| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/14 06:41 | flow | patch-triage |
1mArgs:null Results: {
"EnableConfigs": [
"RTW88",
"RTW88_8822BU"
],
"FocusSymbols": [
"rtw_tx",
"rtw_tx_work"
],
"KMSANReasoning": "The patch modifies the queue selection logic for transmitted packets in the Realtek rtw88 USB driver. It checks a flag in the `ieee80211_tx_info` struct (stored in `skb-\u003ecb`) to determine the appropriate queue for broadcast/multicast packets. The `skb-\u003ecb` field is fully initialized by the mac80211 subsystem before the packet is passed to the driver for transmission. There is no risk of reading uninitialized memory, nor does this patch introduce any new allocations or structures that could leak uninitialized data to user space or hardware. The issue is a purely logical bug in queue assignment, which does not require KMSAN to detect. Standard testing or KASAN is sufficient for general memory safety, and KMSAN is not applicable here.",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies the TX queue selection logic for broadcast/multicast packets in the Realtek rtw88 USB driver. This is a functional change in the driver's TX path, reachable via mac80211 when sending packets over a USB interface.",
"WorthFuzzing": true
} |
| 1/1 | 2026/08/14 06:41 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 5fb2f6e61b2568dc2c3d097823ff2886a95a9779\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Aug 14 06:41:41 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c\nindex 64e1c3420e0a8..43b9cdb4a79b0 100644\n--- a/drivers/net/wireless/realtek/rtw88/usb.c\n+++ b/drivers/net/wireless/realtek/rtw88/usb.c\n@@ -560,6 +560,7 @@ static int rtw_usb_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)\n static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\n {\n \tstruct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb-\u003edata;\n+\tstruct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);\n \t__le16 fc = hdr-\u003eframe_control;\n \tu8 qsel;\n \n@@ -567,7 +568,8 @@ static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\n \t\tqsel = TX_DESC_QSEL_MGMT;\n \telse if (is_broadcast_ether_addr(hdr-\u003eaddr1) ||\n \t\t is_multicast_ether_addr(hdr-\u003eaddr1))\n-\t\tqsel = TX_DESC_QSEL_HIGH;\n+\t\tqsel = (info-\u003eflags \u0026 IEEE80211_TX_CTL_SEND_AFTER_DTIM) ?\n+\t\t TX_DESC_QSEL_HIGH : skb-\u003epriority;\n \telse if (skb_get_queue_mapping(skb) \u003c= IEEE80211_AC_BK)\n \t\tqsel = skb-\u003epriority;\n \telse\n"
} |
| 2/1 | 2026/08/14 06:41 | agent | patch-evaluator |
1mModel:best-expensive Args: null Results: {
"EnableConfigs": [
"RTW88",
"RTW88_8822BU"
],
"FocusSymbols": [
"rtw_tx",
"rtw_tx_work"
],
"Reasoning": "The patch modifies the TX queue selection logic for broadcast/multicast packets in the Realtek rtw88 USB driver. This is a functional change in the driver's TX path, reachable via mac80211 when sending packets over a USB interface.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 5fb2f6e61b2568dc2c3d097823ff2886a95a9779
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Aug 14 06:41:41 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 64e1c3420e0a8..43b9cdb4a79b0 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -560,6 +560,7 @@ static int rtw_usb_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)
static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)
{
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
__le16 fc = hdr->frame_control;
u8 qsel;
@@ -567,7 +568,8 @@ static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)
qsel = TX_DESC_QSEL_MGMT;
else if (is_broadcast_ether_addr(hdr->addr1) ||
is_multicast_ether_addr(hdr->addr1))
- qsel = TX_DESC_QSEL_HIGH;
+ qsel = (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ?
+ TX_DESC_QSEL_HIGH : skb->priority;
else if (skb_get_queue_mapping(skb) <= IEEE80211_AC_BK)
qsel = skb->priority;
else
|
| 3/2 | 2026/08/14 06:41 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2274 output: 40 thoughts: 181 Thoughts: **Analyzing a Realtek WiFi Driver Patch** Okay, so I'm looking at a patch that's tweaking the `rtw_usb_tx_queue_mapping_to_qsel` function within the Realtek rtw88 USB driver, specifically in `drivers/net/wireless/realtek/rtw88/usb.c`. Seems like they're revising the queue selection mechanism for broadcast and multicast frames. Right now, it looks like the logic is this: if the `IEEE80211_TX_CTL_SEND_AFTER_DTIM` flag is set in `info->flags`, it's directing frames to `TX_DESC_QSEL_HIGH`. Otherwise, it’s going with the `skb->priority`. First things first, I want to confirm that this is indeed the Realtek WiFi driver I think it is, and the path confirms that this is a USB WiFi driver. Now, the key question is whether this is something we can fuzz. Given that it's a USB device, we're definitely in the right ballpark. We can emulate USB devices using tools like raw-gadget or dummy-hcd, so fuzzing this driver is definitely on the table. Next step is to track down the configuration and understand the driver's build options. |
| 4/2 | 2026/08/14 06:41 | tool | grepper |
0mArgs:{
"Expression": "rtw88",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig=2=menuconfig RTW88\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-8-\ndrivers/net/wireless/realtek/rtw88/Kconfig:9:\t If you choose to build a module, it'll be called rtw88.\ndrivers/net/wireless/realtek/rtw88/Kconfig-10-\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=148=config RTW88_8723CS\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-159-\ndrivers/net/wireless/realtek/rtw88/Kconfig:160:\t If you choose to build a module, it'll be called rtw88_8723cs.\ndrivers/net/wireless/realtek/rtw88/Kconfig-161-\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=250=config RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/Kconfig:251:\tbool \"Realtek rtw88 debug support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-252-\tdepends on RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=258=config RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/Kconfig:259:\tbool \"Realtek rtw88 debugfs support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-260-\tdepends on RTW88_CORE\n"
} |
| 5/2 | 2026/08/14 06:41 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3214 output: 38 thoughts: 18 Thoughts: Here's a summary of my thought process, as requested: **Kconfig Dive for rtw88/usb.c** Okay, time to dig into the `Kconfig` for `rtw88/usb.c`. My initial thought is to figure out if there are any specific configuration options that control the inclusion or behavior of this USB-related driver component. I need to understand what's gating its compilation, and if there are any settings that might be affecting its performance or causing any observed issues in a specific build or target. I'll be looking for things like: * **Dependencies:** What other modules or features need to be enabled for `rtw88/usb.c` to be built? Are there any prerequisites I need to be aware of? * **Default Behavior:** What's the default state of the options related to the USB driver? Is it enabled by default, or is it contingent on other selections? This informs my understanding of what's *expected* in a standard configuration. * **Conditional Compilation:** I'm searching for `if` statements or other conditional logic. Are there specific hardware platforms, kernel versions, or build configurations that dictate whether this module is included? If so, this helps me identify constraints on the driver's compatibility. * **Parameters & Tuning:** Are there any Kconfig options that allow me to tune parameters related to power management, interrupt handling, or buffer sizes within the USB module? These settings could be important to optimize for particular wireless use cases or hardware limitations. * **Documentation:** Hopefully, the Kconfig includes clear descriptions of the options, their purpose, and their implications. I need these details to make informed choices. * **Possible conflicts:** Are there other drivers that might conflict with this USB driver, possibly at compile time? My goal is to thoroughly analyze the configuration options associated with `rtw88/usb.c` so I can understand the driver's behavior and dependencies within the kernel build system and, ultimately, ensure that the module is behaving optimally for the user's setup. |
| 6/2 | 2026/08/14 06:41 | tool | grepper |
0mArgs:{
"Expression": "usb.o",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Makefile"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Makefile=110=rtw88_sdio-objs\t\t\t:= sdio.o\ndrivers/net/wireless/realtek/rtw88/Makefile-111-\ndrivers/net/wireless/realtek/rtw88/Makefile:112:obj-$(CONFIG_RTW88_USB)\t\t+= rtw88_usb.o\ndrivers/net/wireless/realtek/rtw88/Makefile:113:rtw88_usb-objs\t\t\t:= usb.o\n"
} |
| 7/2 | 2026/08/14 06:41 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3855 output: 43 thoughts: 22 Thoughts: Here's my take on those thoughts, tailored for an expert audience: **Kernel Configuration Dependencies - RTW88 USB** Alright, so `CONFIG_RTW88_USB` is the key configuration option we're looking at. Let's dig into this. I need to understand its dependencies before making any changes. No point in enabling this without knowing what else I'm pulling in. We need to check if there are any base options, other drivers or modules required. I'm thinking, are there specific USB controller drivers needed? Any generic wireless stack elements? Any conflict with existing hardware configurations? Time to fire up the configuration tools and see the dependency tree. Knowing the implications will avoid any nasty surprises down the line. We can't have breakage because we haven't traced the dependencies properly. |
| 8/2 | 2026/08/14 06:41 | tool | grepper |
0mArgs:{
"Expression": "config RTW88_USB",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig=20=config RTW88_SDIO\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-22-\ndrivers/net/wireless/realtek/rtw88/Kconfig:23:config RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-24-\ttristate\n"
} |
| 9/2 | 2026/08/14 06:41 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4207 output: 42 thoughts: 12 Thoughts: Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and written in the first person: **Analyzing Dependencies** Right, so I need to understand what this thing *affects* or *relies upon*. What other processes, systems, or data elements are directly linked to it? What are the implications of changes to *it*? I need to think through every possible connection – direct dependencies, indirect effects, cascading impacts. Let me map out the relationships – cause and effect, upstream and downstream. This requires a thorough understanding of the overall system architecture, data flow, and potential failure points. I need to be methodical. Let's start with the immediate vicinity and then extrapolate outwards to get a comprehensive view. |
| 10/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "RTW88_USB",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig=20=config RTW88_SDIO\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-22-\ndrivers/net/wireless/realtek/rtw88/Kconfig:23:config RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-24-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=82=config RTW88_8822BU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-85-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:86:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-87-\tselect RTW88_8822B\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=115=config RTW88_8822CU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-118-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:119:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-120-\tselect RTW88_8822C\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=162=config RTW88_8723DU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-165-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:166:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-167-\tselect RTW88_8723D\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=195=config RTW88_8821CU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-198-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:199:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-200-\tselect RTW88_8821C\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=206=config RTW88_8821AU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-209-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:210:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-211-\tselect RTW88_8821A\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=217=config RTW88_8812AU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-220-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:221:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-222-\tselect RTW88_8812A\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=239=config RTW88_8814AU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-242-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:243:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-244-\tselect RTW88_8814A\n"
} |
| 11/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 5446 output: 41 thoughts: 56 Thoughts: **My Initial Thoughts on WiFi Driver Configuration** Okay, so we're looking at enabling a Realtek WiFi driver here. My instinct is to start broad. Let's enable the base `RTW88` module and then also target the specific `RTW88_8822BU` since that seems to be a common variant. I always find it best to start with a more comprehensive approach. Now, before we go any further, let's just quickly check on `RTW88`'s dependencies. I need to make sure we aren't introducing any conflicts or pulling in unnecessary baggage. Understanding the build system and dependencies thoroughly is key here. |
