AI Trajectory

null

{
  "EnableConfigs": [
    "MT7925U",
    "MT7925E"
  ],
  "FocusSymbols": [
    "mt7925_sta_pre_rcu_remove"
  ],
  "Reasoning": "The patch adds functional logic for RCU removal of stations in the MT7925 wireless driver, including handling for Multi-Link Devices (MLD). The driver has a USB variant (mt7925u) which can be fuzzed via USB emulation (dummy HCD).",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 3ab6414d7333d0d403ca6e09fa0c319cfffacd5a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Jun 30 13:03:21 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c\nindex 73d3722739d0a8..e3fb6392eda24a 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c\n@@ -2410,6 +2410,40 @@ static void mt7925_channel_switch_rx_beacon(struct ieee80211_hw *hw,\n \t}\n }\n \n+static void mt7925_sta_pre_rcu_remove(struct ieee80211_hw *hw,\n+\t\t\t\t      struct ieee80211_vif *vif,\n+\t\t\t\t      struct ieee80211_sta *sta)\n+{\n+\tstruct mt76_phy *phy = hw-\u003epriv;\n+\tstruct mt76_dev *dev = phy-\u003edev;\n+\tstruct mt76_wcid *wcid = (struct mt76_wcid *)sta-\u003edrv_priv;\n+\n+\tmutex_lock(\u0026dev-\u003emutex);\n+\tspin_lock_bh(\u0026dev-\u003estatus_lock);\n+\n+\tif (ieee80211_vif_is_mld(vif)) {\n+\t\tstruct mt792x_sta *msta = (struct mt792x_sta *)sta-\u003edrv_priv;\n+\t\tstruct mt792x_vif *mvif = (struct mt792x_vif *)vif-\u003edrv_priv;\n+\t\tunsigned long valid = mvif-\u003evalid_links;\n+\t\tstruct mt792x_link_sta *mlink;\n+\t\tunsigned int link_id;\n+\n+\t\tfor_each_set_bit(link_id, \u0026valid, IEEE80211_MLD_MAX_NUM_LINKS) {\n+\t\t\tmlink = mt792x_sta_to_link(msta, link_id);\n+\t\t\tif (!mlink || !mlink-\u003ewcid.sta)\n+\t\t\t\tcontinue;\n+\t\t\tif (mlink-\u003ewcid.idx \u003c ARRAY_SIZE(dev-\u003ewcid))\n+\t\t\t\trcu_assign_pointer(dev-\u003ewcid[mlink-\u003ewcid.idx],\n+\t\t\t\t\t\t   NULL);\n+\t\t}\n+\t} else {\n+\t\trcu_assign_pointer(dev-\u003ewcid[wcid-\u003eidx], NULL);\n+\t}\n+\n+\tspin_unlock_bh(\u0026dev-\u003estatus_lock);\n+\tmutex_unlock(\u0026dev-\u003emutex);\n+}\n+\n const struct ieee80211_ops mt7925_ops = {\n \t.tx = mt792x_tx,\n \t.start = mt7925_start,\n@@ -2422,7 +2456,7 @@ const struct ieee80211_ops mt7925_ops = {\n \t.start_ap = mt7925_start_ap,\n \t.stop_ap = mt7925_stop_ap,\n \t.sta_state = mt76_sta_state,\n-\t.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,\n+\t.sta_pre_rcu_remove = mt7925_sta_pre_rcu_remove,\n \t.set_key = mt7925_set_key,\n \t.sta_set_decap_offload = mt7925_sta_set_decap_offload,\n #if IS_ENABLED(CONFIG_IPV6)\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "MT7925U",
    "MT7925E"
  ],
  "FocusSymbols": [
    "mt7925_sta_pre_rcu_remove"
  ],
  "Reasoning": "The patch adds functional logic for RCU removal of stations in the MT7925 wireless driver, including handling for Multi-Link Devices (MLD). The driver has a USB variant (mt7925u) which can be fuzzed via USB emulation (dummy HCD).",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 3ab6414d7333d0d403ca6e09fa0c319cfffacd5a
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Jun 30 13:03:21 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 73d3722739d0a8..e3fb6392eda24a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2410,6 +2410,40 @@ static void mt7925_channel_switch_rx_beacon(struct ieee80211_hw *hw,
 	}
 }
 
