AI Trajectory

null

{
  "EnableConfigs": [
    "MAC80211",
    "RTW88",
    "RTW88_CORE",
    "RTW88_8822C",
    "RTW88_8822CU",
    "RTW88_8822CE"
  ],
  "FocusSymbols": [
    "rtw_core_start",
    "rtw_power_on",
    "rtw8822c_phy_set_param",
    "rtw8822c_rf_init",
    "rtw8822c_rf_dac_cal",
    "rtw8822c_dac_cal_iq_search",
    "rtw8822c_dac_iq_offset"
  ],
  "KMSANReasoning": "The patch refactors internal DAC I/Q calibration routines in the Realtek rtw8822c wireless driver (rtw8822c.c) by using FIELD_GET_SIGNED for 10-bit signed register decoding, standard kernel sort(), and simplified signed integer arithmetic instead of custom 2's complement handling. The changes do not introduce or modify any data structures copied to user space (no copy_to_user, netlink skb, ioctl, etc.), nor do they introduce uninitialized memory reads or changes to heap/stack allocation initialization. Therefore, dedicated KMSAN fuzzing is not required and standard KASAN/sanitizers are sufficient.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies DAC IQ calibration math, sample validation, and sorting logic for Realtek RTL8822C wireless devices. RTL8822CU USB devices can be emulated in virtualized environments via USB emulation tools (like Raw Gadget), making these code paths reachable during hardware initialization and power-on.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit e35b83a9419fe7928b00f2ceab02b204338de51e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Aug 28 06:39:46 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c\nindex 244c8026479c2..bec1bb376996b 100644\n--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c\n+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c\n@@ -3,6 +3,7 @@\n  */\n \n #include \u003clinux/module.h\u003e\n+#include \u003clinux/sort.h\u003e\n #include \"main.h\"\n #include \"coex.h\"\n #include \"fw.h\"\n@@ -153,84 +154,30 @@ static void rtw8822c_dac_restore_reg(struct rtw_dev *rtwdev,\n \t}\n }\n \n-static void rtw8822c_rf_minmax_cmp(struct rtw_dev *rtwdev, u32 value,\n-\t\t\t\t   u32 *min, u32 *max)\n+static int rtw8822c_dac_iq_cmp_s32(const void *a, const void *b)\n {\n-\tif (value \u003e= 0x200) {\n-\t\tif (*min \u003e= 0x200) {\n-\t\t\tif (*min \u003e value)\n-\t\t\t\t*min = value;\n-\t\t} else {\n-\t\t\t*min = value;\n-\t\t}\n-\t\tif (*max \u003e= 0x200) {\n-\t\t\tif (*max \u003c value)\n-\t\t\t\t*max = value;\n-\t\t}\n-\t} else {\n-\t\tif (*min \u003c 0x200) {\n-\t\t\tif (*min \u003e value)\n-\t\t\t\t*min = value;\n-\t\t}\n+\ts32 val_a = *(const s32 *)a;\n+\ts32 val_b = *(const s32 *)b;\n \n-\t\tif (*max  \u003e= 0x200) {\n-\t\t\t*max = value;\n-\t\t} else {\n-\t\t\tif (*max \u003c value)\n-\t\t\t\t*max = value;\n-\t\t}\n-\t}\n+\treturn (val_a \u003e val_b) - (val_a \u003c val_b);\n }\n \n-static void __rtw8822c_dac_iq_sort(struct rtw_dev *rtwdev, u32 *v1, u32 *v2)\n-{\n-\tif (*v1 \u003e= 0x200 \u0026\u0026 *v2 \u003e= 0x200) {\n-\t\tif (*v1 \u003e *v2)\n-\t\t\tswap(*v1, *v2);\n-\t} else if (*v1 \u003c 0x200 \u0026\u0026 *v2 \u003c 0x200) {\n-\t\tif (*v1 \u003e *v2)\n-\t\t\tswap(*v1, *v2);\n-\t} else if (*v1 \u003c 0x200 \u0026\u0026 *v2 \u003e= 0x200) {\n-\t\tswap(*v1, *v2);\n-\t}\n-}\n \n-static void rtw8822c_dac_iq_sort(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)\n+static u32 rtw8822c_dac_iq_offset(struct rtw_dev *rtwdev, s32 *vec)\n {\n-\tu32 i, j;\n-\n-\tfor (i = 0; i \u003c DACK_SN_8822C - 1; i++) {\n-\t\tfor (j = 0; j \u003c (DACK_SN_8822C - 1 - i) ; j++) {\n-\t\t\t__rtw8822c_dac_iq_sort(rtwdev, \u0026iv[j], \u0026iv[j + 1]);\n-\t\t\t__rtw8822c_dac_iq_sort(rtwdev, \u0026qv[j], \u0026qv[j + 1]);\n-\t\t}\n-\t}\n-}\n+\ts32 sum = 0;\n+\ts32 avg;\n+\tu32 i;\n \n-static void rtw8822c_dac_iq_offset(struct rtw_dev *rtwdev, u32 *vec, u32 *val)\n-{\n-\tu32 p, m, t, i;\n+\tfor (i = 10; i \u003c DACK_SN_8822C - 10; i++)\n+\t\tsum += vec[i];\n \n-\tm = 0;\n-\tp = 0;\n-\tfor (i = 10; i \u003c DACK_SN_8822C - 10; i++) {\n-\t\tif (vec[i] \u003e 0x200)\n-\t\t\tm = (0x400 - vec[i]) + m;\n-\t\telse\n-\t\t\tp = vec[i] + p;\n-\t}\n+\tavg = sum / (DACK_SN_8822C - 20);\n \n-\tif (p \u003e m) {\n-\t\tt = p - m;\n-\t\tt = t / (DACK_SN_8822C - 20);\n-\t} else {\n-\t\tt = m - p;\n-\t\tt = t / (DACK_SN_8822C - 20);\n-\t\tif (t != 0x0)\n-\t\t\tt = 0x400 - t;\n-\t}\n-\n-\t*val = t;\n+\t/* Map the signed average back to a 10-bit hardware format.\n+\t * Example: avg = -1, returns 0x3FF (signed 10-bit value)\n+\t */\n+\treturn avg \u0026 GENMASK(9, 0);\n }\n \n static u32 rtw8822c_get_path_write_addr(u8 path)\n@@ -271,29 +218,27 @@ static u32 rtw8822c_get_path_read_addr(u8 path)\n \treturn base_addr;\n }\n \n-static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, u32 value)\n+static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, s32 value)\n {\n-\tbool ret = true;\n \n-\tif ((value \u003e= 0x200 \u0026\u0026 (0x400 - value) \u003e 0x64) ||\n-\t    (value \u003c 0x200 \u0026\u0026 value \u003e 0x64)) {\n-\t\tret = false;\n+\tif (value \u003e 100 || value \u003c -100) {\n \t\trtw_dbg(rtwdev, RTW_DBG_RFK, \"[DACK] Error overflow\\n\");\n+\t\treturn false;\n \t}\n \n-\treturn ret;\n+\treturn true;\n }\n \n-static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)\n+static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, s32 *iv, s32 *qv)\n {\n \tu32 temp;\n \tint i = 0, cnt = 0;\n \n \twhile (i \u003c DACK_SN_8822C \u0026\u0026 cnt \u003c 10000) {\n \t\tcnt++;\n-\t\ttemp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);\n-\t\tiv[i] = (temp \u0026 0x3ff000) \u003e\u003e 12;\n-\t\tqv[i] = temp \u0026 0x3ff;\n+\t\ttemp = rtw_read32(rtwdev, 0x2dbc);\n+\t\tiv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);\n+\t\tqv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);\n \n \t\tif (rtw8822c_dac_iq_check(rtwdev, iv[i]) \u0026\u0026\n \t\t    rtw8822c_dac_iq_check(rtwdev, qv[i]))\n@@ -302,67 +247,64 @@ static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)\n }\n \n static void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,\n-\t\t\t\t       u32 *iv, u32 *qv,\n+\t\t\t\t       s32 *iv, s32 *qv,\n \t\t\t\t       u32 *i_value, u32 *q_value)\n {\n-\tu32 i_max = 0, q_max = 0, i_min = 0, q_min = 0;\n+\ts32 i_max = 0, q_max = 0, i_min = 0, q_min = 0;\n \tu32 i_delta, q_delta;\n \tu32 temp;\n-\tint i, cnt = 0;\n+\tu32 i, cnt = 0;\n \n \tdo {\n \t\ti_min = iv[0];\n \t\ti_max = iv[0];\n \t\tq_min = qv[0];\n \t\tq_max = qv[0];\n-\t\tfor (i = 0; i \u003c DACK_SN_8822C; i++) {\n-\t\t\trtw8822c_rf_minmax_cmp(rtwdev, iv[i], \u0026i_min, \u0026i_max);\n-\t\t\trtw8822c_rf_minmax_cmp(rtwdev, qv[i], \u0026q_min, \u0026q_max);\n+\t\tfor (i = 1; i \u003c DACK_SN_8822C; i++) {\n+\t\t\tif (iv[i] \u003c i_min)\n+\t\t\t\ti_min = iv[i];\n+\t\t\tif (iv[i] \u003e i_max)\n+\t\t\t\ti_max = iv[i];\n+\t\t\tif (qv[i] \u003c q_min)\n+\t\t\t\tq_min = qv[i];\n+\t\t\tif (qv[i] \u003e q_max)\n+\t\t\t\tq_max = qv[i];\n \t\t}\n \n-\t\tif (i_max \u003c 0x200 \u0026\u0026 i_min \u003c 0x200)\n-\t\t\ti_delta = i_max - i_min;\n-\t\telse if (i_max \u003e= 0x200 \u0026\u0026 i_min \u003e= 0x200)\n-\t\t\ti_delta = i_max - i_min;\n-\t\telse\n-\t\t\ti_delta = i_max + (0x400 - i_min);\n+\t\ti_delta = i_max - i_min;\n+\t\tq_delta = q_max - q_min;\n \n-\t\tif (q_max \u003c 0x200 \u0026\u0026 q_min \u003c 0x200)\n-\t\t\tq_delta = q_max - q_min;\n-\t\telse if (q_max \u003e= 0x200 \u0026\u0026 q_min \u003e= 0x200)\n-\t\t\tq_delta = q_max - q_min;\n-\t\telse\n-\t\t\tq_delta = q_max + (0x400 - q_min);\n \n \t\trtw_dbg(rtwdev, RTW_DBG_RFK,\n-\t\t\t\"[DACK] i: min=0x%08x, max=0x%08x, delta=0x%08x\\n\",\n+\t\t\t\"[DACK] i: min=%d, max=%d, delta=%d\\n\",\n \t\t\ti_min, i_max, i_delta);\n \t\trtw_dbg(rtwdev, RTW_DBG_RFK,\n-\t\t\t\"[DACK] q: min=0x%08x, max=0x%08x, delta=0x%08x\\n\",\n+\t\t\t\"[DACK] q: min=%d, max=%d, delta=%d\",\n \t\t\tq_min, q_max, q_delta);\n \n-\t\trtw8822c_dac_iq_sort(rtwdev, iv, qv);\n+\t\tsort(iv, DACK_SN_8822C, sizeof(s32), rtw8822c_dac_iq_cmp_s32, NULL);\n+\t\tsort(qv, DACK_SN_8822C, sizeof(s32), rtw8822c_dac_iq_cmp_s32, NULL);\n \n \t\tif (i_delta \u003e 5 || q_delta \u003e 5) {\n-\t\t\ttemp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);\n-\t\t\tiv[0] = (temp \u0026 0x3ff000) \u003e\u003e 12;\n-\t\t\tqv[0] = temp \u0026 0x3ff;\n-\t\t\ttemp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);\n-\t\t\tiv[DACK_SN_8822C - 1] = (temp \u0026 0x3ff000) \u003e\u003e 12;\n-\t\t\tqv[DACK_SN_8822C - 1] = temp \u0026 0x3ff;\n+\t\t\ttemp = rtw_read32(rtwdev, 0x2dbc);\n+\t\t\tiv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);\n+\t\t\tqv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);\n+\t\t\ttemp = rtw_read32(rtwdev, 0x2dbc);\n+\t\t\tiv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);\n+\t\t\tqv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);\n \t\t} else {\n \t\t\tbreak;\n \t\t}\n \t} while (cnt++ \u003c 100);\n \n-\trtw8822c_dac_iq_offset(rtwdev, iv, i_value);\n-\trtw8822c_dac_iq_offset(rtwdev, qv, q_value);\n+\t*i_value = rtw8822c_dac_iq_offset(rtwdev, iv);\n+\t*q_value = rtw8822c_dac_iq_offset(rtwdev, qv);\n }\n \n static void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,\n \t\t\t\t     u32 *i_value, u32 *q_value)\n {\n-\tu32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];\n+\ts32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];\n \tu32 rf_a, rf_b;\n \n \trf_a = rtw_read_rf(rtwdev, RF_PATH_A, 0x0, RFREG_MASK);\ndiff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.h b/drivers/net/wireless/realtek/rtw88/rtw8822c.h\nindex fc62b67a15f21..7bea99614354b 100644\n--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.h\n+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.h\n@@ -141,6 +141,9 @@ const struct rtw_table name ## _tbl = {\t\t\t\\\n #define DACK_RF_8822C\t\t1\n #define DACK_SN_8822C\t\t100\n \n+#define RTW8822C_DAC_IV_MASK GENMASK(21, 12)\n+#define RTW8822C_DAC_QV_MASK GENMASK(9, 0)\n+\n /* phy status page0 */\n #define GET_PHY_STAT_P0_PWDB_A(phy_stat)                                       \\\n \tle32_get_bits(*((__le32 *)(phy_stat) + 0x00), GENMASK(15, 8))\n"
}

core

null

{
  "EnableConfigs": [
    "MAC80211",
    "RTW88",
    "RTW88_CORE",
    "RTW88_8822C",
    "RTW88_8822CU",
    "RTW88_8822CE"
  ],
  "FocusSymbols": [
    "rtw_core_start",
    "rtw_power_on",
    "rtw8822c_phy_set_param",
    "rtw8822c_rf_init",
    "rtw8822c_rf_dac_cal",
    "rtw8822c_dac_cal_iq_search",
    "rtw8822c_dac_iq_offset"
  ],
  "Reasoning": "The patch modifies DAC IQ calibration math, sample validation, and sorting logic for Realtek RTL8822C wireless devices. RTL8822CU USB devices can be emulated in virtualized environments via USB emulation tools (like Raw Gadget), making these code paths reachable during hardware initialization and power-on.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e35b83a9419fe7928b00f2ceab02b204338de51e
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Aug 28 06:39:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
index 244c8026479c2..bec1bb376996b 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
@@ -3,6 +3,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/sort.h>
 #include "main.h"
 #include "coex.h"
 #include "fw.h"
@@ -153,84 +154,30 @@ static void rtw8822c_dac_restore_reg(struct rtw_dev *rtwdev,
 	}
 }
 
-static void rtw8822c_rf_minmax_cmp(struct rtw_dev *rtwdev, u32 value,
-				   u32 *min, u32 *max)
+static int rtw8822c_dac_iq_cmp_s32(const void *a, const void *b)
 {
-	if (value >= 0x200) {
-		if (*min >= 0x200) {
-			if (*min > value)
-				*min = value;
-		} else {
-			*min = value;
-		}
-		if (*max >= 0x200) {
-			if (*max < value)
-				*max = value;
-		}
-	} else {
-		if (*min < 0x200) {
-			if (*min > value)
-				*min = value;
-		}
+	s32 val_a = *(const s32 *)a;
+	s32 val_b = *(const s32 *)b;
 
-		if (*max  >= 0x200) {
-			*max = value;
-		} else {
-			if (*max < value)
-				*max = value;
-		}
-	}
+	return (val_a > val_b) - (val_a < val_b);
 }
 
-static void __rtw8822c_dac_iq_sort(struct rtw_dev *rtwdev, u32 *v1, u32 *v2)
-{
-	if (*v1 >= 0x200 && *v2 >= 0x200) {
-		if (*v1 > *v2)
-			swap(*v1, *v2);
-	} else if (*v1 < 0x200 && *v2 < 0x200) {
-		if (*v1 > *v2)
-			swap(*v1, *v2);
-	} else if (*v1 < 0x200 && *v2 >= 0x200) {
-		swap(*v1, *v2);
-	}
-}
 
-static void rtw8822c_dac_iq_sort(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)
+static u32 rtw8822c_dac_iq_offset(struct rtw_dev *rtwdev, s32 *vec)
 {
-	u32 i, j;
-
-	for (i = 0; i < DACK_SN_8822C - 1; i++) {
-		for (j = 0; j < (DACK_SN_8822C - 1 - i) ; j++) {
-			__rtw8822c_dac_iq_sort(rtwdev, &iv[j], &iv[j + 1]);
-			__rtw8822c_dac_iq_sort(rtwdev, &qv[j], &qv[j + 1]);
-		}
-	}
-}
+	s32 sum = 0;
+	s32 avg;
+	u32 i;
 
-static void rtw8822c_dac_iq_offset(struct rtw_dev *rtwdev, u32 *vec, u32 *val)
-{
-	u32 p, m, t, i;
+	for (i = 10; i < DACK_SN_8822C - 10; i++)
+		sum += vec[i];
 
-	m = 0;
-	p = 0;
-	for (i = 10; i < DACK_SN_8822C - 10; i++) {
-		if (vec[i] > 0x200)
-			m = (0x400 - vec[i]) + m;
-		else
-			p = vec[i] + p;
-	}
+	avg = sum / (DACK_SN_8822C - 20);
 
-	if (p > m) {
-		t = p - m;
-		t = t / (DACK_SN_8822C - 20);
-	} else {
-		t = m - p;
-		t = t / (DACK_SN_8822C - 20);
-		if (t != 0x0)
-			t = 0x400 - t;
-	}
-
-	*val = t;
+	/* Map the signed average back to a 10-bit hardware format.
+	 * Example: avg = -1, returns 0x3FF (signed 10-bit value)
+	 */
+	return avg & GENMASK(9, 0);
 }
 
 static u32 rtw8822c_get_path_write_addr(u8 path)
@@ -271,29 +218,27 @@ static u32 rtw8822c_get_path_read_addr(u8 path)
 	return base_addr;
 }
 
