AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The modifications are in the NXP WiFi driver (drivers/net/wireless/nxp/nxpwifi/cfg80211.c), which is an SDIO-based wireless network driver (CONFIG_NXPWIFI / CONFIG_NXPWIFI_SDIO) requiring physical NXP IW61x hardware. The driver cannot be instantiated or reached in virtualized environments like QEMU or GCE without dedicated physical hardware.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit ab1f2faf7bbe1ea0a1fdbd7d56b975facaae266f\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Aug 31 07:56:59 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\nindex 5cc8cdf594d3e..335221c4f17d1 100644\n--- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\n+++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\n@@ -844,8 +844,7 @@ nxpwifi_change_vif_to_sta(struct net_device *dev,\n \tupdate_vif_type_counter(adapter, type, 1);\n \tdev-\u003eieee80211_ptr-\u003eiftype = type;\n \n-\tif (nxpwifi_set_bss_mode(priv))\n-\t\treturn -1;\n+\tret = nxpwifi_set_bss_mode(priv);\n \n \tif (ret)\n \t\tgoto done;\n@@ -888,8 +887,7 @@ nxpwifi_change_vif_to_ap(struct net_device *dev,\n \tupdate_vif_type_counter(adapter, type, 1);\n \tdev-\u003eieee80211_ptr-\u003eiftype = type;\n \n-\tif (nxpwifi_set_bss_mode(priv))\n-\t\treturn -1;\n+\tret = nxpwifi_set_bss_mode(priv);\n \n \tif (ret)\n \t\tgoto done;\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The modifications are in the NXP WiFi driver (drivers/net/wireless/nxp/nxpwifi/cfg80211.c), which is an SDIO-based wireless network driver (CONFIG_NXPWIFI / CONFIG_NXPWIFI_SDIO) requiring physical NXP IW61x hardware. The driver cannot be instantiated or reached in virtualized environments like QEMU or GCE without dedicated physical hardware.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit ab1f2faf7bbe1ea0a1fdbd7d56b975facaae266f
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Aug 31 07:56:59 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
index 5cc8cdf594d3e..335221c4f17d1 100644
--- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
+++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
@@ -844,8 +844,7 @@ nxpwifi_change_vif_to_sta(struct net_device *dev,
 	update_vif_type_counter(adapter, type, 1);
 	dev->ieee80211_ptr->iftype = type;
 
-	if (nxpwifi_set_bss_mode(priv))
-		return -1;
+	ret = nxpwifi_set_bss_mode(priv);
 
 	if (ret)
 		goto done;
@@ -888,8 +887,7 @@ nxpwifi_change_vif_to_ap(struct net_device *dev,
 	update_vif_type_counter(adapter, type, 1);
 	dev->ieee80211_ptr->iftype = type;
 
-	if (nxpwifi_set_bss_mode(priv))
-		return -1;
+	ret = nxpwifi_set_bss_mode(priv);
 
 	if (ret)
 		goto done;

gemini-3.7-flash

null

null

							input: 2261
							output: 30
							thoughts: 140
						

**Analyzing a Wireless Driver Patch**

Alright, let's dive into this patch. The key file here is `drivers/net/wireless/nxp/nxpwifi/cfg80211.c`, which immediately suggests we're dealing with the NXP WiFi driver. My initial instinct is to understand the bus interaction. Is this a USB-based device, SDIO, or perhaps PCIe? This is crucial for determining how we can effectively fuzz it. If it's USB, can we leverage USB gadget modes or raw gadget approaches? Or perhaps even emulate the device? Of course, if it's SDIO or PCIe, that changes the game.

To understand the driver's internals a bit better, I'll need to explore the `drivers/net/wireless/nxp/nxpwifi/` directory more closely. I'll likely use `codesearch-dir-index` or `read-file` or `grepper` to quickly get an overview of the code and how it interacts with the underlying hardware, if possible. This should help clarify the bus interface and potential fuzzing vectors.

