| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/29 23:02 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the ath11k wireless driver, which is a vendor-specific hardware driver for Qualcomm Atheros 802.11ax PCIe/AHB devices. Standard virtualized environments like QEMU do not emulate this specific hardware, meaning the driver cannot probe and initialize. Therefore, the modified code paths are unreachable during fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/07/29 23:02 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 59f7be7979c4c9a384bba122957fb82840a0db97\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Jul 29 23:02:12 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c\nindex 2d55cdc4d165d..ae91b57c8422f 100644\n--- a/drivers/net/wireless/ath/ath11k/mac.c\n+++ b/drivers/net/wireless/ath/ath11k/mac.c\n@@ -873,6 +873,22 @@ static int ath11k_mac_set_kickout(struct ath11k_vif *arvif)\n \treturn 0;\n }\n \n+static void ath11k_mac_station_cleanup(struct ieee80211_sta *sta)\n+{\n+\tstruct ath11k_sta *arsta;\n+\n+\tif (!sta)\n+\t\treturn;\n+\n+\tarsta = ath11k_sta_to_arsta(sta);\n+\n+\tkfree(arsta-\u003etx_stats);\n+\tarsta-\u003etx_stats = NULL;\n+\n+\tkfree(arsta-\u003erx_stats);\n+\tarsta-\u003erx_stats = NULL;\n+}\n+\n void ath11k_mac_peer_cleanup_all(struct ath11k *ar)\n {\n \tstruct ath11k_peer *peer, *tmp;\n@@ -885,6 +901,7 @@ void ath11k_mac_peer_cleanup_all(struct ath11k *ar)\n \tlist_for_each_entry_safe(peer, tmp, \u0026ab-\u003epeers, list) {\n \t\tath11k_peer_rx_tid_cleanup(ar, peer);\n \t\tath11k_peer_rhash_delete(ab, peer);\n+\t\tath11k_mac_station_cleanup(peer-\u003esta);\n \t\tlist_del(\u0026peer-\u003elist);\n \t\tkfree(peer);\n \t}\n@@ -9892,7 +9909,6 @@ static int ath11k_mac_station_remove(struct ath11k *ar,\n {\n \tstruct ath11k_base *ab = ar-\u003eab;\n \tstruct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);\n-\tstruct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);\n \tint ret;\n \n \tif (ab-\u003ehw_params.vdev_start_delay \u0026\u0026\n@@ -9916,12 +9932,7 @@ static int ath11k_mac_station_remove(struct ath11k *ar,\n \t\t\t sta-\u003eaddr, arvif-\u003evdev_id);\n \n \tath11k_mac_dec_num_stations(arvif, sta);\n-\n-\tkfree(arsta-\u003etx_stats);\n-\tarsta-\u003etx_stats = NULL;\n-\n-\tkfree(arsta-\u003erx_stats);\n-\tarsta-\u003erx_stats = NULL;\n+\tath11k_mac_station_cleanup(sta);\n \n \treturn ret;\n }\n"
} |
| 2/1 | 2026/07/29 23:02 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the ath11k wireless driver, which is a vendor-specific hardware driver for Qualcomm Atheros 802.11ax PCIe/AHB devices. Standard virtualized environments like QEMU do not emulate this specific hardware, meaning the driver cannot probe and initialize. Therefore, the modified code paths are unreachable during fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 59f7be7979c4c9a384bba122957fb82840a0db97
Author: syz-cluster <triage@syzkaller.com>
Date: Wed Jul 29 23:02:12 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 2d55cdc4d165d..ae91b57c8422f 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -873,6 +873,22 @@ static int ath11k_mac_set_kickout(struct ath11k_vif *arvif)
return 0;
}
+static void ath11k_mac_station_cleanup(struct ieee80211_sta *sta)
+{
+ struct ath11k_sta *arsta;
+
+ if (!sta)
+ return;
+
+ arsta = ath11k_sta_to_arsta(sta);
+
+ kfree(arsta->tx_stats);
+ arsta->tx_stats = NULL;
+
+ kfree(arsta->rx_stats);
+ arsta->rx_stats = NULL;
+}
+
void ath11k_mac_peer_cleanup_all(struct ath11k *ar)
{
struct ath11k_peer *peer, *tmp;
@@ -885,6 +901,7 @@ void ath11k_mac_peer_cleanup_all(struct ath11k *ar)
list_for_each_entry_safe(peer, tmp, &ab->peers, list) {
ath11k_peer_rx_tid_cleanup(ar, peer);
ath11k_peer_rhash_delete(ab, peer);
+ ath11k_mac_station_cleanup(peer->sta);
list_del(&peer->list);
kfree(peer);
}
@@ -9892,7 +9909,6 @@ static int ath11k_mac_station_remove(struct ath11k *ar,
{
struct ath11k_base *ab = ar->ab;
struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
- struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
int ret;
if (ab->hw_params.vdev_start_delay &&
@@ -9916,12 +9932,7 @@ static int ath11k_mac_station_remove(struct ath11k *ar,
sta->addr, arvif->vdev_id);
ath11k_mac_dec_num_stations(arvif, sta);
-
- kfree(arsta->tx_stats);
- arsta->tx_stats = NULL;
-
- kfree(arsta->rx_stats);
- arsta->rx_stats = NULL;
+ ath11k_mac_station_cleanup(sta);
return ret;
}
|
| 3/2 | 2026/07/29 23:02 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2632 output: 37 thoughts: 269 Thoughts: **Analyzing the ath11k Cleanup Patch** Okay, so I'm looking at this patch in `drivers/net/wireless/ath/ath11k/mac.c`. Seems like a straightforward refactoring - they've pulled some cleanup code into a dedicated function, `ath11k_mac_station_cleanup`, and now call it from both `ath11k_mac_peer_cleanup_all` and `ath11k_mac_station_remove`. Nothing too complex, good practice for maintainability. My immediate thought is, how testable is this change? The `ath11k` driver, being for Qualcomm Atheros 802.11ax hardware, typically requires specific hardware interfaces - PCIe or AHB, if I recall correctly. Can I get away with testing this in a virtualized environment, perhaps? Let me see if there's any software emulation available for the `ath11k` hardware. I *highly* doubt it, given it's a hardware driver. We'd need something very specific, and I'm pretty sure I'd have remembered if there was an `ath11k` emulator available in QEMU. Generic mac80211 stuff like `mac80211_hwsim` won't cut it; that's for a more general mac80211-based device, not this specific Atheros silicon. Hang on... what about syzkaller? I vaguely recall something about syzkaller not fuzzing `ath11k` unless it's hooked up through a USB device, or something similar. Right, `ath11k` *does* support PCI and AHB, but that's not easily virtualized. Let's see… does `ath11k` *have* a USB driver? Perhaps that's a vector for fuzzing. I need to check if there's any USB support built into it to have any chance of fuzzing this thing. |
