AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch introduces a board-specific quirk for Marvell WiFi devices to skip a regulatory hint if a specific device tree property ('marvell,invalid-reg-hint-in-rom') is present. This property is only added to a specific ARM board's device tree (armada-385-linksys-rango). In virtualized environments like QEMU/GCE where fuzzing occurs, this device tree property will not be present, meaning the execution flow will be identical to the pre-patch behavior. The new code path (skipping the regulatory hint) is unreachable during standard fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 27c98f0bdfe0e8cafb20ca86a17f6d3fe682093b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Aug 21 01:33:30 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml b/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml\nindex 930b700b73d00..9f905ef5c2c07 100644\n--- a/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml\n+++ b/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml\n@@ -59,6 +59,12 @@ properties:\n     description: Calibration data for sub-band 3 in the 5GHz band.\n     maxItems: 502\n \n+  marvell,invalid-reg-hint-in-rom:\n+    $ref: /schemas/types.yaml#/definitions/flag\n+    description:\n+      The regulatory hint in ROM conflicts with platform configuration.\n+      It should be ignored, so the platform regulatory domain can be used.\n+\n   marvell,wakeup-pin:\n     $ref: /schemas/types.yaml#/definitions/uint32\n     description:\ndiff --git a/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts b/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts\nindex 4ab45f294de22..2bf29981a0313 100644\n--- a/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts\n+++ b/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts\n@@ -165,6 +165,15 @@ \u0026sdhci {\n \twp-inverted;\n \tbus-width = \u003c8\u003e;\n \tstatus = \"okay\";\n+\n+\t#address-cells = \u003c1\u003e;\n+\t#size-cells = \u003c0\u003e;\n+\n+\twifi@1 {\n+\t\tcompatible = \"marvell,sd8897\";\n+\t\treg = \u003c1\u003e;\n+\t\tmarvell,invalid-reg-hint-in-rom;\n+\t};\n };\n \n \u0026usb3_1_vbus {\ndiff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c\nindex 7a1ba32f1fb36..293876397b670 100644\n--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c\n+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c\n@@ -4897,7 +4897,14 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)\n \t\t\t\tcountry_code =\n \t\t\t\t\tmwifiex_11d_code_2_region(\n \t\t\t\t\t\tadapter-\u003eregion_code);\n+\n+\t\t\t\t/* If the reg hint in ROM conflicts with platform\n+\t\t\t\t * configuration, it should be ignored, so the\n+\t\t\t\t * platform regulatory domain can be used.\n+\t\t\t\t */\n \t\t\t\tif (country_code \u0026\u0026\n+\t\t\t\t    !device_property_read_bool(adapter-\u003edev,\n+\t\t\t\t\t\t\t       \"marvell,invalid-reg-hint-in-rom\") \u0026\u0026\n \t\t\t\t    regulatory_hint(wiphy, country_code))\n \t\t\t\t\tmwifiex_dbg(priv-\u003eadapter, ERROR,\n \t\t\t\t\t\t    \"regulatory_hint() failed\\n\");\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a board-specific quirk for Marvell WiFi devices to skip a regulatory hint if a specific device tree property ('marvell,invalid-reg-hint-in-rom') is present. This property is only added to a specific ARM board's device tree (armada-385-linksys-rango). In virtualized environments like QEMU/GCE where fuzzing occurs, this device tree property will not be present, meaning the execution flow will be identical to the pre-patch behavior. The new code path (skipping the regulatory hint) is unreachable during standard fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 27c98f0bdfe0e8cafb20ca86a17f6d3fe682093b
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Aug 21 01:33:30 2026 +0000

    syz-cluster: applied patch under review

diff --git a/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml b/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml
index 930b700b73d00..9f905ef5c2c07 100644
--- a/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml
+++ b/Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml
@@ -59,6 +59,12 @@ properties:
     description: Calibration data for sub-band 3 in the 5GHz band.
     maxItems: 502
 
+  marvell,invalid-reg-hint-in-rom:
+    $ref: /schemas/types.yaml#/definitions/flag
+    description:
+      The regulatory hint in ROM conflicts with platform configuration.
+      It should be ignored, so the platform regulatory domain can be used.
+
   marvell,wakeup-pin:
     $ref: /schemas/types.yaml#/definitions/uint32
     description:
diff --git a/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts b/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts
index 4ab45f294de22..2bf29981a0313 100644
--- a/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts
+++ b/arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts
@@ -165,6 +165,15 @@ &sdhci {
 	wp-inverted;
 	bus-width = <8>;
 	status = "okay";
+
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	wifi@1 {
+		compatible = "marvell,sd8897";
+		reg = <1>;
+		marvell,invalid-reg-hint-in-rom;
+	};
 };
 
 &usb3_1_vbus {
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 7a1ba32f1fb36..293876397b670 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -4897,7 +4897,14 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
 				country_code =
 					mwifiex_11d_code_2_region(
 						adapter->region_code);
+
+				/* If the reg hint in ROM conflicts with platform
+				 * configuration, it should be ignored, so the
+				 * platform regulatory domain can be used.
+				 */
 				if (country_code &&
+				    !device_property_read_bool(adapter->dev,
+							       "marvell,invalid-reg-hint-in-rom") &&
 				    regulatory_hint(wiphy, country_code))
 					mwifiex_dbg(priv->adapter, ERROR,
 						    "regulatory_hint() failed\n");

gemini-3.1-pro-preview

null

null

							input: 2700
							output: 26
							thoughts: 385
						

**Fuzzing Feasibility of a Minor WiFi Driver Change**

Okay, so I've got this patch that touches a few files: the device tree binding for a Marvell WiFi chip, a device tree file for an Armada board, and the `mwifiex` wireless driver itself. The key change in `mwifiex_register_cfg80211` is a check for this new device property, `marvell,invalid-reg-hint-in-rom`. If it's there, it just skips a regulatory hint. Pretty minimal, really.

The question is, is this worth fuzzing? The driver in question is `mwifiex`, a Marvell WiFi driver, which is somewhat niche. It requires specific hardware – SDIO, PCIe, or USB Marvell WiFi cards. Can I even get at it in a virtualized environment? Likely not directly, as QEMU doesn't emulate Marvell WiFi. However, the lightbulb just went off: `mwifiex` has a USB driver, `mwifiex_usb`! That opens up possibilities.

USB devices can often be fuzzed using `dummy_hcd` or syzkaller's USB fuzzing capabilities. If I can reach `mwifiex_register_cfg80211` through the USB path, this becomes a much more interesting target. It looks like it's called during adapter initialization, so that seems promising.

Now, let's dive into `drivers/net/wireless/marvell/mwifiex/usb.c` or a similar file to confirm whether this initialization path is USB-accessible and see if I can figure out how to trigger that `mwifiex_register_cfg80211` call through a USB device. If I can, this change, even though it's small, could be worth a fuzzing campaign.

{
  "Expression": "mwifiex_register_cfg80211"
}

{
  "Output": "drivers/net/wireless/marvell/mwifiex/cfg80211.c=4668=int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-4697-\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c:4698:int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-4699-{\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.h-14-\ndrivers/net/wireless/marvell/mwifiex/cfg80211.h:15:int mwifiex_register_cfg80211(struct mwifiex_adapter *);\ndrivers/net/wireless/marvell/mwifiex/cfg80211.h-16-\n--\ndrivers/net/wireless/marvell/mwifiex/main.c=535=static int _mwifiex_fw_dpc(const struct firmware *firmware, void *context)\n--\ndrivers/net/wireless/marvell/mwifiex/main.c-586-\tif (!adapter-\u003ewiphy) {\ndrivers/net/wireless/marvell/mwifiex/main.c:587:\t\tif (mwifiex_register_cfg80211(adapter)) {\ndrivers/net/wireless/marvell/mwifiex/main.c-588-\t\t\tmwifiex_dbg(adapter, ERROR,\n"
}

gemini-3.1-pro-preview

null

null

							input: 3933
							output: 23
							thoughts: 84
						

**Analyzing the `mwifiex_register_cfg80211` Call**

Okay, so `mwifiex_register_cfg80211` is triggered from `_mwifiex_fw_dpc`. Right, that's the firmware download completion callback. That’s interesting. Immediately, I'm thinking about fuzzing and reachability. If `mwifiex_register_cfg80211` depends on a successful firmware download, getting there with a fuzzer *could* be tricky. I'll need to figure out if the fuzzer provides the necessary firmware data, or if the driver can somehow proceed without it. My gut says I need to take a closer look at `_mwifiex_fw_dpc` to confirm this potential dependency and understand the path to this crucial function. Time to dive into the code.

{
  "Expression": "_mwifiex_fw_dpc"
}

{
  "Output": "drivers/net/wireless/marvell/mwifiex/main.c=510=static void mwifiex_terminate_workqueue(struct mwifiex_adapter *adapter)\n--\ndrivers/net/wireless/marvell/mwifiex/main.c-534- */\ndrivers/net/wireless/marvell/mwifiex/main.c:535:static int _mwifiex_fw_dpc(const struct firmware *firmware, void *context)\ndrivers/net/wireless/marvell/mwifiex/main.c-536-{\n--\ndrivers/net/wireless/marvell/mwifiex/main.c=689=static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)\ndrivers/net/wireless/marvell/mwifiex/main.c-690-{\ndrivers/net/wireless/marvell/mwifiex/main.c:691:\t_mwifiex_fw_dpc(firmware, context);\ndrivers/net/wireless/marvell/mwifiex/main.c-692-}\n--\ndrivers/net/wireless/marvell/mwifiex/main.c=1530=mwifiex_reinit_sw(struct mwifiex_adapter *adapter)\n--\ndrivers/net/wireless/marvell/mwifiex/main.c-1592-\ndrivers/net/wireless/marvell/mwifiex/main.c:1593:\t/* _mwifiex_fw_dpc() does its own cleanup */\ndrivers/net/wireless/marvell/mwifiex/main.c:1594:\tret = _mwifiex_fw_dpc(adapter-\u003efirmware, adapter);\ndrivers/net/wireless/marvell/mwifiex/main.c-1595-\tif (ret) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 4681
							output: 45
							thoughts: 39
						

Okay, here's my interpretation of those thoughts, presented as a first-person summary, keeping in mind my expertise:

**Potential Firmware Dependency Failure**

Right, so if the expected firmware image is somehow missing or inaccessible, it's pretty likely that the `_mwifiex_fw_dpc` function will just crap out. That's the most probable failure point, given the context. Let's dig into that `_mwifiex_fw_dpc` routine and see exactly *why* it would fail. Gotta figure out the dependency chain and any implicit assumptions it makes about the firmware's availability. There's probably some error handling (or lack thereof) in there that's crucial to understand. Need to confirm my assumption, obviously.

