AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/06/25 01:02	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "MT7663U", "MT76x0U", "MT76x2U", "MT7921U", "MT7925U" ], "FocusSymbols": [ "__mt76_set_channel", "mt76_set_channel" ], "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.", "WorthFuzzing": true }
1/1	2026/06/25 01:02	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 21186e7823b92420f70763ccd108d4067224aaa5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jun 25 01:02:15 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c\nindex 13c4e8abe28191..37474d64cfecdb 100644\n--- a/drivers/net/wireless/mediatek/mt76/mac80211.c\n+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c\n@@ -1033,6 +1033,7 @@ int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\n \t\t bool offchannel)\n {\n \tstruct mt76_dev dev = phy-\u003edev;\n+\tlong time_left;\n \tint timeout = HZ / 5;\n \tint ret;\n \n@@ -1040,8 +1041,13 @@ int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\n \tmt76_txq_schedule_pending(phy);\n \n \tset_bit(MT76_RESET, \u0026phy-\u003estate);\n-\twait_event_timeout(dev-\u003etx_wait, !mt76_has_tx_pending(phy), timeout);\n+\ttime_left = wait_event_timeout(dev-\u003etx_wait, !mt76_has_tx_pending(phy),\n+\t\t\t\t timeout);\n \tmt76_update_survey(phy);\n+\tif (!time_left) {\n+\t\tret = -ETIMEDOUT;\n+\t\tgoto out;\n+\t}\n \n \tif (phy-\u003echandef.chan-\u003ecenter_freq != chandef-\u003echan-\u003ecenter_freq \|\|\n \t phy-\u003echandef.width != chandef-\u003ewidth)\n@@ -1059,6 +1065,7 @@ int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def *chandef,\n \n \tret = dev-\u003edrv-\u003eset_channel(phy);\n \n+out:\n \tclear_bit(MT76_RESET, \u0026phy-\u003estate);\n \tmt76_worker_enable(\u0026dev-\u003etx_worker);\n \tmt76_worker_schedule(\u0026dev-\u003etx_worker);\n" }
2/1	2026/06/25 01:02	agent	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: { "EnableConfigs": [ "MT7663U", "MT76x0U", "MT76x2U", "MT7921U", "MT7925U" ], "FocusSymbols": [ "__mt76_set_channel", "mt76_set_channel" ], "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 21186e7823b92420f70763ccd108d4067224aaa5 Author: syz-cluster <triage@syzkaller.com> Date: Thu Jun 25 01:02:15 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c index 13c4e8abe28191..37474d64cfecdb 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -1033,6 +1033,7 @@ int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef, bool offchannel) { struct mt76_dev dev = phy->dev; + long time_left; int timeout = HZ / 5; int ret; @@ -1040,8 +1041,13 @@ int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef, mt76_txq_schedule_pending(phy); set_bit(MT76_RESET, &phy->state); - wait_event_timeout(dev->tx_wait, !mt76_has_tx_pending(phy), timeout); + time_left = wait_event_timeout(dev->tx_wait, !mt76_has_tx_pending(phy), + timeout); mt76_update_survey(phy); + if (!time_left) { + ret = -ETIMEDOUT; + goto out; + } if (phy->chandef.chan->center_freq != chandef->chan->center_freq \|\| phy->chandef.width != chandef->width) @@ -1059,6 +1065,7 @@ int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def *chandef, ret = dev->drv->set_channel(phy); +out: clear_bit(MT76_RESET, &phy->state); mt76_worker_enable(&dev->tx_worker); mt76_worker_schedule(&dev->tx_worker);
3/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2232 output: 38 thoughts: 309 Thoughts: Analyzing the Reachability of a Timeout Patch Okay, so I'm looking at this patch for `drivers/net/wireless/mediatek/mt76/mac80211.c`. Specifically, it's modifying the `__mt76_set_channel` function, adding a timeout check within `wait_event_timeout`. If the timeout expires, it returns `-ETIMEDOUT` and jumps to the `out:` label. My initial thought is, can we even reach this code in our fuzzing environment? Since it's a driver for Mediatek MT76 wireless devices, my experience immediately flags a potential issue. Typically, these hardware-specific drivers aren't easily accessible within virtualization environments like QEMU or GCE, unless we're dealing with software emulation or PCI passthrough. But `mac80211_hwsim` simulates generic mac80211 devices, not something as specific as an MT76 chip. Is there an MT76 emulator out there? Probably not. So, the chances of this timeout code being directly exercised in our current fuzzing setup seem low. However, I can't be too sure without a double-check. I need to investigate if there's any kind of virtual or USB interface associated with MT76 that we could fuzz through USB gadget or something similar. Ah, yes, I recall MT76 does have USB drivers, namely `mt76x0u` and `mt76x2u`. That's a game-changer! USB devices open the door for fuzzing using `dummy_hcd` or syzkaller's USB fuzzing capabilities. Now I need to confirm whether these MT76 USB drivers are enabled, or at least if we could potentially use them for fuzzing.
4/2	2026/06/25 01:02	tool	grepper	0m Args: { "Expression": "mt76.usb", "PathPrefix": "drivers/net/wireless/mediatek/mt76/" } Results:* { "Output": "\nFull output is too long, showing 500 out of 708 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Makefile=2=obj-$(CONFIG_MT76_CORE) += mt76.o\ndrivers/net/wireless/mediatek/mt76/Makefile:3:obj-$(CONFIG_MT76_USB) += mt76-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-4-obj-$(CONFIG_MT76_SDIO) += mt76-sdio.o\ndrivers/net/wireless/mediatek/mt76/Makefile=5=obj-$(CONFIG_MT76x02_LIB) += mt76x02-lib.o\ndrivers/net/wireless/mediatek/mt76/Makefile:6:obj-$(CONFIG_MT76x02_USB) += mt76x02-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-7-obj-$(CONFIG_MT76_CONNAC_LIB) += mt76-connac-lib.o\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=17=mt76-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/mediatek/mt76/Makefile-18-\ndrivers/net/wireless/mediatek/mt76/Makefile:19:mt76-usb-y := usb.o usb_trace.o\ndrivers/net/wireless/mediatek/mt76/Makefile-20-mt76-sdio-y := sdio.o sdio_txrx.o\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=27=mt76x02-lib-y := mt76x02_util.o mt76x02_mac.o mt76x02_mcu.o \\\n--\ndrivers/net/wireless/mediatek/mt76/Makefile-31-\ndrivers/net/wireless/mediatek/mt76/Makefile:32:mt76x02-usb-y := mt76x02_usb_mcu.o mt76x02_usb_core.o\ndrivers/net/wireless/mediatek/mt76/Makefile-33-\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c=74=static int mt76_rx_queues_read(struct seq_file s, void data)\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c-82-\ndrivers/net/wireless/mediatek/mt76/debugfs.c:83:\t\tqueued = mt76_is_usb(dev) ? q-\u003endesc - q-\u003equeued : q-\u003equeued;\ndrivers/net/wireless/mediatek/mt76/debugfs.c-84-\t\tseq_printf(s, \" %9d \| %9d \| %9d \| %9d \|\\n\",\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=95=struct mt76_bus_ops {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-109-\ndrivers/net/wireless/mediatek/mt76/mt76.h:110:#define mt76_is_usb(dev) ((dev)-\u003ebus-\u003etype == MT76_BUS_USB)\ndrivers/net/wireless/mediatek/mt76/mt76.h-111-#define mt76_is_mmio(dev) ((dev)-\u003ebus-\u003etype == MT76_BUS_MMIO)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=649=struct mt76_mcu {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-662-#define MCU_RESP_URB_SIZE\t1024\ndrivers/net/wireless/mediatek/mt76/mt76.h:663:struct mt76_usb {\ndrivers/net/wireless/mediatek/mt76/mt76.h-664-\tstruct mutex usb_ctrl_mtx;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=921=struct mt76_dev {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1035-\t\tstruct mt76_mmio mmio;\ndrivers/net/wireless/mediatek/mt76/mt76.h:1036:\t\tstruct mt76_usb usb;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1037-\t\tstruct mt76_sdio sdio;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1838=mt76u_bulk_msg(struct mt76_dev dev, void data, int len, int actual_len,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1842-\tstruct usb_device udev = interface_to_usbdev(uintf);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1843:\tstruct mt76_usb usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1844-\tunsigned int pipe;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1868=void ___mt76u_wr(struct mt76_dev dev, u8 req, u8 req_type,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1869-\t\t u32 addr, u32 val);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1870:int __mt76u_init(struct mt76_dev dev, struct usb_interface intf,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1871-\t\t struct mt76_bus_ops ops);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1872:int mt76u_init(struct mt76_dev dev, struct usb_interface intf);\ndrivers/net/wireless/mediatek/mt76/mt76.h-1873-int mt76u_alloc_mcu_queue(struct mt76_dev dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile=4=obj-$(CONFIG_MT7615E) += mt7615e.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:5:obj-$(CONFIG_MT7663_USB_SDIO_COMMON) += mt7663-usb-sdio-common.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-6-obj-$(CONFIG_MT7663U) += mt7663u.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile=16=mt7615e-$(CONFIG_MT7622_WMAC) += soc.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-17-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:18:mt7663-usb-sdio-common-y := usb_sdio.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:19:mt7663u-y := usb.o usb_mcu.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-20-mt7663s-y := sdio.o sdio_mcu.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=96=mt7615_pm_set(void data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:105:\tif (!mt7615_firmware_offload(dev) \|\| mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-106-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=355=extern const u32 mt7663e_reg_map[__MT_BASE_MAX];\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:356:extern const u32 mt7663_usb_sdio_reg_map[__MT_BASE_MAX];\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-357-extern struct pci_driver mt7615_pci_driver;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=540=void mt7622_trigger_hif_int(struct mt7615_dev dev, bool en);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-542-/* usb /\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:543:int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev mdev, void txwi_ptr,\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-544-\t\t\t\t enum mt76_txq_id qid, struct mt76_wcid wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-546-\t\t\t\t struct mt76_tx_info tx_info);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:547:bool mt7663_usb_sdio_tx_status_data(struct mt76_dev mdev, u8 update);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:548:void mt7663_usb_sdio_tx_complete_skb(struct mt76_dev mdev,\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-549-\t\t\t\t struct mt76_queue_entry e);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:550:int mt7663_usb_sdio_register_device(struct mt7615_dev dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-551-int mt7663u_mcu_init(struct mt7615_dev dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c=76=static int mt7663s_probe(struct sdio_func func,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-81-\t\t.drv_flags = MT_DRV_RX_DMA_HDR,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:82:\t\t.tx_prepare_skb = mt7663_usb_sdio_tx_prepare_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:83:\t\t.tx_complete_skb = mt7663_usb_sdio_tx_complete_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:84:\t\t.tx_status_data = mt7663_usb_sdio_tx_status_data,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-85-\t\t.rx_skb = mt7615_queue_rx_skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-118-\tINIT_WORK(\u0026dev-\u003emcu_work, mt7663s_init_work);\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:119:\tdev-\u003ereg_map = mt7663_usb_sdio_reg_map;\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-120-\tdev-\u003eops = ops;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-158-\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:159:\tret = mt7663_usb_sdio_register_device(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-160-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c=57=static void mt7663u_copy(struct mt76_dev dev, u32 offset,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-59-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:60:\tstruct mt76_usb usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-61-\tint ret, i = 0, batch_len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c=101=static void mt7663u_init_work(struct work_struct work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-111-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:112:static int mt7663u_probe(struct usb_interface usb_intf,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-113-\t\t\t const struct usb_device_id id)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-117-\t\t.drv_flags = MT_DRV_RX_DMA_HDR \| MT_DRV_HW_MGMT_TXQ,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:118:\t\t.tx_prepare_skb = mt7663_usb_sdio_tx_prepare_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:119:\t\t.tx_complete_skb = mt7663_usb_sdio_tx_complete_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:120:\t\t.tx_status_data = mt7663_usb_sdio_tx_status_data,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-121-\t\t.rx_skb = mt7615_queue_rx_skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-148-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:149:\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(dev), ops, \u0026drv_ops);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-150-\tif (!mdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-158-\tINIT_WORK(\u0026dev-\u003emcu_work, mt7663u_init_work);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:159:\tdev-\u003ereg_map = mt7663_usb_sdio_reg_map;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-160-\tdev-\u003eops = ops;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:161:\tret = __mt76u_init(mdev, usb_intf, \u0026bus_ops);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-162-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-185-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:186:\tret = mt7663_usb_sdio_register_device(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-187-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:201:static void mt7663u_disconnect(struct usb_interface usb_intf)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-202-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:203:\tstruct mt7615_dev dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-204-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-216-#ifdef CONFIG_PM\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:217:static int mt7663u_suspend(struct usb_interface intf, pm_message_t state)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-218-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:219:\tstruct mt7615_dev dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-220-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-235-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:236:static int mt7663u_resume(struct usb_interface intf)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-237-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:238:\tstruct mt7615_dev dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-239-\tint err;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-16-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:17:const u32 mt7663_usb_sdio_reg_map[] = {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-18-\t[MT_TOP_CFG_BASE]\t= 0x80020000,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-40-};\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:41:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_reg_map);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-42-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c=43=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:44:mt7663_usb_sdio_write_txwi(struct mt7615_dev dev, struct mt76_wcid wcid,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-45-\t\t\t enum mt76_txq_id qid, struct ieee80211_sta sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-55-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:56:static int mt7663_usb_sdio_set_rates(struct mt7615_dev dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-57-\t\t\t\t struct mt7615_wtbl_rate_desc wrd)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-130-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:131:static void mt7663_usb_sdio_rate_work(struct work_struct work)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-132-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-148-\t\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:149:\t\tmt7663_usb_sdio_set_rates(dev, wrd);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-150-\t\tmt7615_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-155-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:156:bool mt7663_usb_sdio_tx_status_data(struct mt76_dev mdev, u8 update)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-157-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-165-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:166:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_tx_status_data);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-167-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:168:void mt7663_usb_sdio_tx_complete_skb(struct mt76_dev mdev,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-169-\t\t\t\t struct mt76_queue_entry e)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-172-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:173:\tif (mt76_is_usb(mdev))\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-174-\t\theadroom += MT_USB_HDR_SIZE;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-178-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:179:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_tx_complete_skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-180-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:181:int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev mdev, void txwi_ptr,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-182-\t\t\t\t enum mt76_txq_id qid, struct mt76_wcid wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-206-\tpktid = mt76_tx_status_skb_add(\u0026dev-\u003emt76, wcid, skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:207:\tmt7663_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:208:\tif (mt76_is_usb(mdev)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-209-\t\tu32 len = skb-\u003elen;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-223-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:224:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_tx_prepare_skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-225-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c=226=static int mt7663u_dma_sched_init(struct mt7615_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-277-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:278:static int mt7663_usb_sdio_init_hardware(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-279-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-285-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:286:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-287-\t\tret = mt7663u_dma_sched_init(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-305-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:306:int mt7663_usb_sdio_register_device(struct mt7615_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-307-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-310-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:311:\tINIT_WORK(\u0026dev-\u003erate_work, mt7663_usb_sdio_rate_work);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-312-\tINIT_LIST_HEAD(\u0026dev-\u003ewrd_head);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-314-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:315:\terr = mt7663_usb_sdio_init_hardware(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-316-\tif (err)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-319-\thw-\u003eextra_tx_headroom += MT_USB_TXD_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:320:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-321-\t\thw-\u003eextra_tx_headroom += MT_USB_HDR_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-322-\t\t/* check hw sg support in order to enable AMSDU /\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:323:\t\tif (dev-\u003emt76.usb.sg_en)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-324-\t\t\thw-\u003emax_tx_fragments = MT_HW_TXP_MAX_BUF_NUM;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-333-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:334:\tif (!dev-\u003emt76.usb.sg_en) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-335-\t\tstruct ieee80211_sta_vht_cap vht_cap;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-347-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:348:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_register_device);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-349-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c=36=int mt76_connac_pm_wake(struct mt76_phy phy, struct mt76_connac_pm pm)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-39-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c:40:\tif (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-41-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c=62=void mt76_connac_power_save_sched(struct mt76_phy phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-66-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c:67:\tif (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-68-\t\treturn;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=2566=mt76_connac_mcu_set_wow_ctrl(struct mt76_phy phy, struct ieee80211_vif vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2608-\t\treq.