AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/08/26 04:48 flow patch-triage
1m Args: 
null

Results: 
{
  "EnableConfigs": [
    "MT7925U"
  ],
  "FocusSymbols": [
    "mt7925_change_vif_links"
  ],
  "KMSANReasoning": "The patch modifies the logic for changing VIF links in the mt7925 driver by adding a condition to remove and re-add a BSS link when transitioning from having valid links to no valid links. This is a state machine and firmware synchronization fix. It does not introduce any new allocations, structures sent to user space, or complex data structures where uninitialized fields could be read. Any potential bugs related to this change would involve use-after-free, out-of-bounds accesses, or logic errors, which are well-covered by KASAN and standard bug detectors. There is no risk of uninitialized memory usage or info-leaks that would necessitate KMSAN.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies `mt7925_change_vif_links` in the MediaTek MT7925 wireless driver to restore the legacy BSS when links are removed. This is a functional change in the mac80211 driver operations. The driver has a USB variant (MT7925U) which can be fuzzed via USB emulation (dummy_hcd) in virtualized environments.",
  "WorthFuzzing": true
}
1/1 2026/08/26 04:48 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit 908edf9b1eef340a9c5508b280492949594209de\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Aug 26 04:48:18 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c\nindex 84b55f008b3d3..c7ced2efd4d7c 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c\n@@ -2294,6 +2294,21 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n \n \tmvif-\u003evalid_links = new_links;\n \n+\t/* The firmware would keep the MLD BSS and DEV entry: the removal\n+\t * loop skips the deflink and the hweight16() fallback above reads\n+\t * the stale pre-update valid_links. Restore the legacy BSS.\n+\t */\n+\tif (old_links \u0026\u0026 !new_links) {\n+\t\tmt792x_mac_link_bss_remove(dev, \u0026mvif-\u003ebss_conf,\n+\t\t\t\t\t   \u0026mvif-\u003esta.deflink);\n+\t\terr = mt7925_mac_link_bss_add(dev, \u0026vif-\u003ebss_conf,\n+\t\t\t\t\t      \u0026mvif-\u003esta.deflink);\n+\t\tif (err \u003c 0) {\n+\t\t\tmt792x_mutex_release(dev);\n+\t\t\treturn err;\n+\t\t}\n+\t}\n+\n \tmt792x_mutex_release(dev);\n \n \treturn 0;\n"
}
2/1 2026/08/26 04:48 agent patch-evaluator
0m Model: 
best-expensive

Args: 
null

Results: 
{
  "EnableConfigs": [
    "MT7925U"
  ],
  "FocusSymbols": [
    "mt7925_change_vif_links"
  ],
  "Reasoning": "The patch modifies `mt7925_change_vif_links` in the MediaTek MT7925 wireless driver to restore the legacy BSS when links are removed. This is a functional change in the mac80211 driver operations. The driver has a USB variant (MT7925U) which can be fuzzed via USB emulation (dummy_hcd) in virtualized environments.",
  "WorthFuzzing": true
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit 908edf9b1eef340a9c5508b280492949594209de
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Aug 26 04:48:18 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 84b55f008b3d3..c7ced2efd4d7c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2294,6 +2294,21 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 
 	mvif->valid_links = new_links;
 
+	/* The firmware would keep the MLD BSS and DEV entry: the removal
+	 * loop skips the deflink and the hweight16() fallback above reads
+	 * the stale pre-update valid_links. Restore the legacy BSS.
+	 */
+	if (old_links && !new_links) {
+		mt792x_mac_link_bss_remove(dev, &mvif->bss_conf,
+					   &mvif->sta.deflink);
+		err = mt7925_mac_link_bss_add(dev, &vif->bss_conf,
+					      &mvif->sta.deflink);
+		if (err < 0) {
+			mt792x_mutex_release(dev);
+			return err;
+		}
+	}
+
 	mt792x_mutex_release(dev);
 
 	return 0;

3/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 2219
							output: 38
							thoughts: 134

Thoughts: 
**Analyzing a Driver Patch**

Okay, so I'm looking at a patch for the `mt7925_change_vif_links` function within `drivers/net/wireless/mediatek/mt76/mt7925/main.c`. This places it firmly within the MediaTek MT7925 wireless driver, which I'm familiar with. But a thought immediately pops up: can I *test* this in QEMU? These MT76 drivers are *typically* targeted at physical hardware – PCIe or USB devices. I need to figure out if there's even a USB variant of the MT7925. Time to fire up `grep` and search within Kconfig, or at least a quick scan through the driver files, to see if there's any indication of a USB support path. Without that, this patch is going to be significantly more cumbersome to evaluate.

4/2 2026/08/26 04:48 tool grepper
0m Args: 
{
  "Expression": "mt7925",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