-static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, u32 value)
+static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, s32 value)
 {
-	bool ret = true;
 
-	if ((value >= 0x200 && (0x400 - value) > 0x64) ||
-	    (value < 0x200 && value > 0x64)) {
-		ret = false;
+	if (value > 100 || value < -100) {
 		rtw_dbg(rtwdev, RTW_DBG_RFK, "[DACK] Error overflow\n");
+		return false;
 	}
 
-	return ret;
+	return true;
 }
 
-static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)
+static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, s32 *iv, s32 *qv)
 {
 	u32 temp;
 	int i = 0, cnt = 0;
 
 	while (i < DACK_SN_8822C && cnt < 10000) {
 		cnt++;
-		temp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);
-		iv[i] = (temp & 0x3ff000) >> 12;
-		qv[i] = temp & 0x3ff;
+		temp = rtw_read32(rtwdev, 0x2dbc);
+		iv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);
+		qv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);
 
 		if (rtw8822c_dac_iq_check(rtwdev, iv[i]) &&
 		    rtw8822c_dac_iq_check(rtwdev, qv[i]))
@@ -302,67 +247,64 @@ static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)
 }
 
 static void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,
-				       u32 *iv, u32 *qv,
+				       s32 *iv, s32 *qv,
 				       u32 *i_value, u32 *q_value)
 {
-	u32 i_max = 0, q_max = 0, i_min = 0, q_min = 0;
+	s32 i_max = 0, q_max = 0, i_min = 0, q_min = 0;
 	u32 i_delta, q_delta;
 	u32 temp;
-	int i, cnt = 0;
+	u32 i, cnt = 0;
 
 	do {
 		i_min = iv[0];
 		i_max = iv[0];
 		q_min = qv[0];
 		q_max = qv[0];
-		for (i = 0; i < DACK_SN_8822C; i++) {
-			rtw8822c_rf_minmax_cmp(rtwdev, iv[i], &i_min, &i_max);
-			rtw8822c_rf_minmax_cmp(rtwdev, qv[i], &q_min, &q_max);
+		for (i = 1; i < DACK_SN_8822C; i++) {
+			if (iv[i] < i_min)
+				i_min = iv[i];
+			if (iv[i] > i_max)
+				i_max = iv[i];
+			if (qv[i] < q_min)
+				q_min = qv[i];
+			if (qv[i] > q_max)
+				q_max = qv[i];
 		}
 
-		if (i_max < 0x200 && i_min < 0x200)
-			i_delta = i_max - i_min;
-		else if (i_max >= 0x200 && i_min >= 0x200)
-			i_delta = i_max - i_min;
-		else
-			i_delta = i_max + (0x400 - i_min);
+		i_delta = i_max - i_min;
+		q_delta = q_max - q_min;
 
-		if (q_max < 0x200 && q_min < 0x200)
-			q_delta = q_max - q_min;
-		else if (q_max >= 0x200 && q_min >= 0x200)
-			q_delta = q_max - q_min;
-		else
-			q_delta = q_max + (0x400 - q_min);
 
 		rtw_dbg(rtwdev, RTW_DBG_RFK,
-			"[DACK] i: min=0x%08x, max=0x%08x, delta=0x%08x\n",
+			"[DACK] i: min=%d, max=%d, delta=%d\n",
 			i_min, i_max, i_delta);
 		rtw_dbg(rtwdev, RTW_DBG_RFK,
-			"[DACK] q: min=0x%08x, max=0x%08x, delta=0x%08x\n",
+			"[DACK] q: min=%d, max=%d, delta=%d",
 			q_min, q_max, q_delta);
 
-		rtw8822c_dac_iq_sort(rtwdev, iv, qv);
+		sort(iv, DACK_SN_8822C, sizeof(s32), rtw8822c_dac_iq_cmp_s32, NULL);
+		sort(qv, DACK_SN_8822C, sizeof(s32), rtw8822c_dac_iq_cmp_s32, NULL);
 
 		if (i_delta > 5 || q_delta > 5) {
-			temp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);
-			iv[0] = (temp & 0x3ff000) >> 12;
-			qv[0] = temp & 0x3ff;
-			temp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);
-			iv[DACK_SN_8822C - 1] = (temp & 0x3ff000) >> 12;
-			qv[DACK_SN_8822C - 1] = temp & 0x3ff;
+			temp = rtw_read32(rtwdev, 0x2dbc);
+			iv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);
+			qv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);
+			temp = rtw_read32(rtwdev, 0x2dbc);
+			iv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);
+			qv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);
 		} else {
 			break;
 		}
 	} while (cnt++ < 100);
 
-	rtw8822c_dac_iq_offset(rtwdev, iv, i_value);
-	rtw8822c_dac_iq_offset(rtwdev, qv, q_value);
+	*i_value = rtw8822c_dac_iq_offset(rtwdev, iv);
+	*q_value = rtw8822c_dac_iq_offset(rtwdev, qv);
 }
 
 static void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,
 				     u32 *i_value, u32 *q_value)
 {
-	u32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];
+	s32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];
 	u32 rf_a, rf_b;
 
 	rf_a = rtw_read_rf(rtwdev, RF_PATH_A, 0x0, RFREG_MASK);
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.h b/drivers/net/wireless/realtek/rtw88/rtw8822c.h
index fc62b67a15f21..7bea99614354b 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.h
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.h
@@ -141,6 +141,9 @@ const struct rtw_table name ## _tbl = {			\
 #define DACK_RF_8822C		1
 #define DACK_SN_8822C		100
 
+#define RTW8822C_DAC_IV_MASK GENMASK(21, 12)
+#define RTW8822C_DAC_QV_MASK GENMASK(9, 0)
+
 /* phy status page0 */
 #define GET_PHY_STAT_P0_PWDB_A(phy_stat)                                       \
 	le32_get_bits(*((__le32 *)(phy_stat) + 0x00), GENMASK(15, 8))

gemini-3.7-flash

null

null

							input: 6111
							output: 39
							thoughts: 190
						

**Assessing the Fuzzing Potential of This Patch**

Okay, let's take a look at this patch and decide if it's fuzz-worthy. It's touching `drivers/net/wireless/realtek/rtw88/rtw8822c.c` and `drivers/net/wireless/realtek/rtw88/rtw8822c.h`. Hmm, so we're dealing with the `rtw8822c` driver. Right, that's a Realtek 802.11ac wireless network driver, part of the `rtw88` family.

Now, the crucial question: can we even *get* to this driver in a fuzzing environment? Is it a PCI/USB/SDIO driver, something we can relatively easily interact with using QEMU, GCE, or simulated hardware like mac80211_hwsim or USB interfaces? Or does it rely on some specific, physical hardware configuration that's going to make fuzzing an absolute nightmare? Let's check with `grepper` and see what else is happening around `drivers/net/wireless/realtek/rtw88/`. That should give us a clearer picture of its accessibility and suitability for fuzzing.

{
  "Expression": "CONFIG_RTW88",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/Makefile-2-\ndrivers/net/wireless/realtek/rtw88/Makefile:3:obj-$(CONFIG_RTW88_CORE)\t+= rtw88_core.o\ndrivers/net/wireless/realtek/rtw88/Makefile-4-rtw88_core-y += main.o \\\n--\ndrivers/net/wireless/realtek/rtw88/Makefile=21=rtw88_core-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/realtek/rtw88/Makefile-22-\ndrivers/net/wireless/realtek/rtw88/Makefile:23:rtw88_core-$(CONFIG_RTW88_LEDS) += led.o\ndrivers/net/wireless/realtek/rtw88/Makefile-24-\ndrivers/net/wireless/realtek/rtw88/Makefile:25:obj-$(CONFIG_RTW88_8822B)\t+= rtw88_8822b.o\ndrivers/net/wireless/realtek/rtw88/Makefile-26-rtw88_8822b-objs\t\t:= rtw8822b.o rtw8822b_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-27-\ndrivers/net/wireless/realtek/rtw88/Makefile:28:obj-$(CONFIG_RTW88_8822BE)\t+= rtw88_8822be.o\ndrivers/net/wireless/realtek/rtw88/Makefile-29-rtw88_8822be-objs\t\t:= rtw8822be.o\ndrivers/net/wireless/realtek/rtw88/Makefile-30-\ndrivers/net/wireless/realtek/rtw88/Makefile:31:obj-$(CONFIG_RTW88_8822BS)\t+= rtw88_8822bs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-32-rtw88_8822bs-objs\t\t:= rtw8822bs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-33-\ndrivers/net/wireless/realtek/rtw88/Makefile:34:obj-$(CONFIG_RTW88_8822BU)\t+= rtw88_8822bu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-35-rtw88_8822bu-objs\t\t:= rtw8822bu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-36-\ndrivers/net/wireless/realtek/rtw88/Makefile:37:obj-$(CONFIG_RTW88_8822C)\t+= rtw88_8822c.o\ndrivers/net/wireless/realtek/rtw88/Makefile-38-rtw88_8822c-objs\t\t:= rtw8822c.o rtw8822c_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-39-\ndrivers/net/wireless/realtek/rtw88/Makefile:40:obj-$(CONFIG_RTW88_8822CE)\t+= rtw88_8822ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-41-rtw88_8822ce-objs\t\t:= rtw8822ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-42-\ndrivers/net/wireless/realtek/rtw88/Makefile:43:obj-$(CONFIG_RTW88_8822CS)\t+= rtw88_8822cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-44-rtw88_8822cs-objs\t\t:= rtw8822cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-45-\ndrivers/net/wireless/realtek/rtw88/Makefile:46:obj-$(CONFIG_RTW88_8822CU)\t+= rtw88_8822cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-47-rtw88_8822cu-objs\t\t:= rtw8822cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-48-\ndrivers/net/wireless/realtek/rtw88/Makefile:49:obj-$(CONFIG_RTW88_8723X)\t+= rtw88_8723x.o\ndrivers/net/wireless/realtek/rtw88/Makefile-50-rtw88_8723x-objs\t\t:= rtw8723x.o\ndrivers/net/wireless/realtek/rtw88/Makefile-51-\ndrivers/net/wireless/realtek/rtw88/Makefile:52:obj-$(CONFIG_RTW88_8703B)\t+= rtw88_8703b.o\ndrivers/net/wireless/realtek/rtw88/Makefile-53-rtw88_8703b-objs\t\t:= rtw8703b.o rtw8703b_tables.o\ndrivers/net/wireless/realtek/rtw88/Makefile-54-\ndrivers/net/wireless/realtek/rtw88/Makefile:55:obj-$(CONFIG_RTW88_8723CS)\t+= rtw88_8723cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-56-rtw88_8723cs-objs\t\t:= rtw8723cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-57-\ndrivers/net/wireless/realtek/rtw88/Makefile:58:obj-$(CONFIG_RTW88_8723D)\t+= rtw88_8723d.o\ndrivers/net/wireless/realtek/rtw88/Makefile-59-rtw88_8723d-objs\t\t:= rtw8723d.o rtw8723d_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-60-\ndrivers/net/wireless/realtek/rtw88/Makefile:61:obj-$(CONFIG_RTW88_8723DE)\t+= rtw88_8723de.o\ndrivers/net/wireless/realtek/rtw88/Makefile-62-rtw88_8723de-objs\t\t:= rtw8723de.o\ndrivers/net/wireless/realtek/rtw88/Makefile-63-\ndrivers/net/wireless/realtek/rtw88/Makefile:64:obj-$(CONFIG_RTW88_8723DS)\t+= rtw88_8723ds.o\ndrivers/net/wireless/realtek/rtw88/Makefile-65-rtw88_8723ds-objs\t\t:= rtw8723ds.o\ndrivers/net/wireless/realtek/rtw88/Makefile-66-\ndrivers/net/wireless/realtek/rtw88/Makefile:67:obj-$(CONFIG_RTW88_8723DU)\t+= rtw88_8723du.o\ndrivers/net/wireless/realtek/rtw88/Makefile-68-rtw88_8723du-objs\t\t:= rtw8723du.o\ndrivers/net/wireless/realtek/rtw88/Makefile-69-\ndrivers/net/wireless/realtek/rtw88/Makefile:70:obj-$(CONFIG_RTW88_8821C)\t+= rtw88_8821c.o\ndrivers/net/wireless/realtek/rtw88/Makefile-71-rtw88_8821c-objs\t\t:= rtw8821c.o rtw8821c_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-72-\ndrivers/net/wireless/realtek/rtw88/Makefile:73:obj-$(CONFIG_RTW88_8821CE)\t+= rtw88_8821ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-74-rtw88_8821ce-objs\t\t:= rtw8821ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-75-\ndrivers/net/wireless/realtek/rtw88/Makefile:76:obj-$(CONFIG_RTW88_8821CS)\t+= rtw88_8821cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-77-rtw88_8821cs-objs\t\t:= rtw8821cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-78-\ndrivers/net/wireless/realtek/rtw88/Makefile:79:obj-$(CONFIG_RTW88_8821CU)\t+= rtw88_8821cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-80-rtw88_8821cu-objs\t\t:= rtw8821cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-81-\ndrivers/net/wireless/realtek/rtw88/Makefile:82:obj-$(CONFIG_RTW88_88XXA)\t+= rtw88_88xxa.o\ndrivers/net/wireless/realtek/rtw88/Makefile-83-rtw88_88xxa-objs\t\t:= rtw88xxa.o\ndrivers/net/wireless/realtek/rtw88/Makefile-84-\ndrivers/net/wireless/realtek/rtw88/Makefile:85:obj-$(CONFIG_RTW88_8821A)\t+= rtw88_8821a.o\ndrivers/net/wireless/realtek/rtw88/Makefile-86-rtw88_8821a-objs\t\t:= rtw8821a.o rtw8821a_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-87-\ndrivers/net/wireless/realtek/rtw88/Makefile:88:obj-$(CONFIG_RTW88_8812A)\t+= rtw88_8812a.o\ndrivers/net/wireless/realtek/rtw88/Makefile-89-rtw88_8812a-objs\t\t:= rtw8812a.o rtw8812a_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-90-\ndrivers/net/wireless/realtek/rtw88/Makefile:91:obj-$(CONFIG_RTW88_8821AU)\t+= rtw88_8821au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-92-rtw88_8821au-objs\t\t:= rtw8821au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-93-\ndrivers/net/wireless/realtek/rtw88/Makefile:94:obj-$(CONFIG_RTW88_8812AU)\t+= rtw88_8812au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-95-rtw88_8812au-objs\t\t:= rtw8812au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-96-\ndrivers/net/wireless/realtek/rtw88/Makefile:97:obj-$(CONFIG_RTW88_8814A)\t+= rtw88_8814a.o\ndrivers/net/wireless/realtek/rtw88/Makefile-98-rtw88_8814a-objs\t\t:= rtw8814a.o rtw8814a_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-99-\ndrivers/net/wireless/realtek/rtw88/Makefile:100:obj-$(CONFIG_RTW88_8814AE)\t+= rtw88_8814ae.o\ndrivers/net/wireless/realtek/rtw88/Makefile-101-rtw88_8814ae-objs\t\t:= rtw8814ae.o\ndrivers/net/wireless/realtek/rtw88/Makefile-102-\ndrivers/net/wireless/realtek/rtw88/Makefile:103:obj-$(CONFIG_RTW88_8814AU)\t+= rtw88_8814au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-104-rtw88_8814au-objs\t\t:= rtw8814au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-105-\ndrivers/net/wireless/realtek/rtw88/Makefile:106:obj-$(CONFIG_RTW88_PCI)\t\t+= rtw88_pci.o\ndrivers/net/wireless/realtek/rtw88/Makefile-107-rtw88_pci-objs\t\t\t:= pci.o\ndrivers/net/wireless/realtek/rtw88/Makefile-108-\ndrivers/net/wireless/realtek/rtw88/Makefile:109:obj-$(CONFIG_RTW88_SDIO)\t+= rtw88_sdio.o\ndrivers/net/wireless/realtek/rtw88/Makefile-110-rtw88_sdio-objs\t\t\t:= sdio.o\ndrivers/net/wireless/realtek/rtw88/Makefile-111-\ndrivers/net/wireless/realtek/rtw88/Makefile:112:obj-$(CONFIG_RTW88_USB)\t\t+= rtw88_usb.o\ndrivers/net/wireless/realtek/rtw88/Makefile-113-rtw88_usb-objs\t\t\t:= usb.o\n--\ndrivers/net/wireless/realtek/rtw88/coex.c=3553=void rtw_coex_wl_ccklock_work(struct work_struct *work)\n--\ndrivers/net/wireless/realtek/rtw88/coex.c-3563-\ndrivers/net/wireless/realtek/rtw88/coex.c:3564:#ifdef CONFIG_RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/coex.c-3565-#define INFO_SIZE\t80\n--\ndrivers/net/wireless/realtek/rtw88/coex.c=3936=void rtw_coex_display_coex_info(struct rtw_dev *rtwdev, struct seq_file *m)\n--\ndrivers/net/wireless/realtek/rtw88/coex.c-4204-}\ndrivers/net/wireless/realtek/rtw88/coex.c:4205:#endif /* CONFIG_RTW88_DEBUGFS */\n--\ndrivers/net/wireless/realtek/rtw88/debug.c-16-\ndrivers/net/wireless/realtek/rtw88/debug.c:17:#ifdef CONFIG_RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/debug.c-18-\n--\ndrivers/net/wireless/realtek/rtw88/debug.c=1349=void rtw_debugfs_deinit(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/debug.c-1352-}\ndrivers/net/wireless/realtek/rtw88/debug.c:1353:#endif /* CONFIG_RTW88_DEBUGFS */\ndrivers/net/wireless/realtek/rtw88/debug.c-1354-\ndrivers/net/wireless/realtek/rtw88/debug.c:1355:#ifdef CONFIG_RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/debug.c-1356-\n--\ndrivers/net/wireless/realtek/rtw88/debug.c=1373=EXPORT_SYMBOL(rtw_dbg);\ndrivers/net/wireless/realtek/rtw88/debug.c-1374-\ndrivers/net/wireless/realtek/rtw88/debug.c:1375:#endif /* CONFIG_RTW88_DEBUG */\n--\ndrivers/net/wireless/realtek/rtw88/debug.h=8=enum rtw_debug_mask {\n--\ndrivers/net/wireless/realtek/rtw88/debug.h-33-\ndrivers/net/wireless/realtek/rtw88/debug.h:34:#ifdef CONFIG_RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/debug.h-35-\n--\ndrivers/net/wireless/realtek/rtw88/debug.h=43=static inline void rtw_debugfs_deinit(struct rtw_dev *rtwdev) {}\ndrivers/net/wireless/realtek/rtw88/debug.h-44-\ndrivers/net/wireless/realtek/rtw88/debug.h:45:#endif /* CONFIG_RTW88_DEBUGFS */\ndrivers/net/wireless/realtek/rtw88/debug.h-46-\ndrivers/net/wireless/realtek/rtw88/debug.h:47:#ifdef CONFIG_RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/debug.h-48-\n--\ndrivers/net/wireless/realtek/rtw88/debug.h=64=static inline bool rtw_dbg_is_enabled(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/debug.h-69-\ndrivers/net/wireless/realtek/rtw88/debug.h:70:#endif /* CONFIG_RTW88_DEBUG */\ndrivers/net/wireless/realtek/rtw88/debug.h-71-\n--\ndrivers/net/wireless/realtek/rtw88/led.h-7-\ndrivers/net/wireless/realtek/rtw88/led.h:8:#ifdef CONFIG_RTW88_LEDS\ndrivers/net/wireless/realtek/rtw88/led.h-9-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c=1886=const struct rtw_chip_info rtw8703b_hw_spec = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1995-\t/* These registers are used to read (and print) from if\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:1996:\t * CONFIG_RTW88_DEBUGFS is enabled.\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1997-\t */\n"
}

gemini-3.7-flash

null

null

							input: 11543
							output: 44
							thoughts: 162
						

**Fuzzing the RTW8822C: A USB Wireless Driver Perspective**

Okay, so I'm thinking about how to approach fuzzing this `rtw8822c` driver. The first thing I need to figure out is the interface – is it USB, PCIe, or SDIO? Ah, good, it looks like `RTW88_8822CU` is specifically USB, which is a major advantage. Knowing that it's USB opens up some interesting avenues because Syzkaller is known to fuzz USB drivers really effectively via Raw Gadget and USB emulation.

