AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch adds a bounds check in iwl_mvm_rx_umac_scan_complete_notif() within the Intel Wi-Fi driver (iwlwifi). This driver requires physical Intel PCIe wireless hardware and firmware, which cannot be reached in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 4dd093f7dfc1655f52e5a7539a8693e167078ec5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Aug 31 18:15:01 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c\nindex b588f1dcf20d5..7bf8236cea6d4 100644\n--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c\n+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c\n@@ -1,6 +1,6 @@\n // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n /*\n- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation\n+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation\n  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH\n  * Copyright (C) 2016-2017 Intel Deutschland GmbH\n  */\n@@ -3221,6 +3221,10 @@ void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,\n \n \tmvm-\u003emei_scan_filter.is_mei_limited_scan = false;\n \n+\tif (IWL_FW_CHECK(mvm, uid \u003e= ARRAY_SIZE(mvm-\u003escan_uid_status),\n+\t\t\t \"FW reports out-of-range scan UID %d\\n\", uid))\n+\t\treturn;\n+\n \tIWL_DEBUG_SCAN(mvm,\n \t\t       \"Scan completed: uid=%u type=%u, status=%s, EBS=%s\\n\",\n \t\t       uid, mvm-\u003escan_uid_status[uid],\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds a bounds check in iwl_mvm_rx_umac_scan_complete_notif() within the Intel Wi-Fi driver (iwlwifi). This driver requires physical Intel PCIe wireless hardware and firmware, which cannot be reached in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 4dd093f7dfc1655f52e5a7539a8693e167078ec5
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Aug 31 18:15:01 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index b588f1dcf20d5..7bf8236cea6d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -3221,6 +3221,10 @@ void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
 
 	mvm->mei_scan_filter.is_mei_limited_scan = false;
 
+	if (IWL_FW_CHECK(mvm, uid >= ARRAY_SIZE(mvm->scan_uid_status),
+			 "FW reports out-of-range scan UID %d\n", uid))
+		return;
+
 	IWL_DEBUG_SCAN(mvm,
 		       "Scan completed: uid=%u type=%u, status=%s, EBS=%s\n",
 		       uid, mvm->scan_uid_status[uid],

gemini-3.7-flash

null

null

							input: 2311
							output: 33
							thoughts: 405
						

**Analyzing the `iwlwifi` Scan Completion Notification**

Okay, so the patch is located in `drivers/net/wireless/intel/iwlwifi/mvm/scan.c`, specifically within `iwl_mvm_rx_umac_scan_complete_notif`. My initial thought is to assess its fuzzing potential. Can this be targeted in a standard QEMU or GCE environment, or does it require dedicated Intel Wi-Fi hardware? Hold on, let's step back and consider the guidelines.

Right, the key is to determine if the code path is accessible in virtualized environments like QEMU or GCE, even with emulated hardware. If it relies on vendor-specific hardware, like a PCIe switch or a SmartNIC driver not emulated by standard QEMU, then it's not a good candidate.

Now, back to `iwlwifi`. Does it offer any software emulation within QEMU or perhaps utilize `mac80211_hwsim`? No, wait a minute, `mac80211_hwsim` emulates the mac80211 interface directly, not the `iwlwifi` driver. `iwlwifi` is Intel's proprietary Wi-Fi driver, likely tied to their PCIe/PCI/AX200 wireless hardware.

So, does `iwlwifi` have *any* virtual or simulated mode? Or, is it fundamentally vendor-specific? It is Intel's proprietary driver for their WiFi NICs. It's time to confirm this and search the kernel to definitively determine whether `iwlwifi` has any sort of hardware simulation or requires Intel WiFi hardware.