{
  "Dir": "drivers/net/wireless/nxp/nxpwifi"
}

{
  "Files": [
    "11ac.c",
    "11ac.h",
    "11ax.c",
    "11ax.h",
    "11h.c",
    "11n.c",
    "11n.h",
    "11n_aggr.c",
    "11n_aggr.h",
    "11n_rxreorder.c",
    "11n_rxreorder.h",
    "cfg.h",
    "cfg80211.c",
    "cfg80211.h",
    "cfp.c",
    "cmdevt.c",
    "cmdevt.h",
    "debugfs.c",
    "ethtool.c",
    "fw.h",
    "ie.c",
    "init.c",
    "join.c",
    "main.c",
    "main.h",
    "scan.c",
    "sdio.c",
    "sdio.h",
    "sta_cfg.c",
    "sta_cmd.c",
    "sta_event.c",
    "sta_rx.c",
    "sta_tx.c",
    "txrx.c",
    "uap_cmd.c",
    "uap_event.c",
    "uap_txrx.c",
    "util.c",
    "util.h",
    "wmm.c",
    "wmm.h"
  ],
  "Subdirs": null
}

gemini-3.7-flash

null

null

							input: 3002
							output: 28
							thoughts: 53
						

**Kconfig Hunting for nxpwifi**

Okay, time to track down the Kconfig entries related to `nxpwifi`. Where are they hiding? My first instinct is to use `grep` and search for the string `nxpwifi`. That should be a quick way to locate any mentions within the build system. Alternatively, I know I can often find drivers within `drivers/net/wireless` which might contain a dedicated `nxp` directory and then a `Kconfig` file. I'll need to check `drivers/net/wireless/nxp/Kconfig` and also the more general `drivers/net/wireless/Kconfig` to be thorough. Let's see what the Kconfig files reveal.