So, the next question is, can I leverage that existing USB emulation setup in Syzkaller to fuzz USB wireless dongles that utilize the `rtw88_8822cu` driver? The possibility excites me, as the existing infrastructure could significantly reduce the setup burden.

Alright, to answer that, I need to get into the code. I should probably focus on examining both `rtw88_8822cu` and the core `rtw8822c.c` file. I'll need to trace the code path to see how functions like `rtw8822c_dac_cal_iq_sample` and `rtw8822c_dac_cal_rf_mode` are actually reached and triggered. Understanding the call flow will be crucial in figuring out if the relevant functionality is accessible through a fuzzing harness.

{
  "Expression": "rtw8822c_dac_cal",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.c=221=static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, s32 value)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-231-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:232:static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, s32 *iv, s32 *qv)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-233-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-248-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:249:static void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-250-\t\t\t\t       s32 *iv, s32 *qv,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-303-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:304:static void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-305-\t\t\t\t     u32 *i_value, u32 *q_value)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-315-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:316:\trtw8822c_dac_cal_iq_sample(rtwdev, iv, qv);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:317:\trtw8822c_dac_cal_iq_search(rtwdev, iv, qv, i_value, q_value);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-318-}\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=320=static void rtw8822c_dac_bb_setting(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-335-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:336:static void rtw8822c_dac_cal_adc(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-337-\t\t\t\t u8 path, u32 *adc_ic, u32 *adc_qc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-373-\t\trtw_write32(rtwdev, 0x1c24, 0x00010002);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:374:\t\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-375-\t\trtw_dbg(rtwdev, RTW_DBG_RFK,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-393-\t\trtw_write32(rtwdev, 0x1c3c, path_sel + 0x8103);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:394:\t\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-395-\t\trtw_dbg(rtwdev, RTW_DBG_RFK,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-413-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:414:static void rtw8822c_dac_cal_step1(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-415-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-458-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:459:static void rtw8822c_dac_cal_step2(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-460-\t\t\t\t   u8 path, u32 *ic_out, u32 *qc_out)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-476-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:477:\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic_in, \u0026qc_in);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-478-\tic = ic_in;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-507-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:508:static void rtw8822c_dac_cal_step3(struct rtw_dev *rtwdev, u8 path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-509-\t\t\t\t   u32 adc_ic, u32 adc_qc,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-558-\trtw_write32(rtwdev, base_addr + 0x60, 0xf0000000);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:559:\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-560-\tif (ic \u003e= 0x10)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-584-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:585:static void rtw8822c_dac_cal_step4(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-586-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-594-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:595:static void rtw8822c_dac_cal_backup_vec(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-596-\t\t\t\t\tu8 path, u8 vec, u32 w_addr, u32 r_addr)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-611-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:612:static void rtw8822c_dac_cal_backup_path(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-613-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-623-\tr_addr = rtw8822c_get_path_read_addr(path) + 0x10;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:624:\trtw8822c_dac_cal_backup_vec(rtwdev, path, 0, w_addr, r_addr);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-625-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-628-\tr_addr = rtw8822c_get_path_read_addr(path) + 0x10 + r_off;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:629:\trtw8822c_dac_cal_backup_vec(rtwdev, path, 1, w_addr, r_addr);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-630-}\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-631-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:632:static void rtw8822c_dac_cal_backup_dck(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-633-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-655-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:656:static void rtw8822c_dac_cal_backup(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-657-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-669-\trtw_write32_mask(rtwdev, 0x1860, 0xfc000000, 0x3c);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:670:\trtw8822c_dac_cal_backup_path(rtwdev, RF_PATH_A);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-671-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-674-\trtw_write32_mask(rtwdev, 0x4160, 0xfc000000, 0x3c);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:675:\trtw8822c_dac_cal_backup_path(rtwdev, RF_PATH_B);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-676-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:677:\trtw8822c_dac_cal_backup_dck(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-678-\trtw_write32_set(rtwdev, 0x1830, BIT(30));\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-685-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:686:static void rtw8822c_dac_cal_restore_dck(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-687-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-715-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:716:static void rtw8822c_dac_cal_restore_prepare(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-717-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-744-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:745:\trtw8822c_dac_cal_restore_dck(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-746-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-768-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:769:static bool rtw8822c_dac_cal_restore_wait(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-770-\t\t\t\t\t  u32 target_addr, u32 toggle_addr)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-785-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:786:static bool rtw8822c_dac_cal_restore_path(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-787-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-799-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:800:\tif (!rtw8822c_dac_cal_restore_wait(rtwdev, r_i, w_i + 0x8))\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-801-\t\treturn false;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-812-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:813:\tif (!rtw8822c_dac_cal_restore_wait(rtwdev, r_q, w_q + 0x8))\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-814-\t\treturn false;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-832-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:833:static bool __rtw8822c_dac_cal_restore(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-834-{\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:835:\tif (!rtw8822c_dac_cal_restore_path(rtwdev, RF_PATH_A))\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-836-\t\treturn false;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-837-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:838:\tif (!rtw8822c_dac_cal_restore_path(rtwdev, RF_PATH_B))\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-839-\t\treturn false;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-843-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:844:static bool rtw8822c_dac_cal_restore(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-845-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-859-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:860:\trtw8822c_dac_cal_restore_prepare(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-861-\tif (!check_hw_ready(rtwdev, 0x2808, 0x7fff80, 0xffff) ||\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-866-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:867:\tif (!__rtw8822c_dac_cal_restore(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-868-\t\trtw_err(rtwdev, \"failed to restore dack vectors\\n\");\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=885=static void rtw8822c_rf_dac_cal(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-893-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:894:\tif (rtw8822c_dac_cal_restore(rtwdev))\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-895-\t\treturn;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-903-\t/* path-A */\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:904:\trtw8822c_dac_cal_adc(rtwdev, RF_PATH_A, \u0026adc_ic_a, \u0026adc_qc_a);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-905-\tfor (i = 0; i \u003c 10; i++) {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:906:\t\trtw8822c_dac_cal_step1(rtwdev, RF_PATH_A);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:907:\t\trtw8822c_dac_cal_step2(rtwdev, RF_PATH_A, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-908-\t\tic_a = ic;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-910-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:911:\t\trtw8822c_dac_cal_step3(rtwdev, RF_PATH_A, adc_ic_a, adc_qc_a,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-912-\t\t\t\t       \u0026ic, \u0026qc, \u0026i_a, \u0026q_a);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-916-\t}\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:917:\trtw8822c_dac_cal_step4(rtwdev, RF_PATH_A);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-918-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-919-\t/* path-B */\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:920:\trtw8822c_dac_cal_adc(rtwdev, RF_PATH_B, \u0026adc_ic_b, \u0026adc_qc_b);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-921-\tfor (i = 0; i \u003c 10; i++) {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:922:\t\trtw8822c_dac_cal_step1(rtwdev, RF_PATH_B);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:923:\t\trtw8822c_dac_cal_step2(rtwdev, RF_PATH_B, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-924-\t\tic_b = ic;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-926-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:927:\t\trtw8822c_dac_cal_step3(rtwdev, RF_PATH_B, adc_ic_b, adc_qc_b,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-928-\t\t\t\t       \u0026ic, \u0026qc, \u0026i_b, \u0026q_b);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-932-\t}\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:933:\trtw8822c_dac_cal_step4(rtwdev, RF_PATH_B);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-934-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-943-\t/* backup results to restore, saving a lot of time */\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:944:\trtw8822c_dac_cal_backup(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-945-\n"
}

gemini-3.7-flash

null

null

							input: 18248
							output: 46
							thoughts: 24
						

Here's my take on those thoughts, tailored for an expert audience:

**Tracing the RF DAC Calibration Function**

Okay, so I need to understand the call flow for `rtw8822c_rf_dac_cal`. My initial thought is to figure out where this calibration function is being invoked. I'm assuming it's probably critical to the radio's performance, given the "RF DAC" component in the name. Given the naming convention I can guess it's specific to the Realtek 8822C chip, which gives me a useful search starting point. Time to fire up the tools – I'll probably start with a cross-reference search in the relevant driver source code. I'm expecting to see calls from the initialization routines, perhaps during link setup or whenever channel changes occur. Could also be triggered by a specific event or command from the MAC layer. I want to see *how* and *when* it's being used. Specifically, what's triggering it, and what's the broader context surrounding the call. This will help me understand its purpose and why it's needed.

{
  "Expression": "rtw8822c_rf_dac_cal",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.c=844=static bool rtw8822c_dac_cal_restore(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-884-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:885:static void rtw8822c_rf_dac_cal(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-886-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=1780=static void rtw8822c_rf_init(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1781-{\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1782:\trtw8822c_rf_dac_cal(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1783-\trtw8822c_rf_x2_check(rtwdev);\n"
}

gemini-3.7-flash

null

null

							input: 18923
							output: 44
							thoughts: 43
						

Here's my summary, as though I'm thinking through this process:

**Diving into the `rtw8822c_rf_init` Function**

Okay, so I need to understand the role of `rtw8822c_rf_init`. First things first, I need to figure out the call graph for that function. Where is it being called from? I need to trace its execution path to understand its context. I'm thinking I'll start by checking if `rtw_chip_info` or `rtw_chip_ops` are referencing it, either directly or indirectly. Those structures are usually the central hubs for chip-specific initialization and operation pointers, so if it's involved in RF initialization, it has to be connected through them. I'll need to see if it's registered as an operation or if the initialization process grabs it from a table somewhere. Understanding this will give me a good handle on how the radio frequency aspects of this driver are being brought up.

{
  "Expression": "rtw8822c_rf_init",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.c=1767=static void rtw8822c_do_gapk(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1779-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1780:static void rtw8822c_rf_init(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1781-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=1805=static void rtw8822c_phy_set_param(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1850-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1851:\trtw8822c_rf_init(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1852-\trtw8822c_pwrtrack_init(rtwdev);\n"
}

gemini-3.7-flash

null

null

							input: 19595
							output: 46
							thoughts: 23
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating `rtw8822c_phy_set_param` Usage**

Alright, time to dive in. My immediate thought is, "Okay, `rtw8822c_phy_set_param`... where's this function actually *used*?" I need to understand its context. Knowing the call sites is absolutely crucial to grasping its purpose and the larger implications within the driver. I need to quickly identify the upstream and downstream dependencies. I'm thinking I'll start with a straightforward cross-reference search to pinpoint every instance this function is invoked. From there, I can begin to assess what parameters are being passed and how the returned value (if any) is handled. Context is everything; I need the calling context to understand the *why* behind its use. Let's see what the initial search reveals.

{
  "Expression": "rtw8822c_phy_set_param",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.c=1789=static void rtw8822c_pwrtrack_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1804-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1805:static void rtw8822c_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1806-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=4901=static const struct rtw_chip_ops rtw8822c_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4903-\t.power_off\t\t= rtw_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:4904:\t.phy_set_param\t\t= rtw8822c_phy_set_param,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4905-\t.read_efuse\t\t= rtw8822c_read_efuse,\n"
}

gemini-3.7-flash

null

null

							input: 20248
							output: 44
							thoughts: 49
						

Here's my summary, as though I'm thinking through this process:

**Diving into the rtw8822c Architecture**

Okay, so I'm looking at `rtw8822c_hw_spec` here, and it's clear it's got a relationship with `rtw8822c_ops`. That's a good starting point. I need to understand this module's place in the broader driver architecture, so my next move is obvious: I have to find all instances where `rtw8822c_hw_spec` is either exported or, more importantly, *used*. I want to trace the dependencies and figure out how this `hw_spec` structure is actually leveraged. Where does it fit? What functions and modules rely on it to function? Gotta find the imports.

{
  "Expression": "rtw8822c_hw_spec",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.c=5253=static const struct rtw_reg_domain coex_info_hw_regs_8822c[] = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-5277-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:5278:const struct rtw_chip_info rtw8822c_hw_spec = {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-5279-\t.ops = \u0026rtw8822c_ops,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-5382-};\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:5383:EXPORT_SYMBOL(rtw8822c_hw_spec);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-5384-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h=127=void rtw8822c_parse_tbl_dpk(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-129-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:130:extern const struct rtw_chip_info rtw8822c_hw_spec;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-131-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822ce.c=10=static const struct pci_device_id rtw_8822ce_id_table[] = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822ce.c-12-\t\tPCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0xC822),\ndrivers/net/wireless/realtek/rtw88/rtw8822ce.c:13:\t\t.driver_data = (kernel_ulong_t)\u0026rtw8822c_hw_spec\ndrivers/net/wireless/realtek/rtw88/rtw8822ce.c-14-\t},\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822ce.c-16-\t\tPCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0xC82F),\ndrivers/net/wireless/realtek/rtw88/rtw8822ce.c:17:\t\t.driver_data = (kernel_ulong_t)\u0026rtw8822c_hw_spec\ndrivers/net/wireless/realtek/rtw88/rtw8822ce.c-18-\t},\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c=12=static const struct sdio_device_id rtw_8822cs_id_table[] =  {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c-15-\t\t\t    SDIO_DEVICE_ID_REALTEK_RTW8822CS),\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c:16:\t\t.driver_data = (kernel_ulong_t)\u0026rtw8822c_hw_spec,\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c-17-\t},\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c=11=static const struct usb_device_id rtw_8822cu_id_table[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-12-\t{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc82c, 0xff, 0xff, 0xff),\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c:13:\t  .driver_info = (kernel_ulong_t)\u0026(rtw8822c_hw_spec) },\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-14-\t{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc812, 0xff, 0xff, 0xff),\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c:15:\t  .driver_info = (kernel_ulong_t)\u0026(rtw8822c_hw_spec) },\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-16-\t{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc82e, 0xff, 0xff, 0xff),\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c:17:\t  .driver_info = (kernel_ulong_t)\u0026(rtw8822c_hw_spec) },\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-18-\t{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xd820, 0xff, 0xff, 0xff),\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c:19:\t  .driver_info = (kernel_ulong_t)\u0026(rtw8822c_hw_spec) },\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-20-\t{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xd82b, 0xff, 0xff, 0xff),\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c:21:\t  .driver_info = (kernel_ulong_t)\u0026(rtw8822c_hw_spec) },\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-22-\t{ USB_DEVICE_AND_INTERFACE_INFO(0x13b1, 0x0043, 0xff, 0xff, 0xff),\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c:23:\t  .driver_info = (kernel_ulong_t)\u0026(rtw8822c_hw_spec) }, /* Alpha - Alpha */\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-24-\t{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3329, 0xff, 0xff, 0xff),\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c:25:\t  .driver_info = (kernel_ulong_t)\u0026(rtw8822c_hw_spec) }, /* D-Link AC13U rev. A1 */\ndrivers/net/wireless/realtek/rtw88/rtw8822cu.c-26-\t{},\n"
}

gemini-3.7-flash

null

null

							input: 22492
							output: 38
							thoughts: 75
						

Here's my take on the situation:

**Investigating the `rtw88_8822cu` USB Driver**

Okay, so I'm looking at this `rtw88_8822cu` driver. Right, it's pretty clear: it's a USB driver for those RTL8822CU wireless dongles. My immediate thought is, when this USB device gets probed and initialized, does it interact with `phy_set_param`? That's the key question here. I'm seeing if it calls that function during those stages. To find the answer, I need to trace the execution path. Let's dig into the core `rtw88` code and figure out where `phy_set_param` is actually being called. Understanding this relationship is crucial for debugging or optimizing the wireless configuration.