| 12/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "config RTW88",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/realtek/rtw88/Kconfig:2:menuconfig RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-3-\ttristate \"Realtek 802.11ac wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=11=if RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-12-\ndrivers/net/wireless/realtek/rtw88/Kconfig:13:config RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-16-\ndrivers/net/wireless/realtek/rtw88/Kconfig:17:config RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-18-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-19-\ndrivers/net/wireless/realtek/rtw88/Kconfig:20:config RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig-21-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-22-\ndrivers/net/wireless/realtek/rtw88/Kconfig:23:config RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-24-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-25-\ndrivers/net/wireless/realtek/rtw88/Kconfig:26:config RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-27-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-28-\ndrivers/net/wireless/realtek/rtw88/Kconfig:29:config RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-30-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-31-\ndrivers/net/wireless/realtek/rtw88/Kconfig:32:config RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-33-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-34-\ndrivers/net/wireless/realtek/rtw88/Kconfig:35:config RTW88_8703B\ndrivers/net/wireless/realtek/rtw88/Kconfig-36-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-38-\ndrivers/net/wireless/realtek/rtw88/Kconfig:39:config RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-40-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-42-\ndrivers/net/wireless/realtek/rtw88/Kconfig:43:config RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-44-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-45-\ndrivers/net/wireless/realtek/rtw88/Kconfig:46:config RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-47-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-48-\ndrivers/net/wireless/realtek/rtw88/Kconfig:49:config RTW88_8821A\ndrivers/net/wireless/realtek/rtw88/Kconfig-50-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-52-\ndrivers/net/wireless/realtek/rtw88/Kconfig:53:config RTW88_8812A\ndrivers/net/wireless/realtek/rtw88/Kconfig-54-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-56-\ndrivers/net/wireless/realtek/rtw88/Kconfig:57:config RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-58-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-59-\ndrivers/net/wireless/realtek/rtw88/Kconfig:60:config RTW88_8822BE\ndrivers/net/wireless/realtek/rtw88/Kconfig-61-\ttristate \"Realtek 8822BE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-70-\ndrivers/net/wireless/realtek/rtw88/Kconfig:71:config RTW88_8822BS\ndrivers/net/wireless/realtek/rtw88/Kconfig-72-\ttristate \"Realtek 8822BS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-81-\ndrivers/net/wireless/realtek/rtw88/Kconfig:82:config RTW88_8822BU\ndrivers/net/wireless/realtek/rtw88/Kconfig-83-\ttristate \"Realtek 8822BU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-92-\ndrivers/net/wireless/realtek/rtw88/Kconfig:93:config RTW88_8822CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-94-\ttristate \"Realtek 8822CE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-103-\ndrivers/net/wireless/realtek/rtw88/Kconfig:104:config RTW88_8822CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-105-\ttristate \"Realtek 8822CS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-114-\ndrivers/net/wireless/realtek/rtw88/Kconfig:115:config RTW88_8822CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-116-\ttristate \"Realtek 8822CU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-125-\ndrivers/net/wireless/realtek/rtw88/Kconfig:126:config RTW88_8723DE\ndrivers/net/wireless/realtek/rtw88/Kconfig-127-\ttristate \"Realtek 8723DE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-136-\ndrivers/net/wireless/realtek/rtw88/Kconfig:137:config RTW88_8723DS\ndrivers/net/wireless/realtek/rtw88/Kconfig-138-\ttristate \"Realtek 8723DS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-147-\ndrivers/net/wireless/realtek/rtw88/Kconfig:148:config RTW88_8723CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-149-\ttristate \"Realtek 8723CS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-161-\ndrivers/net/wireless/realtek/rtw88/Kconfig:162:config RTW88_8723DU\ndrivers/net/wireless/realtek/rtw88/Kconfig-163-\ttristate \"Realtek 8723DU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-172-\ndrivers/net/wireless/realtek/rtw88/Kconfig:173:config RTW88_8821CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-174-\ttristate \"Realtek 8821CE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-183-\ndrivers/net/wireless/realtek/rtw88/Kconfig:184:config RTW88_8821CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-185-\ttristate \"Realtek 8821CS SDIO wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-194-\ndrivers/net/wireless/realtek/rtw88/Kconfig:195:config RTW88_8821CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-196-\ttristate \"Realtek 8821CU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-205-\ndrivers/net/wireless/realtek/rtw88/Kconfig:206:config RTW88_8821AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-207-\ttristate \"Realtek 8821AU/8811AU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-216-\ndrivers/net/wireless/realtek/rtw88/Kconfig:217:config RTW88_8812AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-218-\ttristate \"Realtek 8812AU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-227-\ndrivers/net/wireless/realtek/rtw88/Kconfig:228:config RTW88_8814AE\ndrivers/net/wireless/realtek/rtw88/Kconfig-229-\ttristate \"Realtek 8814AE PCI wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-238-\ndrivers/net/wireless/realtek/rtw88/Kconfig:239:config RTW88_8814AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-240-\ttristate \"Realtek 8814AU USB wireless network adapter\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-249-\ndrivers/net/wireless/realtek/rtw88/Kconfig:250:config RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/Kconfig-251-\tbool \"Realtek rtw88 debug support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-257-\ndrivers/net/wireless/realtek/rtw88/Kconfig:258:config RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/Kconfig-259-\tbool \"Realtek rtw88 debugfs support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-265-\ndrivers/net/wireless/realtek/rtw88/Kconfig:266:config RTW88_LEDS\ndrivers/net/wireless/realtek/rtw88/Kconfig-267-\tbool\n"
} |
| 13/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8807 output: 52 thoughts: 71 Thoughts: Here's my take on this, considering I'm deep in these kinds of kernel module dependencies: **Kernel Module Dependency Check** Okay, so I'm looking at this driver situation. First, I need to make sure I have all the necessary modules loaded, given the dependencies. It's pretty straightforward: `RTW88` relies on `MAC80211`, which makes sense as it provides the core 802.11 functionality. Therefore, I'll need to confirm that `MAC80211`, the base driver, is present, along with both `RTW88` and the specific variant `RTW88_8822BU`. I'll have to verify the module loading order, too, just to be on the safe side. Now, I'm going to dig a bit deeper. Time to examine that `rtw_usb_tx_queue_mapping_to_qsel` function. I want to see how the USB transmission queues are being mapped to the queue select. I'm hoping I don't have to rewrite the queue handling. |
| 14/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "rtw_usb_tx_queue_mapping_to_qsel",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/usb.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/usb.c=550=static int rtw_usb_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-559-\ndrivers/net/wireless/realtek/rtw88/usb.c:560:static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw88/usb.c-561-{\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=581=static int rtw_usb_tx_write(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-590-\ndrivers/net/wireless/realtek/rtw88/usb.c:591:\tpkt_info-\u003eqsel = rtw_usb_tx_queue_mapping_to_qsel(skb);\ndrivers/net/wireless/realtek/rtw88/usb.c-592-\tpkt_desc = skb_push(skb, chip-\u003etx_pkt_desc_sz);\n"
} |
| 15/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9504 output: 45 thoughts: 14 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm deep in the weeds of embedded systems and USB driver development: **Thinking Through a USB Transmission Function Call** Alright, so `rtw_usb_tx_write` is the caller. That immediately tells me this function is responsible for initiating a USB transmission, likely for a Realtek Wi-Fi device. I'm already thinking about what that implies. This probably means there's a higher-level function, perhaps `rtw_netif_transmit`, which is responsible for taking network packets and ultimately calling *this* function to actually send the data over the USB bus. My mind jumps to the data structures involved: I’ll need to understand the buffer where the data to be transmitted lives, how it’s mapped to USB endpoints, what descriptors are used, and whether there's some kind of DMA involved to reduce CPU load. I need to refresh my memory about the Realtek-specific nuances of their USB driver implementation. Is it polling, interrupt-driven, or using some kind of ring buffer mechanism? I’m also wondering about the context. What resources are already in use? Are there locks or mutexes to worry about? Are we dealing with a single packet or a larger transmission split into chunks? Any error handling? This function should be robust to handle disconnects, errors on the USB bus, and potential buffer overflows. I have to be ready to debug those scenarios. Knowing `rtw_usb_tx_write` is the caller, I immediately see the critical part of the system is the USB transfer. I need to keep in mind the device, and the host, and the data transfer protocol to keep the system working. It all boils down to the USB packet transmission. I will have to ensure that all data is correctly copied to the proper hardware buffers, and the USB controller has the right data to start transferring. |
| 16/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "rtw_usb_tx_write",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/usb.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/usb.c=560=static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-580-\ndrivers/net/wireless/realtek/rtw88/usb.c:581:static int rtw_usb_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/usb.c-582-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=953=static const struct rtw_hci_ops rtw_usb_ops = {\ndrivers/net/wireless/realtek/rtw88/usb.c:954:\t.tx_write = rtw_usb_tx_write,\ndrivers/net/wireless/realtek/rtw88/usb.c-955-\t.tx_kick_off = rtw_usb_tx_kick_off,\n"
} |
| 17/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10253 output: 43 thoughts: 131 Thoughts: **Analyzing the rtw_usb_tx Path** Okay, so I'm looking into the `rtw_usb_tx_write` function; it's a callback within the `rtw_hci_ops` structure. My initial instinct tells me this *has* to be part of the mac80211 transmit path. That seems like a logical connection to make. Alright, time to dig in. Let's make `rtw_usb_tx_write` and `rtw_usb_tx_kick_off` our focal points for now – those seem like key pieces to understand. Wait a second… `rtw_usb_tx_write` is *static*? Hmm, that's a bit of a wrinkle. Static functions can be tricky when tracing execution paths, since they can be a bit more limited in scope. Maybe it's not the best symbol to focus on directly. I'll have to keep that in mind. Let's switch gears a bit. Perhaps understanding how `rtw_usb_ops` is used will give me a better overview of the overall flow and how `rtw_usb_tx_write` fits into the picture. That will be a more productive line of inquiry. |
| 18/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "rtw_usb_ops",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/usb.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/usb.c=931=static void rtw_usb_dynamic_rx_agg(struct rtw_dev *rtwdev, bool enable)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-952-\ndrivers/net/wireless/realtek/rtw88/usb.c:953:static const struct rtw_hci_ops rtw_usb_ops = {\ndrivers/net/wireless/realtek/rtw88/usb.c-954-\t.tx_write = rtw_usb_tx_write,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=1265=int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-1281-\trtwdev-\u003echip = (struct rtw_chip_info *)id-\u003edriver_info;\ndrivers/net/wireless/realtek/rtw88/usb.c:1282:\trtwdev-\u003ehci.ops = \u0026rtw_usb_ops;\ndrivers/net/wireless/realtek/rtw88/usb.c-1283-\trtwdev-\u003ehci.type = RTW_HCI_TYPE_USB;\n"
} |
| 19/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11041 output: 37 thoughts: 32 Thoughts: Okay, here's my interpretation of those thoughts, presented as a personal thought process, as requested: **Tracing the Data Transmission Path** Right, so the callback for this process is triggered by `rtwdev->hci.ops->tx_write`. Okay, good. Now I need to figure out the upstream logic. The critical question here is: *where* is `tx_write` actually being called? I need to trace back from that point to understand the complete data transmission path. This is key to debugging. Let's dig into the call stacks and identify where this function is invoked. |