{
  "File": "drivers/net/wireless/marvell/mwifiex/main.c",
  "FirstLine": 530,
  "LineCount": 100
}

{
  "Contents": " 530:\t *\n 531:\t * The main initialization steps followed are -\n 532:\t *      - Download the correct firmware to card\n 533:\t *      - Issue the init commands to firmware\n 534:\t */\n 535:\tstatic int _mwifiex_fw_dpc(const struct firmware *firmware, void *context)\n 536:\t{\n 537:\t\tint ret;\n 538:\t\tchar fmt[64];\n 539:\t\tstruct mwifiex_adapter *adapter = context;\n 540:\t\tstruct mwifiex_fw_image fw;\n 541:\t\tbool init_failed = false;\n 542:\t\tstruct wireless_dev *wdev;\n 543:\t\tstruct completion *fw_done = adapter-\u003efw_done;\n 544:\t\n 545:\t\tif (!firmware) {\n 546:\t\t\tmwifiex_dbg(adapter, ERROR,\n 547:\t\t\t\t    \"Failed to get firmware %s\\n\", adapter-\u003efw_name);\n 548:\t\t\tgoto err_dnld_fw;\n 549:\t\t}\n 550:\t\n 551:\t\tmemset(\u0026fw, 0, sizeof(struct mwifiex_fw_image));\n 552:\t\tadapter-\u003efirmware = firmware;\n 553:\t\tfw.fw_buf = (u8 *) adapter-\u003efirmware-\u003edata;\n 554:\t\tfw.fw_len = adapter-\u003efirmware-\u003esize;\n 555:\t\n 556:\t\tif (adapter-\u003eif_ops.dnld_fw) {\n 557:\t\t\tret = adapter-\u003eif_ops.dnld_fw(adapter, \u0026fw);\n 558:\t\t} else {\n 559:\t\t\tret = mwifiex_dnld_fw(adapter, \u0026fw);\n 560:\t\t}\n 561:\t\n 562:\t\tif (ret == -1)\n 563:\t\t\tgoto err_dnld_fw;\n 564:\t\n 565:\t\tmwifiex_dbg(adapter, MSG, \"WLAN FW is active\\n\");\n 566:\t\n 567:\t\tif (cal_data_cfg) {\n 568:\t\t\tif ((request_firmware(\u0026adapter-\u003ecal_data, cal_data_cfg,\n 569:\t\t\t\t\t      adapter-\u003edev)) \u003c 0)\n 570:\t\t\t\tmwifiex_dbg(adapter, ERROR,\n 571:\t\t\t\t\t    \"Cal data request_firmware() failed\\n\");\n 572:\t\t}\n 573:\t\n 574:\t\t/* enable host interrupt after fw dnld is successful */\n 575:\t\tif (adapter-\u003eif_ops.enable_int) {\n 576:\t\t\tif (adapter-\u003eif_ops.enable_int(adapter))\n 577:\t\t\t\tgoto err_dnld_fw;\n 578:\t\t}\n 579:\t\n 580:\t\tret = mwifiex_init_fw(adapter);\n 581:\t\tif (ret == -1)\n 582:\t\t\tgoto err_init_fw;\n 583:\t\n 584:\t\tmaybe_quirk_fw_disable_ds(adapter);\n 585:\t\n 586:\t\tif (!adapter-\u003ewiphy) {\n 587:\t\t\tif (mwifiex_register_cfg80211(adapter)) {\n 588:\t\t\t\tmwifiex_dbg(adapter, ERROR,\n 589:\t\t\t\t\t    \"cannot register with cfg80211\\n\");\n 590:\t\t\t\tgoto err_init_fw;\n 591:\t\t\t}\n 592:\t\t}\n 593:\t\n 594:\t\tif (mwifiex_init_channel_scan_gap(adapter)) {\n 595:\t\t\tmwifiex_dbg(adapter, ERROR,\n 596:\t\t\t\t    \"could not init channel stats table\\n\");\n 597:\t\t\tgoto err_init_chan_scan;\n 598:\t\t}\n 599:\t\n 600:\t\tif (driver_mode) {\n 601:\t\t\tdriver_mode \u0026= MWIFIEX_DRIVER_MODE_BITMASK;\n 602:\t\t\tdriver_mode |= MWIFIEX_DRIVER_MODE_STA;\n 603:\t\t}\n 604:\t\n 605:\t\trtnl_lock();\n 606:\t\twiphy_lock(adapter-\u003ewiphy);\n 607:\t\t/* Create station interface by default */\n 608:\t\twdev = mwifiex_add_virtual_intf(adapter-\u003ewiphy, \"mlan%d\", NET_NAME_ENUM,\n 609:\t\t\t\t\t\tNL80211_IFTYPE_STATION, NULL);\n 610:\t\tif (IS_ERR(wdev)) {\n 611:\t\t\tmwifiex_dbg(adapter, ERROR,\n 612:\t\t\t\t    \"cannot create default STA interface\\n\");\n 613:\t\t\twiphy_unlock(adapter-\u003ewiphy);\n 614:\t\t\trtnl_unlock();\n 615:\t\t\tgoto err_add_intf;\n 616:\t\t}\n 617:\t\n 618:\t\tif (driver_mode \u0026 MWIFIEX_DRIVER_MODE_UAP) {\n 619:\t\t\twdev = mwifiex_add_virtual_intf(adapter-\u003ewiphy, \"uap%d\", NET_NAME_ENUM,\n 620:\t\t\t\t\t\t\tNL80211_IFTYPE_AP, NULL);\n 621:\t\t\tif (IS_ERR(wdev)) {\n 622:\t\t\t\tmwifiex_dbg(adapter, ERROR,\n 623:\t\t\t\t\t    \"cannot create AP interface\\n\");\n 624:\t\t\t\twiphy_unlock(adapter-\u003ewiphy);\n 625:\t\t\t\trtnl_unlock();\n 626:\t\t\t\tgoto err_add_intf;\n 627:\t\t\t}\n 628:\t\t}\n 629:\t\n"
}

gemini-3.1-pro-preview

null

null

							input: 6462
							output: 21
							thoughts: 280
						

**My Analysis of the Marvell Wi-Fi Firmware Loading Process**

Okay, so I'm looking at this `_mwifiex_fw_dpc` function and it's immediately clear that it's *completely* reliant on the presence of firmware. If `firmware` is NULL, it's a hard fail. This means that if the firmware isn't successfully loaded, we'll never even get to `mwifiex_register_cfg80211`. That's important to remember for fuzzing later.

The immediate problem is, syzkaller *typically* doesn't provide arbitrary firmware blobs unless they are within `linux-firmware` and included in the syzkaller image. I need to figure out if we even have the Marvell firmware in the environment. Even if we do, that's not the end of the story.

Even if we *have* the firmware available, the USB fuzzer is going to have to do a *perfect* job of emulating the firmware download process. This means correctly invoking either `adapter->if_ops.dnld_fw(adapter, &fw)` or `mwifiex_dnld_fw(adapter, &fw)`. And then it gets even trickier.

After the firmware is downloaded, `mwifiex_init_fw(adapter)` is called. *This* is where it gets interesting because this is where the driver actually *talks* to the device. It sends commands and, critically, *expects responses*. If the USB fuzzer isn't able to provide valid responses to these initialization commands, `mwifiex_init_fw` is going to fail. That would stop the driver from working.

I need to dive into `mwifiex_init_fw` to see what those specific commands are and what kind of responses the device expects. This is the crucial area to investigate to identify potential fuzzing targets.

{
  "Expression": "mwifiex_init_fw"
}

{
  "Output": "drivers/net/wireless/marvell/mwifiex/init.c=417=int mwifiex_init_lock_list(struct mwifiex_adapter *adapter)\n--\ndrivers/net/wireless/marvell/mwifiex/init.c-484- */\ndrivers/net/wireless/marvell/mwifiex/init.c:485:int mwifiex_init_fw(struct mwifiex_adapter *adapter)\ndrivers/net/wireless/marvell/mwifiex/init.c-486-{\n--\ndrivers/net/wireless/marvell/mwifiex/main.c=535=static int _mwifiex_fw_dpc(const struct firmware *firmware, void *context)\n--\ndrivers/net/wireless/marvell/mwifiex/main.c-579-\ndrivers/net/wireless/marvell/mwifiex/main.c:580:\tret = mwifiex_init_fw(adapter);\ndrivers/net/wireless/marvell/mwifiex/main.c-581-\tif (ret == -1)\n--\ndrivers/net/wireless/marvell/mwifiex/main.h=1056=void mwifiex_free_priv(struct mwifiex_private *priv);\ndrivers/net/wireless/marvell/mwifiex/main.h-1057-\ndrivers/net/wireless/marvell/mwifiex/main.h:1058:int mwifiex_init_fw(struct mwifiex_adapter *adapter);\ndrivers/net/wireless/marvell/mwifiex/main.h-1059-\n"
}

gemini-3.1-pro-preview

null

null

							input: 7579
							output: 45
							thoughts: 13
						

Okay, let's dive into `mwifiex_init_fw`. I need to get a clear understanding of this function's purpose within the broader driver context. My immediate thought is, what are the key steps involved in initializing the firmware for the Marvell Wi-Fi adapter? This function is clearly critical, as the name suggests it handles firmware initialization, which is a foundational step for any hardware driver. I'm expecting this function will allocate resources, load the firmware image, likely configure some hardware registers, and handle any necessary error checking. I'm also anticipating it'll interact with some of the more general hardware interface functions. Time to dig in and see how well my assumptions align with the implementation details.