+static void mt7925_sta_pre_rcu_remove(struct ieee80211_hw *hw,
+				      struct ieee80211_vif *vif,
+				      struct ieee80211_sta *sta)
+{
+	struct mt76_phy *phy = hw->priv;
+	struct mt76_dev *dev = phy->dev;
+	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
+
+	mutex_lock(&dev->mutex);
+	spin_lock_bh(&dev->status_lock);
+
+	if (ieee80211_vif_is_mld(vif)) {
+		struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
+		struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+		unsigned long valid = mvif->valid_links;
+		struct mt792x_link_sta *mlink;
+		unsigned int link_id;
+
+		for_each_set_bit(link_id, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
+			mlink = mt792x_sta_to_link(msta, link_id);
+			if (!mlink || !mlink->wcid.sta)
+				continue;
+			if (mlink->wcid.idx < ARRAY_SIZE(dev->wcid))
+				rcu_assign_pointer(dev->wcid[mlink->wcid.idx],
+						   NULL);
+		}
+	} else {
+		rcu_assign_pointer(dev->wcid[wcid->idx], NULL);
+	}
+
+	spin_unlock_bh(&dev->status_lock);
+	mutex_unlock(&dev->mutex);
+}
+
 const struct ieee80211_ops mt7925_ops = {
 	.tx = mt792x_tx,
 	.start = mt7925_start,
@@ -2422,7 +2456,7 @@ const struct ieee80211_ops mt7925_ops = {
 	.start_ap = mt7925_start_ap,
 	.stop_ap = mt7925_stop_ap,
 	.sta_state = mt76_sta_state,
-	.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
+	.sta_pre_rcu_remove = mt7925_sta_pre_rcu_remove,
 	.set_key = mt7925_set_key,
 	.sta_set_decap_offload = mt7925_sta_set_decap_offload,
 #if IS_ENABLED(CONFIG_IPV6)

gemini-3.1-pro-preview

null

null

							input: 2563
							output: 44
							thoughts: 266
						

**Analyzing the MT7925 Driver Patch**

Okay, so I'm looking at this patch for `drivers/net/wireless/mediatek/mt76/mt7925/main.c`. It's adding `mt7925_sta_pre_rcu_remove` and linking it up to `.sta_pre_rcu_remove` within `mt7925_ops`. Standard stuff, setting up a hook for station removal, nothing immediately alarming. This is the Mediatek MT7925 wireless driver, which raises the immediate question in my mind: can I actually trigger this in a virtualized environment? Wireless drivers are notoriously hardware-specific, usually requiring the actual physical hardware or a robust emulator.

Mac80211_hwsim comes to mind, but that's a *generic* mac80211 emulator. It wouldn't directly emulate the MT7925 specifically. Unless there's some obscure USB or PCI emulator out there for the MT7925... wait, is this device USB? If so, I could potentially fuzz it with a dummy HCD, as Syzkaller does have USB fuzzing capabilities. I need to quickly check. I'll fire up `grepper` and see if `mt7925` appears in the USB section within that driver path. Let's see if this is something I can actually hit easily in a virtual setting.