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:2609:\telse if (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2610-\t\treq.wow_ctrl_tlv.wakeup_hif = WOW_USB;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=2619=int mt76_connac_mcu_set_hif_suspend(struct mt76_dev dev, bool suspend, bool wait_resp)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2644-\t\treq.hdr.hif_type = 2;\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:2645:\telse if (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2646-\t\treq.hdr.hif_type = 1;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile=6=mt76x0-common-y := init.o main.o eeprom.o phy.o\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile:8:mt76x0u-y := usb.o usb_mcu.o\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile-9-mt76x0e-y := pci.o pci_mcu.o\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c=103=mt76x0_rf_wr(struct mt76x02_dev dev, u32 offset, u8 val)\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-104-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c:105:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-106-\t\tstruct mt76_reg_pair pair = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c=119=static int mt76x0_rf_rr(struct mt76x02_dev dev, u32 offset)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-123-\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c:124:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-125-\t\tstruct mt76_reg_pair pair = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c=913=void mt76x0_phy_set_channel(struct mt76x02_dev dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-970-\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c:971:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-972-\t\tmt76x0_phy_bbp_set_bw(dev, chandef-\u003ewidth);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-11-#include \"mcu.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:12:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-13-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=14=static struct usb_device_id mt76x0_device_table[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-45-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:46:static void mt76x0_init_usb_dma(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-47-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=151=static int mt76x0u_init_hardware(struct mt76x02_dev dev, bool reset)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-163-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:164:\tmt76x0_init_usb_dma(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-165-\terr = mt76x0_init_hardware(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=179=static int mt76x0u_register_device(struct mt76x02_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-181-\tstruct ieee80211_hw hw = dev-\u003emt76.hw;\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:182:\tstruct mt76_usb usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-183-\tint err;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-198-\t/* check hw sg support in order to enable AMSDU /\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:199:\thw-\u003emax_tx_fragments = dev-\u003emt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1;\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-200-\terr = mt76x0_register_device(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-212-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:213:static int mt76x0u_probe(struct usb_interface usb_intf,\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-214-\t\t\t const struct usb_device_id id)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-235-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:236:\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(dev), \u0026mt76x0u_ops,\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-237-\t\t\t\t \u0026drv_ops);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-252-\tmt76x02u_init_mcu(mdev);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:253:\tret = mt76u_init(mdev, usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-254-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-291-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:292:static void mt76x0_disconnect(struct usb_interface usb_intf)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-293-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:294:\tstruct mt76x02_dev dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-295-\tbool initialized = test_bit(MT76_STATE_INITIALIZED, \u0026dev-\u003emphy.state);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-307-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:308:static int __maybe_unused mt76x0_suspend(struct usb_interface usb_intf,\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-309-\t\t\t\t\t pm_message_t state)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-310-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:311:\tstruct mt76x02_dev dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-312-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-319-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:320:static int __maybe_unused mt76x0_resume(struct usb_interface usb_intf)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-321-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:322:\tstruct mt76x02_dev dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-323-\tint ret;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c-10-#include \"mcu.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c:11:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c-12-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c=26=mt76x02_write_beacon(struct mt76x02_dev dev, int offset, struct sk_buff skb)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c-35-\t /\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c:36:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c-37-\t\tstruct mt76x02_txwi txwi;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c-5-\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c:6:#include \"mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c-7-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-10-#include \"mt76x02_mcu.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:11:#include \"mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-12-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c=21=mt76x02u_multiple_mcu_reads(struct mt76_dev dev, u8 data, int len)\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-22-{\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:23:\tstruct mt76_usb usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-24-\tint i;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c=37=static int mt76x02u_mcu_wait_resp(struct mt76_dev dev, u8 seq)\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-38-{\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:39:\tstruct mt76_usb usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-40-\tu8 data = usb-\u003emcu.data;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c=166=mt76x02u_mcu_rd_rp(struct mt76_dev dev, u32 base,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-170-\tconst int max_vals_per_cmd = MT_INBAND_PACKET_MAX_LEN / 8;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:171:\tstruct mt76_usb usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-172-\tstruct sk_buff skb;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c=140=int mt76x02_init_device(struct mt76x02_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-152-\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c:153:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-154-\t\thw-\u003eextra_tx_headroom += sizeof(struct mt76x02_txwi) +\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c=406=int mt76x02_set_key(struct ieee80211_hw hw, enum set_key_cmd cmd,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-443-\t /\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c:444:\tif (mt76_is_usb(\u0026dev-\u003emt76) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-445-\t vif-\u003etype == NL80211_IFTYPE_AP \u0026\u0026\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-8-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:9:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-10-#include \"mt76x2u.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c=12=static const struct usb_device_id mt76x2u_device_table[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-31-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:32:static int mt76x2u_probe(struct usb_interface intf,\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-33-\t\t\t const struct usb_device_id id)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-90-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:91:static void mt76x2u_disconnect(struct usb_interface intf)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-92-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:93:\tstruct mt76x02_dev dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-94-\tstruct ieee80211_hw hw = mt76_hw(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-102-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:103:static int __maybe_unused mt76x2u_suspend(struct usb_interface intf,\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-104-\t\t\t\t\t pm_message_t state)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-105-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:106:\tstruct mt76x02_dev dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-107-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-112-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:113:static int __maybe_unused mt76x2u_resume(struct usb_interface intf)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-114-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:115:\tstruct mt76x02_dev dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-116-\tint err;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-10-#include \"../mt76x02_phy.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c:11:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-12-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c=190=int mt76x2u_register_device(struct mt76x02_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-192-\tstruct ieee80211_hw hw = mt76_hw(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c:193:\tstruct mt76_usb usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-194-\tbool vht;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-219-\t/* check hw sg support in order to enable AMSDU /\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c:220:\thw-\u003emax_tx_fragments = dev-\u003emt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-221-\tswitch (dev-\u003emt76.rev) {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c-6-#include \"mt76x2u.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c:7:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c-8-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-9-#include \"eeprom.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c:10:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-11-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c=28=static void mt76x2u_mcu_enable_patch(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-29-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c:30:\tstruct mt76_usb usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-31-\tstatic const u8 data[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c=43=static void mt76x2u_mcu_reset_wmt(struct mt76x02_dev dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-44-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c:45:\tstruct mt76_usb usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-46-\tu8 data[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=143=mt7921_pm_set(void data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-147-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:148:\tif (mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-149-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=188=mt7921_deep_sleep_set(void data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-194-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:195:\tif (mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-196-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c=170=int mt7921_register_device(struct mt792x_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-209-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:210:\tif (!mt76_is_usb(\u0026dev-\u003emt76) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-211-\t !is_mt7902(\u0026dev-\u003emt76)) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=655=void mt7921_mac_reset_work(struct work_struct work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-680-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:681:\tif ((mt76_is_sdio(\u0026dev-\u003emt76) \|\| mt76_is_usb(\u0026dev-\u003emt76)) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-682-\t atomic_read(\u0026dev-\u003emt76.bus_hung))\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=769=int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev mdev, void txwi_ptr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-804-\tpad = round_up(skb-\u003elen, 4) - skb-\u003elen;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:805:\tif (mt76_is_usb(mdev))\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-806-\t\tpad += 4;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c=13=bool mt7921_regd_clc_supported(struct mt792x_dev dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c-15-\tif (mt7921_disable_clc \|\|\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c:16:\t mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c-17-\t\treturn false;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c=150=static int mt7921u_probe(struct usb_interface usb_intf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-197-\tops-\u003estop = mt792xu_stop;\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:198:\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(dev), ops, \u0026drv_ops);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-199-\tif (!mdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-211-\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:212:\tret = __mt76u_init(mdev, usb_intf, \u0026bus_ops);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-213-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=182=mt7925_pm_set(void *data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-186-\n\n" }
5/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19204 output: 49 thoughts: 183 Thoughts: Fuzzing the MT76 USB Driver Okay, so the MT76 driver family has USB support – that's a key piece of information. Specifically, it supports a range of USB variants: `mt76-usb`, `mt76x02-usb`, `mt7615-usb`, the whole lot. This is brilliant because it means we can fuzz it using a USB gadget setup! Now, the main target for modification is the `__mt76_set_channel` function, and I know it resides within the `drivers/net/wireless/mediatek/mt76/mac80211.c` file. Next, I need to confirm if that function is accessible. I suspect it's likely a mac80211 callback, something along the lines of `set_channel`. Let's confirm that by checking `mac80211.c` for calls to `__mt76_set_channel`.
6/2	2026/06/25 01:02	tool	grepper	0m Args: { "Expression": "__mt76_set_channel", "PathPrefix": "drivers/net/wireless/mediatek/mt76/mac80211.c" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mac80211.c=1030=EXPORT_SYMBOL_GPL(mt76_update_survey);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1031-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1032:int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1033-\t\t bool offchannel)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1076=int mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1084-\tmutex_lock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1085:\tret = __mt76_set_channel(phy, chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1086-\tmutex_unlock(\u0026dev-\u003emutex);\n" }
7/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 20014 output: 40 thoughts: 40 Thoughts: Here's a summary of my thought process: Tracing the Call Chain of `mt76_set_channel` Okay, so I'm looking at `__mt76_set_channel`, which is pretty clearly a low-level function related to channel configuration within the mt76 wireless driver. My instinct is to trace back the call stack. Specifically, I'm noting that `__mt76_set_channel` is called by `mt76_set_channel`. Now, let's see where that function, `mt76_set_channel`, is actually used. I need to understand the higher-level context, the initiating function calls, and the typical flow to have any idea how to debug or modify it. That will provide a critical clue about the control flow.