{
  "Expression": "nxpwifi",
  "PathPrefix": "drivers/net/wireless"
}

{
  "Output": "\nFull output is too long, showing 500 out of 15172 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/nxp/Kconfig=13=if WLAN_VENDOR_NXP\ndrivers/net/wireless/nxp/Kconfig-14-\ndrivers/net/wireless/nxp/Kconfig:15:source \"drivers/net/wireless/nxp/nxpwifi/Kconfig\"\ndrivers/net/wireless/nxp/Kconfig-16-\n--\ndrivers/net/wireless/nxp/Makefile-2-\ndrivers/net/wireless/nxp/Makefile:3:obj-$(CONFIG_NXPWIFI)\t+= nxpwifi/\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-2-/*\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:3: * nxpwifi 802.11ac helpers\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-4- * Copyright 2011-2024 NXP\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c=36=static u16\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:37:nxpwifi_convert_mcsmap_to_maxrate(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-38-\t\t\t\t  u16 bands, u16 mcs_map)\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-42-\tu32 usr_vht_cap_info = 0;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:43:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-44-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c=79=static void\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:80:nxpwifi_fill_vht_cap_info(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-81-\t\t\t  struct ieee80211_vht_cap *vht_cap, u16 bands)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-82-{\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:83:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-84-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c=93=void\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:94:nxpwifi_fill_vht_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-95-\t\t\t struct ieee80211_vht_cap *vht_cap, u16 bands)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-96-{\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:97:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-98-\tu16 mcs_map_user, mcs_map_resp, mcs_map_result;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-101-\t/* Fill VHT capability info. */\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:102:\tnxpwifi_fill_vht_cap_info(priv, vht_cap, bands);\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-103-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-123-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:124:\ttmp = nxpwifi_convert_mcsmap_to_maxrate(priv, bands, mcs_map_result);\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-125-\tvht_cap-\u003esupp_mcs.rx_highest = cpu_to_le16(tmp);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-145-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:146:\ttmp = nxpwifi_convert_mcsmap_to_maxrate(priv, bands, mcs_map_result);\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-147-\tvht_cap-\u003esupp_mcs.tx_highest = cpu_to_le16(tmp);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-149-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:150:int nxpwifi_cmd_append_11ac_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:151:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-152-\t\t\t\tu8 **buffer)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-153-{\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:154:\tstruct nxpwifi_ie_types_vhtcap *vht_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:155:\tstruct nxpwifi_ie_types_oper_mode_ntf *oper_ntf;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-156-\tstruct ieee_types_oper_mode_ntf *ieee_oper_ntf;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:157:\tstruct nxpwifi_ie_types_vht_oper *vht_op;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:158:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-159-\tu8 supp_chwd_set;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-169-\tif (bss_desc-\u003ebcn_vht_cap) {\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:170:\t\tvht_cap = (struct nxpwifi_ie_types_vhtcap *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-171-\t\tmemset(vht_cap, 0, sizeof(*vht_cap));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-174-\t\t\tcpu_to_le16(sizeof(struct ieee80211_vht_cap));\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:175:\t\tmemcpy((u8 *)vht_cap + sizeof(struct nxpwifi_ie_types_header),\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-176-\t\t       (u8 *)bss_desc-\u003ebcn_vht_cap,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-178-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:179:\t\tnxpwifi_fill_vht_cap_tlv(priv, \u0026vht_cap-\u003evht_cap,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-180-\t\t\t\t\t bss_desc-\u003ebss_band);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-187-\t\tif (priv-\u003ebss_mode == NL80211_IFTYPE_STATION) {\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:188:\t\t\tvht_op = (struct nxpwifi_ie_types_vht_oper *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-189-\t\t\tmemset(vht_op, 0, sizeof(*vht_op));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-192-\t\t\tvht_op-\u003eheader.len  = cpu_to_le16(sizeof(*vht_op) -\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:193:\t\t\t\tsizeof(struct nxpwifi_ie_types_header));\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-194-\t\t\tmemcpy((u8 *)vht_op +\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:195:\t\t\t\tsizeof(struct nxpwifi_ie_types_header),\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-196-\t\t\t       (u8 *)bss_desc-\u003ebcn_vht_oper,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-244-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:245:int nxpwifi_cmd_11ac_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-246-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:247:\t\t\t struct nxpwifi_11ac_vht_cfg *cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-248-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-264-/* Initialize BlockAck parameters for 11ac. */\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:265:void nxpwifi_set_11ac_ba_params(struct nxpwifi_private *priv)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-266-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-2-/*\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:3: * nxpwifi: 802.11ac (VHT) definitions\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-4- *\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.h=14=enum vht_cfg_misc_config {\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-24-\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:25:int nxpwifi_cmd_append_11ac_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:26:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-27-\t\t\t\tu8 **buffer);\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:28:int nxpwifi_cmd_11ac_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-29-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:30:\t\t\t struct nxpwifi_11ac_vht_cfg *cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:31:void nxpwifi_fill_vht_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-32-\t\t\t      struct ieee80211_vht_cap *vht_cap, u16 bands);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-1-// SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:2:/* nxpwifi: 802.11ax (HE) support\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-3- * Copyright (C) 2011-2024 NXP\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-10-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:11:void nxpwifi_update_11ax_cap(struct nxpwifi_adapter *adapter,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-12-\t\t\t     struct hw_spec_extension *hw_he_cap)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-13-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:14:\tstruct nxpwifi_private *priv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:15:\tstruct nxpwifi_ie_types_he_cap *he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:16:\tstruct nxpwifi_ie_types_he_cap *user_he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:17:\tu8 header_len = sizeof(struct nxpwifi_ie_types_header);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-18-\tu16 data_len = le16_to_cpu(hw_he_cap-\u003eheader.len);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-22-\tif ((data_len + header_len) \u003e sizeof(adapter-\u003ehw_he_cap)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:23:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-24-\t\t\t    \"hw_he_cap too big, len=%d\\n\",\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-28-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:29:\the_cap = (struct nxpwifi_ie_types_he_cap *)hw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-30-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-37-\t\the_cap_2g = true;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:38:\t\tnxpwifi_dbg_dump(adapter, CMD_D, \"2.4G HE capability element \",\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-39-\t\t\t\t adapter-\u003ehw_2g_he_cap,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-45-\t\tadapter-\u003efw_bands |= BAND_AAX;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:46:\t\tnxpwifi_dbg_dump(adapter, CMD_D, \"5G HE capability element \",\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-47-\t\t\t\t adapter-\u003ehw_he_cap,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-57-\t\t\t       sizeof(adapter-\u003ehw_2g_he_cap));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:58:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-59-\t\t\t\tpriv-\u003euser_2g_he_cap;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-63-\t\t\t       sizeof(adapter-\u003ehw_he_cap));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:64:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-65-\t\t\t\tpriv-\u003euser_he_cap;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-78-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:79:bool nxpwifi_11ax_bandconfig_allowed(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:80:\t\t\t\t     struct nxpwifi_bssdescriptor *bss_desc)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-81-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-94-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:95:int nxpwifi_fill_he_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:96:\t\t\t    struct nxpwifi_ie_types_he_cap *he_cap,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-97-\t\t\t    u16 bands)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-98-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:99:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:100:\tstruct nxpwifi_ie_types_he_cap *hw_he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-101-\tu16 rx_nss, tx_nss;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-108-\t\tmemcpy(he_cap, priv-\u003euser_he_cap, priv-\u003euser_he_cap_len);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:109:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)adapter-\u003ehw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-110-\t\tret_len = priv-\u003euser_he_cap_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-112-\t\tmemcpy(he_cap, priv-\u003euser_2g_he_cap, priv-\u003euser_2g_he_cap_len);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:113:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)adapter-\u003ehw_2g_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-114-\t\tret_len = priv-\u003euser_2g_he_cap_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-125-\tfor (nss = 1; nss \u003c= 8; nss++) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:126:\t\tcfg_value = nxpwifi_get_he_nss_mcs(he_cap-\u003erx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:127:\t\thw_value = nxpwifi_get_he_nss_mcs(hw_he_cap-\u003erx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-128-\t\tif (rx_nss != 0 \u0026\u0026 nss \u003e rx_nss)\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-130-\t\tif (hw_value == NO_NSS_SUPPORT || cfg_value == NO_NSS_SUPPORT)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:131:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003erx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-132-\t\t\t\t\t       NO_NSS_SUPPORT);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-133-\t\telse\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:134:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003erx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-135-\t\t\t\t\t       min(cfg_value, hw_value));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-138-\tfor (nss = 1; nss \u003c= 8; nss++) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:139:\t\tcfg_value = nxpwifi_get_he_nss_mcs(he_cap-\u003etx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:140:\t\thw_value = nxpwifi_get_he_nss_mcs(hw_he_cap-\u003etx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-141-\t\tif (tx_nss != 0 \u0026\u0026 nss \u003e tx_nss)\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-143-\t\tif (hw_value == NO_NSS_SUPPORT || cfg_value == NO_NSS_SUPPORT)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:144:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003etx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-145-\t\t\t\t\t       NO_NSS_SUPPORT);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-146-\t\telse\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:147:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003etx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-148-\t\t\t\t\t       min(cfg_value, hw_value));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-153-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:154:int nxpwifi_cmd_append_11ax_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:155:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-156-\t\t\t\tu8 **buffer)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-157-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:158:\tstruct nxpwifi_ie_types_he_cap *he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-159-\tint ret_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-163-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:164:\the_cap = (struct nxpwifi_ie_types_he_cap *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:165:\tret_len = nxpwifi_fill_he_cap_tlv(priv, he_cap, bss_desc-\u003ebss_band);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-166-\t*buffer += ret_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-170-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:171:int nxpwifi_cmd_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-172-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:173:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-174-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-176-\tu16 cmd_size;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:177:\tstruct nxpwifi_ie_types_header *header;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-178-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-186-\t    ax_cfg-\u003ehe_cap_cfg.ext_id == WLAN_EID_EXT_HE_CAPABILITY) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:187:\t\theader = (struct nxpwifi_ie_types_header *)he_cfg-\u003etlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-188-\t\theader-\u003etype = cpu_to_le16(ax_cfg-\u003ehe_cap_cfg.id);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-200-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:201:int nxpwifi_ret_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-202-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:203:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-204-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-205-\tstruct host_cmd_11ax_cfg *he_cfg = \u0026resp-\u003eparams.ax_cfg;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:206:\tstruct nxpwifi_ie_types_header *header;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-207-\tu16 left_len, tlv_type, tlv_len;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-208-\tu8 ext_id;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:209:\tstruct nxpwifi_11ax_he_cap_cfg *he_cap = \u0026ax_cfg-\u003ehe_cap_cfg;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-210-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-211-\tleft_len = le16_to_cpu(resp-\u003esize) - sizeof(*he_cfg) - S_DS_GEN;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:212:\theader = (struct nxpwifi_ie_types_header *)he_cfg-\u003etlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-213-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-242-\t\tleft_len -= (sizeof(*header) + tlv_len);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:243:\t\theader = (struct nxpwifi_ie_types_header *)((u8 *)header +\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-244-\t\t\t\t\t\t\t    sizeof(*header) +\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-250-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:251:int nxpwifi_cmd_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-252-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:253:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-254-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:255:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-256-\tstruct host_cmd_11ax_cmd *he_cmd = \u0026cmd-\u003eparams.ax_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-257-\tu16 cmd_size;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:258:\tstruct nxpwifi_11ax_sr_cmd *sr_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:259:\tstruct nxpwifi_ie_types_data *tlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:260:\tstruct nxpwifi_11ax_beam_cmd *beam_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:261:\tstruct nxpwifi_11ax_htc_cmd *htc_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:262:\tstruct nxpwifi_11ax_txomi_cmd *txmoi_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:263:\tstruct