| 20/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "tx_write",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/hci.h=9=struct rtw_hci_ops {\ndrivers/net/wireless/realtek/rtw88/hci.h:10:\tint (*tx_write)(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/hci.h-11-\t\t\tstruct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/hci.h-35-\ndrivers/net/wireless/realtek/rtw88/hci.h:36:static inline int rtw_hci_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/hci.h-37-\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/hci.h-39-{\ndrivers/net/wireless/realtek/rtw88/hci.h:40:\treturn rtwdev-\u003ehci.ops-\u003etx_write(rtwdev, pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/hci.h-41-}\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=790=static void rtw_pci_tx_kick_off(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-799-\ndrivers/net/wireless/realtek/rtw88/pci.c:800:static int rtw_pci_tx_write_data(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/pci.c-801-\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=870=static int rtw_pci_write_data_rsvd_page(struct rtw_dev *rtwdev, u8 *buf,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-877-\ndrivers/net/wireless/realtek/rtw88/pci.c:878:\tskb = rtw_tx_write_data_rsvd_page_get(rtwdev, \u0026pkt_info, buf, size);\ndrivers/net/wireless/realtek/rtw88/pci.c-879-\tif (!skb)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-881-\ndrivers/net/wireless/realtek/rtw88/pci.c:882:\tret = rtw_pci_tx_write_data(rtwdev, \u0026pkt_info, skb, RTW_TX_QUEUE_BCN);\ndrivers/net/wireless/realtek/rtw88/pci.c-883-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=896=static int rtw_pci_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-901-\ndrivers/net/wireless/realtek/rtw88/pci.c:902:\tskb = rtw_tx_write_data_h2c_get(rtwdev, \u0026pkt_info, buf, size);\ndrivers/net/wireless/realtek/rtw88/pci.c-903-\tif (!skb)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-905-\ndrivers/net/wireless/realtek/rtw88/pci.c:906:\tret = rtw_pci_tx_write_data(rtwdev, \u0026pkt_info, skb, RTW_TX_QUEUE_H2C);\ndrivers/net/wireless/realtek/rtw88/pci.c-907-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-916-\ndrivers/net/wireless/realtek/rtw88/pci.c:917:static int rtw_pci_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/pci.c-918-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-925-\ndrivers/net/wireless/realtek/rtw88/pci.c:926:\tret = rtw_pci_tx_write_data(rtwdev, pkt_info, skb, queue);\ndrivers/net/wireless/realtek/rtw88/pci.c-927-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=1605=static const struct rtw_hci_ops rtw_pci_ops = {\ndrivers/net/wireless/realtek/rtw88/pci.c:1606:\t.tx_write = rtw_pci_tx_write,\ndrivers/net/wireless/realtek/rtw88/pci.c-1607-\t.tx_kick_off = rtw_pci_tx_kick_off,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=900=static int rtw_sdio_write_data_rsvd_page(struct rtw_dev *rtwdev, u8 *buf,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-905-\ndrivers/net/wireless/realtek/rtw88/sdio.c:906:\tskb = rtw_tx_write_data_rsvd_page_get(rtwdev, \u0026pkt_info, buf, size);\ndrivers/net/wireless/realtek/rtw88/sdio.c-907-\tif (!skb)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=913=static int rtw_sdio_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-917-\ndrivers/net/wireless/realtek/rtw88/sdio.c:918:\tskb = rtw_tx_write_data_h2c_get(rtwdev, \u0026pkt_info, buf, size);\ndrivers/net/wireless/realtek/rtw88/sdio.c-919-\tif (!skb)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-924-\ndrivers/net/wireless/realtek/rtw88/sdio.c:925:static int rtw_sdio_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c-926-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1170=static const struct rtw_hci_ops rtw_sdio_ops = {\ndrivers/net/wireless/realtek/rtw88/sdio.c:1171:\t.tx_write = rtw_sdio_tx_write,\ndrivers/net/wireless/realtek/rtw88/sdio.c-1172-\t.tx_kick_off = rtw_sdio_tx_kick_off,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=502=struct sk_buff *\ndrivers/net/wireless/realtek/rtw88/tx.c:503:rtw_tx_write_data_rsvd_page_get(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c-504-\t\t\t\tstruct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-525-}\ndrivers/net/wireless/realtek/rtw88/tx.c:526:EXPORT_SYMBOL(rtw_tx_write_data_rsvd_page_get);\ndrivers/net/wireless/realtek/rtw88/tx.c-527-\ndrivers/net/wireless/realtek/rtw88/tx.c=528=struct sk_buff *\ndrivers/net/wireless/realtek/rtw88/tx.c:529:rtw_tx_write_data_h2c_get(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c-530-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-551-}\ndrivers/net/wireless/realtek/rtw88/tx.c:552:EXPORT_SYMBOL(rtw_tx_write_data_h2c_get);\ndrivers/net/wireless/realtek/rtw88/tx.c-553-\ndrivers/net/wireless/realtek/rtw88/tx.c=554=void rtw_tx(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-561-\trtw_tx_pkt_info_update(rtwdev, \u0026pkt_info, control-\u003esta, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c:562:\tret = rtw_hci_tx_write(rtwdev, \u0026pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-563-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=608=static int rtw_txq_push_skb(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-618-\trtw_tx_pkt_info_update(rtwdev, \u0026pkt_info, txq-\u003esta, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c:619:\tret = rtw_hci_tx_write(rtwdev, \u0026pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-620-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/tx.h=106=struct sk_buff *\ndrivers/net/wireless/realtek/rtw88/tx.h:107:rtw_tx_write_data_rsvd_page_get(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.h-108-\t\t\t\tstruct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/tx.h=110=struct sk_buff *\ndrivers/net/wireless/realtek/rtw88/tx.h:111:rtw_tx_write_data_h2c_get(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.h-112-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=560=static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-580-\ndrivers/net/wireless/realtek/rtw88/usb.c:581:static int rtw_usb_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/usb.c-582-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=953=static const struct rtw_hci_ops rtw_usb_ops = {\ndrivers/net/wireless/realtek/rtw88/usb.c:954:\t.tx_write = rtw_usb_tx_write,\ndrivers/net/wireless/realtek/rtw88/usb.c-955-\t.tx_kick_off = rtw_usb_tx_kick_off,\n"
} |
| 21/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 14515 output: 38 thoughts: 24 Thoughts: Here's my thought process, as requested: **Checking the Nature of `rtw_tx`** Okay, let's zero in on this `rtw_tx` symbol. The key question in my mind is: is this thing a publicly accessible function, meaning it's been exported, or is it lurking somewhere within a limited scope as a static internal component? I'll need to figure this out before I can reason further about the code that touches it. Let me just take a look... |
| 22/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "rtw_tx",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 871 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/realtek/rtw88/fw.c=93=static void rtw_fw_c2h_cmd_handle_ext(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/fw.c-103-\tcase C2H_CCX_RPT:\ndrivers/net/wireless/realtek/rtw88/fw.c:104:\t\trtw_tx_report_handle(rtwdev, skb, C2H_CCX_RPT);\ndrivers/net/wireless/realtek/rtw88/fw.c-105-\t\tbreak;\n--\ndrivers/net/wireless/realtek/rtw88/fw.c=301=void rtw_fw_c2h_cmd_handle(struct rtw_dev *rtwdev, struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/fw.c-317-\tcase C2H_CCX_TX_RPT:\ndrivers/net/wireless/realtek/rtw88/fw.c:318:\t\trtw_tx_report_handle(rtwdev, skb, C2H_CCX_TX_RPT);\ndrivers/net/wireless/realtek/rtw88/fw.c-319-\t\tbreak;\n--\ndrivers/net/wireless/realtek/rtw88/fw.c=1300=static void rtw_fill_rsvd_page_desc(struct rtw_dev *rtwdev, struct sk_buff *skb,\n--\ndrivers/net/wireless/realtek/rtw88/fw.c-1302-{\ndrivers/net/wireless/realtek/rtw88/fw.c:1303:\tstruct rtw_tx_pkt_info pkt_info = {0};\ndrivers/net/wireless/realtek/rtw88/fw.c-1304-\tconst struct rtw_chip_info *chip = rtwdev-\u003echip;\n--\ndrivers/net/wireless/realtek/rtw88/fw.c-1306-\ndrivers/net/wireless/realtek/rtw88/fw.c:1307:\trtw_tx_rsvd_page_pkt_info_update(rtwdev, \u0026pkt_info, skb, type);\ndrivers/net/wireless/realtek/rtw88/fw.c-1308-\tpkt_desc = skb_push(skb, chip-\u003etx_pkt_desc_sz);\ndrivers/net/wireless/realtek/rtw88/fw.c-1309-\tmemset(pkt_desc, 0, chip-\u003etx_pkt_desc_sz);\ndrivers/net/wireless/realtek/rtw88/fw.c:1310:\trtw_tx_fill_tx_desc(rtwdev, \u0026pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/fw.c-1311-}\n--\ndrivers/net/wireless/realtek/rtw88/hci.h=9=struct rtw_hci_ops {\ndrivers/net/wireless/realtek/rtw88/hci.h-10-\tint (*tx_write)(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/hci.h:11:\t\t\tstruct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/hci.h-12-\t\t\tstruct sk_buff *skb);\n--\ndrivers/net/wireless/realtek/rtw88/hci.h=36=static inline int rtw_hci_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/hci.h:37:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/hci.h-38-\t\t\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c=18=static void rtw_ops_tx(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c-28-\ndrivers/net/wireless/realtek/rtw88/mac80211.c:29:\trtw_tx(rtwdev, control, skb);\ndrivers/net/wireless/realtek/rtw88/mac80211.c-30-}\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c=32=static void rtw_ops_wake_tx_queue(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c-35-\tstruct rtw_dev *rtwdev = hw-\u003epriv;\ndrivers/net/wireless/realtek/rtw88/mac80211.c:36:\tstruct rtw_txq *rtwtxq = (struct rtw_txq *)txq-\u003edrv_priv;\ndrivers/net/wireless/realtek/rtw88/mac80211.c-37-\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c-47-\tif (txq-\u003eac == IEEE80211_AC_VO)\ndrivers/net/wireless/realtek/rtw88/mac80211.c:48:\t\t__rtw_tx_work(rtwdev);\ndrivers/net/wireless/realtek/rtw88/mac80211.c-49-\telse\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c=146=static int rtw_ops_add_interface(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c-164-\tmemset(\u0026rtwvif-\u003ebfee, 0, sizeof(struct rtw_bfee));\ndrivers/net/wireless/realtek/rtw88/mac80211.c:165:\trtw_txq_init(rtwdev, vif-\u003etxq);\ndrivers/net/wireless/realtek/rtw88/mac80211.c-166-\tINIT_LIST_HEAD(\u0026rtwvif-\u003ersvd_page_list);\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c=228=static void rtw_ops_remove_interface(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c-241-\ndrivers/net/wireless/realtek/rtw88/mac80211.c:242:\trtw_txq_cleanup(rtwdev, vif-\u003etxq);\ndrivers/net/wireless/realtek/rtw88/mac80211.c-243-\trtw_remove_rsvd_page(rtwdev, rtwvif);\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c=636=static int rtw_ops_ampdu_action(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw88/mac80211.c-642-\tstruct ieee80211_txq *txq = sta-\u003etxq[tid];\ndrivers/net/wireless/realtek/rtw88/mac80211.c:643:\tstruct rtw_txq *rtwtxq = (struct rtw_txq *)txq-\u003edrv_priv;\ndrivers/net/wireless/realtek/rtw88/mac80211.c-644-\n--\ndrivers/net/wireless/realtek/rtw88/main.c=345=int rtw_sta_add(struct rtw_dev *rtwdev, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/realtek/rtw88/main.c-365-\tfor (i = 0; i \u003c ARRAY_SIZE(sta-\u003etxq); i++)\ndrivers/net/wireless/realtek/rtw88/main.c:366:\t\trtw_txq_init(rtwdev, sta-\u003etxq[i]);\ndrivers/net/wireless/realtek/rtw88/main.c-367-\tINIT_WORK(\u0026si-\u003erc_work, rtw_sta_rc_work);\n--\ndrivers/net/wireless/realtek/rtw88/main.c=380=void rtw_sta_remove(struct rtw_dev *rtwdev, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/realtek/rtw88/main.c-394-\tfor (i = 0; i \u003c ARRAY_SIZE(sta-\u003etxq); i++)\ndrivers/net/wireless/realtek/rtw88/main.c:395:\t\trtw_txq_cleanup(rtwdev, sta-\u003etxq[i]);\ndrivers/net/wireless/realtek/rtw88/main.c-396-\n--\ndrivers/net/wireless/realtek/rtw88/main.c=622=static void rtw_reset_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-628-\trtw_vif_assoc_changed(rtwvif, NULL);\ndrivers/net/wireless/realtek/rtw88/main.c:629:\trtw_txq_cleanup(rtwdev, vif-\u003etxq);\ndrivers/net/wireless/realtek/rtw88/main.c-630-\n--\ndrivers/net/wireless/realtek/rtw88/main.c=674=static void rtw_fw_recovery_work(struct work_struct *work)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-685-\ndrivers/net/wireless/realtek/rtw88/main.c:686:struct rtw_txq_ba_iter_data {\ndrivers/net/wireless/realtek/rtw88/main.c-687-};\ndrivers/net/wireless/realtek/rtw88/main.c-688-\ndrivers/net/wireless/realtek/rtw88/main.c:689:static void rtw_txq_ba_iter(void *data, struct ieee80211_sta *sta)\ndrivers/net/wireless/realtek/rtw88/main.c-690-{\n--\ndrivers/net/wireless/realtek/rtw88/main.c-700-\t\t\tstruct ieee80211_txq *txq;\ndrivers/net/wireless/realtek/rtw88/main.c:701:\t\t\tstruct rtw_txq *rtwtxq;\ndrivers/net/wireless/realtek/rtw88/main.c-702-\ndrivers/net/wireless/realtek/rtw88/main.c-703-\t\t\ttxq = sta-\u003etxq[tid];\ndrivers/net/wireless/realtek/rtw88/main.c:704:\t\t\trtwtxq = (struct rtw_txq *)txq-\u003edrv_priv;\ndrivers/net/wireless/realtek/rtw88/main.c-705-\t\t\tset_bit(RTW_TXQ_BLOCK_BA, \u0026rtwtxq-\u003eflags);\n--\ndrivers/net/wireless/realtek/rtw88/main.c-711-\ndrivers/net/wireless/realtek/rtw88/main.c:712:static void rtw_txq_ba_work(struct work_struct *work)\ndrivers/net/wireless/realtek/rtw88/main.c-713-{\ndrivers/net/wireless/realtek/rtw88/main.c-714-\tstruct rtw_dev *rtwdev = container_of(work, struct rtw_dev, ba_work);\ndrivers/net/wireless/realtek/rtw88/main.c:715:\tstruct rtw_txq_ba_iter_data data;\ndrivers/net/wireless/realtek/rtw88/main.c-716-\ndrivers/net/wireless/realtek/rtw88/main.c:717:\trtw_iterate_stas_atomic(rtwdev, rtw_txq_ba_iter, \u0026data);\ndrivers/net/wireless/realtek/rtw88/main.c-718-}\n--\ndrivers/net/wireless/realtek/rtw88/main.c=2138=int rtw_core_init(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-2147-\ttimer_setup(\u0026rtwdev-\u003etx_report.purge_timer,\ndrivers/net/wireless/realtek/rtw88/main.c:2148:\t\t rtw_tx_report_purge_timer, 0);\ndrivers/net/wireless/realtek/rtw88/main.c:2149:\trtwdev-\u003etx_wq = alloc_workqueue(\"rtw_tx_wq\", WQ_UNBOUND | WQ_HIGHPRI, 0);\ndrivers/net/wireless/realtek/rtw88/main.c-2150-\tif (!rtwdev-\u003etx_wq) {\ndrivers/net/wireless/realtek/rtw88/main.c:2151:\t\trtw_warn(rtwdev, \"alloc_workqueue