| 4/2 | 2026/07/29 23:02 | tool | grepper |
0mArgs:{
"Expression": "ath11k",
"PathPrefix": "drivers/net/wireless/ath/ath11k/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 26683 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath11k/Kconfig=2=config ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-10-\ndrivers/net/wireless/ath/ath11k/Kconfig:11:\t If you choose to build a module, it'll be called ath11k.\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig=13=config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig:14:\ttristate \"Atheros ath11k AHB support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-15-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=20=config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig:21:\ttristate \"Atheros ath11k PCI support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-22-\tdepends on ATH11K \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=30=config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig:31:\tbool \"QCA ath11k debugging\"\ndrivers/net/wireless/ath/ath11k/Kconfig-32-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=38=config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig:39:\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-40-\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-41-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:42:\t Enable ath11k debugfs support\ndrivers/net/wireless/ath/ath11k/Kconfig-43-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=46=config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig:47:\tbool \"ath11k tracing support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-48-\tdepends on ATH11K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-49-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:50:\t Select this to use ath11k tracing infrastructure.\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig=52=config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig:53:\tbool \"QCA ath11k spectral scan support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-54-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-56-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:57:\t Enable ath11k spectral scan support\ndrivers/net/wireless/ath/ath11k/Kconfig-58-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=61=config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig:62:\tbool \"ath11k channel frequency response support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-63-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-65-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:66:\t Enable ath11k channel frequency response dump support.\ndrivers/net/wireless/ath/ath11k/Kconfig-67-\t This option exposes debugfs nodes that will allow the user\n--\ndrivers/net/wireless/ath/ath11k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Makefile:2:obj-$(CONFIG_ATH11K) += ath11k.o\ndrivers/net/wireless/ath/ath11k/Makefile:3:ath11k-y += core.o \\\ndrivers/net/wireless/ath/ath11k/Makefile-4-\t hal.o \\\n--\ndrivers/net/wireless/ath/ath11k/Makefile-23-\ndrivers/net/wireless/ath/ath11k/Makefile:24:ath11k-$(CONFIG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath11k/Makefile:25:ath11k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath11k/Makefile:26:ath11k-$(CONFIG_ATH11K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath11k/Makefile:27:ath11k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath11k/Makefile:28:ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath11k/Makefile:29:ath11k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath11k/Makefile:30:ath11k-$(CONFIG_DEV_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath11k/Makefile:31:ath11k-$(CONFIG_ATH11K_CFR) += cfr.o\ndrivers/net/wireless/ath/ath11k/Makefile-32-\ndrivers/net/wireless/ath/ath11k/Makefile:33:obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile:34:ath11k_ahb-y += ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-35-\ndrivers/net/wireless/ath/ath11k/Makefile:36:obj-$(CONFIG_ATH11K_PCI) += ath11k_pci.o\ndrivers/net/wireless/ath/ath11k/Makefile:37:ath11k_pci-y += mhi.o pci.o\ndrivers/net/wireless/ath/ath11k/Makefile-38-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-23-\ndrivers/net/wireless/ath/ath11k/ahb.c:24:static const struct of_device_id ath11k_ahb_of_match[] = {\ndrivers/net/wireless/ath/ath11k/ahb.c-25-\t/* TODO: Should we change the compatible string to something similar\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-42-\ndrivers/net/wireless/ath/ath11k/ahb.c:43:MODULE_DEVICE_TABLE(of, ath11k_ahb_of_match);\ndrivers/net/wireless/ath/ath11k/ahb.c-44-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=144=static int\ndrivers/net/wireless/ath/ath11k/ahb.c:145:ath11k_ahb_get_msi_irq_wcn6750(struct