AI Trajectory

null

{
  "EnableConfigs": [
    "WLAN",
    "WLAN_VENDOR_MEDIATEK",
    "MT7925E",
    "MT7925U",
    "MAC80211"
  ],
  "FocusSymbols": [
    "mt7925_mcu_sta_update",
    "mt7925_mac_sta_add"
  ],
  "KMSANReasoning": "The patch modifies `mt7925_mcu_sta_mld_tlv()` in `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c` to iterate over all valid station links when constructing the STA_REC_MLD MCU TLV command for firmware.\n\n- The buffer containing `struct sta_rec_mld` is allocated and zero-initialized via `mt76_connac_mcu_add_tlv()` (`skb_put_zero()`).\n- All local variables (`valid`, `max_links`, `cnt`, `link_id`, `mlink_sec`, `mconf_sec`) are properly initialized before use.\n- The TLV data is packaged into an internal MCU command skb transmitted to the device firmware, not copied or leaked to user space.\n- Any potential bounds issues (e.g. array indexing checked by `cnt == max_links`), pointer validity, or locking issues are covered by KASAN, LOCKDEP, and standard kernel debugging mechanisms.\n\nNo uninitialized memory read risks or info leaks are introduced or exposed. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the station MLD TLV construction in the MediaTek MT7925 wireless driver (mt7925_mcu_sta_mld_tlv) to properly encode all active and pending station links during station add and update commands instead of only the secondary link currently being updated. This is a functional change in 802.11be Multi-Link Operation (MLO) state configuration reachable via mac80211/nl80211 interfaces.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 3eb2bde608a81b4e746495647ebc84677d4ee361\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Sep 3 08:26:18 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\nindex fa29c486a4553..d3e1ae4143cb7 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\n@@ -2068,9 +2068,12 @@ mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\n \tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\n \tstruct mt792x_sta *msta = (struct mt792x_sta *)sta-\u003edrv_priv;\n \tstruct mt792x_dev *dev = mvif-\u003ephy-\u003edev;\n+\tunsigned long valid = msta-\u003evalid_links;\n \tstruct mt792x_bss_conf *mconf_pri;\n \tstruct sta_rec_mld *mld;\n+\tunsigned int link_id;\n \tstruct tlv *tlv;\n+\tu8 max_links;\n \tu8 cnt = 0;\n \n \t/* Primary link always uses driver's deflink WCID. */\n@@ -2099,11 +2102,47 @@ mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\n \tmld-\u003elink[cnt].wlan_id = cpu_to_le16(msta-\u003edeflink.wcid.idx);\n \tmld-\u003elink[cnt++].bss_idx = mconf_pri-\u003emt76.idx;\n \n-\t/* Optionally encode the currently-updated secondary link. */\n-\tif (mlink \u0026\u0026 mlink != \u0026msta-\u003edeflink \u0026\u0026 mconf) {\n-\t\tmld-\u003esecondary_id = cpu_to_le16(mlink-\u003ewcid.idx);\n-\t\tmld-\u003elink[cnt].wlan_id = cpu_to_le16(mlink-\u003ewcid.idx);\n-\t\tmld-\u003elink[cnt++].bss_idx = mconf-\u003emt76.idx;\n+\t/* Encode the remaining valid links of this station, not just the one\n+\t * this command happens to be updating. STA_REC_MLD is a complete\n+\t * record: every update rewrites link_num and link[], so selecting the\n+\t * secondary entry from the caller's link made the record firmware\n+\t * ends up holding depend on which link was updated last.\n+\t */\n+\tmax_links = ARRAY_SIZE(mld-\u003elink);\n+\n+\t/* mt7925_mac_link_sta_add() issues this command before publishing\n+\t * a new link in msta-\u003elink[] and msta-\u003evalid_links. Include that\n+\t * in-flight caller link in this record so it is not lost.\n+\t */\n+\tif (mlink \u0026\u0026 mconf \u0026\u0026 mlink != \u0026msta-\u003edeflink)\n+\t\tvalid |= BIT(mlink-\u003ewcid.link_id);\n+\n+\tfor_each_set_bit(link_id, \u0026valid, IEEE80211_MLD_MAX_NUM_LINKS) {\n+\t\tstruct mt792x_link_sta *mlink_sec;\n+\t\tstruct mt792x_bss_conf *mconf_sec;\n+\n+\t\tif (cnt == max_links)\n+\t\t\tbreak;\n+\n+\t\tif (link_id == msta-\u003edeflink_id)\n+\t\t\tcontinue;\n+\n+\t\tmlink_sec = mt792x_sta_to_link(msta, link_id);\n+\t\tif (!mlink_sec \u0026\u0026 mlink \u0026\u0026 link_id == mlink-\u003ewcid.link_id)\n+\t\t\tmlink_sec = mlink;\n+\t\tif (!mlink_sec || mlink_sec == \u0026msta-\u003edeflink)\n+\t\t\tcontinue;\n+\n+\t\tmconf_sec = rcu_dereference_protected(mvif-\u003elink_conf[link_id],\n+\t\t\t\t\t\t      lockdep_is_held(\u0026dev-\u003emt76.mutex));\n+\t\tif (!mconf_sec)\n+\t\t\tcontinue;\n+\n+\t\tif (cnt == 1)\n+\t\t\tmld-\u003esecondary_id = cpu_to_le16(mlink_sec-\u003ewcid.idx);\n+\n+\t\tmld-\u003elink[cnt].wlan_id = cpu_to_le16(mlink_sec-\u003ewcid.idx);\n+\t\tmld-\u003elink[cnt++].bss_idx = mconf_sec-\u003emt76.idx;\n \t}\n \n \tmld-\u003elink_num = cnt;\n"
}

core

null

{
  "EnableConfigs": [
    "WLAN",
    "WLAN_VENDOR_MEDIATEK",
    "MT7925E",
    "MT7925U",
    "MAC80211"
  ],
  "FocusSymbols": [
    "mt7925_mcu_sta_update",
    "mt7925_mac_sta_add"
  ],
  "Reasoning": "The patch modifies the station MLD TLV construction in the MediaTek MT7925 wireless driver (mt7925_mcu_sta_mld_tlv) to properly encode all active and pending station links during station add and update commands instead of only the secondary link currently being updated. This is a functional change in 802.11be Multi-Link Operation (MLO) state configuration reachable via mac80211/nl80211 interfaces.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 3eb2bde608a81b4e746495647ebc84677d4ee361
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Sep 3 08:26:18 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index fa29c486a4553..d3e1ae4143cb7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2068,9 +2068,12 @@ mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
 	struct mt792x_dev *dev = mvif->phy->dev;
+	unsigned long valid = msta->valid_links;
 	struct mt792x_bss_conf *mconf_pri;
 	struct sta_rec_mld *mld;
+	unsigned int link_id;
 	struct tlv *tlv;
+	u8 max_links;
 	u8 cnt = 0;
 
 	/* Primary link always uses driver's deflink WCID. */
@@ -2099,11 +2102,47 @@ mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
 	mld->link[cnt].wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
 	mld->link[cnt++].bss_idx = mconf_pri->mt76.idx;
 
-	/* Optionally encode the currently-updated secondary link. */
-	if (mlink && mlink != &msta->deflink && mconf) {
-		mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
-		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
-		mld->link[cnt++].bss_idx = mconf->mt76.idx;
+	/* Encode the remaining valid links of this station, not just the one
+	 * this command happens to be updating. STA_REC_MLD is a complete
+	 * record: every update rewrites link_num and link[], so selecting the
+	 * secondary entry from the caller's link made the record firmware
+	 * ends up holding depend on which link was updated last.
+	 */
+	max_links = ARRAY_SIZE(mld->link);
+
+	/* mt7925_mac_link_sta_add() issues this command before publishing
+	 * a new link in msta->link[] and msta->valid_links. Include that
+	 * in-flight caller link in this record so it is not lost.
+	 */
+	if (mlink && mconf && mlink != &msta->deflink)
+		valid |= BIT(mlink->wcid.link_id);
+
+	for_each_set_bit(link_id, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
+		struct mt792x_link_sta *mlink_sec;
+		struct mt792x_bss_conf *mconf_sec;
+
+		if (cnt == max_links)
+			break;
+
+		if (link_id == msta->deflink_id)
+			continue;
+
+		mlink_sec = mt792x_sta_to_link(msta, link_id);
+		if (!mlink_sec && mlink && link_id == mlink->wcid.link_id)
+			mlink_sec = mlink;
+		if (!mlink_sec || mlink_sec == &msta->deflink)
+			continue;
+
+		mconf_sec = rcu_dereference_protected(mvif->link_conf[link_id],
+						      lockdep_is_held(&dev->mt76.mutex));
+		if (!mconf_sec)
+			continue;
+
+		if (cnt == 1)
+			mld->secondary_id = cpu_to_le16(mlink_sec->wcid.idx);
+
+		mld->link[cnt].wlan_id = cpu_to_le16(mlink_sec->wcid.idx);
+		mld->link[cnt++].bss_idx = mconf_sec->mt76.idx;
 	}
 
 	mld->link_num = cnt;

gemini-3.7-flash

null

null

							input: 3075
							output: 37
							thoughts: 176
						

**Fuzzing Feasibility Assessment**

Okay, let's dive into this patch and figure out if it's fuzz-worthy. The target is `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c`, specifically the `mt7925_mcu_sta_mld_tlv` function. Right away, my radar's up – what kind of driver is mt7925? I need to quickly establish if we're dealing with a physical wireless hardware driver (PCIe, USB, etc.), something that can be emulated, or if it's highly hardware-dependent.

Time to head into the kernel source and poke around `drivers/net/wireless/mediatek/mt76/`. I'll either use `grepper` to search for details or check the `Kconfig` files within the `drivers/net/wireless/mediatek/mt76/mt7925/` directory. That should give me the crucial context I need to assess the fuzzing potential. I need to understand the underlying hardware dependency before I go further.