{
  "Expression": "sim",
  "PathPrefix": "drivers/net/wireless/intel/iwlwifi/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1046 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/intel/iwlwifi/Kconfig=107=config IWLWIFI_DEBUG\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-119-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:120:\t  To set a value, simply echo an 8-byte hex value to the same file:\ndrivers/net/wireless/intel/iwlwifi/Kconfig-121-\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c=717=static void iwl_find_disconn_antenna(struct iwl_priv *priv, u32* average_sig,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c-775-\t *\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c:776:\t * To be safe, simply mask out any chains that we know\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c-777-\t * are not on the device.\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c=824=static void iwlagn_gain_computation(struct iwl_priv *priv,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c-853-\t\t\t *   not the format of any internal device registers.\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c:854:\t\t\t *   Do not change this format for e.g. 6050 or similar\ndrivers/net/wireless/intel/iwlwifi/dvm/calib.c-855-\t\t\t *   devices.  Change format only if more resolution\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=508=enum {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-537-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:538: * REPLY_RXON = 0x10 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-539- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=555=struct iwl_rxon_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-579-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:580: * REPLY_RXON_ASSOC = 0x11 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-581- */\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=582=struct iwl_rxon_assoc_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-600-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:601: * REPLY_RXON_TIMING = 0x14 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-602- */\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=603=struct iwl_rxon_time_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-613-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:614: * REPLY_CHANNEL_SWITCH = 0x72 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-615- */\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=690=struct iwl_ac_qos {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-706-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:707: * REPLY_QOS_PARAM = 0x13 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-708- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=1435=struct iwl_compressed_ba_resp {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-1452-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:1453: * REPLY_TX_PWR_TABLE_CMD = 0x97 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-1454- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=1520=struct iwl_link_qual_agg_params {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-1546-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:1547: * REPLY_TX_LINK_QUALITY_CMD = 0x4e (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-1548- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=1734=struct iwl_link_quality_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-1795-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:1796: * REPLY_BT_CONFIG = 0x9b (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-1797- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=2019=struct iwl_spectrum_notification {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2051- *\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:2052: * POWER_TABLE_CMD = 0x77 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2053- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=2121=enum {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2135-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:2136: * REPLY_CARD_STATE_CMD = 0xa0 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2137- */\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=2416=struct iwlagn_beacon_notif {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2423-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:2424: * REPLY_TX_BEACON = 0x91 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2425- */\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=2750=struct iwl_missed_beacon_notif {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2772-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:2773: * SENSITIVITY_CMD = 0xa8 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-2774- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=3009=struct iwl_enhance_sensitivity_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-3015-/*\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:3016: * REPLY_PHY_CALIBRATION_CMD = 0xb0 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-3017- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=3178=struct iwl_calib_chain_noise_gain_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-3192- * LEDs Command \u0026 Response\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:3193: * REPLY_LEDS_CMD = 0x48 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-3194- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h=3902=struct iwl_wipan_p2p_channel_switch_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-3913- *\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h:3914: * In beacons, the NoA schedule is simply appended\ndrivers/net/wireless/intel/iwlwifi/dvm/commands.h-3915- * to the frame we give the device.\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=29=static const struct file_operations iwl_dbgfs_##name##_ops = {          \\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-30-\t.read = iwl_dbgfs_##name##_read,\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:31:\t.open = simple_open,\t\t\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-32-\t.llseek = generic_file_llseek,\t\t\t\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=36=static const struct file_operations iwl_dbgfs_##name##_ops = {          \\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-37-\t.write = iwl_dbgfs_##name##_write,                              \\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:38:\t.open = simple_open,\t\t\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-39-\t.llseek = generic_file_llseek,\t\t\t\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=44=static const struct file_operations iwl_dbgfs_##name##_ops = {          \\\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-46-\t.read = iwl_dbgfs_##name##_read,                                \\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:47:\t.open = simple_open,\t\t\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-48-\t.llseek = generic_file_llseek,\t\t\t\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=51=static ssize_t iwl_dbgfs_sram_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-135-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:136:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-137-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=169=static