8/2	2026/06/25 01:02	tool	grepper	0m Args: { "Expression": "mt76_set_channel", "PathPrefix": "drivers/net/wireless/mediatek/mt76/" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/channel.c=22=mt76_phy_update_channel(struct mt76_phy phy,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-28-\ndrivers/net/wireless/mediatek/mt76/channel.c:29:\treturn __mt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/channel.c-30-}\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=313=void mt76_roc_complete(struct mt76_phy phy)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-324-\t !test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)) {\ndrivers/net/wireless/mediatek/mt76/channel.c:325:\t\t__mt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/channel.c-326-\t\tmt76_offchannel_notify(phy, false);\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=357=int mt76_remain_on_channel(struct ieee80211_hw hw, struct ieee80211_vif vif,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-394-\t\tmt76_offchannel_notify(phy, true);\ndrivers/net/wireless/mediatek/mt76/channel.c:395:\tret = __mt76_set_channel(phy, \u0026chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/channel.c-396-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1030=EXPORT_SYMBOL_GPL(mt76_update_survey);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1031-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1032:int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1033-\t\t bool offchannel)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1075-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1076:int mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1077-\t\t bool offchannel)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1084-\tmutex_lock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1085:\tret = __mt76_set_channel(phy, chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1086-\tmutex_unlock(\u0026dev-\u003emutex);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1091=int mt76_update_channel(struct mt76_phy phy)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1098-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1099:\treturn mt76_set_channel(phy, chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1100-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1799=void mt76_queue_tx_complete(struct mt76_dev dev, struct mt76_queue q,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1800-\t\t\t struct mt76_queue_entry e);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1801:int __mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1802-\t\t bool offchannel);\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1805=mt76_offchannel_chandef(struct mt76_phy phy, struct ieee80211_channel chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1814-}\ndrivers/net/wireless/mediatek/mt76/mt76.h:1815:int mt76_set_channel(struct mt76_phy phy, struct cfg80211_chan_def chandef,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1816-\t\t bool offchannel);\n--\ndrivers/net/wireless/mediatek/mt76/scan.c=7=static void mt76_scan_complete(struct mt76_dev dev, bool abort)\n--\ndrivers/net/wireless/mediatek/mt76/scan.c-20-\t !test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)) {\ndrivers/net/wireless/mediatek/mt76/scan.c:21:\t\tmt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/scan.c-22-\t\tmt76_offchannel_notify(phy, false);\n--\ndrivers/net/wireless/mediatek/mt76/scan.c=107=void mt76_scan_work(struct work_struct work)\n--\ndrivers/net/wireless/mediatek/mt76/scan.c-135-\t\tdev-\u003escan.chan = NULL;\ndrivers/net/wireless/mediatek/mt76/scan.c:136:\t\tmt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/scan.c-137-\t\tmt76_offchannel_notify(phy, false);\n--\ndrivers/net/wireless/mediatek/mt76/scan.c-145-\t\tmt76_offchannel_notify(phy, true);\ndrivers/net/wireless/mediatek/mt76/scan.c:146:\tmt76_set_channel(phy, \u0026chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/scan.c-147-\n" }
9/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 22097 output: 39 thoughts: 180 Thoughts: Analyzing MT76 Channel Setting Functions for Testability Okay, so I'm looking at how the `mt76_set_channel` and `__mt76_set_channel` functions are used in the MT76 wireless driver. It seems pretty straightforward; they're called in response to the usual mac80211 events: scanning (`mt76_scan_work`, `mt76_scan_complete`), channel updates (`mt76_update_channel`), and also things like remaining on a specific channel (`mt76_remain_on_channel`), ROC completion (`mt76_roc_complete`), and direct PHY channel updates (`mt76_phy_update_channel`). That's all standard operating procedure for a mac80211-compliant driver, nothing particularly out of the ordinary here. The interesting part, from a testing perspective, is that MT76 has USB support. That means we can potentially leverage `dummy_hcd` within syzkaller to emulate a USB device and then trigger these mac80211 operations, particularly via `nl80211`. That would give us a completely virtualized environment to thoroughly test all those channel setting and management functions. Given that they are used in so many different functions within the driver, it should be quite reachable. Right, so to make this happen, the next logical step is to figure out which kernel configuration options are required to enable those MT76 USB drivers in the first place. That'll be the starting point.
10/2	2026/06/25 01:02	tool	grepper	0m Args: { "Expression": "config MT76.USB", "PathPrefix": "drivers/net/wireless/mediatek/mt76/" } Results:* { "Output": "drivers/net/wireless/mediatek/mt76/Kconfig=6=config MT76_LEDS\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig=20=config MT76x02_LIB\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-23-\ndrivers/net/wireless/mediatek/mt76/Kconfig:24:config MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-25-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig=21=config MT7622_WMAC\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:32:config MT7663_USB_SDIO_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-33-\ttristate\n" }
11/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 22993 output: 37 thoughts: 57 Thoughts: Here's my analysis of the situation: Investigating MT76 Driver Configuration Okay, so I need to figure out the exact configuration options that activate these MT76 wireless drivers. I'm going to dive right into the `Kconfig` files for the Mediatek wireless drivers. Specifically, I'll be starting with `drivers/net/wireless/mediatek/mt76/Kconfig`, and then branch out to look at the more specific `mt76x0` directory's `Kconfig` file and others like it. This should give me the ground truth of what flags need to be set to include these MT76-based drivers in a kernel build. I expect to find some interesting dependencies and potentially platform-specific configurations in these files as well.
12/2	2026/06/25 01:02	tool	grepper	0m Args: { "Expression": "config MT76", "PathPrefix": "drivers/net/wireless/mediatek/mt76/" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/Kconfig:2:config MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/Kconfig:6:config MT76_LEDS\ndrivers/net/wireless/mediatek/mt76/Kconfig-7-\tbool\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/Kconfig:16:config MT76_SDIO\ndrivers/net/wireless/mediatek/mt76/Kconfig-17-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-19-\ndrivers/net/wireless/mediatek/mt76/Kconfig:20:config MT76x02_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-21-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-23-\ndrivers/net/wireless/mediatek/mt76/Kconfig:24:config MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-25-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/Kconfig:28:config MT76_CONNAC_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-29-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig=36=config MT792x_USB\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-39-\ndrivers/net/wireless/mediatek/mt76/Kconfig:40:config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\tbool\n--\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig:2:config MT7603E\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig-3-\ttristate \"MediaTek MT7603E (PCIe) and MT76x8 WLAN support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-2-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:3:config MT7615_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-4-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-7-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:8:config MT7615E\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-9-\ttristate \"MediaTek MT7615E and MT7663E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-20-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:21:config MT7622_WMAC\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-22-\tbool \"MT7622 (SoC) WMAC support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:32:config MT7663_USB_SDIO_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-33-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:36:config MT7663U\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-37-\ttristate \"MediaTek MT7663U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-46-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:47:config MT7663S\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-48-\ttristate \"MediaTek MT7663S (SDIO) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:2:config MT76x0_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:6:config MT76x0U\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-7-\ttristate \"MediaTek MT76x0U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:19:config MT76x0E\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-20-\ttristate \"MediaTek MT76x0E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:2:config MT76x2_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:6:config MT76x2E\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-7-\ttristate \"MediaTek MT76x2E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-17-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:18:config MT76x2U\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-19-\ttristate \"MediaTek MT76x2U (USB) support\"\n" }
13/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25239 output: 45 thoughts: 69 Thoughts: USB Support for MT76: A Quick Mental Checklist Okay, so I'm thinking about USB support for MT76-based devices. Let me quickly run through the relevant configurations in my head... I know we've got a few of them that are pretty common: MT7663U, MT76x0U, and MT76x2U. Those are definitely key. Hold on... I'm pretty sure there's an MT7921U variant as well, right? Let me just double-check that. I need to make sure I'm not missing anything crucial there. Time to pull up the `mt7921/Kconfig` file in my mental repository and verify that I'm including everything I should be!
14/2	2026/06/25 01:02	tool	grepper	0m Args: { "Expression": "config MT7921", "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7921/" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/mt7921/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:2:config MT7921_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-6-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:7:config MT7921E\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-8-\ttristate \"MediaTek MT7921E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-16-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:17:config MT7921S\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-18-\ttristate \"MediaTek MT7921S (SDIO) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:28:config MT7921U\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-29-\ttristate \"MediaTek MT7921U (USB) support\"\n" }
15/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25945 output: 38 thoughts: 807 Thoughts: Fuzzing the MT76 USB Drivers Okay, so we need to get these MT76 USB drivers ready for fuzzing. I've identified the relevant configurations: `MT7663U`, `MT76x0U`, `MT76x2U`, and `MT7921U`. My initial thought is to enable these configurations to ensure their USB drivers are built and accessible for fuzzing. Let's make sure those are selected, ah yes, `MT76_USB` is selected by these. Also, those select `MT76_CORE` and `MT76_USB` - good, good. I should probably add `MAC80211`, even though it is already enabled, to the list in case we need it, but the others are the ones we really want. The primary function we need to focus our fuzzing efforts on appears to be `__mt76_set_channel`, since that is the modified function. I should also include `mt76_set_channel` in our fuzzing targets, as well. Also, let's add `mt76_update_channel`, `mt76_scan_work`, `mt76_scan_complete`, `mt76_remain_on_channel`, `mt76_roc_complete`, and `mt76_phy_update_channel` to that list, because they are related. Yep, `__mt76_set_channel` is the one modified, so let's mark `__mt76_set_channel` and `mt76_set_channel` as our primary `FocusSymbols`. Let's quickly review the patch again... right, so the change is adding a timeout check to the `wait_event_timeout` call in `__mt76_set_channel`. If the timeout expires, it now exits early, whereas before it would have continued. This prevents a potential hang or issue if the TX isn't clear in time. This is definitely a functional change and absolutely warrants fuzzing. I'll quickly double-check to make sure there aren't any other relevant USB configurations for MT76 we should be aware of.
16/2	2026/06/25 01:02	tool	grepper	0m Args: { "Expression": "config MT.U$", "PathPrefix": "drivers/net/wireless/mediatek/mt76/" } Results:* { "Output": "drivers/net/wireless/mediatek/mt76/Kconfig=36=config MT792x_USB\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-39-\ndrivers/net/wireless/mediatek/mt76/Kconfig:40:config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\tbool\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig=32=config MT7663_USB_SDIO_COMMON\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:36:config MT7663U\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-37-\ttristate \"MediaTek MT7663U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig=2=config MT76x0_COMMON\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:6:config MT76x0U\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-7-\ttristate \"MediaTek MT76x0U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig=6=config MT76x2E\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-17-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:18:config MT76x2U\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-19-\ttristate \"MediaTek MT76x2U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig=17=config MT7921S\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:28:config MT7921U\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-29-\ttristate \"MediaTek MT7921U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig=7=config MT7925E\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:19:config MT7925U\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-20-\ttristate \"MediaTek MT7925U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig=2=config MT7996E\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:16:config MT7996_NPU\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-17-\tbool \"MT7996 (PCIe) NPU support\"\n" }
17/2	2026/06/25 01:02	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28215 output: 39 thoughts: 245 Thoughts: Analyzing USB Wi-Fi Driver Configurations Okay, so I see `MT7925U` is also in the mix. Right, I need to make a note of which configurations I need to enable. Based on the presence of this chip, it seems the relevant configurations are: `MT7663U`, `MT76x0U`, `MT76x2U`, `MT7921U`, and now, `MT7925U`. Hmm, hold on. Isn't `MT76_USB` a common configuration for these drivers? Perhaps I can simplify things by just enabling that instead of listing them all individually? Let's check. First, I need to see if `MT76_USB` can be enabled directly, or if it's dependent. I'll check the `Kconfig` file in `drivers/net/wireless/mediatek/mt76/Kconfig`. Ah, here it is: ``` config MT76_USB tristate ``` Okay, so it's a tristate config, but there's no visible prompt. That means it can't be enabled directly through the user interface. It's only selected by the specific driver configs. So, it looks like I need to stick with listing the individual drivers, specifically: `MT7663U`, `MT76x0U`, `MT76x2U`, `MT7921U`, and finally, `MT7925U`. Just to be absolutely sure, let me double check again to make sure that `MT76_USB` doesn't have a prompt.
18/2	2026/06/25 01:03	tool	grepper	0m Args: { "Expression": "config MT76_USB", "PathPrefix": "drivers/net/wireless/mediatek/mt76/" } Results: { "Output": "drivers/net/wireless/mediatek/mt76/Kconfig=6=config MT76_LEDS\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\n" }
19/2	2026/06/25 01:03	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28974 output: 198 thoughts: 355 Thoughts: Analyzing the MT76 USB Driver Changes Okay, here's what I've got. No specific prompt, just diving in. First, I need to confirm the relevant USB drivers within MT76. Looks like `MT76x02_USB` and `MT792x_USB` are the ones to consider, no specific prompts attached to them either. So, the key configs I'm looking at are: `MT7663U`, `MT76x0U`, `MT76x2U`, `MT7921U`, and `MT7925U`. That’s my working list. The critical symbols I'm focusing on here are `__mt76_set_channel` and `mt76_set_channel`. The core of this patch seems to be adding a timeout check within `__mt76_set_channel` using `wait_event_timeout`. This prevents the system from hanging if TX operations are still pending when the channel is being changed, which is a functional improvement in the MT76 mac80211 driver. This is definitely reachable in virtualized environments. Given these are USB devices, and based on the MT76 series, I am confident this would work with `dummy_hcd` and `nl80211` commands. Now, let me just quickly double-check `__mt76_set_channel` to make sure it's not a performance bottleneck. Based on my understanding, it's used during channel changes, updates, and staying on channel for scanning and off-channel operations. These are control path functions, not data path operations like TX/RX. So, addressing potential timeouts here is completely appropriate. It’s not something that’s likely to be invoked constantly. Alright, I am ready to call `set-results`.
20/2	2026/06/25 01:03	tool	set-results	0m Args: { "EnableConfigs": [ "MT7663U", "MT76x0U", "MT76x2U", "MT7921U", "MT7925U" ], "FocusSymbols": [ "__mt76_set_channel", "mt76_set_channel" ], "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "MT7663U", "MT76x0U", "MT76x2U", "MT7921U", "MT7925U" ], "FocusSymbols": [ "__mt76_set_channel", "mt76_set_channel" ], "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.", "WorthFuzzing": true }