ath11k_base *ab, unsigned int vector)\ndrivers/net/wireless/ath/ath11k/ahb.c-146-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=150=static inline u32\ndrivers/net/wireless/ath/ath11k/ahb.c:151:ath11k_ahb_get_window_start_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-152-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=166=static void\ndrivers/net/wireless/ath/ath11k/ahb.c:167:ath11k_ahb_window_write32_wcn6750(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-168-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-171-\t/* WCN6750 uses static window based register access*/\ndrivers/net/wireless/ath/ath11k/ahb.c:172:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-173-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-177-\ndrivers/net/wireless/ath/ath11k/ahb.c:178:static u32 ath11k_ahb_window_read32_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-179-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-183-\t/* WCN6750 uses static window based register access */\ndrivers/net/wireless/ath/ath11k/ahb.c:184:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-185-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-190-\ndrivers/net/wireless/ath/ath11k/ahb.c:191:static const struct ath11k_pci_ops ath11k_ahb_pci_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c-192-\t.wakeup = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c-193-\t.release = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:194:\t.get_msi_irq = ath11k_ahb_get_msi_irq_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:195:\t.window_write32 = ath11k_ahb_window_write32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:196:\t.window_read32 = ath11k_ahb_window_read32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c-197-};\ndrivers/net/wireless/ath/ath11k/ahb.c-198-\ndrivers/net/wireless/ath/ath11k/ahb.c:199:static inline u32 ath11k_ahb_read32(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-200-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-203-\ndrivers/net/wireless/ath/ath11k/ahb.c:204:static inline void ath11k_ahb_write32(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-205-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-208-\ndrivers/net/wireless/ath/ath11k/ahb.c:209:static void ath11k_ahb_kill_tasklets(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-210-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-213-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:214:\t\tstruct ath11k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-215-\ndrivers/net/wireless/ath/ath11k/ahb.c:216:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-217-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-222-\ndrivers/net/wireless/ath/ath11k/ahb.c:223:static void ath11k_ahb_ext_grp_disable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-224-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-230-\ndrivers/net/wireless/ath/ath11k/ahb.c:231:static void __ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-232-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-235-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:236:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-237-\ndrivers/net/wireless/ath/ath11k/ahb.c:238:\t\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-239-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-247-\ndrivers/net/wireless/ath/ath11k/ahb.c:248:static void ath11k_ahb_ext_grp_enable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-249-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-255-\ndrivers/net/wireless/ath/ath11k/ahb.c:256:static void ath11k_ahb_setbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-257-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-259-\ndrivers/net/wireless/ath/ath11k/ahb.c:260:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:261:\tath11k_ahb_write32(ab, offset, val | BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-262-}\ndrivers/net/wireless/ath/ath11k/ahb.c-263-\ndrivers/net/wireless/ath/ath11k/ahb.c:264:static void ath11k_ahb_clearbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-265-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-267-\ndrivers/net/wireless/ath/ath11k/ahb.c:268:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:269:\tath11k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-270-}\ndrivers/net/wireless/ath/ath11k/ahb.c-271-\ndrivers/net/wireless/ath/ath11k/ahb.c:272:static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-273-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-283-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:284:\t\tath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-285-\ndrivers/net/wireless/ath/ath11k/ahb.c-286-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:287:\t\tath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:288:\t\tath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-289-\t\t\t\t ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-292-\ndrivers/net/wireless/ath/ath11k/ahb.c:293:static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-294-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-304-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:305:\t\tath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-306-\ndrivers/net/wireless/ath/ath11k/ahb.c-307-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:308:\t\tath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:309:\t\tath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-310-\t\t\t\t ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-313-\ndrivers/net/wireless/ath/ath11k/ahb.c:314:static void ath11k_ahb_sync_ce_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-315-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-319-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:320:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-321-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-327-\ndrivers/net/wireless/ath/ath11k/ahb.c:328:static void ath11k_ahb_sync_ext_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-329-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-333-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:334:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-335-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-342-\ndrivers/net/wireless/ath/ath11k/ahb.c:343:static void ath11k_ahb_ce_irqs_enable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-344-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-347-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:348:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-349-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:350:\t\tath11k_ahb_ce_irq_enable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-351-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-353-\ndrivers/net/wireless/ath/ath11k/ahb.c:354:static void ath11k_ahb_ce_irqs_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-355-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-358-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:359:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-360-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:361:\t\tath11k_ahb_ce_irq_disable(ab, i);\ndrivers/net/wireless/ath/ath11k/ahb.c-362-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-364-\ndrivers/net/wireless/ath/ath11k/ahb.c:365:static int ath11k_ahb_start(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-366-{\ndrivers/net/wireless/ath/ath11k/ahb.c:367:\tath11k_ahb_ce_irqs_enable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:368:\tath11k_ce_rx_post_buf(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-369-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-372-\ndrivers/net/wireless/ath/ath11k/ahb.c:373:static void ath11k_ahb_ext_irq_enable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-374-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-377-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:378:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-379-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-383-\t\t}\ndrivers/net/wireless/ath/ath11k/ahb.c:384:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-385-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-387-\ndrivers/net/wireless/ath/ath11k/ahb.c:388:static void ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-389-{\ndrivers/net/wireless/ath/ath11k/ahb.c:390:\t__ath11k_ahb_ext_irq_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:391:\tath11k_ahb_sync_ext_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-392-}\ndrivers/net/wireless/ath/ath11k/ahb.c-393-\ndrivers/net/wireless/ath/ath11k/ahb.c:394:static void ath11k_ahb_stop(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-395-{\ndrivers/net/wireless/ath/ath11k/ahb.c-396-\tif (!test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ahb.c:397:\t\tath11k_ahb_ce_irqs_disable(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:398:\tath11k_ahb_sync_ce_irqs(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:399:\tath11k_ahb_kill_tasklets(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-400-\ttimer_delete_sync(\u0026ab-\u003erx_replenish_retry);\ndrivers/net/wireless/ath/ath11k/ahb.c:401:\tath11k_ce_cleanup_pipes(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-402-}\ndrivers/net/wireless/ath/ath11k/ahb.c-403-\ndrivers/net/wireless/ath/ath11k/ahb.c:404:static int ath11k_ahb_power_up(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-405-{\ndrivers/net/wireless/ath/ath11k/ahb.c:406:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-407-\tint ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-410-\tif (ret)\ndrivers/net/wireless/ath/ath11k/ahb.c:411:\t\tath11k_err(ab, \"failed to boot the remote processor Q6\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-412-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-415-\ndrivers/net/wireless/ath/ath11k/ahb.c:416:static void ath11k_ahb_power_down(struct ath11k_base *ab, bool is_suspend)\ndrivers/net/wireless/ath/ath11k/ahb.c-417-{\ndrivers/net/wireless/ath/ath11k/ahb.c:418:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-419-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-422-\ndrivers/net/wireless/ath/ath11k/ahb.c:423:static void ath11k_ahb_init_qmi_ce_config(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-424-{\ndrivers/net/wireless/ath/ath11k/ahb.c:425:\tstruct ath11k_qmi_ce_cfg *cfg = \u0026ab-\u003eqmi.ce_cfg;\ndrivers/net/wireless/ath/ath11k/ahb.c-426-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-433-\ndrivers/net/wireless/ath/ath11k/ahb.c:434:static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-435-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-438-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:439:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-440-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-448-\ndrivers/net/wireless/ath/ath11k/ahb.c:449:static