{
  "File": "drivers/net/wireless/marvell/mwifiex/init.c",
  "FirstLine": 480,
  "LineCount": 100
}

{
  "Contents": " 480:\t *      - Initialize the adapter structure\n 481:\t *      - Initialize the private structure\n 482:\t *      - Add BSS priority tables to the adapter structure\n 483:\t *      - For each interface, send the init commands to firmware\n 484:\t */\n 485:\tint mwifiex_init_fw(struct mwifiex_adapter *adapter)\n 486:\t{\n 487:\t\tint ret;\n 488:\t\tstruct mwifiex_private *priv;\n 489:\t\tu8 i, first_sta = true;\n 490:\t\n 491:\t\tadapter-\u003ehw_status = MWIFIEX_HW_STATUS_INITIALIZING;\n 492:\t\n 493:\t\t/* Allocate memory for member of adapter structure */\n 494:\t\tret = mwifiex_allocate_adapter(adapter);\n 495:\t\tif (ret)\n 496:\t\t\treturn -1;\n 497:\t\n 498:\t\t/* Initialize adapter structure */\n 499:\t\tmwifiex_init_adapter(adapter);\n 500:\t\n 501:\t\tfor (i = 0; i \u003c adapter-\u003epriv_num; i++) {\n 502:\t\t\tpriv = adapter-\u003epriv[i];\n 503:\t\n 504:\t\t\t/* Initialize private structure */\n 505:\t\t\tret = mwifiex_init_priv(priv);\n 506:\t\t\tif (ret)\n 507:\t\t\t\treturn -1;\n 508:\t\t}\n 509:\t\tif (adapter-\u003emfg_mode) {\n 510:\t\t\tadapter-\u003ehw_status = MWIFIEX_HW_STATUS_READY;\n 511:\t\t} else {\n 512:\t\t\tfor (i = 0; i \u003c adapter-\u003epriv_num; i++) {\n 513:\t\t\t\tret = mwifiex_sta_init_cmd(adapter-\u003epriv[i],\n 514:\t\t\t\t\t\t\t   first_sta);\n 515:\t\t\t\tif (ret == -1)\n 516:\t\t\t\t\treturn -1;\n 517:\t\n 518:\t\t\t\tfirst_sta = false;\n 519:\t\t\t}\n 520:\t\t}\n 521:\t\n 522:\t\tspin_lock_bh(\u0026adapter-\u003ecmd_pending_q_lock);\n 523:\t\tWARN_ON(!list_empty(\u0026adapter-\u003ecmd_pending_q));\n 524:\t\tspin_unlock_bh(\u0026adapter-\u003ecmd_pending_q_lock);\n 525:\t\n 526:\t\tadapter-\u003ehw_status = MWIFIEX_HW_STATUS_READY;\n 527:\t\n 528:\t\tif (adapter-\u003eif_ops.init_fw_port)\n 529:\t\t\tadapter-\u003eif_ops.init_fw_port(adapter);\n 530:\t\n 531:\t\treturn 0;\n 532:\t}\n 533:\t\n 534:\t/*\n 535:\t * This function deletes the BSS priority tables.\n 536:\t *\n 537:\t * The function traverses through all the allocated BSS priority nodes\n 538:\t * in every BSS priority table and frees them.\n 539:\t */\n 540:\tstatic void mwifiex_delete_bss_prio_tbl(struct mwifiex_private *priv)\n 541:\t{\n 542:\t\tint i;\n 543:\t\tstruct mwifiex_adapter *adapter = priv-\u003eadapter;\n 544:\t\tstruct mwifiex_bss_prio_node *bssprio_node, *tmp_node;\n 545:\t\tstruct list_head *head;\n 546:\t\tspinlock_t *lock; /* bss priority lock */\n 547:\t\n 548:\t\tfor (i = 0; i \u003c adapter-\u003epriv_num; ++i) {\n 549:\t\t\thead = \u0026adapter-\u003ebss_prio_tbl[i].bss_prio_head;\n 550:\t\t\tlock = \u0026adapter-\u003ebss_prio_tbl[i].bss_prio_lock;\n 551:\t\t\tmwifiex_dbg(adapter, INFO,\n 552:\t\t\t\t    \"info: delete BSS priority table,\\t\"\n 553:\t\t\t\t    \"bss_type = %d, bss_num = %d, i = %d,\\t\"\n 554:\t\t\t\t    \"head = %p\\n\",\n 555:\t\t\t\t    priv-\u003ebss_type, priv-\u003ebss_num, i, head);\n 556:\t\n 557:\t\t\t{\n 558:\t\t\t\tspin_lock_bh(lock);\n 559:\t\t\t\tlist_for_each_entry_safe(bssprio_node, tmp_node, head,\n 560:\t\t\t\t\t\t\t list) {\n 561:\t\t\t\t\tif (bssprio_node-\u003epriv == priv) {\n 562:\t\t\t\t\t\tmwifiex_dbg(adapter, INFO,\n 563:\t\t\t\t\t\t\t    \"info: Delete\\t\"\n 564:\t\t\t\t\t\t\t    \"node %p, next = %p\\n\",\n 565:\t\t\t\t\t\t\t    bssprio_node, tmp_node);\n 566:\t\t\t\t\t\tlist_del(\u0026bssprio_node-\u003elist);\n 567:\t\t\t\t\t\tkfree(bssprio_node);\n 568:\t\t\t\t\t}\n 569:\t\t\t\t}\n 570:\t\t\t\tspin_unlock_bh(lock);\n 571:\t\t\t}\n 572:\t\t}\n 573:\t}\n 574:\t\n 575:\t/*\n 576:\t * This function frees the private structure, including cleans\n 577:\t * up the TX and RX queues and frees the BSS priority tables.\n 578:\t */\n 579:\tvoid mwifiex_free_priv(struct mwifiex_private *priv)\n"
}

gemini-3.1-pro-preview

null

null

							input: 9298
							output: 23
							thoughts: 51
						

**Analyzing the Firmware Initialization Process**

Okay, so I'm looking at this initialization routine, and it seems the critical part is this `mwifiex_sta_init_cmd` function. It looks like that's the point where we're actually pushing commands down to the firmware. Makes sense; that's where the rubber meets the road, so to speak.

My initial concern is, if that fails – if `mwifiex_sta_init_cmd` hits a snag – the entire initialization process bombs out with a return code of -1 from `mwifiex_init_fw`. So, the failure of the command to execute is the single point of failure.

Given that, I need to focus my attention, right now, on understanding exactly what `mwifiex_sta_init_cmd` is doing and what its failure modes are. We have to understand this function completely, because it dictates the success or failure of the entire process. No room for ambiguity here. Let's dig in and figure out why this might fail.

{
  "Expression": "mwifiex_sta_init_cmd"
}

{
  "Output": "drivers/net/wireless/marvell/mwifiex/cfg80211.c=1083=mwifiex_change_vif_to_p2p(struct net_device *dev,\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-1129-\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c:1130:\tif (mwifiex_sta_init_cmd(priv, false))\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-1131-\t\treturn -1;\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c=1137=mwifiex_change_vif_to_sta_adhoc(struct net_device *dev,\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-1170-\t\treturn -1;\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c:1171:\tif (mwifiex_sta_init_cmd(priv, false))\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-1172-\t\treturn -1;\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c=1178=mwifiex_change_vif_to_ap(struct net_device *dev,\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-1207-\t\treturn -1;\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c:1208:\tif (mwifiex_sta_init_cmd(priv, false))\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-1209-\t\treturn -1;\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c=2980=struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,\n--\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-3116-\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c:3117:\t\tret = mwifiex_sta_init_cmd(priv, false);\ndrivers/net/wireless/marvell/mwifiex/cfg80211.c-3118-\t\tif (ret)\n--\ndrivers/net/wireless/marvell/mwifiex/init.c=485=int mwifiex_init_fw(struct mwifiex_adapter *adapter)\n--\ndrivers/net/wireless/marvell/mwifiex/init.c-512-\t\tfor (i = 0; i \u003c adapter-\u003epriv_num; i++) {\ndrivers/net/wireless/marvell/mwifiex/init.c:513:\t\t\tret = mwifiex_sta_init_cmd(adapter-\u003epriv[i],\ndrivers/net/wireless/marvell/mwifiex/init.c-514-\t\t\t\t\t\t   first_sta);\n--\ndrivers/net/wireless/marvell/mwifiex/main.h=1152=void mwifiex_process_uap_txpd(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/main.h-1153-\t\t\t      struct sk_buff *skb);\ndrivers/net/wireless/marvell/mwifiex/main.h:1154:int mwifiex_sta_init_cmd(struct mwifiex_private *, u8 first_sta);\ndrivers/net/wireless/marvell/mwifiex/main.h-1155-int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd,\n--\ndrivers/net/wireless/marvell/mwifiex/sta_cmd.c=2033=int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,\n--\ndrivers/net/wireless/marvell/mwifiex/sta_cmd.c-2353- */\ndrivers/net/wireless/marvell/mwifiex/sta_cmd.c:2354:int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)\ndrivers/net/wireless/marvell/mwifiex/sta_cmd.c-2355-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 10744
							output: 48
							thoughts: 23
						

Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person:

**Analyzing `mwifiex_sta_init_cmd`'s Command and Reply Handling**

Okay, so I'm digging into `mwifiex_sta_init_cmd`. My primary concern right now is the command flow. Specifically, I need to understand if this function initiates command transmission to the hardware and then patiently waits for a response from the device. Are we dealing with a synchronous or asynchronous model here? Does it use some kind of internal mechanism to track the command ID and correlate it with the eventual reply, or is it doing something more low-level? I'm looking for clues in the code regarding how it handles potential timeouts, error conditions if no reply is received within a reasonable timeframe, or if it does some clever interrupt or polling setup. Also, I'm checking if it correctly sets flags to handle command completion and reply signaling. The goal is to see if its implemented in a clean way or if I have to make modifications.