nxpwifi_11ax_toltime_cmd *toltime_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:264:\tstruct nxpwifi_11ax_txop_cmd *txop_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:265:\tstruct nxpwifi_11ax_set_bsrp_cmd *set_bsrp_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:266:\tstruct nxpwifi_11ax_llde_cmd *llde_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-267-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-275-\tcase NXPWIFI_11AXCMD_SR_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:276:\t\tsr_cmd = (struct nxpwifi_11ax_sr_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-277-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:278:\t\ttlv = (struct nxpwifi_ie_types_data *)he_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-279-\t\ttlv-\u003eheader.type = cpu_to_le16(sr_cmd-\u003etype);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-285-\tcase NXPWIFI_11AXCMD_BEAM_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:286:\t\tbeam_cmd = (struct nxpwifi_11ax_beam_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-287-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-291-\tcase NXPWIFI_11AXCMD_HTC_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:292:\t\thtc_cmd = (struct nxpwifi_11ax_htc_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-293-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-297-\tcase NXPWIFI_11AXCMD_TXOMI_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:298:\t\ttxmoi_cmd =\t(struct nxpwifi_11ax_txomi_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-299-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-303-\tcase NXPWIFI_11AXCMD_OBSS_TOLTIME_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:304:\t\ttoltime_cmd = (struct nxpwifi_11ax_toltime_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-305-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-310-\tcase NXPWIFI_11AXCMD_TXOPRTS_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:311:\t\ttxop_cmd = (struct nxpwifi_11ax_txop_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-312-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-317-\tcase NXPWIFI_11AXCMD_SET_BSRP_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:318:\t\tset_bsrp_cmd = (struct nxpwifi_11ax_set_bsrp_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-319-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-323-\tcase NXPWIFI_11AXCMD_LLDE_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:324:\t\tllde_cmd = (struct nxpwifi_11ax_llde_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-325-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-329-\tdefault:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:330:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-331-\t\t\t    \"%s: Unknown sub command: %d\\n\",\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-340-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:341:int nxpwifi_ret_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-342-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:343:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-344-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:345:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-346-\tstruct host_cmd_11ax_cmd *he_cmd = \u0026resp-\u003eparams.ax_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:347:\tstruct nxpwifi_ie_types_data *tlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-348-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-352-\tcase NXPWIFI_11AXCMD_SR_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:353:\t\ttlv = (struct nxpwifi_ie_types_data *)he_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-354-\t\tmemcpy(ax_cmd-\u003eparam.sr_cfg.param.obss_pd_offset.offset,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-383-\tdefault:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:384:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-385-\t\t\t    \"%s: Unknown sub command: %d\\n\",\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-392-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:393:static u8 nxpwifi_is_ap_11ax_twt_supported(struct nxpwifi_bssdescriptor *bss_desc)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-394-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-409-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:410:bool nxpwifi_is_11ax_twt_supported(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:411:\t\t\t\t   struct nxpwifi_bssdescriptor *bss_desc)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-412-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:413:\tstruct nxpwifi_ie_types_he_cap *user_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:414:\tstruct nxpwifi_ie_types_he_cap *hw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-415-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-418-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:419:\tif (!nxpwifi_is_ap_11ax_twt_supported(bss_desc)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:420:\t\tnxpwifi_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-421-\t\t\t    \"AP don't support twt feature\\n\");\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-425-\tif (bss_desc-\u003ebss_band \u0026 BAND_A) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:426:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-427-\t\t\tpriv-\u003eadapter-\u003ehw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:428:\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-429-\t\t\tpriv-\u003euser_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-430-\t} else {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:431:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-432-\t\t\tpriv-\u003eadapter-\u003ehw_2g_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:433:\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-434-\t\t\tpriv-\u003euser_2g_he_cap;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-437-\tif (!(hw_he_cap-\u003ehe_mac_cap[0] \u0026 HE_MAC_CAP_TWT_REQ_SUPPORT)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:438:\t\tnxpwifi_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-439-\t\t\t    \"FW don't support TWT\\n\");\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-443-\tif (!(user_he_cap-\u003ehe_mac_cap[0] \u0026 HE_MAC_CAP_TWT_REQ_SUPPORT)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:444:\t\tnxpwifi_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-445-\t\t\t    \"USER HE_MAC_CAP don't support TWT\\n\");\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-451-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:452:u8 nxpwifi_is_sta_11ax_twt_req_supported(struct nxpwifi_private *priv)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-453-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:454:\tstruct nxpwifi_ie_types_he_cap *user_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-455-\tu8 ret = 0;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-459-\t\tif (priv-\u003econfig_bands \u0026 BAND_AAX)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:460:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)priv-\u003euser_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-461-\t\telse\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:462:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)priv-\u003euser_2g_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-463-\t\tret = user_he_cap-\u003ehe_mac_cap[0] \u0026 HE_MAC_CAP_TWT_REQ_SUPPORT;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-468-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:469:int nxpwifi_cmd_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-470-\t\t\tstruct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:471:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-472-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:473:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-474-\tstruct host_cmd_twt_cfg *twt_cfg_cmd = \u0026cmd-\u003eparams.twt_cfg;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:475:\tstruct nxpwifi_twt_setup *twt_setup;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:476:\tstruct nxpwifi_twt_teardown *twt_teardown;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:477:\tstruct nxpwifi_twt_report *twt_report;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:478:\tstruct nxpwifi_twt_information *twt_information;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:479:\tstruct nxpwifi_btwt_ap_config *btwt_ap_config;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-480-\tu8 i;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-490-\tcase NXPWIFI_11AX_TWT_SETUP_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:491:\t\ttwt_setup = (struct nxpwifi_twt_setup *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-492-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-493-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:494:\t\tmemset(twt_setup, 0x00, sizeof(struct