void ath11k_ahb_free_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-450-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-454-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:455:\t\treturn ath11k_pcic_free_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-456-\ndrivers/net/wireless/ath/ath11k/ahb.c-457-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:458:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-459-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-463-\ndrivers/net/wireless/ath/ath11k/ahb.c:464:\tath11k_ahb_free_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-465-}\ndrivers/net/wireless/ath/ath11k/ahb.c-466-\ndrivers/net/wireless/ath/ath11k/ahb.c:467:static void ath11k_ahb_ce_tasklet(struct tasklet_struct *t)\ndrivers/net/wireless/ath/ath11k/ahb.c-468-{\ndrivers/net/wireless/ath/ath11k/ahb.c:469:\tstruct ath11k_ce_pipe *ce_pipe = from_tasklet(ce_pipe, t, intr_tq);\ndrivers/net/wireless/ath/ath11k/ahb.c-470-\ndrivers/net/wireless/ath/ath11k/ahb.c:471:\tath11k_ce_per_engine_service(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-472-\ndrivers/net/wireless/ath/ath11k/ahb.c:473:\tath11k_ahb_ce_irq_enable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-474-}\ndrivers/net/wireless/ath/ath11k/ahb.c-475-\ndrivers/net/wireless/ath/ath11k/ahb.c:476:static irqreturn_t ath11k_ahb_ce_interrupt_handler(int irq, void *arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-477-{\ndrivers/net/wireless/ath/ath11k/ahb.c:478:\tstruct ath11k_ce_pipe *ce_pipe = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-479-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-482-\ndrivers/net/wireless/ath/ath11k/ahb.c:483:\tath11k_ahb_ce_irq_disable(ce_pipe-\u003eab, ce_pipe-\u003epipe_num);\ndrivers/net/wireless/ath/ath11k/ahb.c-484-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-489-\ndrivers/net/wireless/ath/ath11k/ahb.c:490:static int ath11k_ahb_ext_grp_napi_poll(struct napi_struct *napi, int budget)\ndrivers/net/wireless/ath/ath11k/ahb.c-491-{\ndrivers/net/wireless/ath/ath11k/ahb.c:492:\tstruct ath11k_ext_irq_grp *irq_grp = container_of(napi,\ndrivers/net/wireless/ath/ath11k/ahb.c:493:\t\t\t\t\t\tstruct ath11k_ext_irq_grp,\ndrivers/net/wireless/ath/ath11k/ahb.c-494-\t\t\t\t\t\tnapi);\ndrivers/net/wireless/ath/ath11k/ahb.c:495:\tstruct ath11k_base *ab = irq_grp-\u003eab;\ndrivers/net/wireless/ath/ath11k/ahb.c-496-\tint work_done;\ndrivers/net/wireless/ath/ath11k/ahb.c-497-\ndrivers/net/wireless/ath/ath11k/ahb.c:498:\twork_done = ath11k_dp_service_srng(ab, irq_grp, budget);\ndrivers/net/wireless/ath/ath11k/ahb.c-499-\tif (work_done \u003c budget) {\ndrivers/net/wireless/ath/ath11k/ahb.c-500-\t\tnapi_complete_done(napi, work_done);\ndrivers/net/wireless/ath/ath11k/ahb.c:501:\t\tath11k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-502-\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-509-\ndrivers/net/wireless/ath/ath11k/ahb.c:510:static irqreturn_t ath11k_ahb_ext_interrupt_handler(int irq, void *arg)\ndrivers/net/wireless/ath/ath11k/ahb.c-511-{\ndrivers/net/wireless/ath/ath11k/ahb.c:512:\tstruct ath11k_ext_irq_grp *irq_grp = arg;\ndrivers/net/wireless/ath/ath11k/ahb.c-513-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-516-\ndrivers/net/wireless/ath/ath11k/ahb.c:517:\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-518-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-523-\ndrivers/net/wireless/ath/ath11k/ahb.c:524:static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-525-{\ndrivers/net/wireless/ath/ath11k/ahb.c:526:\tstruct ath11k_hw_params *hw = \u0026ab-\u003ehw_params;\ndrivers/net/wireless/ath/ath11k/ahb.c-527-\tint i, j;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-531-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:532:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-533-\t\tu32 num_irq = 0;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-542-\t\tnetif_napi_add(irq_grp-\u003enapi_ndev, \u0026irq_grp-\u003enapi,\ndrivers/net/wireless/ath/ath11k/ahb.c:543:\t\t\t ath11k_ahb_ext_grp_napi_poll);\ndrivers/net/wireless/ath/ath11k/ahb.c-544-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-568-\t\t\t\t\t\trxdma2host_destination_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:569:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-570-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-574-\t\t\t\t\t\thost2rxdma_host_buf_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:575:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-576-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-580-\t\t\t\t\t\tppdu_end_interrupts_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:581:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-582-\t\t\t\t\tirq_grp-\u003eirqs[num_irq++] =\ndrivers/net/wireless/ath/ath11k/ahb.c-583-\t\t\t\t\t\trxdma2host_monitor_status_ring_mac1 -\ndrivers/net/wireless/ath/ath11k/ahb.c:584:\t\t\t\t\t\tath11k_hw_get_mac_from_pdev_id(hw, j);\ndrivers/net/wireless/ath/ath11k/ahb.c-585-\t\t\t\t}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-596-\t\t\tirq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY);\ndrivers/net/wireless/ath/ath11k/ahb.c:597:\t\t\tret = request_irq(irq, ath11k_ahb_ext_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-598-\t\t\t\t\t