{
  "Expression": "MT7925",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "\nFull output is too long, showing 500 out of 664 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Makefile=51=obj-$(CONFIG_MT7996E) += mt7996/\ndrivers/net/wireless/mediatek/mt76/Makefile:52:obj-$(CONFIG_MT7925_COMMON) += mt7925/\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:2:config MT7925_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-6-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:7:config MT7925E\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:8:\ttristate \"MediaTek MT7925E (PCIe) support\"\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:9:\tselect MT7925_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-10-\tdepends on MAC80211\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-12-\thelp\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:13:\t  This adds support for MT7925-based wireless PCIe devices,\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-14-\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:19:config MT7925U\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:20:\ttristate \"MediaTek MT7925U (USB) support\"\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-21-\tselect MT792x_USB\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:22:\tselect MT7925_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-23-\tdepends on MAC80211\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-25-\thelp\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:26:\t  This adds support for MT7925-based wireless USB devices,\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-27-\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:3:obj-$(CONFIG_MT7925_COMMON) += mt7925-common.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:4:obj-$(CONFIG_MT7925E) += mt7925e.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:5:obj-$(CONFIG_MT7925U) += mt7925u.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile-6-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=13=bool mt7925_mac_wtbl_update(struct mt792x_dev *dev, int idx, u32 mask)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-19-\telse\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:20:\t\twtbl_update = MT7925_WTBL_UPDATE;\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-21-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h-3-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h:4:#ifndef __MT7925_MAC_H\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h:5:#define __MT7925_MAC_H\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h-6-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h=15=static inline u32 mt7925_mac_wtbl_lmac_addr(struct mt792x_dev *dev, u16 wcid, u8 dw)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h-21-\telse\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h:22:\t\twdu_cr = MT7925_WTBLON_TOP_WDUCR;\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.h-23-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=624=static int mt7925_remain_on_channel(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-635-\terr = mt7925_set_roc(phy, \u0026mvif-\u003ebss_conf,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:636:\t\t\t     chan, duration, MT7925_ROC_REQ_ROC);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-637-\tmt792x_mutex_release(phy-\u003edev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=854=static void mt7925_configure_filter(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-858-{\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:859:#define MT7925_FILTER_FCSFAIL    BIT(2)\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:860:#define MT7925_FILTER_CONTROL    BIT(5)\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:861:#define MT7925_FILTER_OTHER_BSS  BIT(6)\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:862:#define MT7925_FILTER_ENABLE     BIT(31)\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-863-\tstruct mt792x_dev *dev = mt792x_hw_dev(hw);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:864:\tu32 flags = MT7925_FILTER_ENABLE;\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-865-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:866:#define MT7925_FILTER(_fif, _type) do {\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-867-\t\tif (*total_flags \u0026 (_fif))\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:868:\t\t\tflags |= MT7925_FILTER_##_type;\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-869-\t} while (0)\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-870-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:871:\tMT7925_FILTER(FIF_FCSFAIL, FCSFAIL);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:872:\tMT7925_FILTER(FIF_CONTROL, CONTROL);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:873:\tMT7925_FILTER(FIF_OTHER_BSS, OTHER_BSS);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-874-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=883=mt7925_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-897-\t\t/* must odd index */\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:898:\t\tidx = MT7925_BEACON_RATES_TBL + 2 * (mvif-\u003eidx % 20);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-899-\t\tmt7925_mac_set_fixed_rate_table(dev, idx, rate);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2070=static void mt7925_mgd_prepare_tx(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2081-\t\t       mvif-\u003ebss_conf.mt76.ctx-\u003edef.chan, duration,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2082:\t\t       MT7925_ROC_REQ_JOIN);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2083-\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2461=void mt7925_csa_work(struct work_struct *work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2484-\tlink_conf = \u0026vif-\u003ebss_conf;\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2485:\troc_rtype = MT7925_ROC_REQ_JOIN;\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2486-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2792=MODULE_AUTHOR(\"Deren Wu \u003cderen.wu@mediatek.com\u003e\");\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2793:MODULE_DESCRIPTION(\"MediaTek MT7925 core driver\");\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2794-MODULE_LICENSE(\"Dual BSD/GPL\");\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-13-#define MT_STA_BFEE\t\t\tBIT(1)\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:14:#define MT7925_WOW_PATTERN_NEW_FW_DATE\t\"20260414153105\"\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-15-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=233=static bool mt7925_mcu_wow_pattern_old_tlv(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-245-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:246:\treturn strncmp(build_date, MT7925_WOW_PATTERN_NEW_FW_DATE,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:247:\t\t       strlen(MT7925_WOW_PATTERN_NEW_FW_DATE)) \u003c 0;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-248-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=251=mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-269-\ttlv_len = old_tlv ? sizeof(struct mt7925_wow_pattern_tlv) :\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:270:\t\t\t    MT7925_WOW_PATTERN_TLV_V2_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-271-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=359=static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-370-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:371:\tif (grant-\u003ereqtype == MT7925_ROC_REQ_ROC)\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-372-\t\tieee80211_ready_on_channel(hw);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:373:\telse if (grant-\u003ereqtype == MT7925_ROC_REQ_JOIN)\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-374-\t\tieee80211_iterate_active_interfaces_atomic(hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=826=static int mt7925_mcu_read_eeprom(struct mt792x_dev *dev, u32 offset, u8 *val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-835-\t\t__le32 valid;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:836:\t\tu8 data[MT7925_EEPROM_BLOCK_SIZE];\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-837-\t} __packed req = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-840-\t\t.addr = cpu_to_le32(round_down(offset,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:841:\t\t\t\t    MT7925_EEPROM_BLOCK_SIZE)),\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-842-\t};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-866-\tres = (struct evt *)skb-\u003edata;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:867:\t*val = res-\u003edata[offset % MT7925_EEPROM_BLOCK_SIZE];\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-868-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1246=int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1254-\t\t\t\t\t      \u0026mlink-\u003ewcid,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1255:\t\t\t\t\t      MT7925_STA_UPDATE_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1256-\tif (IS_ERR(skb))\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1403=int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1414-\tskb = __mt76_connac_mcu_alloc_sta_req(dev, \u0026mconf-\u003emt76, wcid,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1415:\t\t\t\t\t      MT7925_STA_UPDATE_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1416-\tif (IS_ERR(skb))\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1428=int mt7925_mcu_set_mlo_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1489-\t      IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS))\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1490:\t\ttype = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1491:\t\t\t\t    MT7925_ROC_REQ_MLSR_AA;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1492-\telse\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1493:\t\ttype = MT7925_ROC_REQ_JOIN;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1494-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1517-\t\t */\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1518:\t\treq.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1519-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2163=mt7925_mcu_sta_cmd(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2176-\tskb = __mt76_connac_mcu_alloc_sta_req(dev, \u0026mconf-\u003emt76, info-\u003ewcid,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2177:\t\t\t\t\t      MT7925_STA_UPDATE_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2178-\tif (IS_ERR(skb))\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2251=int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2254-{\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2255:#define MT7925_FIF_BIT_CLR\t\tBIT(1)\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2256:#define MT7925_FIF_BIT_SET\t\tBIT(0)\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2257-\tint err = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2264-\t\treturn mt7925_mcu_set_rxfilter(dev, 0,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2265:\t\t\t\t\t       MT7925_FIF_BIT_SET,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2266-\t\t\t\t\t       MT_WF_RFCR_DROP_OTHER_BEACON);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2273-\treturn mt7925_mcu_set_rxfilter(dev, 0,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2274:\t\t\t\t       MT7925_FIF_BIT_CLR,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2275-\t\t\t\t       MT_WF_RFCR_DROP_OTHER_BEACON);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2622=int mt7925_mcu_set_eht_pp(struct mt76_phy *phy, struct mt76_vif_link *mvif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2628-\tskb = __mt7925_mcu_alloc_bss_req(phy-\u003edev, mvif,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2629:\t\t\t\t\t MT7925_BSS_UPDATE_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2630-\tif (IS_ERR(skb))\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2639=int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif_link *mvif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2645-\tskb = __mt7925_mcu_alloc_bss_req(phy-\u003edev, mvif,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2646:\t\t\t\t\t MT7925_BSS_UPDATE_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2647-\tif (IS_ERR(skb))\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3028=int mt7925_mcu_set_timing(struct mt792x_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3035-\tskb = __mt7925_mcu_alloc_bss_req(\u0026dev-\u003emt76, \u0026mconf-\u003emt76,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3036:\t\t\t\t\t MT7925_BSS_UPDATE_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3037-\tif (IS_ERR(skb))\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3102=int mt7925_mcu_add_bss_info_sta(struct mt792x_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3115-\tskb = __mt7925_mcu_alloc_bss_req(\u0026dev-\u003emt76, \u0026mconf-\u003emt76,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3116:\t\t\t\t\t MT7925_BSS_UPDATE_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3117-\tif (IS_ERR(skb))\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3254=int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3277-\tmax_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3278:\t\t  sizeof(*bssid) * MT7925_RNR_SCAN_MAX_BSSIDS +\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3279-\t\t  sizeof(*chan_info) + sizeof(*misc) + sizeof(*ie) +\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3302-\t\t\tcontinue;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3303:\t\tif (i \u003e= MT7925_RNR_SCAN_MAX_BSSIDS)\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3304-\t\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3319-\t\tfor (j = 0; j \u003c mdev-\u003ernr.bssid_num; j++) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3320:\t\t\tif (j \u003e= MT7925_RNR_SCAN_MAX_BSSIDS)\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3321-\t\t\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3328-\t\t\tbssid-\u003ematch_ch = mdev-\u003ernr.channel[j];\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3329:\t\t\tbssid-\u003ematch_ssid_ind = MT7925_RNR_SCAN_MAX_BSSIDS;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3330:\t\t\tbssid-\u003ematch_short_ssid_ind = MT7925_RNR_SCAN_MAX_BSSIDS;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3331-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-3-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:4:#ifndef __MT7925_MCU_H\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:5:#define __MT7925_MCU_H\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-6-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=14=struct mt7925_mcu_eeprom_info {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-16-\t__le32 valid;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:17:\tu8 data[MT7925_EEPROM_BLOCK_SIZE];\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-18-} __packed;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=99=enum {\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:100:\tMT7925_TM_NORMAL,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:101:\tMT7925_TM_TESTMODE,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:102:\tMT7925_TM_ICAP,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:103:\tMT7925_TM_ICAP_OVERLAP,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:104:\tMT7925_TM_WIFISPECTRUM,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-105-};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=217=enum {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-221-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:222:#define MT7925_RNR_SCAN_MAX_BSSIDS\t10\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-223-struct scan_hdr_tlv {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=252=struct scan_ssid_tlv {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-263-\tu8 pad;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:264:\tstruct mt76_connac_mcu_scan_ssid ssids[MT7925_RNR_SCAN_MAX_BSSIDS];\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-265-} __packed;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=512=struct bss_rlm_tlv {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-526-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:527:#define MT7925_STA_UPDATE_MAX_SIZE\t(sizeof(struct sta_req_hdr) +\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-528-\t\t\t\t\t sizeof(struct sta_rec_basic) +\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-547-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:548:#define MT7925_BSS_UPDATE_MAX_SIZE\t(sizeof(struct bss_req_hdr) +\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-549-\t\t\t\t\t sizeof(struct mt76_connac_bss_basic_tlv) +\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=596=struct mt7925_wow_pattern_tlv {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-610-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:611:#define MT7925_WOW_PATTERN_TLV_V2_SIZE\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-612-\t(offsetof(struct mt7925_wow_pattern_tlv, rsv) + 3)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-3-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:4:#ifndef __MT7925_H\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:5:#define __MT7925_H\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-6-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-9-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:10:#define MT7925_BEACON_RATES_TBL\t\t25\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-11-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:12:#define MT7925_TX_RING_SIZE\t\t2048\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:13:#define MT7925_TX_MCU_RING_SIZE\t\t256\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:14:#define MT7925_TX_FWDL_RING_SIZE\t128\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-15-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:16:#define MT7925_RX_RING_SIZE\t\t1536\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:17:#define MT7925_RX_MCU_RING_SIZE\t\t512\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-18-#define MT7928_RX_MCU_WA_RING_SIZE\t512\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-19-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:20:#define MT7925_EEPROM_SIZE\t\t3584\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:21:#define MT7925_TOKEN_SIZE\t\t8192\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-22-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:23:#define MT7925_EEPROM_BLOCK_SIZE\t16\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-24-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:25:#define MT7925_SKU_RATE_NUM\t\t161\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:26:#define MT7925_SKU_MAX_DELTA_IDX\tMT7925_SKU_RATE_NUM\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:27:#define MT7925_SKU_TABLE_SIZE\t\t(MT7925_SKU_RATE_NUM + 1)\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-28-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=58=enum mt7925_roc_req {\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:59:\tMT7925_ROC_REQ_JOIN,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:60:\tMT7925_ROC_REQ_ROC,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:61:\tMT7925_ROC_REQ_SUB_LINK,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:62:\tMT7925_ROC_REQ_MLSR_AG = 10,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:63:\tMT7925_ROC_REQ_MLSR_AA,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:64:\tMT7925_ROC_REQ_NUM\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-65-};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=116=enum mt7925_txq_id {\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:117:\tMT7925_TXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:118:\tMT7925_TXQ_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:119:\tMT7925_TXQ_MCU_WM = 15,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:120:\tMT7925_TXQ_FWDL,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-121-};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=123=enum mt7925_rxq_id {\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:124:\tMT7925_RXQ_BAND0 = 2,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:125:\tMT7925_RXQ_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:126:\tMT7925_RXQ_MCU_WM = 0,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:127:\tMT7925_RXQ_MCU_WM2, /* for tx done */\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-128-};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=130=enum mt7927_txq_id {\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:131:\tMT7927_TXQ_BAND0 = MT7925_TXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:132:\tMT7927_TXQ_BAND1 = MT7925_TXQ_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:133:\tMT7927_TXQ_MCU_WM = MT7925_TXQ_MCU_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:134:\tMT7927_TXQ_FWDL = MT7925_TXQ_FWDL,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-135-};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=161=enum {\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:162:\tMT7925_CLC_POWER,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:163:\tMT7925_CLC_CHAN,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:164:\tMT7925_CLC_MAX_NUM,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-165-};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=360=int mt7925_nan_change_configure(struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-371-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:372:\tskb = mt76_mcu_msg_alloc(mdev, NULL, MT7925_NAN_CONF_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-373-\tif (!skb)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=645=void mt7925_nan_local_sched_changed(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-661-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:662:\tskb = mt76_mcu_msg_alloc(mdev, NULL, MT7925_NAN_AVAIL_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-663-\tif (!skb)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=865=int mt792x_nan_set_peer_schedule(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-880-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:881:\tskb = mt76_mcu_msg_alloc(mdev, NULL, MT7925_NAN_PEER_MAX_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-882-\tif (!skb)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-3-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h:4:#ifndef __MT7925_NAN_H\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h:5:#define __MT7925_NAN_H\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-6-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-30-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h:31:#define MT7925_NAN_CONF_MAX_SIZE\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-32-\t(sizeof(struct mt7925_nan_common_hdr) +\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-37-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h:38:#define MT7925_NAN_AVAIL_MAX_SIZE\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-39-\t(sizeof(struct mt7925_nan_common_hdr) +\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-42-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h:43:#define MT7925_NAN_PEER_MAX_SIZE\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.h-44-\t(sizeof(struct mt7925_nan_common_hdr) +\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=14=static const struct pci_device_id mt7925_pci_device_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-15-\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7925),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:16:\t\t.driver_data = (kernel_ulong_t)MT7925_FIRMWARE_WM },\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-17-\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0717),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:18:\t\t.driver_data = (kernel_ulong_t)MT7925_FIRMWARE_WM },\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-19-\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7927),\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=319=static const struct mt792x_dma_layout mt7925_dma_layout = {\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:320:\t.tx_data0 = mt792x_dma_ring(MT7925_TXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:321:\t\t\t\t    MT7925_TX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-322-\t\t\t\t    MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:323:\t.tx_mcu = mt792x_dma_ring(MT7925_TXQ_MCU_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:324:\t\t\t\t  MT7925_TX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-325-\t\t\t\t  MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:326:\t.tx_fwdl = mt792x_dma_ring(MT7925_TXQ_FWDL,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:327:\t\t\t\t   MT7925_TX_FWDL_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-328-\t\t\t\t   MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:329:\t.rx_mcu = mt792x_dma_ring(MT7925_RXQ_MCU_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:330:\t\t\t\t  MT7925_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-331-\t\t\t\t  MT_RX_EVENT_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:332:\t.rx_data = mt792x_dma_ring(MT7925_RXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:333:\t\t\t\t   MT7925_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-334-\t\t\t\t   MT_RX_DATA_RING_BASE),\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=337=static const struct mt792x_dma_layout mt7927_dma_layout = {\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-338-\t.tx_data0 = mt792x_dma_ring(MT7927_TXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:339:\t\t\t\t    MT7925_TX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-340-\t\t\t\t    MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-341-\t.tx_mcu = mt792x_dma_ring(MT7927_TXQ_MCU_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:342:\t\t\t\t  MT7925_TX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-343-\t\t\t\t  MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-344-\t.tx_fwdl = mt792x_dma_ring(MT7927_TXQ_FWDL,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:345:\t\t\t\t   MT7925_TX_FWDL_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-346-\t\t\t\t   MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-347-\t.rx_mcu = mt792x_dma_ring(MT7927_RXQ_MCU_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:348:\t\t\t\t  MT7925_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-349-\t\t\t\t  MT_RX_EVENT_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-350-\t.rx_data = mt792x_dma_ring(MT7927_RXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:351:\t\t\t\t   MT7925_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-352-\t\t\t\t   MT_RX_DATA_RING_BASE),\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=355=static const struct mt792x_dma_layout mt7928_dma_layout = {\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:356:\t.tx_data0 = mt792x_dma_ring(MT7925_TXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:357:\t\t\t\t    MT7925_TX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-358-\t\t\t\t    MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:359:\t.tx_mcu = mt792x_dma_ring(MT7925_TXQ_MCU_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:360:\t\t\t\t  MT7925_TX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-361-\t\t\t\t  MT_TX_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:362:\t.tx_fwdl = mt792x_dma_ring(MT7925_TXQ_FWDL,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:363:\t\t\t\t   MT7925_TX_FWDL_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-364-\t\t\t\t   MT_TX_RING_BASE),\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-368-\t.rx_mcu = mt792x_dma_ring(MT7928_RXQ_MCU_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:369:\t\t\t\t  MT7925_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-370-\t\t\t\t  MT_RX_EVENT_RING_BASE),\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-371-\t.rx_data = mt792x_dma_ring(MT7928_RXQ_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:372:\t\t\t\t   MT7925_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-373-\t\t\t\t   MT_RX_DATA_RING_BASE),\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=376=static int mt7927_dma_init(struct mt792x_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-385-\t\t\t       MT7927_RXQ_DATA2,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:386:\t\t\t       MT7925_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-387-\t\t\t       MT_RX_BUF_SIZE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=476=static const struct mt792x_pcie_reg mt7925_pcie_reg = {\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:477:\t.imask = MT7925_PCIE_MAC_INT_ENABLE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:478:\t.pm = MT7925_PCIE_MAC_PM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-479-};\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=486=static const struct mt792x_irq_map mt7925_irq_map = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-492-\t.rx = {\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:493:\t\t.all_complete_mask = MT7925_INT_RX_DONE_ALL,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:494:\t\t.data_complete_mask = MT7925_INT_RX_DONE_DATA,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:495:\t\t.wm_complete_mask = MT7925_INT_RX_DONE_WM,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-496-\t\t.wm2_complete_mask = MT_INT_RX_DONE_WM2,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=528=static int mt7925_pci_probe(struct pci_dev *pdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-538-\t\t\t\tSURVEY_INFO_TIME_BSS_RX,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:539:\t\t.token_size = MT7925_TOKEN_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-540-\t\t.tx_prepare_skb = mt7925e_tx_prepare_skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=925=MODULE_DEVICE_TABLE(pci, mt7925_pci_device_table);\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:926:MODULE_FIRMWARE(MT7925_FIRMWARE_WM);\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:927:MODULE_FIRMWARE(MT7925_ROM_PATCH);\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-928-MODULE_FIRMWARE(MT7927_FIRMWARE_WM);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c=935=MODULE_AUTHOR(\"Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\");\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c:936:MODULE_DESCRIPTION(\"MediaTek MT7925E (PCIe) wireless driver\");\ndrivers/net/wireless/mediatek/mt76/mt7925/pci.c-937-MODULE_LICENSE(\"Dual BSD/GPL\");\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c=76=mt7925_regd_channel_update(struct wiphy *wiphy, struct mt792x_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-79-\t(!(dev-\u003ephy.clc_chan_conf \u0026 BIT(idx)) \u0026\u0026 (cfreq) \u003e= (sfreq) \u0026\u0026 (cfreq) \u003c= (efreq))\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:80:#define MT7925_UNII_59G_IS_VALID\t0x1\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:81:#define MT7925_UNII_6G_IS_VALID\t0x1e\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-82-\tstruct ieee80211_supported_band *sband;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-89-\t\tif ((mtcl_conf \u0026 0x3) == 0)\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:90:\t\t\tdev-\u003ephy.clc_chan_conf \u0026= ~MT7925_UNII_59G_IS_VALID;\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-91-\t\tif (((mtcl_conf \u003e\u003e 2) \u0026 0x3) == 0)\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:92:\t\t\tdev-\u003ephy.clc_chan_conf \u0026= ~MT7925_UNII_6G_IS_VALID;\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-93-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c=180=void mt7925_regd_notifier(struct wiphy *wiphy, struct regulatory_request *req)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-210-\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:211:\tif (MT7925_REGD_SUPPORTED(\u0026dev-\u003ephy)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-212-\t\tmt7925_regd_update(\u0026dev-\u003ephy, req-\u003ealpha2);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c=291=int mt7925_regd_update(struct mt792x_phy *phy, char *alpha2)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-307-\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:308:\tif (!MT7925_REGD_SUPPORTED(phy))\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-309-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c=428=int mt7925_regd_change(struct mt792x_phy *phy, char *alpha2)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-450-\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:451:\tif (MT7925_REGD_SUPPORTED(phy)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-452-\t\treturn mt7925_regd_update(phy, alpha2);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c=461=int mt7925_regd_init(struct mt792x_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-467-\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c:468:\tif (MT7925_REGD_SUPPORTED(phy)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/regd.c-469-\t\twiphy-\u003eregulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED |\n\n"
}

gemini-3.7-flash

null

null

							input: 20976
							output: 39
							thoughts: 177
						

**My Investigation into MT7925 Emulation**

Okay, so I'm diving into the MT7925 situation. First, I need to confirm whether we're dealing with the USB (MT7925U) or PCIe (MT7925E) variant, since that dictates the initial approach. Hold on, though... can we even *emulate* these devices? Can we fake a USB or PCIe interface for this specific MT7925 chipset?

Ah, right! Syzkaller has that Raw Gadget/Dummy HCD setup for USB fuzzing! That opens up possibilities. My immediate thought is, can I make the mt7925u USB driver probe correctly through USB gadget emulation? 

Now, let's step back a bit. I need to understand what `mt7925u` actually *does* during a probe. Does it immediately jump into firmware loading and communication, or does it start by registering the `mac80211 hw`? Knowing that will determine the complexity of the initial emulation setup.

Okay, let's refocus on USB fuzzing with Syzkaller, but specifically with wireless USB drivers. I need to see what's been done in this area.

Time to dig into the source. I'll need to check the `drivers/net/wireless/mediatek/mt76/mt7925/usb.c` file, or if I can find a relevant `usb_probe` function within the MT7925 source, to understand the device initialization sequence. That should give me the answers I need to proceed.

{
  "Expression": "mt7925_usb",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/mac.c=1620=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1621:mt7925_usb_sdio_write_txwi(struct mt792x_dev *dev, struct mt76_wcid *wcid,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1622-\t\t\t   enum mt76_txq_id qid, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1632-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1633:int mt7925_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1634-\t\t\t\t   enum mt76_txq_id qid, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1663-\tpktid = mt76_tx_status_skb_add(\u0026dev-\u003emt76, wcid, skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1664:\tmt7925_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1665-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1677-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1678:EXPORT_SYMBOL_GPL(mt7925_usb_sdio_tx_prepare_skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1679-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1680:void mt7925_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1681-\t\t\t\t     struct mt76_queue_entry *e)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1698-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1699:EXPORT_SYMBOL_GPL(mt7925_usb_sdio_tx_complete_skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1700-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1701:bool mt7925_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1702-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1710-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1711:EXPORT_SYMBOL_GPL(mt7925_usb_sdio_tx_status_data);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1712-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=369=int mt7925_mcu_get_temperature(struct mt792x_phy *phy);\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-370-\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:371:int mt7925_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-372-\t\t\t\t   enum mt76_txq_id qid, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-374-\t\t\t\t   struct mt76_tx_info *tx_info);\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:375:void mt7925_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-376-\t\t\t\t     struct mt76_queue_entry *e);\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:377:bool mt7925_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update);\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-378-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c=150=static int mt7925u_probe(struct usb_interface *usb_intf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-159-\t\t\t\tSURVEY_INFO_TIME_BSS_RX,\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:160:\t\t.tx_prepare_skb = mt7925_usb_sdio_tx_prepare_skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:161:\t\t.tx_complete_skb = mt7925_usb_sdio_tx_complete_skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c:162:\t\t.tx_status_data = mt7925_usb_sdio_tx_status_data,\ndrivers/net/wireless/mediatek/mt76/mt7925/usb.c-163-\t\t.rx_skb = mt7925_queue_rx_skb,\n"
}

gemini-3.7-flash

null

null

							input: 23311
							output: 48
							thoughts: 74
						

**Investigating the `mt7925_mcu_sta_mld_tlv` Function Callers**

Alright, let's get down to brass tacks. I need to figure out the context of this `mt7925_mcu_sta_mld_tlv` function. My usual approach is to quickly identify where it's being called, so I can understand the logical flow and how it's being used. I'll start with a straightforward grep for the function name itself. If that's too broad or the codebase is structured in a way that makes grepping inefficient, I'll then limit my search, honing in on the most likely area: the `drivers/net/wireless/mediatek/mt76/mt7925/` directory. That seems like a pretty safe bet given the naming convention. Knowing the Mediatek platform, I'd also check if there are any code browsing tools that would let me see the call graph directly. That would be the cleanest way to understand the relationships. Ultimately, I'm aiming to quickly paint a mental picture of what's going on around that function and how it's integrated into the driver.

{
  "Expression": "mt7925_mcu_sta_mld_tlv",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2061=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2062:mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2063-\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2163=mt7925_mcu_sta_cmd(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2202-\t\tif (info-\u003estate != MT76_STA_INFO_STATE_NONE) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2203:\t\t\tmt7925_mcu_sta_mld_tlv(skb, info-\u003evif,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2204-\t\t\t\t\t       info-\u003elink_sta-\u003esta,\n"
}

gemini-3.7-flash

null

null

							input: 24036
							output: 44
							thoughts: 44
						

Here's my take on those thoughts:

**Analyzing the `mt7925_mcu_sta_cmd` Function**

Okay, so I need to understand this `mt7925_mcu_sta_cmd` function better. Where is it being called from? That's the crucial question. I need to trace its callers. Understanding the calling context will tell me everything I need to know about its purpose and how it fits into the broader driver architecture. Let's get to work and find those call sites. This is where the fun begins.

{
  "Expression": "mt7925_mcu_sta_cmd",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2162=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2163:mt7925_mcu_sta_cmd(struct mt76_phy *phy,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2164-\t\t   struct mt76_sta_cmd_info *info)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2225=int mt7925_mcu_sta_update(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2247-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2248:\treturn mt7925_mcu_sta_cmd(\u0026dev-\u003emphy, \u0026info);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2249-}\n"
}

gemini-3.7-flash

null

null

							input: 24558
							output: 44
							thoughts: 24
						

Here's my thought process, as if I were analyzing that code:

**Analyzing the Callers of `mt7925_mcu_sta_update`**

Okay, so I'm digging into this `mt7925_mcu_sta_update` function. My immediate question is: *Who* is calling this thing? It's essential to understand the context in which this update function is used. Knowing the callers will tell me about the events or conditions that trigger these updates. Are we talking about station state changes, management frame updates, maybe even power-saving transitions? 

I need to trace the call graph. A quick grep, or if I have it available, my IDE's call hierarchy feature, will be invaluable here. I'm looking for the call sites. I want a clear picture of what's *upstream* of this function. Any clues to be found in the related code.

Once I have the list of callers, I'll start analyzing the surrounding code blocks. What data is being passed in? What's the state of the system when this function gets called? Is there any interesting conditional logic? This is a critical step to gain a full understanding of the wireless driver, and how it interacts with the MediaTek 7925 chipset. I'll need to piece together the sequence of events leading up to the call and the purpose of calling the function.