nxpwifi_twt_setup));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-495-\t\ttwt_setup-\u003eimplicit = twt_cfg-\u003eparam.twt_setup.implicit;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-507-\t\ttwt_setup-\u003ebcn_miss_threshold = twt_cfg-\u003eparam.twt_setup.bcn_miss_threshold;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:508:\t\tcmd_size += sizeof(struct nxpwifi_twt_setup);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-509-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-510-\tcase NXPWIFI_11AX_TWT_TEARDOWN_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:511:\t\ttwt_teardown = (struct nxpwifi_twt_teardown *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-512-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-513-\t\tmemset(twt_teardown, 0x00,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:514:\t\t       sizeof(struct nxpwifi_twt_teardown));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-515-\t\ttwt_teardown-\u003eflow_identifier =\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-520-\t\t\ttwt_cfg-\u003eparam.twt_teardown.teardown_all_twt;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:521:\t\tcmd_size += sizeof(struct nxpwifi_twt_teardown);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-522-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-523-\tcase NXPWIFI_11AX_TWT_REPORT_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:524:\t\ttwt_report = (struct nxpwifi_twt_report *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-525-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:526:\t\tmemset(twt_report, 0x00, sizeof(struct nxpwifi_twt_report));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-527-\t\ttwt_report-\u003etype = twt_cfg-\u003eparam.twt_report.type;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:528:\t\tcmd_size += sizeof(struct nxpwifi_twt_report);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-529-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-530-\tcase NXPWIFI_11AX_TWT_INFORMATION_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:531:\t\ttwt_information = (struct nxpwifi_twt_information *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-532-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-533-\t\tmemset(twt_information, 0x00,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:534:\t\t       sizeof(struct nxpwifi_twt_information));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-535-\t\ttwt_information-\u003eflow_identifier =\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-538-\t\t\ttwt_cfg-\u003eparam.twt_information.suspend_duration;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:539:\t\tcmd_size += sizeof(struct nxpwifi_twt_information);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-540-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-541-\tcase NXPWIFI_11AX_BTWT_AP_CONFIG_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:542:\t\tbtwt_ap_config = (struct nxpwifi_btwt_ap_config *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-543-\t\t\t\t twt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-544-\t\tmemset(btwt_ap_config, 0x00,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:545:\t\t       sizeof(struct nxpwifi_btwt_ap_config));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-546-\t\tbtwt_ap_config-\u003eap_bcast_bet_sta_wait =\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-564-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:565:\t\tcmd_size += sizeof(struct nxpwifi_btwt_ap_config);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-566-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-567-\tdefault:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:568:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-569-\t\t\t    \"Unknown sub id: %d\\n\", twt_cfg-\u003esub_id);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-577-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:578:int nxpwifi_ret_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-579-\t\t\tstruct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:580:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-581-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-589-\t    twt_cfg-\u003esub_id == NXPWIFI_11AX_TWT_REPORT_SUBID) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:590:\t\tstruct nxpwifi_twt_report *twt_report =\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:591:\t\t\t(struct nxpwifi_twt_report *)twt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-592-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:593:\t\tmemcpy(\u0026twt_cfg-\u003eparam.twt_report, twt_report, sizeof(struct nxpwifi_twt_report));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-594-\t}\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-2-/*\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:3: * nxpwifi: 802.11ax support\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-4- *\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.h=17=static inline u16\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:18:nxpwifi_get_he_nss_mcs(__le16 mcs_map_set, int nss) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-19-\treturn ((le16_to_cpu(mcs_map_set) \u003e\u003e (2 * (nss - 1))) \u0026 0x3);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.h=22=static inline void\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:23:nxpwifi_set_he_nss_mcs(__le16 *mcs_map_set, int nss, int value) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-24-\tu16 temp;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-30-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:31:bool nxpwifi_is_11ax_twt_supported(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:32:\t\t\t\t   struct  nxpwifi_bssdescriptor *bss_desc);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-33-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:34:void nxpwifi_update_11ax_cap(struct nxpwifi_adapter *adapter,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-35-\t\t\t     struct hw_spec_extension *hw_he_cap);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-36-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:37:bool nxpwifi_11ax_bandconfig_allowed(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:38:\t\t\t\t     struct nxpwifi_bssdescriptor *bss_desc);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-39-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:40:int nxpwifi_cmd_append_11ax_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:41:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-42-\t\t\t\tu8 **buffer);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-43-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:44:int nxpwifi_fill_he_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:45:\t\t\t    struct nxpwifi_ie_types_he_cap *he_cap,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-46-\t\t\t    u16 bands);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:47:int nxpwifi_cmd_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-48-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:49:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-50-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:51:int nxpwifi_ret_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-52-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:53:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-54-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:55:int nxpwifi_cmd_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-56-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:57:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-58-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:59:int nxpwifi_ret_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-60-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:61:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-62-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:63:int nxpwifi_cmd_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-64-\t\t\tstruct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:65:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-66-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:67:int nxpwifi_ret_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-68-\t\t\tstruct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:69:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-70-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:71:u8 nxpwifi_is_sta_11ax_twt_req_supported(struct nxpwifi_private *priv);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-72-\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c-2-/*\ndrivers/net/wireless/nxp/nxpwifi/11h.c:3: * nxpwifi: 802.11h helpers\ndrivers/net/wireless/nxp/nxpwifi/11h.c-4- *\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c-12-\ndrivers/net/wireless/nxp/nxpwifi/11h.c:13:void nxpwifi_init_11h_params(struct nxpwifi_private *priv)\ndrivers/net/wireless/nxp/nxpwifi/11h.c-14-{\n\n"
}