{
  "Expression": "phy_set_param",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/main.c=1374=int rtw_power_on(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1412-\ndrivers/net/wireless/realtek/rtw88/main.c:1413:\tchip-\u003eops-\u003ephy_set_param(rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.c-1414-\n--\ndrivers/net/wireless/realtek/rtw88/main.h=862=struct rtw_chip_ops {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-869-\tint (*read_efuse)(struct rtw_dev *rtwdev, u8 *map);\ndrivers/net/wireless/realtek/rtw88/main.h:870:\tvoid (*phy_set_param)(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.h-871-\tvoid (*set_channel)(struct rtw_dev *rtwdev, u8 channel,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c=553=static void rtw8703b_pwrtrack_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-577-\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:578:static void rtw8703b_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-579-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c=1836=static const struct rtw_chip_ops rtw8703b_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1843-\t.read_efuse\t\t= rtw8703b_read_efuse,\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:1844:\t.phy_set_param\t\t= rtw8703b_phy_set_param,\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1845-\t.set_channel\t\t= rtw8703b_set_channel,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c=67=static void rtw8723d_pwrtrack_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c-84-\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c:85:static void rtw8723d_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c-86-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c=1392=static const struct rtw_chip_ops rtw8723d_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c-1394-\t.power_off\t\t= rtw_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c:1395:\t.phy_set_param\t\t= rtw8723d_phy_set_param,\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c-1396-\t.read_efuse\t\t= rtw8723x_read_efuse,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c=914=static const struct rtw_chip_ops rtw8812a_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c-916-\t.power_off\t\t= rtw8812a_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c:917:\t.phy_set_param\t\t= NULL,\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c-918-\t.read_efuse\t\t= rtw88xxa_read_efuse,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=265=static void rtw8814a_config_cck_rx_antenna_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-282-\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:283:static void rtw8814a_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-284-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=2050=static const struct rtw_chip_ops rtw8814a_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-2052-\t.power_off\t\t= rtw_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:2053:\t.phy_set_param\t\t= rtw8814a_phy_set_param,\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-2054-\t.read_efuse\t\t= rtw8814a_read_efuse,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c=860=static const struct rtw_chip_ops rtw8821a_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c-862-\t.power_off\t\t= rtw8821a_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c:863:\t.phy_set_param\t\t= NULL,\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c-864-\t.read_efuse\t\t= rtw88xxa_read_efuse,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c=151=static void rtw8821c_phy_bf_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-157-\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c:158:static void rtw8821c_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-159-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c=1658=static const struct rtw_chip_ops rtw8821c_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-1660-\t.power_off\t\t= rtw_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c:1661:\t.phy_set_param\t\t= rtw8821c_phy_set_param,\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-1662-\t.read_efuse\t\t= rtw8821c_read_efuse,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c=145=static void rtw8822b_phy_bf_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-151-\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:152:static void rtw8822b_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-153-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c=2150=static const struct rtw_chip_ops rtw8822b_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-2152-\t.power_off\t\t= rtw_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:2153:\t.phy_set_param\t\t= rtw8822b_phy_set_param,\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-2154-\t.read_efuse\t\t= rtw8822b_read_efuse,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=1789=static void rtw8822c_pwrtrack_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1804-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1805:static void rtw8822c_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1806-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=4901=static const struct rtw_chip_ops rtw8822c_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4903-\t.power_off\t\t= rtw_power_off,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:4904:\t.phy_set_param\t\t= rtw8822c_phy_set_param,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4905-\t.read_efuse\t\t= rtw8822c_read_efuse,\n"
}

gemini-3.7-flash

null

null

							input: 25732
							output: 39
							thoughts: 14
						

Okay, here's my interpretation of those thoughts, crafted with the understanding that I'm speaking to a fellow expert:

**Tracing the Origins of `rtw_power_on`**

Alright, so the task at hand is to understand the control flow surrounding `rtw_power_on`. My first instinct is to simply track down all the calls to that function. I need to see where, when, and under what conditions it's invoked. This is often the starting point for really digging into power management routines within a driver. Knowing the context of its calls will provide the key to understanding its overall role. I'm thinking I'll start by grepping the source for that function name, looking for anything that touches it directly. I'll need to keep an eye out for indirect calls or function pointers too, just to be sure I'm not missing anything. I'll probably start with the most relevant modules and drivers first.

{
  "Expression": "rtw_power_on",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/main.c=1354=static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1373-\ndrivers/net/wireless/realtek/rtw88/main.c:1374:int rtw_power_on(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/main.c-1375-{\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1442-}\ndrivers/net/wireless/realtek/rtw88/main.c:1443:EXPORT_SYMBOL(rtw_power_on);\ndrivers/net/wireless/realtek/rtw88/main.c-1444-\n--\ndrivers/net/wireless/realtek/rtw88/main.h=2271=int rtw_wait_firmware_completion(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.h:2272:int rtw_power_on(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.h-2273-void rtw_core_fw_scan_notify(struct rtw_dev *rtwdev, bool start);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c=1836=static const struct rtw_chip_ops rtw8703b_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:1837:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1838-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c=1392=static const struct rtw_chip_ops rtw8723d_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c:1393:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c-1394-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=2050=static const struct rtw_chip_ops rtw8814a_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:2051:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-2052-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c=1658=static const struct rtw_chip_ops rtw8821c_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c:1659:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-1660-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c=2150=static const struct rtw_chip_ops rtw8822b_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:2151:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-2152-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=4901=static const struct rtw_chip_ops rtw8822c_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:4902:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4903-\t.power_off\t\t= rtw_power_off,\n"
}

gemini-3.7-flash

null

null

							input: 27206
							output: 36
							thoughts: 20
						

Here's a summary of my thought process, as requested:

**Deconstructing the `power_on` Call**

Okay, so I'm digging into this `chip->ops->power_on(rtwdev)` call. My initial thought is to dissect exactly what's happening here. I'm immediately interested in the context of `chip->ops`. I'm going to assume `chip` is some sort of device structure, and `ops` likely refers to a function pointer table – a common pattern in embedded systems and driver development. This tells me that the specific "power on" function being called is going to be device-specific, dynamically chosen at runtime. I need to figure out what `chip` is, what its `ops` structure contains, and what the `rtwdev` argument represents. I'm going to follow the definition and cross reference where this `chip` structure is initialized. I'll search for where `power_on` is defined. This is likely where the real magic happens. This is likely where the hardware is initialized and enabled. I'll be looking for register writes, clock enable sequences, pin configurations, and any other low-level actions that would be required to bring the hardware to a working state.

{
  "Expression": "power_on",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/coex.c=2708=static void __rtw_coex_init_hw_config(struct rtw_dev *rtwdev, bool wifi_only)\n--\ndrivers/net/wireless/realtek/rtw88/coex.c-2762-\ndrivers/net/wireless/realtek/rtw88/coex.c:2763:void rtw_coex_power_on_setting(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/coex.c-2764-{\n--\ndrivers/net/wireless/realtek/rtw88/coex.c-2787-}\ndrivers/net/wireless/realtek/rtw88/coex.c:2788:EXPORT_SYMBOL(rtw_coex_power_on_setting);\ndrivers/net/wireless/realtek/rtw88/coex.c-2789-\n--\ndrivers/net/wireless/realtek/rtw88/coex.h=396=void rtw_coex_wl_ccklock_work(struct work_struct *work);\ndrivers/net/wireless/realtek/rtw88/coex.h-397-\ndrivers/net/wireless/realtek/rtw88/coex.h:398:void rtw_coex_power_on_setting(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/coex.h-399-void rtw_coex_power_off_setting(struct rtw_dev *rtwdev);\n--\ndrivers/net/wireless/realtek/rtw88/mac.c=370=static int rtw_mac_init_system_cfg(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-377-\ndrivers/net/wireless/realtek/rtw88/mac.c:378:int rtw_mac_power_on(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/mac.c-379-{\n--\ndrivers/net/wireless/realtek/rtw88/mac.h=33=int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/mac.h-34-\t\t       const struct rtw_pwr_seq_cmd * const *cmd_seq);\ndrivers/net/wireless/realtek/rtw88/mac.h:35:int rtw_mac_power_on(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/mac.h-36-void rtw_mac_power_off(struct rtw_dev *rtwdev);\n--\ndrivers/net/wireless/realtek/rtw88/main.c=1354=static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1373-\ndrivers/net/wireless/realtek/rtw88/main.c:1374:int rtw_power_on(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/main.c-1375-{\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1387-\t/* power on MAC before firmware downloaded */\ndrivers/net/wireless/realtek/rtw88/main.c:1388:\tret = rtw_mac_power_on(rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.c-1389-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1431-\twifi_only = !rtwdev-\u003eefuse.btcoex;\ndrivers/net/wireless/realtek/rtw88/main.c:1432:\trtw_coex_power_on_setting(rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.c-1433-\trtw_coex_init_hw_config(rtwdev, wifi_only);\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1442-}\ndrivers/net/wireless/realtek/rtw88/main.c:1443:EXPORT_SYMBOL(rtw_power_on);\ndrivers/net/wireless/realtek/rtw88/main.c-1444-\n--\ndrivers/net/wireless/realtek/rtw88/main.c=1515=int rtw_core_start(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1518-\ndrivers/net/wireless/realtek/rtw88/main.c:1519:\tret = rtwdev-\u003echip-\u003eops-\u003epower_on(rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.c-1520-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw88/main.c=1919=static int rtw_chip_efuse_enable(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1929-\ndrivers/net/wireless/realtek/rtw88/main.c:1930:\tret = rtw_mac_power_on(rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.c-1931-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/main.h=862=struct rtw_chip_ops {\ndrivers/net/wireless/realtek/rtw88/main.h:863:\tint (*power_on)(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.h-864-\tvoid (*power_off)(struct rtw_dev *rtwdev);\n--\ndrivers/net/wireless/realtek/rtw88/main.h=2271=int rtw_wait_firmware_completion(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.h:2272:int rtw_power_on(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.h-2273-void rtw_core_fw_scan_notify(struct rtw_dev *rtwdev, bool start);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c=1836=static const struct rtw_chip_ops rtw8703b_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:1837:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1838-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c=1392=static const struct rtw_chip_ops rtw8723d_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c:1393:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8723d.c-1394-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c=914=static const struct rtw_chip_ops rtw8812a_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c:915:\t.power_on\t\t= rtw88xxa_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c-916-\t.power_off\t\t= rtw8812a_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=739=static void rtw8814a_adc_clk(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-807-\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:808:\t/* power_on/clk_off */\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-809-\t/* [19] = 0 to turn on ADC */\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-814-\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:815:\t/* power_on/clk_on @ anapar_state=BT mode */\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-816-\trtw_write32(rtwdev, REG_AFE_PWR1_A, 0x05808032);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=2050=static const struct rtw_chip_ops rtw8814a_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:2051:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-2052-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=23576=const struct rtw_pwr_track_tbl rtw8814a_rtw_pwrtrk_type8_tbl = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-23618-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:23619:static const struct rtw_pwr_seq_cmd init_power_on_8814a[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-23620-\t{0x10c2,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=23919=const struct rtw_pwr_seq_cmd * const card_enable_flow_8814a[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:23920:\tinit_power_on_8814a,\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-23921-\ttrans_carddis_to_cardemu_8814a,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c=860=static const struct rtw_chip_ops rtw8821a_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c:861:\t.power_on\t\t= rtw88xxa_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c-862-\t.power_off\t\t= rtw8821a_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c=1658=static const struct rtw_chip_ops rtw8821c_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c:1659:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-1660-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h=32=struct rtw8821ce_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h-62-\tu8 port_common_mode_restore_time;\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h:63:\tu8 port_t_power_on_scale:2;\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h-64-\tu8 res6:1;\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h:65:\tu8 port_t_power_on_value:5;\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h-66-\tu8 res7;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c=2150=static const struct rtw_chip_ops rtw8822b_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:2151:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-2152-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h=32=struct rtw8822be_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-62-\tu8 port_common_mode_restore_time;\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h:63:\tu8 port_t_power_on_scale:2;\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-64-\tu8 res6:1;\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h:65:\tu8 port_t_power_on_value:5;\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-66-\tu8 res7;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=4901=static const struct rtw_chip_ops rtw8822c_ops = {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:4902:\t.power_on\t\t= rtw_power_on,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4903-\t.power_off\t\t= rtw_power_off,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h=24=struct rtw8822ce_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-54-\tu8 port_common_mode_restore_time;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:55:\tu8 port_t_power_on_scale:2;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-56-\tu8 res6:1;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:57:\tu8 port_t_power_on_value:5;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-58-\tu8 res7;\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c=304=static void rtw88xxau_hw_reset(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-343-\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:344:static int rtw88xxau_init_power_on(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-345-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c=927=static void rtw88xxa_switch_band(struct rtw_dev *rtwdev, u8 new_band, u8 bw)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1005-\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:1006:int rtw88xxa_power_on(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1007-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1048-\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:1049:\tret = rtw88xxau_init_power_on(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1050-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1228-\tif (efuse-\u003ebtcoex) {\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:1229:\t\trtw_coex_power_on_setting(rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1230-\t\trtw_coex_init_hw_config(rtwdev, false);\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1242-}\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:1243:EXPORT_SYMBOL(rtw88xxa_power_on);\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-1244-\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h=144=void rtw88xxa_power_off(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h-145-\t\t\tconst struct rtw_pwr_seq_cmd *const *enter_lps_flow);\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h:146:int rtw88xxa_power_on(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h-147-u32 rtw88xxa_phy_read_rf(struct rtw_dev *rtwdev,\n"
}

gemini-3.7-flash

null

null

							input: 32691
							output: 39
							thoughts: 116
						

**My Initial Thoughts on the Power-Up Sequence**

Okay, so I'm looking at this initialization flow, and here's what's running through my head. We kick things off with `rtw_core_start`. That's the entry point, the first command in this chain. From there, it's pretty standard, the core's telling the chip to power on with `chip->ops->power_on(rtwdev)`. Makes sense, we need to get the hardware ready. That function calls `rtw_power_on(rtwdev)`, of course, which probably manages low-level chip power control.

Next up, it looks like we're configuring the physical layer, as indicated by the call to `chip->ops->phy_set_param(rtwdev)`. We get down to `rtw8822c_phy_set_param`, where the specifics of this particular PHY are set. And from what I see here, we're doing the radio frequency init with `rtw8822c_rf_init` and then running the digital-to-analog converter calibration, or DAC cal, through `rtw8822c_rf_dac_cal`. Standard stuff for bringing a radio up.

So, where is `rtw_core_start` being called from? I need to track down the call stack to see where this all begins, which will tell me what triggers this entire sequence. I need more context to see how this system is responding to the power-on sequence.

{
  "Expression": "rtw_core_start",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/mac80211.c=53=static int rtw_ops_start(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c-58-\tmutex_lock(\u0026rtwdev-\u003emutex);\ndrivers/net/wireless/realtek/rtw88/mac80211.c:59:\tret = rtw_core_start(rtwdev);\ndrivers/net/wireless/realtek/rtw88/mac80211.c-60-\tmutex_unlock(\u0026rtwdev-\u003emutex);\n--\ndrivers/net/wireless/realtek/rtw88/main.c=1490=void rtw_core_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1514-\ndrivers/net/wireless/realtek/rtw88/main.c:1515:int rtw_core_start(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/main.c-1516-{\n--\ndrivers/net/wireless/realtek/rtw88/main.h=2253=void rtw_core_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw88/main.h-2254-\t\t\t    bool hw_scan);\ndrivers/net/wireless/realtek/rtw88/main.h:2255:int rtw_core_start(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/main.h-2256-void rtw_power_off(struct rtw_dev *rtwdev);\n--\ndrivers/net/wireless/realtek/rtw88/ps.c=13=static int rtw_ips_pwr_up(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/ps.c-16-\ndrivers/net/wireless/realtek/rtw88/ps.c:17:\tret = rtw_core_start(rtwdev);\ndrivers/net/wireless/realtek/rtw88/ps.c-18-\tif (ret)\n"
}

gemini-3.7-flash

null

null

							input: 33820
							output: 40
							thoughts: 1232
						

**Fuzzing Feasibility Analysis: RTW88 Driver**

Okay, let's break this down. My initial thought is about the `rtw_ops_start` callback and how it links to bringing an interface up, which is triggered via `ip link set dev ... up` or nl80211.  I know RTW88 supports various interfaces like USB (`RTW88_8822CU`), SDIO, and PCI (`RTW88_8822CE`). The question now: Is this driver accessible in a fuzzing setup like syzkaller?

Right, the fuzzing criteria... Let's review the "WorthFuzzing" guidelines:  We *don't* want to mark it as worth fuzzing if the changes are just documentation, Kconfig, comments, decorative logging, constant/macro changes that don't alter execution, code unreachable in emulated environments (like specific PCIe cards), or teardown callbacks.  If, however, the modifications touch core kernel logic, drivers, or architectures that are reachable, then it is worth fuzzing.

Now, can syzkaller's USB Raw Gadget be used to emulate USB devices, and thus make a USB wireless driver like RTW88 (`RTW88_8822CU`) accessible? Absolutely! I can use it in QEMU/syzkaller.

Now, let's get into the *actual* code changes. Are there modifications to  `FIELD_GET_SIGNED` or sorting or calculation logic? Let's dig in. I need to understand what's been altered in the patch.

Okay, analyzing the functions:

1.  `rtw8822c_rf_minmax_cmp`, `__rtw8822c_dac_iq_sort`, and `rtw8822c_dac_iq_sort` were replaced with a standard `sort()` kernel function, leveraging a signed comparison function. This is significant, using `sort` is a functional change.

2.  `rtw8822c_dac_iq_offset` has undergone a significant refactor:  It's now calculating an average of *signed* values and performing a different mapping operation compared to the original unsigned logic.

3.  `rtw8822c_dac_iq_check`:  They've switched from an unsigned comparison to a signed comparison. Subtle but important in this context.

4.  `rtw8822c_dac_cal_iq_sample` and `rtw8822c_dac_cal_iq_search`: These now utilize `FIELD_GET_SIGNED` for signed value extraction, the kernel's `sort()` function and signed math.

Essentially, this is a non-trivial functional change to the Digital-to-Analog Converter (DAC) calibration algorithm within the RTL8822C driver.

So the Kconfig file confirms `RTW88_8822C`, `RTW88_8822CU` and `RTW88_8822CE`

Given these changes and its accessibility via USB emulation, this driver looks promising for fuzzing.