{
  "Expression": "mt7925_mcu_sta_update",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/mac.c=1473=mt7925_vif_connect_iter(void *priv, u8 *mac,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1502-\t\t\t\t\t    true, NULL);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1503:\t\tmt7925_mcu_sta_update(dev, NULL, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1504-\t\t\t\t      \u0026mvif-\u003esta.deflink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=911=static int mt7925_mac_link_sta_add(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-991-\t    link_sta == mlink-\u003epri_link) {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:992:\t\tret = mt7925_mcu_sta_update(dev, link_sta, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-993-\t\t\t\t\t    mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1013-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1014:\t\tret = mt7925_mcu_sta_update(dev, mlink-\u003epri_link, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1015-\t\t\t\t\t    pri_mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1019-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1020:\t\tret = mt7925_mcu_sta_update(dev, link_sta, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1021-\t\t\t\t\t    mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1025-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1026:\t\tret = mt7925_mcu_sta_update(dev, link_sta, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1027-\t\t\t\t\t    mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1201=static void mt7925_mac_link_sta_assoc(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1234-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1235:\tmt7925_mcu_sta_update(dev, link_sta, vif, mlink, true,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1236-\t\t\t      MT76_STA_INFO_STATE_ASSOC);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1279=static void mt7925_mac_link_sta_remove(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1294-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1295:\tmt7925_mcu_sta_update(dev, link_sta, vif, mlink, false,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1296-\t\t\t      MT76_STA_INFO_STATE_NONE);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1947=mt7925_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1964-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1965:\terr = mt7925_mcu_sta_update(dev, NULL, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1966-\t\t\t\t    \u0026mvif-\u003esta.deflink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2095=static void mt7925_vif_cfg_changed(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2108-\tif (changed \u0026 BSS_CHANGED_ASSOC) {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2109:\t\tmt7925_mcu_sta_update(dev, NULL, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2110-\t\t\t\t      \u0026mvif-\u003esta.deflink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2163=mt7925_mcu_sta_cmd(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2224-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2225:int mt7925_mcu_sta_update(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2226-\t\t\t  struct ieee80211_link_sta *link_sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=281=int mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-283-\t\t\t  bool enable);\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:284:int mt7925_mcu_sta_update(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-285-\t\t\t  struct ieee80211_link_sta *link_sta,\n"
}

gemini-3.7-flash

null

null

							input: 26830
							output: 50
							thoughts: 381
						

**My Assessment of the Patch's Fuzzing Potential**

Okay, first things first, let me meticulously review these instructions. The criteria for not fuzzing are pretty clear: Documentation tweaks, Kconfig changes, comments only, decorative logging, harmless constant modifications, unreachable code in virtualized environments, specific hardware-dependent drivers, and teardown callbacks. Got it.

Now, this patch... does it fall into one of those "not worth fuzzing" categories? I need to figure out if it modifies anything reachable in a virtualized environment. The critical question here is whether the MT7925 driver is fuzzable in GCE or QEMU. That's the crux of it. I need to know if this is something that can be probed, tested, and triggered in those environments.

Let's do a little digging. Is there a way to access MT7925 via USB? Or another interface supported in virtualization? I see it relates to MT76 wifi drivers, so that gives me a starting point. Let's look at `mt7925u_probe` in `drivers/net/wireless/mediatek/mt76/mt7925/usb.c`. I need to get into the details of the usb.c file to fully understand whether the relevant code path can be executed in those environments. This is where I start.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/usb.c",
  "FirstLine": 140,
  "LineCount": 80
}

{
  "Contents": " 140:\t\n 141:\t\terr = __mt7925_start(\u0026dev-\u003ephy);\n 142:\tout:\n 143:\t\tclear_bit(MT76_RESET, \u0026dev-\u003emphy.state);\n 144:\t\n 145:\t\tmt76_worker_enable(\u0026dev-\u003emt76.tx_worker);\n 146:\t\n 147:\t\treturn err;\n 148:\t}\n 149:\t\n 150:\tstatic int mt7925u_probe(struct usb_interface *usb_intf,\n 151:\t\t\t\t const struct usb_device_id *id)\n 152:\t{\n 153:\t\tstatic const struct mt76_driver_ops drv_ops = {\n 154:\t\t\t.txwi_size = MT_SDIO_TXD_SIZE,\n 155:\t\t\t.drv_flags = MT_DRV_RX_DMA_HDR | MT_DRV_HW_MGMT_TXQ |\n 156:\t\t\t\t     MT_DRV_AMSDU_OFFLOAD,\n 157:\t\t\t.survey_flags = SURVEY_INFO_TIME_TX |\n 158:\t\t\t\t\tSURVEY_INFO_TIME_RX |\n 159:\t\t\t\t\tSURVEY_INFO_TIME_BSS_RX,\n 160:\t\t\t.tx_prepare_skb = mt7925_usb_sdio_tx_prepare_skb,\n 161:\t\t\t.tx_complete_skb = mt7925_usb_sdio_tx_complete_skb,\n 162:\t\t\t.tx_status_data = mt7925_usb_sdio_tx_status_data,\n 163:\t\t\t.rx_skb = mt7925_queue_rx_skb,\n 164:\t\t\t.rx_check = mt7925_rx_check,\n 165:\t\t\t.sta_add = mt7925_mac_sta_add,\n 166:\t\t\t.sta_event = mt7925_mac_sta_event,\n 167:\t\t\t.sta_remove = mt7925_mac_sta_remove,\n 168:\t\t\t.update_survey = mt792x_update_channel,\n 169:\t\t};\n 170:\t\tstatic const struct mt792x_hif_ops hif_ops = {\n 171:\t\t\t.mcu_init = mt7925u_mcu_init,\n 172:\t\t\t.init_reset = mt792xu_init_reset,\n 173:\t\t\t.reset = mt7925u_mac_reset,\n 174:\t\t};\n 175:\t\tstatic struct mt76_bus_ops bus_ops = {\n 176:\t\t\t.rr = mt792xu_rr,\n 177:\t\t\t.wr = mt792xu_wr,\n 178:\t\t\t.rmw = mt792xu_rmw,\n 179:\t\t\t.read_copy = mt76u_read_copy,\n 180:\t\t\t.write_copy = mt792xu_copy,\n 181:\t\t\t.type = MT76_BUS_USB,\n 182:\t\t};\n 183:\t\tstruct usb_device *udev = interface_to_usbdev(usb_intf);\n 184:\t\tstruct ieee80211_ops *ops;\n 185:\t\tstruct ieee80211_hw *hw;\n 186:\t\tstruct mt792x_dev *dev;\n 187:\t\tstruct mt76_dev *mdev;\n 188:\t\tu8 features;\n 189:\t\tint ret;\n 190:\t\n 191:\t\tops = mt792x_get_mac80211_ops(\u0026usb_intf-\u003edev, \u0026mt7925_ops,\n 192:\t\t\t\t\t      (void *)id-\u003edriver_info, \u0026features);\n 193:\t\tif (!ops)\n 194:\t\t\treturn -ENOMEM;\n 195:\t\n 196:\t\tops-\u003estop = mt792xu_stop;\n 197:\t\n 198:\t\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(*dev), ops, \u0026drv_ops);\n 199:\t\tif (!mdev)\n 200:\t\t\treturn -ENOMEM;\n 201:\t\n 202:\t\tdev = container_of(mdev, struct mt792x_dev, mt76);\n 203:\t\tdev-\u003efw_features = features;\n 204:\t\tdev-\u003ehif_ops = \u0026hif_ops;\n 205:\t\tmt792xu_reset_work_init(dev);\n 206:\t\n 207:\t\tusb_reset_device(udev);\n 208:\t\n 209:\t\tusb_set_intfdata(usb_intf, dev);\n 210:\t\n 211:\t\tret = __mt76u_init(mdev, usb_intf, \u0026bus_ops);\n 212:\t\tif (ret \u003c 0)\n 213:\t\t\tgoto error;\n 214:\t\n 215:\t\tmdev-\u003erev = (mt76_rr(dev, MT_HW_CHIPID) \u003c\u003c 16) |\n 216:\t\t\t    (mt76_rr(dev, MT_HW_REV) \u0026 0xff);\n 217:\t\tdev_dbg(mdev-\u003edev, \"ASIC revision: %04x\\n\", mdev-\u003erev);\n 218:\t\n 219:\t\tif (mt76_chip(mdev) == 0x6639) {\n"
}

gemini-3.7-flash

null

null

							input: 29042
							output: 52
							thoughts: 205
						

**Analyzing the `mt7925u_probe` Function and USB Driver Testing**

Okay, so the `mt7925u_probe` function is triggered by mac80211 when a USB device is connected, likely via raw gadget or fuzzing using syzkaller. My initial thought is, does this setup even work with a USB gadget? I need to clarify that.

Right, let me check how syzkaller actually tests USB and, specifically, WiFi drivers. Ah, syzkaller utilizes `syz_usb_connect`, which emulates USB devices through `dummy_hcd` and `raw_gadget`. So, when the connected USB device aligns with the `mt7925_usb_device_table` entry in the `mt7925u` driver, the `probe` function is subsequently invoked.

Hmm, but I need to understand this *particular* patch better. Let's delve into the actual code changes. I'll read through `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c`, and focus around line 2068, to understand what `mt7925_mcu_sta_mld_tlv` does and how it was modified. That should give me the core context.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c",
  "FirstLine": 2060,
  "LineCount": 95
}

{
  "Contents": "2060:\t\n2061:\tstatic void\n2062:\tmt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\n2063:\t\t\t       struct ieee80211_vif *vif,\n2064:\t\t\t       struct ieee80211_sta *sta,\n2065:\t\t\t       struct mt792x_bss_conf *mconf,\n2066:\t\t\t       struct mt792x_link_sta *mlink)\n2067:\t{\n2068:\t\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\n2069:\t\tstruct mt792x_sta *msta = (struct mt792x_sta *)sta-\u003edrv_priv;\n2070:\t\tstruct mt792x_dev *dev = mvif-\u003ephy-\u003edev;\n2071:\t\tunsigned long valid = msta-\u003evalid_links;\n2072:\t\tstruct mt792x_bss_conf *mconf_pri;\n2073:\t\tstruct sta_rec_mld *mld;\n2074:\t\tunsigned int link_id;\n2075:\t\tstruct tlv *tlv;\n2076:\t\tu8 max_links;\n2077:\t\tu8 cnt = 0;\n2078:\t\n2079:\t\t/* Primary link always uses driver's deflink WCID. */\n2080:\t\tmconf_pri = (msta-\u003edeflink_id != IEEE80211_LINK_UNSPECIFIED) ?\n2081:\t\t\t    mt792x_vif_to_link(mvif, msta-\u003edeflink_id) : NULL;\n2082:\t\n2083:\t\t/* If caller is operating on deflink, reuse its mconf as primary. */\n2084:\t\tif (!mconf_pri \u0026\u0026 mlink == \u0026msta-\u003edeflink)\n2085:\t\t\tmconf_pri = mconf;\n2086:\t\n2087:\t\tif (!mconf_pri) {\n2088:\t\t\tdev_warn_ratelimited(dev-\u003emt76.dev,\n2089:\t\t\t\t\t     \"mt7925: MLD_TLV_LINK skip (no primary mconf) sta=%pM\\n\",\n2090:\t\t\t\tsta-\u003eaddr);\n2091:\t\t\treturn;\n2092:\t\t}\n2093:\t\n2094:\t\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));\n2095:\t\tmld = (struct sta_rec_mld *)tlv;\n2096:\t\tmemcpy(mld-\u003emac_addr, sta-\u003eaddr, ETH_ALEN);\n2097:\t\n2098:\t\tmld-\u003eprimary_id = cpu_to_le16(msta-\u003edeflink.wcid.idx);\n2099:\t\tmld-\u003ewlan_id = cpu_to_le16(msta-\u003edeflink.wcid.idx);\n2100:\t\n2101:\t\t/* Always encode primary link first. */\n2102:\t\tmld-\u003elink[cnt].wlan_id = cpu_to_le16(msta-\u003edeflink.wcid.idx);\n2103:\t\tmld-\u003elink[cnt++].bss_idx = mconf_pri-\u003emt76.idx;\n2104:\t\n2105:\t\t/* Encode the remaining valid links of this station, not just the one\n2106:\t\t * this command happens to be updating. STA_REC_MLD is a complete\n2107:\t\t * record: every update rewrites link_num and link[], so selecting the\n2108:\t\t * secondary entry from the caller's link made the record firmware\n2109:\t\t * ends up holding depend on which link was updated last.\n2110:\t\t */\n2111:\t\tmax_links = ARRAY_SIZE(mld-\u003elink);\n2112:\t\n2113:\t\t/* mt7925_mac_link_sta_add() issues this command before publishing\n2114:\t\t * a new link in msta-\u003elink[] and msta-\u003evalid_links. Include that\n2115:\t\t * in-flight caller link in this record so it is not lost.\n2116:\t\t */\n2117:\t\tif (mlink \u0026\u0026 mconf \u0026\u0026 mlink != \u0026msta-\u003edeflink)\n2118:\t\t\tvalid |= BIT(mlink-\u003ewcid.link_id);\n2119:\t\n2120:\t\tfor_each_set_bit(link_id, \u0026valid, IEEE80211_MLD_MAX_NUM_LINKS) {\n2121:\t\t\tstruct mt792x_link_sta *mlink_sec;\n2122:\t\t\tstruct mt792x_bss_conf *mconf_sec;\n2123:\t\n2124:\t\t\tif (cnt == max_links)\n2125:\t\t\t\tbreak;\n2126:\t\n2127:\t\t\tif (link_id == msta-\u003edeflink_id)\n2128:\t\t\t\tcontinue;\n2129:\t\n2130:\t\t\tmlink_sec = mt792x_sta_to_link(msta, link_id);\n2131:\t\t\tif (!mlink_sec \u0026\u0026 mlink \u0026\u0026 link_id == mlink-\u003ewcid.link_id)\n2132:\t\t\t\tmlink_sec = mlink;\n2133:\t\t\tif (!mlink_sec || mlink_sec == \u0026msta-\u003edeflink)\n2134:\t\t\t\tcontinue;\n2135:\t\n2136:\t\t\tmconf_sec = rcu_dereference_protected(mvif-\u003elink_conf[link_id],\n2137:\t\t\t\t\t\t\t      lockdep_is_held(\u0026dev-\u003emt76.mutex));\n2138:\t\t\tif (!mconf_sec)\n2139:\t\t\t\tcontinue;\n2140:\t\n2141:\t\t\tif (cnt == 1)\n2142:\t\t\t\tmld-\u003esecondary_id = cpu_to_le16(mlink_sec-\u003ewcid.idx);\n2143:\t\n2144:\t\t\tmld-\u003elink[cnt].wlan_id = cpu_to_le16(mlink_sec-\u003ewcid.idx);\n2145:\t\t\tmld-\u003elink[cnt++].bss_idx = mconf_sec-\u003emt76.idx;\n2146:\t\t}\n2147:\t\n2148:\t\tmld-\u003elink_num = cnt;\n2149:\t}\n2150:\t\n2151:\tstatic void\n2152:\tmt7925_mcu_sta_remove_tlv(struct sk_buff *skb)\n2153:\t{\n2154:\t\tstruct sta_rec_remove *rem;\n"
}

gemini-3.7-flash

null

null

							input: 31365
							output: 48
							thoughts: 122
						

**Reaching for the Improbable: A Quick Diagnostic**

Okay, here's the situation. I'm taking a look at this and my initial question is: can I actually *reach* this target? First thought is that mt7925 is a WiFi 7 driver for a MediaTek chip, the MT7925. But, does QEMU, my trusted emulator, support this specific device? No, it doesn't. That’s a roadblock. But hold on, what about USB emulation using syzkaller? It might be possible to fuzz the USB interface as a workaround. Now, to investigate that approach, I need to check the `mt7925_usb_device_table` in `drivers/net/wireless/mediatek/mt76/mt7925/usb.c`. This table will be the key to understanding if this is a viable path forward. I need to know if the USB interface is even present and how it's handled. Let's see if we can find something there.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/usb.c",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\t/* Copyright (C) 2023 MediaTek Inc. */\n   3:\t\n   4:\t#include \u003clinux/kernel.h\u003e\n   5:\t#include \u003clinux/module.h\u003e\n   6:\t#include \u003clinux/usb.h\u003e\n   7:\t\n   8:\t#include \"mt7925.h\"\n   9:\t#include \"mcu.h\"\n  10:\t#include \"mac.h\"\n  11:\t\n  12:\tstatic const struct usb_device_id mt7925u_device_table[] = {\n  13:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x6639, 0xff, 0xff, 0xff),\n  14:\t\t\t.driver_info = (kernel_ulong_t)MT7925_FIRMWARE_WM },\n  15:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7925, 0xff, 0xff, 0xff),\n  16:\t\t\t.driver_info = (kernel_ulong_t)MT7925_FIRMWARE_WM },\n  17:\t\t/* Netgear, Inc. A8500 */\n  18:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9050, 0xff, 0xff, 0xff),\n  19:\t\t\t.driver_info = (kernel_ulong_t)MT7925_FIRMWARE_WM },\n  20:\t\t/* Netgear, Inc. A9000 */\n  21:\t\t{ USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9072, 0xff, 0xff, 0xff),\n  22:\t\t\t.driver_info = (kernel_ulong_t)MT7925_FIRMWARE_WM },\n  23:\t\t{ },\n  24:\t};\n  25:\t\n  26:\tstatic int\n  27:\tmt7925u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,\n  28:\t\t\t\t int cmd, int *seq)\n  29:\t{\n  30:\t\tstruct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);\n  31:\t\tu32 pad, ep;\n  32:\t\tint ret;\n  33:\t\n  34:\t\tret = mt7925_mcu_fill_message(mdev, skb, cmd, seq);\n  35:\t\tif (ret)\n  36:\t\t\treturn ret;\n  37:\t\n  38:\t\tmdev-\u003emcu.timeout = 3 * HZ;\n  39:\t\n  40:\t\tif (cmd != MCU_CMD(FW_SCATTER))\n  41:\t\t\tep = MT_EP_OUT_INBAND_CMD;\n  42:\t\telse\n  43:\t\t\tep = MT_EP_OUT_AC_BE;\n  44:\t\n  45:\t\tmt792x_skb_add_usb_sdio_hdr(dev, skb, 0);\n  46:\t\tpad = round_up(skb-\u003elen, 4) + 4 - skb-\u003elen;\n  47:\t\t__skb_put_zero(skb, pad);\n  48:\t\n  49:\t\tret = mt76u_bulk_msg(\u0026dev-\u003emt76, skb-\u003edata, skb-\u003elen, NULL,\n  50:\t\t\t\t     1000, ep);\n"
}

gemini-3.7-flash

null

null

							input: 32707
							output: 45
							thoughts: 566
						

**Analyzing the Fuzzing Potential of This Patch**

Okay, let's break this down. First, I remember that USB devices *can* be fuzzed in virtualized environments like syzkaller, especially using USB Raw Gadget or dummy_hcd emulation. Now, I need to make sure this patch meets the criteria for being worth fuzzing. I'll quickly run through the rules again: Documentation/ changes, Kconfig mods, comments, decorative changes like logging, changes to constants without functional impact, unreachable code paths in virtualized environments, vendor-specific PCIe switch/SmartNIC/GPU drivers needing physical hardware, and driver teardown callbacks are all no-gos.

Aha! The rule explicitly mentions "even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim)." So, since this code *can* be reached with the use of software emulation, that's a good sign. The question then becomes, does the code relate to that type of emulation?

Now, I'm thinking about `mt7925u` and whether it plays nicely with USB gadget. If the USB device is probed via USB gadget, it can initialize the driver. That should be a good indicator. I need to zero in on this particular function, `mt7925_mcu_sta_mld_tlv`. When a WiFi interface is brought up (or simulated using mac80211 or nl80211), commands like `NL80211_CMD_NEW_STATION`, `NL80211_CMD_SET_STATION`, and things like `mt7925_mac_link_sta_add` or MLD operations will call `mt7925_mcu_sta_update`, which in turn, calls `mt7925_mcu_sta_cmd` and then `mt7925_mcu_sta_mld_tlv`. I need to ensure this is reachable through that path.

To confirm reachability, I need to check how `mt7925_mac_link_sta_add` is called by mac80211, and I'll do that by grepping for instances of `mt7925_mac_link_sta_add` and/or `sta_add`. I'm going to start there and see if the function is connected to USB gadget.