{
  "Expression": "mt7925",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7925/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 3152 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:3:obj-$(CONFIG_MT7925_COMMON) += mt7925-common.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:4:obj-$(CONFIG_MT7925E) += mt7925e.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:5:obj-$(CONFIG_MT7925U) += mt7925u.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile-6-\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:7:mt7925-common-y := mac.o mcu.o regd.o main.o init.o debugfs.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:8:mt7925-common-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:9:mt7925e-y := pci.o pci_mac.o pci_mcu.o\ndrivers/net/wireless/mediatek/mt76/mt7925/Makefile:10:mt7925u-y := usb.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-3-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:4:#include \"mt7925.h\"\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-5-#include \"mcu.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=7=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:8:mt7925_reg_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-9-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-13-\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:14:\tmt7925_mcu_regval(dev, dev-\u003emt76.debugfs_reg, \u0026regval, true);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-15-\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=20=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:21:mt7925_reg_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-22-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-27-\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:28:\tret = mt7925_mcu_regval(dev, dev-\u003emt76.debugfs_reg, \u0026regval, false);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-29-\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-35-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:36:DEFINE_DEBUGFS_ATTRIBUTE(fops_regval, mt7925_reg_get, mt7925_reg_set,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-37-\t\t\t \"0x%08llx\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=38=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:39:mt7925_fw_debug_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-40-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-45-\tdev-\u003efw_debug = (u8)val;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:46:\tmt7925_mcu_fw_log_2_host(dev, dev-\u003efw_debug);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-47-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=53=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:54:mt7925_fw_debug_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-55-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-62-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:63:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug, mt7925_fw_debug_get,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:64:\t\t\t mt7925_fw_debug_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-65-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=68=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:69:mt7925_seq_puts_array(struct seq_file *file, const char *str,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-70-\t\t      s8 val[][2], int len, u8 band_idx)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-82-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:83:#define mt7925_print_txpwr_entry(prefix, rate, idx)\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-84-({\t\t\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:85:\tmt7925_seq_puts_array(s, #prefix \" (tmac)\",\t\\\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-86-\t\t\t      txpwr-\u003erate,\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=91=static inline void\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:92:mt7925_eht_txpwr(struct seq_file *s, struct mt7925_txpwr *txpwr, u8 band_idx)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-93-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-97-\t\t   \"mcs12\", \"mcs13\", \"mcs14\", \"mcs15\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:98:\tmt7925_print_txpwr_entry(EHT26, eht26, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:99:\tmt7925_print_txpwr_entry(EHT52, eht52, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:100:\tmt7925_print_txpwr_entry(EHT106, eht106, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:101:\tmt7925_print_txpwr_entry(EHT242, eht242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:102:\tmt7925_print_txpwr_entry(EHT484, eht484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-103-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:104:\tmt7925_print_txpwr_entry(EHT996, eht996, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:105:\tmt7925_print_txpwr_entry(EHT996x2, eht996x2, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:106:\tmt7925_print_txpwr_entry(EHT996x4, eht996x4, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:107:\tmt7925_print_txpwr_entry(EHT26_52, eht26_52, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:108:\tmt7925_print_txpwr_entry(EHT26_106, eht26_106, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:109:\tmt7925_print_txpwr_entry(EHT484_242, eht484_242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:110:\tmt7925_print_txpwr_entry(EHT996_484, eht996_484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:111:\tmt7925_print_txpwr_entry(EHT996_484_242, eht996_484_242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:112:\tmt7925_print_txpwr_entry(EHT996x2_484, eht996x2_484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:113:\tmt7925_print_txpwr_entry(EHT996x3, eht996x3, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:114:\tmt7925_print_txpwr_entry(EHT996x3_484, eht996x3_484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-115-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=117=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:118:mt7925_txpwr(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-119-{\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-120-\tstruct mt792x_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:121:\tstruct mt7925_txpwr *txpwr = NULL;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-122-\tu8 band_idx = dev-\u003emphy.band_idx;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-130-\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:131:\tret = mt7925_get_txpwr_info(dev, band_idx, txpwr);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-132-\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-138-\t\t   \" \", \"1m\", \"2m\", \"5m\", \"11m\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:139:\tmt7925_print_txpwr_entry(CCK, cck, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-140-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-143-\t\t   \"48m\", \"54m\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:144:\tmt7925_print_txpwr_entry(OFDM, ofdm, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-145-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-148-\t\t   \"mcs6\", \"mcs7\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:149:\tmt7925_print_txpwr_entry(HT20, ht20, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-150-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-153-\t\t   \"mcs6\", \"mcs7\", \"mcs32\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:154:\tmt7925_print_txpwr_entry(HT40, ht40, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-155-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-158-\t\t   \"mcs6\", \"mcs7\", \"mcs8\", \"mcs9\", \"mcs10\", \"mcs11\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:159:\tmt7925_print_txpwr_entry(VHT20, vht20, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:160:\tmt7925_print_txpwr_entry(VHT40, vht40, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-161-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:162:\tmt7925_print_txpwr_entry(VHT80, vht80, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:163:\tmt7925_print_txpwr_entry(VHT160, vht160, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-164-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:165:\tmt7925_print_txpwr_entry(HE26, he26, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:166:\tmt7925_print_txpwr_entry(HE52, he52, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:167:\tmt7925_print_txpwr_entry(HE106, he106, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:168:\tmt7925_print_txpwr_entry(HE242, he242, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:169:\tmt7925_print_txpwr_entry(HE484, he484, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-170-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:171:\tmt7925_print_txpwr_entry(HE996, he996, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:172:\tmt7925_print_txpwr_entry(HE996x2, he996x2, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-173-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:174:\tmt7925_eht_txpwr(s, txpwr, band_idx);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-175-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=181=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:182:mt7925_pm_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-183-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-205-\tpm-\u003eenable_user = val;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:206:\tmt7925_set_runtime_pm(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-207-\tmt76_connac_power_save_sched(\u0026dev-\u003emphy, pm);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=214=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:215:mt7925_pm_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-216-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-223-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:224:DEFINE_DEBUGFS_ATTRIBUTE(fops_pm, mt7925_pm_get, mt7925_pm_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-225-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=226=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:227:mt7925_deep_sleep_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-228-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-242-\tpm-\u003eds_enable = enable \u0026\u0026 !monitor;\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:243:\tmt7925_mcu_set_deep_sleep(dev, pm-\u003eds_enable);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-244-out:\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=250=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:251:mt7925_deep_sleep_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-252-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-259-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:260:DEFINE_DEBUGFS_ATTRIBUTE(fops_ds, mt7925_deep_sleep_get,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:261:\t\t\t mt7925_deep_sleep_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-262-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c=263=DEFINE_DEBUGFS_ATTRIBUTE(fops_pm_idle_timeout, mt792x_pm_idle_timeout_get,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-265-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:266:static int mt7925_chip_reset(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-267-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-278-\t\tmt792x_mutex_acquire(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:279:\t\tret = mt7925_mcu_chip_config(dev, \"assert\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-280-\t\tmt792x_mutex_release(dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-286-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:287:DEFINE_DEBUGFS_ATTRIBUTE(fops_reset, NULL, mt7925_chip_reset, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-288-\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:289:int mt7925_init_debugfs(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-290-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-306-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"txpower_sku\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c:307:\t\t\t\t    mt7925_txpwr);\ndrivers/net/wireless/mediatek/mt76/mt7925/debugfs.c-308-\tdebugfs_create_file(\"tx_stats\", 0400, dir, dev, \u0026mt792x_tx_stats_fops);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-8-#include \u003clinux/firmware.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:9:#include \"mt7925.h\"\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-10-#include \"regd.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-13-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:14:static ssize_t mt7925_thermal_temp_show(struct device *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-15-\t\t\t\t\tstruct device_attribute *attr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-24-\t\tmt792x_mutex_acquire(mdev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:25:\t\ttemperature = mt7925_mcu_get_temperature(phy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-26-\t\tmt792x_mutex_release(mdev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-36-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:37:static SENSOR_DEVICE_ATTR_RO(temp1_input, mt7925_thermal_temp, 0);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-38-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:39:static struct attribute *mt7925_hwmon_attrs[] = {\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-40-\t\u0026sensor_dev_attr_temp1_input.dev_attr.attr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-42-};\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:43:ATTRIBUTE_GROUPS(mt7925_hwmon);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-44-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:45:static int mt7925_thermal_init(struct mt792x_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-46-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-53-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:54:\tname = devm_kasprintf(\u0026wiphy-\u003edev, GFP_KERNEL, \"mt7925_%s\",\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-55-\t\t\t      wiphy_name(wiphy));\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-59-\thwmon = devm_hwmon_device_register_with_groups(\u0026wiphy-\u003edev, name, phy,\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:60:\t\t\t\t\t\t       mt7925_hwmon_groups);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-61-\treturn PTR_ERR_OR_ZERO(hwmon);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-63-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:64:static void mt7925_mac_init_basic_rates(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-65-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-73-\t\t       FIELD_PREP(MT_TX_RATE_IDX, rate \u0026 GENMASK(7, 0));\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:74:\t\tmt7925_mac_set_fixed_rate_table(dev, idx, rate);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-75-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-77-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:78:int mt7925_mac_init(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-79-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-86-\tfor (i = 0; i \u003c MT792x_WTBL_SIZE; i++)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:87:\t\tmt7925_mac_wtbl_update(dev, i,\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-88-\t\t\t\t       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-91-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:92:\tmt7925_mac_init_basic_rates(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-93-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-97-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:98:EXPORT_SYMBOL_GPL(mt7925_mac_init);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-99-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:100:static int __mt7925_init_hardware(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-101-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-111-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:112:\tret = mt7925_mcu_set_eeprom(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-113-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-115-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:116:\tret = mt7925_mac_init(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-117-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-123-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:124:static int mt7925_init_hardware(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-125-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-130-\tfor (i = 0; i \u003c MT792x_MCU_INIT_RETRY_COUNT; i++) {\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:131:\t\tret = __mt7925_init_hardware(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-132-\t\tif (!ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-145-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:146:static void mt7925_init_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-147-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-151-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:152:\tret = mt7925_init_hardware(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-153-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-156-\tmt76_set_stream_caps(\u0026dev-\u003emphy, true);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:157:\tmt7925_set_stream_he_eht_caps(\u0026dev-\u003ephy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-158-\tmt792x_config_mac_addr_list(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-159-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:160:\tret = mt7925_init_mlo_caps(\u0026dev-\u003ephy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-161-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-172-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:173:\tret = mt7925_init_debugfs(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-174-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-178-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:179:\tret = mt7925_thermal_init(\u0026dev-\u003ephy);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-180-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-184-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:185:\tret = mt7925_mcu_set_thermal_protect(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-186-\tif (ret) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-193-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:194:\tmt7925_mcu_set_deep_sleep(dev, dev-\u003epm.ds_enable);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-195-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-196-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:197:int mt7925_register_device(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-198-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-207-\tINIT_DELAYED_WORK(\u0026dev-\u003epm.ps_work, mt792x_pm_power_save_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:208:\tINIT_DELAYED_WORK(\u0026dev-\u003emlo_pm_work, mt7925_mlo_pm_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-209-\tINIT_WORK(\u0026dev-\u003epm.wake_work, mt792x_pm_wake_work);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-215-\tINIT_DELAYED_WORK(\u0026dev-\u003emphy.mac_work, mt792x_mac_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:216:\tINIT_DELAYED_WORK(\u0026dev-\u003ephy.scan_work, mt7925_scan_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:217:\tINIT_DELAYED_WORK(\u0026dev-\u003ecoredump.work, mt7925_coredump_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-218-#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:219:\tINIT_WORK(\u0026dev-\u003eipv6_ns_work, mt7925_set_ipv6_ns_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-220-\tskb_queue_head_init(\u0026dev-\u003eipv6_ns_list);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-224-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:225:\tINIT_WORK(\u0026dev-\u003ereset_work, mt7925_mac_reset_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:226:\tINIT_WORK(\u0026dev-\u003einit_work, mt7925_init_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-227-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:228:\tINIT_WORK(\u0026dev-\u003ephy.roc_work, mt7925_roc_work);\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-229-\ttimer_setup(\u0026dev-\u003ephy.roc_timer, mt792x_roc_timer, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-254-\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:255:\thw-\u003ewiphy-\u003ereg_notifier = mt7925_regd_notifier;\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-256-\tdev-\u003emphy.sband_2g.sband.ht_cap.cap |=\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c-282-}\ndrivers/net/wireless/mediatek/mt76/mt7925/init.c:283:EXPORT_SYMBOL_GPL(mt7925_register_device);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-6-#include \u003clinux/timekeeping.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:7:#include \"mt7925.h\"\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-8-#include \"../dma.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-12-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:13:bool mt7925_mac_wtbl_update(struct mt792x_dev *dev, int idx, u32 mask)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-14-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-21-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:22:static void mt7925_mac_sta_poll(struct mt792x_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-23-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-58-\t\tidx = mlink-\u003ewcid.idx;\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:59:\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, MT_WTBL_AC0_CTT_OFFSET);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-60-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-77-\t\tif (clear) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:78:\t\t\tmt7925_mac_wtbl_update(dev, idx,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-79-\t\t\t\t\t       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-122-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:123:\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, 6);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-124-\t\tval = mt76_rr(dev, addr);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-125-\t\tif (rate-\u003eflags \u0026 RATE_INFO_FLAGS_EHT_MCS) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:126:\t\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, 5);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-127-\t\t\tval = mt76_rr(dev, addr);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-141-\t\t/* get signal strength of resp frames (CTS/BA/ACK) */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:142:\t\taddr = mt7925_mac_wtbl_lmac_addr(dev, idx, 34);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-143-\t\tval = mt76_rr(dev, addr);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-156-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:157:void mt7925_mac_set_fixed_rate_table(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-158-\t\t\t\t     u8 tbl_idx, u16 rate_idx)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-168-/* The HW does not translate the mac header to 802.3 for mesh point */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:169:static int mt7925_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-170-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=248=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:249:mt7925_mac_fill_rx_rate(struct mt792x_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-250-\t\t\tstruct mt76_rx_status *status,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=353=static int\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:354:mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-355-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-533-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:534:\t\tret = mt7925_mac_fill_rx_rate(dev, status, sband, rxv, \u0026mode);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-535-\t\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-547-\tif (hdr_trans \u0026\u0026 ieee80211_has_morefrags(fc)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:548:\t\tif (mt7925_reverse_frag0_hdr_trans(skb, hdr_gap))\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-549-\t\t\treturn -EINVAL;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=621=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:622:mt7925_mac_write_txwi_8023(__le32 *txwi, struct sk_buff *skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-623-\t\t\t   struct mt76_wcid *wcid)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=656=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:657:mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-658-\t\t\t    struct sk_buff *skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=724=void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:725:mt7925_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-726-\t\t      struct sk_buff *skb, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-813-\tif (is_8023)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:814:\t\tmt7925_mac_write_txwi_8023(txwi, skb, wcid);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-815-\telse\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:816:\t\tmt7925_mac_write_txwi_80211(dev, txwi, skb, key);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-817-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-836-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:837:EXPORT_SYMBOL_GPL(mt7925_mac_write_txwi);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-838-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:839:static void mt7925_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-840-\t\t\t\t struct mt76_wcid *wcid)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=894=static bool\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:895:mt7925_mac_add_txs_skb(struct mt792x_dev *dev, struct mt76_wcid *wcid,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-896-\t\t       int pid, __le32 *txs_data)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1027-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1028:void mt7925_mac_add_txs(struct mt792x_dev *dev, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1029-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1055-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1056:\tmt7925_mac_add_txs_skb(dev, wcid, pid, txs_data);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1057-\tif (!wcid-\u003esta)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1065-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1066:void mt7925_txwi_free(struct mt792x_dev *dev, struct mt76_txwi_cache *t,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1067-\t\t      struct ieee80211_sta *sta, struct mt76_wcid *wcid,\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1080-\t\tif (likely(t-\u003eskb-\u003eprotocol != cpu_to_be16(ETH_P_PAE)))\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1081:\t\t\tmt7925_tx_check_aggr(sta, t-\u003eskb, wcid);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1082-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1092-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1093:EXPORT_SYMBOL_GPL(mt7925_txwi_free);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1094-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=1095=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1096:mt7925_mac_tx_free(struct mt792x_dev *dev, void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1097-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1161-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1162:\t\t\tmt7925_txwi_free(dev, txwi, sta, wcid, \u0026free_list);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1163-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1165-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1166:\tmt7925_mac_sta_poll(dev);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1167-\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1178-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1179:bool mt7925_rx_check(struct mt76_dev *mdev, void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1180-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1197-\t\t/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1198:\t\tmt7925_mac_tx_free(dev, data, len); /* mmio */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1199-\t\treturn false;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1201-\t\tfor (rxd += 4; rxd + 12 \u003c= end; rxd += 12)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1202:\t\t\tmt7925_mac_add_txs(dev, rxd);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1203-\t\treturn false;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1207-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1208:EXPORT_SYMBOL_GPL(mt7925_rx_check);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1209-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1210:void mt7925_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1211-\t\t\t struct sk_buff *skb, u32 *info)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1234-\t\t/* PKT_TYPE_TXRX_NOTIFY can be received only by mmio devices */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1235:\t\tmt7925_mac_tx_free(dev, skb-\u003edata, skb-\u003elen);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1236-\t\tnapi_consume_skb(skb, 1);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1238-\tcase PKT_TYPE_RX_EVENT:\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1239:\t\tmt7925_mcu_rx_event(dev, skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1240-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1242-\t\tfor (rxd += 2; rxd + 8 \u003c= end; rxd += 8)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1243:\t\t\tmt7925_mac_add_txs(dev, rxd);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1244-\t\tdev_kfree_skb(skb);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1247-\tcase PKT_TYPE_NORMAL:\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1248:\t\tif (!mt7925_mac_fill_rx(dev, skb)) {\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1249-\t\t\tmt76_rx(\u0026dev-\u003emt76, q, skb);\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1257-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1258:EXPORT_SYMBOL_GPL(mt7925_queue_rx_skb);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1259-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=1260=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1261:mt7925_vif_connect_iter(void *priv, u8 *mac,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1262-\t\t\tstruct ieee80211_vif *vif)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1281-\t\t\t\t\t    \u0026mvif-\u003esta.deflink.wcid, true);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1282:\t\tmt7925_mcu_set_tx(dev, bss_conf);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1283-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1287-\t\t\t\t\t    true, NULL);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1288:\t\tmt7925_mcu_sta_update(dev, NULL, vif,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1289-\t\t\t\t      \u0026mvif-\u003esta.deflink, true,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1290-\t\t\t\t      MT76_STA_INFO_STATE_NONE);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1291:\t\tmt7925_mcu_uni_add_beacon_offload(dev, hw, vif, true);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1292-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1295-/* system error recovery */\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1296:void mt7925_mac_reset_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1297-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1336-\t\t\t\t\t    IEEE80211_IFACE_ITER_RESUME_ALL,\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1337:\t\t\t\t\t    mt7925_vif_connect_iter, NULL);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1338-\tmt76_connac_power_save_sched(\u0026dev-\u003emt76.phy, pm);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1339-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1340:\tmt7925_regd_change(\u0026dev-\u003ephy, \"00\");\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1341-}\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1342-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1343:void mt7925_coredump_work(struct work_struct *work)\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1344-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1370-\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1371:\t\tskb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 8);\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c-1372-\t\tif (!dump || data + skb-\u003elen - dump \u003e MT76_CONNAC_COREDUMP_SZ) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c=1391=static void\ndrivers/net/wireless/mediatek/mt76/mt7925/mac.c:1392:mt7925_usb_sdio_write_txwi(struct mt792x_dev *dev, struct mt76_wcid *wcid,\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 20284
							output: 39
							thoughts: 770
						