{
  "EnableConfigs": [
    "MT7663U",
    "MT76x0U",
    "MT76x2U",
    "MT7921U",
    "MT7925U"
  ],
  "FocusSymbols": [
    "__mt76_set_channel",
    "mt76_set_channel"
  ],
  "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit 21186e7823b92420f70763ccd108d4067224aaa5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jun 25 01:02:15 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c\nindex 13c4e8abe28191..37474d64cfecdb 100644\n--- a/drivers/net/wireless/mediatek/mt76/mac80211.c\n+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c\n@@ -1033,6 +1033,7 @@ int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\n \t\t       bool offchannel)\n {\n \tstruct mt76_dev *dev = phy-\u003edev;\n+\tlong time_left;\n \tint timeout = HZ / 5;\n \tint ret;\n \n@@ -1040,8 +1041,13 @@ int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\n \tmt76_txq_schedule_pending(phy);\n \n \tset_bit(MT76_RESET, \u0026phy-\u003estate);\n-\twait_event_timeout(dev-\u003etx_wait, !mt76_has_tx_pending(phy), timeout);\n+\ttime_left = wait_event_timeout(dev-\u003etx_wait, !mt76_has_tx_pending(phy),\n+\t\t\t\t       timeout);\n \tmt76_update_survey(phy);\n+\tif (!time_left) {\n+\t\tret = -ETIMEDOUT;\n+\t\tgoto out;\n+\t}\n \n \tif (phy-\u003echandef.chan-\u003ecenter_freq != chandef-\u003echan-\u003ecenter_freq ||\n \t    phy-\u003echandef.width != chandef-\u003ewidth)\n@@ -1059,6 +1065,7 @@ int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\n \n \tret = dev-\u003edrv-\u003eset_channel(phy);\n \n+out:\n \tclear_bit(MT76_RESET, \u0026phy-\u003estate);\n \tmt76_worker_enable(\u0026dev-\u003etx_worker);\n \tmt76_worker_schedule(\u0026dev-\u003etx_worker);\n"
}