Results: 
{
  "Output": "\nFull output is too long, showing 500 out of 4097 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Kconfig=50=source \"drivers/net/wireless/mediatek/mt76/mt7996/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:51:source \"drivers/net/wireless/mediatek/mt76/mt7925/Kconfig\"\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=51=obj-$(CONFIG_MT7996E) += mt7996/\ndrivers/net/wireless/mediatek/mt76/Makefile:52:obj-$(CONFIG_MT7925_COMMON) += mt7925/\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=180=static inline bool is_connac3(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-184-\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:185:static inline bool is_mt7925(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-186-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=54=int mt76_connac_mcu_init_download(struct mt76_dev *dev, u32 addr, u32 len,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-69-\t    (is_connac2(dev) \u0026\u0026 addr == 0x900000) ||\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:70:\t    ((is_mt7925(dev) || is_mt7927(dev)) \u0026\u0026 (addr == 0x900000 || addr == 0xe0002800)) ||\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-71-\t    (is_mt7928(dev) \u0026\u0026 (addr == 0x900000 || addr == 0xe0002000)) ||\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:3:obj-$(CONFIG_MT7925_COMMON) += mt7925-common.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:4:obj-$(CONFIG_MT7925E) += mt7925e.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:5:obj-$(CONFIG_MT7925U) += mt7925u.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile-6-\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:7:mt7925-common-y := mac.o mcu.o regd.o main.o init.o debugfs.o nan.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:8:mt7925-common-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:9:mt7925e-y := pci.o pci_mac.o pci_mcu.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:10:mt7925u-y := usb.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-3-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:4:#include \"mt7925.h\"\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-5-#include \"mcu.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=7=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:8:mt7925_reg_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-9-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-13-\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:14:\tmt7925_mcu_regval(dev, dev-\u003emt76.debugfs_reg, \u0026regval, true);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-15-\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=20=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:21:mt7925_reg_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-22-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-27-\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:28:\tret = mt7925_mcu_regval(dev, dev-\u003emt76.debugfs_reg, \u0026regval, false);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-29-\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-35-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:36:DEFINE_DEBUGFS_ATTRIBUTE(fops_regval, mt7925_reg_get, mt7925_reg_set,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-37-\t\t\t \"0x%08llx\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=38=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:39:mt7925_fw_debug_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-40-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-45-\tdev-\u003efw_debug = (u8)val;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:46:\tmt7925_mcu_fw_log_2_host(dev, dev-\u003efw_debug);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-47-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=53=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:54:mt7925_fw_debug_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-55-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-62-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:63:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug, mt7925_fw_debug_get,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:64:\t\t\t mt7925_fw_debug_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-65-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=68=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:69:mt7925_seq_puts_array(struct seq_file *file, const char *str,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-70-\t\t      s8 val[][2], int len, u8 band_idx)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-82-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:83:#define mt7925_print_txpwr_entry(prefix, rate, idx)\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-84-({\t\t\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:85:\tmt7925_seq_puts_array(s, #prefix \" (tmac)\",\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-86-\t\t\t      txpwr-\u003erate,\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=91=static inline void\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:92:mt7925_eht_txpwr(struct seq_file *s, struct mt7925_txpwr *txpwr, u8 band_idx)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-93-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-97-\t\t   \"mcs12\", \"mcs13\", \"mcs14\", \"mcs15\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:98:\tmt7925_print_txpwr_entry(EHT26, eht26, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:99:\tmt7925_print_txpwr_entry(EHT52, eht52, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:100:\tmt7925_print_txpwr_entry(EHT106, eht106, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:101:\tmt7925_print_txpwr_entry(EHT242, eht242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:102:\tmt7925_print_txpwr_entry(EHT484, eht484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-103-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:104:\tmt7925_print_txpwr_entry(EHT996, eht996, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:105:\tmt7925_print_txpwr_entry(EHT996x2, eht996x2, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:106:\tmt7925_print_txpwr_entry(EHT996x4, eht996x4, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:107:\tmt7925_print_txpwr_entry(EHT26_52, eht26_52, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:108:\tmt7925_print_txpwr_entry(EHT26_106, eht26_106, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:109:\tmt7925_print_txpwr_entry(EHT484_242, eht484_242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:110:\tmt7925_print_txpwr_entry(EHT996_484, eht996_484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:111:\tmt7925_print_txpwr_entry(EHT996_484_242, eht996_484_242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:112:\tmt7925_print_txpwr_entry(EHT996x2_484, eht996x2_484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:113:\tmt7925_print_txpwr_entry(EHT996x3, eht996x3, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:114:\tmt7925_print_txpwr_entry(EHT996x3_484, eht996x3_484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-115-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=117=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:118:mt7925_txpwr(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-119-{\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-120-\tstruct mt792x_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:121:\tstruct mt7925_txpwr *txpwr = NULL;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-122-\tu8 band_idx = dev-\u003emphy.band_idx;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-130-\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:131:\tret = mt7925_get_txpwr_info(dev, band_idx, txpwr);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-132-\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-138-\t\t   \" \", \"1m\", \"2m\", \"5m\", \"11m\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:139:\tmt7925_print_txpwr_entry(CCK, cck, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-140-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-143-\t\t   \"48m\", \"54m\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:144:\tmt7925_print_txpwr_entry(OFDM, ofdm, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-145-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-148-\t\t   \"mcs6\", \"mcs7\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:149:\tmt7925_print_txpwr_entry(HT20, ht20, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-150-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-153-\t\t   \"mcs6\", \"mcs7\", \"mcs32\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:154:\tmt7925_print_txpwr_entry(HT40, ht40, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-155-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-158-\t\t   \"mcs6\", \"mcs7\", \"mcs8\", \"mcs9\", \"mcs10\", \"mcs11\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:159:\tmt7925_print_txpwr_entry(VHT20, vht20, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:160:\tmt7925_print_txpwr_entry(VHT40, vht40, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-161-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:162:\tmt7925_print_txpwr_entry(VHT80, vht80, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:163:\tmt7925_print_txpwr_entry(VHT160, vht160, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-164-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:165:\tmt7925_print_txpwr_entry(HE26, he26, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:166:\tmt7925_print_txpwr_entry(HE52, he52, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:167:\tmt7925_print_txpwr_entry(HE106, he106, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:168:\tmt7925_print_txpwr_entry(HE242, he242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:169:\tmt7925_print_txpwr_entry(HE484, he484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-170-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:171:\tmt7925_print_txpwr_entry(HE996, he996, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:172:\tmt7925_print_txpwr_entry(HE996x2, he996x2, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-173-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:174:\tmt7925_eht_txpwr(s, txpwr, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-175-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=181=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:182:mt7925_pm_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-183-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-205-\tpm-\u003eenable_user = val;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:206:\tmt7925_set_runtime_pm(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-207-\tmt76_connac_power_save_sched(\u0026dev-\u003emphy, pm);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=214=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:215:mt7925_pm_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-216-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-223-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:224:DEFINE_DEBUGFS_ATTRIBUTE(fops_pm, mt7925_pm_get, mt7925_pm_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-225-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=226=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:227:mt7925_deep_sleep_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-228-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-242-\tpm-\u003eds_enable = enable \u0026\u0026 !monitor;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:243:\tmt7925_mcu_set_deep_sleep(dev, pm-\u003eds_enable);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-244-out:\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=250=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:251:mt7925_deep_sleep_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-252-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-259-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:260:DEFINE_DEBUGFS_ATTRIBUTE(fops_ds, mt7925_deep_sleep_get,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:261:\t\t\t mt7925_deep_sleep_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-262-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=263=DEFINE_DEBUGFS_ATTRIBUTE(fops_pm_idle_timeout, mt792x_pm_idle_timeout_get,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-265-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:266:static int mt7925_chip_reset(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-267-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-278-\t\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:279:\t\tret = mt7925_mcu_chip_config(dev, \"assert\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-280-\t\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-286-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:287:DEFINE_DEBUGFS_ATTRIBUTE(fops_reset, NULL, mt7925_chip_reset, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-288-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:289:int mt7925_init_debugfs(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-290-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-304-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"txpower_sku\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:305:\t\t\t\t    mt7925_txpwr);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-306-\tdebugfs_create_file(\"tx_stats\", 0400, dir, dev, \u0026mt792x_tx_stats_fops);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-8-#include \u003clinux/firmware.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:9:#include \"mt7925.h\"\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-10-#include \"regd.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-13-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:14:static ssize_t mt7925_thermal_temp_show(struct device *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-15-\t\t\t\t\tstruct device_attribute *attr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-24-\t\tmt792x_mutex_acquire(mdev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:25:\t\ttemperature = mt7925_mcu_get_temperature(phy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-26-\t\tmt792x_mutex_release(mdev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-36-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:37:static SENSOR_DEVICE_ATTR_RO(temp1_input, mt7925_thermal_temp, 0);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-38-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:39:static struct attribute *mt7925_hwmon_attrs[] = {\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-40-\t\u0026sensor_dev_attr_temp1_input.dev_attr.attr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-42-};\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:43:ATTRIBUTE_GROUPS(mt7925_hwmon);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-44-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:45:static int mt7925_thermal_init(struct mt792x_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-46-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-53-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:54:\tname = devm_kasprintf(\u0026wiphy-\u003edev, GFP_KERNEL, \"mt7925_%s\",\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-55-\t\t\t      wiphy_name(wiphy));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-59-\thwmon = devm_hwmon_device_register_with_groups(\u0026wiphy-\u003edev, name, phy,\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:60:\t\t\t\t\t\t       mt7925_hwmon_groups);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-61-\treturn PTR_ERR_OR_ZERO(hwmon);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-63-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:64:static void mt7925_mac_init_basic_rates(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-65-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-73-\t\t       FIELD_PREP(MT_TX_RATE_IDX, rate \u0026 GENMASK(7, 0));\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:74:\t\tmt7925_mac_set_fixed_rate_table(dev, idx, rate);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-75-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-77-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:78:int mt7925_mac_init(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-79-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-86-\tfor (i = 0; i \u003c MT792x_WTBL_SIZE; i++)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:87:\t\tmt7925_mac_wtbl_update(dev, i,\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-88-\t\t\t\t       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-91-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:92:\tmt7925_mac_init_basic_rates(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-93-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-97-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:98:EXPORT_SYMBOL_GPL(mt7925_mac_init);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-99-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:100:static int __mt7925_init_hardware(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-101-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-111-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:112:\tret = mt7925_mcu_set_eeprom(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-113-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-115-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:116:\tret = mt7925_mac_init(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-117-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-120-\tif (is_mt7927(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:121:\t\tret = mt7925_mcu_set_dbdc(\u0026dev-\u003emphy, true);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-122-\t\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-132-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:133:static int mt7925_init_hardware(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-134-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-144-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:145:\t\tret = __mt7925_init_hardware(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-146-\t\tif (!ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-162-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:163:static int mt7925_init_nan_cap(struct mt76_dev *mdev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-164-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-189-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:190:static void mt7925_init_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-191-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-195-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:196:\tret = mt7925_init_hardware(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-197-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-200-\tmt76_set_stream_caps(\u0026dev-\u003emphy, true);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:201:\tmt7925_set_stream_he_eht_caps(\u0026dev-\u003ephy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-202-\tmt792x_config_mac_addr_list(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-203-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:204:\tret = mt7925_init_mlo_caps(\u0026dev-\u003ephy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-205-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-209-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:210:\tdev-\u003emt76.init_wiphy = mt7925_init_nan_cap;\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-211-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-218-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:219:\tret = mt7925_init_debugfs(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-220-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-224-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:225:\tret = mt7925_thermal_init(\u0026dev-\u003ephy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-226-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-230-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:231:\tret = mt7925_mcu_set_thermal_protect(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-232-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-239-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:240:\tmt7925_mcu_set_deep_sleep(dev, dev-\u003epm.ds_enable);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-241-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-242-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:243:int mt7925_register_device(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-244-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-253-\tINIT_DELAYED_WORK(\u0026dev-\u003epm.ps_work, mt792x_pm_power_save_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:254:\tINIT_DELAYED_WORK(\u0026dev-\u003emlo_pm_work, mt7925_mlo_pm_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-255-\tINIT_WORK(\u0026dev-\u003epm.wake_work, mt792x_pm_wake_work);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-261-\tINIT_DELAYED_WORK(\u0026dev-\u003emphy.mac_work, mt792x_mac_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:262:\tINIT_DELAYED_WORK(\u0026dev-\u003ephy.scan_work, mt7925_scan_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:263:\tINIT_DELAYED_WORK(\u0026dev-\u003ecoredump.work, mt7925_coredump_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-264-#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:265:\tINIT_WORK(\u0026dev-\u003eipv6_ns_work, mt7925_set_ipv6_ns_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-266-\tskb_queue_head_init(\u0026dev-\u003eipv6_ns_list);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-270-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:271:\tINIT_WORK(\u0026dev-\u003ereset_work, mt7925_mac_reset_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:272:\tINIT_WORK(\u0026dev-\u003einit_work, mt7925_init_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-273-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:274:\tINIT_WORK(\u0026dev-\u003ephy.roc_work, mt7925_roc_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-275-\ttimer_setup(\u0026dev-\u003ephy.roc_timer, mt792x_roc_timer, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-301-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:302:\thw-\u003ewiphy-\u003ereg_notifier = mt7925_regd_notifier;\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-303-\tdev-\u003emphy.sband_2g.sband.ht_cap.cap |=\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-329-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:330:EXPORT_SYMBOL_GPL(mt7925_register_device);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-6-#include \u003clinux/timekeeping.