{
  "File": "drivers/net/wireless/marvell/mwifiex/sta_cmd.c",
  "FirstLine": 2350,
  "LineCount": 100
}

{
  "Contents": "2350:\t *      - Set AMSDU aggregation control\n2351:\t *      - Set 11d control\n2352:\t *      - Set MAC control (this must be the last command to initialize firmware)\n2353:\t */\n2354:\tint mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)\n2355:\t{\n2356:\t\tstruct mwifiex_adapter *adapter = priv-\u003eadapter;\n2357:\t\tint ret;\n2358:\t\tstruct mwifiex_ds_11n_amsdu_aggr_ctrl amsdu_aggr_ctrl;\n2359:\t\tstruct mwifiex_ds_auto_ds auto_ds;\n2360:\t\tenum state_11d_t state_11d;\n2361:\t\tstruct mwifiex_ds_11n_tx_cfg tx_cfg;\n2362:\t\tu8 sdio_sp_rx_aggr_enable;\n2363:\t\tu16 packet_aggr_enable;\n2364:\t\tint data;\n2365:\t\n2366:\t\tif (first_sta) {\n2367:\t\t\tif (priv-\u003eadapter-\u003eiface_type == MWIFIEX_PCIE) {\n2368:\t\t\t\tret = mwifiex_send_cmd(priv,\n2369:\t\t\t\t\t\t       HostCmd_CMD_PCIE_DESC_DETAILS,\n2370:\t\t\t\t\t\t       HostCmd_ACT_GEN_SET, 0, NULL,\n2371:\t\t\t\t\t\t       true);\n2372:\t\t\t\tif (ret)\n2373:\t\t\t\t\treturn -1;\n2374:\t\t\t}\n2375:\t\n2376:\t\t\tret = mwifiex_send_cmd(priv, HostCmd_CMD_FUNC_INIT,\n2377:\t\t\t\t\t       HostCmd_ACT_GEN_SET, 0, NULL, true);\n2378:\t\t\tif (ret)\n2379:\t\t\t\treturn -1;\n2380:\t\n2381:\t\t\t/* Download calibration data to firmware.\n2382:\t\t\t * The cal-data can be read from device tree and/or\n2383:\t\t\t * a configuration file and downloaded to firmware.\n2384:\t\t\t */\n2385:\t\t\tif (adapter-\u003edt_node) {\n2386:\t\t\t\tif (of_property_read_u32(adapter-\u003edt_node,\n2387:\t\t\t\t\t\t\t \"marvell,wakeup-pin\",\n2388:\t\t\t\t\t\t\t \u0026data) == 0) {\n2389:\t\t\t\t\tpr_debug(\"Wakeup pin = 0x%x\\n\", data);\n2390:\t\t\t\t\tadapter-\u003ehs_cfg.gpio = data;\n2391:\t\t\t\t}\n2392:\t\n2393:\t\t\t\tmwifiex_dnld_dt_cfgdata(priv, adapter-\u003edt_node,\n2394:\t\t\t\t\t\t\t\"marvell,caldata\");\n2395:\t\t\t}\n2396:\t\n2397:\t\t\tif (adapter-\u003ecal_data) {\n2398:\t\t\t\tmwifiex_send_cmd(priv, HostCmd_CMD_CFG_DATA,\n2399:\t\t\t\t\t\t HostCmd_ACT_GEN_SET, 0, NULL, true);\n2400:\t\t\t\trelease_firmware(adapter-\u003ecal_data);\n2401:\t\t\t\tadapter-\u003ecal_data = NULL;\n2402:\t\t\t}\n2403:\t\n2404:\t\n2405:\t\t\t/* Read MAC address from HW */\n2406:\t\t\tret = mwifiex_send_cmd(priv, HostCmd_CMD_GET_HW_SPEC,\n2407:\t\t\t\t\t       HostCmd_ACT_GEN_GET, 0, NULL, true);\n2408:\t\t\tif (ret)\n2409:\t\t\t\treturn -1;\n2410:\t\n2411:\t\t\t/** Set SDIO Single Port RX Aggr Info */\n2412:\t\t\tif (priv-\u003eadapter-\u003eiface_type == MWIFIEX_SDIO \u0026\u0026\n2413:\t\t\t    ISSUPP_SDIO_SPA_ENABLED(priv-\u003eadapter-\u003efw_cap_info) \u0026\u0026\n2414:\t\t\t    !priv-\u003eadapter-\u003ehost_disable_sdio_rx_aggr) {\n2415:\t\t\t\tsdio_sp_rx_aggr_enable = true;\n2416:\t\t\t\tret = mwifiex_send_cmd(priv,\n2417:\t\t\t\t\t\t       HostCmd_CMD_SDIO_SP_RX_AGGR_CFG,\n2418:\t\t\t\t\t\t       HostCmd_ACT_GEN_SET, 0,\n2419:\t\t\t\t\t\t       \u0026sdio_sp_rx_aggr_enable,\n2420:\t\t\t\t\t\t       true);\n2421:\t\t\t\tif (ret) {\n2422:\t\t\t\t\tmwifiex_dbg(priv-\u003eadapter, ERROR,\n2423:\t\t\t\t\t\t    \"error while enabling SP aggregation..disable it\");\n2424:\t\t\t\t\tadapter-\u003esdio_rx_aggr_enable = false;\n2425:\t\t\t\t}\n2426:\t\t\t}\n2427:\t\n2428:\t\t\t/* Reconfigure tx buf size */\n2429:\t\t\tret = mwifiex_send_cmd(priv, HostCmd_CMD_RECONFIGURE_TX_BUFF,\n2430:\t\t\t\t\t       HostCmd_ACT_GEN_SET, 0,\n2431:\t\t\t\t\t       \u0026priv-\u003eadapter-\u003etx_buf_size, true);\n2432:\t\t\tif (ret)\n2433:\t\t\t\treturn -1;\n2434:\t\n2435:\t\t\tif (priv-\u003ebss_type != MWIFIEX_BSS_TYPE_UAP) {\n2436:\t\t\t\t/* Enable IEEE PS by default */\n2437:\t\t\t\tpriv-\u003eadapter-\u003eps_mode = MWIFIEX_802_11_POWER_MODE_PSP;\n2438:\t\t\t\tret = mwifiex_send_cmd(priv,\n2439:\t\t\t\t\t\t       HostCmd_CMD_802_11_PS_MODE_ENH,\n2440:\t\t\t\t\t\t       EN_AUTO_PS, BITMAP_STA_PS, NULL,\n2441:\t\t\t\t\t\t       true);\n2442:\t\t\t\tif (ret)\n2443:\t\t\t\t\treturn -1;\n2444:\t\t\t}\n2445:\t\n2446:\t\t\tif (drcs) {\n2447:\t\t\t\tadapter-\u003edrcs_enabled = true;\n2448:\t\t\t\tif (ISSUPP_DRCS_ENABLED(adapter-\u003efw_cap_info))\n2449:\t\t\t\t\tret = mwifiex_send_cmd(priv,\n"
}

gemini-3.1-pro-preview

null

null

							input: 12719
							output: 17
							thoughts: 114
						

**Analyzing Potential `mwifiex` Vulnerabilities with Syzkaller**

Okay, so `mwifiex_send_cmd` with that `true` argument? That means it *absolutely* waits for a response. No response, and it's either timing out or just plain failing. That's a key point. Now, the USB fuzzer...right, I remember that. It *can* provide responses if it knows the protocol, but usually, it's just spewing out garbage data. So, the question is, has syzkaller even been set up to effectively fuzz `mwifiex`? That's what I need to figure out. I'm going to quickly check for any existing syzkaller bug reports specifically related to `mwifiex`. That would be a good starting point to establish the extent of existing coverage.