rtw_tx_wq failed\\n\");\ndrivers/net/wireless/realtek/rtw88/main.c-2152-\t\treturn -ENOMEM;\n--\ndrivers/net/wireless/realtek/rtw88/main.c-2164-\tINIT_DELAYED_WORK(\u0026coex-\u003ewl_ccklock_work, rtw_coex_wl_ccklock_work);\ndrivers/net/wireless/realtek/rtw88/main.c:2165:\tINIT_WORK(\u0026rtwdev-\u003etx_work, rtw_tx_work);\ndrivers/net/wireless/realtek/rtw88/main.c-2166-\tINIT_WORK(\u0026rtwdev-\u003ec2h_work, rtw_c2h_work);\n--\ndrivers/net/wireless/realtek/rtw88/main.c-2169-\tINIT_WORK(\u0026rtwdev-\u003eupdate_beacon_work, rtw_fw_update_beacon_work);\ndrivers/net/wireless/realtek/rtw88/main.c:2170:\tINIT_WORK(\u0026rtwdev-\u003eba_work, rtw_txq_ba_work);\ndrivers/net/wireless/realtek/rtw88/main.c-2171-\tskb_queue_head_init(\u0026rtwdev-\u003ec2h_queue);\n--\ndrivers/net/wireless/realtek/rtw88/main.c=2255=int rtw_register_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-2267-\thw-\u003equeues = IEEE80211_NUM_ACS;\ndrivers/net/wireless/realtek/rtw88/main.c:2268:\thw-\u003etxq_data_size = sizeof(struct rtw_txq);\ndrivers/net/wireless/realtek/rtw88/main.c-2269-\thw-\u003esta_data_size = sizeof(struct rtw_sta_info);\n--\ndrivers/net/wireless/realtek/rtw88/main.h=191=enum rtw_chip_type {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-201-\ndrivers/net/wireless/realtek/rtw88/main.h:202:enum rtw_tx_queue_type {\ndrivers/net/wireless/realtek/rtw88/main.h-203-\t/* the order of AC queues matters */\n--\ndrivers/net/wireless/realtek/rtw88/main.h=344=enum rtw_regulatory_domains {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-361-\ndrivers/net/wireless/realtek/rtw88/main.h:362:enum rtw_txq_flags {\ndrivers/net/wireless/realtek/rtw88/main.h-363-\tRTW_TXQ_AMPDU,\n--\ndrivers/net/wireless/realtek/rtw88/main.h=520=struct rtw_5g_txpwr_idx {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-532-\ndrivers/net/wireless/realtek/rtw88/main.h:533:struct rtw_txpwr_idx {\ndrivers/net/wireless/realtek/rtw88/main.h-534-\tstruct rtw_2g_txpwr_idx pwr_idx_2g;\n--\ndrivers/net/wireless/realtek/rtw88/main.h=599=struct rtw_vif_port {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-606-\ndrivers/net/wireless/realtek/rtw88/main.h:607:struct rtw_tx_pkt_info {\ndrivers/net/wireless/realtek/rtw88/main.h-608-\tu32 tx_pkt_size;\n--\ndrivers/net/wireless/realtek/rtw88/main.h=737=struct rtw_sec_desc {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-745-\ndrivers/net/wireless/realtek/rtw88/main.h:746:struct rtw_tx_report {\ndrivers/net/wireless/realtek/rtw88/main.h-747-\t/* protect the tx report queue */\n--\ndrivers/net/wireless/realtek/rtw88/main.h=754=struct rtw_ra_report {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-759-\ndrivers/net/wireless/realtek/rtw88/main.h:760:struct rtw_txq {\ndrivers/net/wireless/realtek/rtw88/main.h-761-\tstruct list_head list;\n--\ndrivers/net/wireless/realtek/rtw88/main.h=862=struct rtw_chip_ops {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-912-\tvoid (*fill_txdesc_checksum)(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/main.h:913:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/main.h-914-\t\t\t\t u8 *txdesc);\n--\ndrivers/net/wireless/realtek/rtw88/main.h=1792=struct rtw_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-1841-\ndrivers/net/wireless/realtek/rtw88/main.h:1842:\tstruct rtw_txpwr_idx txpwr_idx_table[4];\ndrivers/net/wireless/realtek/rtw88/main.h-1843-};\n--\ndrivers/net/wireless/realtek/rtw88/main.h=2060=struct rtw_dev {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-2102-\ndrivers/net/wireless/realtek/rtw88/main.h:2103:\tstruct rtw_tx_report tx_report;\ndrivers/net/wireless/realtek/rtw88/main.h-2104-\n--\ndrivers/net/wireless/realtek/rtw88/main.h=2146=static inline bool rtw_is_assoc(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/main.h-2150-\ndrivers/net/wireless/realtek/rtw88/main.h:2151:static inline struct ieee80211_txq *rtwtxq_to_txq(struct rtw_txq *rtwtxq)\ndrivers/net/wireless/realtek/rtw88/main.h-2152-{\n--\ndrivers/net/wireless/realtek/rtw88/main.h=2247=void rtw_vif_port_config(struct rtw_dev *rtwdev, struct rtw_vif *rtwvif,\ndrivers/net/wireless/realtek/rtw88/main.h-2248-\t\t\t u32 config);\ndrivers/net/wireless/realtek/rtw88/main.h:2249:void rtw_tx_report_purge_timer(struct timer_list *t);\ndrivers/net/wireless/realtek/rtw88/main.h-2250-void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=35=static u8 rtw_pci_get_tx_qsel(struct sk_buff *skb,\ndrivers/net/wireless/realtek/rtw88/pci.c:36:\t\t\t enum rtw_tx_queue_type queue)\ndrivers/net/wireless/realtek/rtw88/pci.c-37-{\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=538=static void rtw_pci_dma_release(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-540-\tstruct rtw_pci_tx_ring *tx_ring;\ndrivers/net/wireless/realtek/rtw88/pci.c:541:\tenum rtw_tx_queue_type queue;\ndrivers/net/wireless/realtek/rtw88/pci.c-542-\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=603=static void rtw_pci_deep_ps_enter(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-606-\tstruct rtw_pci_tx_ring *tx_ring;\ndrivers/net/wireless/realtek/rtw88/pci.c:607:\tenum rtw_tx_queue_type queue;\ndrivers/net/wireless/realtek/rtw88/pci.c-608-\tbool tx_empty = true;\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=754=static void rtw_pci_flush_queues(struct rtw_dev *rtwdev, u32 queues, bool drop)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-766-\t\t\tif (queues \u0026 BIT(i))\ndrivers/net/wireless/realtek/rtw88/pci.c:767:\t\t\t\tpci_queues |= BIT(rtw_tx_ac_to_hwq(i));\ndrivers/net/wireless/realtek/rtw88/pci.c-768-\t}\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=773=static void rtw_pci_tx_kick_off_queue(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/pci.c:774:\t\t\t\t enum rtw_tx_queue_type queue)\ndrivers/net/wireless/realtek/rtw88/pci.c-775-{\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=790=static void rtw_pci_tx_kick_off(struct rtw_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-792-\tstruct rtw_pci *rtwpci = (struct rtw_pci *)rtwdev-\u003epriv;\ndrivers/net/wireless/realtek/rtw88/pci.c:793:\tenum rtw_tx_queue_type queue;\ndrivers/net/wireless/realtek/rtw88/pci.c-794-\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=800=static int rtw_pci_tx_write_data(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/pci.c:801:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/pci.c-802-\t\t\t\t struct sk_buff *skb,\ndrivers/net/wireless/realtek/rtw88/pci.c:803:\t\t\t\t enum rtw_tx_queue_type queue)\ndrivers/net/wireless/realtek/rtw88/pci.c-804-{\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-828-\tpkt_info-\u003eqsel = rtw_pci_get_tx_qsel(skb, queue);\ndrivers/net/wireless/realtek/rtw88/pci.c:829:\trtw_tx_fill_tx_desc(rtwdev, pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/pci.c-830-\tdma = dma_map_single(\u0026rtwpci-\u003epdev-\u003edev, skb-\u003edata, skb-\u003elen,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=870=static int rtw_pci_write_data_rsvd_page(struct rtw_dev *rtwdev, u8 *buf,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-873-\tstruct sk_buff *skb;\ndrivers/net/wireless/realtek/rtw88/pci.c:874:\tstruct rtw_tx_pkt_info pkt_info = {0};\ndrivers/net/wireless/realtek/rtw88/pci.c-875-\tu8 reg_bcn_work;\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-877-\ndrivers/net/wireless/realtek/rtw88/pci.c:878:\tskb = rtw_tx_write_data_rsvd_page_get(rtwdev, \u0026pkt_info, buf, size);\ndrivers/net/wireless/realtek/rtw88/pci.c-879-\tif (!skb)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=896=static int rtw_pci_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-898-\tstruct sk_buff *skb;\ndrivers/net/wireless/realtek/rtw88/pci.c:899:\tstruct rtw_tx_pkt_info pkt_info = {0};\ndrivers/net/wireless/realtek/rtw88/pci.c-900-\tint ret;\ndrivers/net/wireless/realtek/rtw88/pci.c-901-\ndrivers/net/wireless/realtek/rtw88/pci.c:902:\tskb = rtw_tx_write_data_h2c_get(rtwdev, \u0026pkt_info, buf, size);\ndrivers/net/wireless/realtek/rtw88/pci.c-903-\tif (!skb)\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=917=static int rtw_pci_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/pci.c:918:\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/pci.c-919-\t\t\t struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw88/pci.c-920-{\ndrivers/net/wireless/realtek/rtw88/pci.c:921:\tenum rtw_tx_queue_type queue = rtw_tx_queue_mapping(skb);\ndrivers/net/wireless/realtek/rtw88/pci.c-922-\tstruct rtw_pci *rtwpci = (struct rtw_pci *)rtwdev-\u003epriv;\n--\ndrivers/net/wireless/realtek/rtw88/pci.c=941=static void rtw_pci_tx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-998-\t\tif (info-\u003eflags \u0026 IEEE80211_TX_CTL_REQ_TX_STATUS) {\ndrivers/net/wireless/realtek/rtw88/pci.c:999:\t\t\trtw_tx_report_enqueue(rtwdev, skb, tx_data-\u003esn);\ndrivers/net/wireless/realtek/rtw88/pci.c-1000-\t\t\tcontinue;\n--\ndrivers/net/wireless/realtek/rtw88/phy.c=1760=void rtw_parse_tbl_txpwr_lmt(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/phy.c-1762-{\ndrivers/net/wireless/realtek/rtw88/phy.c:1763:\tconst struct rtw_txpwr_lmt_cfg_pair *p = tbl-\u003edata;\ndrivers/net/wireless/realtek/rtw88/phy.c:1764:\tconst struct rtw_txpwr_lmt_cfg_pair *end = p + tbl-\u003esize;\ndrivers/net/wireless/realtek/rtw88/phy.c-1765-\tu32 regd_cfg_flag = 0;\n--\ndrivers/net/wireless/realtek/rtw88/phy.c=2239=void rtw_get_tx_power_params(struct rtw_dev *rtwdev, u8 path, u8 rate, u8 bw,\n--\ndrivers/net/wireless/realtek/rtw88/phy.c-2243-\tstruct rtw_dm_info *dm_info = \u0026rtwdev-\u003edm_info;\ndrivers/net/wireless/realtek/rtw88/phy.c:2244:\tstruct rtw_txpwr_idx *pwr_idx;\ndrivers/net/wireless/realtek/rtw88/phy.c-2245-\tu8 group, band;\n--\ndrivers/net/wireless/realtek/rtw88/phy.h=70=void rtw_phy_tx_path_diversity(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/phy.h-71-\ndrivers/net/wireless/realtek/rtw88/phy.h:72:struct rtw_txpwr_lmt_cfg_pair {\ndrivers/net/wireless/realtek/rtw88/phy.h-73-\tu8 regd;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b_tables.c=17=RTW_DECL_TABLE_BB_PG(rtw8703b_bb_pg);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b_tables.c-23- */\ndrivers/net/wireless/realtek/rtw88/rtw8703b_tables.c:24:static const struct rtw_txpwr_lmt_cfg_pair rtw8703b_txpwr_lmt[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8703b_tables.c-25-\t{0, 0, 0, 0, 1, 30},\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723d_table.c=939=RTW_DECL_TABLE_RF_RADIO(rtw8723d_rf_a, A);\ndrivers/net/wireless/realtek/rtw88/rtw8723d_table.c-940-\ndrivers/net/wireless/realtek/rtw88/rtw8723d_table.c:941:static const struct rtw_txpwr_lmt_cfg_pair rtw8723d_txpwr_lmt[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8723d_table.c-942-\t{0, 0, 0, 0, 1, 30, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c=101=static void __rtw8723x_debug_txpwr_limit(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c:102:\t\t\t\t\t struct rtw_txpwr_idx *table,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-103-\t\t\t\t\t int tx_path_count)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c=682=void __rtw8723x_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c:683:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-684-\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-688-\t__le16 *data = (__le16 *)(txdesc);\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c:689:\tstruct rtw_tx_desc *tx_desc = (struct rtw_tx_desc *)txdesc;\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-690-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h=66=struct rtw8723x_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-72-\t/* power index for four RF paths */\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h:73:\tstruct rtw_txpwr_idx txpwr_idx_table[4];\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-74-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h=122=struct rtw8723x_common {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-155-\tvoid (*fill_txdesc_checksum)(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h:156:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-157-\t\t\t\t u8 *txdesc);\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-158-\tvoid (*debug_txpwr_limit)(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h:159:\t\t\t\t struct rtw_txpwr_idx *table,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-160-\t\t\t\t int tx_path_count);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h=365=void rtw8723x_debug_txpwr_limit(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h:366:\t\t\t\tstruct rtw_txpwr_idx *table,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-367-\t\t\t\tint tx_path_count)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h=451=void rtw8723x_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h:452:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8723x.h-453-\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c=887=static void rtw8812a_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c:888:\t\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8812a.c-889-\t\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.c=1688=RTW_DECL_TABLE_RF_RADIO(rtw8812a_rf_b, B);\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.c-1689-\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.c:1690:static const struct rtw_txpwr_lmt_cfg_pair rtw8812a_txpwr_lmt[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.c-1691-\t{ 0, 0, 0, 0, 1, 36, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=2042=static void rtw8814a_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:2043:\t\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-2044-\t\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h=23=struct rtw8814a_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h-29-\t/* power index for four RF paths */\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h:30:\tstruct rtw_txpwr_idx