{
  "Expression": "RTW88",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/realtek/rtw88/Kconfig:2:menuconfig RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-3-\ttristate \"Realtek 802.11ac wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-10-\ndrivers/net/wireless/realtek/rtw88/Kconfig:11:if RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-12-\ndrivers/net/wireless/realtek/rtw88/Kconfig:13:config RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-16-\ndrivers/net/wireless/realtek/rtw88/Kconfig:17:config RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-18-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-19-\ndrivers/net/wireless/realtek/rtw88/Kconfig:20:config RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig-21-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-22-\ndrivers/net/wireless/realtek/rtw88/Kconfig:23:config RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-24-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-25-\ndrivers/net/wireless/realtek/rtw88/Kconfig:26:config RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-27-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-28-\ndrivers/net/wireless/realtek/rtw88/Kconfig:29:config RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-30-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-31-\ndrivers/net/wireless/realtek/rtw88/Kconfig:32:config RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-33-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-34-\ndrivers/net/wireless/realtek/rtw88/Kconfig:35:config RTW88_8703B\ndrivers/net/wireless/realtek/rtw88/Kconfig-36-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:37:\tselect RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-38-\ndrivers/net/wireless/realtek/rtw88/Kconfig:39:config RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-40-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:41:\tselect RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-42-\ndrivers/net/wireless/realtek/rtw88/Kconfig:43:config RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-44-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-45-\ndrivers/net/wireless/realtek/rtw88/Kconfig:46:config RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-47-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-48-\ndrivers/net/wireless/realtek/rtw88/Kconfig:49:config RTW88_8821A\ndrivers/net/wireless/realtek/rtw88/Kconfig-50-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:51:\tselect RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-52-\ndrivers/net/wireless/realtek/rtw88/Kconfig:53:config RTW88_8812A\ndrivers/net/wireless/realtek/rtw88/Kconfig-54-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:55:\tselect RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-56-\ndrivers/net/wireless/realtek/rtw88/Kconfig:57:config RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-58-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-59-\ndrivers/net/wireless/realtek/rtw88/Kconfig:60:config RTW88_8822BE\ndrivers/net/wireless/realtek/rtw88/Kconfig-61-\ttristate \"Realtek 8822BE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-62-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:63:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:64:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:65:\tselect RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-66-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-70-\ndrivers/net/wireless/realtek/rtw88/Kconfig:71:config RTW88_8822BS\ndrivers/net/wireless/realtek/rtw88/Kconfig-72-\ttristate \"Realtek 8822BS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-73-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:74:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:75:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:76:\tselect RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-77-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-81-\ndrivers/net/wireless/realtek/rtw88/Kconfig:82:config RTW88_8822BU\ndrivers/net/wireless/realtek/rtw88/Kconfig-83-\ttristate \"Realtek 8822BU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-84-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:85:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:86:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:87:\tselect RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-88-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-92-\ndrivers/net/wireless/realtek/rtw88/Kconfig:93:config RTW88_8822CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-94-\ttristate \"Realtek 8822CE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-95-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:96:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:97:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:98:\tselect RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-99-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-103-\ndrivers/net/wireless/realtek/rtw88/Kconfig:104:config RTW88_8822CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-105-\ttristate \"Realtek 8822CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-106-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:107:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:108:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:109:\tselect RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-110-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-114-\ndrivers/net/wireless/realtek/rtw88/Kconfig:115:config RTW88_8822CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-116-\ttristate \"Realtek 8822CU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-117-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:118:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:119:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:120:\tselect RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-121-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-125-\ndrivers/net/wireless/realtek/rtw88/Kconfig:126:config RTW88_8723DE\ndrivers/net/wireless/realtek/rtw88/Kconfig-127-\ttristate \"Realtek 8723DE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-128-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:129:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:130:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:131:\tselect RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-132-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-136-\ndrivers/net/wireless/realtek/rtw88/Kconfig:137:config RTW88_8723DS\ndrivers/net/wireless/realtek/rtw88/Kconfig-138-\ttristate \"Realtek 8723DS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-139-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:140:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:141:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:142:\tselect RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-143-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-147-\ndrivers/net/wireless/realtek/rtw88/Kconfig:148:config RTW88_8723CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-149-\ttristate \"Realtek 8723CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-150-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:151:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:152:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:153:\tselect RTW88_8703B\ndrivers/net/wireless/realtek/rtw88/Kconfig-154-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-161-\ndrivers/net/wireless/realtek/rtw88/Kconfig:162:config RTW88_8723DU\ndrivers/net/wireless/realtek/rtw88/Kconfig-163-\ttristate \"Realtek 8723DU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-164-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:165:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:166:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:167:\tselect RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-168-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-172-\ndrivers/net/wireless/realtek/rtw88/Kconfig:173:config RTW88_8821CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-174-\ttristate \"Realtek 8821CE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-175-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:176:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:177:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:178:\tselect RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-179-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-183-\ndrivers/net/wireless/realtek/rtw88/Kconfig:184:config RTW88_8821CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-185-\ttristate \"Realtek 8821CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-186-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:187:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:188:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:189:\tselect RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-190-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-194-\ndrivers/net/wireless/realtek/rtw88/Kconfig:195:config RTW88_8821CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-196-\ttristate \"Realtek 8821CU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-197-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:198:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:199:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:200:\tselect RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-201-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-205-\ndrivers/net/wireless/realtek/rtw88/Kconfig:206:config RTW88_8821AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-207-\ttristate \"Realtek 8821AU/8811AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-208-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:209:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:210:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:211:\tselect RTW88_8821A\ndrivers/net/wireless/realtek/rtw88/Kconfig-212-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-216-\ndrivers/net/wireless/realtek/rtw88/Kconfig:217:config RTW88_8812AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-218-\ttristate \"Realtek 8812AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-219-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:220:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:221:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:222:\tselect RTW88_8812A\ndrivers/net/wireless/realtek/rtw88/Kconfig-223-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-227-\ndrivers/net/wireless/realtek/rtw88/Kconfig:228:config RTW88_8814AE\ndrivers/net/wireless/realtek/rtw88/Kconfig-229-\ttristate \"Realtek 8814AE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-230-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:231:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:232:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:233:\tselect RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-234-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-238-\ndrivers/net/wireless/realtek/rtw88/Kconfig:239:config RTW88_8814AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-240-\ttristate \"Realtek 8814AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-241-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:242:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:243:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:244:\tselect RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-245-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-249-\ndrivers/net/wireless/realtek/rtw88/Kconfig:250:config RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/Kconfig-251-\tbool \"Realtek rtw88 debug support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:252:\tdepends on RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-253-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-257-\ndrivers/net/wireless/realtek/rtw88/Kconfig:258:config RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/Kconfig-259-\tbool \"Realtek rtw88 debugfs support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:260:\tdepends on RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-261-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-265-\ndrivers/net/wireless/realtek/rtw88/Kconfig:266:config RTW88_LEDS\ndrivers/net/wireless/realtek/rtw88/Kconfig-267-\tbool\n"
}

gemini-3.7-flash

null

null

							input: 41593
							output: 46
							thoughts: 211
						

**Analyzing the RTW8822CU Driver Teardown and Entrypoints**

Okay, let's break this down. First, I need to confirm the teardown procedures. I'm focusing on those critical `.remove`, `.shutdown`, and `pci_unregister_driver` callbacks. My mental map tells me these are likely intertwined with the DAC calibration, hardware setup, RF initialization, and power-on sequences. That's the crucial area to investigate for potential vulnerabilities, especially during resource release.

Next, I need to consider the context. Given that we're looking at a USB device (RTW88_8822CU), I have to keep in mind that QEMU/GCE, with the USB Raw Gadget functionality, allows for emulation. So, any code paths that might seem unreachable in a virtualized environment need a second look. They might be relevant in this context.

Now, I'm thinking about how to efficiently analyze the code. I'll focus on identifying "FocusSymbols," which I'm defining as non-static, non-inlined API entrypoint functions over internal static helper functions. This gives me the most direct path into the driver's operation.

Let's see: are there any non-static functions in the call path or exported functions? The likely suspects are `rtw_power_on`, `rtw_core_start`, and `rtw_ops_start`. I need to verify. And, I need to check what exported symbols are in rtw8822c.c.

Okay, time to get specific. I'll need to go directly into `rtw8822c.c` and `rtw8822c.h` now. I need to make sure I know the exact non-static / exported functions to assess the potential entrypoints to the driver's functions.

{
  "Expression": "EXPORT_SYMBOL",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88/rtw8822c.c"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.c=5278=const struct rtw_chip_info rtw8822c_hw_spec = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-5382-};\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:5383:EXPORT_SYMBOL(rtw8822c_hw_spec);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-5384-\n"
}

gemini-3.7-flash

null

null

							input: 42422
							output: 51
							thoughts: 22
						

Okay, let's dive into this `rtw8822c.h` file and see what non-static functions are hiding in there. My initial thought is to get a quick overview of what's *available*, and identify any interesting potential interactions with other parts of the driver or the overall system. I'm looking for functions that aren't declared as `static`, as those are likely to be used and visible outside of this particular compilation unit. This will help me understand the public interface of this module and how it fits into the broader architecture. I want to have a firm grasp of the functions that are intended for *external* usage, which will provide clues regarding the driver's role and potential entry points for operations.

{
  "Expression": "rtw8822c_",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88/rtw8822c.h"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.h=24=struct rtw8822ce_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-60-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:61:struct rtw8822c_efuse {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-62-\t__le16 rtl_id;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-107-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:108:enum rtw8822c_dpk_agc_phase {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-109-\tRTW_DPK_GAIN_CHECK,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-117-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:118:enum rtw8822c_dpk_one_shot_action {\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-119-\tRTW_DPK_CAL_PWR,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-126-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:127:void rtw8822c_parse_tbl_dpk(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-128-\t\t\t    const struct rtw_table *tbl);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-129-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:130:extern const struct rtw_chip_info rtw8822c_hw_spec;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-131-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h=133=const struct rtw_table name ## _tbl = {\t\t\t\\\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-135-\t.size = ARRAY_SIZE(name),\t\t\t\\\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:136:\t.parse = rtw8822c_parse_tbl_dpk,\t\t\\\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-137-}\n"
}

gemini-3.7-flash

null

null

							input: 43442
							output: 41
							thoughts: 266
						

**My Initial Assessment of the RTW8822C Changes**

Okay, so the modifications are centered around the Direct Analog Conversion (DAC) I/Q calibration, specifically within `rtw8822c.c`. My immediate focus is on those static functions: `rtw8822c_dac_iq_cmp_s32`, `rtw8822c_dac_iq_offset`, `rtw8822c_dac_iq_check`, `rtw8822c_dac_cal_iq_sample`, `rtw8822c_dac_cal_iq_search`, and `rtw8822c_dac_cal_rf_mode`. They’re obviously central to the calibration process. Next, I need to see *how* these are used, and the callers listed – `rtw8822c_rf_dac_cal`, `rtw8822c_rf_init`, and `rtw8822c_phy_set_param` – are key. The fact that `rf_dac_cal` is a direct caller implies a potentially significant change in the radio frequency calibration procedure.

Then, I should also look at the external entrypoints. `rtw_power_on`, `rtw_core_start`, `rtw_ops_start`, and the USB probe functions, specifically `rtw_usb_probe` and `rtw88_usb` are going to be crucial for understanding the overall integration and initialization flow. I need to understand how the new DAC calibration fits within the broader system context.

My next step is to nail down the configuration options that these changes might necessitate. Are there new tunable parameters, and what are their implications? Finally, I need to refresh my understanding of RTW88's dependencies. What does this module rely on, and are these changes impacting those dependencies? This will give me a proper handle on the ripple effect of these modifications.

{
  "Expression": "config RTW88",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/realtek/rtw88/Kconfig:2:menuconfig RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-3-\ttristate \"Realtek 802.11ac wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=11=if RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-12-\ndrivers/net/wireless/realtek/rtw88/Kconfig:13:config RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-16-\ndrivers/net/wireless/realtek/rtw88/Kconfig:17:config RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-18-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-19-\ndrivers/net/wireless/realtek/rtw88/Kconfig:20:config RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig-21-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-22-\ndrivers/net/wireless/realtek/rtw88/Kconfig:23:config RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-24-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-25-\ndrivers/net/wireless/realtek/rtw88/Kconfig:26:config RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-27-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-28-\ndrivers/net/wireless/realtek/rtw88/Kconfig:29:config RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-30-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-31-\ndrivers/net/wireless/realtek/rtw88/Kconfig:32:config RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-33-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-34-\ndrivers/net/wireless/realtek/rtw88/Kconfig:35:config RTW88_8703B\ndrivers/net/wireless/realtek/rtw88/Kconfig-36-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-38-\ndrivers/net/wireless/realtek/rtw88/Kconfig:39:config RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-40-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-42-\ndrivers/net/wireless/realtek/rtw88/Kconfig:43:config RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-44-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-45-\ndrivers/net/wireless/realtek/rtw88/Kconfig:46:config RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-47-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-48-\ndrivers/net/wireless/realtek/rtw88/Kconfig:49:config RTW88_8821A\ndrivers/net/wireless/realtek/rtw88/Kconfig-50-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-52-\ndrivers/net/wireless/realtek/rtw88/Kconfig:53:config RTW88_8812A\ndrivers/net/wireless/realtek/rtw88/Kconfig-54-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-56-\ndrivers/net/wireless/realtek/rtw88/Kconfig:57:config RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-58-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-59-\ndrivers/net/wireless/realtek/rtw88/Kconfig:60:config RTW88_8822BE\ndrivers/net/wireless/realtek/rtw88/Kconfig-61-\ttristate \"Realtek 8822BE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-70-\ndrivers/net/wireless/realtek/rtw88/Kconfig:71:config RTW88_8822BS\ndrivers/net/wireless/realtek/rtw88/Kconfig-72-\ttristate \"Realtek 8822BS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-81-\ndrivers/net/wireless/realtek/rtw88/Kconfig:82:config RTW88_8822BU\ndrivers/net/wireless/realtek/rtw88/Kconfig-83-\ttristate \"Realtek 8822BU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-92-\ndrivers/net/wireless/realtek/rtw88/Kconfig:93:config RTW88_8822CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-94-\ttristate \"Realtek 8822CE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-103-\ndrivers/net/wireless/realtek/rtw88/Kconfig:104:config RTW88_8822CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-105-\ttristate \"Realtek 8822CS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-114-\ndrivers/net/wireless/realtek/rtw88/Kconfig:115:config RTW88_8822CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-116-\ttristate \"Realtek 8822CU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-125-\ndrivers/net/wireless/realtek/rtw88/Kconfig:126:config RTW88_8723DE\ndrivers/net/wireless/realtek/rtw88/Kconfig-127-\ttristate \"Realtek 8723DE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-136-\ndrivers/net/wireless/realtek/rtw88/Kconfig:137:config RTW88_8723DS\ndrivers/net/wireless/realtek/rtw88/Kconfig-138-\ttristate \"Realtek 8723DS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-147-\ndrivers/net/wireless/realtek/rtw88/Kconfig:148:config RTW88_8723CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-149-\ttristate \"Realtek 8723CS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-161-\ndrivers/net/wireless/realtek/rtw88/Kconfig:162:config RTW88_8723DU\ndrivers/net/wireless/realtek/rtw88/Kconfig-163-\ttristate \"Realtek 8723DU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-172-\ndrivers/net/wireless/realtek/rtw88/Kconfig:173:config RTW88_8821CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-174-\ttristate \"Realtek 8821CE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-183-\ndrivers/net/wireless/realtek/rtw88/Kconfig:184:config RTW88_8821CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-185-\ttristate \"Realtek 8821CS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-194-\ndrivers/net/wireless/realtek/rtw88/Kconfig:195:config RTW88_8821CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-196-\ttristate \"Realtek 8821CU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-205-\ndrivers/net/wireless/realtek/rtw88/Kconfig:206:config RTW88_8821AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-207-\ttristate \"Realtek 8821AU/8811AU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-216-\ndrivers/net/wireless/realtek/rtw88/Kconfig:217:config RTW88_8812AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-218-\ttristate \"Realtek 8812AU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-227-\ndrivers/net/wireless/realtek/rtw88/Kconfig:228:config RTW88_8814AE\ndrivers/net/wireless/realtek/rtw88/Kconfig-229-\ttristate \"Realtek 8814AE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-238-\ndrivers/net/wireless/realtek/rtw88/Kconfig:239:config RTW88_8814AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-240-\ttristate \"Realtek 8814AU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-249-\ndrivers/net/wireless/realtek/rtw88/Kconfig:250:config RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/Kconfig-251-\tbool \"Realtek rtw88 debug support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-257-\ndrivers/net/wireless/realtek/rtw88/Kconfig:258:config RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/Kconfig-259-\tbool \"Realtek rtw88 debugfs support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-265-\ndrivers/net/wireless/realtek/rtw88/Kconfig:266:config RTW88_LEDS\ndrivers/net/wireless/realtek/rtw88/Kconfig-267-\tbool\n"
}

gemini-3.7-flash

null

null

							input: 47301
							output: 42
							thoughts: 42
						

Okay, let's dive into this. I need to get a handle on the dependencies of `menuconfig RTW88` within the Realtek wireless driver configuration. My first step is to check `drivers/net/wireless/realtek/rtw88/Kconfig` and focus on the initial lines, specifically lines 1 through 15. That should give me the core dependencies I'm looking for. This is a standard and efficient way to begin understanding the build configuration, and it'll give me a solid foundation for further analysis.

{
  "File": "drivers/net/wireless/realtek/rtw88/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tmenuconfig RTW88\n   3:\t\ttristate \"Realtek 802.11ac wireless chips support\"\n   4:\t\tdepends on MAC80211\n   5:\t\thelp\n   6:\t\t  This module adds support for mac80211-based wireless drivers that\n   7:\t\t  enables Realtek IEEE 802.11ac wireless chipsets.\n   8:\t\n   9:\t\t  If you choose to build a module, it'll be called rtw88.\n  10:\t\n  11:\tif RTW88\n  12:\t\n  13:\tconfig RTW88_CORE\n  14:\t\ttristate\n  15:\t\tselect WANT_DEV_COREDUMP\n  16:\t\n  17:\tconfig RTW88_PCI\n  18:\t\ttristate\n  19:\t\n  20:\tconfig RTW88_SDIO\n"
}

gemini-3.7-flash

null

null

							input: 47767
							output: 53
							thoughts: 507
						

**My Analysis of the RTW88 Driver for Fuzzing**

Okay, let's break this down. First, I need to make sure the core dependencies are in place. The Realtek RTW88 driver, `RTW88`, hinges on `MAC80211`, so that's the baseline. For the 8822C variant specifically, I see that `RTW88_8822C` is the relevant config. Looking at the dependencies, it can be enabled via PCI (`RTW88_8822CE`), MMC (`RTW88_8822CS`), or USB (`RTW88_8822CU`).