{
  "Expression": "mwifiex"
}

{
  "Output": "\nFull output is too long, showing 500 out of 18577 lines.\nUse more precise expression if possible.\n\nMAINTAINERS=15736=S:\tOdd Fixes\nMAINTAINERS:15737:F:\tdrivers/net/wireless/marvell/mwifiex/\nMAINTAINERS-15738-\n--\narch/arm/boot/dts/rockchip/rk3288-veyron-jerry.dts=43=\u0026sdio0 {\n--\narch/arm/boot/dts/rockchip/rk3288-veyron-jerry.dts-46-\narch/arm/boot/dts/rockchip/rk3288-veyron-jerry.dts:47:\tmwifiex: wifi@1 {\narch/arm/boot/dts/rockchip/rk3288-veyron-jerry.dts-48-\t\tcompatible = \"marvell,sd8897\";\n--\narch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi=285=\u0026usdhc1 {\n--\narch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi-302-\narch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi:303:\tmwifiex: wifi@1 {\narch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi-304-\t\tcompatible = \"marvell,sd8997\";\n--\narch/arm64/boot/dts/mediatek/mt8173-elm.dtsi=412=\u0026mmc3 {\n--\narch/arm64/boot/dts/mediatek/mt8173-elm.dtsi-432-\narch/arm64/boot/dts/mediatek/mt8173-elm.dtsi:433:\tmwifiex: wifi@1 {\narch/arm64/boot/dts/mediatek/mt8173-elm.dtsi-434-\t\tcompatible = \"marvell,sd8897\";\n--\ndrivers/net/wireless/marvell/Kconfig=16=source \"drivers/net/wireless/marvell/libertas_tf/Kconfig\"\ndrivers/net/wireless/marvell/Kconfig:17:source \"drivers/net/wireless/marvell/mwifiex/Kconfig\"\ndrivers/net/wireless/marvell/Kconfig-18-\n--\ndrivers/net/wireless/marvell/Makefile=4=obj-$(CONFIG_LIBERTAS_THINFIRM)\t+= libertas_tf/\ndrivers/net/wireless/marvell/Makefile:5:obj-$(CONFIG_MWIFIEX)\t+= mwifiex/\ndrivers/net/wireless/marvell/Makefile-6-\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c=42=static u16\ndrivers/net/wireless/marvell/mwifiex/11ac.c:43:mwifiex_convert_mcsmap_to_maxrate(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.c-44-\t\t\t\t  u8 bands, u16 mcs_map)\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-48-\tu32 usr_vht_cap_info = 0;\ndrivers/net/wireless/marvell/mwifiex/11ac.c:49:\tstruct mwifiex_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-50-\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c=85=static void\ndrivers/net/wireless/marvell/mwifiex/11ac.c:86:mwifiex_fill_vht_cap_info(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.c-87-\t\t\t  struct ieee80211_vht_cap *vht_cap, u8 bands)\ndrivers/net/wireless/marvell/mwifiex/11ac.c-88-{\ndrivers/net/wireless/marvell/mwifiex/11ac.c:89:\tstruct mwifiex_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-90-\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-98-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:99:void mwifiex_fill_vht_cap_tlv(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.c-100-\t\t\t      struct ieee80211_vht_cap *vht_cap, u8 bands)\ndrivers/net/wireless/marvell/mwifiex/11ac.c-101-{\ndrivers/net/wireless/marvell/mwifiex/11ac.c:102:\tstruct mwifiex_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-103-\tu16 mcs_map_user, mcs_map_resp, mcs_map_result;\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-106-\t/* Fill VHT cap info */\ndrivers/net/wireless/marvell/mwifiex/11ac.c:107:\tmwifiex_fill_vht_cap_info(priv, vht_cap, bands);\ndrivers/net/wireless/marvell/mwifiex/11ac.c-108-\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-128-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:129:\ttmp = mwifiex_convert_mcsmap_to_maxrate(priv, bands, mcs_map_result);\ndrivers/net/wireless/marvell/mwifiex/11ac.c-130-\tvht_cap-\u003esupp_mcs.rx_highest = cpu_to_le16(tmp);\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-150-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:151:\ttmp = mwifiex_convert_mcsmap_to_maxrate(priv, bands, mcs_map_result);\ndrivers/net/wireless/marvell/mwifiex/11ac.c-152-\tvht_cap-\u003esupp_mcs.tx_highest = cpu_to_le16(tmp);\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-156-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:157:int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.c:158:\t\t\t     struct mwifiex_bssdescriptor *bss_desc,\ndrivers/net/wireless/marvell/mwifiex/11ac.c-159-\t\t\t     u8 **buffer)\ndrivers/net/wireless/marvell/mwifiex/11ac.c-160-{\ndrivers/net/wireless/marvell/mwifiex/11ac.c:161:\tstruct mwifiex_ie_types_vhtcap *vht_cap;\ndrivers/net/wireless/marvell/mwifiex/11ac.c:162:\tstruct mwifiex_ie_types_oper_mode_ntf *oper_ntf;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-163-\tstruct ieee_types_oper_mode_ntf *ieee_oper_ntf;\ndrivers/net/wireless/marvell/mwifiex/11ac.c:164:\tstruct mwifiex_ie_types_vht_oper *vht_op;\ndrivers/net/wireless/marvell/mwifiex/11ac.c:165:\tstruct mwifiex_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-166-\tu8 supp_chwd_set;\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-176-\tif (bss_desc-\u003ebcn_vht_cap) {\ndrivers/net/wireless/marvell/mwifiex/11ac.c:177:\t\tvht_cap = (struct mwifiex_ie_types_vhtcap *)*buffer;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-178-\t\tmemset(vht_cap, 0, sizeof(*vht_cap));\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-181-\t\t\t\tcpu_to_le16(sizeof(struct ieee80211_vht_cap));\ndrivers/net/wireless/marvell/mwifiex/11ac.c:182:\t\tmemcpy((u8 *)vht_cap + sizeof(struct mwifiex_ie_types_header),\ndrivers/net/wireless/marvell/mwifiex/11ac.c-183-\t\t       (u8 *)bss_desc-\u003ebcn_vht_cap,\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-185-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:186:\t\tmwifiex_fill_vht_cap_tlv(priv, \u0026vht_cap-\u003evht_cap,\ndrivers/net/wireless/marvell/mwifiex/11ac.c-187-\t\t\t\t\t bss_desc-\u003ebss_band);\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-194-\t\tif (priv-\u003ebss_mode == NL80211_IFTYPE_STATION) {\ndrivers/net/wireless/marvell/mwifiex/11ac.c:195:\t\t\tvht_op = (struct mwifiex_ie_types_vht_oper *)*buffer;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-196-\t\t\tmemset(vht_op, 0, sizeof(*vht_op));\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-199-\t\t\tvht_op-\u003eheader.len  = cpu_to_le16(sizeof(*vht_op) -\ndrivers/net/wireless/marvell/mwifiex/11ac.c:200:\t\t\t\t      sizeof(struct mwifiex_ie_types_header));\ndrivers/net/wireless/marvell/mwifiex/11ac.c-201-\t\t\tmemcpy((u8 *)vht_op +\ndrivers/net/wireless/marvell/mwifiex/11ac.c:202:\t\t\t\tsizeof(struct mwifiex_ie_types_header),\ndrivers/net/wireless/marvell/mwifiex/11ac.c-203-\t\t\t       (u8 *)bss_desc-\u003ebcn_vht_oper,\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-252-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:253:int mwifiex_cmd_11ac_cfg(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.c-254-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/marvell/mwifiex/11ac.c:255:\t\t\t struct mwifiex_11ac_vht_cfg *cfg)\ndrivers/net/wireless/marvell/mwifiex/11ac.c-256-{\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-272-/* This function initializes the BlockACK setup information for given\ndrivers/net/wireless/marvell/mwifiex/11ac.c:273: * mwifiex_private structure for 11ac enabled networks.\ndrivers/net/wireless/marvell/mwifiex/11ac.c-274- */\ndrivers/net/wireless/marvell/mwifiex/11ac.c:275:void mwifiex_set_11ac_ba_params(struct mwifiex_private *priv)\ndrivers/net/wireless/marvell/mwifiex/11ac.c-276-{\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-293-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:294:bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv)\ndrivers/net/wireless/marvell/mwifiex/11ac.c-295-{\ndrivers/net/wireless/marvell/mwifiex/11ac.c:296:\tstruct mwifiex_bssdescriptor *bss_desc;\ndrivers/net/wireless/marvell/mwifiex/11ac.c-297-\tstruct ieee80211_vht_operation *vht_oper;\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.c-310-\ndrivers/net/wireless/marvell/mwifiex/11ac.c:311:u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,\ndrivers/net/wireless/marvell/mwifiex/11ac.c-312-\t\t\t\t u32 pri_chan, u8 chan_bw)\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.h=14=enum vht_cfg_misc_config {\n--\ndrivers/net/wireless/marvell/mwifiex/11ac.h-24-\ndrivers/net/wireless/marvell/mwifiex/11ac.h:25:int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.h:26:\t\t\t\tstruct mwifiex_bssdescriptor *bss_desc,\ndrivers/net/wireless/marvell/mwifiex/11ac.h-27-\t\t\t\tu8 **buffer);\ndrivers/net/wireless/marvell/mwifiex/11ac.h:28:int mwifiex_cmd_11ac_cfg(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.h-29-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/marvell/mwifiex/11ac.h:30:\t\t\t struct mwifiex_11ac_vht_cfg *cfg);\ndrivers/net/wireless/marvell/mwifiex/11ac.h:31:void mwifiex_fill_vht_cap_tlv(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11ac.h-32-\t\t\t      struct ieee80211_vht_cap *vht_cap, u8 bands);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-11-\ndrivers/net/wireless/marvell/mwifiex/11h.c:12:void mwifiex_init_11h_params(struct mwifiex_private *priv)\ndrivers/net/wireless/marvell/mwifiex/11h.c-13-{\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-17-\ndrivers/net/wireless/marvell/mwifiex/11h.c:18:inline int mwifiex_is_11h_active(struct mwifiex_private *priv)\ndrivers/net/wireless/marvell/mwifiex/11h.c-19-{\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c=25=static void\ndrivers/net/wireless/marvell/mwifiex/11h.c:26:mwifiex_11h_process_infra_join(struct mwifiex_private *priv, u8 **buffer,\ndrivers/net/wireless/marvell/mwifiex/11h.c:27:\t\t\t       struct mwifiex_bssdescriptor *bss_desc)\ndrivers/net/wireless/marvell/mwifiex/11h.c-28-{\ndrivers/net/wireless/marvell/mwifiex/11h.c:29:\tstruct mwifiex_ie_types_header *ie_header;\ndrivers/net/wireless/marvell/mwifiex/11h.c:30:\tstruct mwifiex_ie_types_pwr_capability *cap;\ndrivers/net/wireless/marvell/mwifiex/11h.c:31:\tstruct mwifiex_ie_types_local_pwr_constraint *constraint;\ndrivers/net/wireless/marvell/mwifiex/11h.c-32-\tstruct ieee80211_supported_band *sband;\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-38-\ndrivers/net/wireless/marvell/mwifiex/11h.c:39:\tradio_type = mwifiex_band_to_radio_type((u8) bss_desc-\u003ebss_band);\ndrivers/net/wireless/marvell/mwifiex/11h.c-40-\tsband = priv-\u003ewdev.wiphy-\u003ebands[radio_type];\ndrivers/net/wireless/marvell/mwifiex/11h.c-41-\ndrivers/net/wireless/marvell/mwifiex/11h.c:42:\tcap = (struct mwifiex_ie_types_pwr_capability *)*buffer;\ndrivers/net/wireless/marvell/mwifiex/11h.c-43-\tcap-\u003eheader.type = cpu_to_le16(WLAN_EID_PWR_CAPABILITY);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-48-\ndrivers/net/wireless/marvell/mwifiex/11h.c:49:\tconstraint = (struct mwifiex_ie_types_local_pwr_constraint *)*buffer;\ndrivers/net/wireless/marvell/mwifiex/11h.c-50-\tconstraint-\u003eheader.type = cpu_to_le16(WLAN_EID_PWR_CONSTRAINT);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-55-\ndrivers/net/wireless/marvell/mwifiex/11h.c:56:\tie_header = (struct mwifiex_ie_types_header *)*buffer;\ndrivers/net/wireless/marvell/mwifiex/11h.c-57-\tie_header-\u003etype = cpu_to_le16(TLV_TYPE_PASSTHROUGH);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-69-/* Enable or disable the 11h extensions in the firmware */\ndrivers/net/wireless/marvell/mwifiex/11h.c:70:int mwifiex_11h_activate(struct mwifiex_private *priv, bool flag)\ndrivers/net/wireless/marvell/mwifiex/11h.c-71-{\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-77-\ndrivers/net/wireless/marvell/mwifiex/11h.c:78:\treturn mwifiex_send_cmd(priv, HostCmd_CMD_802_11_SNMP_MIB,\ndrivers/net/wireless/marvell/mwifiex/11h.c-79-\t\t\t\tHostCmd_ACT_GEN_SET, DOT11H_I, \u0026enable, true);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-87- */\ndrivers/net/wireless/marvell/mwifiex/11h.c:88:void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,\ndrivers/net/wireless/marvell/mwifiex/11h.c:89:\t\t\t      