ssize_t iwl_dbgfs_wowlan_sram_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-178-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:179:\treturn simple_read_from_buffer(user_buf, count, ppos,\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-180-\t\t\t\t       priv-\u003ewowlan_sram,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=183=static ssize_t iwl_dbgfs_stations_read(struct file *file, char __user *user_buf,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-233-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:234:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-235-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=239=static ssize_t iwl_dbgfs_nvm_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-272-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:273:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-274-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=278=static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-337-\t}\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:338:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-339-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=343=static ssize_t iwl_dbgfs_status_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-373-\t\ttest_bit(STATUS_FW_ERROR, \u0026priv-\u003estatus));\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:374:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-375-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=377=static ssize_t iwl_dbgfs_rx_handlers_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-400-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:401:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-402-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=429=static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-452-\t}\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:453:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-454-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=456=static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-484-\t}\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:485:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-486-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=511=static ssize_t iwl_dbgfs_disable_ht40_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-522-\t\t\tpriv-\u003edisable_ht40 ? \"Disabled\" : \"Enabled\");\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:523:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-524-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=526=static ssize_t iwl_dbgfs_temperature_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-535-\tpos += scnprintf(buf + pos, bufsz - pos, \"%d\\n\", priv-\u003etemperature);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:536:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-537-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=582=static ssize_t iwl_dbgfs_sleep_level_override_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-596-\tpos = scnprintf(buf, bufsz, \"%d\\n\", value);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:597:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-598-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=600=static ssize_t iwl_dbgfs_current_sleep_command_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-620-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:621:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-622-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=666=static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1093-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1094:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1095-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1099=static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1290-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1291:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1292-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1296=static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1410-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1411:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1412-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1416=static ssize_t iwl_dbgfs_ucode_bt_stats_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1498-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1499:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1500-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1504=static ssize_t iwl_dbgfs_reply_tx_error_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1640-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1641:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1642-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1646=static ssize_t iwl_dbgfs_sensitivity_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1718-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1719:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1720-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1725=static ssize_t iwl_dbgfs_chain_noise_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1775-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1776:\tret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1777-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1781=static ssize_t iwl_dbgfs_power_save_status_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1800-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1801:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1802-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1828=static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1845-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1846:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1847-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1879=static ssize_t iwl_dbgfs_rxon_flags_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1888-\t\tle32_to_cpu(priv-\u003econtexts[IWL_RXON_CTX_BSS].active.flags));\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1889:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, len);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1890-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1892=static ssize_t iwl_dbgfs_rxon_filter_flags_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1901-\t\tle32_to_cpu(priv-\u003econtexts[IWL_RXON_CTX_BSS].active.filter_flags));\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1902:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, len);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1903-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1905=static ssize_t iwl_dbgfs_missed_beacon_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1916-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1917:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1918-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1946=static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1957-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:1958:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-1959-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=1985=static ssize_t