txpwr_idx_table[4];\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h-31-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=14583=RTW_DECL_TABLE_RF_RADIO(rtw8814a_rf_d, D);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-14584-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:14585:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-14586-\t{ 0, 0, 0, 0, 1, 36, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=15560=RTW_DECL_TABLE_TXPWR_LMT(rtw8814a_txpwr_lmt);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-15561-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:15562:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt_type0[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-15563-\t{ 0, 0, 0, 0, 1, 32, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=16537=RTW_DECL_TABLE_TXPWR_LMT(rtw8814a_txpwr_lmt_type0);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-16538-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:16539:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt_type1[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-16540-\t\t{ 0, 0, 0, 0, 1, 34, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=17514=RTW_DECL_TABLE_TXPWR_LMT(rtw8814a_txpwr_lmt_type1);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-17515-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:17516:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt_type2[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-17517-\t{ 0, 0, 0, 0, 1, 42, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=18491=RTW_DECL_TABLE_TXPWR_LMT(rtw8814a_txpwr_lmt_type2);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-18492-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:18493:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt_type3[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-18494-\t{ 0, 0, 0, 0, 1, 46, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=19468=RTW_DECL_TABLE_TXPWR_LMT(rtw8814a_txpwr_lmt_type3);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-19469-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:19470:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt_type5[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-19471-\t{ 0, 0, 0, 0, 1, 46, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=20445=RTW_DECL_TABLE_TXPWR_LMT(rtw8814a_txpwr_lmt_type5);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-20446-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:20447:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt_type7[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-20448-\t{ 0, 0, 0, 0, 1, 44, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c=21422=RTW_DECL_TABLE_TXPWR_LMT(rtw8814a_txpwr_lmt_type7);\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-21423-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c:21424:static const struct rtw_txpwr_lmt_cfg_pair rtw8814a_txpwr_lmt_type8[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.c-21425-\t{ 0, 0, 0, 0, 1, 46, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c=734=static void rtw8821a_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c:735:\t\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8821a.c-736-\t\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.c=1335=RTW_DECL_TABLE_RF_RADIO(rtw8821a_rf_a, A);\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.c-1336-\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.c:1337:static const struct rtw_txpwr_lmt_cfg_pair rtw8821a_txpwr_lmt[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.c-1338-\t{ 0, 0, 0, 0, 1, 32, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c=1231=static void rtw8821c_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c:1232:\t\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-1233-\t\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h=74=struct rtw8821c_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h-78-\t/* power index for four RF paths */\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h:79:\tstruct rtw_txpwr_idx txpwr_idx_table[4];\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h-80-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.c=6011=RTW_DECL_TABLE_RF_RADIO(rtw8821c_rf_a, A);\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.c-6012-\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.c:6013:static const struct rtw_txpwr_lmt_cfg_pair rtw8821c_txpwr_lmt_type0[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.c-6014-\t{ 0, 0, 0, 0, 1, 30, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c=1594=static void rtw8822b_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:1595:\t\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-1596-\t\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h=74=struct rtw8822b_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-80-\t/* power index for four RF paths */\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h:81:\tstruct rtw_txpwr_idx txpwr_idx_table[4];\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-82-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c=20434=RTW_DECL_TABLE_RF_RADIO(rtw8822b_rf_b, B);\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c-20435-\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c:20436:static const struct rtw_txpwr_lmt_cfg_pair rtw8822b_txpwr_lmt_type0[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c-20437-\t{ 0, 0, 0, 0, 1, 32, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c=21024=RTW_DECL_TABLE_TXPWR_LMT(rtw8822b_txpwr_lmt_type0);\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c-21025-\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c:21026:static const struct rtw_txpwr_lmt_cfg_pair rtw8822b_txpwr_lmt_type2[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c-21027-\t{ 0, 0, 0, 0, 1, 32, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c=21614=RTW_DECL_TABLE_TXPWR_LMT(rtw8822b_txpwr_lmt_type2);\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c-21615-\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c:21616:static const struct rtw_txpwr_lmt_cfg_pair rtw8822b_txpwr_lmt_type5[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.c-21617-\t{ 0, 0, 0, 0, 1, 32, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=4563=static void rtw8822c_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:4564:\t\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4565-\t\t\t\t\t u8 *txdesc)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h=61=struct rtw8822c_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-67-\t/* power index for four RF paths */\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:68:\tstruct rtw_txpwr_idx txpwr_idx_table[4];\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-69-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c=39822=RTW_DECL_TABLE_RF_RADIO(rtw8822c_rf_b, B);\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c-39823-\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c:39824:static const struct rtw_txpwr_lmt_cfg_pair rtw8822c_txpwr_lmt_type0[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c-39825-\t{ 0, 0, 0, 0, 1, 72, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c=42167=RTW_DECL_TABLE_TXPWR_LMT(rtw8822c_txpwr_lmt_type0);\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c-42168-\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c:42169:static const struct rtw_txpwr_lmt_cfg_pair rtw8822c_txpwr_lmt_type5[] = {\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.c-42170-\t{ 0, 0, 0, 0, 1, 72, },\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h=28=struct rtw88xxa_efuse {\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h-34-\t/* power index for four RF paths */\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h:35:\tstruct rtw_txpwr_idx txpwr_idx_table[4];\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h-36-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=470=static u32 rtw_sdio_get_tx_addr(struct rtw_dev *rtwdev, size_t size,\ndrivers/net/wireless/realtek/rtw88/sdio.c:471:\t\t\t\tenum rtw_tx_queue_type queue)\ndrivers/net/wireless/realtek/rtw88/sdio.c-472-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=635=static int rtw_sdio_write_port(struct rtw_dev *rtwdev, struct sk_buff *skb,\ndrivers/net/wireless/realtek/rtw88/sdio.c:636:\t\t\t enum rtw_tx_queue_type queue)\ndrivers/net/wireless/realtek/rtw88/sdio.c-637-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=847=static void rtw_sdio_tx_skb_prepare(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c:848:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/sdio.c-849-\t\t\t\t struct sk_buff *skb,\ndrivers/net/wireless/realtek/rtw88/sdio.c:850:\t\t\t\t enum rtw_tx_queue_type queue)\ndrivers/net/wireless/realtek/rtw88/sdio.c-851-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-880-\ndrivers/net/wireless/realtek/rtw88/sdio.c:881:\trtw_tx_fill_tx_desc(rtwdev, pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/sdio.c:882:\trtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, pkt_desc);\ndrivers/net/wireless/realtek/rtw88/sdio.c-883-}\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=885=static int rtw_sdio_write_data(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c:886:\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/sdio.c-887-\t\t\t struct sk_buff *skb,\ndrivers/net/wireless/realtek/rtw88/sdio.c:888:\t\t\t enum rtw_tx_queue_type queue)\ndrivers/net/wireless/realtek/rtw88/sdio.c-889-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=900=static int rtw_sdio_write_data_rsvd_page(struct rtw_dev *rtwdev, u8 *buf,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-902-{\ndrivers/net/wireless/realtek/rtw88/sdio.c:903:\tstruct rtw_tx_pkt_info pkt_info = {};\n\n"
} |
| 23/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 30544 output: 43 thoughts: 309 Thoughts: **Analyzing the Target for Fuzzing** Okay, so I'm looking at this code and trying to figure out if it's a good candidate for fuzzing. `rtw_tx` is definitely reachable because it's the mac80211 TX callback, called through `rtw_ops_tx`. I can see that clearly. But my interest is piqued because the patch modifies `rtw_usb_tx_queue_mapping_to_qsel` in `usb.c`. Now, that's called by `rtw_usb_tx_write`, which is the `tx_write` callback *specifically* for USB transmissions. So, that's definitely a viable path for packets sent over USB. The more I think about it, yeah, this is worth investigating further. Changes to queue selection for broadcast and multicast packets are functionally significant. The key part is that the logic involves checking `info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM`. mac80211 sets this flag for multicast and broadcast frames, meaning the changes will definitely affect how these kinds of frames are handled. This is a functional change in the driver's TX path. Now, let's consider the fuzzing strategy. Is `rtw_usb_tx_write` a good symbol to focus on? Hmm, it's static, which is a concern – it could be inlined, or might not even have a distinct symbol in the final binary. So, let's pivot. Checking `rtw_usb_tx_queue_mapping_to_qsel`, that's static too. Okay, let's broaden the search a bit. Are there any *non*-static functions in this area? Looks like `rtw_usb_ops` is static, so that's not useful. But `rtw_usb_probe` is non-static or possibly exported, it's worth a look. |
| 24/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "rtw_usb_probe",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/usb.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/usb.c=1227=static void rtw_usb_phy_cfg(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-1264-\ndrivers/net/wireless/realtek/rtw88/usb.c:1265:int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)\ndrivers/net/wireless/realtek/rtw88/usb.c-1266-{\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-1360-}\ndrivers/net/wireless/realtek/rtw88/usb.c:1361:EXPORT_SYMBOL(rtw_usb_probe);\ndrivers/net/wireless/realtek/rtw88/usb.c-1362-\n"
} |
| 25/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 31557 output: 41 thoughts: 40 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: **Investigating the rtw_usb Driver** Alright, so `rtw_usb_probe` is exposed, that's not news, but the commit's focused on the transmit path. Interesting. My initial gut feeling is to check if `rtw_tx` had any changes with this patch. That function lives in `tx.c`, so I should probably jump straight there and see what's changed in relation to the reported issue. It would make sense to look at how these functions are being called, and if the changes in `rtw_usb_probe` are affecting the logic in `rtw_tx`. Let's see if this lines up with the problem report. |
