This could lead to information leaks or even crashes. Nope. The driver isn't introducing any complex data structure initialization in this patch.

*   **Bounds Checks and Logic:** What about potential buffer overflows, and the like? The change doesn't modify any bounds checks, lengths, or access existing buffers in a way that might introduce uninitialized bytes.

Next, I need to understand if active monitor mode itself, with the new feature flag, might have any implications. Does the mt76 driver transmit ACKs or anything that might potentially read uninitialized data? It looks like the active monitor mode, including sending ACKs, is handled in hardware or firmware. No uninitialized memory is exposed to user space.

So, summing it up, this appears to be a pretty straightforward feature flag enablement and field cleanup in the mt76 wireless driver. It's essentially removing a flag and adding another feature. There are no obvious uninitialized memory risks, no information leaks, or any concerns about the overall memory safety of the wireless stack.

Let me double-check: the patch simply includes `NL80211_FEATURE_ACTIVE_MONITOR` in `wiphy->features`, removes the `no_active_monitor` field, and also removes the `phy->mt76->no_active_monitor = true` setting from `mt792x_init_wiphy`. No real complexity here.

Finally, regarding testing, the change does not require KMSAN. KASAN and standard testing methodologies are sufficient to verify any memory safety in packet handling and buffer allocation. KMSAN is overkill here.

I'm ready to call the `set-results` method. I'm confident in my assessment.

{
  "KMSANReasoning": "The patch enables the NL80211_FEATURE_ACTIVE_MONITOR feature flag unconditionally for all mt76 wireless devices by removing the `no_active_monitor` flag from `struct mt76_phy` and the override in `mt792x_init_wiphy`.\n\nThis change only modifies a feature bitmask flag on the wiphy device and removes a struct field. It does not introduce new data structures, uninitialized stack or heap allocations, uninitialized padding/fields copied to userspace, or branching on uninitialized variables. Therefore, there are no uninitialized memory or information leak risks that would require KMSAN fuzzing, and standard KASAN/syzkaller testing is sufficient.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch enables the NL80211_FEATURE_ACTIVE_MONITOR feature flag unconditionally for all mt76 wireless devices by removing the `no_active_monitor` flag from `struct mt76_phy` and the override in `mt792x_init_wiphy`.\n\nThis change only modifies a feature bitmask flag on the wiphy device and removes a struct field. It does not introduce new data structures, uninitialized stack or heap allocations, uninitialized padding/fields copied to userspace, or branching on uninitialized variables. Therefore, there are no uninitialized memory or information leak risks that would require KMSAN fuzzing, and standard KASAN/syzkaller testing is sufficient.",
  "NeedsKMSAN": false
}