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:7:#include \"mt7925.h\"\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-8-#include \"../dma.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-12-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:13:bool mt7925_mac_wtbl_update(struct mt792x_dev *dev, int idx, u32 mask)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-14-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-28-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:29:static void mt7925_mac_sta_poll(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-30-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-65-\t\tidx = mlink-\u003ewcid.idx;\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:66:\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, MT_WTBL_AC0_CTT_OFFSET);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-67-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-84-\t\tif (clear) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:85:\t\t\tmt7925_mac_wtbl_update(dev, idx,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-86-\t\t\t\t\t       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-129-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:130:\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, 6);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-131-\t\tval = mt76_rr(dev, addr);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-132-\t\tif (rate-\u003eflags \u0026 RATE_INFO_FLAGS_EHT_MCS) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:133:\t\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, 5);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-134-\t\t\tval = mt76_rr(dev, addr);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-148-\t\t/* get signal strength of resp frames (CTS/BA/ACK) */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:149:\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, 34);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-150-\t\tval = mt76_rr(dev, addr);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-163-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:164:void mt7925_mac_set_fixed_rate_table(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-165-\t\t\t\t     u8 tbl_idx, u16 rate_idx)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-182-/* The HW does not translate the mac header to 802.3 for mesh point */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:183:static int mt7925_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-184-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=262=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:263:mt7925_mac_fill_rx_rate(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-264-\t\t\tstruct mt76_rx_status *status,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=372=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:373:mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-374-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-552-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:553:\t\tret = mt7925_mac_fill_rx_rate(dev, status, sband, rxv, \u0026mode);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-554-\t\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-566-\tif (hdr_trans \u0026\u0026 ieee80211_has_morefrags(fc)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:567:\t\tif (mt7925_reverse_frag0_hdr_trans(skb, hdr_gap))\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-568-\t\t\treturn -EINVAL;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=640=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:641:mt7925_mac_write_txwi_8023(__le32 *txwi, struct sk_buff *skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-642-\t\t\t   struct mt76_wcid *wcid)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=675=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:676:mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-677-\t\t\t    struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=746=void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:747:mt7925_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-748-\t\t      struct sk_buff *skb, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-839-\tif (is_8023)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:840:\t\tmt7925_mac_write_txwi_8023(txwi, skb, wcid);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-841-\telse\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:842:\t\tmt7925_mac_write_txwi_80211(dev, txwi, skb, key);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-843-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-866-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:867:EXPORT_SYMBOL_GPL(mt7925_mac_write_txwi);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-868-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:869:static void mt7925_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-870-\t\t\t\t struct mt76_wcid *wcid)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=923=static bool\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:924:mt7925_mac_add_txs_skb(struct mt792x_dev *dev, struct mt76_wcid *wcid,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-925-\t\t       int pid, __le32 *txs_data)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=1192=void mt7928_mac_add_txs_msg(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1228-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1229:void mt7925_mac_add_txs(struct mt792x_dev *dev, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1230-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1262-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1263:\tmt7925_mac_add_txs_skb(dev, wcid, pid, txs_data);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1264-\tif (!wcid-\u003esta)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1272-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1273:void mt7925_txwi_free(struct mt792x_dev *dev, struct mt76_txwi_cache *t,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1274-\t\t      struct ieee80211_sta *sta, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1287-\t\tif (likely(t-\u003eskb-\u003eprotocol != cpu_to_be16(ETH_P_PAE)))\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1288:\t\t\tmt7925_tx_check_aggr(sta, t-\u003eskb, wcid);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1289-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1299-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1300:EXPORT_SYMBOL_GPL(mt7925_txwi_free);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1301-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=1302=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1303:mt7925_mac_tx_free(struct mt792x_dev *dev, void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1304-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1369-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1370:\t\t\tmt7925_txwi_free(dev, txwi, sta, wcid, \u0026free_list);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1371-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1373-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1374:\tmt7925_mac_sta_poll(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1375-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1386-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1387:bool mt7925_rx_check(struct mt76_dev *mdev, void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1388-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1406-\t\t\treturn false;\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1407:\t\tmt7925_mac_tx_free(dev, data, len);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1408-\t\treturn false;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1410-\t\tfor (rxd += 4; rxd + 12 \u003c= end; rxd += 12)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1411:\t\t\tmt7925_mac_add_txs(dev, rxd);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1412-\t\treturn false;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1416-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1417:EXPORT_SYMBOL_GPL(mt7925_rx_check);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1418-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1419:void mt7925_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1420-\t\t\t struct sk_buff *skb, u32 *info)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1446-\t\t}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1447:\t\tmt7925_mac_tx_free(dev, skb-\u003edata, skb-\u003elen);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1448-\t\tnapi_consume_skb(skb, 1);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1450-\tcase PKT_TYPE_RX_EVENT:\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1451:\t\tmt7925_mcu_rx_event(dev, skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1452-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1454-\t\tfor (rxd += 2; rxd + 8 \u003c= end; rxd += 8)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1455:\t\t\tmt7925_mac_add_txs(dev, rxd);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1456-\t\tdev_kfree_skb(skb);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1459-\tcase PKT_TYPE_NORMAL:\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1460:\t\tif (!mt7925_mac_fill_rx(dev, skb)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1461-\t\t\tmt76_rx(\u0026dev-\u003emt76, q, skb);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1469-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1470:EXPORT_SYMBOL_GPL(mt7925_queue_rx_skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1471-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=1472=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1473:mt7925_vif_connect_iter(void *priv, u8 *mac,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1474-\t\t\tstruct ieee80211_vif *vif)\n\n"
}
5/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 19517
							output: 51
							thoughts: 181