gemini-3.7-flash

null

null

							input: 19453
							output: 41
							thoughts: 53
						

Here's my thinking process:

**Diving into the nxpwifi Module Configuration**

Okay, so I need to get a handle on the `nxpwifi` driver. My first step is to crack open the `Kconfig` and `Makefile` files. Those are always the key starting points. The `Kconfig` should reveal all the configuration options: things like supported chipsets, feature flags, any dependencies on other modules, and how the driver presents itself to the user. I'll be looking for things that define specific hardware features or modes of operation – this will give me the building blocks of understanding what's possible.

Then, I'll move over to the `Makefile`. That's where the rubber really hits the road. It will show the compilation process, the source files involved, and importantly, the hardware interfaces it's targeting. Are we talking SPI, SDIO, or PCIe? Which specific hardware variants are supported, and how is the module structured to handle those differing platforms? The Makefile should illuminate the dependencies and the overall build environment for the driver. I expect a good Makefile will clearly outline the modules, and include files.

Understanding these two files will be essential for any deeper analysis or potential modifications. It's the groundwork.

{
  "File": "drivers/net/wireless/nxp/nxpwifi/Kconfig",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tconfig NXPWIFI\n   3:\t\ttristate \"NXP WiFi Driver\" if COMPILE_TEST\n   4:\t\tdepends on CFG80211\n   5:\t\thelp\n   6:\t\t  This adds support for wireless adapters based on NXP\n   7:\t\t  802.11n/ac chipsets.\n   8:\t\n   9:\t\t  If you choose to build it as a module, it will be called\n  10:\t\t  nxpwifi.\n  11:\t\n  12:\tconfig NXPWIFI_SDIO\n  13:\t\ttristate \"NXP WiFi Driver for IW61x\"\n  14:\t\tdepends on CFG80211 \u0026\u0026 MMC\n  15:\t\tselect NXPWIFI\n  16:\t\tselect FW_LOADER\n  17:\t\tselect WANT_DEV_COREDUMP\n  18:\t\thelp\n  19:\t\t  This adds support for wireless adapters based on NXP\n  20:\t\t  IW61x interface.\n  21:\t\n  22:\t\t  If you choose to build it as a module, it will be called\n  23:\t\t  nxpwifi_sdio.\n"
}

gemini-3.7-flash

null

null

							input: 20128
							output: 40
							thoughts: 22
						

Here's a summary of my thought process, as requested:

**Diving into the Makefile**

Okay, so we're talking about the NXP Wi-Fi driver, and I need to understand its build process. Let's see... *nxpwifi/Makefile* is where the action is. This is where I'll get the lay of the land, see how the source files are compiled, linked, and integrated into the overall kernel build. I'm expecting to find the usual suspects: object file targets, dependency rules, flags for the compiler (gcc, likely), perhaps some conditional compilation based on platform or configuration options. I'll be looking for clues on how they handle firmware loading, any specific board-level dependencies, and how they manage modules if it's modular. I'll be mentally tracing the flow of compilation to get a good handle on how the entire driver is structured within the overall wireless subsystem. Let's see what gems are hidden in there.