gemini-3.1-pro-preview

{
  "EnableConfigs": [
    "MT7663U",
    "MT76x0U",
    "MT76x2U",
    "MT7921U",
    "MT7925U"
  ],
  "FocusSymbols": [
    "__mt76_set_channel",
    "mt76_set_channel"
  ],
  "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 21186e7823b92420f70763ccd108d4067224aaa5
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jun 25 01:02:15 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 13c4e8abe28191..37474d64cfecdb 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -1033,6 +1033,7 @@ int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,
 		       bool offchannel)
 {
 	struct mt76_dev *dev = phy->dev;
+	long time_left;
 	int timeout = HZ / 5;
 	int ret;
 
@@ -1040,8 +1041,13 @@ int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,
 	mt76_txq_schedule_pending(phy);
 
 	set_bit(MT76_RESET, &phy->state);
-	wait_event_timeout(dev->tx_wait, !mt76_has_tx_pending(phy), timeout);
+	time_left = wait_event_timeout(dev->tx_wait, !mt76_has_tx_pending(phy),
+				       timeout);
 	mt76_update_survey(phy);
+	if (!time_left) {
+		ret = -ETIMEDOUT;
+		goto out;
+	}
 
 	if (phy->chandef.chan->center_freq != chandef->chan->center_freq ||
 	    phy->chandef.width != chandef->width)
@@ -1059,6 +1065,7 @@ int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,
 
 	ret = dev->drv->set_channel(phy);
 
+out:
 	clear_bit(MT76_RESET, &phy->state);
 	mt76_worker_enable(&dev->tx_worker);
 	mt76_worker_schedule(&dev->tx_worker);

gemini-3.1-pro-preview

							input: 2232
							output: 38
							thoughts: 309

**Analyzing the Reachability of a Timeout Patch**

Okay, so I'm looking at this patch for `drivers/net/wireless/mediatek/mt76/mac80211.c`. Specifically, it's modifying the `__mt76_set_channel` function, adding a timeout check within `wait_event_timeout`. If the timeout expires, it returns `-ETIMEDOUT` and jumps to the `out:` label. My initial thought is, can we even *reach* this code in our fuzzing environment?

Since it's a driver for Mediatek MT76 wireless devices, my experience immediately flags a potential issue. Typically, these hardware-specific drivers aren't easily accessible within virtualization environments like QEMU or GCE, unless we're dealing with software emulation or PCI passthrough. But `mac80211_hwsim` simulates *generic* mac80211 devices, not something as specific as an MT76 chip. Is there an MT76 emulator out there? Probably not.

So, the chances of this timeout code being directly exercised in our current fuzzing setup seem low. However, I can't be too sure without a double-check. I need to investigate if there's any kind of virtual or USB interface associated with MT76 that we *could* fuzz through USB gadget or something similar. Ah, yes, I recall MT76 does have USB drivers, namely `mt76x0u` and `mt76x2u`. That's a game-changer! USB devices open the door for fuzzing using `dummy_hcd` or syzkaller's USB fuzzing capabilities. Now I need to confirm whether these MT76 USB drivers are enabled, or at least if we could potentially use them for fuzzing.