Thoughts: 
**MT7925 Driver Deep Dive**

Okay, so I'm looking at the `mt7925` driver. Right, it's got both `mt7925e.o`, the PCIe version, and `mt7925u.o`, which is USB. Wait a minute... *yes*, `mt7925u-y := usb.o` confirms there's a USB driver for this MT7925 chipset. Excellent! This opens up some interesting fuzzing possibilities. Since it's USB, I can leverage dummy_hcd and syzkaller's USB fuzzing capabilities – that's a key advantage.

Now, let's see... what's a good target function to examine for potential vulnerabilities? I'm thinking I should start by checking if `mt7925_change_vif_links` is reachable. Let me quickly confirm where that's defined; yep, it's `drivers/net/wireless/mediatek/mt76/mt7925/main.c`. Now, the next logical step is to trace the function's usage, understand how it gets called and under what circumstances. That's where the interesting stuff usually lies.

6/2 2026/08/26 04:48 tool grepper
0m Args: 
{
  "Expression": "mt7925_change_vif_links",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7925/"
}

Results: 
{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/main.c=2208=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2209:mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2210-\t\t\tu16 old_links, u16 new_links,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2731=const struct ieee80211_ops mt7925_ops = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2790-\t.link_info_changed = mt7925_link_info_changed,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2791:\t.change_vif_links = mt7925_change_vif_links,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2792-\t.change_sta_links = mt7925_change_sta_links,\n"
}
7/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 20375
							output: 46
							thoughts: 105

Thoughts: 
**Analyzing the MT7925 Driver's Link Change Function**

Okay, so I'm diving into this `mt7925_ops` structure and I see the `.change_vif_links` function assigned. That immediately tells me this is operating within the mac80211 framework, which is standard procedure. Since we are talking about a USB driver, it *should* be attachable via USB emulation, a common approach for testing these kinds of things.

But hold on a second... is the MT7925 USB driver actually enabled in syzkaller's configuration? I need to verify that before I go any further down this rabbit hole. Let me go check the Kconfig file for `MT7925U`. That's where the answer will be. Gotta make sure we're even testing the right path here.

8/2 2026/08/26 04:48 tool grepper
0m Args: 
{
  "Expression": "config MT7925U",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7925/"
}

Results: 
{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/Kconfig=7=config MT7925E\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:19:config MT7925U\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-20-\ttristate \"MediaTek MT7925U (USB) support\"\n"
}
9/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 20858
							output: 47
							thoughts: 32

Thoughts: 
Okay, here's my take on those thoughts, framed as my own:

**Working with MT7925U Configuration**

Right, *MT7925U* is the configuration we're going with, yep. But hold on a second... before we go any further, let's just double-check the dependencies of *MT7925U*. I need to be absolutely certain we haven't overlooked any critical upstream or downstream components that rely on or impact this particular setup. It's too easy to get caught out by unexpected interactions later on. A quick review of the dependencies now is always time well spent.

10/2 2026/08/26 04:48 tool read-file
0m Args: 
{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/Kconfig",
  "FirstLine": 1,
  "LineCount": 50
}

Results: 
{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\tconfig MT7925_COMMON\n   3:\t\ttristate\n   4:\t\tselect MT792x_LIB\n   5:\t\tselect WANT_DEV_COREDUMP\n   6:\t\n   7:\tconfig MT7925E\n   8:\t\ttristate \"MediaTek MT7925E (PCIe) support\"\n   9:\t\tselect MT7925_COMMON\n  10:\t\tdepends on MAC80211\n  11:\t\tdepends on PCI\n  12:\t\thelp\n  13:\t\t  This adds support for MT7925-based wireless PCIe devices,\n  14:\t\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n  15:\t\t  2x2:2SS 4096-QAM, 160MHz channels.\n  16:\t\n  17:\t\t  To compile this driver as a module, choose M here.\n  18:\t\n  19:\tconfig MT7925U\n  20:\t\ttristate \"MediaTek MT7925U (USB) support\"\n  21:\t\tselect MT792x_USB\n  22:\t\tselect MT7925_COMMON\n  23:\t\tdepends on MAC80211\n  24:\t\tdepends on USB\n  25:\t\thelp\n  26:\t\t  This adds support for MT7925-based wireless USB devices,\n  27:\t\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n  28:\t\t  2x2:2SS 4096-QAM, 160MHz channels.\n  29:\t\n  30:\t\t  To compile this driver as a module, choose M here.\n"
}
11/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 21554
							output: 54
							thoughts: 751

Thoughts: 
**Analyzing the Impact of the `mt7925_change_vif_links` Modification**