Therefore, to enable the 8822C functionality, I'll need to set these configs: `MAC80211`, `RTW88`, `RTW88_CORE`, `RTW88_8822C`, and also one of the interface-specific options: `RTW88_8822CU`, `RTW88_8822CE`, or `RTW88_8822CS`

Now, let's identify the key functions to focus on for fuzzing. The modified file is `drivers/net/wireless/realtek/rtw88/rtw8822c.c`, which makes `rtw8822c.c` a prime target for fuzzing. I see `rtw8822c_hw_spec` as a struct symbol and `rtw8822c_parse_tbl_dpk` as functions within that file. Also, in the call stack for DAC calibration I see `rtw_core_start` and `rtw_power_on`.

I need to focus on API entrypoint functions, not internal helper functions. Looking at the `FocusSymbols` guidance, it's clear I need to prioritize non-static, non-inlined functions. I confirmed that `rtw_power_on` and `rtw_core_start` are *exported* symbols located in `drivers/net/wireless/realtek/rtw88/main.c`, and so those look like candidates. Now, I should also perform a thorough review of all the non-static functions within `rtw8822c.c` to make sure I haven't missed anything obvious.

{
  "Expression": "^[a-zA-Z_].*\\(",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88/rtw8822c.c"
}

{
  "Output": "\nFull output is too long, showing 500 out of 704 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-23-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:24:static void rtw8822c_config_trx_mode(struct rtw_dev *rtwdev, u8 tx_path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-25-\t\t\t\t     u8 rx_path, bool is_tx2_path);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-26-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:27:static void rtw8822ce_efuse_parsing(struct rtw_efuse *efuse,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-28-\t\t\t\t    struct rtw8822c_efuse *map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-32-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:33:static void rtw8822cu_efuse_parsing(struct rtw_efuse *efuse,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-34-\t\t\t\t    struct rtw8822c_efuse *map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-38-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:39:static void rtw8822cs_efuse_parsing(struct rtw_efuse *efuse,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-40-\t\t\t\t    struct rtw8822c_efuse *map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-44-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:45:static int rtw8822c_read_efuse(struct rtw_dev *rtwdev, u8 *log_map)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-46-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-88-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:89:static void rtw8822c_header_file_init(struct rtw_dev *rtwdev, bool pre)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-90-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-101-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:102:static void rtw8822c_bb_reset(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-103-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-108-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:109:static void rtw8822c_dac_backup_reg(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-110-\t\t\t\t    struct rtw_backup_info *backup,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-137-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:138:static void rtw8822c_dac_restore_reg(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-139-\t\t\t\t     struct rtw_backup_info *backup,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-156-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:157:static int rtw8822c_dac_iq_cmp_s32(const void *a, const void *b)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-158-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-165-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:166:static u32 rtw8822c_dac_iq_offset(struct rtw_dev *rtwdev, s32 *vec)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-167-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-182-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:183:static u32 rtw8822c_get_path_write_addr(u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-184-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-201-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:202:static u32 rtw8822c_get_path_read_addr(u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-203-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-220-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:221:static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, s32 value)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-222-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-231-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:232:static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, s32 *iv, s32 *qv)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-233-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-248-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:249:static void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-250-\t\t\t\t       s32 *iv, s32 *qv,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-303-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:304:static void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-305-\t\t\t\t     u32 *i_value, u32 *q_value)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-319-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:320:static void rtw8822c_dac_bb_setting(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-321-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-335-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:336:static void rtw8822c_dac_cal_adc(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-337-\t\t\t\t u8 path, u32 *adc_ic, u32 *adc_qc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-413-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:414:static void rtw8822c_dac_cal_step1(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-415-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-458-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:459:static void rtw8822c_dac_cal_step2(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-460-\t\t\t\t   u8 path, u32 *ic_out, u32 *qc_out)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-507-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:508:static void rtw8822c_dac_cal_step3(struct rtw_dev *rtwdev, u8 path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-509-\t\t\t\t   u32 adc_ic, u32 adc_qc,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-584-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:585:static void rtw8822c_dac_cal_step4(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-586-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-594-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:595:static void rtw8822c_dac_cal_backup_vec(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-596-\t\t\t\t\tu8 path, u8 vec, u32 w_addr, u32 r_addr)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-611-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:612:static void rtw8822c_dac_cal_backup_path(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-613-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-631-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:632:static void rtw8822c_dac_cal_backup_dck(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-633-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-655-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:656:static void rtw8822c_dac_cal_backup(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-657-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-685-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:686:static void rtw8822c_dac_cal_restore_dck(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-687-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-715-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:716:static void rtw8822c_dac_cal_restore_prepare(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-717-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-768-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:769:static bool rtw8822c_dac_cal_restore_wait(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-770-\t\t\t\t\t  u32 target_addr, u32 toggle_addr)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-785-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:786:static bool rtw8822c_dac_cal_restore_path(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-787-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-832-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:833:static bool __rtw8822c_dac_cal_restore(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-834-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-843-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:844:static bool rtw8822c_dac_cal_restore(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-845-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-884-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:885:static void rtw8822c_rf_dac_cal(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-886-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-951-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:952:static void rtw8822c_rf_x2_check(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-953-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-965-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:966:static void rtw8822c_set_power_trim(struct rtw_dev *rtwdev, s8 bb_gain[2][8])\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-967-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-997-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:998:static void rtw8822c_power_trim(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-999-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1034-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1035:static void rtw8822c_thermal_trim(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1036-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1052-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1053:static void rtw8822c_pa_bias(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1054-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1074-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1075:static void rtw8822c_rfk_handshake(struct rtw_dev *rtwdev, bool is_before_k)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1076-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1120-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1121:static void rtw8822c_rfk_power_save(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1122-\t\t\t\t    bool is_power_save)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1132-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1133:static void rtw8822c_txgapk_backup_bb_reg(struct rtw_dev *rtwdev, const u32 reg[],\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1134-\t\t\t\t\t  u32 reg_backup[], u32 reg_num)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1145-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1146:static void rtw8822c_txgapk_reload_bb_reg(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1147-\t\t\t\t\t  const u32 reg[], u32 reg_backup[],\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1158-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1159:static bool check_rf_status(struct rtw_dev *rtwdev, u8 status)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1160-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1173-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1174:static void rtw8822c_txgapk_tx_pause(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1175-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1189-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1190:static void rtw8822c_txgapk_bb_dpk(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1191-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1221-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1222:static void rtw8822c_txgapk_afe_dpk(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1223-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1257-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1258:static void rtw8822c_txgapk_afe_dpk_restore(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1259-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1290-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1291:static void rtw8822c_txgapk_bb_dpk_restore(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1292-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1330-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1331:static bool _rtw8822c_txgapk_gain_valid(struct rtw_dev *rtwdev, u32 gain)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1332-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1339-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1340:static void _rtw8822c_txgapk_write_gain_bb_table(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1341-\t\t\t\t\t\t u8 band, u8 path)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1393-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1394:static void rtw8822c_txgapk_write_gain_bb_table(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1395-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1408-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1409:static void rtw8822c_txgapk_read_offset(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1410-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1485-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1486:static void rtw8822c_txgapk_calculate_offset(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1487-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1559-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1560:static void rtw8822c_txgapk_rf_restore(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1561-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1571-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1572:static u32 rtw8822c_txgapk_cal_gain(struct rtw_dev *rtwdev, u32 gain, s8 offset)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1573-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1595-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1596:static void rtw8822c_txgapk_write_tx_gain(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1597-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1665-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1666:static void rtw8822c_txgapk_save_all_tx_gain_table(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1667-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1724-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1725:static void rtw8822c_txgapk(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1726-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1766-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1767:static void rtw8822c_do_gapk(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1768-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1779-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1780:static void rtw8822c_rf_init(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1781-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1788-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1789:static void rtw8822c_pwrtrack_init(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1790-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1804-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1805:static void rtw8822c_phy_set_param(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1806-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1945-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:1946:static int rtw8822c_mac_init(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-1947-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=2089=static const struct rtw_fwcd_segs rtw8822c_fwcd_segs = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2093-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2094:static int rtw8822c_dump_fw_crash(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2095-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2121-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2122:static void rtw8822c_rstb_3wire(struct rtw_dev *rtwdev, bool enable)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2123-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2132-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2133:static void rtw8822c_set_channel_rf(struct rtw_dev *rtwdev, u8 channel, u8 bw)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2134-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2198-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2199:static void rtw8822c_toggle_igi(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2200-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2209-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2210:static void rtw8822c_set_channel_bb(struct rtw_dev *rtwdev, u8 channel, u8 bw,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2211-\t\t\t\t    u8 primary_ch_idx)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2367-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2368:static void rtw8822c_set_channel(struct rtw_dev *rtwdev, u8 channel, u8 bw,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2369-\t\t\t\t u8 primary_chan_idx)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2376-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2377:static void rtw8822c_config_cck_rx_path(struct rtw_dev *rtwdev, u8 rx_path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2378-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2394-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2395:static void rtw8822c_config_ofdm_rx_path(struct rtw_dev *rtwdev, u8 rx_path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2396-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2414-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2415:static void rtw8822c_config_rx_path(struct rtw_dev *rtwdev, u8 rx_path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2416-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2420-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2421:static void rtw8822c_config_cck_tx_path(struct rtw_dev *rtwdev, u8 tx_path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2422-\t\t\t\t\tbool is_tx2_path)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2436-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2437:static void rtw8822c_config_ofdm_tx_path(struct rtw_dev *rtwdev, u8 tx_path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2438-\t\t\t\t\t enum rtw_bb_path tx_path_sel_1ss)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2460-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2461:static void rtw8822c_config_tx_path(struct rtw_dev *rtwdev, u8 tx_path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2462-\t\t\t\t    enum rtw_bb_path tx_path_sel_1ss,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2470-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2471:static void rtw8822c_config_trx_mode(struct rtw_dev *rtwdev, u8 tx_path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2472-\t\t\t\t     u8 rx_path, bool is_tx2_path)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2489-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2490:static void query_phy_status_page0(struct rtw_dev *rtwdev, u8 *phy_status,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2491-\t\t\t\t   struct rtw_rx_pkt_stat *pkt_stat)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2539-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2540:static void query_phy_status_page1(struct rtw_dev *rtwdev, u8 *phy_status,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2541-\t\t\t\t   struct rtw_rx_pkt_stat *pkt_stat)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2614-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2615:static void query_phy_status(struct rtw_dev *rtwdev, u8 *phy_status,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2616-\t\t\t     struct rtw_rx_pkt_stat *pkt_stat)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=2635=static void\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2636:rtw8822c_set_write_tx_power_ref(struct rtw_dev *rtwdev, u8 *tx_pwr_ref_cck,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2637-\t\t\t\tu8 *tx_pwr_ref_ofdm)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2655-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2656:static void rtw8822c_set_tx_power_diff(struct rtw_dev *rtwdev, u8 rate,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2657-\t\t\t\t       s8 *diff_idx)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2677-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2678:static void rtw8822c_set_tx_power_index(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2679-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2710-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2711:static int rtw8822c_set_antenna(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2712-\t\t\t\tint radio_idx,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2745-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2746:static void rtw8822c_cfg_ldo25(struct rtw_dev *rtwdev, bool enable)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2747-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2754-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2755:static void rtw8822c_false_alarm_statistics(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2756-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2824-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2825:static void rtw8822c_do_lck(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2826-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2844-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2845:static void rtw8822c_do_iqk(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2846-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2862-/* for coex */\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2863:static void rtw8822c_coex_cfg_init(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2864-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2891-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2892:static void rtw8822c_coex_cfg_gnt_fix(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2893-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2970-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2971:static void rtw8822c_coex_cfg_gnt_debug(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2972-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2979-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:2980:static void rtw8822c_coex_cfg_rfe_type(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-2981-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3002-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3003:static void rtw8822c_coex_cfg_wl_tx_power(struct rtw_dev *rtwdev, u8 wl_pwr)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3004-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3013-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3014:static void rtw8822c_coex_cfg_wl_rx_gain(struct rtw_dev *rtwdev, bool low_gain)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3015-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3043-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3044:static void rtw8822c_bf_enable_bfee_su(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3045-\t\t\t\t       struct rtw_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3063-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3064:static void rtw8822c_bf_config_bfee_su(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3065-\t\t\t\t       struct rtw_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3073-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3074:static void rtw8822c_bf_config_bfee_mu(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3075-\t\t\t\t       struct rtw_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3083-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3084:static void rtw8822c_bf_config_bfee(struct rtw_dev *rtwdev, struct rtw_vif *vif,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3085-\t\t\t\t    struct rtw_bfee *bfee, bool enable)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=3095=struct dpk_cfg_pair {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3100-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3101:void rtw8822c_parse_tbl_dpk(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3102-\t\t\t    const struct rtw_table *tbl)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3112-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3113:static void rtw8822c_dpk_set_gnt_wl(struct rtw_dev *rtwdev, bool is_before_k)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3114-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=3129=static void\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3130:rtw8822c_dpk_restore_registers(struct rtw_dev *rtwdev, u32 reg_num,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3131-\t\t\t       struct rtw_backup_info *bckp)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=3138=static void\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3139:rtw8822c_dpk_backup_registers(struct rtw_dev *rtwdev, u32 *reg,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3140-\t\t\t      u32 reg_num, struct rtw_backup_info *bckp)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3150-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3151:static void rtw8822c_dpk_backup_rf_registers(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3152-\t\t\t\t\t     u32 *rf_reg,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3164-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3165:static void rtw8822c_dpk_reload_rf_registers(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3166-\t\t\t\t\t     u32 *rf_reg,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3178-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3179:static void rtw8822c_dpk_information(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3180-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3192-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3193:static void rtw8822c_dpk_rxbb_dc_cal(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3194-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3201-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3202:static u8 rtw8822c_dpk_dc_corr_check(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3203-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3226-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3227:static void rtw8822c_dpk_tx_pause(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3228-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3242-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3243:static void rtw8822c_dpk_mac_bb_setting(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3244-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3248-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3249:static void rtw8822c_dpk_afe_setting(struct rtw_dev *rtwdev, bool is_do_dpk)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3250-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3256-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3257:static void rtw8822c_dpk_pre_setting(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3258-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3275-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3276:static u32 rtw8822c_dpk_rf_setting(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3277-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3313-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3314:static u16 rtw8822c_dpk_get_cmd(struct rtw_dev *rtwdev, u8 action, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3315-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3338-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3339:static u8 rtw8822c_dpk_one_shot(struct rtw_dev *rtwdev, u8 path, u8 action)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3340-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3379-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3380:static u16 rtw8822c_dpk_dgain_read(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3381-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3391-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3392:static u8 rtw8822c_dpk_thermal_read(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3393-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3401-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3402:static u32 rtw8822c_dpk_pas_read(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3403-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3424-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3425:static u32 rtw8822c_psd_log2base(u32 val)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3426-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3450-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3451:static u8 rtw8822c_dpk_gainloss_result(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3452-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3465-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3466:static u8 rtw8822c_dpk_agc_gain_chk(struct rtw_dev *rtwdev, u8 path,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3467-\t\t\t\t    u8 limited_pga)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3482-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3483:static u8 rtw8822c_dpk_agc_loss_chk(struct rtw_dev *rtwdev, u8 path)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3484-{\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=3500=struct rtw8822c_dpk_data {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3509-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3510:static u8 rtw8822c_gain_check_state(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3511-\t\t\t\t    struct rtw8822c_dpk_data *data)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3539-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3540:static u8 rtw8822c_gain_large_state(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3541-\t\t\t\t    struct rtw8822c_dpk_data *data)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3554-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:3555:static u8 rtw8822c_gain_less_state(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-3556-\t\t\t\t   struct rtw8822c_dpk_data *data)\n\n"
}

gemini-3.7-flash

null

null

							input: 64637
							output: 256
							thoughts: 779
						

**My Analysis of the RTL8822C Wireless Driver for Fuzzing**

Okay, let's break this down. I'm focusing on fuzzing the `rtw8822c.c` driver, specifically for the RTL8822C wireless chip. My initial thought was to examine the static driver operations and internal initialization functions, but the instructions are clear: prioritize non-static, non-inlined API entrypoints to avoid skewed distributions and address collisions.

So, I started by looking for exported symbols beyond the obvious, finding only `rtw8822c_hw_spec` and `rtw8822c_parse_tbl_dpk`. These, however, are not candidates.

Then, I identified a list of potential "FocusSymbols" based on the functions in `rtw8822c.c`. I need to ensure they are not inlined. After a careful review, keeping in mind the fuzzing strategy, I've selected the following functions: `rtw_power_on`, `rtw_core_start`, `rtw8822c_dac_cal_iq_search`, `rtw8822c_dac_iq_offset`, `rtw8822c_dac_iq_check`, `rtw8822c_rf_dac_cal`, `rtw8822c_rf_init`, and `rtw8822c_phy_set_param`. These seem to be the key entry points for fuzzing.

I've also confirmed that the `EnableConfigs` are correctly set: `MAC80211`, `RTW88`, `RTW88_CORE`, `RTW88_8822C`, `RTW88_8822CU`, and `RTW88_8822CE`.

Finally, I'm checking the requirements again to make certain I haven't missed anything. I've confirmed that `WorthFuzzing` is set to `true`, and I know that this hardware can be emulated via the USB raw gadget syzkaller method (e.g. RTL8822CU USB dongle). Given the patch description mentions DAC IQ calibration, sample checks, and sorting, this is definitely worth fuzzing.

Everything looks good. Time to set the results.