iwl_dbgfs_rf_reset_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2006-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:2007:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2008-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=2045=static ssize_t iwl_dbgfs_bt_traffic_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2055-\t\tpos += scnprintf(buf + pos, bufsz - pos, \"BT coex disabled\\n\");\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:2056:\t\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2057-\t}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2086-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:2087:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2088-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=2090=static ssize_t iwl_dbgfs_protection_mode_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2108-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:2109:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2110-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=2172=static ssize_t iwl_dbgfs_log_event_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2181-\tif (ret \u003e 0)\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:2182:\t\tret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2183-\tkfree(buf);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c=2213=static ssize_t iwl_dbgfs_calib_disabled_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2237-\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c:2238:\treturn simple_read_from_buffer(user_buf, count, ppos, buf, pos);\ndrivers/net/wireless/intel/iwlwifi/dvm/debugfs.c-2239-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/mac80211.c=1388=static int iwlagn_mac_change_interface(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/mac80211.c-1406-\t/*\ndrivers/net/wireless/intel/iwlwifi/dvm/mac80211.c:1407:\t * To simplify this code, only support changes on the\ndrivers/net/wireless/intel/iwlwifi/dvm/mac80211.c-1408-\t * BSS context. The PAN context is usually reassigned\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=2157=static void rs_rate_scale_perform(struct iwl_priv *priv,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-2600- *       if the driver's iwl-agn-rs rate scaling algorithm is used, instead of\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:2601: *       rc80211_simple.\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-2602- *\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=3061=static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3157-\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3158:\tret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3159-\tkfree(buff);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=3163=static const struct file_operations rs_sta_dbgfs_scale_table_ops = {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3165-\t.read = rs_sta_dbgfs_scale_table_read,\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3166:\t.open = simple_open,\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3167-\t.llseek = default_llseek,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=3169=static ssize_t rs_sta_dbgfs_stats_table_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3201-\t}\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3202:\tret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3203-\tkfree(buff);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=3207=static const struct file_operations rs_sta_dbgfs_stats_table_ops = {\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3208-\t.read = rs_sta_dbgfs_stats_table_read,\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3209:\t.open = simple_open,\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3210-\t.llseek = default_llseek,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=3213=static ssize_t rs_sta_dbgfs_rate_scale_data_read(struct file *file,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3229-\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3230:\treturn simple_read_from_buffer(user_buf, count, ppos, buff, desc);\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3231-}\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=3233=static const struct file_operations rs_sta_dbgfs_rate_scale_data_ops = {\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3234-\t.read = rs_sta_dbgfs_rate_scale_data_read,\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3235:\t.open = simple_open,\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3236-\t.llseek = default_llseek,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/scan.c=36=static int iwl_send_scan_abort(struct iwl_priv *priv)\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/scan.c-60-\t\t * 2 for \"failure\".  A failure condition can be\ndrivers/net/wireless/intel/iwlwifi/dvm/scan.c:61:\t\t * due to simply not being in an active scan which\ndrivers/net/wireless/intel/iwlwifi/dvm/scan.c-62-\t\t * can occur if we send the scan abort before we\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h=211=enum iwl_tof_responder_cfg_flags {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-238- * @toa_offset: Artificial addition [pSec] for the ToA - to be used for debug\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h:239: *\tpurposes, simulating station movement by adding various values\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-240- *\tto this field\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h=246=struct iwl_tof_responder_config_cmd_v6 {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-274- * @toa_offset: Artificial addition [pSec] for the ToA - to be used for debug\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h:275: *\tpurposes, simulating station movement by adding various values\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-276- *\tto this field\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h=282=struct iwl_tof_responder_config_cmd_v7 {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-313- * @toa_offset: Artificial addition [pSec] for the ToA - to be used for debug\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h:314: *\tpurposes, simulating station movement by adding various values\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-315- *\tto this field\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h=330=struct iwl_tof_responder_config_cmd_v8 {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-359- * @toa_offset: Artificial addition [pSec] for the ToA - to be used for debug\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h:360: *\tpurposes, simulating station movement by adding various values\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-361- *\tto this field\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h=380=struct iwl_tof_responder_config_cmd_v9 {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-411- * @toa_offset: Artificial addition [pSec] for the ToA - to be used for debug\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h:412: *\tpurposes, simulating station movement by adding various values\ndrivers/net/wireless/intel/iwlwifi/fw/api/location.h-413- *\tto this field\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h=96=enum iwl_power_flags {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h-112- *\tis used also with a new\tpower API for device wide power settings.