{
  "Expression": "mt7925_mac_link_sta_add",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/main.c=883=mt7925_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-910-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:911:static int mt7925_mac_link_sta_add(struct mt76_dev *mdev,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-912-\t\t\t\t   struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1091=mt7925_mac_sta_add_links(struct mt792x_dev *dev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1119-\t\tlink_sta = mt792x_sta_to_link_sta(vif, sta, link_id);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1120:\t\terr = mt7925_mac_link_sta_add(\u0026dev-\u003emt76, vif, link_sta, mlink);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1121-\t\tif (err) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1142=int mt7925_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1159-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1160:\t\terr = mt7925_mac_link_sta_add(mdev, vif, \u0026sta-\u003edeflink,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1161-\t\t\t\t\t      \u0026msta-\u003edeflink);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2062=mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2112-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2113:\t/* mt7925_mac_link_sta_add() issues this command before publishing\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2114-\t * a new link in msta-\u003elink[] and msta-\u003evalid_links. Include that\n"
}

gemini-3.7-flash

null

null

							input: 34669
							output: 47
							thoughts: 35
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Diving into the MT7925 Configuration Landscape**

Right, let's get down to brass tacks. I need to quickly establish the essential configuration parameters for the MT7925 series, specifically focusing on the MT7925, MT7925U, and MT7925E variants. Time to dive into the Kconfig files. My goal here is to identify exactly which options are *mandatory* for these chips to function correctly within the relevant driver, and also to understand what the *optional* configurations are that allow for the device's feature-set to be used, and if there are any subtle distinctions in requirements between the different sub-models. I'm looking for anything that might impact the base device functionality - things like power management settings, interface modes, or crucial clock configurations that could make or break initial bring-up. It is important to know the minimum set of configurations for bringing up the device to ensure that initial testing can be carried out. From there, I can determine if any additional work needs to be done.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/Kconfig",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\tconfig MT7925_COMMON\n   3:\t\ttristate\n   4:\t\tselect MT792x_LIB\n   5:\t\tselect WANT_DEV_COREDUMP\n   6:\t\n   7:\tconfig MT7925E\n   8:\t\ttristate \"MediaTek MT7925E (PCIe) support\"\n   9:\t\tselect MT7925_COMMON\n  10:\t\tdepends on MAC80211\n  11:\t\tdepends on PCI\n  12:\t\thelp\n  13:\t\t  This adds support for MT7925-based wireless PCIe devices,\n  14:\t\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n  15:\t\t  2x2:2SS 4096-QAM, 160MHz channels.\n  16:\t\n  17:\t\t  To compile this driver as a module, choose M here.\n  18:\t\n  19:\tconfig MT7925U\n  20:\t\ttristate \"MediaTek MT7925U (USB) support\"\n  21:\t\tselect MT792x_USB\n  22:\t\tselect MT7925_COMMON\n  23:\t\tdepends on MAC80211\n  24:\t\tdepends on USB\n  25:\t\thelp\n  26:\t\t  This adds support for MT7925-based wireless USB devices,\n  27:\t\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n  28:\t\t  2x2:2SS 4096-QAM, 160MHz channels.\n  29:\t\n  30:\t\t  To compile this driver as a module, choose M here.\n"
}

gemini-3.7-flash

null

null

							input: 35473
							output: 41
							thoughts: 24
						

Here's my take:

**Investigating the Kconfig File for MT76 Wireless Drivers**

Okay, so we're looking at some wireless driver configurations, and my gut feeling is that we're missing something crucial. I've been down this road before. To make sure we've got the whole picture, I need to take a look at the `drivers/net/wireless/mediatek/mt76/Kconfig` file. It's often the central source of truth for these types of configurations. I know the Mediatek MT76 drivers pretty well, and based on past experience, Kconfig files are the best starting point when I encounter a system that is not behaving as expected. Let's see what's being enabled or disabled there and whether there's a setting that's causing this issue. Time to dig in.

{
  "File": "drivers/net/wireless/mediatek/mt76/Kconfig",
  "FirstLine": 1,
  "LineCount": 80
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\tconfig MT76_CORE\n   3:\t\ttristate\n   4:\t\tselect PAGE_POOL\n   5:\t\n   6:\tconfig MT76_LEDS\n   7:\t\tbool\n   8:\t\tdepends on MT76_CORE\n   9:\t\tdepends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS\n  10:\t\tdefault y\n  11:\t\n  12:\tconfig MT76_USB\n  13:\t\ttristate\n  14:\t\tdepends on MT76_CORE\n  15:\t\n  16:\tconfig MT76_SDIO\n  17:\t\ttristate\n  18:\t\tdepends on MT76_CORE\n  19:\t\n  20:\tconfig MT76x02_LIB\n  21:\t\ttristate\n  22:\t\tselect MT76_CORE\n  23:\t\n  24:\tconfig MT76x02_USB\n  25:\t\ttristate\n  26:\t\tselect MT76_USB\n  27:\t\n  28:\tconfig MT76_CONNAC_LIB\n  29:\t\ttristate\n  30:\t\tselect MT76_CORE\n  31:\t\n  32:\tconfig MT792x_LIB\n  33:\t\ttristate\n  34:\t\tselect MT76_CONNAC_LIB\n  35:\t\n  36:\tconfig MT792x_USB\n  37:\t\ttristate\n  38:\t\tselect MT76_USB\n  39:\t\n  40:\tconfig MT76_NPU\n  41:\t\ttristate\n  42:\t\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\n  43:\t\n  44:\tsource \"drivers/net/wireless/mediatek/mt76/mt76x0/Kconfig\"\n  45:\tsource \"drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig\"\n  46:\tsource \"drivers/net/wireless/mediatek/mt76/mt7603/Kconfig\"\n  47:\tsource \"drivers/net/wireless/mediatek/mt76/mt7615/Kconfig\"\n  48:\tsource \"drivers/net/wireless/mediatek/mt76/mt7915/Kconfig\"\n  49:\tsource \"drivers/net/wireless/mediatek/mt76/mt7921/Kconfig\"\n  50:\tsource \"drivers/net/wireless/mediatek/mt76/mt7996/Kconfig\"\n  51:\tsource \"drivers/net/wireless/mediatek/mt76/mt7925/Kconfig\"\n"
}

gemini-3.7-flash

null

null

							input: 36445
							output: 29
							thoughts: 17
						

Here's my take on those thoughts, tailored for an expert audience:

**Diving into the Mediatek Wireless Configuration**

Okay, time to get my hands dirty. I need to take a look at `drivers/net/wireless/mediatek/Kconfig`. This is where the magic happens, the heart of the Mediatek wireless driver's configuration. I'm going to start by getting a clear picture of what's been defined and how the options are structured. I'm especially interested in dependencies, defaults, and any unusual configurations that might be worth further investigation. I'll need to see how the features are enabled/disabled at compile time. I need to understand what variables are going to be set by the kernel build, and the implications of those variables for the performance and robustness of the driver. Let's see what gems are hidden in this configuration file.