| 26/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "rtw_tx",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/tx.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/tx.c=11=static\ndrivers/net/wireless/realtek/rtw88/tx.c:12:void rtw_tx_stats(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw88/tx.c-13-\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-34-\ndrivers/net/wireless/realtek/rtw88/tx.c:35:void rtw_tx_fill_tx_desc(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:36:\t\t\t struct rtw_tx_pkt_info *pkt_info, struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw88/tx.c-37-{\ndrivers/net/wireless/realtek/rtw88/tx.c:38:\tstruct rtw_tx_desc *tx_desc = (struct rtw_tx_desc *)skb-\u003edata;\ndrivers/net/wireless/realtek/rtw88/tx.c-39-\tbool more_data = false;\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-93-}\ndrivers/net/wireless/realtek/rtw88/tx.c:94:EXPORT_SYMBOL(rtw_tx_fill_tx_desc);\ndrivers/net/wireless/realtek/rtw88/tx.c-95-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=125=static u8 get_highest_vht_tx_rate(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-165-\ndrivers/net/wireless/realtek/rtw88/tx.c:166:static void rtw_tx_report_enable(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:167:\t\t\t\t struct rtw_tx_pkt_info *pkt_info)\ndrivers/net/wireless/realtek/rtw88/tx.c-168-{\ndrivers/net/wireless/realtek/rtw88/tx.c:169:\tstruct rtw_tx_report *tx_report = \u0026rtwdev-\u003etx_report;\ndrivers/net/wireless/realtek/rtw88/tx.c-170-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-178-\ndrivers/net/wireless/realtek/rtw88/tx.c:179:void rtw_tx_report_purge_timer(struct timer_list *t)\ndrivers/net/wireless/realtek/rtw88/tx.c-180-{\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-182-\t\t\t\t\t\t tx_report.purge_timer);\ndrivers/net/wireless/realtek/rtw88/tx.c:183:\tstruct rtw_tx_report *tx_report = \u0026rtwdev-\u003etx_report;\ndrivers/net/wireless/realtek/rtw88/tx.c-184-\tunsigned long flags;\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-195-\ndrivers/net/wireless/realtek/rtw88/tx.c:196:void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn)\ndrivers/net/wireless/realtek/rtw88/tx.c-197-{\ndrivers/net/wireless/realtek/rtw88/tx.c:198:\tstruct rtw_tx_report *tx_report = \u0026rtwdev-\u003etx_report;\ndrivers/net/wireless/realtek/rtw88/tx.c-199-\tunsigned long timeout = RTW_TX_PROBE_TIMEOUT;\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-216-}\ndrivers/net/wireless/realtek/rtw88/tx.c:217:EXPORT_SYMBOL(rtw_tx_report_enqueue);\ndrivers/net/wireless/realtek/rtw88/tx.c-218-\ndrivers/net/wireless/realtek/rtw88/tx.c:219:static void rtw_tx_report_tx_status(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c-220-\t\t\t\t struct sk_buff *skb, bool acked)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-233-\ndrivers/net/wireless/realtek/rtw88/tx.c:234:void rtw_tx_report_handle(struct rtw_dev *rtwdev, struct sk_buff *skb, int src)\ndrivers/net/wireless/realtek/rtw88/tx.c-235-{\ndrivers/net/wireless/realtek/rtw88/tx.c:236:\tstruct rtw_tx_report *tx_report = \u0026rtwdev-\u003etx_report;\ndrivers/net/wireless/realtek/rtw88/tx.c-237-\tstruct rtw_c2h_cmd *c2h;\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-257-\t\t\t__skb_unlink(cur, \u0026tx_report-\u003equeue);\ndrivers/net/wireless/realtek/rtw88/tx.c:258:\t\t\trtw_tx_report_tx_status(rtwdev, cur, st == 0);\ndrivers/net/wireless/realtek/rtw88/tx.c-259-\t\t\tbreak;\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=265=static u8 rtw_get_mgmt_rate(struct rtw_dev *rtwdev, struct sk_buff *skb,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-277-\ndrivers/net/wireless/realtek/rtw88/tx.c:278:static void rtw_tx_pkt_info_update_rate(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:279:\t\t\t\t\tstruct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-280-\t\t\t\t\tstruct sk_buff *skb,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-296-\ndrivers/net/wireless/realtek/rtw88/tx.c:297:static void rtw_tx_pkt_info_update_sec(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:298:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-299-\t\t\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-323-\ndrivers/net/wireless/realtek/rtw88/tx.c:324:static void rtw_tx_mgmt_pkt_info_update(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:325:\t\t\t\t\tstruct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-326-\t\t\t\t\tstruct ieee80211_sta *sta,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-328-{\ndrivers/net/wireless/realtek/rtw88/tx.c:329:\trtw_tx_pkt_info_update_rate(rtwdev, pkt_info, skb, false);\ndrivers/net/wireless/realtek/rtw88/tx.c-330-\tpkt_info-\u003edis_qselseq = true;\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-335-\ndrivers/net/wireless/realtek/rtw88/tx.c:336:static void rtw_tx_data_pkt_info_update(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:337:\t\t\t\t\tstruct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-338-\t\t\t\t\tstruct ieee80211_sta *sta,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-406-\ndrivers/net/wireless/realtek/rtw88/tx.c:407:void rtw_tx_pkt_info_update(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:408:\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-409-\t\t\t struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-429-\tif (ieee80211_is_mgmt(fc) || ieee80211_is_any_nullfunc(fc))\ndrivers/net/wireless/realtek/rtw88/tx.c:430:\t\trtw_tx_mgmt_pkt_info_update(rtwdev, pkt_info, sta, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-431-\telse if (ieee80211_is_data(fc))\ndrivers/net/wireless/realtek/rtw88/tx.c:432:\t\trtw_tx_data_pkt_info_update(rtwdev, pkt_info, sta, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-433-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-437-\tif (info-\u003eflags \u0026 IEEE80211_TX_CTL_REQ_TX_STATUS)\ndrivers/net/wireless/realtek/rtw88/tx.c:438:\t\trtw_tx_report_enable(rtwdev, pkt_info);\ndrivers/net/wireless/realtek/rtw88/tx.c-439-\ndrivers/net/wireless/realtek/rtw88/tx.c-440-\tpkt_info-\u003ebmc = bmc;\ndrivers/net/wireless/realtek/rtw88/tx.c:441:\trtw_tx_pkt_info_update_sec(rtwdev, pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-442-\tpkt_info-\u003etx_pkt_size = skb-\u003elen;\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-447-\t/* maybe merge with tx status ? */\ndrivers/net/wireless/realtek/rtw88/tx.c:448:\trtw_tx_stats(rtwdev, vif, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-449-}\ndrivers/net/wireless/realtek/rtw88/tx.c-450-\ndrivers/net/wireless/realtek/rtw88/tx.c:451:void rtw_tx_rsvd_page_pkt_info_update(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:452:\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-453-\t\t\t\t struct sk_buff *skb,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-465-\ndrivers/net/wireless/realtek/rtw88/tx.c:466:\trtw_tx_pkt_info_update_rate(rtwdev, pkt_info, skb, true);\ndrivers/net/wireless/realtek/rtw88/tx.c-467-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-496-\ndrivers/net/wireless/realtek/rtw88/tx.c:497:\trtw_tx_pkt_info_update_sec(rtwdev, pkt_info, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-498-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=502=struct sk_buff *\ndrivers/net/wireless/realtek/rtw88/tx.c:503:rtw_tx_write_data_rsvd_page_get(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:504:\t\t\t\tstruct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-505-\t\t\t\tu8 *buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-521-\tskb_put_data(skb, buf, size);\ndrivers/net/wireless/realtek/rtw88/tx.c:522:\trtw_tx_rsvd_page_pkt_info_update(rtwdev, pkt_info, skb, RSVD_BEACON);\ndrivers/net/wireless/realtek/rtw88/tx.c-523-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-525-}\ndrivers/net/wireless/realtek/rtw88/tx.c:526:EXPORT_SYMBOL(rtw_tx_write_data_rsvd_page_get);\ndrivers/net/wireless/realtek/rtw88/tx.c-527-\ndrivers/net/wireless/realtek/rtw88/tx.c=528=struct sk_buff *\ndrivers/net/wireless/realtek/rtw88/tx.c:529:rtw_tx_write_data_h2c_get(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:530:\t\t\t struct rtw_tx_pkt_info *pkt_info,\ndrivers/net/wireless/realtek/rtw88/tx.c-531-\t\t\t u8 *buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-551-}\ndrivers/net/wireless/realtek/rtw88/tx.c:552:EXPORT_SYMBOL(rtw_tx_write_data_h2c_get);\ndrivers/net/wireless/realtek/rtw88/tx.c-553-\ndrivers/net/wireless/realtek/rtw88/tx.c:554:void rtw_tx(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c-555-\t struct ieee80211_tx_control *control,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-557-{\ndrivers/net/wireless/realtek/rtw88/tx.c:558:\tstruct rtw_tx_pkt_info pkt_info = {0};\ndrivers/net/wireless/realtek/rtw88/tx.c-559-\tint ret;\ndrivers/net/wireless/realtek/rtw88/tx.c-560-\ndrivers/net/wireless/realtek/rtw88/tx.c:561:\trtw_tx_pkt_info_update(rtwdev, \u0026pkt_info, control-\u003esta, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-562-\tret = rtw_hci_tx_write(rtwdev, \u0026pkt_info, skb);\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-575-\ndrivers/net/wireless/realtek/rtw88/tx.c:576:static void rtw_txq_check_agg(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:577:\t\t\t struct rtw_txq *rtwtxq,\ndrivers/net/wireless/realtek/rtw88/tx.c-578-\t\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-607-\ndrivers/net/wireless/realtek/rtw88/tx.c:608:static int rtw_txq_push_skb(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:609:\t\t\t struct rtw_txq *rtwtxq,\ndrivers/net/wireless/realtek/rtw88/tx.c-610-\t\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-612-\tstruct ieee80211_txq *txq = rtwtxq_to_txq(rtwtxq);\ndrivers/net/wireless/realtek/rtw88/tx.c:613:\tstruct rtw_tx_pkt_info pkt_info = {0};\ndrivers/net/wireless/realtek/rtw88/tx.c-614-\tint ret;\ndrivers/net/wireless/realtek/rtw88/tx.c-615-\ndrivers/net/wireless/realtek/rtw88/tx.c:616:\trtw_txq_check_agg(rtwdev, rtwtxq, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-617-\ndrivers/net/wireless/realtek/rtw88/tx.c:618:\trtw_tx_pkt_info_update(rtwdev, \u0026pkt_info, txq-\u003esta, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-619-\tret = rtw_hci_tx_write(rtwdev, \u0026pkt_info, skb);\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-627-\ndrivers/net/wireless/realtek/rtw88/tx.c:628:static void rtw_txq_push(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.c:629:\t\t\t struct rtw_txq *rtwtxq,\ndrivers/net/wireless/realtek/rtw88/tx.c-630-\t\t\t unsigned long frames)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-643-\ndrivers/net/wireless/realtek/rtw88/tx.c:644:\t\tret = rtw_txq_push_skb(rtwdev, rtwtxq, skb);\ndrivers/net/wireless/realtek/rtw88/tx.c-645-\t\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-653-\ndrivers/net/wireless/realtek/rtw88/tx.c:654:void __rtw_tx_work(struct rtw_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw88/tx.c-655-{\ndrivers/net/wireless/realtek/rtw88/tx.c:656:\tstruct rtw_txq *rtwtxq, *tmp;\ndrivers/net/wireless/realtek/rtw88/tx.c-657-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-664-\t\tieee80211_txq_get_depth(txq, \u0026frame_cnt, NULL);\ndrivers/net/wireless/realtek/rtw88/tx.c:665:\t\trtw_txq_push(rtwdev, rtwtxq, frame_cnt);\ndrivers/net/wireless/realtek/rtw88/tx.c-666-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-674-\ndrivers/net/wireless/realtek/rtw88/tx.c:675:void rtw_tx_work(struct work_struct *w)\ndrivers/net/wireless/realtek/rtw88/tx.c-676-{\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-678-\ndrivers/net/wireless/realtek/rtw88/tx.c:679:\t__rtw_tx_work(rtwdev);\ndrivers/net/wireless/realtek/rtw88/tx.c-680-}\ndrivers/net/wireless/realtek/rtw88/tx.c-681-\ndrivers/net/wireless/realtek/rtw88/tx.c:682:void rtw_txq_init(struct rtw_dev *rtwdev, struct ieee80211_txq *txq)\ndrivers/net/wireless/realtek/rtw88/tx.c-683-{\ndrivers/net/wireless/realtek/rtw88/tx.c:684:\tstruct rtw_txq *rtwtxq;\ndrivers/net/wireless/realtek/rtw88/tx.c-685-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-688-\ndrivers/net/wireless/realtek/rtw88/tx.c:689:\trtwtxq = (struct rtw_txq *)txq-\u003edrv_priv;\ndrivers/net/wireless/realtek/rtw88/tx.c-690-\tINIT_LIST_HEAD(\u0026rtwtxq-\u003elist);\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-692-\ndrivers/net/wireless/realtek/rtw88/tx.c:693:void rtw_txq_cleanup(struct rtw_dev *rtwdev, struct ieee80211_txq *txq)\ndrivers/net/wireless/realtek/rtw88/tx.c-694-{\ndrivers/net/wireless/realtek/rtw88/tx.c:695:\tstruct rtw_txq *rtwtxq;\ndrivers/net/wireless/realtek/rtw88/tx.c-696-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-699-\ndrivers/net/wireless/realtek/rtw88/tx.c:700:\trtwtxq = (struct rtw_txq *)txq-\u003edrv_priv;\ndrivers/net/wireless/realtek/rtw88/tx.c-701-\tspin_lock_bh(\u0026rtwdev-\u003etxq_lock);\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-706-\ndrivers/net/wireless/realtek/rtw88/tx.c:707:static const enum rtw_tx_queue_type ac_to_hwq[] = {\ndrivers/net/wireless/realtek/rtw88/tx.c-708-\t[IEEE80211_AC_VO] = RTW_TX_QUEUE_VO,\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=714=static_assert(ARRAY_SIZE(ac_to_hwq) == IEEE80211_NUM_ACS);\ndrivers/net/wireless/realtek/rtw88/tx.c-715-\ndrivers/net/wireless/realtek/rtw88/tx.c:716:enum rtw_tx_queue_type rtw_tx_ac_to_hwq(enum ieee80211_ac_numbers ac)\ndrivers/net/wireless/realtek/rtw88/tx.c-717-{\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-722-}\ndrivers/net/wireless/realtek/rtw88/tx.c:723:EXPORT_SYMBOL(rtw_tx_ac_to_hwq);\ndrivers/net/wireless/realtek/rtw88/tx.c-724-\ndrivers/net/wireless/realtek/rtw88/tx.c:725:enum rtw_tx_queue_type rtw_tx_queue_mapping(struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw88/tx.c-726-{\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-729-\tu8 q_mapping = skb_get_queue_mapping(skb);\ndrivers/net/wireless/realtek/rtw88/tx.c:730:\tenum rtw_tx_queue_type queue;\ndrivers/net/wireless/realtek/rtw88/tx.c-731-\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-745-}\ndrivers/net/wireless/realtek/rtw88/tx.c:746:EXPORT_SYMBOL(rtw_tx_queue_mapping);\n"
} |
| 27/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 38411 output: 42 thoughts: 83 Thoughts: **Investigating the `rtw_tx` Function** Okay, so I'm digging into this code, and it looks like `rtw_tx` isn't a directly exported function. I see it being called from `rtw_ops_tx` within `mac80211.c`, which is a common pattern, but the function's definition itself... it's not exported. Hmm. *Wait*, now I'm remembering – there's a `rtw_tx` function over in `tx.c`, isn't there? But yeah, I confirm, it's not explicitly exported, and the declaration is actually present in `tx.h`. I'll need to double check how it's used there, and what the surrounding context tells me about how it interacts with the rest of the driver. Let me go take a look at the declaration in `tx.h` to make sure I understand its signature and any inline hints. |