\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h:113: * POWER_TABLE_CMD = 0x77 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h-114- *\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h=157=enum iwl_device_power_flags {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h-165- * struct iwl_device_power_cmd - device wide power command.\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h:166: * DEVICE_POWER_CMD = 0x77 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h-167- *\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h=171=struct iwl_device_power_cmd {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h-178- * struct iwl_mac_power_cmd - New power command containing uAPSD support\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h:179: * MAC_PM_POWER_TABLE = 0xA9 (command, has simple generic response)\ndrivers/net/wireless/intel/iwlwifi/fw/api/power.h-180- * @id_and_color:\tMAC contex identifier, \u0026enum iwl_ctxt_id_and_color\n--\ndrivers/net/wireless/intel/iwlwifi/fw/dbg.h=156=static inline void\ndrivers/net/wireless/intel/iwlwifi/fw/dbg.h:157:_iwl_fw_dbg_trigger_simple_stop(struct iwl_fw_runtime *fwrt,\ndrivers/net/wireless/intel/iwlwifi/fw/dbg.h-158-\t\t\t\tstruct wireless_dev *wdev,\n--\ndrivers/net/wireless/intel/iwlwifi/fw/dbg.h-169-\ndrivers/net/wireless/intel/iwlwifi/fw/dbg.h:170:#define iwl_fw_dbg_trigger_simple_stop(fwrt, wdev, trig)\t\\\ndrivers/net/wireless/intel/iwlwifi/fw/dbg.h:171:\t_iwl_fw_dbg_trigger_simple_stop((fwrt), (wdev),\t\t\\\ndrivers/net/wireless/intel/iwlwifi/fw/dbg.h-172-\t\t\t\t\tiwl_fw_dbg_get_trigger((fwrt)-\u003efw,\\\n--\ndrivers/net/wireless/intel/iwlwifi/fw/debugfs.c=36=static ssize_t _iwl_dbgfs_##name##_read(struct file *file,\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/fw/debugfs.c-50-\t\treturn data-\u003erlen;\t\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/fw/debugfs.c:51:\treturn simple_read_from_buffer(user_buf, count, ppos,\t\t\\\ndrivers/net/wireless/intel/iwlwifi/fw/debugfs.c-52-\t\t\t\t       data-\u003erbuf, data-\u003erlen);\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/fw/uefi.h=241=struct uefi_cnv_wpfc_data {\n--\ndrivers/net/wireless/intel/iwlwifi/fw/uefi.h-247- * This is known to be broken on v4.19 and to work on v5.4.  Until we\ndrivers/net/wireless/intel/iwlwifi/fw/uefi.h:248: * figure out why this is the case and how to make it work, simply\ndrivers/net/wireless/intel/iwlwifi/fw/uefi.h-249- * disable the feature in old kernels.\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-csr.h-17- * Use iwl_write32() and iwl_read32() family to access these registers;\ndrivers/net/wireless/intel/iwlwifi/iwl-csr.h:18: * these provide simple PCI bus access, without waking up the MAC.\ndrivers/net/wireless/intel/iwlwifi/iwl-csr.h-19- * Do not use iwl_write_direct32() family for these registers;\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-csr.h=321=enum {\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-csr.h-508- * Do not use iwl_write32()/iwl_read32() family to access these registers;\ndrivers/net/wireless/intel/iwlwifi/iwl-csr.h:509: * these provide only simple PCI bus access, without waking up the MAC.\ndrivers/net/wireless/intel/iwlwifi/iwl-csr.h-510- */\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-debug.h=102=do {                                            \t\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-debug.h-113- *\ndrivers/net/wireless/intel/iwlwifi/iwl-debug.h:114: * If you are defining a new debug classification, simply add it to the #define\ndrivers/net/wireless/intel/iwlwifi/iwl-debug.h-115- * list here in the form of\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-op-mode.h=20=struct iwl_rf_cfg;\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-op-mode.h-36- *\ndrivers/net/wireless/intel/iwlwifi/iwl-op-mode.h:37: * The operational mode has a very simple life cycle.\ndrivers/net/wireless/intel/iwlwifi/iwl-op-mode.h-38- *\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-utils.c=86=static u32 iwl_div_by_db(u32 value, u8 db)\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-utils.c-88-\t/*\ndrivers/net/wireless/intel/iwlwifi/iwl-utils.c:89:\t * 2^32 * 10**(i / 10) for i = [1, 10], skipping 0 and simply stopping\ndrivers/net/wireless/intel/iwlwifi/iwl-utils.c-90-\t * at 10 dB and looping instead of using a much larger table.\n--\ndrivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h-174- * CSME can transmit packets, through the netdev that it gets from the wifi\ndrivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h:175: * driver. It'll send packet in the 802.3 format and simply call\ndrivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h-176- * dev_queue_xmit.\n--\ndrivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h=428=void iwl_mei_set_netdev(struct net_device *netdev);\n--\ndrivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h-436- *\ndrivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h:437: * This function doesn't take any lock, it simply tries to catch DHCP\ndrivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h-438- * packets sent by the wifi driver. If the packet is a DHCP packet, it\n--\ndrivers/net/wireless/intel/iwlwifi/mei/main.c=1900=static const struct file_operations iwl_mei_dbgfs_send_start_message_ops = {\ndrivers/net/wireless/intel/iwlwifi/mei/main.c-1901-\t.write = iwl_mei_dbgfs_send_start_message_write,\ndrivers/net/wireless/intel/iwlwifi/mei/main.c:1902:\t.open = simple_open,\ndrivers/net/wireless/intel/iwlwifi/mei/main.c-1903-\t.llseek = default_llseek,\n--\ndrivers/net/wireless/intel/iwlwifi/mei/main.c=1915=static const struct file_operations iwl_mei_dbgfs_req_ownership_ops = {\ndrivers/net/wireless/intel/iwlwifi/mei/main.c-1916-\t.write = iwl_mei_dbgfs_req_ownership_write,\ndrivers/net/wireless/intel/iwlwifi/mei/main.c:1917:\t.open = simple_open,\ndrivers/net/wireless/intel/iwlwifi/mei/main.c-1918-\t.llseek = default_llseek,\n--\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h=35=static ssize_t _iwl_dbgfs_##name##_read(struct file *file,\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h-49-\t\treturn data-\u003erlen;\t\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h:50:\treturn simple_read_from_buffer(user_buf, count, ppos,\t\t\\\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h-51-\t\t\t\t       data-\u003ebuf, data-\u003erlen);\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h=101=static ssize_t __iwl_dbgfs_##name##_write(struct file *file,\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h-119-\t\t.write = __iwl_dbgfs_##name##_write,\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h:120:\t\t.open = simple_open,\t\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h-121-\t\t.llseek = generic_file_llseek,\t\t\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h=162=static ssize_t __iwl_dbgfs_##name##_read(struct file *file,\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h-179-\t\treturn data-\u003erlen;\t\t\t\t\t\\\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h:180:\treturn simple_read_from_buffer(user_buf, count, ppos,\t\t\\\ndrivers/net/wireless/intel/iwlwifi/mld/debugfs.h-181-\t\t\t\t       data-\u003ebuf, data-\u003erlen);\t\t\\\n--\ndrivers/net/wireless/intel/iwlwifi/mld/mac80211.c=1369=iwl_mld_mac80211_cancel_hw_scan(struct ieee80211_hw *hw,\n\n"
}