{
  "Expression": "mt76.*usb",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 708 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Makefile=2=obj-$(CONFIG_MT76_CORE) += mt76.o\ndrivers/net/wireless/mediatek/mt76/Makefile:3:obj-$(CONFIG_MT76_USB) += mt76-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-4-obj-$(CONFIG_MT76_SDIO) += mt76-sdio.o\ndrivers/net/wireless/mediatek/mt76/Makefile=5=obj-$(CONFIG_MT76x02_LIB) += mt76x02-lib.o\ndrivers/net/wireless/mediatek/mt76/Makefile:6:obj-$(CONFIG_MT76x02_USB) += mt76x02-usb.o\ndrivers/net/wireless/mediatek/mt76/Makefile-7-obj-$(CONFIG_MT76_CONNAC_LIB) += mt76-connac-lib.o\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=17=mt76-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/mediatek/mt76/Makefile-18-\ndrivers/net/wireless/mediatek/mt76/Makefile:19:mt76-usb-y := usb.o usb_trace.o\ndrivers/net/wireless/mediatek/mt76/Makefile-20-mt76-sdio-y := sdio.o sdio_txrx.o\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=27=mt76x02-lib-y := mt76x02_util.o mt76x02_mac.o mt76x02_mcu.o \\\n--\ndrivers/net/wireless/mediatek/mt76/Makefile-31-\ndrivers/net/wireless/mediatek/mt76/Makefile:32:mt76x02-usb-y := mt76x02_usb_mcu.o mt76x02_usb_core.o\ndrivers/net/wireless/mediatek/mt76/Makefile-33-\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c=74=static int mt76_rx_queues_read(struct seq_file *s, void *data)\n--\ndrivers/net/wireless/mediatek/mt76/debugfs.c-82-\ndrivers/net/wireless/mediatek/mt76/debugfs.c:83:\t\tqueued = mt76_is_usb(dev) ? q-\u003endesc - q-\u003equeued : q-\u003equeued;\ndrivers/net/wireless/mediatek/mt76/debugfs.c-84-\t\tseq_printf(s, \" %9d | %9d | %9d | %9d |\\n\",\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=95=struct mt76_bus_ops {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-109-\ndrivers/net/wireless/mediatek/mt76/mt76.h:110:#define mt76_is_usb(dev) ((dev)-\u003ebus-\u003etype == MT76_BUS_USB)\ndrivers/net/wireless/mediatek/mt76/mt76.h-111-#define mt76_is_mmio(dev) ((dev)-\u003ebus-\u003etype == MT76_BUS_MMIO)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=649=struct mt76_mcu {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-662-#define MCU_RESP_URB_SIZE\t1024\ndrivers/net/wireless/mediatek/mt76/mt76.h:663:struct mt76_usb {\ndrivers/net/wireless/mediatek/mt76/mt76.h-664-\tstruct mutex usb_ctrl_mtx;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=921=struct mt76_dev {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1035-\t\tstruct mt76_mmio mmio;\ndrivers/net/wireless/mediatek/mt76/mt76.h:1036:\t\tstruct mt76_usb usb;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1037-\t\tstruct mt76_sdio sdio;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1838=mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1842-\tstruct usb_device *udev = interface_to_usbdev(uintf);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1843:\tstruct mt76_usb *usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76.h-1844-\tunsigned int pipe;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1868=void ___mt76u_wr(struct mt76_dev *dev, u8 req, u8 req_type,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1869-\t\t u32 addr, u32 val);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1870:int __mt76u_init(struct mt76_dev *dev, struct usb_interface *intf,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1871-\t\t struct mt76_bus_ops *ops);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1872:int mt76u_init(struct mt76_dev *dev, struct usb_interface *intf);\ndrivers/net/wireless/mediatek/mt76/mt76.h-1873-int mt76u_alloc_mcu_queue(struct mt76_dev *dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile=4=obj-$(CONFIG_MT7615E) += mt7615e.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:5:obj-$(CONFIG_MT7663_USB_SDIO_COMMON) += mt7663-usb-sdio-common.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-6-obj-$(CONFIG_MT7663U) += mt7663u.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile=16=mt7615e-$(CONFIG_MT7622_WMAC) += soc.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-17-\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:18:mt7663-usb-sdio-common-y := usb_sdio.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile:19:mt7663u-y := usb.o usb_mcu.o\ndrivers/net/wireless/mediatek/mt76/mt7615/Makefile-20-mt7663s-y := sdio.o sdio_mcu.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c=96=mt7615_pm_set(void *data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c:105:\tif (!mt7615_firmware_offload(dev) || mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7615/debugfs.c-106-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=355=extern const u32 mt7663e_reg_map[__MT_BASE_MAX];\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:356:extern const u32 mt7663_usb_sdio_reg_map[__MT_BASE_MAX];\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-357-extern struct pci_driver mt7615_pci_driver;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h=540=void mt7622_trigger_hif_int(struct mt7615_dev *dev, bool en);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-542-/* usb */\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:543:int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-544-\t\t\t\t   enum mt76_txq_id qid, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-546-\t\t\t\t   struct mt76_tx_info *tx_info);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:547:bool mt7663_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:548:void mt7663_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-549-\t\t\t\t     struct mt76_queue_entry *e);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h:550:int mt7663_usb_sdio_register_device(struct mt7615_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/mt7615.h-551-int mt7663u_mcu_init(struct mt7615_dev *dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c=76=static int mt7663s_probe(struct sdio_func *func,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-81-\t\t.drv_flags = MT_DRV_RX_DMA_HDR,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:82:\t\t.tx_prepare_skb = mt7663_usb_sdio_tx_prepare_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:83:\t\t.tx_complete_skb = mt7663_usb_sdio_tx_complete_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:84:\t\t.tx_status_data = mt7663_usb_sdio_tx_status_data,\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-85-\t\t.rx_skb = mt7615_queue_rx_skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-118-\tINIT_WORK(\u0026dev-\u003emcu_work, mt7663s_init_work);\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:119:\tdev-\u003ereg_map = mt7663_usb_sdio_reg_map;\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-120-\tdev-\u003eops = ops;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-158-\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c:159:\tret = mt7663_usb_sdio_register_device(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/sdio.c-160-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c=57=static void mt7663u_copy(struct mt76_dev *dev, u32 offset,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-59-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:60:\tstruct mt76_usb *usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-61-\tint ret, i = 0, batch_len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c=101=static void mt7663u_init_work(struct work_struct *work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-111-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:112:static int mt7663u_probe(struct usb_interface *usb_intf,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-113-\t\t\t const struct usb_device_id *id)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-117-\t\t.drv_flags = MT_DRV_RX_DMA_HDR | MT_DRV_HW_MGMT_TXQ,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:118:\t\t.tx_prepare_skb = mt7663_usb_sdio_tx_prepare_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:119:\t\t.tx_complete_skb = mt7663_usb_sdio_tx_complete_skb,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:120:\t\t.tx_status_data = mt7663_usb_sdio_tx_status_data,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-121-\t\t.rx_skb = mt7615_queue_rx_skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-148-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:149:\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(*dev), ops, \u0026drv_ops);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-150-\tif (!mdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-158-\tINIT_WORK(\u0026dev-\u003emcu_work, mt7663u_init_work);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:159:\tdev-\u003ereg_map = mt7663_usb_sdio_reg_map;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-160-\tdev-\u003eops = ops;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:161:\tret = __mt76u_init(mdev, usb_intf, \u0026bus_ops);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-162-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-185-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:186:\tret = mt7663_usb_sdio_register_device(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-187-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:201:static void mt7663u_disconnect(struct usb_interface *usb_intf)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-202-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:203:\tstruct mt7615_dev *dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-204-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-216-#ifdef CONFIG_PM\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:217:static int mt7663u_suspend(struct usb_interface *intf, pm_message_t state)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-218-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:219:\tstruct mt7615_dev *dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-220-\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-235-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:236:static int mt7663u_resume(struct usb_interface *intf)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-237-{\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c:238:\tstruct mt7615_dev *dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb.c-239-\tint err;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-16-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:17:const u32 mt7663_usb_sdio_reg_map[] = {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-18-\t[MT_TOP_CFG_BASE]\t= 0x80020000,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-40-};\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:41:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_reg_map);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-42-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c=43=static void\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:44:mt7663_usb_sdio_write_txwi(struct mt7615_dev *dev, struct mt76_wcid *wcid,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-45-\t\t\t   enum mt76_txq_id qid, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-55-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:56:static int mt7663_usb_sdio_set_rates(struct mt7615_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-57-\t\t\t\t     struct mt7615_wtbl_rate_desc *wrd)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-130-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:131:static void mt7663_usb_sdio_rate_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-132-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-148-\t\tmt7615_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:149:\t\tmt7663_usb_sdio_set_rates(dev, wrd);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-150-\t\tmt7615_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-155-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:156:bool mt7663_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-157-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-165-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:166:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_tx_status_data);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-167-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:168:void mt7663_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-169-\t\t\t\t     struct mt76_queue_entry *e)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-172-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:173:\tif (mt76_is_usb(mdev))\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-174-\t\theadroom += MT_USB_HDR_SIZE;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-178-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:179:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_tx_complete_skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-180-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:181:int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-182-\t\t\t\t   enum mt76_txq_id qid, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-206-\tpktid = mt76_tx_status_skb_add(\u0026dev-\u003emt76, wcid, skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:207:\tmt7663_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:208:\tif (mt76_is_usb(mdev)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-209-\t\tu32 len = skb-\u003elen;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-223-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:224:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_tx_prepare_skb);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-225-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c=226=static int mt7663u_dma_sched_init(struct mt7615_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-277-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:278:static int mt7663_usb_sdio_init_hardware(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-279-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-285-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:286:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-287-\t\tret = mt7663u_dma_sched_init(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-305-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:306:int mt7663_usb_sdio_register_device(struct mt7615_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-307-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-310-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:311:\tINIT_WORK(\u0026dev-\u003erate_work, mt7663_usb_sdio_rate_work);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-312-\tINIT_LIST_HEAD(\u0026dev-\u003ewrd_head);\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-314-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:315:\terr = mt7663_usb_sdio_init_hardware(dev);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-316-\tif (err)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-319-\thw-\u003eextra_tx_headroom += MT_USB_TXD_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:320:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-321-\t\thw-\u003eextra_tx_headroom += MT_USB_HDR_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-322-\t\t/* check hw sg support in order to enable AMSDU */\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:323:\t\tif (dev-\u003emt76.usb.sg_en)\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-324-\t\t\thw-\u003emax_tx_fragments = MT_HW_TXP_MAX_BUF_NUM;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-333-\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:334:\tif (!dev-\u003emt76.usb.sg_en) {\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-335-\t\tstruct ieee80211_sta_vht_cap *vht_cap;\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-347-}\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c:348:EXPORT_SYMBOL_GPL(mt7663_usb_sdio_register_device);\ndrivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c-349-\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c=36=int mt76_connac_pm_wake(struct mt76_phy *phy, struct mt76_connac_pm *pm)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-39-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c:40:\tif (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-41-\t\treturn 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c=62=void mt76_connac_power_save_sched(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-66-\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c:67:\tif (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mac.c-68-\t\treturn;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=2566=mt76_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2608-\t\treq.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:2609:\telse if (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2610-\t\treq.wow_ctrl_tlv.wakeup_hif = WOW_USB;\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c=2619=int mt76_connac_mcu_set_hif_suspend(struct mt76_dev *dev, bool suspend, bool wait_resp)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2644-\t\treq.hdr.hif_type = 2;\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:2645:\telse if (mt76_is_usb(dev))\ndrivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c-2646-\t\treq.hdr.hif_type = 1;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile=6=mt76x0-common-y := init.o main.o eeprom.o phy.o\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile:8:mt76x0u-y := usb.o usb_mcu.o\ndrivers/net/wireless/mediatek/mt76/mt76x0/Makefile-9-mt76x0e-y := pci.o pci_mcu.o\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c=103=mt76x0_rf_wr(struct mt76x02_dev *dev, u32 offset, u8 val)\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-104-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c:105:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-106-\t\tstruct mt76_reg_pair pair = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c=119=static int mt76x0_rf_rr(struct mt76x02_dev *dev, u32 offset)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-123-\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c:124:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-125-\t\tstruct mt76_reg_pair pair = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c=913=void mt76x0_phy_set_channel(struct mt76x02_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-970-\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c:971:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x0/phy.c-972-\t\tmt76x0_phy_bbp_set_bw(dev, chandef-\u003ewidth);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-11-#include \"mcu.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:12:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-13-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=14=static struct usb_device_id mt76x0_device_table[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-45-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:46:static void mt76x0_init_usb_dma(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-47-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=151=static int mt76x0u_init_hardware(struct mt76x02_dev *dev, bool reset)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-163-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:164:\tmt76x0_init_usb_dma(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-165-\terr = mt76x0_init_hardware(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c=179=static int mt76x0u_register_device(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-181-\tstruct ieee80211_hw *hw = dev-\u003emt76.hw;\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:182:\tstruct mt76_usb *usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-183-\tint err;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-198-\t/* check hw sg support in order to enable AMSDU */\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:199:\thw-\u003emax_tx_fragments = dev-\u003emt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1;\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-200-\terr = mt76x0_register_device(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-212-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:213:static int mt76x0u_probe(struct usb_interface *usb_intf,\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-214-\t\t\t const struct usb_device_id *id)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-235-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:236:\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(*dev), \u0026mt76x0u_ops,\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-237-\t\t\t\t \u0026drv_ops);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-252-\tmt76x02u_init_mcu(mdev);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:253:\tret = mt76u_init(mdev, usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-254-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-291-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:292:static void mt76x0_disconnect(struct usb_interface *usb_intf)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-293-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:294:\tstruct mt76x02_dev *dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-295-\tbool initialized = test_bit(MT76_STATE_INITIALIZED, \u0026dev-\u003emphy.state);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-307-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:308:static int __maybe_unused mt76x0_suspend(struct usb_interface *usb_intf,\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-309-\t\t\t\t\t pm_message_t state)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-310-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:311:\tstruct mt76x02_dev *dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-312-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-319-\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:320:static int __maybe_unused mt76x0_resume(struct usb_interface *usb_intf)\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-321-{\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c:322:\tstruct mt76x02_dev *dev = usb_get_intfdata(usb_intf);\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb.c-323-\tint ret;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c-10-#include \"mcu.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c:11:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x0/usb_mcu.c-12-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c=26=mt76x02_write_beacon(struct mt76x02_dev *dev, int offset, struct sk_buff *skb)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c-35-\t */\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c:36:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x02_beacon.c-37-\t\tstruct mt76x02_txwi *txwi;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c-5-\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c:6:#include \"mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c-7-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-10-#include \"mt76x02_mcu.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:11:#include \"mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-12-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c=21=mt76x02u_multiple_mcu_reads(struct mt76_dev *dev, u8 *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-22-{\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:23:\tstruct mt76_usb *usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-24-\tint i;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c=37=static int mt76x02u_mcu_wait_resp(struct mt76_dev *dev, u8 seq)\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-38-{\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:39:\tstruct mt76_usb *usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-40-\tu8 *data = usb-\u003emcu.data;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c=166=mt76x02u_mcu_rd_rp(struct mt76_dev *dev, u32 base,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-170-\tconst int max_vals_per_cmd = MT_INBAND_PACKET_MAX_LEN / 8;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c:171:\tstruct mt76_usb *usb = \u0026dev-\u003eusb;\ndrivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c-172-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c=140=int mt76x02_init_device(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-152-\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c:153:\tif (mt76_is_usb(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-154-\t\thw-\u003eextra_tx_headroom += sizeof(struct mt76x02_txwi) +\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c=406=int mt76x02_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-443-\t */\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c:444:\tif (mt76_is_usb(\u0026dev-\u003emt76) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76x02_util.c-445-\t    vif-\u003etype == NL80211_IFTYPE_AP \u0026\u0026\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-8-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:9:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-10-#include \"mt76x2u.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c=12=static const struct usb_device_id mt76x2u_device_table[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-31-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:32:static int mt76x2u_probe(struct usb_interface *intf,\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-33-\t\t\t const struct usb_device_id *id)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-90-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:91:static void mt76x2u_disconnect(struct usb_interface *intf)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-92-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:93:\tstruct mt76x02_dev *dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-94-\tstruct ieee80211_hw *hw = mt76_hw(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-102-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:103:static int __maybe_unused mt76x2u_suspend(struct usb_interface *intf,\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-104-\t\t\t\t\t  pm_message_t state)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-105-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:106:\tstruct mt76x02_dev *dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-107-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-112-\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:113:static int __maybe_unused mt76x2u_resume(struct usb_interface *intf)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-114-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c:115:\tstruct mt76x02_dev *dev = usb_get_intfdata(intf);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb.c-116-\tint err;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-10-#include \"../mt76x02_phy.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c:11:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-12-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c=190=int mt76x2u_register_device(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-192-\tstruct ieee80211_hw *hw = mt76_hw(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c:193:\tstruct mt76_usb *usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-194-\tbool vht;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-219-\t/* check hw sg support in order to enable AMSDU */\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c:220:\thw-\u003emax_tx_fragments = dev-\u003emt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c-221-\tswitch (dev-\u003emt76.rev) {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c-6-#include \"mt76x2u.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c:7:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c-8-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-9-#include \"eeprom.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c:10:#include \"../mt76x02_usb.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-11-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c=28=static void mt76x2u_mcu_enable_patch(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-29-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c:30:\tstruct mt76_usb *usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-31-\tstatic const u8 data[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c=43=static void mt76x2u_mcu_reset_wmt(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-44-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c:45:\tstruct mt76_usb *usb = \u0026dev-\u003emt76.usb;\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_mcu.c-46-\tu8 data[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=143=mt7921_pm_set(void *data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-147-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:148:\tif (mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-149-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c=188=mt7921_deep_sleep_set(void *data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-194-\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c:195:\tif (mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7921/debugfs.c-196-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c=170=int mt7921_register_device(struct mt792x_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-209-\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c:210:\tif (!mt76_is_usb(\u0026dev-\u003emt76) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7921/init.c-211-\t    !is_mt7902(\u0026dev-\u003emt76)) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=655=void mt7921_mac_reset_work(struct work_struct *work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-680-\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:681:\tif ((mt76_is_sdio(\u0026dev-\u003emt76) || mt76_is_usb(\u0026dev-\u003emt76)) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-682-\t    atomic_read(\u0026dev-\u003emt76.bus_hung))\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c=769=int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-804-\tpad = round_up(skb-\u003elen, 4) - skb-\u003elen;\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c:805:\tif (mt76_is_usb(mdev))\ndrivers/net/wireless/mediatek/mt76/mt7921/mac.c-806-\t\tpad += 4;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c=13=bool mt7921_regd_clc_supported(struct mt792x_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c-15-\tif (mt7921_disable_clc ||\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c:16:\t    mt76_is_usb(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7921/regd.c-17-\t\treturn false;\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c=150=static int mt7921u_probe(struct usb_interface *usb_intf,\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-197-\tops-\u003estop = mt792xu_stop;\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:198:\tmdev = mt76_alloc_device(\u0026usb_intf-\u003edev, sizeof(*dev), ops, \u0026drv_ops);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-199-\tif (!mdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-211-\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c:212:\tret = __mt76u_init(mdev, usb_intf, \u0026bus_ops);\ndrivers/net/wireless/mediatek/mt76/mt7921/usb.c-213-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=182=mt7925_pm_set(void *data, u64 val)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-186-\n\n"
}