{
  "Expression": "mt76",
  "PathPrefix": "drivers/net/wireless/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 50869 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/Kconfig=13=if WLAN_VENDOR_MEDIATEK\ndrivers/net/wireless/mediatek/Kconfig:14:source \"drivers/net/wireless/mediatek/mt7601u/Kconfig\"\ndrivers/net/wireless/mediatek/Kconfig:15:source \"drivers/net/wireless/mediatek/mt76/Kconfig\"\ndrivers/net/wireless/mediatek/Kconfig-16-endif # WLAN_VENDOR_MEDIATEK\n--\ndrivers/net/wireless/mediatek/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/mediatek/Makefile:2:obj-$(CONFIG_MT7601U)\t+= mt7601u/\ndrivers/net/wireless/mediatek/Makefile:3:obj-$(CONFIG_MT76_CORE)\t+= mt76/\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig=40=config MT76_NPU\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-43-\ndrivers/net/wireless/mediatek/mt76/Kconfig:44:source \"drivers/net/wireless/mediatek/mt76/mt76x0/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:45:source \"drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:46:source \"drivers/net/wireless/mediatek/mt76/mt7603/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:47:source \"drivers/net/wireless/mediatek/mt76/mt7615/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:48:source \"drivers/net/wireless/mediatek/mt76/mt7915/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:49:source \"drivers/net/wireless/mediatek/mt76/mt7921/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:50:source \"drivers/net/wireless/mediatek/mt76/mt7996/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:51:source \"drivers/net/wireless/mediatek/mt76/mt7925/Kconfig\"\n--\ndrivers/net/wireless/mediatek/mt76/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/Makefile:2:obj-$(CONFIG_MT76_CORE) += mt76.o\ndrivers/net/wireless/mediatek/mt76/Makefile:3:obj-$(CONFIG_MT76_USB) += mt76-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile:4:obj-$(CONFIG_MT76_SDIO) += mt76-sdio.o\ndrivers/net/wireless/mediatek/mt76/Makefile:5:obj-$(CONFIG_MT76x02_LIB) += mt76x02-lib.o\ndrivers/net/wireless/mediatek/mt76/Makefile:6:obj-$(CONFIG_MT76x02_USB) += mt76x02-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile:7:obj-$(CONFIG_MT76_CONNAC_LIB) += mt76-connac-lib.o\ndrivers/net/wireless/mediatek/mt76/Makefile-8-obj-$(CONFIG_MT792x_LIB) += mt792x-lib.o\ndrivers/net/wireless/mediatek/mt76/Makefile=9=obj-$(CONFIG_MT792x_USB) += mt792x-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-10-\ndrivers/net/wireless/mediatek/mt76/Makefile:11:mt76-y := \\\ndrivers/net/wireless/mediatek/mt76/Makefile-12-\tmmio.o util.o trace.o dma.o mac80211.o debugfs.o eeprom.o \\\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=15=ifdef CONFIG_MT76_NPU\n--\ndrivers/net/wireless/mediatek/mt76/Makefile-17-# but it behaves as a bool symbol here.\ndrivers/net/wireless/mediatek/mt76/Makefile:18:mt76-y += npu.o\ndrivers/net/wireless/mediatek/mt76/Makefile-19-endif\ndrivers/net/wireless/mediatek/mt76/Makefile:20:mt76-$(CONFIG_PCI) += pci.o\ndrivers/net/wireless/mediatek/mt76/Makefile:21:mt76-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/mediatek/mt76/Makefile-22-\ndrivers/net/wireless/mediatek/mt76/Makefile:23:mt76-usb-y := usb.o usb_trace.o\ndrivers/net/wireless/mediatek/mt76/Makefile:24:mt76-sdio-y := sdio.o sdio_txrx.o\ndrivers/net/wireless/mediatek/mt76/Makefile-25-\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=27=CFLAGS_usb_trace.o := -I$(src)\ndrivers/net/wireless/mediatek/mt76/Makefile:28:CFLAGS_mt76x02_trace.o := -I$(src)\ndrivers/net/wireless/mediatek/mt76/Makefile-29-CFLAGS_mt792x_trace.o := -I$(src)\ndrivers/net/wireless/mediatek/mt76/Makefile-30-\ndrivers/net/wireless/mediatek/mt76/Makefile:31:mt76x02-lib-y := mt76x02_util.o mt76x02_mac.o mt76x02_mcu.o \\\ndrivers/net/wireless/mediatek/mt76/Makefile:32:\t\t mt76x02_eeprom.o mt76x02_phy.o mt76x02_mmio.o \\\ndrivers/net/wireless/mediatek/mt76/Makefile:33:\t\t mt76x02_txrx.o mt76x02_trace.o mt76x02_debugfs.o \\\ndrivers/net/wireless/mediatek/mt76/Makefile:34:\t\t mt76x02_dfs.o mt76x02_beacon.o\ndrivers/net/wireless/mediatek/mt76/Makefile-35-\ndrivers/net/wireless/mediatek/mt76/Makefile:36:mt76x02-usb-y := mt76x02_usb_mcu.o mt76x02_usb_core.o\ndrivers/net/wireless/mediatek/mt76/Makefile-37-\ndrivers/net/wireless/mediatek/mt76/Makefile:38:mt76-connac-lib-y := mt76_connac_mcu.o mt76_connac_mac.o mt76_connac3_mac.o\ndrivers/net/wireless/mediatek/mt76/Makefile-39-\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=43=mt792x-usb-y := mt792x_usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-44-\ndrivers/net/wireless/mediatek/mt76/Makefile:45:obj-$(CONFIG_MT76x0_COMMON) += mt76x0/\ndrivers/net/wireless/mediatek/mt76/Makefile:46:obj-$(CONFIG_MT76x2_COMMON) += mt76x2/\ndrivers/net/wireless/mediatek/mt76/Makefile:47:obj-$(CONFIG_MT7603E) += mt7603/\ndrivers/net/wireless/mediatek/mt76/Makefile:48:obj-$(CONFIG_MT7615_COMMON) += mt7615/\ndrivers/net/wireless/mediatek/mt76/Makefile-49-obj-$(CONFIG_MT7915E) += mt7915/\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-4- */\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:5:#include \"mt76.h\"\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-6-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:7:static unsigned long mt76_aggr_tid_to_timeo(u8 tidno)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-8-{\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c=15=static void\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:16:mt76_aggr_release(struct mt76_rx_tid *tid, struct sk_buff_head *frames, int idx)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-17-{\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c=31=static void\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:32:mt76_rx_aggr_release_frames(struct mt76_rx_tid *tid,\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-33-\t\t\t    struct sk_buff_head *frames,\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-39-\t\tidx = tid-\u003ehead % tid-\u003esize;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:40:\t\tmt76_aggr_release(tid, frames, idx);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-41-\t}\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c=44=static void\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:45:mt76_rx_aggr_release_head(struct mt76_rx_tid *tid, struct sk_buff_head *frames)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-46-{\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-49-\twhile (tid-\u003ereorder_buf[idx]) {\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:50:\t\tmt76_aggr_release(tid, frames, idx);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-51-\t\tidx = tid-\u003ehead % tid-\u003esize;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c=55=static void\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:56:mt76_rx_aggr_check_release(struct mt76_rx_tid *tid, struct sk_buff_head *frames)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-57-{\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:58:\tstruct mt76_rx_status *status;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-59-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-64-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:65:\tmt76_rx_aggr_release_head(tid, frames);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-66-\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-77-\t\tnframes--;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:78:\t\tstatus = (struct mt76_rx_status *)skb-\u003ecb;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-79-\t\tif (!time_after32(jiffies,\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-80-\t\t\t\t  status-\u003ereorder_time +\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:81:\t\t\t\t  mt76_aggr_tid_to_timeo(tid-\u003enum)))\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-82-\t\t\tcontinue;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-83-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:84:\t\tmt76_rx_aggr_release_frames(tid, frames, status-\u003eseqno);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-85-\t}\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-86-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:87:\tmt76_rx_aggr_release_head(tid, frames);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-88-}\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c=90=static void\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:91:mt76_rx_aggr_reorder_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-92-{\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:93:\tstruct mt76_rx_tid *tid = container_of(work, struct mt76_rx_tid,\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-94-\t\t\t\t\t       reorder_work.work);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:95:\tstruct mt76_dev *dev = tid-\u003edev;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-96-\tstruct sk_buff_head frames;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-104-\tspin_lock(\u0026tid-\u003elock);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:105:\tmt76_rx_aggr_check_release(tid, \u0026frames);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-106-\tnframes = tid-\u003enframes;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-110-\t\tieee80211_queue_delayed_work(tid-\u003edev-\u003ehw, \u0026tid-\u003ereorder_work,\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:111:\t\t\t\t\t     mt76_aggr_tid_to_timeo(tid-\u003enum));\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:112:\tmt76_rx_complete(dev, \u0026frames, NULL);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-113-\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c=118=static void\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:119:mt76_rx_aggr_check_ctl(struct sk_buff *skb, struct sk_buff_head *frames)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-120-{\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:121:\tstruct mt76_rx_status *status = (struct mt76_rx_status *)skb-\u003ecb;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:122:\tstruct ieee80211_bar *bar = mt76_skb_get_hdr(skb);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:123:\tstruct mt76_wcid *wcid = status-\u003ewcid;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:124:\tstruct mt76_rx_tid *tid;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-125-\tu8 tidno;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-141-\tif (!tid-\u003estopped) {\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:142:\t\tmt76_rx_aggr_release_frames(tid, frames, seqno);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:143:\t\tmt76_rx_aggr_release_head(tid, frames);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-144-\t}\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-147-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:148:void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-149-{\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:150:\tstruct mt76_rx_status *status = (struct mt76_rx_status *)skb-\u003ecb;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:151:\tstruct mt76_wcid *wcid = status-\u003ewcid;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-152-\tstruct ieee80211_sta *sta;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:153:\tstruct mt76_rx_tid *tid;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-154-\tbool sn_less;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-166-\t\tif (!(status-\u003eflag \u0026 RX_FLAG_8023))\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:167:\t\t\tmt76_rx_aggr_check_ctl(skb, frames);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-168-\t\treturn;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-208-\t\tif (tid-\u003enframes)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:209:\t\t\tmt76_rx_aggr_release_head(tid, frames);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-210-\t\tgoto out;\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-220-\t\thead = ieee80211_sn_inc(ieee80211_sn_sub(seqno, size));\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:221:\t\tmt76_rx_aggr_release_frames(tid, frames, head);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-222-\t}\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-234-\ttid-\u003enframes++;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:235:\tmt76_rx_aggr_release_head(tid, frames);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-236-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-237-\tieee80211_queue_delayed_work(tid-\u003edev-\u003ehw, \u0026tid-\u003ereorder_work,\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:238:\t\t\t\t     mt76_aggr_tid_to_timeo(tid-\u003enum));\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-239-\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-243-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:244:int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno,\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-245-\t\t       u16 ssn, u16 size)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-246-{\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:247:\tstruct mt76_rx_tid *tid;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-248-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:249:\tmt76_rx_aggr_stop(dev, wcid, tidno);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-250-\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-258-\ttid-\u003enum = tidno;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:259:\tINIT_DELAYED_WORK(\u0026tid-\u003ereorder_work, mt76_rx_aggr_reorder_work);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-260-\tspin_lock_init(\u0026tid-\u003elock);\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-265-}\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:266:EXPORT_SYMBOL_GPL(mt76_rx_aggr_start);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-267-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:268:static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-269-{\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-291-\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:292:void mt76_rx_aggr_stop(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno)\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-293-{\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:294:\tstruct mt76_rx_tid *tid = NULL;\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-295-\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-298-\tif (tid) {\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:299:\t\tmt76_rx_aggr_shutdown(dev, tid);\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-300-\t\tkfree_rcu(tid, rcu_head);\n--\ndrivers/net/wireless/mediatek/mt76/agg-rx.c-302-}\ndrivers/net/wireless/mediatek/mt76/agg-rx.c:303:EXPORT_SYMBOL_GPL(mt76_rx_aggr_stop);\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-4- */\ndrivers/net/wireless/mediatek/mt76/channel.c:5:#include \"mt76.h\"\ndrivers/net/wireless/mediatek/mt76/channel.c-6-\ndrivers/net/wireless/mediatek/mt76/channel.c:7:static struct mt76_vif_link *\ndrivers/net/wireless/mediatek/mt76/channel.c:8:mt76_alloc_mlink(struct mt76_dev *dev, struct mt76_vif_data *mvif)\ndrivers/net/wireless/mediatek/mt76/channel.c-9-{\ndrivers/net/wireless/mediatek/mt76/channel.c:10:\tstruct mt76_vif_link *mlink;\ndrivers/net/wireless/mediatek/mt76/channel.c-11-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=21=static int\ndrivers/net/wireless/mediatek/mt76/channel.c:22:mt76_phy_update_channel(struct mt76_phy *phy,\ndrivers/net/wireless/mediatek/mt76/channel.c-23-\t\t\tstruct ieee80211_chanctx_conf *conf)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-26-\tphy-\u003emain_chandef = conf-\u003edef;\ndrivers/net/wireless/mediatek/mt76/channel.c:27:\tphy-\u003echanctx = (struct mt76_chanctx *)conf-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c-28-\ndrivers/net/wireless/mediatek/mt76/channel.c:29:\treturn __mt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/channel.c-30-}\ndrivers/net/wireless/mediatek/mt76/channel.c-31-\ndrivers/net/wireless/mediatek/mt76/channel.c:32:int mt76_add_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/channel.c-33-\t\t     struct ieee80211_chanctx_conf *conf)\ndrivers/net/wireless/mediatek/mt76/channel.c-34-{\ndrivers/net/wireless/mediatek/mt76/channel.c:35:\tstruct mt76_chanctx *ctx = (struct mt76_chanctx *)conf-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:36:\tstruct mt76_phy *phy = hw-\u003epriv;\ndrivers/net/wireless/mediatek/mt76/channel.c:37:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-38-\tint ret = -EINVAL;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-44-\tif (dev-\u003escan.phy == phy)\ndrivers/net/wireless/mediatek/mt76/channel.c:45:\t\tmt76_abort_scan(dev);\ndrivers/net/wireless/mediatek/mt76/channel.c-46-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-48-\tif (!phy-\u003echanctx)\ndrivers/net/wireless/mediatek/mt76/channel.c:49:\t\tret = mt76_phy_update_channel(phy, conf);\ndrivers/net/wireless/mediatek/mt76/channel.c-50-\telse\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-55-}\ndrivers/net/wireless/mediatek/mt76/channel.c:56:EXPORT_SYMBOL_GPL(mt76_add_chanctx);\ndrivers/net/wireless/mediatek/mt76/channel.c-57-\ndrivers/net/wireless/mediatek/mt76/channel.c:58:void mt76_remove_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/channel.c-59-\t\t\t struct ieee80211_chanctx_conf *conf)\ndrivers/net/wireless/mediatek/mt76/channel.c-60-{\ndrivers/net/wireless/mediatek/mt76/channel.c:61:\tstruct mt76_chanctx *ctx = (struct mt76_chanctx *)conf-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:62:\tstruct mt76_phy *phy = hw-\u003epriv;\ndrivers/net/wireless/mediatek/mt76/channel.c:63:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-64-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-69-\tif (dev-\u003escan.phy == phy)\ndrivers/net/wireless/mediatek/mt76/channel.c:70:\t\tmt76_abort_scan(dev);\ndrivers/net/wireless/mediatek/mt76/channel.c-71-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-76-}\ndrivers/net/wireless/mediatek/mt76/channel.c:77:EXPORT_SYMBOL_GPL(mt76_remove_chanctx);\ndrivers/net/wireless/mediatek/mt76/channel.c-78-\ndrivers/net/wireless/mediatek/mt76/channel.c:79:void mt76_change_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/channel.c-80-\t\t\t struct ieee80211_chanctx_conf *conf,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-82-{\ndrivers/net/wireless/mediatek/mt76/channel.c:83:\tstruct mt76_chanctx *ctx = (struct mt76_chanctx *)conf-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:84:\tstruct mt76_phy *phy = ctx-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/channel.c:85:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-86-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-91-\tif (phy-\u003eroc_vif)\ndrivers/net/wireless/mediatek/mt76/channel.c:92:\t\tmt76_abort_roc(phy);\ndrivers/net/wireless/mediatek/mt76/channel.c-93-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-96-\tmutex_lock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/channel.c:97:\tmt76_phy_update_channel(phy, conf);\ndrivers/net/wireless/mediatek/mt76/channel.c-98-\tmutex_unlock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/channel.c-99-}\ndrivers/net/wireless/mediatek/mt76/channel.c:100:EXPORT_SYMBOL_GPL(mt76_change_chanctx);\ndrivers/net/wireless/mediatek/mt76/channel.c-101-\ndrivers/net/wireless/mediatek/mt76/channel.c-102-\ndrivers/net/wireless/mediatek/mt76/channel.c:103:int mt76_assign_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/channel.c-104-\t\t\t    struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-107-{\ndrivers/net/wireless/mediatek/mt76/channel.c:108:\tstruct mt76_chanctx *ctx = (struct mt76_chanctx *)conf-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:109:\tstruct mt76_vif_link *mlink = (struct mt76_vif_link *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:110:\tstruct mt76_vif_data *mvif = mlink-\u003emvif;\ndrivers/net/wireless/mediatek/mt76/channel.c-111-\tint link_id = link_conf-\u003elink_id;\ndrivers/net/wireless/mediatek/mt76/channel.c:112:\tstruct mt76_phy *phy = ctx-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/channel.c:113:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-114-\tbool mlink_alloc = false;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-117-\tif (dev-\u003escan.vif == vif)\ndrivers/net/wireless/mediatek/mt76/channel.c:118:\t\tmt76_abort_scan(dev);\ndrivers/net/wireless/mediatek/mt76/channel.c-119-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-125-\ndrivers/net/wireless/mediatek/mt76/channel.c:126:\tmlink = mt76_vif_conf_link(dev, vif, link_conf);\ndrivers/net/wireless/mediatek/mt76/channel.c-127-\tif (!mlink) {\ndrivers/net/wireless/mediatek/mt76/channel.c:128:\t\tmlink = mt76_alloc_mlink(dev, mvif);\ndrivers/net/wireless/mediatek/mt76/channel.c-129-\t\tif (!mlink) {\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-151-}\ndrivers/net/wireless/mediatek/mt76/channel.c:152:EXPORT_SYMBOL_GPL(mt76_assign_vif_chanctx);\ndrivers/net/wireless/mediatek/mt76/channel.c-153-\ndrivers/net/wireless/mediatek/mt76/channel.c:154:void mt76_unassign_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/channel.c-155-\t\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-158-{\ndrivers/net/wireless/mediatek/mt76/channel.c:159:\tstruct mt76_chanctx *ctx = (struct mt76_chanctx *)conf-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:160:\tstruct mt76_vif_link *mlink = (struct mt76_vif_link *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:161:\tstruct mt76_phy *phy = ctx-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/channel.c:162:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-163-\ndrivers/net/wireless/mediatek/mt76/channel.c-164-\tif (dev-\u003escan.vif == vif)\ndrivers/net/wireless/mediatek/mt76/channel.c:165:\t\tmt76_abort_scan(dev);\ndrivers/net/wireless/mediatek/mt76/channel.c-166-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-172-\ndrivers/net/wireless/mediatek/mt76/channel.c:173:\tmlink = mt76_vif_conf_link(dev, vif, link_conf);\ndrivers/net/wireless/mediatek/mt76/channel.c-174-\tif (!mlink)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-181-}\ndrivers/net/wireless/mediatek/mt76/channel.c:182:EXPORT_SYMBOL_GPL(mt76_unassign_vif_chanctx);\ndrivers/net/wireless/mediatek/mt76/channel.c-183-\ndrivers/net/wireless/mediatek/mt76/channel.c:184:int mt76_switch_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/channel.c-185-\t\t\t    struct ieee80211_vif_chanctx_switch *vifs,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-189-\tstruct ieee80211_vif_chanctx_switch *v;\ndrivers/net/wireless/mediatek/mt76/channel.c:190:\tstruct mt76_chanctx *old_ctx, *new_ctx;\ndrivers/net/wireless/mediatek/mt76/channel.c:191:\tstruct mt76_phy *old_phy, *phy = hw-\u003epriv;\ndrivers/net/wireless/mediatek/mt76/channel.c:192:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c:193:\tstruct mt76_vif_link *mlink;\ndrivers/net/wireless/mediatek/mt76/channel.c-194-\tbool need_update[__MT_MAX_BAND] = {};\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-198-\t\tv = \u0026vifs[i];\ndrivers/net/wireless/mediatek/mt76/channel.c:199:\t\tnew_ctx = (struct mt76_chanctx *)v-\u003enew_ctx-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c-200-\t\tif (mode == CHANCTX_SWMODE_SWAP_CONTEXTS)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-212-\t\t\tif (dev-\u003escan.phy == phy)\ndrivers/net/wireless/mediatek/mt76/channel.c:213:\t\t\t\tmt76_abort_scan(dev);\ndrivers/net/wireless/mediatek/mt76/channel.c-214-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-223-\t\tv = \u0026vifs[i];\ndrivers/net/wireless/mediatek/mt76/channel.c:224:\t\told_ctx = (struct mt76_chanctx *)v-\u003eold_ctx-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c-225-\t\told_phy = old_ctx-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/channel.c-226-\ndrivers/net/wireless/mediatek/mt76/channel.c:227:\t\tnew_ctx = (struct mt76_chanctx *)v-\u003enew_ctx-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c-228-\t\tphy = new_ctx-\u003ephy;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-234-\t\tif (need_update[phy-\u003eband_idx]) {\ndrivers/net/wireless/mediatek/mt76/channel.c:235:\t\t\tret = mt76_phy_update_channel(phy, v-\u003enew_ctx);\ndrivers/net/wireless/mediatek/mt76/channel.c-236-\t\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-241-\ndrivers/net/wireless/mediatek/mt76/channel.c:242:\t\tmlink = mt76_vif_conf_link(dev, v-\u003evif, v-\u003elink_conf);\ndrivers/net/wireless/mediatek/mt76/channel.c-243-\t\tif (!mlink)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-265-}\ndrivers/net/wireless/mediatek/mt76/channel.c:266:EXPORT_SYMBOL_GPL(mt76_switch_vif_chanctx);\ndrivers/net/wireless/mediatek/mt76/channel.c-267-\ndrivers/net/wireless/mediatek/mt76/channel.c:268:struct mt76_vif_link *mt76_get_vif_phy_link(struct mt76_phy *phy,\ndrivers/net/wireless/mediatek/mt76/channel.c-269-\t\t\t\t\t    struct ieee80211_vif *vif)\ndrivers/net/wireless/mediatek/mt76/channel.c-270-{\ndrivers/net/wireless/mediatek/mt76/channel.c:271:\tstruct mt76_vif_link *mlink = (struct mt76_vif_link *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:272:\tstruct mt76_vif_data *mvif = mlink-\u003emvif;\ndrivers/net/wireless/mediatek/mt76/channel.c:273:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-274-\tint i, ret;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-276-\tfor (i = 0; i \u003c ARRAY_SIZE(mvif-\u003elink); i++) {\ndrivers/net/wireless/mediatek/mt76/channel.c:277:\t\tmlink = mt76_dereference(mvif-\u003elink[i], dev);\ndrivers/net/wireless/mediatek/mt76/channel.c-278-\t\tif (!mlink)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-280-\ndrivers/net/wireless/mediatek/mt76/channel.c:281:\t\tif (mt76_vif_link_phy(mlink) == phy)\ndrivers/net/wireless/mediatek/mt76/channel.c-282-\t\t\treturn mlink;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-287-\ndrivers/net/wireless/mediatek/mt76/channel.c:288:\tmlink = mt76_alloc_mlink(dev, mvif);\ndrivers/net/wireless/mediatek/mt76/channel.c-289-\tif (!mlink)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-302-\ndrivers/net/wireless/mediatek/mt76/channel.c:303:void mt76_put_vif_phy_link(struct mt76_phy *phy, struct ieee80211_vif *vif,\ndrivers/net/wireless/mediatek/mt76/channel.c:304:\t\t\t   struct mt76_vif_link *mlink)\ndrivers/net/wireless/mediatek/mt76/channel.c-305-{\ndrivers/net/wireless/mediatek/mt76/channel.c:306:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c:307:\tstruct mt76_vif_data *mvif;\ndrivers/net/wireless/mediatek/mt76/channel.c-308-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-318-\ndrivers/net/wireless/mediatek/mt76/channel.c:319:void mt76_roc_complete(struct mt76_phy *phy)\ndrivers/net/wireless/mediatek/mt76/channel.c-320-{\ndrivers/net/wireless/mediatek/mt76/channel.c:321:\tstruct mt76_vif_link *mlink = phy-\u003eroc_link;\ndrivers/net/wireless/mediatek/mt76/channel.c:322:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-323-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-330-\t    !test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)) {\ndrivers/net/wireless/mediatek/mt76/channel.c:331:\t\t__mt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/channel.c:332:\t\tmt76_offchannel_notify(phy, false);\ndrivers/net/wireless/mediatek/mt76/channel.c-333-\t}\ndrivers/net/wireless/mediatek/mt76/channel.c:334:\tmt76_put_vif_phy_link(phy, phy-\u003eroc_vif, phy-\u003eroc_link);\ndrivers/net/wireless/mediatek/mt76/channel.c-335-\tphy-\u003eroc_vif = NULL;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-340-\ndrivers/net/wireless/mediatek/mt76/channel.c:341:void mt76_roc_complete_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/channel.c-342-{\ndrivers/net/wireless/mediatek/mt76/channel.c:343:\tstruct mt76_phy *phy = container_of(work, struct mt76_phy, roc_work.work);\ndrivers/net/wireless/mediatek/mt76/channel.c:344:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-345-\ndrivers/net/wireless/mediatek/mt76/channel.c-346-\tmutex_lock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/channel.c:347:\tmt76_roc_complete(phy);\ndrivers/net/wireless/mediatek/mt76/channel.c-348-\tmutex_unlock(\u0026dev-\u003emutex);\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-350-\ndrivers/net/wireless/mediatek/mt76/channel.c:351:void mt76_abort_roc(struct mt76_phy *phy)\ndrivers/net/wireless/mediatek/mt76/channel.c-352-{\ndrivers/net/wireless/mediatek/mt76/channel.c:353:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c-354-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-357-\tmutex_lock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/channel.c:358:\tmt76_roc_complete(phy);\ndrivers/net/wireless/mediatek/mt76/channel.c-359-\tmutex_unlock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/channel.c-360-}\ndrivers/net/wireless/mediatek/mt76/channel.c:361:EXPORT_SYMBOL_GPL(mt76_abort_roc);\ndrivers/net/wireless/mediatek/mt76/channel.c-362-\ndrivers/net/wireless/mediatek/mt76/channel.c:363:int mt76_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/mediatek/mt76/channel.c-364-\t\t\t   struct ieee80211_channel *chan, int duration,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-367-\tstruct cfg80211_chan_def chandef = {};\ndrivers/net/wireless/mediatek/mt76/channel.c:368:\tstruct mt76_phy *phy = hw-\u003epriv;\ndrivers/net/wireless/mediatek/mt76/channel.c:369:\tstruct mt76_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/channel.c:370:\tstruct mt76_vif_link *mlink;\ndrivers/net/wireless/mediatek/mt76/channel.c-371-\tbool offchannel;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-387-\ndrivers/net/wireless/mediatek/mt76/channel.c:388:\tmlink = mt76_get_vif_phy_link(phy, vif);\ndrivers/net/wireless/mediatek/mt76/channel.c-389-\tif (IS_ERR(mlink)) {\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-397-\ndrivers/net/wireless/mediatek/mt76/channel.c:398:\toffchannel = mt76_offchannel_chandef(phy, chan, \u0026chandef);\ndrivers/net/wireless/mediatek/mt76/channel.c-399-\tif (offchannel)\ndrivers/net/wireless/mediatek/mt76/channel.c:400:\t\tmt76_offchannel_notify(phy, true);\ndrivers/net/wireless/mediatek/mt76/channel.c:401:\tret = __mt76_set_channel(phy, \u0026chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/channel.c-402-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-405-\t\tphy-\u003eroc_link = NULL;\ndrivers/net/wireless/mediatek/mt76/channel.c:406:\t\tmt76_put_vif_phy_link(phy, vif, mlink);\ndrivers/net/wireless/mediatek/mt76/channel.c-407-\t\tgoto out;\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-416-}\ndrivers/net/wireless/mediatek/mt76/channel.c:417:EXPORT_SYMBOL_GPL(mt76_remain_on_channel);\ndrivers/net/wireless/mediatek/mt76/channel.c-418-\ndrivers/net/wireless/mediatek/mt76/channel.c:419:int mt76_cancel_remain_on_channel(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/channel.c-420-\t\t\t\t  struct ieee80211_vif *vif)\ndrivers/net/wireless/mediatek/mt76/channel.c-421-{\ndrivers/net/wireless/mediatek/mt76/channel.c:422:\tstruct mt76_vif_link *mlink = (struct mt76_vif_link *)vif-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/channel.c:423:\tstruct mt76_vif_data *mvif = mlink-\u003emvif;\ndrivers/net/wireless/mediatek/mt76/channel.c:424:\tstruct mt76_phy *phy = mvif-\u003eroc_phy;\ndrivers/net/wireless/mediatek/mt76/channel.c-425-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-428-\ndrivers/net/wireless/mediatek/mt76/channel.c:429:\tmt76_abort_roc(phy);\ndrivers/net/wireless/mediatek/mt76/channel.c-430-\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-432-}\ndrivers/net/wireless/mediatek/mt76/channel.c:433:EXPORT_SYMBOL_GPL(mt76_cancel_remain_on_channel);\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c-4- */\ndrivers/net/wireless/mediatek/mt76/debugfs.c:5:#include \"mt76.h\"\ndrivers/net/wireless/mediatek/mt76/debugfs.c-6-\ndrivers/net/wireless/mediatek/mt76/debugfs.c=7=static int\ndrivers/net/wireless/mediatek/mt76/debugfs.c:8:mt76_reg_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/debugfs.c-9-{\ndrivers/net/wireless/mediatek/mt76/debugfs.c:10:\tstruct mt76_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/debugfs.c-11-\ndrivers/net/wireless/mediatek/mt76/debugfs.c:12:\t__mt76_wr(dev, dev-\u003edebugfs_reg, val);\ndrivers/net/wireless/mediatek/mt76/debugfs.c-13-\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c=16=static int\ndrivers/net/wireless/mediatek/mt76/debugfs.c:17:mt76_reg_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/debugfs.c-18-{\ndrivers/net/wireless/mediatek/mt76/debugfs.c:19:\tstruct mt76_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/debugfs.c-20-\ndrivers/net/wireless/mediatek/mt76/debugfs.c:21:\t*val = __mt76_rr(dev, dev-\u003edebugfs_reg);\ndrivers/net/wireless/mediatek/mt76/debugfs.c-22-\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c-24-\ndrivers/net/wireless/mediatek/mt76/debugfs.c:25:DEFINE_DEBUGFS_ATTRIBUTE(fops_regval, mt76_reg_get, mt76_reg_set,\ndrivers/net/wireless/mediatek/mt76/debugfs.c-26-\t\t\t \"0x%08llx\\n\");\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c=28=static int\ndrivers/net/wireless/mediatek/mt76/debugfs.c:29:mt76_napi_threaded_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/debugfs.c-30-{\ndrivers/net/wireless/mediatek/mt76/debugfs.c:31:\tstruct mt76_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/debugfs.c-32-\ndrivers/net/wireless/mediatek/mt76/debugfs.c:33:\tif (!mt76_is_mmio(dev))\ndrivers/net/wireless/mediatek/mt76/debugfs.c-34-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c=42=static int\n\n"
}

gemini-3.7-flash

null

null

							input: 51122
							output: 44
							thoughts: 1552
						

**Analyzing the MT7925 Driver Patch for Station Link Management**

Okay, so I'm looking at this MT7925 driver patch and trying to understand its implications for station link management. First, I need to figure out the scope of this change – specifically, whether it affects both USB (`CONFIG_MT7925U`) and PCIe (`CONFIG_MT7925E`) configurations. That's a basic check.

My initial focus is on the function `mt7925_mcu_sta_mld_tlv`. It looks like this patch is changing it. It's a `static void`, so I need to see what's *calling* it and whether any non-static entry points are being affected directly or indirectly.

So, I'm checking the driver code, especially `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c`. I've quickly confirmed `mt7925_mcu_sta_mld_tlv` is defined in there. Now I need to identify which external functions, if any, call it. This is where I start by looking for other functions in `mcu.c` or, potentially, other files in the `mt7925/` directory that are not static.