gemini-3.7-flash

null

null

							input: 16320
							output: 45
							thoughts: 24
						

Here's my attempt at summarizing that thought process, tailored for an expert audience:

**Diving into the iwlwifi Driver**

Okay, so I'm poking around the kernel's iwlwifi driver code. I'm primarily interested in understanding its interactions. Specifically, I want to trace how it hooks into the system. My first line of investigation will be to figure out the bus registrations. What buses does this driver initialize with? PCI? USB? Perhaps even SDIO or something more obscure, depending on the Intel wireless chipsets it supports? I need to get a clear picture of its device probing and driver binding mechanisms. Understanding the bus interactions will then dictate which kernel components or configurations, if any, I need to focus my attention.

{
  "Expression": "module_pci_driver|pci_register_driver",
  "PathPrefix": "drivers/net/wireless/intel/iwlwifi/"
}

{
  "Output": "drivers/net/wireless/intel/iwlwifi/iwl-drv.c=2062=static int __init iwl_drv_init(void)\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-drv.c-2073-\ndrivers/net/wireless/intel/iwlwifi/iwl-drv.c:2074:\terr = iwl_pci_register_driver();\ndrivers/net/wireless/intel/iwlwifi/iwl-drv.c-2075-\tif (err)\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-trans.h=1212=static inline void iwl_trans_notify_fw_error(struct iwl_trans *trans)\n--\ndrivers/net/wireless/intel/iwlwifi/iwl-trans.h-1219- *****************************************************/\ndrivers/net/wireless/intel/iwlwifi/iwl-trans.h:1220:int __must_check iwl_pci_register_driver(void);\ndrivers/net/wireless/intel/iwlwifi/iwl-trans.h-1221-void iwl_pci_unregister_driver(void);\n--\ndrivers/net/wireless/intel/iwlwifi/pcie/drv.c=1323=static struct pci_driver iwl_pci_driver = {\n--\ndrivers/net/wireless/intel/iwlwifi/pcie/drv.c-1331-\ndrivers/net/wireless/intel/iwlwifi/pcie/drv.c:1332:int __must_check iwl_pci_register_driver(void)\ndrivers/net/wireless/intel/iwlwifi/pcie/drv.c-1333-{\ndrivers/net/wireless/intel/iwlwifi/pcie/drv.c-1334-\tint ret;\ndrivers/net/wireless/intel/iwlwifi/pcie/drv.c:1335:\tret = pci_register_driver(\u0026iwl_pci_driver);\ndrivers/net/wireless/intel/iwlwifi/pcie/drv.c-1336-\tif (ret)\n"
}

gemini-3.7-flash

null

null

							input: 17088
							output: 39
							thoughts: 25
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Investigating iwlwifi Bus Support**