Okay, so I'm looking at this patch and immediately, the dependencies jump out: `MAC80211` and `USB`.  That means the relevant configuration is likely `MT7925U`. The core function that's been modified is `mt7925_change_vif_links`.  Let's re-examine that code block, paying close attention to the added logic that handles the legacy BSS restore.

```c
@@ -2294,6 +2294,21 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 
 	mvif->valid_links = new_links;
 
+	/* The firmware would keep the MLD BSS and DEV entry: the removal
+	 * loop skips the deflink and the hweight16() fallback above reads
+	 * the stale pre-update valid_links. Restore the legacy BSS.
+	 */
+	if (old_links && !new_links) {
+		mt792x_mac_link_bss_remove(dev, &mvif->bss_conf,
+					   &mvif->sta.deflink);
+		err = mt7925_mac_link_bss_add(dev, &vif->bss_conf,
+					      &mvif->sta.deflink);
+		if (err < 0) {
+			mt792x_mutex_release(dev);
+			return err;
+		}
+	}
+
 	mt792x_mutex_release(dev);
 
 	return 0;
```

This is clearly a functional change within `mt7925_change_vif_links`. Now, a crucial question arises: is `mt7925_change_vif_links` even reachable?  I know that `mac80211` calls this when virtual interface (vif) links change, which is typically triggered via netlink. But does firmware need to be loaded for this code path to be reached? With USB drivers in `mac80211`, firmware usually *is* required for proper initialization. If firmware isn't available, the driver might fail to probe.

Here's where things get interesting in the context of fuzzing with syzkaller.  Syzkaller can sometimes bypass firmware requirements. It could mock the firmware, or the driver might not *strictly* need it to register the `mac80211` device. We need to ascertain if `mt7925_change_vif_links` is reachable without firmware, or whether syzkaller's setup allows it.

Syzkaller generally uses `mac80211_hwsim`, but for USB drivers, it uses `dummy_hcd` and injects descriptors. If the driver *does* need firmware, syzkaller has a fallback mechanism to supply dummy firmware via the firmware loader.

Let's also evaluate `mt7925_mac_link_bss_add` and `mt792x_mac_link_bss_remove` as potential focus symbols. While `mt7925_change_vif_links` is the central modified function, those related functions in the patch might be interesting too. Checking back, it looks like `mt7925_change_vif_links` is declared static. Time to double-check the code in `drivers/net/wireless/mediatek/mt76/mt7925/main.c`.

12/2 2026/08/26 04:48 tool grepper
0m Args: 
{
  "Expression": "mt7925_change_vif_links",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7925/main.c"
}

Results: 
{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/main.c=2208=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2209:mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2210-\t\t\tu16 old_links, u16 new_links,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2731=const struct ieee80211_ops mt7925_ops = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2790-\t.link_info_changed = mt7925_link_info_changed,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2791:\t.change_vif_links = mt7925_change_vif_links,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2792-\t.change_sta_links = mt7925_change_sta_links,\n"
}
13/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 23556
							output: 52
							thoughts: 147

Thoughts: 
**Considering the `mt7925_change_vif_links` Function**

Okay, so I'm thinking about this `mt7925_change_vif_links` function. The code says it's static, which usually means the compiler might inline it, making its symbol address ambiguous. However, since it's being assigned to a function pointer, inlining is unlikely. So, the static declaration is a bit redundant but likely harmless, although it's better to ensure it's provided if it is *not* inlined.

Hang on a second… the prompt explicitly states a preference for non-static, non-inlined API entry points over internal static helper functions. This is where I have to pause and consider - is `mt7925_change_vif_links` the *exact* function that needs to be modified? If so, what are my options? Is there a non-static alternative I can use here? I need to explore what the alternative methods are here.

Let's quickly check `mt7925_mac_link_bss_add`. Maybe that function is the preferred method here.

14/2 2026/08/26 04:48 tool grepper
0m Args: 
{
  "Expression": "mt7925_mac_link_bss_add",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7925/"
}

Results: 
{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/main.c=366=static int mt7925_start(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-377-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:378:static int mt7925_mac_link_bss_add(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-379-\t\t\t\t   struct ieee80211_bss_conf *link_conf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=455=mt7925_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-469-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:470:\tret = mt7925_mac_link_bss_add(dev, \u0026vif-\u003ebss_conf, \u0026mvif-\u003esta.deflink);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-471-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2209=mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2282-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2283:\t\terr = mt7925_mac_link_bss_add(dev, link_conf, mlink);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2284-\t\tif (err \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2303-\t\t\t\t\t   \u0026mvif-\u003esta.deflink);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2304:\t\terr = mt7925_mac_link_bss_add(dev, \u0026vif-\u003ebss_conf,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2305-\t\t\t\t\t      \u0026mvif-\u003esta.deflink);\n"
}
15/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 24728
							output: 46
							thoughts: 41

Thoughts: 
Okay, here's my interpretation of those thoughts, summarized from my perspective as someone familiar with embedded systems and driver development:

**Initial Assessment: Static Context and Function Usage**

Alright, so the initial observation points out a key aspect: we're dealing with static elements in this particular scenario. My immediate follow-up question is, are we *exclusively* dealing with static functions, or are there any non-static alternatives to consider? This is critical in understanding the scope of the problem.

The next logical step is to dive into the `mt7925_ops` structure. My primary focus is to determine how it's being *utilized*. Specifically, I need to know if it's exported, and therefore possibly accessible outside of its intended scope, or used in `init.c`. This will give me a better understanding of the overall initialization and access methods of the code. This will help me narrow down potential issues.