**Fuzzing the `mt7925` Driver**

Okay, so I'm looking at this `mt7925` driver. Good news – it has both a PCI variant (`mt7925e`) and a USB variant (`mt7925u`). The USB variant is key, because that means I can leverage syzkaller's dummy HCD for USB fuzzing. That makes this driver reachable in virtualized environments, which is ideal for efficient testing.

The patch I'm examining modifies the `mt7925_sta_pre_rcu_remove` function within `drivers/net/wireless/mediatek/mt76/mt7925/main.c`. Let's refresh my memory on that code block:

```c
+static void mt7925_sta_pre_rcu_remove(struct ieee80211_hw *hw,
+				      struct ieee80211_vif *vif,
+				      struct ieee80211_sta *sta)
+{
+	struct mt76_phy *phy = hw->priv;
+	struct mt76_dev *dev = phy->dev;
+	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
+
+	mutex_lock(&dev->mutex);
+	spin_lock_bh(&dev->status_lock);
+
+	if (ieee80211_vif_is_mld(vif)) {
+		struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
+		struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+		unsigned long valid = mvif->valid_links;
+		struct mt792x_link_sta *mlink;
+		unsigned int link_id;
+
+		for_each_set_bit(link_id, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
+			mlink = mt792x_sta_to_link(msta, link_id);
+			if (!mlink || !mlink->wcid.sta)
+				continue;
+			if (mlink->wcid.idx < ARRAY_SIZE(dev->wcid))
+				rcu_assign_pointer(dev->wcid[mlink->wcid.idx],
+						   NULL);
+		}
+	} else {
+		rcu_assign_pointer(dev->wcid[wcid->idx], NULL);
+	}
+
+	spin_unlock_bh(&dev->status_lock);
+	mutex_unlock(&dev->mutex);
+}
```

Right, it's responsible for the RCU removal of a station, with specific handling for Multi-Link Device (MLD) functionality. This is definitely functional code that requires fuzzing. We need to expose its logic to fuzzing to ensure correctness and identify vulnerabilities.

Now, what about the kernel configuration?  I'll need `CONFIG_MT7925U` to enable the USB variant. While `CONFIG_MT7925E` (PCI) is an option, the USB variant offers the most straightforward path for fuzzing with syzkaller. Time to check `drivers/net/wireless/mediatek/mt76/mt7925/Kconfig` or similar files to verify.

{
  "Expression": "config MT7925",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7925/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:2:config MT7925_COMMON\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-6-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:7:config MT7925E\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-8-\ttristate \"MediaTek MT7925E (PCIe) support\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-18-\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig:19:config MT7925U\ndrivers/net/wireless/mediatek/mt76/mt7925/Kconfig-20-\ttristate \"MediaTek MT7925U (USB) support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 22230
							output: 47
							thoughts: 65
						

Okay, here's my quick take on what I'm thinking, based on that input.