I've got `mt7925_mcu_sta_update` and `mt7925_mac_link_sta_add` or `mt7925_mac_sta_add` to track down and examine more closely. It looks like `mt7925_mcu_sta_update` and `mt7925_mac_sta_add` are non-static and potentially the entry points for this patch.

Right, so let's dive into the patch itself. I need to understand what's *actually* changing. I'm focusing on the code snippet. It seems to be related to handling multiple links for a station. The old code was encoding only the currently updated secondary link, and now it's being reworked to encode *all* valid links for the station in the MLD record. It looks like the patch adds a loop that iterates over the `valid_links` bitmap and populates the `mld->link[]` array with the information of multiple links. I see the addition of a `max_links` variable to limit the size of the array, and the code also handles the case when `mt7925_mac_link_sta_add` is called before the link is published.

Ok, now I want to check that `mt7925_mcu_sta_update` and `mt7925_mac_sta_add` are actually exported in the relevant header file. That's a good sanity check. I'll peek at `drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h` to see how those are declared.

{
  "Expression": "mt7925_mcu_sta_update",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/mac.c=1473=mt7925_vif_connect_iter(void *priv, u8 *mac,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1502-\t\t\t\t\t    true, NULL);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1503:\t\tmt7925_mcu_sta_update(dev, NULL, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1504-\t\t\t\t      \u0026mvif-\u003esta.deflink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=911=static int mt7925_mac_link_sta_add(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-991-\t    link_sta == mlink-\u003epri_link) {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:992:\t\tret = mt7925_mcu_sta_update(dev, link_sta, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-993-\t\t\t\t\t    mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1013-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1014:\t\tret = mt7925_mcu_sta_update(dev, mlink-\u003epri_link, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1015-\t\t\t\t\t    pri_mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1019-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1020:\t\tret = mt7925_mcu_sta_update(dev, link_sta, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1021-\t\t\t\t\t    mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1025-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1026:\t\tret = mt7925_mcu_sta_update(dev, link_sta, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1027-\t\t\t\t\t    mlink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1201=static void mt7925_mac_link_sta_assoc(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1234-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1235:\tmt7925_mcu_sta_update(dev, link_sta, vif, mlink, true,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1236-\t\t\t      MT76_STA_INFO_STATE_ASSOC);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1279=static void mt7925_mac_link_sta_remove(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1294-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1295:\tmt7925_mcu_sta_update(dev, link_sta, vif, mlink, false,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1296-\t\t\t      MT76_STA_INFO_STATE_NONE);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=1947=mt7925_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1964-\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:1965:\terr = mt7925_mcu_sta_update(dev, NULL, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-1966-\t\t\t\t    \u0026mvif-\u003esta.deflink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=2095=static void mt7925_vif_cfg_changed(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2108-\tif (changed \u0026 BSS_CHANGED_ASSOC) {\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:2109:\t\tmt7925_mcu_sta_update(dev, NULL, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-2110-\t\t\t\t      \u0026mvif-\u003esta.deflink, true,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2163=mt7925_mcu_sta_cmd(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2224-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2225:int mt7925_mcu_sta_update(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2226-\t\t\t  struct ieee80211_link_sta *link_sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h=281=int mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-283-\t\t\t  bool enable);\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h:284:int mt7925_mcu_sta_update(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mt7925.h-285-\t\t\t  struct ieee80211_link_sta *link_sta,\n"
}

gemini-3.7-flash

null

null

							input: 55273
							output: 51
							thoughts: 42
						

Here's my attempt at summarizing the thought process, as if I were an expert:

**Diving into the MT7925 STA Addition Function**

Okay, time to get my hands dirty. I need to understand how station additions are handled in the MT7925 driver. Specifically, I'm going to jump into `drivers/net/wireless/mediatek/mt76/mt7925/main.c` and zero in on the `mt7925_mac_sta_add` function. It's the logical place to start when digging into the STA association process, as the name makes it pretty clear what it does. I want to see how the MAC handles adding a new station - how it's configured, what data structures are populated, and, crucially, how it interacts with the hardware itself. Knowing this is going to be key to debugging any issues related to station connectivity or performance on this chipset. Let's see what secrets this function holds...

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/main.c",
  "FirstLine": 1140,
  "LineCount": 40
}

{
  "Contents": "1140:\t}\n1141:\t\n1142:\tint mt7925_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,\n1143:\t\t\t       struct ieee80211_sta *sta)\n1144:\t{\n1145:\t\tstruct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);\n1146:\t\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\n1147:\t\tstruct mt792x_sta *msta = (struct mt792x_sta *)sta-\u003edrv_priv;\n1148:\t\tint err;\n1149:\t\n1150:\t\tmsta-\u003evif = mvif;\n1151:\t\n1152:\t\tif (vif-\u003etype == NL80211_IFTYPE_STATION)\n1153:\t\t\tmvif-\u003ewep_sta = msta;\n1154:\t\n1155:\t\tif (ieee80211_vif_is_mld(vif)) {\n1156:\t\t\tmsta-\u003edeflink_id = IEEE80211_LINK_UNSPECIFIED;\n1157:\t\n1158:\t\t\terr = mt7925_mac_sta_add_links(dev, vif, sta, sta-\u003evalid_links);\n1159:\t\t} else {\n1160:\t\t\terr = mt7925_mac_link_sta_add(mdev, vif, \u0026sta-\u003edeflink,\n1161:\t\t\t\t\t\t      \u0026msta-\u003edeflink);\n1162:\t\t}\n1163:\t\n1164:\t\treturn err;\n1165:\t}\n1166:\tEXPORT_SYMBOL_GPL(mt7925_mac_sta_add);\n1167:\t\n1168:\tstatic void\n1169:\tmt7925_mac_set_links(struct mt76_dev *mdev, struct ieee80211_vif *vif)\n1170:\t{\n1171:\t\tstruct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);\n1172:\t\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\n1173:\t\tstruct ieee80211_bss_conf *link_conf =\n1174:\t\t\tmt792x_vif_to_bss_conf(vif, mvif-\u003edeflink_id);\n1175:\t\tstruct cfg80211_chan_def *chandef = \u0026link_conf-\u003echanreq.oper;\n1176:\t\tenum nl80211_band band = chandef-\u003echan-\u003eband, secondary_band;\n1177:\t\n1178:\t\tu16 sel_links = mt76_select_links(vif, 2);\n1179:\t\tu8 secondary_link_id = __ffs(~BIT(mvif-\u003edeflink_id) \u0026 sel_links);\n"
}

gemini-3.7-flash

null

null

							input: 56429
							output: 34
							thoughts: 242
						

**My Configuration Investigation**

Alright, let's get down to brass tacks. I need to figure out the dependencies and necessary configurations for compiling the mt7925 driver, specifically statically or as a module. First things first, I'll dive into the `drivers/net/wireless/mediatek/mt76/mt7925/Kconfig` file.

Okay, here's what I'm seeing: `CONFIG_MT7925E` (PCIe) needs `MAC80211` and `PCI` to be set. `CONFIG_MT7925U` (USB), similarly, is reliant on `MAC80211` and `USB`. Both of them select `CONFIG_MT7925_COMMON`, which makes sense. I see `CONFIG_MT76_CORE` and `CONFIG_WLAN_VENDOR_MEDIATEK` are also relevant.

Now, let me shift focus to `drivers/net/wireless/mediatek/Kconfig`. Ah, the `source "drivers/net/wireless/mediatek/mt76/Kconfig"` line is nested within an `if WLAN_VENDOR_MEDIATEK` block. That's good to know. It solidifies that the mediatek configuration is correctly linked.

Just to be thorough, I should scan the `drivers/net/wireless/Kconfig` to see if there are any higher-level dependencies or parent menus that need my attention. Gotta make sure I'm not missing anything crucial in the bigger picture.

{
  "Expression": "WLAN_VENDOR_MEDIATEK",
  "PathPrefix": "drivers/net/wireless/"
}

{
  "Output": "drivers/net/wireless/Makefile=12=obj-$(CONFIG_WLAN_VENDOR_MARVELL) += marvell/\ndrivers/net/wireless/Makefile:13:obj-$(CONFIG_WLAN_VENDOR_MEDIATEK) += mediatek/\ndrivers/net/wireless/Makefile-14-obj-$(CONFIG_WLAN_VENDOR_MICROCHIP) += microchip/\n--\ndrivers/net/wireless/mediatek/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/mediatek/Kconfig:2:config WLAN_VENDOR_MEDIATEK\ndrivers/net/wireless/mediatek/Kconfig-3-\tbool \"MediaTek devices\"\n--\ndrivers/net/wireless/mediatek/Kconfig-12-\ndrivers/net/wireless/mediatek/Kconfig:13:if WLAN_VENDOR_MEDIATEK\ndrivers/net/wireless/mediatek/Kconfig-14-source \"drivers/net/wireless/mediatek/mt7601u/Kconfig\"\ndrivers/net/wireless/mediatek/Kconfig=15=source \"drivers/net/wireless/mediatek/mt76/Kconfig\"\ndrivers/net/wireless/mediatek/Kconfig:16:endif # WLAN_VENDOR_MEDIATEK\n"
}

gemini-3.7-flash

null

null

							input: 57352
							output: 34
							thoughts: 25
						

Here's my thought process, as if I were considering this myself:

**Investigating Wireless Driver Configuration**

Okay, so I need to figure out the configuration options for a wireless network device. Let's see... First, I'll head to the kernel source and zero in on the relevant Kconfig file. Based on the usual organization, `drivers/net/wireless/Kconfig` seems like the most logical place to start. I'll need to double-check that `NETDEVICES` or `WLAN` is defined there and investigate what dependencies they might have. It is highly likely they are. This will tell me which options control the compilation of specific wireless drivers and related functionality. After that, I will need to delve deeper into the configuration and dependencies of the various modules.

{
  "File": "drivers/net/wireless/Kconfig",
  "FirstLine": 1,
  "LineCount": 40
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t#\n   3:\t# Wireless LAN device configuration\n   4:\t#\n   5:\t\n   6:\tmenuconfig WLAN\n   7:\t\tbool \"Wireless LAN\"\n   8:\t\tdepends on !S390\n   9:\t\tdepends on NET\n  10:\t\tselect WIRELESS\n  11:\t\tdefault y\n  12:\t\thelp\n  13:\t\t  This section contains all the pre 802.11 and 802.11 wireless\n  14:\t\t  device drivers. For a complete list of drivers and documentation\n  15:\t\t  on them refer to the wireless wiki:\n  16:\t\n  17:\t\t  https://wireless.wiki.kernel.org/en/users/Drivers\n  18:\t\n  19:\tif WLAN\n  20:\t\n  21:\tsource \"drivers/net/wireless/admtek/Kconfig\"\n  22:\tsource \"drivers/net/wireless/ath/Kconfig\"\n  23:\tsource \"drivers/net/wireless/atmel/Kconfig\"\n  24:\tsource \"drivers/net/wireless/broadcom/Kconfig\"\n  25:\tsource \"drivers/net/wireless/intel/Kconfig\"\n  26:\tsource \"drivers/net/wireless/intersil/Kconfig\"\n  27:\tsource \"drivers/net/wireless/marvell/Kconfig\"\n  28:\tsource \"drivers/net/wireless/mediatek/Kconfig\"\n  29:\tsource \"drivers/net/wireless/microchip/Kconfig\"\n  30:\tsource \"drivers/net/wireless/morsemicro/Kconfig\"\n  31:\tsource \"drivers/net/wireless/nxp/Kconfig\"\n  32:\tsource \"drivers/net/wireless/purelifi/Kconfig\"\n  33:\tsource \"drivers/net/wireless/ralink/Kconfig\"\n  34:\tsource \"drivers/net/wireless/realtek/Kconfig\"\n  35:\tsource \"drivers/net/wireless/rsi/Kconfig\"\n  36:\tsource \"drivers/net/wireless/silabs/Kconfig\"\n  37:\tsource \"drivers/net/wireless/st/Kconfig\"\n  38:\tsource \"drivers/net/wireless/ti/Kconfig\"\n  39:\tsource \"drivers/net/wireless/zydas/Kconfig\"\n  40:\tsource \"drivers/net/wireless/quantenna/Kconfig\"\n"
}

gemini-3.7-flash

null

null

							input: 58205
							output: 206
							thoughts: 448
						

**My Analysis of the MT7925 MLO Patch**

Okay, let's break this down systematically. First, I need to confirm the relevant configurations and modules involved. I see `MT7925U` and `MT7925E`, which are key. Then, the configs themselves: `WLAN`, `WLAN_VENDOR_MEDIATEK`, `MT7925E`, `MT7925U`, `MAC80211`, `USB`, and `PCI`. Makes perfect sense given the driver and the potential test setups, including emulation.

Now, I need to identify the critical functions to focus on. I'm looking at `mt7925_mac_sta_add` and `mt7925_mcu_sta_update`, which seem like the primary entry points for station management. I then checked `mt7925_mcu_sta_mld_tlv` to verify it is static, which it is, because the instructions specify preferring non-static and non-inlined API entrypoints to the static helper functions. This re-enforces that my focus should be on `mt7925_mcu_sta_update` and `mt7925_mac_sta_add`.

Next, I need to confirm the patch's impact and applicability. The reasoning is solid: It fixes MLD TLV generation during station update/association, specifically addressing how multi-link operation (MLO) is handled by the MT7925 driver. This fix ensures that *all* valid station links are correctly encoded, not just the one being updated. The context of emulation (USB or mac80211) is also important to consider.

Given this, I have everything needed:
*   `WorthFuzzing: true` (Critical, given the multi-link aspect).
*   `EnableConfigs: WLAN, WLAN_VENDOR_MEDIATEK, MT7925E, MT7925U, MAC80211` (Ensures the correct modules are enabled).
*   `FocusSymbols: mt7925_mcu_sta_update, mt7925_mac_sta_add` (Identifies the key entry points).

Therefore, I'm confident in the analysis and ready to move forward. Time to call `set-results`.

{
  "EnableConfigs": [
    "WLAN",
    "WLAN_VENDOR_MEDIATEK",
    "MT7925E",
    "MT7925U",
    "MAC80211"
  ],
  "FocusSymbols": [
    "mt7925_mcu_sta_update",
    "mt7925_mac_sta_add"
  ],
  "Reasoning": "The patch modifies the station MLD TLV construction in the MediaTek MT7925 wireless driver (mt7925_mcu_sta_mld_tlv) to properly encode all active and pending station links during station add and update commands instead of only the secondary link currently being updated. This is a functional change in 802.11be Multi-Link Operation (MLO) state configuration reachable via mac80211/nl80211 interfaces.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "WLAN",
    "WLAN_VENDOR_MEDIATEK",
    "MT7925E",
    "MT7925U",
    "MAC80211"
  ],
  "FocusSymbols": [
    "mt7925_mcu_sta_update",
    "mt7925_mac_sta_add"
  ],
  "Reasoning": "The patch modifies the station MLD TLV construction in the MediaTek MT7925 wireless driver (mt7925_mcu_sta_mld_tlv) to properly encode all active and pending station links during station add and update commands instead of only the secondary link currently being updated. This is a functional change in 802.11be Multi-Link Operation (MLO) state configuration reachable via mac80211/nl80211 interfaces.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

core

null

{
  "KMSANReasoning": "The patch modifies `mt7925_mcu_sta_mld_tlv()` in `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c` to iterate over all valid station links when constructing the STA_REC_MLD MCU TLV command for firmware.\n\n- The buffer containing `struct sta_rec_mld` is allocated and zero-initialized via `mt76_connac_mcu_add_tlv()` (`skb_put_zero()`).\n- All local variables (`valid`, `max_links`, `cnt`, `link_id`, `mlink_sec`, `mconf_sec`) are properly initialized before use.\n- The TLV data is packaged into an internal MCU command skb transmitted to the device firmware, not copied or leaked to user space.\n- Any potential bounds issues (e.g. array indexing checked by `cnt == max_links`), pointer validity, or locking issues are covered by KASAN, LOCKDEP, and standard kernel debugging mechanisms.\n\nNo uninitialized memory read risks or info leaks are introduced or exposed. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 3eb2bde608a81b4e746495647ebc84677d4ee361
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Sep 3 08:26:18 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index fa29c486a4553..d3e1ae4143cb7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2068,9 +2068,12 @@ mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
 	struct mt792x_dev *dev = mvif->phy->dev;
+	unsigned long valid = msta->valid_links;
 	struct mt792x_bss_conf *mconf_pri;
 	struct sta_rec_mld *mld;
+	unsigned int link_id;
 	struct tlv *tlv;
+	u8 max_links;
 	u8 cnt = 0;
 
 	/* Primary link always uses driver's deflink WCID. */
@@ -2099,11 +2102,47 @@ mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
 	mld->link[cnt].wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
 	mld->link[cnt++].bss_idx = mconf_pri->mt76.idx;
 
-	/* Optionally encode the currently-updated secondary link. */
-	if (mlink && mlink != &msta->deflink && mconf) {
-		mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
-		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
-		mld->link[cnt++].bss_idx = mconf->mt76.idx;
+	/* Encode the remaining valid links of this station, not just the one
+	 * this command happens to be updating. STA_REC_MLD is a complete
+	 * record: every update rewrites link_num and link[], so selecting the
+	 * secondary entry from the caller's link made the record firmware
+	 * ends up holding depend on which link was updated last.
+	 */
+	max_links = ARRAY_SIZE(mld->link);
+
+	/* mt7925_mac_link_sta_add() issues this command before publishing
+	 * a new link in msta->link[] and msta->valid_links. Include that
+	 * in-flight caller link in this record so it is not lost.
+	 */
+	if (mlink && mconf && mlink != &msta->deflink)
+		valid |= BIT(mlink->wcid.link_id);
+
+	for_each_set_bit(link_id, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
+		struct mt792x_link_sta *mlink_sec;
+		struct mt792x_bss_conf *mconf_sec;
+
+		if (cnt == max_links)
+			break;
+
+		if (link_id == msta->deflink_id)
+			continue;
+
+		mlink_sec = mt792x_sta_to_link(msta, link_id);
+		if (!mlink_sec && mlink && link_id == mlink->wcid.link_id)
+			mlink_sec = mlink;
+		if (!mlink_sec || mlink_sec == &msta->deflink)
+			continue;
+
+		mconf_sec = rcu_dereference_protected(mvif->link_conf[link_id],
+						      lockdep_is_held(&dev->mt76.mutex));
+		if (!mconf_sec)
+			continue;
+
+		if (cnt == 1)
+			mld->secondary_id = cpu_to_le16(mlink_sec->wcid.idx);
+
+		mld->link[cnt].wlan_id = cpu_to_le16(mlink_sec->wcid.idx);
+		mld->link[cnt++].bss_idx = mconf_sec->mt76.idx;
 	}
 
 	mld->link_num = cnt;

gemini-3.7-flash

null

null

							input: 3072
							output: 52
							thoughts: 67
						

Okay, here's my take on that code analysis process:

**Diving into the Patch: Memory Safety First**

Alright, let's get down to brass tacks. My initial thought is to figure out the memory safety implications of this patch. The immediate question: are we looking at potential uninitialized memory reads that would necessitate the heavy hammer of KMSAN, or can we stick with the standard KASAN/sanitizers that are generally sufficient? Time to assess the risk profile.