struct mwifiex_bssdescriptor *bss_desc)\ndrivers/net/wireless/marvell/mwifiex/11h.c-90-{\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-94-\t\t */\ndrivers/net/wireless/marvell/mwifiex/11h.c:95:\t\tmwifiex_11h_activate(priv, true);\ndrivers/net/wireless/marvell/mwifiex/11h.c-96-\t\tpriv-\u003estate_11h.is_11h_active = true;\ndrivers/net/wireless/marvell/mwifiex/11h.c-97-\t\tbss_desc-\u003ecap_info_bitmap |= WLAN_CAPABILITY_SPECTRUM_MGMT;\ndrivers/net/wireless/marvell/mwifiex/11h.c:98:\t\tmwifiex_11h_process_infra_join(priv, buffer, bss_desc);\ndrivers/net/wireless/marvell/mwifiex/11h.c-99-\t} else {\ndrivers/net/wireless/marvell/mwifiex/11h.c-100-\t\t/* Deactivate 11h functions in the firmware */\ndrivers/net/wireless/marvell/mwifiex/11h.c:101:\t\tmwifiex_11h_activate(priv, false);\ndrivers/net/wireless/marvell/mwifiex/11h.c-102-\t\tpriv-\u003estate_11h.is_11h_active = false;\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-110- */\ndrivers/net/wireless/marvell/mwifiex/11h.c:111:void mwifiex_dfs_cac_work_queue(struct work_struct *work)\ndrivers/net/wireless/marvell/mwifiex/11h.c-112-{\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-114-\tstruct delayed_work *delayed_work = to_delayed_work(work);\ndrivers/net/wireless/marvell/mwifiex/11h.c:115:\tstruct mwifiex_private *priv =\ndrivers/net/wireless/marvell/mwifiex/11h.c:116:\t\t\tcontainer_of(delayed_work, struct mwifiex_private,\ndrivers/net/wireless/marvell/mwifiex/11h.c-117-\t\t\t\t     dfs_cac_work);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-120-\tif (priv-\u003ewdev.links[0].cac_started) {\ndrivers/net/wireless/marvell/mwifiex/11h.c:121:\t\tmwifiex_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/marvell/mwifiex/11h.c-122-\t\t\t    \"CAC timer finished; No radar detected\\n\");\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-131- */\ndrivers/net/wireless/marvell/mwifiex/11h.c:132:int mwifiex_cmd_issue_chan_report_request(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11h.c-133-\t\t\t\t\t  struct host_cmd_ds_command *cmd,\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-136-\tstruct host_cmd_ds_chan_rpt_req *cr_req = \u0026cmd-\u003eparams.chan_rpt_req;\ndrivers/net/wireless/marvell/mwifiex/11h.c:137:\tstruct mwifiex_radar_params *radar_params = (void *)data_buf;\ndrivers/net/wireless/marvell/mwifiex/11h.c-138-\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-149-\tif (radar_params-\u003ecac_time_ms)\ndrivers/net/wireless/marvell/mwifiex/11h.c:150:\t\tmwifiex_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/marvell/mwifiex/11h.c-151-\t\t\t    \"11h: issuing DFS Radar check for channel=%d\\n\",\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-153-\telse\ndrivers/net/wireless/marvell/mwifiex/11h.c:154:\t\tmwifiex_dbg(priv-\u003eadapter, MSG, \"cancelling CAC\\n\");\ndrivers/net/wireless/marvell/mwifiex/11h.c-155-\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-158-\ndrivers/net/wireless/marvell/mwifiex/11h.c:159:int mwifiex_stop_radar_detection(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11h.c-160-\t\t\t\t struct cfg80211_chan_def *chandef)\ndrivers/net/wireless/marvell/mwifiex/11h.c-161-{\ndrivers/net/wireless/marvell/mwifiex/11h.c:162:\tstruct mwifiex_radar_params radar_params;\ndrivers/net/wireless/marvell/mwifiex/11h.c-163-\ndrivers/net/wireless/marvell/mwifiex/11h.c:164:\tmemset(\u0026radar_params, 0, sizeof(struct mwifiex_radar_params));\ndrivers/net/wireless/marvell/mwifiex/11h.c-165-\tradar_params.chandef = chandef;\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-167-\ndrivers/net/wireless/marvell/mwifiex/11h.c:168:\treturn mwifiex_send_cmd(priv, HostCmd_CMD_CHAN_REPORT_REQUEST,\ndrivers/net/wireless/marvell/mwifiex/11h.c-169-\t\t\t\tHostCmd_ACT_GEN_SET, 0, \u0026radar_params, true);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-174- */\ndrivers/net/wireless/marvell/mwifiex/11h.c:175:void mwifiex_abort_cac(struct mwifiex_private *priv)\ndrivers/net/wireless/marvell/mwifiex/11h.c-176-{\ndrivers/net/wireless/marvell/mwifiex/11h.c-177-\tif (priv-\u003ewdev.links[0].cac_started) {\ndrivers/net/wireless/marvell/mwifiex/11h.c:178:\t\tif (mwifiex_stop_radar_detection(priv, \u0026priv-\u003edfs_chandef))\ndrivers/net/wireless/marvell/mwifiex/11h.c:179:\t\t\tmwifiex_dbg(priv-\u003eadapter, ERROR,\ndrivers/net/wireless/marvell/mwifiex/11h.c-180-\t\t\t\t    \"failed to stop CAC in FW\\n\");\ndrivers/net/wireless/marvell/mwifiex/11h.c:181:\t\tmwifiex_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/marvell/mwifiex/11h.c-182-\t\t\t    \"Aborting delayed work for CAC.\\n\");\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-193- */\ndrivers/net/wireless/marvell/mwifiex/11h.c:194:int mwifiex_11h_handle_chanrpt_ready(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11h.c-195-\t\t\t\t     struct sk_buff *skb)\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-197-\tstruct host_cmd_ds_chan_rpt_event *rpt_event;\ndrivers/net/wireless/marvell/mwifiex/11h.c:198:\tstruct mwifiex_ie_types_chan_rpt_data *rpt;\ndrivers/net/wireless/marvell/mwifiex/11h.c-199-\tu16 event_len, tlv_len;\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-205-\tif (le32_to_cpu(rpt_event-\u003eresult) != HostCmd_RESULT_OK) {\ndrivers/net/wireless/marvell/mwifiex/11h.c:206:\t\tmwifiex_dbg(priv-\u003eadapter, ERROR,\ndrivers/net/wireless/marvell/mwifiex/11h.c-207-\t\t\t    \"Error in channel report event\\n\");\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-210-\ndrivers/net/wireless/marvell/mwifiex/11h.c:211:\twhile (event_len \u003e= sizeof(struct mwifiex_ie_types_header)) {\ndrivers/net/wireless/marvell/mwifiex/11h.c-212-\t\trpt = (void *)\u0026rpt_event-\u003etlvbuf;\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-217-\t\t\tif (rpt-\u003emap.radar) {\ndrivers/net/wireless/marvell/mwifiex/11h.c:218:\t\t\t\tmwifiex_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/marvell/mwifiex/11h.c-219-\t\t\t\t\t    \"RADAR Detected on channel %d!\\n\",\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-238-/* Handler for radar detected event from FW.*/\ndrivers/net/wireless/marvell/mwifiex/11h.c:239:int mwifiex_11h_handle_radar_detected(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11h.c-240-\t\t\t\t      struct sk_buff *skb)\ndrivers/net/wireless/marvell/mwifiex/11h.c-241-{\ndrivers/net/wireless/marvell/mwifiex/11h.c:242:\tstruct mwifiex_radar_det_event *rdr_event;\ndrivers/net/wireless/marvell/mwifiex/11h.c-243-\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-245-\ndrivers/net/wireless/marvell/mwifiex/11h.c:246:\tmwifiex_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/marvell/mwifiex/11h.c-247-\t\t    \"radar detected; indicating kernel\\n\");\ndrivers/net/wireless/marvell/mwifiex/11h.c:248:\tif (mwifiex_stop_radar_detection(priv, \u0026priv-\u003edfs_chandef))\ndrivers/net/wireless/marvell/mwifiex/11h.c:249:\t\tmwifiex_dbg(priv-\u003eadapter, ERROR,\ndrivers/net/wireless/marvell/mwifiex/11h.c-250-\t\t\t    \"Failed to stop CAC in FW\\n\");\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-252-\t\t\t     GFP_KERNEL);\ndrivers/net/wireless/marvell/mwifiex/11h.c:253:\tmwifiex_dbg(priv-\u003eadapter, MSG, \"regdomain: %d\\n\",\ndrivers/net/wireless/marvell/mwifiex/11h.c-254-\t\t    rdr_event-\u003ereg_domain);\ndrivers/net/wireless/marvell/mwifiex/11h.c:255:\tmwifiex_dbg(priv-\u003eadapter, MSG, \"radar detection type: %d\\n\",\ndrivers/net/wireless/marvell/mwifiex/11h.c-256-\t\t    rdr_event-\u003edet_type);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-265- */\ndrivers/net/wireless/marvell/mwifiex/11h.c:266:void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)\ndrivers/net/wireless/marvell/mwifiex/11h.c-267-{\ndrivers/net/wireless/marvell/mwifiex/11h.c:268:\tstruct mwifiex_uap_bss_param *bss_cfg;\ndrivers/net/wireless/marvell/mwifiex/11h.c-269-\tstruct delayed_work *delayed_work = to_delayed_work(work);\ndrivers/net/wireless/marvell/mwifiex/11h.c:270:\tstruct mwifiex_private *priv =\ndrivers/net/wireless/marvell/mwifiex/11h.c:271:\t\t\tcontainer_of(delayed_work, struct mwifiex_private,\ndrivers/net/wireless/marvell/mwifiex/11h.c-272-\t\t\t\t     dfs_chan_sw_work);\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-275-\tif (!bss_cfg-\u003ebeacon_period) {\ndrivers/net/wireless/marvell/mwifiex/11h.c:276:\t\tmwifiex_dbg(priv-\u003eadapter, ERROR,\ndrivers/net/wireless/marvell/mwifiex/11h.c-277-\t\t\t    \"channel switch: AP already stopped\\n\");\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-280-\ndrivers/net/wireless/marvell/mwifiex/11h.c:281:\tmwifiex_uap_set_channel(priv, bss_cfg, priv-\u003edfs_chandef);\ndrivers/net/wireless/marvell/mwifiex/11h.c-282-\ndrivers/net/wireless/marvell/mwifiex/11h.c:283:\tif (mwifiex_config_start_uap(priv, bss_cfg)) {\ndrivers/net/wireless/marvell/mwifiex/11h.c:284:\t\tmwifiex_dbg(priv-\u003eadapter, ERROR,\ndrivers/net/wireless/marvell/mwifiex/11h.c-285-\t\t\t    \"Failed to start AP after channel switch\\n\");\n--\ndrivers/net/wireless/marvell/mwifiex/11h.c-288-\ndrivers/net/wireless/marvell/mwifiex/11h.c:289:\tmwifiex_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/marvell/mwifiex/11h.c-290-\t\t    \"indicating channel switch completion to kernel\\n\");\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-24- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:25:int mwifiex_fill_cap_info(struct mwifiex_private *priv, u8 radio_type,\ndrivers/net/wireless/marvell/mwifiex/11n.c-26-\t\t\t  struct ieee80211_ht_cap *ht_cap)\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-32-\tif (WARN_ON_ONCE(!sband)) {\ndrivers/net/wireless/marvell/mwifiex/11n.c:33:\t\tmwifiex_dbg(priv-\u003eadapter, ERROR, \"Invalid radio type!\\n\");\ndrivers/net/wireless/marvell/mwifiex/11n.c-34-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-69- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:70:static struct mwifiex_tx_ba_stream_tbl *\ndrivers/net/wireless/marvell/mwifiex/11n.c:71:mwifiex_get_ba_status(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c:72:\t\t      enum mwifiex_ba_status ba_status)\ndrivers/net/wireless/marvell/mwifiex/11n.c-73-{\ndrivers/net/wireless/marvell/mwifiex/11n.c:74:\tstruct mwifiex_tx_ba_stream_tbl *tx_ba_tsr_tbl;\ndrivers/net/wireless/marvell/mwifiex/11n.c-75-\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-95- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:96:int mwifiex_ret_11n_delba(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c-97-\t\t\t  struct host_cmd_ds_command *resp)\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-99-\tint tid;\ndrivers/net/wireless/marvell/mwifiex/11n.c:100:\tstruct mwifiex_tx_ba_stream_tbl *tx_ba_tbl;\ndrivers/net/wireless/marvell/mwifiex/11n.c-101-\tstruct host_cmd_ds_11n_delba *del_ba = \u0026resp-\u003eparams.del_ba;\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-105-\tif (del_ba-\u003edel_result == BA_RESULT_SUCCESS) {\ndrivers/net/wireless/marvell/mwifiex/11n.c:106:\t\tmwifiex_del_ba_tbl(priv, tid, del_ba-\u003epeer_mac_addr,\ndrivers/net/wireless/marvell/mwifiex/11n.c-107-\t\t\t\t   TYPE_DELBA_SENT,\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-109-\ndrivers/net/wireless/marvell/mwifiex/11n.c:110:\t\ttx_ba_tbl = mwifiex_get_ba_status(priv, BA_SETUP_INPROGRESS);\ndrivers/net/wireless/marvell/mwifiex/11n.c-111-\t\tif (tx_ba_tbl)\ndrivers/net/wireless/marvell/mwifiex/11n.c:112:\t\t\tmwifiex_send_addba(priv, tx_ba_tbl-\u003etid,\ndrivers/net/wireless/marvell/mwifiex/11n.c-113-\t\t\t\t\t   tx_ba_tbl-\u003era);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-120-\ndrivers/net/wireless/marvell/mwifiex/11n.c:121:\t\tmwifiex_create_ba_tbl(priv, del_ba-\u003epeer_mac_addr, tid,\ndrivers/net/wireless/marvell/mwifiex/11n.c-122-\t\t\t\t      