Alright, let's get down to brass tacks. I need to make sure we're not just tunnel-visioned on PCI for the iwlwifi driver. It's time to dig deeper and see if the driver is designed to support other bus types. I'm thinking specifically about possibilities beyond PCI – are we looking at USB implementations, or perhaps platform-specific integrations? This is important; if we're only considering PCI, we could be missing a whole ecosystem of potential hardware that could leverage this driver. Expansion here could be huge. Time to map out the different possibilities.

no matches

{
  "Expression": "driver_register|platform_driver",
  "PathPrefix": "drivers/net/wireless/intel/iwlwifi/"
}

{
  "error": "no matches"
}

gemini-3.7-flash

null

null

							input: 17319
							output: 47
							thoughts: 352
						

**Analyzing the Potential for Fuzzing with the iwlwifi Driver**

Okay, so I'm looking at a patch related to the `iwlwifi` driver, specifically the PCI driver `iwl_pci_driver`. My immediate thought is to determine if this patch is a good candidate for fuzzing, and I need to apply the rules outlined. I'll need to check the patch details and see if any of the criteria that would make it *not* fuzzable apply.

First, I need to know precisely what's changed. The file is `drivers/net/wireless/intel/iwlwifi/mvm/scan.c`, which makes me think it's dealing with the Multi-Virtual Machine (MVM) architecture of iwlwifi. The function in question is `iwl_mvm_rx_umac_scan_complete_notif`. The name is a mouthful, but if it is related to "scan complete notification" I can imagine it being triggered based on external input, which makes me feel pretty optimistic about its suitability for fuzzing at this stage.

Now, I'll carefully read the code within `iwl_mvm_rx_umac_scan_complete_notif` and see if the patch introduces any modifications that could be covered by the negative rules, to be certain. I know the general structure of the wireless subsystem and I know the potential pitfalls, so I'll be looking carefully at data structures and how this notification interacts with the MAC layer. I'm especially interested in whether the changes introduce new data paths, alter control flow significantly, or handle external data that might be susceptible to manipulation. Let's see...

{
  "File": "drivers/net/wireless/intel/iwlwifi/mvm/scan.c",
  "FirstLine": 3200,
  "LineCount": 60
}

{
  "Contents": "3200:\t\t\t/* If the scan failed, it usually means that the FW was unable\n3201:\t\t\t * to allocate the time events. Warn on it, but maybe we\n3202:\t\t\t * should try to send the command again with different params.\n3203:\t\t\t */\n3204:\t\t\tIWL_ERR(mvm, \"Sched scan failed! ret %d\\n\", ret);\n3205:\t\t\tmvm-\u003esched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;\n3206:\t\t}\n3207:\t\n3208:\tout:\n3209:\t\tif (non_psc_included)\n3210:\t\t\tkfree(params.channels);\n3211:\t\treturn ret;\n3212:\t}\n3213:\t\n3214:\tvoid iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,\n3215:\t\t\t\t\t\t struct iwl_rx_cmd_buffer *rxb)\n3216:\t{\n3217:\t\tstruct iwl_rx_packet *pkt = rxb_addr(rxb);\n3218:\t\tstruct iwl_umac_scan_complete *notif = (void *)pkt-\u003edata;\n3219:\t\tu32 uid = __le32_to_cpu(notif-\u003euid);\n3220:\t\tbool aborted = (notif-\u003estatus == IWL_SCAN_OFFLOAD_ABORTED);\n3221:\t\n3222:\t\tmvm-\u003emei_scan_filter.is_mei_limited_scan = false;\n3223:\t\n3224:\t\tif (IWL_FW_CHECK(mvm, uid \u003e= ARRAY_SIZE(mvm-\u003escan_uid_status),\n3225:\t\t\t\t \"FW reports out-of-range scan UID %d\\n\", uid))\n3226:\t\t\treturn;\n3227:\t\n3228:\t\tIWL_DEBUG_SCAN(mvm,\n3229:\t\t\t       \"Scan completed: uid=%u type=%u, status=%s, EBS=%s\\n\",\n3230:\t\t\t       uid, mvm-\u003escan_uid_status[uid],\n3231:\t\t\t       notif-\u003estatus == IWL_SCAN_OFFLOAD_COMPLETED ?\n3232:\t\t\t\t\t\"completed\" : \"aborted\",\n3233:\t\t\t       iwl_mvm_ebs_status_str(notif-\u003eebs_status));\n3234:\t\n3235:\t\tIWL_DEBUG_SCAN(mvm, \"Scan completed: scan_status=0x%x\\n\",\n3236:\t\t\t       mvm-\u003escan_status);\n3237:\t\n3238:\t\tIWL_DEBUG_SCAN(mvm,\n3239:\t\t\t       \"Scan completed: line=%u, iter=%u, elapsed time=%u\\n\",\n3240:\t\t\t       notif-\u003elast_schedule, notif-\u003elast_iter,\n3241:\t\t\t       __le32_to_cpu(notif-\u003etime_from_last_iter));\n3242:\t\n3243:\t\tif (WARN_ON(!(mvm-\u003escan_uid_status[uid] \u0026 mvm-\u003escan_status)))\n3244:\t\t\treturn;\n3245:\t\n3246:\t\t/* if the scan is already stopping, we don't need to notify mac80211 */\n3247:\t\tif (mvm-\u003escan_uid_status[uid] == IWL_MVM_SCAN_REGULAR) {\n3248:\t\t\tstruct cfg80211_scan_info info = {\n3249:\t\t\t\t.aborted = aborted,\n3250:\t\t\t\t.scan_start_tsf = mvm-\u003escan_start,\n3251:\t\t\t};\n3252:\t\t\tstruct iwl_mvm_vif *scan_vif = mvm-\u003escan_vif;\n3253:\t\t\tstruct iwl_mvm_vif_link_info *link_info =\n3254:\t\t\t\tscan_vif-\u003elink[mvm-\u003escan_link_id];\n3255:\t\n3256:\t\t\t/* It is possible that by the time the scan is complete the link\n3257:\t\t\t * was already removed and is not valid.\n3258:\t\t\t */\n3259:\t\t\tif (link_info)\n"
}