I'm zeroing in on that code now, particularly on `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c`. Let's see what kind of memory access patterns this patch introduces and whether it touches anything related to the MCU interaction, which is often a source of potential issues. I'll need to look closely at data structures, how buffers are initialized (or *not* initialized), and any places where we're passing data back and forth with the hardware. Gotta identify all possible avenues for memory-based exploits. Let's see what treasures (or issues) this patch holds.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c",
  "FirstLine": 2065,
  "LineCount": 90
}

{
  "Contents": "2065:\t\t\t       struct mt792x_bss_conf *mconf,\n2066:\t\t\t       struct mt792x_link_sta *mlink)\n2067:\t{\n2068:\t\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\n2069:\t\tstruct mt792x_sta *msta = (struct mt792x_sta *)sta-\u003edrv_priv;\n2070:\t\tstruct mt792x_dev *dev = mvif-\u003ephy-\u003edev;\n2071:\t\tunsigned long valid = msta-\u003evalid_links;\n2072:\t\tstruct mt792x_bss_conf *mconf_pri;\n2073:\t\tstruct sta_rec_mld *mld;\n2074:\t\tunsigned int link_id;\n2075:\t\tstruct tlv *tlv;\n2076:\t\tu8 max_links;\n2077:\t\tu8 cnt = 0;\n2078:\t\n2079:\t\t/* Primary link always uses driver's deflink WCID. */\n2080:\t\tmconf_pri = (msta-\u003edeflink_id != IEEE80211_LINK_UNSPECIFIED) ?\n2081:\t\t\t    mt792x_vif_to_link(mvif, msta-\u003edeflink_id) : NULL;\n2082:\t\n2083:\t\t/* If caller is operating on deflink, reuse its mconf as primary. */\n2084:\t\tif (!mconf_pri \u0026\u0026 mlink == \u0026msta-\u003edeflink)\n2085:\t\t\tmconf_pri = mconf;\n2086:\t\n2087:\t\tif (!mconf_pri) {\n2088:\t\t\tdev_warn_ratelimited(dev-\u003emt76.dev,\n2089:\t\t\t\t\t     \"mt7925: MLD_TLV_LINK skip (no primary mconf) sta=%pM\\n\",\n2090:\t\t\t\tsta-\u003eaddr);\n2091:\t\t\treturn;\n2092:\t\t}\n2093:\t\n2094:\t\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));\n2095:\t\tmld = (struct sta_rec_mld *)tlv;\n2096:\t\tmemcpy(mld-\u003emac_addr, sta-\u003eaddr, ETH_ALEN);\n2097:\t\n2098:\t\tmld-\u003eprimary_id = cpu_to_le16(msta-\u003edeflink.wcid.idx);\n2099:\t\tmld-\u003ewlan_id = cpu_to_le16(msta-\u003edeflink.wcid.idx);\n2100:\t\n2101:\t\t/* Always encode primary link first. */\n2102:\t\tmld-\u003elink[cnt].wlan_id = cpu_to_le16(msta-\u003edeflink.wcid.idx);\n2103:\t\tmld-\u003elink[cnt++].bss_idx = mconf_pri-\u003emt76.idx;\n2104:\t\n2105:\t\t/* Encode the remaining valid links of this station, not just the one\n2106:\t\t * this command happens to be updating. STA_REC_MLD is a complete\n2107:\t\t * record: every update rewrites link_num and link[], so selecting the\n2108:\t\t * secondary entry from the caller's link made the record firmware\n2109:\t\t * ends up holding depend on which link was updated last.\n2110:\t\t */\n2111:\t\tmax_links = ARRAY_SIZE(mld-\u003elink);\n2112:\t\n2113:\t\t/* mt7925_mac_link_sta_add() issues this command before publishing\n2114:\t\t * a new link in msta-\u003elink[] and msta-\u003evalid_links. Include that\n2115:\t\t * in-flight caller link in this record so it is not lost.\n2116:\t\t */\n2117:\t\tif (mlink \u0026\u0026 mconf \u0026\u0026 mlink != \u0026msta-\u003edeflink)\n2118:\t\t\tvalid |= BIT(mlink-\u003ewcid.link_id);\n2119:\t\n2120:\t\tfor_each_set_bit(link_id, \u0026valid, IEEE80211_MLD_MAX_NUM_LINKS) {\n2121:\t\t\tstruct mt792x_link_sta *mlink_sec;\n2122:\t\t\tstruct mt792x_bss_conf *mconf_sec;\n2123:\t\n2124:\t\t\tif (cnt == max_links)\n2125:\t\t\t\tbreak;\n2126:\t\n2127:\t\t\tif (link_id == msta-\u003edeflink_id)\n2128:\t\t\t\tcontinue;\n2129:\t\n2130:\t\t\tmlink_sec = mt792x_sta_to_link(msta, link_id);\n2131:\t\t\tif (!mlink_sec \u0026\u0026 mlink \u0026\u0026 link_id == mlink-\u003ewcid.link_id)\n2132:\t\t\t\tmlink_sec = mlink;\n2133:\t\t\tif (!mlink_sec || mlink_sec == \u0026msta-\u003edeflink)\n2134:\t\t\t\tcontinue;\n2135:\t\n2136:\t\t\tmconf_sec = rcu_dereference_protected(mvif-\u003elink_conf[link_id],\n2137:\t\t\t\t\t\t\t      lockdep_is_held(\u0026dev-\u003emt76.mutex));\n2138:\t\t\tif (!mconf_sec)\n2139:\t\t\t\tcontinue;\n2140:\t\n2141:\t\t\tif (cnt == 1)\n2142:\t\t\t\tmld-\u003esecondary_id = cpu_to_le16(mlink_sec-\u003ewcid.idx);\n2143:\t\n2144:\t\t\tmld-\u003elink[cnt].wlan_id = cpu_to_le16(mlink_sec-\u003ewcid.idx);\n2145:\t\t\tmld-\u003elink[cnt++].bss_idx = mconf_sec-\u003emt76.idx;\n2146:\t\t}\n2147:\t\n2148:\t\tmld-\u003elink_num = cnt;\n2149:\t}\n2150:\t\n2151:\tstatic void\n2152:\tmt7925_mcu_sta_remove_tlv(struct sk_buff *skb)\n2153:\t{\n2154:\t\tstruct sta_rec_remove *rem;\n"
}

gemini-3.7-flash

null

null

							input: 5119
							output: 21
							thoughts: 35
						

Here's my analysis of what I'm looking at, from my expert perspective:

**Diving into the `mt76_connac_mcu_add_tlv` and `struct sta_rec_mld`**

Okay, so I need to refresh my memory on the interplay of the MCU and the STA record management within this `mt76_connac` context. My immediate focus is on the function `mt76_connac_mcu_add_tlv` and precisely how it's used within this framework. What I need to understand is how this function contributes to data encoding/decoding and communication of the relevant data between the host and the MCU. Likely, it's used to add type-length-value (TLV) data structures to messages that will be sent to the MCU. I assume this would include parameters to the station records. I'm keen to determine the precise data format used, and determine if this is handled in little or big-endian. I need to understand the implications of this specific TLV implementation.

My next step is to examine what the `struct sta_rec_mld` actually *is*. Is it a host-side representation of the station record state, or a structure specific to the MCU, or possibly both? I need to understand the fields within this structure – their meaning, data types, and how they relate to the information exchanged with the MCU. Knowing the details of this structure is crucial, because, from my experience, it will dictate the parameters and messages exchanged with the MCU related to station management. I expect a careful correlation between the fields in this structure and the TLV elements added by the `mt76_connac_mcu_add_tlv` function.

{
  "Expression": "struct sta_rec_mld"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2062=mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2072-\tstruct mt792x_bss_conf *mconf_pri;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2073:\tstruct sta_rec_mld *mld;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2074-\tunsigned int link_id;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2094-\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2095:\tmld = (struct sta_rec_mld *)tlv;\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2096-\tmemcpy(mld-\u003emac_addr, sta-\u003eaddr, ETH_ALEN);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=460=struct sta_rec_hdr_trans {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-468-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:469:struct sta_rec_mld {\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-470-\t__le16 tag;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h=512=struct bss_rlm_tlv {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-543-\t\t\t\t\t sizeof(struct sta_rec_hdr_trans) +\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h:544:\t\t\t\t\t sizeof(struct sta_rec_mld) +\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.h-545-\t\t\t\t\t sizeof(struct tlv) * 2 +\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c=2713=mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-2720-\tstruct ieee80211_link_sta *link_sta;\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:2721:\tstruct sta_rec_mld_setup *mld_setup;\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-2722-\tstruct mt7996_sta_link *msta_link;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-2730-\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD,\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:2731:\t\t\t\t      sizeof(struct sta_rec_mld_setup) +\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-2732-\t\t\t\t      sizeof(struct mld_setup_link) * nlinks);\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-2733-\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:2734:\tmld_setup = (struct sta_rec_mld_setup *)tlv;\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c-2735-\tmemcpy(mld_setup-\u003emld_addr, sta-\u003eaddr, ETH_ALEN);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h=716=struct sta_rec_ps_leave {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h-721-\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h:722:struct sta_rec_mld_setup {\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h-723-\t__le16 tag;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h=917=enum {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h-950-\t\t\t\t\t sizeof(struct sta_rec_hdr_trans) +\t\\\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h:951:\t\t\t\t\t sizeof(struct sta_rec_mld_setup) +\t\\\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h-952-\t\t\t\t\t sizeof(struct mld_setup_link) * 3 +\t\\\n"
}

gemini-3.7-flash

null

null

							input: 7028
							output: 51
							thoughts: 57
						

Here's my summary, as if I were thinking these thoughts:

**Examining the MT7925 MCU Connection Handling**

Okay, let's dive into this. I need to refresh my memory on the structure `sta_rec_mld`. I seem to recall that it's important for station record management, especially regarding Multicast Listener Discovery (MLD) in the MT7925 wireless driver. I'll need to go to `drivers/net/wireless/mediatek/mt76/mt7925/mcu.h` to confirm its exact definition. Gotta check the members, the packing, the alignment... make sure there aren't any gotchas I'm overlooking.

Then, I'll need to see how this `sta_rec_mld` is actually used in the MCU interaction. The function `mt76_connac_mcu_add_tlv` looks like the likely candidate. That TLV addition might tell me how the station record data gets encoded and sent to the MCU. I bet it has something to do with the MLD group membership management, but I need to analyze how it's formatted to verify that. I'm going to look for any MLD-specific flags or fields in there. Let's see what the TLV structures look like in the context of connection setup.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.h",
  "FirstLine": 465,
  "LineCount": 35
}

{
  "Contents": " 465:\t\tu8 dis_rx_hdr_tran;\n 466:\t\tu8 rsv;\n 467:\t} __packed;\n 468:\t\n 469:\tstruct sta_rec_mld {\n 470:\t\t__le16 tag;\n 471:\t\t__le16 len;\n 472:\t\tu8 mac_addr[ETH_ALEN];\n 473:\t\t__le16 primary_id;\n 474:\t\t__le16 secondary_id;\n 475:\t\t__le16 wlan_id;\n 476:\t\tu8 link_num;\n 477:\t\tu8 rsv[3];\n 478:\t\tstruct {\n 479:\t\t\t__le16 wlan_id;\n 480:\t\t\tu8 bss_idx;\n 481:\t\t\tu8 rsv;\n 482:\t\t} __packed link[2];\n 483:\t} __packed;\n 484:\t\n 485:\tstruct sta_rec_eht_mld {\n 486:\t\t__le16 tag;\n 487:\t\t__le16 len;\n 488:\t\tu8 nsep;\n 489:\t\tu8 mld_type;\n 490:\t\tu8 __rsv1[1];\n 491:\t\tu8 str_cap[3];\n 492:\t\tu8 eml_cap[3];\n 493:\t\tu8 __rsv2[3];\n 494:\t} __packed;\n 495:\t\n 496:\tstruct bss_ifs_time_tlv {\n 497:\t\t__le16 tag;\n 498:\t\t__le16 len;\n 499:\t\tu8 slot_valid;\n"
}

gemini-3.7-flash

null

null

							input: 7907
							output: 28
							thoughts: 20
						

Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person:

**Analyzing the `mt76_connac_mcu_add_tlv` Function**

Okay, so I'm looking at `mt76_connac_mcu_add_tlv`. Right off the bat, I know this is related to the MediaTek MT76 Connac chipset, likely involved in MCU (Microcontroller Unit) communication. The name itself, `add_tlv`, screams "Type-Length-Value" format, which is a common and efficient way to structure data in embedded systems, especially when dealing with variable-length payloads like configuration parameters or status updates.

My initial expectation is that this function will take a buffer (probably a pointer to a struct or an array), a type identifier, a value length, and the value itself as arguments. It will then pack this information into a TLV-formatted block within the buffer, incrementing a pointer or updating a length field appropriately. The goal is likely to construct a command or data structure to be sent to the MCU. I bet this is part of the firmware interface for the Wi-Fi or Bluetooth controller.

I need to confirm if it handles potential buffer overflows or checks for maximum TLV block sizes. That's a critical aspect of embedded systems design; no one wants a buffer overflow causing a crash! Also, does this handle endianness conversions? The MCU might be running a different architecture than the host, so data alignment and byte ordering need to be considered.

I'm curious about the specific types defined. Are they enum's or some kind of macro magic? The choice of type encoding (e.g., single byte, two bytes, etc.) will impact the overall efficiency. Let's see how they've defined the types and lengths. Finally, is there any error handling baked in? Does it return a status code or set some kind of flag? Those details are crucial for understanding how robust the driver is. Let's dive deeper into the code to see if my initial assumptions hold true.

{
  "Expression": "mt76_connac_mcu_add_tlv"
}

{
  "Output": "\nFull output is too long, showing 500 out of 655 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=931=mt7615_mcu_sta_ba(struct mt7615_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-947-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:948:\tsta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-949-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c=1153=mt7615_mcu_uni_rx_ba(struct mt7615_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1180-\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c:1181:\tsta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,\ndrivers/net/wireless/mediatek/mt76/mt7615/mcu.c-1182-\t\t\t\t\t   sizeof(struct tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=372=void mt76_connac_mcu_bss_omac_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-403-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:404:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-405-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=414=void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-423-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:424:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-425-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=482=void mt76_connac_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-490-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:491:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-492-\tuapsd = (struct sta_rec_uapsd *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=549=int mt76_connac_mcu_sta_update_hdr_trans(struct mt76_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-561-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:562:\tsta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-563-\t\t\t\t\t   sizeof(struct tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=650=mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-663-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:664:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-665-\tamsdu = (struct sta_rec_amsdu *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=677=mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-684-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:685:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-686-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=810=mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-816-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:817:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-818-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=900=void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-919-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:920:\t\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-921-\t\tht = (struct sta_rec_ht *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-930-\t\tlen = is_connac2(dev) ? sizeof(*vht) : sizeof(*vht) - 4;\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:931:\t\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, len);\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-932-\t\tvht = (struct sta_rec_vht *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-954-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:955:\t\t\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-956-\t\t\t\t\t\t      sizeof(*he_6g_capa));\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-961-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:962:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-963-\tphy = (struct sta_rec_phy *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-972-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:973:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-974-\tra_info = (struct sta_rec_ra_info *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-989-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:990:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-991-\tstate = (struct sta_rec_state *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=1094=int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1123-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1124:\tsta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1125-\t\t\t\t\t   sizeof(struct tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=1305=void mt76_connac_mcu_sta_ba_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1311-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1312:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1313-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=1337=int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1350-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1351:\tsta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1352-\t\t\t\t\t   sizeof(struct tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=2766=mt76_connac_mcu_sta_key_tlv(struct mt76_connac_sta_key_conf *sta_key_conf,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2774-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:2775:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2776-\tsec = (struct sta_rec_sec *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=2863=void mt76_connac_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt76_vif_link *mvif)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2872-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:2873:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2874-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=2881=int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2891-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:2892:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2893-\tbss = (struct bss_info_basic *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h=1993=static inline struct tlv *\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h:1994:mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h-1995-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=547=mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-554-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:555:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-556-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=580=mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-586-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:587:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-588-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=606=mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-618-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:619:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-620-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=636=mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-642-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:643:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-644-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=653=mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-659-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:660:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-661-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=787=mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-799-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:800:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-801-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=930=mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-941-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:942:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-943-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=988=mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-995-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:996:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-997-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1003=mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1010-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1011:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1012-\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1020=mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1033-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1034:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1035-\tamsdu = (struct sta_rec_amsdu *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1059=mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1070-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1071:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1072-\twtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(\u0026dev-\u003emt76, \u0026msta-\u003ewcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1259=mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1288-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1289:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1290-\tbf = (struct sta_rec_bf *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1335=mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1350-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1351:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1352-\tbfee = (struct sta_rec_bfee *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1385=int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1401-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1402:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1403-\tra = (struct sta_rec_ra_fixed *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1430=int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1444-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1445:\tsta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1446-\t\t\t\t\t   sizeof(struct tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1566=mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1578-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1579:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-1580-\tra = (struct sta_rec_ra *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=1974=mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-2001-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:2002:\ttlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-2003-\tbcn = (struct bss_info_bcn *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=2057=int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-2078-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:2079:\ttlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-2080-\tbcn = (struct bss_info_bcn *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=4000=int mt7915_mcu_set_protection(struct mt7915_phy *phy, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-4022-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:4023:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_PROTECT_INFO,\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-4024-\t\t\t\t      sizeof(*prot));\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c=4062=int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-4075-\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c:4076:\ttlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,\ndrivers/net/wireless/mediatek/mt76/mt7915/mcu.c-4077-\t\t\t\t      sizeof(*bss_color));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=732=mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-746-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:747:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-748-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1212=mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1219-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1220:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1221-\thdr_trans = (struct sta_rec_hdr_trans *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1264=int mt7925_mcu_set_tx(struct mt792x_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1295-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1296:\t\ttlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1297-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1320=mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1338-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1339:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1340-\tsec = (struct sta_rec_sec_uni *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1780=mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1788-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1789:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1790-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1796=mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1808-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1809:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1810-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1825=mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1832-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1833:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1834-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1840=mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1848-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1849:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1850-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1858=mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1872-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1873:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1874-\tamsdu = (struct sta_rec_amsdu *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1896=mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1912-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1913:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1914-\tphy = (struct sta_rec_phy *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1955=mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1971-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:1972:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-1973-\tstate = (struct sta_rec_state_v2 *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=1984=mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2001-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2002:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2003-\tra_info = (struct sta_rec_ra_info *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2026=mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2038-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2039:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2040-\teht_mld = (struct sta_rec_eht_mld *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2062=mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2093-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2094:\ttlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2095-\tmld = (struct sta_rec_mld *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2152=mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2156-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2157:\ttlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2158-\trem = (struct sta_rec_remove *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2163=mt7925_mcu_sta_cmd(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2212-\t\tmt7925_mcu_sta_remove_tlv(skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2213:\t\tmt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2214-\t\t\t\t\tsizeof(struct tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2506=void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2523-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2524:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2525-\treq = (struct bss_rlm_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2606=void mt7925_mcu_bss_eht_tlv(struct sk_buff *skb, struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2615-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2616:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_EHT, sizeof(*req));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2617-\treq = (struct bss_eht_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2733=mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2751-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2752:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2753-\tbasic_req = (struct mt76_connac_bss_basic_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2822=mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2836-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2837:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2838-\tsec = (struct bss_sec_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2869=mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2883-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2884:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2885-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2904=mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2917-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2918:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2919-\tmld = (struct bss_mld_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2938=mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2942-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2943:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2944-\tqos = (struct mt76_connac_bss_qos_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2949=mt7925_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2957-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2958:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_11V_MBSSID,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2959-\t\t\t\t      sizeof(*mbssid));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2968=mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2980-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2981:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2982-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2998=mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3003-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3004:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3005-\tcolor = (struct bss_info_uni_bss_color *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3014=mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3021-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3022:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3023-\tifs_time = (struct bss_ifs_time_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3171=int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3187-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3188:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3189-\tconf = (struct mbmc_conf_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3202=mt7925_mcu_build_scan_ie_tlv(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3230-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3231:\t\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3232-\t\t\t\t\t      alloc_len);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3254=int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3292-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3293:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3294-\treq = (struct scan_req_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3297-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3298:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3299-\tssid = (struct scan_ssid_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3322-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3323:\t\t\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3324-\t\t\t\t\t\t      sizeof(*bssid));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3333-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3334:\t\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3335-\t\tbssid = (struct scan_bssid_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3339-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3340:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3341-\tchan_info = (struct scan_chan_info_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3363-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3364:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3365-\tmisc = (struct scan_misc_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3384=int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3419-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3420:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3421-\treq = (struct scan_sched_req *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3430-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3431:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3432-\tssid = (struct scan_ssid_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3441-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3442:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3443-\tmatch = (struct scan_sched_ssid_match_sets *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3452-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3453:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3454-\tchan_info = (struct scan_chan_info_tlv *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=3484=mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3504-\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:3505:\ttlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-3506-\treq = (struct scan_sched_enable *)tlv;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=243=mt7925_nan_mp_tlv(struct sk_buff *skb, u8 master_pref)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-250-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:251:\ttlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_MASTER_PREFERENCE,\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-252-\t\t\t\t      sizeof(struct mt7925_nan_master_preference_tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=267=mt7925_nan_dw_tlv(struct sk_buff *skb, struct cfg80211_nan_conf *conf)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-275-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:276:\ttlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_DW_INTERVAL,\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-277-\t\t\t\t      sizeof(struct mt7925_nan_dw_interval_tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=305=mt7925_nan_cluster_id_tlv(struct sk_buff *skb, const u8 *cluster_id)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-312-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:313:\ttlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_CLUSTER_ID,\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-314-\t\t\t\t      sizeof(struct mt7925_nan_cluster_id_tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=327=mt7925_nan_sync_rssi_tlv(struct sk_buff *skb, struct cfg80211_nan_conf *conf)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-334-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:335:\ttlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_SYNC_RSSI,\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-336-\t\t\t\t      sizeof(struct mt7925_nan_sync_rssi_tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=530=static int mt7925_nan_avail_ctrl_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-541-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:542:\ttlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_UPDATE_AVAILABILITY_CTRL,\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-543-\t\t\t\t      sizeof(struct mt7925_nan_avail_ctrl_tlv));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c=612=static int mt7925_nan_avail_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-622-\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c:623:\ttlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_UPDATE_AVAILABILITY,\ndrivers/net/wireless/mediatek/mt76/mt7925/nan.c-624-\t\t\t\t      sizeof(struct mt7925_nan_avail_entry_tlv));\n--\n\n"
}

gemini-3.7-flash

null

null

							input: 25295
							output: 53
							thoughts: 47
						

Here's my summary, as if I were thinking these thoughts:

**Diving into the MT76 Connac MCU Code**

Okay, time to dig into this `mt76_connac_mcu_add_tlv` function. Let's start by looking directly at the declaration – `drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h` is where it's supposed to live. I want to see how this thing is architected, how it handles the construction and addition of TLVs – specifically within the MT76 Connac architecture. I need to understand this fundamental building block for data exchange with the MCU. Knowing the intricacies of adding TLVs will be crucial to troubleshooting potential packet formatting issues or data corruption scenarios down the line. It will also help in reverse engineering if needed. Let's see what we're working with.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h",
  "FirstLine": 1990,
  "LineCount": 25
}

{
  "Contents": "1990:\tstruct tlv *mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag,\n1991:\t\t\t\t\t\t   int len, void *sta_ntlv,\n1992:\t\t\t\t\t\t   void *sta_wtbl);\n1993:\tstatic inline struct tlv *\n1994:\tmt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)\n1995:\t{\n1996:\t\treturn mt76_connac_mcu_add_nested_tlv(skb, tag, len, skb-\u003edata, NULL);\n1997:\t}\n1998:\t\n1999:\tint mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);\n2000:\tint mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);\n2001:\tvoid mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,\n2002:\t\t\t\t\t   struct ieee80211_bss_conf *link_conf,\n2003:\t\t\t\t\t   struct ieee80211_link_sta *link_sta,\n2004:\t\t\t\t\t   int state, bool newly);\n2005:\tvoid mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,\n2006:\t\t\t\t\t      struct ieee80211_vif *vif,\n2007:\t\t\t\t\t      struct ieee80211_sta *sta, void *sta_wtbl,\n2008:\t\t\t\t\t      void *wtbl_tlv);\n2009:\tvoid mt76_connac_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb,\n2010:\t\t\t\t\t\tstruct ieee80211_vif *vif,\n2011:\t\t\t\t\t\tstruct mt76_wcid *wcid,\n2012:\t\t\t\t\t\tvoid *sta_wtbl, void *wtbl_tlv);\n2013:\tint mt76_connac_mcu_sta_update_hdr_trans(struct mt76_dev *dev,\n2014:\t\t\t\t\t\t struct ieee80211_vif *vif,\n"
}

gemini-3.7-flash

null

null

							input: 26237
							output: 48
							thoughts: 49
						

Here's my take on that code snippet:

**Diving into the MT76 Connac MCU TLV Creation**

Okay, so I'm digging into `mt76_connac_mcu_add_nested_tlv` within the `mt76_connac_mcu.c` file, specifically in the Mediatek wireless driver context. My initial thought is, this is likely a critical utility function for constructing and managing the Type-Length-Value (TLV) structures that are fundamental to how the MediaTek MT76 Connac MCU communicates. These nested TLVs are the backbone for exchanging configuration data, commands, and status information with the wireless chip, so getting this right is paramount. I'll need to understand how this function handles the nesting aspect; it's probably building TLVs within TLVs to represent more complex data structures. This is where the magic happens, so let's see how they do it. I will see if there are any subtle bugs here.

{
  "Expression": "mt76_connac_mcu_add_nested_tlv",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=291=struct tlv *\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:292:mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-293-\t\t\t       void *sta_ntlv, void *sta_wtbl)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-315-}\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:316:EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_nested_tlv);\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-317-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=514=void mt76_connac_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-521-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:522:\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-523-\t\t\t\t\t     sizeof(*htr),\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=595=void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-606-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:607:\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_GENERIC,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-608-\t\t\t\t\t     sizeof(*generic),\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-630-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:631:\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-632-\t\t\t\t\t     wtbl_tlv, sta_wtbl);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-641-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:642:\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-643-\t\t\t\t\t     wtbl_tlv, sta_wtbl);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=1002=void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1008-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1009:\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1010-\t\t\t\t\t     wtbl_tlv, sta_wtbl);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=1016=void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1024-\tif (sta-\u003edeflink.ht_cap.ht_supported || sta-\u003edeflink.he_6ghz_capa.capa) {\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1025:\t\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1026-\t\t\t\t\t\t     wtbl_tlv, sta_wtbl);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1047-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1048:\t\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_VHT,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1049-\t\t\t\t\t\t     sizeof(*vht), wtbl_tlv,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1069-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1070:\t\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1071-\t\t\t\t\t\t     sizeof(*raw), wtbl_tlv,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=1149=void mt76_connac_mcu_wtbl_ba_tlv(struct mt76_dev *dev, struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1156-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:1157:\ttlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-1158-\t\t\t\t\t     wtbl_tlv, sta_wtbl);\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h=1988=mt76_connac_mcu_alloc_wtbl_req(struct mt76_dev *dev, struct mt76_wcid *wcid,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h-1989-\t\t\t       int cmd, void *sta_wtbl, struct sk_buff **skb);\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h:1990:struct tlv *mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag,\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h-1991-\t\t\t\t\t   int len, void *sta_ntlv,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h=1994=mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h-1995-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h:1996:\treturn mt76_connac_mcu_add_nested_tlv(skb, tag, len, skb-\u003edata, NULL);\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h-1997-}\n"
}

gemini-3.7-flash

null

null

							input: 28818
							output: 52
							thoughts: 50
						

Here's my summary, as if I were thinking these thoughts:

**Analyzing `mt76_connac_mcu_add_nested_tlv`**

Okay, I'm digging into `drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c`. Specifically, I want to understand what's going on with `mt76_connac_mcu_add_nested_tlv`. Right off the bat, I suspect this function is responsible for building up some sort of data structure, likely a Type-Length-Value (TLV) structure, for communication with the MT76's microcontroller (MCU) in the Connac chipset. The "nested" part strongly suggests that this is a recursive or iterative function, building a hierarchical TLV set. Knowing MediaTek's architecture, I'd bet this TLV structure encapsulates parameters or commands we're sending to the MCU. I'll need to see how it's used to fully grasp the context, but my initial impression is this is a crucial piece for configuration and control. This function likely manages the intricacies of packing and encoding data efficiently for the MCU, making sure the right information, with the right formatting, gets delivered reliably. Time to dive into the code!

{
  "File": "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c",
  "FirstLine": 290,
  "LineCount": 30
}

{
  "Contents": " 290:\t\n 291:\tstruct tlv *\n 292:\tmt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,\n 293:\t\t\t\t       void *sta_ntlv, void *sta_wtbl)\n 294:\t{\n 295:\t\tstruct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;\n 296:\t\tstruct tlv *sta_hdr = sta_wtbl;\n 297:\t\tstruct tlv *ptlv, tlv = {\n 298:\t\t\t.tag = cpu_to_le16(tag),\n 299:\t\t\t.len = cpu_to_le16(len),\n 300:\t\t};\n 301:\t\tu16 ntlv;\n 302:\t\n 303:\t\tptlv = skb_put_zero(skb, len);\n 304:\t\tmemcpy(ptlv, \u0026tlv, sizeof(tlv));\n 305:\t\n 306:\t\tntlv = le16_to_cpu(ntlv_hdr-\u003etlv_num);\n 307:\t\tntlv_hdr-\u003etlv_num = cpu_to_le16(ntlv + 1);\n 308:\t\n 309:\t\tif (sta_hdr) {\n 310:\t\t\tlen += le16_to_cpu(sta_hdr-\u003elen);\n 311:\t\t\tsta_hdr-\u003elen = cpu_to_le16(len);\n 312:\t\t}\n 313:\t\n 314:\t\treturn ptlv;\n 315:\t}\n 316:\tEXPORT_SYMBOL_GPL(mt76_connac_mcu_add_nested_tlv);\n 317:\t\n 318:\tstruct sk_buff *\n 319:\t__mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif_link *mvif,\n"
}

gemini-3.7-flash

null

null

							input: 29730
							output: 30
							thoughts: 87
						

Here's my summary, as if I were thinking these things:

**Analyzing a Potential Security Vulnerability in the MT76 Driver**

Okay, so I'm digging into this `mt76_connac_mcu_add_nested_tlv` function. The code's using `skb_put_zero(skb, len)`, which means the entire TLV buffer is being zeroed out. That's a bit of a red flag, right? Especially since this `skb` is for an internal MCU command going directly to the firmware, not user space.

This could be interesting. A zeroed buffer has implications. I’m thinking there might be something here that could lead to unexpected behavior or even a potential vulnerability if the firmware doesn't handle the zeroed TLV correctly. Perhaps this is okay, but I'm going to follow the call path to see how the buffer is used. Specifically, I need to understand the implications of `mt7925_mcu_sta_mld_tlv`, because that's where this function seems to be used. Let's see who's calling *that* function and figure out what's really happening.

{
  "Expression": "mt7925_mcu_sta_mld_tlv"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2061=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2062:mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2063-\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c=2163=mt7925_mcu_sta_cmd(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2202-\t\tif (info-\u003estate != MT76_STA_INFO_STATE_NONE) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2203:\t\t\tmt7925_mcu_sta_mld_tlv(skb, info-\u003evif,\ndrivers/net/wireless/mediatek/mt76/mt7925/mcu.c-2204-\t\t\t\t\t       info-\u003elink_sta-\u003esta,\n"
}

gemini-3.7-flash

null

null

							input: 30451
							output: 52
							thoughts: 26
						

Here's my take on the thought process, as requested:

**Diving into the `mt7925_mcu_sta_cmd` Function**

Okay, time to get to the heart of this. My initial instinct is to zero in on that `mt7925_mcu_sta_cmd` function, specifically around line 2200. I'm assuming that's where the issue might be rooted. I want to carefully examine the logic surrounding that section. I'll be looking for potential command failures, any unusual state transitions, or perhaps even a memory access issue. Given my experience, I'm expecting something nuanced, not necessarily a glaring error, but rather a subtle interaction within the command sequence that's causing this behavior. Time to start digging!

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c",
  "FirstLine": 2160,
  "LineCount": 55
}

{
  "Contents": "2160:\t}\n2161:\t\n2162:\tstatic int\n2163:\tmt7925_mcu_sta_cmd(struct mt76_phy *phy,\n2164:\t\t\t   struct mt76_sta_cmd_info *info)\n2165:\t{\n2166:\t\tstruct mt792x_vif *mvif = (struct mt792x_vif *)info-\u003evif-\u003edrv_priv;\n2167:\t\tstruct mt76_dev *dev = phy-\u003edev;\n2168:\t\tstruct mt792x_bss_conf *mconf;\n2169:\t\tstruct mt792x_link_sta *mlink;\n2170:\t\tstruct sk_buff *skb;\n2171:\t\tint conn_state;\n2172:\t\n2173:\t\tmconf = mt792x_vif_to_link(mvif, info-\u003ewcid-\u003elink_id);\n2174:\t\tmlink = container_of(info-\u003ewcid, struct mt792x_link_sta, wcid);\n2175:\t\n2176:\t\tskb = __mt76_connac_mcu_alloc_sta_req(dev, \u0026mconf-\u003emt76, info-\u003ewcid,\n2177:\t\t\t\t\t\t      MT7925_STA_UPDATE_MAX_SIZE);\n2178:\t\tif (IS_ERR(skb))\n2179:\t\t\treturn PTR_ERR(skb);\n2180:\t\n2181:\t\tconn_state = info-\u003eenable ? CONN_STATE_PORT_SECURE :\n2182:\t\t\t\t\t    CONN_STATE_DISCONNECT;\n2183:\t\n2184:\t\tif (info-\u003eenable \u0026\u0026 info-\u003elink_sta) {\n2185:\t\t\tmt76_connac_mcu_sta_basic_tlv(dev, skb, info-\u003elink_conf,\n2186:\t\t\t\t\t\t      info-\u003elink_sta,\n2187:\t\t\t\t\t\t      conn_state, info-\u003enewly);\n2188:\t\t\tmt7925_mcu_sta_phy_tlv(skb, info-\u003evif, info-\u003elink_sta);\n2189:\t\t\tmt7925_mcu_sta_ht_tlv(skb, info-\u003elink_sta);\n2190:\t\t\tmt7925_mcu_sta_vht_tlv(skb, info-\u003elink_sta);\n2191:\t\t\tmt76_connac_mcu_sta_uapsd(skb, info-\u003evif, info-\u003elink_sta-\u003esta);\n2192:\t\t\tmt7925_mcu_sta_amsdu_tlv(skb, info-\u003evif, info-\u003elink_sta, mlink);\n2193:\t\t\tmt7925_mcu_sta_he_tlv(skb, info-\u003elink_sta);\n2194:\t\t\tmt7925_mcu_sta_he_6g_tlv(skb, info-\u003elink_sta);\n2195:\t\t\tmt7925_mcu_sta_eht_tlv(skb, info-\u003elink_sta);\n2196:\t\t\tmt7925_mcu_sta_rate_ctrl_tlv(skb, info-\u003evif,\n2197:\t\t\t\t\t\t     info-\u003elink_sta);\n2198:\t\t\tmt7925_mcu_sta_state_v2_tlv(phy, skb, info-\u003elink_sta,\n2199:\t\t\t\t\t\t    info-\u003evif, info-\u003ercpi,\n2200:\t\t\t\t\t\t    info-\u003estate);\n2201:\t\n2202:\t\t\tif (info-\u003estate != MT76_STA_INFO_STATE_NONE) {\n2203:\t\t\t\tmt7925_mcu_sta_mld_tlv(skb, info-\u003evif,\n2204:\t\t\t\t\t\t       info-\u003elink_sta-\u003esta,\n2205:\t\t\t\t\t\t       mconf, mlink);\n2206:\t\n2207:\t\t\t\tmt7925_mcu_sta_eht_mld_tlv(skb, info-\u003evif, info-\u003elink_sta-\u003esta);\n2208:\t\t\t}\n2209:\t\t}\n2210:\t\n2211:\t\tif (!info-\u003eenable) {\n2212:\t\t\tmt7925_mcu_sta_remove_tlv(skb);\n2213:\t\t\tmt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,\n2214:\t\t\t\t\t\tsizeof(struct tlv));\n"
}

gemini-3.7-flash

null

null

							input: 31888
							output: 282
							thoughts: 1502
						

**Patch Analysis: mt7925_mcu_sta_mld_tlv**

Okay, let's dive into this patch. My immediate thought is to determine if this update to `mt7925_mcu_sta_mld_tlv` introduces any potential vulnerabilities, specifically related to uninitialized memory reads or information leaks. I need to be careful, as this is a firmware interaction via an MCU command, so user-space exposure is a key concern.

First, I see the core function involves constructing and sending a TLV (Type-Length-Value) within an `sk_buff`.  The function populates a `sta_rec_mld` structure, which is then passed as a message to the MT7925 firmware. My initial check is: are there uninitialized fields in kernel structures that are sent to user space? No, I see that the `tlv` is written into the `skb` with zero initialization using `skb_put_zero()`. So that's good.

Next, I need to look for uninitialized variables within this patch that could lead to issues. I see `valid` is initialized to `msta->valid_links`. The `link_id` is an iterator variable, `max_links` initialized to `ARRAY_SIZE(mld->link)`, `cnt` initialized to 0. Also `mlink_sec`, `mconf_sec` which are initialized inside the loop. No uninitialized variables being used, nor any reads of uninitialized memory.

Third, does this patch expose info leaks or uninitialized memory reads in reachable code paths?  Nope.

Given this, I must double check against the four KMSAN criteria. 1. No kernel structures are being sent to user space (like `copy_to_user`, `put_user`, `netlink skb`, `ioctl`, etc.). 2. There's no conditional logic depending on potentially uninitialized variables. 3. There's no allocation or initialization of complex data structures where uninitialized fields could be read later. 4. Finally, I confirm there are no bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes.

So, I'm confident that this patch, as it is, should not introduce any KMSAN issues. Potential bugs (like array bounds `cnt == max_links`, RCU locking, NULL derefs) would likely be caught by KASAN, LOCKDEP, or other standard sanitizers.  Therefore, I'd say `NeedsKMSAN` is `false`. Time to move on.

{
  "KMSANReasoning": "The patch modifies `mt7925_mcu_sta_mld_tlv()` in `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c` to iterate over all valid station links when constructing the STA_REC_MLD MCU TLV command for firmware.\n\n- The buffer containing `struct sta_rec_mld` is allocated and zero-initialized via `mt76_connac_mcu_add_tlv()` (`skb_put_zero()`).\n- All local variables (`valid`, `max_links`, `cnt`, `link_id`, `mlink_sec`, `mconf_sec`) are properly initialized before use.\n- The TLV data is packaged into an internal MCU command skb transmitted to the device firmware, not copied or leaked to user space.\n- Any potential bounds issues (e.g. array indexing checked by `cnt == max_links`), pointer validity, or locking issues are covered by KASAN, LOCKDEP, and standard kernel debugging mechanisms.\n\nNo uninitialized memory read risks or info leaks are introduced or exposed. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch modifies `mt7925_mcu_sta_mld_tlv()` in `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c` to iterate over all valid station links when constructing the STA_REC_MLD MCU TLV command for firmware.\n\n- The buffer containing `struct sta_rec_mld` is allocated and zero-initialized via `mt76_connac_mcu_add_tlv()` (`skb_put_zero()`).\n- All local variables (`valid`, `max_links`, `cnt`, `link_id`, `mlink_sec`, `mconf_sec`) are properly initialized before use.\n- The TLV data is packaged into an internal MCU command skb transmitted to the device firmware, not copied or leaked to user space.\n- Any potential bounds issues (e.g. array indexing checked by `cnt == max_links`), pointer validity, or locking issues are covered by KASAN, LOCKDEP, and standard kernel debugging mechanisms.\n\nNo uninitialized memory read risks or info leaks are introduced or exposed. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false
}