BA_SETUP_INPROGRESS);\ndrivers/net/wireless/marvell/mwifiex/11n.c-123-\ndrivers/net/wireless/marvell/mwifiex/11n.c:124:\t\ttx_ba_tbl = mwifiex_get_ba_status(priv, BA_SETUP_INPROGRESS);\ndrivers/net/wireless/marvell/mwifiex/11n.c-125-\ndrivers/net/wireless/marvell/mwifiex/11n.c-126-\t\tif (tx_ba_tbl)\ndrivers/net/wireless/marvell/mwifiex/11n.c:127:\t\t\tmwifiex_del_ba_tbl(priv, tx_ba_tbl-\u003etid, tx_ba_tbl-\u003era,\ndrivers/net/wireless/marvell/mwifiex/11n.c-128-\t\t\t\t\t   TYPE_DELBA_SENT, true);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-141- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:142:int mwifiex_ret_11n_addba_req(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c-143-\t\t\t      struct host_cmd_ds_command *resp)\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-146-\tstruct host_cmd_ds_11n_addba_rsp *add_ba_rsp = \u0026resp-\u003eparams.add_ba_rsp;\ndrivers/net/wireless/marvell/mwifiex/11n.c:147:\tstruct mwifiex_tx_ba_stream_tbl *tx_ba_tbl;\ndrivers/net/wireless/marvell/mwifiex/11n.c:148:\tstruct mwifiex_ra_list_tbl *ra_list;\ndrivers/net/wireless/marvell/mwifiex/11n.c-149-\tu16 block_ack_param_set = le16_to_cpu(add_ba_rsp-\u003eblock_ack_param_set);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-156-\ndrivers/net/wireless/marvell/mwifiex/11n.c:157:\ttid_down = mwifiex_wmm_downgrade_tid(priv, tid);\ndrivers/net/wireless/marvell/mwifiex/11n.c:158:\tra_list = mwifiex_wmm_get_ralist_node(priv, tid_down, add_ba_rsp-\u003e\ndrivers/net/wireless/marvell/mwifiex/11n.c-159-\t\tpeer_mac_addr);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-164-\t\t}\ndrivers/net/wireless/marvell/mwifiex/11n.c:165:\t\tmwifiex_del_ba_tbl(priv, tid, add_ba_rsp-\u003epeer_mac_addr,\ndrivers/net/wireless/marvell/mwifiex/11n.c-166-\t\t\t\t   TYPE_DELBA_SENT, true);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-172-\ndrivers/net/wireless/marvell/mwifiex/11n.c:173:\ttx_ba_tbl = mwifiex_get_ba_tbl(priv, tid, add_ba_rsp-\u003epeer_mac_addr);\ndrivers/net/wireless/marvell/mwifiex/11n.c-174-\tif (tx_ba_tbl) {\ndrivers/net/wireless/marvell/mwifiex/11n.c:175:\t\tmwifiex_dbg(priv-\u003eadapter, EVENT, \"info: BA stream complete\\n\");\ndrivers/net/wireless/marvell/mwifiex/11n.c-176-\t\ttx_ba_tbl-\u003eba_status = BA_SETUP_COMPLETE;\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-187-\t} else {\ndrivers/net/wireless/marvell/mwifiex/11n.c:188:\t\tmwifiex_dbg(priv-\u003eadapter, ERROR, \"BA stream not created\\n\");\ndrivers/net/wireless/marvell/mwifiex/11n.c-189-\t}\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-201- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:202:int mwifiex_cmd_recfg_tx_buf(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c-203-\t\t\t     struct host_cmd_ds_command *cmd, int cmd_action,\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-214-\tcase HostCmd_ACT_GEN_SET:\ndrivers/net/wireless/marvell/mwifiex/11n.c:215:\t\tmwifiex_dbg(priv-\u003eadapter, CMD,\ndrivers/net/wireless/marvell/mwifiex/11n.c-216-\t\t\t    \"cmd: set tx_buf=%d\\n\", *buf_size);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-234- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:235:int mwifiex_cmd_amsdu_aggr_ctrl(struct host_cmd_ds_command *cmd,\ndrivers/net/wireless/marvell/mwifiex/11n.c-236-\t\t\t\tint cmd_action,\ndrivers/net/wireless/marvell/mwifiex/11n.c:237:\t\t\t\tstruct mwifiex_ds_11n_amsdu_aggr_ctrl *aa_ctrl)\ndrivers/net/wireless/marvell/mwifiex/11n.c-238-{\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-267- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:268:int mwifiex_cmd_11n_cfg(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c-269-\t\t\tstruct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/marvell/mwifiex/11n.c:270:\t\t\tstruct mwifiex_ds_11n_tx_cfg *txcfg)\ndrivers/net/wireless/marvell/mwifiex/11n.c-271-{\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c=298=int\ndrivers/net/wireless/marvell/mwifiex/11n.c:299:mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c:300:\t\t\t   struct mwifiex_bssdescriptor *bss_desc,\ndrivers/net/wireless/marvell/mwifiex/11n.c-301-\t\t\t   u8 **buffer)\ndrivers/net/wireless/marvell/mwifiex/11n.c-302-{\ndrivers/net/wireless/marvell/mwifiex/11n.c:303:\tstruct mwifiex_ie_types_htcap *ht_cap;\ndrivers/net/wireless/marvell/mwifiex/11n.c:304:\tstruct mwifiex_ie_types_htinfo *ht_info;\ndrivers/net/wireless/marvell/mwifiex/11n.c:305:\tstruct mwifiex_ie_types_chan_list_param_set *chan_list;\ndrivers/net/wireless/marvell/mwifiex/11n.c:306:\tstruct mwifiex_ie_types_2040bssco *bss_co_2040;\ndrivers/net/wireless/marvell/mwifiex/11n.c:307:\tstruct mwifiex_ie_types_extcap *ext_cap;\ndrivers/net/wireless/marvell/mwifiex/11n.c-308-\tint ret_len = 0;\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-315-\ndrivers/net/wireless/marvell/mwifiex/11n.c:316:\tradio_type = mwifiex_band_to_radio_type((u8) bss_desc-\u003ebss_band);\ndrivers/net/wireless/marvell/mwifiex/11n.c-317-\tsband = priv-\u003ewdev.wiphy-\u003ebands[radio_type];\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-319-\tif (bss_desc-\u003ebcn_ht_cap) {\ndrivers/net/wireless/marvell/mwifiex/11n.c:320:\t\tht_cap = (struct mwifiex_ie_types_htcap *) *buffer;\ndrivers/net/wireless/marvell/mwifiex/11n.c:321:\t\tmemset(ht_cap, 0, sizeof(struct mwifiex_ie_types_htcap));\ndrivers/net/wireless/marvell/mwifiex/11n.c-322-\t\tht_cap-\u003eheader.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-324-\t\t\t\tcpu_to_le16(sizeof(struct ieee80211_ht_cap));\ndrivers/net/wireless/marvell/mwifiex/11n.c:325:\t\tmemcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),\ndrivers/net/wireless/marvell/mwifiex/11n.c-326-\t\t       (u8 *)bss_desc-\u003ebcn_ht_cap,\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-328-\ndrivers/net/wireless/marvell/mwifiex/11n.c:329:\t\tmwifiex_fill_cap_info(priv, radio_type, \u0026ht_cap-\u003eht_cap);\ndrivers/net/wireless/marvell/mwifiex/11n.c-330-\t\t/* Update HT40 capability from current channel information */\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-333-\t\t\tu8 radio =\ndrivers/net/wireless/marvell/mwifiex/11n.c:334:\t\t\tmwifiex_band_to_radio_type(bss_desc-\u003ebss_band);\ndrivers/net/wireless/marvell/mwifiex/11n.c-335-\t\t\tint freq =\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-362-\ndrivers/net/wireless/marvell/mwifiex/11n.c:363:\t\t*buffer += sizeof(struct mwifiex_ie_types_htcap);\ndrivers/net/wireless/marvell/mwifiex/11n.c:364:\t\tret_len += sizeof(struct mwifiex_ie_types_htcap);\ndrivers/net/wireless/marvell/mwifiex/11n.c-365-\t}\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-368-\t\tif (priv-\u003ebss_mode == NL80211_IFTYPE_ADHOC) {\ndrivers/net/wireless/marvell/mwifiex/11n.c:369:\t\t\tht_info = (struct mwifiex_ie_types_htinfo *) *buffer;\ndrivers/net/wireless/marvell/mwifiex/11n.c-370-\t\t\tmemset(ht_info, 0,\ndrivers/net/wireless/marvell/mwifiex/11n.c:371:\t\t\t       sizeof(struct mwifiex_ie_types_htinfo));\ndrivers/net/wireless/marvell/mwifiex/11n.c-372-\t\t\tht_info-\u003eheader.type =\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-378-\t\t\tmemcpy((u8 *) ht_info +\ndrivers/net/wireless/marvell/mwifiex/11n.c:379:\t\t\t       sizeof(struct mwifiex_ie_types_header),\ndrivers/net/wireless/marvell/mwifiex/11n.c-380-\t\t\t       (u8 *)bss_desc-\u003ebcn_ht_oper,\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-388-\ndrivers/net/wireless/marvell/mwifiex/11n.c:389:\t\t\t*buffer += sizeof(struct mwifiex_ie_types_htinfo);\ndrivers/net/wireless/marvell/mwifiex/11n.c:390:\t\t\tret_len += sizeof(struct mwifiex_ie_types_htinfo);\ndrivers/net/wireless/marvell/mwifiex/11n.c-391-\t\t}\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-393-\t\tchan_list =\ndrivers/net/wireless/marvell/mwifiex/11n.c:394:\t\t\t(struct mwifiex_ie_types_chan_list_param_set *) *buffer;\ndrivers/net/wireless/marvell/mwifiex/11n.c-395-\t\tmemset(chan_list, 0, struct_size(chan_list, chan_scan_param, 1));\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-397-\t\tchan_list-\u003eheader.len =\ndrivers/net/wireless/marvell/mwifiex/11n.c:398:\t\t\tcpu_to_le16(sizeof(struct mwifiex_chan_scan_param_set));\ndrivers/net/wireless/marvell/mwifiex/11n.c-399-\t\tchan_list-\u003echan_scan_param[0].chan_number =\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-401-\t\tchan_list-\u003echan_scan_param[0].radio_type =\ndrivers/net/wireless/marvell/mwifiex/11n.c:402:\t\t\tmwifiex_band_to_radio_type((u8) bss_desc-\u003ebss_band);\ndrivers/net/wireless/marvell/mwifiex/11n.c-403-\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-416-\tif (bss_desc-\u003ebcn_bss_co_2040) {\ndrivers/net/wireless/marvell/mwifiex/11n.c:417:\t\tbss_co_2040 = (struct mwifiex_ie_types_2040bssco *) *buffer;\ndrivers/net/wireless/marvell/mwifiex/11n.c-418-\t\tmemset(bss_co_2040, 0,\ndrivers/net/wireless/marvell/mwifiex/11n.c:419:\t\t       sizeof(struct mwifiex_ie_types_2040bssco));\ndrivers/net/wireless/marvell/mwifiex/11n.c-420-\t\tbss_co_2040-\u003eheader.type = cpu_to_le16(WLAN_EID_BSS_COEX_2040);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-424-\t\tmemcpy((u8 *) bss_co_2040 +\ndrivers/net/wireless/marvell/mwifiex/11n.c:425:\t\t       sizeof(struct mwifiex_ie_types_header),\ndrivers/net/wireless/marvell/mwifiex/11n.c-426-\t\t       bss_desc-\u003ebcn_bss_co_2040 +\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-429-\ndrivers/net/wireless/marvell/mwifiex/11n.c:430:\t\t*buffer += sizeof(struct mwifiex_ie_types_2040bssco);\ndrivers/net/wireless/marvell/mwifiex/11n.c:431:\t\tret_len += sizeof(struct mwifiex_ie_types_2040bssco);\ndrivers/net/wireless/marvell/mwifiex/11n.c-432-\t}\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-435-\t\thdr = (void *)bss_desc-\u003ebcn_ext_cap;\ndrivers/net/wireless/marvell/mwifiex/11n.c:436:\t\text_cap = (struct mwifiex_ie_types_extcap *) *buffer;\ndrivers/net/wireless/marvell/mwifiex/11n.c:437:\t\tmemset(ext_cap, 0, sizeof(struct mwifiex_ie_types_extcap));\ndrivers/net/wireless/marvell/mwifiex/11n.c-438-\t\text_cap-\u003eheader.type = cpu_to_le16(WLAN_EID_EXT_CAPABILITY);\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-450-\ndrivers/net/wireless/marvell/mwifiex/11n.c:451:\t\t*buffer += sizeof(struct mwifiex_ie_types_extcap) + hdr-\u003elen;\ndrivers/net/wireless/marvell/mwifiex/11n.c:452:\t\tret_len += sizeof(struct mwifiex_ie_types_extcap) + hdr-\u003elen;\ndrivers/net/wireless/marvell/mwifiex/11n.c-453-\t}\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-461- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:462:static int mwifiex_is_tx_ba_stream_ptr_valid(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c:463:\t\t\t\tstruct mwifiex_tx_ba_stream_tbl *tx_tbl_ptr)\ndrivers/net/wireless/marvell/mwifiex/11n.c-464-{\ndrivers/net/wireless/marvell/mwifiex/11n.c:465:\tstruct mwifiex_tx_ba_stream_tbl *tx_ba_tsr_tbl;\ndrivers/net/wireless/marvell/mwifiex/11n.c-466-\n--\ndrivers/net/wireless/marvell/mwifiex/11n.c-480- */\ndrivers/net/wireless/marvell/mwifiex/11n.c:481:void mwifiex_11n_delete_tx_ba_stream_tbl_entry(struct mwifiex_private *priv,\ndrivers/net/wireless/marvell/mwifiex/11n.c:482:\t\t\t\tstruct mwifiex_tx_ba_stream_tbl *tx_ba_tsr_tbl)\ndrivers/net/wireless/marvell/mwifiex/11n.c-483-{\ndrivers/net/wireless/marvell/mwifiex/11n.c-484-\tif (!tx_ba_tsr_tbl \u0026\u0026\ndrivers/net/wireless/marvell/mwifiex/11n.c:485:\t    mwifiex_is_tx_ba_stream_ptr_valid(priv, tx_ba_tsr_tbl))\ndrivers/net/wireless/marvell/mwifiex/11n.c-486-\t\treturn;\ndrivers/net/wireless/marvell/mwifiex/11n.c-487-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 28283
							output: 157
							thoughts: 1109
						