**Enabling MT7925 Drivers**

Right, so the plan is to get the `MT7925U` and `MT7925E` drivers enabled. Seems straightforward enough. Before I dive too deep, I should quickly verify if `MT7925_COMMON` is actually required directly. It looks like the other options might pull that in automatically, but a quick confirmation is always smart to avoid unnecessary dependencies or conflicts later on. Then, let's just make sure I have the full picture, and check what `MT7925U` depends on. I need to be aware of what other settings or hardware configurations these drivers rely on. Gotta think ahead and make sure all the pieces fit together before I make any final decisions.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7925/Kconfig",
  "FirstLine": 1,
  "LineCount": 30
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\tconfig MT7925_COMMON\n   3:\t\ttristate\n   4:\t\tselect MT792x_LIB\n   5:\t\tselect WANT_DEV_COREDUMP\n   6:\t\n   7:\tconfig MT7925E\n   8:\t\ttristate \"MediaTek MT7925E (PCIe) support\"\n   9:\t\tselect MT7925_COMMON\n  10:\t\tdepends on MAC80211\n  11:\t\tdepends on PCI\n  12:\t\thelp\n  13:\t\t  This adds support for MT7925-based wireless PCIe devices,\n  14:\t\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n  15:\t\t  2x2:2SS 4096-QAM, 160MHz channels.\n  16:\t\n  17:\t\t  To compile this driver as a module, choose M here.\n  18:\t\n  19:\tconfig MT7925U\n  20:\t\ttristate \"MediaTek MT7925U (USB) support\"\n  21:\t\tselect MT792x_USB\n  22:\t\tselect MT7925_COMMON\n  23:\t\tdepends on MAC80211\n  24:\t\tdepends on USB\n  25:\t\thelp\n  26:\t\t  This adds support for MT7925-based wireless USB devices,\n  27:\t\t  which support operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be\n  28:\t\t  2x2:2SS 4096-QAM, 160MHz channels.\n  29:\t\n  30:\t\t  To compile this driver as a module, choose M here.\n"
}

gemini-3.1-pro-preview

null

null

							input: 23006
							output: 124
							thoughts: 301
						

**My Assessment of the MT7925 RCU Removal Patch**

Alright, let's break this down. From what I see, we're looking at configurations `MT7925U` and `MT7925E`. The crucial function here is `mt7925_sta_pre_rcu_remove`. I don't see any other functions implicated in the description, so that seems to be the core of the matter. Just to be thorough, I'm confirming that the patch *only* introduces `mt7925_sta_pre_rcu_remove` and assigns it to `.sta_pre_rcu_remove` within `mt7925_ops`.

The reasoning is pretty clear: This patch is all about implementing RCU removal for stations within the MT7925 wireless driver, with specific considerations for Multi-Link Device (MLD) logic. The key detail, and this is important for fuzzing, is that the MT7925 has a USB variant. That means we can get to it through a dummy HCD setup, opening the door for fuzzing.

Let's summarize this concisely:

*   **WorthFuzzing:** True
*   **FocusSymbols:** `["mt7925_sta_pre_rcu_remove"]`
*   **EnableConfigs:** `["MT7925U", "MT7925E"]`
*   **Reasoning:** The patch adds the necessary functional logic for RCU removal of stations within the MT7925 wireless driver, including handling for Multi-Link Devices (MLD). Importantly, it has a USB variant, mt7925u, which makes fuzzing via USB emulation (dummy HCD) viable.

{
  "EnableConfigs": [
    "MT7925U",
    "MT7925E"
  ],
  "FocusSymbols": [
    "mt7925_sta_pre_rcu_remove"
  ],
  "Reasoning": "The patch adds functional logic for RCU removal of stations in the MT7925 wireless driver, including handling for Multi-Link Devices (MLD). The driver has a USB variant (mt7925u) which can be fuzzed via USB emulation (dummy HCD).",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MT7925U",
    "MT7925E"
  ],
  "FocusSymbols": [
    "mt7925_sta_pre_rcu_remove"
  ],
  "Reasoning": "The patch adds functional logic for RCU removal of stations in the MT7925 wireless driver, including handling for Multi-Link Devices (MLD). The driver has a USB variant (mt7925u) which can be fuzzed via USB emulation (dummy HCD).",
  "WorthFuzzing": true
}