16/2 2026/08/26 04:48 tool grepper
0m Args: 
{
  "Expression": "mt7925_ops",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7925/"
}

Results: 
{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/main.c=2722=static void mt7925_stop(struct ieee80211_hw *hw, bool suspend)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2730-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2731:const struct ieee80211_ops mt7925_ops = {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2732-\t.tx = mt792x_tx,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2804-};\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2805:EXPORT_SYMBOL_GPL(mt7925_ops);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2806-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=263=static inline u8 mt7927_band_idx(enum nl80211_band band)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-274-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:275:extern const struct ieee80211_ops mt7925_ops;\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-276-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=528=static int mt7925_pci_probe(struct pci_dev *pdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-600-\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:601:\tops = mt792x_get_mac80211_ops(\u0026pdev-\u003edev, \u0026mt7925_ops,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-602-\t\t\t\t      (void *)id-\u003edriver_data, \u0026features);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c=150=static int mt7925u_probe(struct usb_interface *usb_intf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-190-\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:191:\tops = mt792x_get_mac80211_ops(\u0026usb_intf-\u003edev, \u0026mt7925_ops,\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-192-\t\t\t\t      (void *)id-\u003edriver_info, \u0026features);\n"
}
17/2 2026/08/26 04:48 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 25857
							output: 142
							thoughts: 727

Thoughts: 
**My Analysis of the `mt7925_change_vif_links` Function**

Okay, so `mt7925_change_vif_links` is the focus here. It's used in both `usb.c` and `pci.c`, which tells me it's exposed through `mt7925_ops` as a function pointer. Since it's a pointer, no inlining, which is good for fuzzing. We can target `mt7925_change_vif_links` directly.

The next question is, can this function be reached without real hardware? Yes, through the `mac80211` driver operations, specifically when the device is probed. For the USB case, we can use `dummy_hcd` to probe `mt7925u`. Now, let's see if `MT7925U` is enabled in syzkaller. The answer is yes, so I need to return `EnableConfigs: ["MT7925U"]`.

I need to confirm if there are any other relevant config options. Checking `MT7925U` dependencies, it looks like it depends on `MAC80211` and `USB`. Digging further, `MT7925_COMMON` is selected by `MT7925U`, and `MT792x_USB` is also selected by `MT7925U`, so `MT7925U` is indeed sufficient.

I've double-checked, and `mt7925_change_vif_links` is the only function modified. The patch restores the legacy BSS. This patch fixes a bug with firmware and it seems to be a functional change. **WorthFuzzing=true** it is.

Let's summarize the necessary configs again: `MT7925U`, `MAC80211`, and `USB`.

I'll also check if `MT7925U` requires firmware. If it does, syzkaller's fallback firmware loading might handle it, or probing might fail. But we want to fuzz this code in any case. Looking at the other driver variants, `MT7925E` is PCIe, which I know is more challenging to fuzz reliably in QEMU compared to USB, even with syzkaller's PCI fuzzer. USB is definitely the better path.

Let's re-examine the code in `mt7925_change_vif_links`:

```c
	if (old_links && !new_links) {
		mt792x_mac_link_bss_remove(dev, &mvif->bss_conf,
					   &mvif->sta.deflink);
		err = mt7925_mac_link_bss_add(dev, &vif->bss_conf,
					      &mvif->sta.deflink);
		if (err < 0) {
			mt792x_mutex_release(dev);
			return err;
		}
	}
```

Yep, this is a clear functional change in the `mac80211` driver.

So the **focus symbol is `mt7925_change_vif_links`**, and the required configs are `MT7925U`. Time to set the results.

18/2 2026/08/26 04:49 tool set-results
0m Args: 
{
  "EnableConfigs": [
    "MT7925U"
  ],
  "FocusSymbols": [
    "mt7925_change_vif_links"
  ],
  "Reasoning": "The patch modifies `mt7925_change_vif_links` in the MediaTek MT7925 wireless driver to restore the legacy BSS when links are removed. This is a functional change in the mac80211 driver operations. The driver has a USB variant (MT7925U) which can be fuzzed via USB emulation (dummy_hcd) in virtualized environments.",
  "WorthFuzzing": true
}

Results: 
{
  "EnableConfigs": [
    "MT7925U"
  ],
  "FocusSymbols": [
    "mt7925_change_vif_links"
  ],
  "Reasoning": "The patch modifies `mt7925_change_vif_links` in the MediaTek MT7925 wireless driver to restore the legacy BSS when links are removed. This is a functional change in the mac80211 driver operations. The driver has a USB variant (MT7925U) which can be fuzzed via USB emulation (dummy_hcd) in virtualized environments.",
  "WorthFuzzing": true
}
19/1 2026/08/26 04:49 action If
0m Args: 
{
  "WorthFuzzing": true
}

Results: 
null
20/2 2026/08/26 04:49 agent kmsan-evaluator
0m Model: 
best-expensive

Args: 
null

Results: 
{
  "KMSANReasoning": "The patch modifies the logic for changing VIF links in the mt7925 driver by adding a condition to remove and re-add a BSS link when transitioning from having valid links to no valid links. This is a state machine and firmware synchronization fix. It does not introduce any new allocations, structures sent to user space, or complex data structures where uninitialized fields could be read. Any potential bugs related to this change would involve use-after-free, out-of-bounds accesses, or logic errors, which are well-covered by KASAN and standard bug detectors. There is no risk of uninitialized memory usage or info-leaks that would necessitate KMSAN.",
  "NeedsKMSAN": false
}

Instruction: 
You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit 908edf9b1eef340a9c5508b280492949594209de
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Aug 26 04:48:18 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 84b55f008b3d3..c7ced2efd4d7c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2294,6 +2294,21 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 
 	mvif->valid_links = new_links;
 
+	/* The firmware would keep the MLD BSS and DEV entry: the removal
+	 * loop skips the deflink and the hweight16() fallback above reads
+	 * the stale pre-update valid_links. Restore the legacy BSS.
+	 */
+	if (old_links && !new_links) {
+		mt792x_mac_link_bss_remove(dev, &mvif->bss_conf,
+					   &mvif->sta.deflink);
+		err = mt7925_mac_link_bss_add(dev, &vif->bss_conf,
+					      &mvif->sta.deflink);
+		if (err < 0) {
+			mt792x_mutex_release(dev);
+			return err;
+		}
+	}
+
 	mt792x_mutex_release(dev);
 
 	return 0;

21/3 2026/08/26 04:49 llm kmsan-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 2216
							output: 51
							thoughts: 257

Thoughts: 
**My Assessment of the MT7925 Patch**

Okay, so this patch is touching `mt7925_change_vif_links` within the MT7925 driver. It looks like it's adding a conditional check: `if (old_links && !new_links)`. That immediately makes me think about MAC link BSS removal and addition. It's calling `mt792x_mac_link_bss_remove` and `mt7925_mac_link_bss_add` based on this check. My initial concern, as always, is uninitialized memory. Let's see... `old_links` and `new_links` seem to be integers, likely `u16` bitmasks. `mvif->bss_conf` and `vif->bss_conf` are pointers, as is `mvif->sta.deflink`.