gemini-3.1-pro-preview

							input: 19204
							output: 49
							thoughts: 183

**Fuzzing the MT76 USB Driver**

Okay, so the MT76 driver family has USB support – that's a key piece of information. Specifically, it supports a range of USB variants: `mt76-usb`, `mt76x02-usb`, `mt7615-usb`, the whole lot. This is brilliant because it means we can fuzz it using a USB gadget setup!

Now, the main target for modification is the `__mt76_set_channel` function, and I know it resides within the `drivers/net/wireless/mediatek/mt76/mac80211.c` file. Next, I need to confirm if that function is accessible. I suspect it's likely a mac80211 callback, something along the lines of `set_channel`. Let's confirm that by checking `mac80211.c` for calls to `__mt76_set_channel`.

{
  "Expression": "__mt76_set_channel",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mac80211.c"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mac80211.c=1030=EXPORT_SYMBOL_GPL(mt76_update_survey);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1031-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1032:int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1033-\t\t       bool offchannel)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1076=int mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1084-\tmutex_lock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1085:\tret = __mt76_set_channel(phy, chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1086-\tmutex_unlock(\u0026dev-\u003emutex);\n"
}

gemini-3.1-pro-preview

							input: 20014
							output: 40
							thoughts: 40

Here's a summary of my thought process:

**Tracing the Call Chain of `mt76_set_channel`**

Okay, so I'm looking at `__mt76_set_channel`, which is pretty clearly a low-level function related to channel configuration within the mt76 wireless driver. My instinct is to trace back the call stack. Specifically, I'm noting that `__mt76_set_channel` is called by `mt76_set_channel`. Now, let's see where *that* function, `mt76_set_channel`, is actually *used*. I need to understand the higher-level context, the initiating function calls, and the typical flow to have any idea how to debug or modify it. That will provide a critical clue about the control flow.

{
  "Expression": "mt76_set_channel",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/channel.c=22=mt76_phy_update_channel(struct mt76_phy *phy,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-28-\ndrivers/net/wireless/mediatek/mt76/channel.c:29:\treturn __mt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/channel.c-30-}\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=313=void mt76_roc_complete(struct mt76_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-324-\t    !test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)) {\ndrivers/net/wireless/mediatek/mt76/channel.c:325:\t\t__mt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/channel.c-326-\t\tmt76_offchannel_notify(phy, false);\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=357=int mt76_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-394-\t\tmt76_offchannel_notify(phy, true);\ndrivers/net/wireless/mediatek/mt76/channel.c:395:\tret = __mt76_set_channel(phy, \u0026chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/channel.c-396-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1030=EXPORT_SYMBOL_GPL(mt76_update_survey);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1031-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1032:int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1033-\t\t       bool offchannel)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1075-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1076:int mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1077-\t\t     bool offchannel)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1084-\tmutex_lock(\u0026dev-\u003emutex);\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1085:\tret = __mt76_set_channel(phy, chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1086-\tmutex_unlock(\u0026dev-\u003emutex);\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c=1091=int mt76_update_channel(struct mt76_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1098-\ndrivers/net/wireless/mediatek/mt76/mac80211.c:1099:\treturn mt76_set_channel(phy, chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/mac80211.c-1100-}\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1799=void mt76_queue_tx_complete(struct mt76_dev *dev, struct mt76_queue *q,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1800-\t\t\t    struct mt76_queue_entry *e);\ndrivers/net/wireless/mediatek/mt76/mt76.h:1801:int __mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1802-\t\t       bool offchannel);\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1805=mt76_offchannel_chandef(struct mt76_phy *phy, struct ieee80211_channel *chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1814-}\ndrivers/net/wireless/mediatek/mt76/mt76.h:1815:int mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1816-\t\t     bool offchannel);\n--\ndrivers/net/wireless/mediatek/mt76/scan.c=7=static void mt76_scan_complete(struct mt76_dev *dev, bool abort)\n--\ndrivers/net/wireless/mediatek/mt76/scan.c-20-\t    !test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state)) {\ndrivers/net/wireless/mediatek/mt76/scan.c:21:\t\tmt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/scan.c-22-\t\tmt76_offchannel_notify(phy, false);\n--\ndrivers/net/wireless/mediatek/mt76/scan.c=107=void mt76_scan_work(struct work_struct *work)\n--\ndrivers/net/wireless/mediatek/mt76/scan.c-135-\t\tdev-\u003escan.chan = NULL;\ndrivers/net/wireless/mediatek/mt76/scan.c:136:\t\tmt76_set_channel(phy, \u0026phy-\u003emain_chandef, false);\ndrivers/net/wireless/mediatek/mt76/scan.c-137-\t\tmt76_offchannel_notify(phy, false);\n--\ndrivers/net/wireless/mediatek/mt76/scan.c-145-\t\tmt76_offchannel_notify(phy, true);\ndrivers/net/wireless/mediatek/mt76/scan.c:146:\tmt76_set_channel(phy, \u0026chandef, offchannel);\ndrivers/net/wireless/mediatek/mt76/scan.c-147-\n"
}

gemini-3.1-pro-preview

							input: 22097
							output: 39
							thoughts: 180

**Analyzing MT76 Channel Setting Functions for Testability**

Okay, so I'm looking at how the `mt76_set_channel` and `__mt76_set_channel` functions are used in the MT76 wireless driver. It seems pretty straightforward; they're called in response to the usual mac80211 events: scanning (`mt76_scan_work`, `mt76_scan_complete`), channel updates (`mt76_update_channel`), and also things like remaining on a specific channel (`mt76_remain_on_channel`), ROC completion (`mt76_roc_complete`), and direct PHY channel updates (`mt76_phy_update_channel`). That's all standard operating procedure for a mac80211-compliant driver, nothing particularly out of the ordinary here.

The interesting part, from a testing perspective, is that MT76 has USB support. That means we can potentially leverage `dummy_hcd` within syzkaller to emulate a USB device and then trigger these mac80211 operations, particularly via `nl80211`. That would give us a completely virtualized environment to thoroughly test all those channel setting and management functions. Given that they are used in so many different functions within the driver, it should be quite reachable.

Right, so to make this happen, the next logical step is to figure out which kernel configuration options are required to enable those MT76 USB drivers in the first place. That'll be the starting point.