| 28/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "void rtw_tx",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/tx.h"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/tx.h=85=enum rtw_rsvd_packet_type;\ndrivers/net/wireless/realtek/rtw88/tx.h-86-\ndrivers/net/wireless/realtek/rtw88/tx.h:87:void rtw_tx(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.h-88-\t struct ieee80211_tx_control *control,\ndrivers/net/wireless/realtek/rtw88/tx.h-89-\t struct sk_buff *skb);\ndrivers/net/wireless/realtek/rtw88/tx.h:90:void rtw_txq_init(struct rtw_dev *rtwdev, struct ieee80211_txq *txq);\ndrivers/net/wireless/realtek/rtw88/tx.h:91:void rtw_txq_cleanup(struct rtw_dev *rtwdev, struct ieee80211_txq *txq);\ndrivers/net/wireless/realtek/rtw88/tx.h:92:void rtw_tx_work(struct work_struct *w);\ndrivers/net/wireless/realtek/rtw88/tx.h-93-void __rtw_tx_work(struct rtw_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw88/tx.h:94:void rtw_tx_pkt_info_update(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.h-95-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/tx.h-97-\t\t\t struct sk_buff *skb);\ndrivers/net/wireless/realtek/rtw88/tx.h:98:void rtw_tx_fill_tx_desc(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.h-99-\t\t\t struct rtw_tx_pkt_info *pkt_info, struct sk_buff *skb);\ndrivers/net/wireless/realtek/rtw88/tx.h:100:void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn);\ndrivers/net/wireless/realtek/rtw88/tx.h:101:void rtw_tx_report_handle(struct rtw_dev *rtwdev, struct sk_buff *skb, int src);\ndrivers/net/wireless/realtek/rtw88/tx.h:102:void rtw_tx_rsvd_page_pkt_info_update(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.h-103-\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/tx.h=119=void fill_txdesc_checksum_common(u8 *txdesc, size_t words)\n--\ndrivers/net/wireless/realtek/rtw88/tx.h-133-\ndrivers/net/wireless/realtek/rtw88/tx.h:134:static inline void rtw_tx_fill_txdesc_checksum(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/tx.h-135-\t\t\t\t\t struct rtw_tx_pkt_info *pkt_info,\n"
} |
| 29/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 39671 output: 45 thoughts: 161 Thoughts: **Focusing on Key Symbols** Okay, so I'm thinking, `rtw_tx` looks like a strong candidate for a focus symbol. And, even though it's static, `rtw_usb_tx_write` also seems promising, especially with the possibility of Syzkaller resolving it. Wait, the actual function that was modified in the context of the issue is `rtw_usb_tx_queue_mapping_to_qsel`. Right, right. Let's get these symbols added as focus symbols: `rtw_usb_tx_write` and also `rtw_tx`. Now, just to be completely sure, let's double-check if `rtw_usb_tx_queue_mapping_to_qsel` is static. Yes, it is. Since it's static, and I think it's likely inlined, does `rtw_usb_tx_write` call it? Ah, yes, it does. That means it is inlined. Let's shift our focus to investigating `rtw_usb_tx_write` more closely. |
| 30/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "rtw_usb_tx_write",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/usb.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/usb.c=560=static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-580-\ndrivers/net/wireless/realtek/rtw88/usb.c:581:static int rtw_usb_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/usb.c-582-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=953=static const struct rtw_hci_ops rtw_usb_ops = {\ndrivers/net/wireless/realtek/rtw88/usb.c:954:\t.tx_write = rtw_usb_tx_write,\ndrivers/net/wireless/realtek/rtw88/usb.c-955-\t.tx_kick_off = rtw_usb_tx_kick_off,\n"
} |
| 31/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 40408 output: 43 thoughts: 452 Thoughts: **Fuzzing Focus: Refinement and Prioritization** Okay, so I'm trying to figure out the best functions to target for fuzzing, specifically in this USB TX path. Let's see... Initially, I was looking at `rtw_usb_tx_write`, and yes, I remember it's static. Could I use `rtw_tx`? Yep, it's non-static, which is good. Then I looked at `rtw_usb_probe`, but that's a probe function – definitely not in the critical path I'm interested in fuzzing. Now, the prompt is telling me to avoid generic hot-path functions to keep the tests from skewing. So, `rtw_tx`, is it hot-path? Absolutely. It's called for every single packet transmitted. If I follow the prompt and don't list `rtw_tx`, what are my other options? I considered `rtw_usb_tx_write` but, even though it's static, it is that *specific* callback, so maybe it's the right choice after all. The prompt, however, really emphasizes avoiding the hot-path. If `rtw_tx` is hot-path, it sounds like *none* of them are great. But, this change is all about the TX queue selection. Maybe I should hold off, and perhaps list `rtw_usb_tx_write` alone? I need to re-evaluate what's really important. It seems my focus is on that `rtw_usb_tx_write` function, even if it is a hot path. Now, a quick config check. `MAC80211`, `RTW88`, `RTW88_8822BU`... Aha! `RTW88_8822BU` selects `RTW88_USB`. Good. Let's make sure there aren't any other USB drivers to be mindful of. |
| 32/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "select RTW88_USB",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig=82=config RTW88_8822BU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-85-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:86:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-87-\tselect RTW88_8822B\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=115=config RTW88_8822CU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-118-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:119:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-120-\tselect RTW88_8822C\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=162=config RTW88_8723DU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-165-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:166:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-167-\tselect RTW88_8723D\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=195=config RTW88_8821CU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-198-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:199:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-200-\tselect RTW88_8821C\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=206=config RTW88_8821AU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-209-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:210:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-211-\tselect RTW88_8821A\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=217=config RTW88_8812AU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-220-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:221:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-222-\tselect RTW88_8812A\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=239=config RTW88_8814AU\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-242-\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:243:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-244-\tselect RTW88_8814A\n"
} |
| 33/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 42253 output: 43 thoughts: 134 Thoughts: **My Current Reasoning on Driver Configuration** Okay, so I'm looking at these driver options, and initially, I was thinking we needed to list both `RTW88_8822BU` and `RTW88_USB`. But hold on... after a quick check, `RTW88_USB` is a tristate, so that simplifies things. In fact, listing both is a little redundant. We'll stick to listing `RTW88_USB` and `RTW88_8822BU`. But, wait a second, let me think this through completely. Looking at the dependencies again, and yes, `RTW88_USB` is *selected by* `RTW88_8822BU`. So, if we enable `RTW88_8822BU`, `RTW88_USB` will come along for the ride, and we only need to enable `RTW88_8822BU`. So, enabling `RTW88_8822BU` is sufficient to enable both. Therefore, let's now confirm that `RTW88_USB` is *not* intended to be enabled independently. |
| 34/2 | 2026/08/14 06:42 | tool | grepper |
0mArgs:{
"Expression": "config RTW88_USB",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig=20=config RTW88_SDIO\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-22-\ndrivers/net/wireless/realtek/rtw88/Kconfig:23:config RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-24-\ttristate\n"
} |
| 35/2 | 2026/08/14 06:42 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 42811 output: 42 thoughts: 70 Thoughts: **My Approach to Selecting This Device** Okay, so I'm looking at this device, and the first thing I notice is that it's just *there*. No specific prompt to activate it. That means I need to trigger it indirectly, right? I need to get one of the drivers that can *select* this thing to kick in. Let's see... looking at the options, `RTW88_8822BU` seems like a likely candidate. It looks like it handles devices like this one. But hold on, before I jump to the specific model driver, I need to make sure the base `RTW88` driver is enabled first. That's the foundation. So, let me check the dependencies for `RTW88`. I need to make sure that's all squared away before I even look at the finer details. We don't want to get ahead of ourselves. |
| 36/2 | 2026/08/14 06:43 | tool | grepper |
0mArgs:{
"Expression": "menuconfig RTW88",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/realtek/rtw88/Kconfig:2:menuconfig RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-3-\ttristate \"Realtek 802.11ac wireless chips support\"\n"
} |
| 37/2 | 2026/08/14 06:43 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 43227 output: 38 thoughts: 23 Thoughts: Here's my attempt at summarizing the thought process in the first person, assuming the user is an expert: **Dependency Check** Okay, so I'm dealing with `RTW88`, and something's nagging at me. It feels like `RTW88` depends on, or interfaces with, `MAC80211`. Time to verify that assumption. Before I dig deeper, I need to confirm whether or not `RTW88` relies on that specific MAC layer implementation. This is the logical first step before troubleshooting whatever issue I have, or exploring how these two relate to each other. Best to get the architecture right from the start. Let's see... I'll pull up the documentation/code/whatever's relevant and confirm that relationship. |
| 38/2 | 2026/08/14 06:43 | tool | grepper |
0mArgs:{
"Expression": "depends on",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/Kconfig"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/Kconfig=2=menuconfig RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-3-\ttristate \"Realtek 802.11ac wireless chips support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:4:\tdepends on MAC80211\ndrivers/net/wireless/realtek/rtw88/Kconfig-5-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=60=config RTW88_8822BE\ndrivers/net/wireless/realtek/rtw88/Kconfig-61-\ttristate \"Realtek 8822BE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:62:\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-63-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=71=config RTW88_8822BS\ndrivers/net/wireless/realtek/rtw88/Kconfig-72-\ttristate \"Realtek 8822BS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:73:\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig-74-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=82=config RTW88_8822BU\ndrivers/net/wireless/realtek/rtw88/Kconfig-83-\ttristate \"Realtek 8822BU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:84:\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-85-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=93=config RTW88_8822CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-94-\ttristate \"Realtek 8822CE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:95:\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-96-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=104=config RTW88_8822CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-105-\ttristate \"Realtek 8822CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:106:\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig-107-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=115=config RTW88_8822CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-116-\ttristate \"Realtek 8822CU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:117:\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-118-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=126=config RTW88_8723DE\ndrivers/net/wireless/realtek/rtw88/Kconfig-127-\ttristate \"Realtek 8723DE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:128:\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-129-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=137=config RTW88_8723DS\ndrivers/net/wireless/realtek/rtw88/Kconfig-138-\ttristate \"Realtek 8723DS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:139:\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig-140-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=148=config RTW88_8723CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-149-\ttristate \"Realtek 8723CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:150:\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig-151-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=162=config RTW88_8723DU\ndrivers/net/wireless/realtek/rtw88/Kconfig-163-\ttristate \"Realtek 8723DU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:164:\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-165-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=173=config RTW88_8821CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-174-\ttristate \"Realtek 8821CE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:175:\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-176-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=184=config RTW88_8821CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-185-\ttristate \"Realtek 8821CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:186:\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig-187-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=195=config RTW88_8821CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-196-\ttristate \"Realtek 8821CU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:197:\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-198-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=206=config RTW88_8821AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-207-\ttristate \"Realtek 8821AU/8811AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:208:\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-209-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=217=config RTW88_8812AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-218-\ttristate \"Realtek 8812AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:219:\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-220-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=228=config RTW88_8814AE\ndrivers/net/wireless/realtek/rtw88/Kconfig-229-\ttristate \"Realtek 8814AE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:230:\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-231-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=239=config RTW88_8814AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-240-\ttristate \"Realtek 8814AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:241:\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-242-\tselect RTW88_CORE\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=250=config RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/Kconfig-251-\tbool \"Realtek rtw88 debug support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:252:\tdepends on RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-253-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=258=config RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/Kconfig-259-\tbool \"Realtek rtw88 debugfs support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:260:\tdepends on RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-261-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig=266=config RTW88_LEDS\ndrivers/net/wireless/realtek/rtw88/Kconfig-267-\tbool\ndrivers/net/wireless/realtek/rtw88/Kconfig:268:\tdepends on LEDS_CLASS=y || LEDS_CLASS=MAC80211\ndrivers/net/wireless/realtek/rtw88/Kconfig-269-\tdefault y\n"