IRQF_TRIGGER_RISING,\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-600-\t\t\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:601:\t\t\t\tath11k_err(ab, \"failed request_irq for %d\\n\",\ndrivers/net/wireless/ath/ath11k/ahb.c-602-\t\t\t\t\t irq);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-609-\ndrivers/net/wireless/ath/ath11k/ahb.c:610:static int ath11k_ahb_config_irq(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-611-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-615-\tif (ab-\u003ehw_params.hybrid_bus_type)\ndrivers/net/wireless/ath/ath11k/ahb.c:616:\t\treturn ath11k_pcic_config_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-617-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-619-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:620:\t\tstruct ath11k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-621-\ndrivers/net/wireless/ath/ath11k/ahb.c:622:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-623-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-626-\ndrivers/net/wireless/ath/ath11k/ahb.c:627:\t\ttasklet_setup(\u0026ce_pipe-\u003eintr_tq, ath11k_ahb_ce_tasklet);\ndrivers/net/wireless/ath/ath11k/ahb.c-628-\t\tirq = platform_get_irq_byname(ab-\u003epdev, irq_name[irq_idx]);\ndrivers/net/wireless/ath/ath11k/ahb.c:629:\t\tret = request_irq(irq, ath11k_ahb_ce_interrupt_handler,\ndrivers/net/wireless/ath/ath11k/ahb.c-630-\t\t\t\t IRQF_TRIGGER_RISING, irq_name[irq_idx],\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-638-\t/* Configure external interrupts */\ndrivers/net/wireless/ath/ath11k/ahb.c:639:\tret = ath11k_ahb_config_ext_irq(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-640-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-643-\ndrivers/net/wireless/ath/ath11k/ahb.c:644:static int ath11k_ahb_map_service_to_pipe(struct ath11k_base *ab, u16 service_id,\ndrivers/net/wireless/ath/ath11k/ahb.c-645-\t\t\t\t\t u8 *ul_pipe, u8 *dl_pipe)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-686-\ndrivers/net/wireless/ath/ath11k/ahb.c:687:static int ath11k_ahb_hif_suspend(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-688-{\ndrivers/net/wireless/ath/ath11k/ahb.c:689:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-690-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-700-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:701:\t\tath11k_err(ab, \"failed to enable wakeup irq :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-702-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-712-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:713:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-714-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-716-\ndrivers/net/wireless/ath/ath11k/ahb.c:717:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device suspended\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-718-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-721-\ndrivers/net/wireless/ath/ath11k/ahb.c:722:static int ath11k_ahb_hif_resume(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-723-{\ndrivers/net/wireless/ath/ath11k/ahb.c:724:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-725-\tu32 wake_irq;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-735-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:736:\t\tath11k_err(ab, \"failed to disable wakeup irq: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-737-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-749-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:750:\t\tath11k_err(ab, \"failed to send smp2p power save enter cmd :%d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-751-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-755-\tif (ret == 0) {\ndrivers/net/wireless/ath/ath11k/ahb.c:756:\t\tath11k_warn(ab, \"timed out while waiting for wow wakeup completion\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-757-\t\treturn -ETIMEDOUT;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-759-\ndrivers/net/wireless/ath/ath11k/ahb.c:760:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device resumed\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-761-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-764-\ndrivers/net/wireless/ath/ath11k/ahb.c:765:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_ipq8074 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:766:\t.start = ath11k_ahb_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:767:\t.stop = ath11k_ahb_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:768:\t.read32 = ath11k_ahb_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:769:\t.write32 = ath11k_ahb_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-770-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:771:\t.irq_enable = ath11k_ahb_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:772:\t.irq_disable = ath11k_ahb_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:773:\t.map_service_to_pipe = ath11k_ahb_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:774:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:775:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c-776-};\ndrivers/net/wireless/ath/ath11k/ahb.c-777-\ndrivers/net/wireless/ath/ath11k/ahb.c:778:static const struct ath11k_hif_ops ath11k_ahb_hif_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c:779:\t.start = ath11k_pcic_start,\ndrivers/net/wireless/ath/ath11k/ahb.c:780:\t.stop = ath11k_pcic_stop,\ndrivers/net/wireless/ath/ath11k/ahb.c:781:\t.read32 = ath11k_pcic_read32,\ndrivers/net/wireless/ath/ath11k/ahb.c:782:\t.write32 = ath11k_pcic_write32,\ndrivers/net/wireless/ath/ath11k/ahb.c-783-\t.read = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:784:\t.irq_enable = ath11k_pcic_ext_irq_enable,\ndrivers/net/wireless/ath/ath11k/ahb.c:785:\t.irq_disable = ath11k_pcic_ext_irq_disable,\ndrivers/net/wireless/ath/ath11k/ahb.c:786:\t.get_msi_address = ath11k_pcic_get_msi_address,\ndrivers/net/wireless/ath/ath11k/ahb.c:787:\t.get_user_msi_vector = ath11k_pcic_get_user_msi_assignment,\ndrivers/net/wireless/ath/ath11k/ahb.c:788:\t.map_service_to_pipe = ath11k_pcic_map_service_to_pipe,\ndrivers/net/wireless/ath/ath11k/ahb.c:789:\t.power_down = ath11k_ahb_power_down,\ndrivers/net/wireless/ath/ath11k/ahb.c:790:\t.power_up = ath11k_ahb_power_up,\ndrivers/net/wireless/ath/ath11k/ahb.c:791:\t.suspend = ath11k_ahb_hif_suspend,\ndrivers/net/wireless/ath/ath11k/ahb.c:792:\t.resume = ath11k_ahb_hif_resume,\ndrivers/net/wireless/ath/ath11k/ahb.c:793:\t.ce_irq_enable = ath11k_pci_enable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c:794:\t.ce_irq_disable = ath11k_pci_disable_ce_irqs_except_wake_irq,\ndrivers/net/wireless/ath/ath11k/ahb.c-795-};\ndrivers/net/wireless/ath/ath11k/ahb.c-796-\ndrivers/net/wireless/ath/ath11k/ahb.c:797:static int ath11k_core_get_rproc(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-798-{\ndrivers/net/wireless/ath/ath11k/ahb.c:799:\tstruct ath11k_ahb *ab_ahb = ath11k_ahb_priv(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-800-\tstruct device *dev = ab-\u003edev;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-804-\tif (of_property_read_u32(dev-\u003eof_node, \"qcom,rproc\", \u0026rproc_phandle)) {\ndrivers/net/wireless/ath/ath11k/ahb.c:805:\t\tath11k_err(ab, \"failed to get q6_rproc handle\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-806-\t\treturn -ENOENT;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-816-\ndrivers/net/wireless/ath/ath11k/ahb.c:817:static int ath11k_ahb_setup_msi_resources(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-818-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-826-\ndrivers/net/wireless/ath/ath11k/ahb.c:827:\tret = ath11k_pcic_init_msi_config(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-828-\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ahb.c:829:\t\tath11k_err(ab, \"failed to init msi config: %d\\n\", ret);\ndrivers/net/wireless/ath/ath11k/ahb.c-830-\t\treturn ret;\n--\n\n"
} |
| 5/2 | 2026/07/29 23:02 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 18256 output: 33 thoughts: 376 Thoughts: **Assessing the Fuzzability of ath11k** Okay, so ath11k has both an AHB and a PCI driver. My immediate question is whether this is fuzzable in a virtualized environment. With PCI drivers, I typically check if they have dependencies on specific hardware. If not, they're generally fair game. The issue is, does ath11k require a specific PCI device and firmware? Syzkaller does have PCI fuzzing capabilities, though I know they're limited, mostly injecting config and BAR accesses, which is usually only effective for specific drivers or very generic PCI setups. Now, the prompt itself is a key factor here. It says to return `WorthFuzzing=false` for vendor-specific PCIe switch, SmartNIC, or GPU drivers. I have to decide if ath11k falls into that category. Considering it's a Qualcomm Atheros 802.11ax wireless driver, it's definitely hardware-dependent, right? My initial gut feeling is, yes, it needs physical hardware. Okay, wait, mac80211_hwsim *is* emulated, but ath11k isn't mac80211_hwsim. So that's out. Given the hardware dependency, I'm leaning toward it not being a good candidate for this particular fuzzing effort. Let me confirm if Syzkaller is even touching ath11k. I'm going to look for any syzkaller descriptions specifically for ath11k. I recall that Syzkaller *does* fuzz wifi, specifically through mac80211_hwsim, but ath11k is a specialized hardware driver. Let's see if this has been attempted previously. |
| 6/2 | 2026/07/29 23:02 | tool | grepper |
0mError:no matches Args: {
"Expression": "ath11k",
"PathPrefix": "net/mac80211/"
}Results: {
"error": "no matches"
} |
| 7/2 | 2026/07/29 23:02 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19049 output: 39 thoughts: 45 Thoughts: **Investigating Ath11k Fuzzing Coverage** Okay, let's take a look. I need to figure out if there's any evidence of `ath11k` being fuzzed by Syzkaller, but not through its standard networking interfaces. My initial thought is to explore whether there are any other mechanisms, perhaps a different driver interaction. Hang on, Syzkaller *does* have a USB fuzzer, doesn't it? That sparks a question... does `ath11k` even *have* a USB driver component that could potentially be targeted? That's the first avenue I need to investigate. |
| 8/2 | 2026/07/29 23:02 | tool | grepper |
0mError:no matches Args: {
"Expression": "ath11k.*usb",
"PathPrefix": "drivers/net/wireless/ath/ath11k/"
}Results: {
"error": "no matches"
} |