{
  "Expression": "config MT76.*USB",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/Kconfig=6=config MT76_LEDS\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig=20=config MT76x02_LIB\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-23-\ndrivers/net/wireless/mediatek/mt76/Kconfig:24:config MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-25-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig=21=config MT7622_WMAC\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:32:config MT7663_USB_SDIO_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-33-\ttristate\n"
}

gemini-3.1-pro-preview

							input: 22993
							output: 37
							thoughts: 57

Here's my analysis of the situation:

**Investigating MT76 Driver Configuration**

Okay, so I need to figure out the exact configuration options that activate these MT76 wireless drivers. I'm going to dive right into the `Kconfig` files for the Mediatek wireless drivers. Specifically, I'll be starting with `drivers/net/wireless/mediatek/mt76/Kconfig`, and then branch out to look at the more specific `mt76x0` directory's `Kconfig` file and others like it. This should give me the ground truth of what flags need to be set to include these MT76-based drivers in a kernel build. I expect to find some interesting dependencies and potentially platform-specific configurations in these files as well.

{
  "Expression": "config MT76",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/Kconfig:2:config MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/Kconfig:6:config MT76_LEDS\ndrivers/net/wireless/mediatek/mt76/Kconfig-7-\tbool\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/Kconfig:16:config MT76_SDIO\ndrivers/net/wireless/mediatek/mt76/Kconfig-17-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-19-\ndrivers/net/wireless/mediatek/mt76/Kconfig:20:config MT76x02_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-21-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-23-\ndrivers/net/wireless/mediatek/mt76/Kconfig:24:config MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-25-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/Kconfig:28:config MT76_CONNAC_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-29-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig=36=config MT792x_USB\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-39-\ndrivers/net/wireless/mediatek/mt76/Kconfig:40:config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\tbool\n--\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig:2:config MT7603E\ndrivers/net/wireless/mediatek/mt76/mt7603/Kconfig-3-\ttristate \"MediaTek MT7603E (PCIe) and MT76x8 WLAN support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-2-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:3:config MT7615_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-4-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-7-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:8:config MT7615E\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-9-\ttristate \"MediaTek MT7615E and MT7663E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-20-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:21:config MT7622_WMAC\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-22-\tbool \"MT7622 (SoC) WMAC support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:32:config MT7663_USB_SDIO_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-33-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:36:config MT7663U\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-37-\ttristate \"MediaTek MT7663U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-46-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:47:config MT7663S\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-48-\ttristate \"MediaTek MT7663S (SDIO) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:2:config MT76x0_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:6:config MT76x0U\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-7-\ttristate \"MediaTek MT76x0U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:19:config MT76x0E\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-20-\ttristate \"MediaTek MT76x0E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:2:config MT76x2_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:6:config MT76x2E\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-7-\ttristate \"MediaTek MT76x2E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-17-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:18:config MT76x2U\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-19-\ttristate \"MediaTek MT76x2U (USB) support\"\n"
}

gemini-3.1-pro-preview

							input: 25239
							output: 45
							thoughts: 69

**USB Support for MT76: A Quick Mental Checklist**

Okay, so I'm thinking about USB support for MT76-based devices. Let me quickly run through the relevant configurations in my head... I know we've got a few of them that are pretty common: MT7663U, MT76x0U, and MT76x2U. Those are definitely key.

Hold on... I'm pretty sure there's an MT7921U variant as well, right? Let me just double-check that. I need to make sure I'm not missing anything crucial there. Time to pull up the `mt7921/Kconfig` file in my mental repository and verify that I'm including everything I should be!

{
  "Expression": "config MT7921",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7921/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7921/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:2:config MT7921_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-6-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:7:config MT7921E\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-8-\ttristate \"MediaTek MT7921E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-16-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:17:config MT7921S\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-18-\ttristate \"MediaTek MT7921S (SDIO) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:28:config MT7921U\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-29-\ttristate \"MediaTek MT7921U (USB) support\"\n"
}

gemini-3.1-pro-preview

							input: 25945
							output: 38
							thoughts: 807

**Fuzzing the MT76 USB Drivers**

Okay, so we need to get these MT76 USB drivers ready for fuzzing. I've identified the relevant configurations: `MT7663U`, `MT76x0U`, `MT76x2U`, and `MT7921U`. My initial thought is to enable these configurations to ensure their USB drivers are built and accessible for fuzzing. Let's make sure those are selected, ah yes, `MT76_USB` is selected by these. Also, those select `MT76_CORE` and `MT76_USB` - good, good. I should probably add `MAC80211`, even though it is already enabled, to the list in case we need it, but the others are the ones we really want.

The primary function we need to focus our fuzzing efforts on appears to be `__mt76_set_channel`, since that is the modified function. I should also include `mt76_set_channel` in our fuzzing targets, as well. Also, let's add `mt76_update_channel`, `mt76_scan_work`, `mt76_scan_complete`, `mt76_remain_on_channel`, `mt76_roc_complete`, and `mt76_phy_update_channel` to that list, because they are related. Yep, `__mt76_set_channel` is the one modified, so let's mark `__mt76_set_channel` and `mt76_set_channel` as our primary `FocusSymbols`.

Let's quickly review the patch again... right, so the change is adding a timeout check to the `wait_event_timeout` call in `__mt76_set_channel`. If the timeout expires, it now exits early, whereas before it would have continued. This prevents a potential hang or issue if the TX isn't clear in time. This is definitely a functional change and absolutely warrants fuzzing.

I'll quickly double-check to make sure there aren't any other relevant USB configurations for MT76 we should be aware of.

{
  "Expression": "config MT.*U$",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/Kconfig=36=config MT792x_USB\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-39-\ndrivers/net/wireless/mediatek/mt76/Kconfig:40:config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\tbool\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig=32=config MT7663_USB_SDIO_COMMON\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig:36:config MT7663U\ndrivers/net/wireless/mediatek/mt76/mt7615/Kconfig-37-\ttristate \"MediaTek MT7663U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig=2=config MT76x0_COMMON\n--\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig:6:config MT76x0U\ndrivers/net/wireless/mediatek/mt76/mt76x0/Kconfig-7-\ttristate \"MediaTek MT76x0U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig=6=config MT76x2E\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-17-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:18:config MT76x2U\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig-19-\ttristate \"MediaTek MT76x2U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig=17=config MT7921S\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig:28:config MT7921U\ndrivers/net/wireless/mediatek/mt76/mt7921/Kconfig-29-\ttristate \"MediaTek MT7921U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig=7=config MT7925E\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:19:config MT7925U\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-20-\ttristate \"MediaTek MT7925U (USB) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig=2=config MT7996E\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:16:config MT7996_NPU\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-17-\tbool \"MT7996 (PCIe) NPU support\"\n"
}

gemini-3.1-pro-preview

							input: 28215
							output: 39
							thoughts: 245

**Analyzing USB Wi-Fi Driver Configurations**

Okay, so I see `MT7925U` is also in the mix. Right, I need to make a note of which configurations I need to enable. Based on the presence of this chip, it seems the relevant configurations are: `MT7663U`, `MT76x0U`, `MT76x2U`, `MT7921U`, and now, `MT7925U`.

Hmm, hold on. Isn't `MT76_USB` a common configuration for these drivers? Perhaps I can simplify things by just enabling that instead of listing them all individually? Let's check. First, I need to see if `MT76_USB` can be enabled directly, or if it's dependent.

I'll check the `Kconfig` file in `drivers/net/wireless/mediatek/mt76/Kconfig`. Ah, here it is:
```
config MT76_USB
	tristate
```
Okay, so it's a *tristate* config, but there's no visible prompt. That means it can't be enabled directly through the user interface. It's only *selected* by the specific driver configs. So, it looks like I need to stick with listing the individual drivers, specifically: `MT7663U`, `MT76x0U`, `MT76x2U`, `MT7921U`, and finally, `MT7925U`.

Just to be absolutely sure, let me double check again to make sure that `MT76_USB` doesn't have a prompt.

{
  "Expression": "config MT76_USB",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/Kconfig=6=config MT76_LEDS\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\n"
}

gemini-3.1-pro-preview

							input: 28974
							output: 198
							thoughts: 355

**Analyzing the MT76 USB Driver Changes**

Okay, here's what I've got. No specific prompt, just diving in. First, I need to confirm the relevant USB drivers within MT76. Looks like `MT76x02_USB` and `MT792x_USB` are the ones to consider, no specific prompts attached to them either.

So, the key configs I'm looking at are: `MT7663U`, `MT76x0U`, `MT76x2U`, `MT7921U`, and `MT7925U`. That’s my working list.

The critical symbols I'm focusing on here are `__mt76_set_channel` and `mt76_set_channel`.

The core of this patch seems to be adding a timeout check within `__mt76_set_channel` using `wait_event_timeout`. This prevents the system from hanging if TX operations are still pending when the channel is being changed, which is a functional improvement in the MT76 mac80211 driver. This is definitely reachable in virtualized environments. Given these are USB devices, and based on the MT76 series, I am confident this would work with `dummy_hcd` and `nl80211` commands.

Now, let me just quickly double-check `__mt76_set_channel` to make sure it's not a performance bottleneck. Based on my understanding, it's used during channel changes, updates, and staying on channel for scanning and off-channel operations. These are control path functions, not data path operations like TX/RX. So, addressing potential timeouts here is completely appropriate. It’s not something that’s likely to be invoked constantly.

Alright, I am ready to call `set-results`.

{
  "EnableConfigs": [
    "MT7663U",
    "MT76x0U",
    "MT76x2U",
    "MT7921U",
    "MT7925U"
  ],
  "FocusSymbols": [
    "__mt76_set_channel",
    "mt76_set_channel"
  ],
  "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MT7663U",
    "MT76x0U",
    "MT76x2U",
    "MT7921U",
    "MT7925U"
  ],
  "FocusSymbols": [
    "__mt76_set_channel",
    "mt76_set_channel"
  ],
  "Reasoning": "The patch adds a timeout check to wait_event_timeout in __mt76_set_channel to prevent proceeding when TX is still pending and the wait times out. This is a functional change in the MT76 mac80211 driver. The code is reachable in virtualized environments via the USB interface of MT76 devices (e.g., MT76x0U, MT76x2U) using dummy_hcd and nl80211 commands.",
  "WorthFuzzing": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)