gemini-3.7-flash

null

null

							input: 19183
							output: 94
							thoughts: 485
						

**My Assessment: Unfuzzable Code Path**

Okay, so looking at this code, `iwl_mvm_rx_umac_scan_complete_notif`... it's a firmware RX notification handler specifically for Intel Wi-Fi devices, part of the `iwlwifi` driver.  The *crucial* point here is that this driver, and by extension this function, requires actual, *physical* Intel PCIe Wi-Fi hardware. We're talking about cards like the 7260, 8260, the AX series, and BE200. These cards aren't just plug-and-play; they also need specific firmware blobs loaded onto the hardware itself.

Now, standard virtual machines like those on QEMU or Google Compute Engine? They *don't* emulate this kind of Intel Wi-Fi PCIe hardware. You might have software-emulated Wi-Fi in the kernel, sure, like `mac80211_hwsim`, but that's a completely different animal – a *virtual* mac80211 driver. This specific function, `iwl_mvm_rx_umac_scan_complete_notif`, is an RX notification from the *Intel firmware* itself, handled by the `iwl_rx_packet` function. This notification cannot be triggered or reached in a virtualized environment *unless* you have physical Intel Wi-Fi hardware present.

Therefore, this falls directly into the category of code that's *impossible* to reach in those kinds of virtualized environments, even with some level of emulated hardware such as `mac80211_hwsim`. Also the same thing happens with code that is in drivers that need physical PCIe hardware, such as SmartNICs, GPUs, and PCIe switches.

So, in essence, it seems like we're not going to be able to make use of this code, so let's verify that we have everything that we need.

`WorthFuzzing`: Definitely *false*.
`FocusSymbols`: We don't have any specific symbols to target.
`EnableConfigs`: Also empty, nothing to enable.
`Reasoning`: We have a concise explanation of why.

Looks like we're good to go. Let's call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch adds a bounds check in iwl_mvm_rx_umac_scan_complete_notif() within the Intel Wi-Fi driver (iwlwifi). This driver requires physical Intel PCIe wireless hardware and firmware, which cannot be reached in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch adds a bounds check in iwl_mvm_rx_umac_scan_complete_notif() within the Intel Wi-Fi driver (iwlwifi). This driver requires physical Intel PCIe wireless hardware and firmware, which cannot be reached in virtualized environments like QEMU or GCE.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null