Alright, I don't see any new memory allocation here, and definitely no direct `copy_to_user` calls that would be an obvious source of uninitialized memory exposure. It doesn't look like any uninitialized data is being read either. My initial instinct is that this is purely a logical change, probably fixing a state machine or synchronization issue with the firmware, which is a fairly common area for patches like this.

Given this, I don't immediately see any obvious KMSAN issues. KASAN would be the more likely tool to catch any Use-After-Free or Out-of-Bounds issues *if* there were any. Though, it never hurts to double-check these things. Let me just take another quick look at the code to be sure I'm not missing anything obvious.

22/3 2026/08/26 04:49 tool read-file
0m Args: 
{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/main.c",
  "FirstLine": 2280,
  "LineCount": 40
}

Results: 
{
  "Contents": "2280:\t\t\trcu_assign_pointer(mvif-\u003elink_conf[link_id], mconf);\n2281:\t\t\trcu_assign_pointer(mvif-\u003esta.link[link_id], mlink);\n2282:\t\n2283:\t\t\terr = mt7925_mac_link_bss_add(dev, link_conf, mlink);\n2284:\t\t\tif (err \u003c 0)\n2285:\t\t\t\tgoto free;\n2286:\t\n2287:\t\t\tif (mconf != \u0026mvif-\u003ebss_conf) {\n2288:\t\t\t\terr = mt7925_set_mlo_roc(phy, \u0026mvif-\u003ebss_conf,\n2289:\t\t\t\t\t\t\t vif-\u003eactive_links);\n2290:\t\t\t\tif (err \u003c 0)\n2291:\t\t\t\t\tgoto free;\n2292:\t\t\t}\n2293:\t\t}\n2294:\t\n2295:\t\tmvif-\u003evalid_links = new_links;\n2296:\t\n2297:\t\t/* The firmware would keep the MLD BSS and DEV entry: the removal\n2298:\t\t * loop skips the deflink and the hweight16() fallback above reads\n2299:\t\t * the stale pre-update valid_links. Restore the legacy BSS.\n2300:\t\t */\n2301:\t\tif (old_links \u0026\u0026 !new_links) {\n2302:\t\t\tmt792x_mac_link_bss_remove(dev, \u0026mvif-\u003ebss_conf,\n2303:\t\t\t\t\t\t   \u0026mvif-\u003esta.deflink);\n2304:\t\t\terr = mt7925_mac_link_bss_add(dev, \u0026vif-\u003ebss_conf,\n2305:\t\t\t\t\t\t      \u0026mvif-\u003esta.deflink);\n2306:\t\t\tif (err \u003c 0) {\n2307:\t\t\t\tmt792x_mutex_release(dev);\n2308:\t\t\t\treturn err;\n2309:\t\t\t}\n2310:\t\t}\n2311:\t\n2312:\t\tmt792x_mutex_release(dev);\n2313:\t\n2314:\t\treturn 0;\n2315:\t\n2316:\tfree:\n2317:\t\tfor_each_set_bit(link_id, \u0026add, IEEE80211_MLD_MAX_NUM_LINKS) {\n2318:\t\t\trcu_assign_pointer(mvif-\u003elink_conf[link_id], NULL);\n2319:\t\t\trcu_assign_pointer(mvif-\u003esta.link[link_id], NULL);\n"
}
23/3 2026/08/26 04:49 llm kmsan-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 3572
							output: 165
							thoughts: 48

Thoughts: 
Okay, here's my take on those thoughts, framed as my own:

**Patch Review and State Machine Logic**

Alright, looking at this patch, it seems straightforward. The main function is to handle the removal and addition of BSS links based on changes in the link state, specifically when the `old_links` are present but the `new_links` are not. This is definitely a state machine correction, which is what I suspected given the description. Nothing in this code touches uninitialized memory, which is a relief – always a good thing to verify. Given that, I'm confident there's no need to enable any extra debugging or hardening, so I'm setting `NeedsKMSAN=false`. This looks clean.

24/3 2026/08/26 04:49 tool set-results
0m Args: 
{
  "KMSANReasoning": "The patch modifies the logic for changing VIF links in the mt7925 driver by adding a condition to remove and re-add a BSS link when transitioning from having valid links to no valid links. This is a state machine and firmware synchronization fix. It does not introduce any new allocations, structures sent to user space, or complex data structures where uninitialized fields could be read. Any potential bugs related to this change would involve use-after-free, out-of-bounds accesses, or logic errors, which are well-covered by KASAN and standard bug detectors. There is no risk of uninitialized memory usage or info-leaks that would necessitate KMSAN.",
  "NeedsKMSAN": false
}

Results: 
{
  "KMSANReasoning": "The patch modifies the logic for changing VIF links in the mt7925 driver by adding a condition to remove and re-add a BSS link when transitioning from having valid links to no valid links. This is a state machine and firmware synchronization fix. It does not introduce any new allocations, structures sent to user space, or complex data structures where uninitialized fields could be read. Any potential bugs related to this change would involve use-after-free, out-of-bounds accesses, or logic errors, which are well-covered by KASAN and standard bug detectors. There is no risk of uninitialized memory usage or info-leaks that would necessitate KMSAN.",
  "NeedsKMSAN": false
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)