{
  "EnableConfigs": [
    "MAC80211",
    "RTW88",
    "RTW88_CORE",
    "RTW88_8822C",
    "RTW88_8822CU",
    "RTW88_8822CE"
  ],
  "FocusSymbols": [
    "rtw_core_start",
    "rtw_power_on",
    "rtw8822c_phy_set_param",
    "rtw8822c_rf_init",
    "rtw8822c_rf_dac_cal",
    "rtw8822c_dac_cal_iq_search",
    "rtw8822c_dac_iq_offset"
  ],
  "Reasoning": "The patch modifies DAC IQ calibration math, sample validation, and sorting logic for Realtek RTL8822C wireless devices. RTL8822CU USB devices can be emulated in virtualized environments via USB emulation tools (like Raw Gadget), making these code paths reachable during hardware initialization and power-on.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MAC80211",
    "RTW88",
    "RTW88_CORE",
    "RTW88_8822C",
    "RTW88_8822CU",
    "RTW88_8822CE"
  ],
  "FocusSymbols": [
    "rtw_core_start",
    "rtw_power_on",
    "rtw8822c_phy_set_param",
    "rtw8822c_rf_init",
    "rtw8822c_rf_dac_cal",
    "rtw8822c_dac_cal_iq_search",
    "rtw8822c_dac_iq_offset"
  ],
  "Reasoning": "The patch modifies DAC IQ calibration math, sample validation, and sorting logic for Realtek RTL8822C wireless devices. RTL8822CU USB devices can be emulated in virtualized environments via USB emulation tools (like Raw Gadget), making these code paths reachable during hardware initialization and power-on.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

core

null

{
  "KMSANReasoning": "The patch refactors internal DAC I/Q calibration routines in the Realtek rtw8822c wireless driver (rtw8822c.c) by using FIELD_GET_SIGNED for 10-bit signed register decoding, standard kernel sort(), and simplified signed integer arithmetic instead of custom 2's complement handling. The changes do not introduce or modify any data structures copied to user space (no copy_to_user, netlink skb, ioctl, etc.), nor do they introduce uninitialized memory reads or changes to heap/stack allocation initialization. Therefore, dedicated KMSAN fuzzing is not required and standard KASAN/sanitizers are sufficient.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e35b83a9419fe7928b00f2ceab02b204338de51e
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Aug 28 06:39:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
index 244c8026479c2..bec1bb376996b 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
@@ -3,6 +3,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/sort.h>
 #include "main.h"
 #include "coex.h"
 #include "fw.h"
@@ -153,84 +154,30 @@ static void rtw8822c_dac_restore_reg(struct rtw_dev *rtwdev,
 	}
 }
 
-static void rtw8822c_rf_minmax_cmp(struct rtw_dev *rtwdev, u32 value,
-				   u32 *min, u32 *max)
+static int rtw8822c_dac_iq_cmp_s32(const void *a, const void *b)
 {
-	if (value >= 0x200) {
-		if (*min >= 0x200) {
-			if (*min > value)
-				*min = value;
-		} else {
-			*min = value;
-		}
-		if (*max >= 0x200) {
-			if (*max < value)
-				*max = value;
-		}
-	} else {
-		if (*min < 0x200) {
-			if (*min > value)
-				*min = value;
-		}
+	s32 val_a = *(const s32 *)a;
+	s32 val_b = *(const s32 *)b;
 
-		if (*max  >= 0x200) {
-			*max = value;
-		} else {
-			if (*max < value)
-				*max = value;
-		}
-	}
+	return (val_a > val_b) - (val_a < val_b);
 }
 
-static void __rtw8822c_dac_iq_sort(struct rtw_dev *rtwdev, u32 *v1, u32 *v2)
-{
-	if (*v1 >= 0x200 && *v2 >= 0x200) {
-		if (*v1 > *v2)
-			swap(*v1, *v2);
-	} else if (*v1 < 0x200 && *v2 < 0x200) {
-		if (*v1 > *v2)
-			swap(*v1, *v2);
-	} else if (*v1 < 0x200 && *v2 >= 0x200) {
-		swap(*v1, *v2);
-	}
-}
 
-static void rtw8822c_dac_iq_sort(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)
+static u32 rtw8822c_dac_iq_offset(struct rtw_dev *rtwdev, s32 *vec)
 {
-	u32 i, j;
-
-	for (i = 0; i < DACK_SN_8822C - 1; i++) {
-		for (j = 0; j < (DACK_SN_8822C - 1 - i) ; j++) {
-			__rtw8822c_dac_iq_sort(rtwdev, &iv[j], &iv[j + 1]);
-			__rtw8822c_dac_iq_sort(rtwdev, &qv[j], &qv[j + 1]);
-		}
-	}
-}
+	s32 sum = 0;
+	s32 avg;
+	u32 i;
 
-static void rtw8822c_dac_iq_offset(struct rtw_dev *rtwdev, u32 *vec, u32 *val)
-{
-	u32 p, m, t, i;
+	for (i = 10; i < DACK_SN_8822C - 10; i++)
+		sum += vec[i];
 
-	m = 0;
-	p = 0;
-	for (i = 10; i < DACK_SN_8822C - 10; i++) {
-		if (vec[i] > 0x200)
-			m = (0x400 - vec[i]) + m;
-		else
-			p = vec[i] + p;
-	}
+	avg = sum / (DACK_SN_8822C - 20);
 
-	if (p > m) {
-		t = p - m;
-		t = t / (DACK_SN_8822C - 20);
-	} else {
-		t = m - p;
-		t = t / (DACK_SN_8822C - 20);
-		if (t != 0x0)
-			t = 0x400 - t;
-	}
-
-	*val = t;
+	/* Map the signed average back to a 10-bit hardware format.
+	 * Example: avg = -1, returns 0x3FF (signed 10-bit value)
+	 */
+	return avg & GENMASK(9, 0);
 }
 
 static u32 rtw8822c_get_path_write_addr(u8 path)
@@ -271,29 +218,27 @@ static u32 rtw8822c_get_path_read_addr(u8 path)
 	return base_addr;
 }
 
-static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, u32 value)
+static bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, s32 value)
 {
-	bool ret = true;
 
-	if ((value >= 0x200 && (0x400 - value) > 0x64) ||
-	    (value < 0x200 && value > 0x64)) {
-		ret = false;
+	if (value > 100 || value < -100) {
 		rtw_dbg(rtwdev, RTW_DBG_RFK, "[DACK] Error overflow\n");
+		return false;
 	}
 
-	return ret;
+	return true;
 }
 
-static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)
+static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, s32 *iv, s32 *qv)
 {
 	u32 temp;
 	int i = 0, cnt = 0;
 
 	while (i < DACK_SN_8822C && cnt < 10000) {
 		cnt++;
-		temp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);
-		iv[i] = (temp & 0x3ff000) >> 12;
-		qv[i] = temp & 0x3ff;
+		temp = rtw_read32(rtwdev, 0x2dbc);
+		iv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);
+		qv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);
 
 		if (rtw8822c_dac_iq_check(rtwdev, iv[i]) &&
 		    rtw8822c_dac_iq_check(rtwdev, qv[i]))
@@ -302,67 +247,64 @@ static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, u32 *iv, u32 *qv)
 }
 
 static void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,
-				       u32 *iv, u32 *qv,
+				       s32 *iv, s32 *qv,
 				       u32 *i_value, u32 *q_value)
 {
-	u32 i_max = 0, q_max = 0, i_min = 0, q_min = 0;
+	s32 i_max = 0, q_max = 0, i_min = 0, q_min = 0;
 	u32 i_delta, q_delta;
 	u32 temp;
-	int i, cnt = 0;
+	u32 i, cnt = 0;
 
 	do {
 		i_min = iv[0];
 		i_max = iv[0];
 		q_min = qv[0];
 		q_max = qv[0];
-		for (i = 0; i < DACK_SN_8822C; i++) {
-			rtw8822c_rf_minmax_cmp(rtwdev, iv[i], &i_min, &i_max);
-			rtw8822c_rf_minmax_cmp(rtwdev, qv[i], &q_min, &q_max);
+		for (i = 1; i < DACK_SN_8822C; i++) {
+			if (iv[i] < i_min)
+				i_min = iv[i];
+			if (iv[i] > i_max)
+				i_max = iv[i];
+			if (qv[i] < q_min)
+				q_min = qv[i];
+			if (qv[i] > q_max)
+				q_max = qv[i];
 		}
 
-		if (i_max < 0x200 && i_min < 0x200)
-			i_delta = i_max - i_min;
-		else if (i_max >= 0x200 && i_min >= 0x200)
-			i_delta = i_max - i_min;
-		else
-			i_delta = i_max + (0x400 - i_min);
+		i_delta = i_max - i_min;
+		q_delta = q_max - q_min;
 
-		if (q_max < 0x200 && q_min < 0x200)
-			q_delta = q_max - q_min;
-		else if (q_max >= 0x200 && q_min >= 0x200)
-			q_delta = q_max - q_min;
-		else
-			q_delta = q_max + (0x400 - q_min);
 
 		rtw_dbg(rtwdev, RTW_DBG_RFK,
-			"[DACK] i: min=0x%08x, max=0x%08x, delta=0x%08x\n",
+			"[DACK] i: min=%d, max=%d, delta=%d\n",
 			i_min, i_max, i_delta);
 		rtw_dbg(rtwdev, RTW_DBG_RFK,
-			"[DACK] q: min=0x%08x, max=0x%08x, delta=0x%08x\n",
+			"[DACK] q: min=%d, max=%d, delta=%d",
 			q_min, q_max, q_delta);
 
-		rtw8822c_dac_iq_sort(rtwdev, iv, qv);
+		sort(iv, DACK_SN_8822C, sizeof(s32), rtw8822c_dac_iq_cmp_s32, NULL);
+		sort(qv, DACK_SN_8822C, sizeof(s32), rtw8822c_dac_iq_cmp_s32, NULL);
 
 		if (i_delta > 5 || q_delta > 5) {
-			temp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);
-			iv[0] = (temp & 0x3ff000) >> 12;
-			qv[0] = temp & 0x3ff;
-			temp = rtw_read32_mask(rtwdev, 0x2dbc, 0x3fffff);
-			iv[DACK_SN_8822C - 1] = (temp & 0x3ff000) >> 12;
-			qv[DACK_SN_8822C - 1] = temp & 0x3ff;
+			temp = rtw_read32(rtwdev, 0x2dbc);
+			iv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);
+			qv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);
+			temp = rtw_read32(rtwdev, 0x2dbc);
+			iv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);
+			qv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);
 		} else {
 			break;
 		}
 	} while (cnt++ < 100);
 
-	rtw8822c_dac_iq_offset(rtwdev, iv, i_value);
-	rtw8822c_dac_iq_offset(rtwdev, qv, q_value);
+	*i_value = rtw8822c_dac_iq_offset(rtwdev, iv);
+	*q_value = rtw8822c_dac_iq_offset(rtwdev, qv);
 }
 
 static void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,
 				     u32 *i_value, u32 *q_value)
 {
-	u32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];
+	s32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];
 	u32 rf_a, rf_b;
 
 	rf_a = rtw_read_rf(rtwdev, RF_PATH_A, 0x0, RFREG_MASK);
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.h b/drivers/net/wireless/realtek/rtw88/rtw8822c.h
index fc62b67a15f21..7bea99614354b 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.h
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.h
@@ -141,6 +141,9 @@ const struct rtw_table name ## _tbl = {			\
 #define DACK_RF_8822C		1
 #define DACK_SN_8822C		100
 
+#define RTW8822C_DAC_IV_MASK GENMASK(21, 12)
+#define RTW8822C_DAC_QV_MASK GENMASK(9, 0)
+
 /* phy status page0 */
 #define GET_PHY_STAT_P0_PWDB_A(phy_stat)                                       \
 	le32_get_bits(*((__le32 *)(phy_stat) + 0x00), GENMASK(15, 8))

gemini-3.7-flash

null

null

							input: 6108
							output: 49
							thoughts: 90
						

Here's my thought process, as if I were reviewing this patch:

**Analyzing the rtw8822c Patch**

Okay, so this patch is touching `rtw8822c.c` and `rtw8822c.h` – that's the Realtek RTL8822C wireless driver, specifically. Given the scope of the file changes, I need to understand what's being modified. I should start by carefully reviewing the diffs, focusing on the context around any function or variable declarations. I'll need to pay particular attention to changes within any core functional blocks.

To get a better grip, I will quickly check the implementation of `rtw8822c_dac_cal_rf_mode` and identify any functions that call it. The quickest way to do that is to grep or read the file directly, it's pretty quick with my setup. Understanding how this function is used is crucial to grasping the patch's overall impact. I'll be looking for potential regressions or unexpected side effects based on how this calibration function interacts with the RF system.

{
  "Expression": "rtw8822c_dac_cal_rf_mode",
  "PathPrefix": "drivers/net/wireless/realtek/rtw88/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw88/rtw8822c.c=249=static void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-303-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:304:static void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-305-\t\t\t\t     u32 *i_value, u32 *q_value)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=336=static void rtw8822c_dac_cal_adc(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-373-\t\trtw_write32(rtwdev, 0x1c24, 0x00010002);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:374:\t\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-375-\t\trtw_dbg(rtwdev, RTW_DBG_RFK,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-393-\t\trtw_write32(rtwdev, 0x1c3c, path_sel + 0x8103);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:394:\t\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-395-\t\trtw_dbg(rtwdev, RTW_DBG_RFK,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=459=static void rtw8822c_dac_cal_step2(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-476-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:477:\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic_in, \u0026qc_in);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-478-\tic = ic_in;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=508=static void rtw8822c_dac_cal_step3(struct rtw_dev *rtwdev, u8 path,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-558-\trtw_write32(rtwdev, base_addr + 0x60, 0xf0000000);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:559:\trtw8822c_dac_cal_rf_mode(rtwdev, \u0026ic, \u0026qc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-560-\tif (ic \u003e= 0x10)\n"
}

gemini-3.7-flash

null

null

							input: 7484
							output: 51
							thoughts: 79
						

Here's my thought process, as I delve into this code:

**Analyzing `rtw8822c_dac_cal_rf_mode` and `FIELD_GET_SIGNED`**

Alright, I need to get a handle on how this calibration routine works, and it looks like `rtw8822c_dac_cal_rf_mode` is the place to start. First thing's first, I want to confirm how the `iv` and `qv` values are being set and subsequently used within that function. I'll need to scrutinize how those variables are initialized and how their values are derived. Specifically, I need to understand the role of `FIELD_GET_SIGNED` in this process. I'm assuming it's related to some signed value extraction from a register, but I need to confirm the exact implementation and context.

Therefore, my next step is a deep dive into `rtw8822c.c`, focusing on the `rtw8822c_dac_cal_rf_mode` function and any functions in its immediate vicinity. This should give me the complete picture, not just the isolated snippet, but also the broader control flow and data dependencies. I'm going to carefully read the surrounding code for a clear understanding of the broader context and any related initialization or usage of those variables. Hopefully, this context clarifies the intent and logic.

{
  "File": "drivers/net/wireless/realtek/rtw88/rtw8822c.c",
  "FirstLine": 295,
  "LineCount": 60
}

{
  "Contents": " 295:\t\t\t} else {\n 296:\t\t\t\tbreak;\n 297:\t\t\t}\n 298:\t\t} while (cnt++ \u003c 100);\n 299:\t\n 300:\t\t*i_value = rtw8822c_dac_iq_offset(rtwdev, iv);\n 301:\t\t*q_value = rtw8822c_dac_iq_offset(rtwdev, qv);\n 302:\t}\n 303:\t\n 304:\tstatic void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,\n 305:\t\t\t\t\t     u32 *i_value, u32 *q_value)\n 306:\t{\n 307:\t\ts32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];\n 308:\t\tu32 rf_a, rf_b;\n 309:\t\n 310:\t\trf_a = rtw_read_rf(rtwdev, RF_PATH_A, 0x0, RFREG_MASK);\n 311:\t\trf_b = rtw_read_rf(rtwdev, RF_PATH_B, 0x0, RFREG_MASK);\n 312:\t\n 313:\t\trtw_dbg(rtwdev, RTW_DBG_RFK, \"[DACK] RF path-A=0x%05x\\n\", rf_a);\n 314:\t\trtw_dbg(rtwdev, RTW_DBG_RFK, \"[DACK] RF path-B=0x%05x\\n\", rf_b);\n 315:\t\n 316:\t\trtw8822c_dac_cal_iq_sample(rtwdev, iv, qv);\n 317:\t\trtw8822c_dac_cal_iq_search(rtwdev, iv, qv, i_value, q_value);\n 318:\t}\n 319:\t\n 320:\tstatic void rtw8822c_dac_bb_setting(struct rtw_dev *rtwdev)\n 321:\t{\n 322:\t\trtw_write32_mask(rtwdev, 0x1d58, 0xff8, 0x1ff);\n 323:\t\trtw_write32_mask(rtwdev, 0x1a00, 0x3, 0x2);\n 324:\t\trtw_write32_mask(rtwdev, 0x1a14, 0x300, 0x3);\n 325:\t\trtw_write32(rtwdev, 0x1d70, 0x7e7e7e7e);\n 326:\t\trtw_write32_mask(rtwdev, 0x180c, 0x3, 0x0);\n 327:\t\trtw_write32_mask(rtwdev, 0x410c, 0x3, 0x0);\n 328:\t\trtw_write32(rtwdev, 0x1b00, 0x00000008);\n 329:\t\trtw_write8(rtwdev, 0x1bcc, 0x3f);\n 330:\t\trtw_write32(rtwdev, 0x1b00, 0x0000000a);\n 331:\t\trtw_write8(rtwdev, 0x1bcc, 0x3f);\n 332:\t\trtw_write32_mask(rtwdev, 0x1e24, BIT(31), 0x0);\n 333:\t\trtw_write32_mask(rtwdev, 0x1e28, 0xf, 0x3);\n 334:\t}\n 335:\t\n 336:\tstatic void rtw8822c_dac_cal_adc(struct rtw_dev *rtwdev,\n 337:\t\t\t\t\t u8 path, u32 *adc_ic, u32 *adc_qc)\n 338:\t{\n 339:\t\tstruct rtw_dm_info *dm_info = \u0026rtwdev-\u003edm_info;\n 340:\t\tu32 ic = 0, qc = 0, temp = 0;\n 341:\t\tu32 base_addr;\n 342:\t\tu32 path_sel;\n 343:\t\tint i;\n 344:\t\n 345:\t\trtw_dbg(rtwdev, RTW_DBG_RFK, \"[DACK] ADCK path(%d)\\n\", path);\n 346:\t\n 347:\t\tbase_addr = rtw8822c_get_path_write_addr(path);\n 348:\t\tswitch (path) {\n 349:\t\tcase RF_PATH_A:\n 350:\t\t\tpath_sel = 0xa0000;\n 351:\t\t\tbreak;\n 352:\t\tcase RF_PATH_B:\n 353:\t\t\tpath_sel = 0x80000;\n 354:\t\t\tbreak;\n"
}

gemini-3.7-flash

null

null

							input: 9287
							output: 51
							thoughts: 35
						

Okay, let's dive into this.