} |
| 39/2 | 2026/08/14 06:43 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 46167 output: 119 thoughts: 847 Thoughts: **My Analysis of the Realtek rtw88 USB Driver for Fuzzing** Okay, let's break this down. First, I need to identify the relevant configurations and entry points for fuzzing this Realtek driver. I see that `RTW88` depends on `MAC80211`, and `RTW88_8822BU` specifically depends on `USB`. Since `MAC80211` and `USB` are typically enabled by default, I'll focus my configuration efforts on enabling `RTW88` and `RTW88_8822BU`. Now for the critical part: the focus symbols. The prompt is steering me towards non-static, non-inlined API entry points. I initially considered `rtw_tx` and `rtw_usb_tx_write`, but then I realized `rtw_usb_tx_write` is static. Digging deeper, I traced the call chain. `rtw_usb_tx_write` is called through a function pointer (`rtwdev->hci.ops->tx_write`), and I found `rtw_hci_tx_write` which, while inline, is called by `rtw_tx` and `rtw_txq_push_skb`. So, I'll list `rtw_tx` as the non-static API entry point. I double-checked `tx.c` and confirmed that `rtw_tx` is indeed non-static. Then, I looked for other potential entry points. `rtw_txq_push_skb` is static, as is `rtw_txq_push`. However, `__rtw_tx_work` and `rtw_tx_work` are non-static. I confirmed that `rtw_tx_work` is non-static as well. Therefore, after a thorough review, I'm confident in my analysis. Here's my summary: * **WorthFuzzing:** True (because this TX queue logic is functionally significant) * **FocusSymbols:** `rtw_tx`, `rtw_tx_work` * **EnableConfigs:** `RTW88`, `RTW88_8822BU` * **Reasoning:** The patch touches TX queue selection logic for broadcast/multicast packets within the Realtek rtw88 USB driver. This is a functional area reachable via mac80211 when sending packets over a USB interface. Finally, while my initial analysis suggested `RTW88_8822BU` as the only USB driver, a quick check of other available RTW88 drivers indicates that selecting this is enough to enable USB compilation. Let's call set-results. |
| 40/2 | 2026/08/14 06:43 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"RTW88",
"RTW88_8822BU"
],
"FocusSymbols": [
"rtw_tx",
"rtw_tx_work"
],
"Reasoning": "The patch modifies the TX queue selection logic for broadcast/multicast packets in the Realtek rtw88 USB driver. This is a functional change in the driver's TX path, reachable via mac80211 when sending packets over a USB interface.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"RTW88",
"RTW88_8822BU"
],
"FocusSymbols": [
"rtw_tx",
"rtw_tx_work"
],
"Reasoning": "The patch modifies the TX queue selection logic for broadcast/multicast packets in the Realtek rtw88 USB driver. This is a functional change in the driver's TX path, reachable via mac80211 when sending packets over a USB interface.",
"WorthFuzzing": true
} |
| 41/1 | 2026/08/14 06:43 | action | If |
0mArgs:{
"WorthFuzzing": true
}Results: null |
| 42/2 | 2026/08/14 06:43 | agent | kmsan-evaluator |
0mModel:best-expensive Args: null Results: {
"KMSANReasoning": "The patch modifies the queue selection logic for transmitted packets in the Realtek rtw88 USB driver. It checks a flag in the `ieee80211_tx_info` struct (stored in `skb-\u003ecb`) to determine the appropriate queue for broadcast/multicast packets. The `skb-\u003ecb` field is fully initialized by the mac80211 subsystem before the packet is passed to the driver for transmission. There is no risk of reading uninitialized memory, nor does this patch introduce any new allocations or structures that could leak uninitialized data to user space or hardware. The issue is a purely logical bug in queue assignment, which does not require KMSAN to detect. Standard testing or KASAN is sufficient for general memory safety, and KMSAN is not applicable here.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: For your convenience, here is the diff of the changes:
commit 5fb2f6e61b2568dc2c3d097823ff2886a95a9779
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Aug 14 06:41:41 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 64e1c3420e0a8..43b9cdb4a79b0 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -560,6 +560,7 @@ static int rtw_usb_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)
static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)
{
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
__le16 fc = hdr->frame_control;
u8 qsel;
@@ -567,7 +568,8 @@ static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)
qsel = TX_DESC_QSEL_MGMT;
else if (is_broadcast_ether_addr(hdr->addr1) ||
is_multicast_ether_addr(hdr->addr1))
- qsel = TX_DESC_QSEL_HIGH;
+ qsel = (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ?
+ TX_DESC_QSEL_HIGH : skb->priority;
else if (skb_get_queue_mapping(skb) <= IEEE80211_AC_BK)
qsel = skb->priority;
else
|
| 43/3 | 2026/08/14 06:43 | llm | kmsan-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2271 output: 52 thoughts: 327 Thoughts: **Analyzing a Potential Kernel Memory Safety Issue** Okay, so I'm looking at this patch in `drivers/net/wireless/realtek/rtw88/usb.c`. It's a modification to the `rtw_usb_tx_queue_mapping_to_qsel` function, and the change is a little concerning. They've introduced `struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);` and then altered the logic to use `info->flags`. Specifically, it's now checking `(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)`. My immediate thought is: could `info->flags` be uninitialized? Anytime I see an access to a structure member that's potentially derived from a macro, my antenna goes up. `IEEE80211_SKB_CB(skb)` is just accessing `skb->cb`, which is the control buffer. The critical question here is whether `skb->cb` is guaranteed to be initialized before `rtw_usb_tx_queue_mapping_to_qsel` is called. From my experience, the `mac80211` layer is usually responsible for initializing `IEEE80211_SKB_CB(skb)` – it's typically set up for outgoing packets. If `info->flags` happens to be uninitialized, then we could be facing a Kernel Memory Sanitizer (KMSAN) issue, which would be bad news bears. However, the networking stack and/or `mac80211` generally do a good job of zeroing or initializing `skb->cb` before it hits the driver. Still, I'm not taking anything for granted, so I'm going to track down every call to `rtw_usb_tx_queue_mapping_to_qsel` in the code. I need to understand where this function is being used to make a determination about whether the patch is truly safe. |
| 44/3 | 2026/08/14 06:43 | tool | grepper |
0mArgs:{
"Expression": "rtw_usb_tx_queue_mapping_to_qsel",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/usb.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/usb.c=550=static int rtw_usb_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-559-\ndrivers/net/wireless/realtek/rtw88/usb.c:560:static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw88/usb.c-561-{\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=581=static int rtw_usb_tx_write(struct rtw_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-590-\ndrivers/net/wireless/realtek/rtw88/usb.c:591:\tpkt_info-\u003eqsel = rtw_usb_tx_queue_mapping_to_qsel(skb);\ndrivers/net/wireless/realtek/rtw88/usb.c-592-\tpkt_desc = skb_push(skb, chip-\u003etx_pkt_desc_sz);\n"
} |
| 45/3 | 2026/08/14 06:43 | llm | kmsan-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3434 output: 45 thoughts: 47 Thoughts: Here's my take on the thought process, as if it were my own: **Investigating the USB TX Write Function** Okay, I'm tracing down this `rtw_usb_tx_write` function. The code says it's calling `rtw_usb_tx_queue_mapping_to_qsel`. My immediate thought is, I need to understand the call graph to this function to get the complete picture. Where else is this `rtw_usb_tx_write` function even *used*? I'm going to have to find the call sites. |
| 46/3 | 2026/08/14 06:43 | tool | grepper |
0mArgs:{
"Expression": "rtw_usb_tx_write",
"PathPrefix": "drivers/net/wireless/realtek/rtw88/usb.c"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw88/usb.c=560=static u8 rtw_usb_tx_queue_mapping_to_qsel(struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-580-\ndrivers/net/wireless/realtek/rtw88/usb.c:581:static int rtw_usb_tx_write(struct rtw_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw88/usb.c-582-\t\t\t struct rtw_tx_pkt_info *pkt_info,\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=953=static const struct rtw_hci_ops rtw_usb_ops = {\ndrivers/net/wireless/realtek/rtw88/usb.c:954:\t.tx_write = rtw_usb_tx_write,\ndrivers/net/wireless/realtek/rtw88/usb.c-955-\t.tx_kick_off = rtw_usb_tx_kick_off,\n"
} |
| 47/3 | 2026/08/14 06:43 | llm | kmsan-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3944 output: 192 thoughts: 474 Thoughts: **My Assessment of the Realtek rtw88 USB Driver Patch** Okay, so this patch is touching the `rtw_hci_ops` within the Realtek rtw88 USB driver. It's related to the transmit path, specifically in `tx.c` or a similar file, where the core driver gets involved. I see that `skb->cb` is being used to store the `ieee80211_tx_info` struct, which is initialized by mac80211. My immediate concern was whether this patch introduces any uninitialized memory reads. Looking at the logic, the patch changes how the `qsel` variable is assigned. It used to be hardcoded to `TX_DESC_QSEL_HIGH`, but now it's conditionally set based on `info->flags` and `skb->priority`. The key here is that `skb->cb`, and therefore `info`, is *fully initialized* by mac80211 *before* the driver even sees it. This means there's no risk of reading uninitialized memory, which is what I was initially concerned about. Essentially, this is a logic change to correctly assign `qsel`. Before, multicast/broadcast frames were always forced to `TX_DESC_QSEL_HIGH`, which is incorrect. The patch fixes this by using `skb->priority` unless the `IEEE80211_TX_CTL_SEND_AFTER_DTIM` flag is set. The real issue is that the queue selection was logically flawed. Therefore, because this is purely a logic bug in queue selection, and doesn't introduce any new allocation or usage of uninitialized memory, there's no need for KMSAN to be involved. This is a case where standard testing and KASAN should be sufficient for memory safety. I'm comfortable stating that `NeedsKMSAN` should be false. |
| 48/3 | 2026/08/14 06:43 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch modifies the queue selection logic for transmitted packets in the Realtek rtw88 USB driver. It checks a flag in the `ieee80211_tx_info` struct (stored in `skb-\u003ecb`) to determine the appropriate queue for broadcast/multicast packets. The `skb-\u003ecb` field is fully initialized by the mac80211 subsystem before the packet is passed to the driver for transmission. There is no risk of reading uninitialized memory, nor does this patch introduce any new allocations or structures that could leak uninitialized data to user space or hardware. The issue is a purely logical bug in queue assignment, which does not require KMSAN to detect. Standard testing or KASAN is sufficient for general memory safety, and KMSAN is not applicable here.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch modifies the queue selection logic for transmitted packets in the Realtek rtw88 USB driver. It checks a flag in the `ieee80211_tx_info` struct (stored in `skb-\u003ecb`) to determine the appropriate queue for broadcast/multicast packets. The `skb-\u003ecb` field is fully initialized by the mac80211 subsystem before the packet is passed to the driver for transmission. There is no risk of reading uninitialized memory, nor does this patch introduce any new allocations or structures that could leak uninitialized data to user space or hardware. The issue is a purely logical bug in queue assignment, which does not require KMSAN to detect. Standard testing or KASAN is sufficient for general memory safety, and KMSAN is not applicable here.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|