**WorthFuzzing=false: Analyzing a Marvell SDIO Driver Patch**

Okay, so Syzkaller is fuzzing `mwifiex` over USB. My initial thought is that the fuzzer could potentially provide arbitrary USB descriptors and responses, that's fine. But, this particular patch, though, is about a `marvell,invalid-reg-hint-in-rom` device property.

Now, this property is read from the device tree. In a USB-emulated environment, where this fuzzer is running, `adapter->dev` is the USB device. USB devices *usually* don't have device tree nodes unless they're hardcoded on a board, like with a modified device tree in `armada-385-linksys-rango.dts`. Aha! The patch *does* modify this very DTS file, specifically adding the property to an SDIO device on a particular board (`wifi@1` under `&sdhci`).

So, this property is specifically for an SDIO device on a certain ARM board. The critical code path is:

```c
				if (country_code &&
				    !device_property_read_bool(adapter->dev,
							       "marvell,invalid-reg-hint-in-rom") &&
				    regulatory_hint(wiphy, country_code))
```

If the property *isn't* present, which is the default for everything except that specific board, it'll call `regulatory_hint`. The patch is *only* adding a way to *skip* `regulatory_hint` if the property *is* present.

Considering that the fuzzer runs on x86_64 or arm64 generic VMs, the device tree won't have this property set. Therefore, the fuzzer's execution flow won't change. The condition `!device_property_read_bool(...)` will always be `true`, and it will execute `regulatory_hint`.

So, the next question is: Does this patch introduce any functional changes for the fuzzer? No, because it doesn't run with that particular device tree! Even if it did, skipping `regulatory_hint` is a very minor change, avoiding a function call to the regulatory subsystem. Is this even worth fuzzing? It's just adding a device tree property check, a board-specific quirk.

The fuzzing rules state: "Return WorthFuzzing=false if the patch only contains...Code paths that are impossible to reach in virtualized environments like GCE or QEMU."

The code path where `device_property_read_bool` returns `true` is unreachable in a standard QEMU environment because the `marvell,invalid-reg-hint-in-rom` property isn't present, and the fuzzer can't inject it (as far as I know) for USB/SDIO devices. Nope, no way to inject the device tree here. Also, even if it *was* reachable, the functional change is trivial: adding a boolean check.

Double-checking, the patch modifies `Documentation/devicetree/bindings/net/wireless/marvell,sd8787.yaml`, `arch/arm/boot/dts/marvell/armada-385-linksys-rango.dts` and `drivers/net/wireless/marvell/mwifiex/cfg80211.c`. This confirms it's a classic board-specific quirk where it skips `regulatory_hint` when the DT property is there. Because the fuzzer won't have that DT property, the execution flow is identical. Even if reachable, it's just skipping a single function call.

Based on the rules, where I've got "Code paths that are impossible to reach in virtualized environments like GCE or QEMU" and here that's `device_property_read_bool` returning `true`, and because the false branch is the same as the old code, I'm setting `WorthFuzzing=false`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a board-specific quirk for Marvell WiFi devices to skip a regulatory hint if a specific device tree property ('marvell,invalid-reg-hint-in-rom') is present. This property is only added to a specific ARM board's device tree (armada-385-linksys-rango). In virtualized environments like QEMU/GCE where fuzzing occurs, this device tree property will not be present, meaning the execution flow will be identical to the pre-patch behavior. The new code path (skipping the regulatory hint) is unreachable during standard fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a board-specific quirk for Marvell WiFi devices to skip a regulatory hint if a specific device tree property ('marvell,invalid-reg-hint-in-rom') is present. This property is only added to a specific ARM board's device tree (armada-385-linksys-rango). In virtualized environments like QEMU/GCE where fuzzing occurs, this device tree property will not be present, meaning the execution flow will be identical to the pre-patch behavior. The new code path (skipping the regulatory hint) is unreachable during standard fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null