**Examining the DAC Calibration Function in `rtw8822c.c`**

Alright, I need to take a look at the `rtw8822c_dac_cal_iq_sample` function. It's obviously critical for understanding the Digital-to-Analog Converter (DAC) calibration process within the `rtw8822c` driver, specifically for the IQ (In-phase and Quadrature) samples. This suggests we are dealing with a direct-conversion architecture, which immediately tells me a lot about the potential calibration complexities we might encounter. I expect to find details on how the driver handles gain imbalances, DC offsets, and quadrature errors. I'll need to see how they're acquiring the samples, how the data is processed, and what algorithms are used to correct for these impairments. I'm keen to see if they're employing any clever techniques to minimize overhead or if they are taking the simple approach. I'm especially interested to see what techniques they are using to sample the I/Q imbalance, or if they have implemented a more complex iterative approach. This seems like a key function in ensuring the radio's performance.

{
  "File": "drivers/net/wireless/realtek/rtw88/rtw8822c.c",
  "FirstLine": 220,
  "LineCount": 40
}

{
  "Contents": " 220:\t\n 221:\tstatic bool rtw8822c_dac_iq_check(struct rtw_dev *rtwdev, s32 value)\n 222:\t{\n 223:\t\n 224:\t\tif (value \u003e 100 || value \u003c -100) {\n 225:\t\t\trtw_dbg(rtwdev, RTW_DBG_RFK, \"[DACK] Error overflow\\n\");\n 226:\t\t\treturn false;\n 227:\t\t}\n 228:\t\n 229:\t\treturn true;\n 230:\t}\n 231:\t\n 232:\tstatic void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, s32 *iv, s32 *qv)\n 233:\t{\n 234:\t\tu32 temp;\n 235:\t\tint i = 0, cnt = 0;\n 236:\t\n 237:\t\twhile (i \u003c DACK_SN_8822C \u0026\u0026 cnt \u003c 10000) {\n 238:\t\t\tcnt++;\n 239:\t\t\ttemp = rtw_read32(rtwdev, 0x2dbc);\n 240:\t\t\tiv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);\n 241:\t\t\tqv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);\n 242:\t\n 243:\t\t\tif (rtw8822c_dac_iq_check(rtwdev, iv[i]) \u0026\u0026\n 244:\t\t\t    rtw8822c_dac_iq_check(rtwdev, qv[i]))\n 245:\t\t\t\ti++;\n 246:\t\t}\n 247:\t}\n 248:\t\n 249:\tstatic void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,\n 250:\t\t\t\t\t       s32 *iv, s32 *qv,\n 251:\t\t\t\t\t       u32 *i_value, u32 *q_value)\n 252:\t{\n 253:\t\ts32 i_max = 0, q_max = 0, i_min = 0, q_min = 0;\n 254:\t\tu32 i_delta, q_delta;\n 255:\t\tu32 temp;\n 256:\t\tu32 i, cnt = 0;\n 257:\t\n 258:\t\tdo {\n 259:\t\t\ti_min = iv[0];\n"
}

gemini-3.7-flash

null

null

							input: 10341
							output: 19
							thoughts: 809
						

**Analyzing Potential Data Leakage in DAC Calibration**

Okay, so I'm looking at this DAC calibration code for the rtw8822c and something's bugging me. Specifically, in `rtw8822c_dac_cal_rf_mode`, I'm seeing this:

```c
static void rtw8822c_dac_cal_rf_mode(struct rtw_dev *rtwdev,
				     u32 *i_value, u32 *q_value)
{
	s32 iv[DACK_SN_8822C], qv[DACK_SN_8822C];
	u32 rf_a, rf_b;

	rf_a = rtw_read_rf(rtwdev, RF_PATH_A, 0x0, RFREG_MASK);
	rf_b = rtw_read_rf(rtwdev, RF_PATH_B, 0x0, RFREG_MASK);

	rtw_dbg(rtwdev, RTW_DBG_RFK, "[DACK] RF path-A=0x%05x\n", rf_a);
	rtw_dbg(rtwdev, RTW_DBG_RFK, "[DACK] RF path-B=0x%05x\n", rf_b);

	rtw8822c_dac_cal_iq_sample(rtwdev, iv, qv);
	rtw8822c_dac_cal_iq_search(rtwdev, iv, qv, i_value, q_value);
}
```

Now, the concern is this: inside `rtw8822c_dac_cal_iq_sample`, the values `iv` and `qv` are populated in a loop with a potential early exit:

```c
	while (i < DACK_SN_8822C && cnt < 10000) {
		cnt++;
		temp = rtw_read32(rtwdev, 0x2dbc);
		iv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);
		qv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);

		if (rtw8822c_dac_iq_check(rtwdev, iv[i]) &&
		    rtw8822c_dac_iq_check(rtwdev, qv[i]))
			i++;
	}
```

What if `cnt` hits 10000 *before* `i` reaches `DACK_SN_8822C`? Those arrays `iv` and `qv` are initialized, and if the loop exits early, the remaining elements *could* contain uninitialized data. That's a potential information leak.

I need to confirm the history here.  It seems this code changed from using `u32` to `s32` for `iv` and `qv` due to the use of `FIELD_GET_SIGNED`. I need to ensure that the code *always* fills the entire array, or that later use correctly accounts for any potential uninitialized values.  Did the patch itself introduce a change that would cause an uninitialized read? No, it looks like previously it was also using `u32`. This patch just changed it to `s32`... so the core issue existed before the patch.

I also need to check the definition of `FIELD_GET_SIGNED` to understand how it handles sign extension and whether it exacerbates the problem, and maybe grep the code base to find any similar usages of `FIELD_GET_SIGNED` to see if there are other potential issues. A quick grep might expose if there are other places where the same pattern exists.

{
  "Expression": "FIELD_GET_SIGNED"
}

{
  "Output": "arch/x86/mm/extable.c=299=int fixup_exception(struct pt_regs *regs, int trapnr, unsigned long error_code,\n--\narch/x86/mm/extable.c-324-\treg  = FIELD_GET(EX_DATA_REG_MASK,  e-\u003edata);\narch/x86/mm/extable.c:325:\timm  = FIELD_GET_SIGNED(EX_DATA_IMM_MASK, e-\u003edata);\narch/x86/mm/extable.c-326-\n--\ndrivers/iio/adc/intel_dc_ti_adc.c=254=static int dc_ti_adc_probe(struct platform_device *pdev)\n--\ndrivers/iio/adc/intel_dc_ti_adc.c-291-\ndrivers/iio/adc/intel_dc_ti_adc.c:292:\tinfo-\u003evbat_zse = FIELD_GET_SIGNED(DC_TI_VBAT_ZSE, val);\ndrivers/iio/adc/intel_dc_ti_adc.c:293:\tinfo-\u003evbat_ge = FIELD_GET_SIGNED(DC_TI_VBAT_GE, val);\ndrivers/iio/adc/intel_dc_ti_adc.c-294-\n--\ndrivers/iio/magnetometer/yamaha-yas530.c=818=static int yas530_get_calibration_data(struct yas5xx *yas5xx)\n--\ndrivers/iio/magnetometer/yamaha-yas530.c-862-\tc-\u003ef[2] = FIELD_GET(GENMASK(6, 5), val);\ndrivers/iio/magnetometer/yamaha-yas530.c:863:\tc-\u003er[0] = FIELD_GET_SIGNED(GENMASK(28, 23), val);\ndrivers/iio/magnetometer/yamaha-yas530.c:864:\tc-\u003er[1] = FIELD_GET_SIGNED(GENMASK(20, 15), val);\ndrivers/iio/magnetometer/yamaha-yas530.c:865:\tc-\u003er[2] = FIELD_GET_SIGNED(GENMASK(12, 7), val);\ndrivers/iio/magnetometer/yamaha-yas530.c-866-\n--\ndrivers/iio/magnetometer/yamaha-yas530.c=870=static int yas532_get_calibration_data(struct yas5xx *yas5xx)\n--\ndrivers/iio/magnetometer/yamaha-yas530.c-917-\tc-\u003ef[2] = FIELD_GET(GENMASK(8, 7), val);\ndrivers/iio/magnetometer/yamaha-yas530.c:918:\tc-\u003er[0] = FIELD_GET_SIGNED(GENMASK(30, 25), val);\ndrivers/iio/magnetometer/yamaha-yas530.c:919:\tc-\u003er[1] = FIELD_GET_SIGNED(GENMASK(22, 17), val);\ndrivers/iio/magnetometer/yamaha-yas530.c:920:\tc-\u003er[2] = FIELD_GET_SIGNED(GENMASK(14, 7), val);\ndrivers/iio/magnetometer/yamaha-yas530.c-921-\n--\ndrivers/iio/pressure/bmp280-core.c=359=static int bme280_read_calib(struct bmp280_data *data)\n--\ndrivers/iio/pressure/bmp280-core.c-394-\ttmp_3 = get_unaligned_le16(\u0026data-\u003ebme280_humid_cal_buf[H5]);\ndrivers/iio/pressure/bmp280-core.c:395:\tcalib-\u003eH5 = FIELD_GET_SIGNED(BME280_COMP_H5_MASK, tmp_3);\ndrivers/iio/pressure/bmp280-core.c-396-\tcalib-\u003eH6 = data-\u003ebme280_humid_cal_buf[H6];\n--\ndrivers/iio/temperature/mcp9600.c=278=static int mcp9600_read_thresh(struct iio_dev *indio_dev,\n--\ndrivers/iio/temperature/mcp9600.c-298-\t\t */\ndrivers/iio/temperature/mcp9600.c:299:\t\t*val = FIELD_GET_SIGNED(MCP9600_ALERT_LIMIT_MASK, ret);\ndrivers/iio/temperature/mcp9600.c-300-\t\t*val2 = 4;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=232=static void rtw8822c_dac_cal_iq_sample(struct rtw_dev *rtwdev, s32 *iv, s32 *qv)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-239-\t\ttemp = rtw_read32(rtwdev, 0x2dbc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:240:\t\tiv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:241:\t\tqv[i] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-242-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=249=static void rtw8822c_dac_cal_iq_search(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-289-\t\t\ttemp = rtw_read32(rtwdev, 0x2dbc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:290:\t\t\tiv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:291:\t\t\tqv[0] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-292-\t\t\ttemp = rtw_read32(rtwdev, 0x2dbc);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:293:\t\t\tiv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_IV_MASK, temp);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:294:\t\t\tqv[DACK_SN_8822C - 1] = FIELD_GET_SIGNED(RTW8822C_DAC_QV_MASK, temp);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-295-\t\t} else {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c=325=static void _check_addc(struct rtw89_dev *rtwdev, enum rtw89_rf_path path)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-336-\t\ttmp = rtw89_phy_read32_mask(rtwdev, R_DBG32_D, MASKDWORD);\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c:337:\t\tdc_re += FIELD_GET_SIGNED(0xfff000, tmp);\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c:338:\t\tdc_im += FIELD_GET_SIGNED(0xfff, tmp);\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-339-\t}\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_common.c=206=static bool _decode_efuse_gain(u8 data, s8 *high, s8 *low)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_common.c-208-\tif (high)\ndrivers/net/wireless/realtek/rtw89/rtw8852b_common.c:209:\t\t*high = FIELD_GET_SIGNED(GENMASK(7,  4), data);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_common.c-210-\tif (low)\ndrivers/net/wireless/realtek/rtw89/rtw8852b_common.c:211:\t\t*low = FIELD_GET_SIGNED(GENMASK(3,  0), data);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_common.c-212-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c=488=static void _check_addc(struct rtw89_dev *rtwdev, enum rtw89_rf_path path)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-499-\t\ttmp = rtw89_phy_read32_mask(rtwdev, R_DBG32_D, MASKDWORD);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c:500:\t\tdc_re += FIELD_GET_SIGNED(0xfff000, tmp);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c:501:\t\tdc_im += FIELD_GET_SIGNED(0xfff, tmp);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-502-\t}\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c.c=565=static bool _decode_efuse_gain(u8 data, s8 *high, s8 *low)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c.c-567-\tif (high)\ndrivers/net/wireless/realtek/rtw89/rtw8852c.c:568:\t\t*high = FIELD_GET_SIGNED(GENMASK(7, 4), data);\ndrivers/net/wireless/realtek/rtw89/rtw8852c.c-569-\tif (low)\ndrivers/net/wireless/realtek/rtw89/rtw8852c.c:570:\t\t*low = FIELD_GET_SIGNED(GENMASK(3, 0), data);\ndrivers/net/wireless/realtek/rtw89/rtw8852c.c-571-\n--\ndrivers/ptp/ptp_fc3.c=54=static s64 tdc_meas2offset(struct idtfc3 *idtfc3, u64 meas_read)\n--\ndrivers/ptp/ptp_fc3.c-57-\ndrivers/ptp/ptp_fc3.c:58:\tfine = FIELD_GET_SIGNED(FINE_MEAS_MASK, meas_read);\ndrivers/ptp/ptp_fc3.c:59:\tcoarse = FIELD_GET_SIGNED(COARSE_MEAS_MASK, meas_read);\ndrivers/ptp/ptp_fc3.c-60-\n--\ndrivers/rtc/rtc-rv3032.c=370=static int rv3032_read_offset(struct device *dev, long *offset)\n--\ndrivers/rtc/rtc-rv3032.c-378-\ndrivers/rtc/rtc-rv3032.c:379:\tsteps = FIELD_GET_SIGNED(RV3032_OFFSET_MSK, value);\ndrivers/rtc/rtc-rv3032.c-380-\n--\ninclude/linux/bitfield.h-181-/**\ninclude/linux/bitfield.h:182: * FIELD_GET_SIGNED() - extract a signed bitfield element\ninclude/linux/bitfield.h-183- * @mask: shifted mask defining the field's length and position\n--\ninclude/linux/bitfield.h-188- */\ninclude/linux/bitfield.h:189:#define FIELD_GET_SIGNED(mask, reg)\t\t\t\t\t\\\ninclude/linux/bitfield.h-190-\t({\t\t\t\t\t\t\t\t\\\ninclude/linux/bitfield.h:191:\t\t__BF_FIELD_CHECK(mask, reg, 0U, \"FIELD_GET_SIGNED: \");\t\\\ninclude/linux/bitfield.h-192-\t\t ((__signed_scalar_typeof(mask))\t\t\t\\\n"
}

gemini-3.7-flash

null

null

							input: 15487
							output: 168
							thoughts: 623
						

**My Analysis of the rtw8822c Patch**

Okay, let's break this down systematically. My initial impression is that this patch focuses on code modernization and simplification within the rtw8822c driver, specifically regarding RF DAC calibration. My focus is on ensuring no new vulnerabilities are introduced during this process.

First, I see the core changes revolve around replacing custom sorting and comparison functions with the kernel's `sort()` function, using a new comparison function `rtw8822c_dac_iq_cmp_s32`. That's good – utilizing standard library functions is generally preferable for maintainability and correctness. The switch to `FIELD_GET_SIGNED` for register reads instead of manual bit-shifting is also a smart move, making the code more readable and less prone to errors. Finally, simplifying the `*_offset` and `*_check` functions by directly operating on signed 32-bit values instead of manually converting unsigned values seems like another step towards clarity and potential performance improvement.

Now, the crucial part: vulnerability assessment. My primary concern here is the introduction of uninitialized memory reads. I need to be absolutely certain that this patch doesn't introduce any new paths where we might accidentally expose uninitialized data. Let's see... is there any data copied to user space? No, this is internal RF DAC calibration logic, completely self-contained within the kernel driver. Are there any conditionally uninitialized memory issues? The local arrays `iv` and `qv` are populated from hardware register reads within `rtw8822c_dac_cal_iq_sample`, so, no, those seem safe. And there aren't any new data structures, allocations, or padding concerns.

Given this analysis, I don't see any evidence of introducing or exposing uninitialized memory reads. This leads me to the KMSAN check. I understand the importance of avoiding resource intensive sessions unless necessary. We need to be absolutely certain before going down that road.

My rule of thumb is: if KASAN, LockDep, or other standard bug detectors are sufficient, there's no reason to waste time on KMSAN. This patch modifies internal numerical processing, sorting algorithms, and register field decoding during DAC IQ calibration. There are no userspace copies, and the changes don't touch memory initialization or padding. There are no exposed uninitialized data paths, therefore KMSAN should not be used.

Based on this, **NeedsKMSAN = false** is the correct call here.

{
  "KMSANReasoning": "The patch refactors internal DAC I/Q calibration routines in the Realtek rtw8822c wireless driver (rtw8822c.c) by using FIELD_GET_SIGNED for 10-bit signed register decoding, standard kernel sort(), and simplified signed integer arithmetic instead of custom 2's complement handling. The changes do not introduce or modify any data structures copied to user space (no copy_to_user, netlink skb, ioctl, etc.), nor do they introduce uninitialized memory reads or changes to heap/stack allocation initialization. Therefore, dedicated KMSAN fuzzing is not required and standard KASAN/sanitizers are sufficient.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch refactors internal DAC I/Q calibration routines in the Realtek rtw8822c wireless driver (rtw8822c.c) by using FIELD_GET_SIGNED for 10-bit signed register decoding, standard kernel sort(), and simplified signed integer arithmetic instead of custom 2's complement handling. The changes do not introduce or modify any data structures copied to user space (no copy_to_user, netlink skb, ioctl, etc.), nor do they introduce uninitialized memory reads or changes to heap/stack allocation initialization. Therefore, dedicated KMSAN fuzzing is not required and standard KASAN/sanitizers are sufficient.",
  "NeedsKMSAN": false
}