| 9/2 | 2026/07/29 23:02 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19282 output: 43 thoughts: 326 Thoughts: **Analyzing the Fuzzing Potential of This Patch** Okay, so no direct USB driver involvement here, that's good. My mind immediately jumps to PCI fuzzing – Syzkaller does have a PCI fuzzer, but it's typically for interactions that Syz's PCI calls like `syz_pci_...` can cover. The prompt, though, it's very explicit. It flags code in vendor-specific PCIe switch, SmartNIC, or GPU drivers, specifically those requiring *physical* PCIe hardware not emulated by standard QEMU. That's key. The question then becomes: is `ath11k` a vendor-specific PCIe card? Yes, it's a Qualcomm Atheros wireless card, typically PCIe or AHB, so it fits the description. The crucial piece is whether QEMU emulates it. And the answer is, no, it does not. So, is `ath11k` part of core kernel logic, or are we dealing with architecture-specific code? It's definitely a vendor-specific driver. Wait a minute... does that exclude the possibility it's reachable from a virtualized environment? If QEMU doesn't emulate the hardware, the driver's probe function won't find the device, and the driver *won't* initialize. Meaning, those `ath11k_mac_station_remove` and `ath11k_mac_peer_cleanup_all` functions will never even be called. But what if the driver can be instantiated *via software* somehow? That's the edge case to consider. Let's dig deeper and see if there are any software instantiations for `ath11k` we can leverage. |
| 10/2 | 2026/07/29 23:02 | tool | grepper |
0mArgs:{
"Expression": "ath11k_mac_station_remove",
"PathPrefix": "drivers/net/wireless/ath/ath11k/"
}Results: {
"Output": "drivers/net/wireless/ath/ath11k/mac.c=9797=static int ath11k_mac_station_add(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-9905-\ndrivers/net/wireless/ath/ath11k/mac.c:9906:static int ath11k_mac_station_remove(struct ath11k *ar,\ndrivers/net/wireless/ath/ath11k/mac.c-9907-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath11k/mac.c=9940=static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-9976-\t\t new_state == IEEE80211_STA_NOTEXIST)) {\ndrivers/net/wireless/ath/ath11k/mac.c:9977:\t\tret = ath11k_mac_station_remove(ar, vif, sta);\ndrivers/net/wireless/ath/ath11k/mac.c-9978-\t\tif (ret)\n"
} |
| 11/2 | 2026/07/29 23:02 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 20352 output: 35 thoughts: 151 Thoughts: **Unreachable Code in a Simulated Environment** Okay, so I've been looking at `ath11k_mac_station_remove`. It's called from `ath11k_mac_op_sta_state`, which is part of an `ieee80211_hw` operation. That tells me it's a callback registered with mac80211. Standard stuff. The thing is, this whole setup relies on the ath11k driver successfully probing a device. And here's the kicker: we're talking about standard QEMU. There's no ath11k hardware in standard QEMU, so the driver *won't* probe. This entire section of code is basically unreachable in a virtualized environment. That means this patch is a dead end for fuzzing efforts. It’s a waste of resources. Just to be absolutely sure, I'll quickly check if there are any virtual or mock drivers out there for ath11k. I want to rule out any edge cases. |
| 12/2 | 2026/07/29 23:02 | tool | grepper |
0mError:no matches Args: {
"Expression": "hwsim",
"PathPrefix": "drivers/net/wireless/ath/ath11k/"
}Results: {
"error": "no matches"
} |
| 13/2 | 2026/07/29 23:02 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 20775 output: 103 thoughts: 262 Thoughts: **WorthFuzzing=False: ath11k and Hardware Dependencies** Okay, so I've looked at this patch and it's modifying the `ath11k` driver, which is a Qualcomm Atheros 802.11ax driver. A quick reminder is that it's a *vendor-specific* hardware driver. That's the key. My expertise tells me immediately that this is likely a PCIe/AHB device. And here's the problem: standard virtualized environments, things like QEMU or Google Compute Engine, don't emulate this kind of specialized hardware. The driver just won't be able to initialize correctly because it's looking for physical hardware that isn't there. This means all the code paths being modified, like the station cleanup or removal routines, are completely unreachable during any fuzzing attempt I'd make. Waste of resources. Let me just quickly re-read the prompt instructions to be 100% compliant. Ah, here we go... "Return WorthFuzzing=false if..." and here's the relevant part: "...Code paths that are impossible to reach in virtualized environments...even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim)..." and also "...Code in vendor-specific PCIe switch...drivers...that require physical PCIe hardware cards not emulated in standard QEMU". Spot on. This `ath11k` situation fits that description *perfectly*. No point in wasting time on this. Time to mark this one as `WorthFuzzing=false`. |
| 14/2 | 2026/07/29 23:02 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the ath11k wireless driver, which is a vendor-specific hardware driver for Qualcomm Atheros 802.11ax PCIe/AHB devices. Standard virtualized environments like QEMU do not emulate this specific hardware, meaning the driver cannot probe and initialize. Therefore, the modified code paths are unreachable during fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the ath11k wireless driver, which is a vendor-specific hardware driver for Qualcomm Atheros 802.11ax PCIe/AHB devices. Standard virtualized environments like QEMU do not emulate this specific hardware, meaning the driver cannot probe and initialize. Therefore, the modified code paths are unreachable during fuzzing.",
"WorthFuzzing": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|