{
  "File": "drivers/net/wireless/nxp/nxpwifi/Makefile",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t#\n   3:\t# Copyright 2011-2020 NXP\n   4:\t#\n   5:\t\n   6:\t\n   7:\tnxpwifi-y += main.o\n   8:\tnxpwifi-y += init.o\n   9:\tnxpwifi-y += cfp.o\n  10:\tnxpwifi-y += cmdevt.o\n  11:\tnxpwifi-y += util.o\n  12:\tnxpwifi-y += txrx.o\n  13:\tnxpwifi-y += wmm.o\n  14:\tnxpwifi-y += 11n.o\n  15:\tnxpwifi-y += 11ac.o\n  16:\tnxpwifi-y += 11ax.o\n  17:\tnxpwifi-y += 11n_aggr.o\n  18:\tnxpwifi-y += 11n_rxreorder.o\n  19:\tnxpwifi-y += scan.o\n  20:\tnxpwifi-y += join.o\n  21:\tnxpwifi-y += sta_cfg.o\n  22:\tnxpwifi-y += sta_cmd.o\n  23:\tnxpwifi-y += uap_cmd.o\n  24:\tnxpwifi-y += ie.o\n  25:\tnxpwifi-y += sta_event.o\n  26:\tnxpwifi-y += uap_event.o\n  27:\tnxpwifi-y += sta_tx.o\n  28:\tnxpwifi-y += sta_rx.o\n  29:\tnxpwifi-y += uap_txrx.o\n  30:\tnxpwifi-y += cfg80211.o\n  31:\tnxpwifi-y += ethtool.o\n  32:\tnxpwifi-y += 11h.o\n  33:\tnxpwifi-$(CONFIG_DEBUG_FS) += debugfs.o\n  34:\tobj-$(CONFIG_NXPWIFI) += nxpwifi.o\n  35:\t\n  36:\tnxpwifi_sdio-y += sdio.o\n  37:\tobj-$(CONFIG_NXPWIFI_SDIO) += nxpwifi_sdio.o\n  38:\t\n  39:\tccflags-y += -D__CHECK_ENDIAN\n"
}

gemini-3.7-flash

null

null

							input: 21030
							output: 43
							thoughts: 410
						

**My Assessment of the `nxpwifi` Driver for Fuzzing Suitability**

Okay, so `nxpwifi` is an SDIO Wi-Fi driver, specifically implemented as `nxpwifi_sdio.o` or `nxpwifi.o`. My initial thought is, can I even *reach* this driver within the typical virtualized environments that I'm using, like QEMU or Google Compute Engine? And I need to verify, is there any chance it's emulated in standard syzkaller / QEMU setups? I'm going to carefully revisit the instructions for determining whether a patch is worth fuzzing.

Specifically, I'm checking to see if this driver falls under the exemptions - documentation changes, logging, decorative changes, numeric constants or macros that don't change execution flow. But the really key point is whether it contains code that's *unreachable* in these virtualized environments. I'm focusing on that. Are we talking vendor-specific PCIe switch, SmartNIC, or GPU drivers, or drivers dependent on specific hardware not emulated by QEMU? And, very importantly, any driver teardown callbacks that are executed only during PCI hot-unplug or sysfs driver unbind operations.

So, let's go back to the central question: can `nxpwifi` be reached in the environments I use? Now, does QEMU, in its default setup, actually emulate the NXP IW61x SDIO Wi-Fi card? I'm not seeing that. QEMU does have SD card emulation, but that's not the same thing. It doesn't appear to be emulating the specific `nxpwifi` hardware, or the firmware associated with that specific SDIO wireless card. So then I need to figure out if there is any USB gadget or software emulation for `nxpwifi` that I can use instead, I'll need to check if there is an alternate path.

Okay, I'm going to dig into the driver's code itself. I'll need to examine `sdio.c` – that's where I'll find how `nxpwifi` probes. This should show me the hardware dependencies and how the driver is initialized, which will determine if it's reachable or not.

{
  "File": "drivers/net/wireless/nxp/nxpwifi/sdio.c",
  "FirstLine": 1,
  "LineCount": 80
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: GPL-2.0-only\n   2:\t/*\n   3:\t * NXP Wireless LAN device driver: SDIO specific handling\n   4:\t *\n   5:\t * Copyright 2011-2024 NXP\n   6:\t */\n   7:\t\n   8:\t#include \u003clinux/firmware.h\u003e\n   9:\t#include \u003clinux/completion.h\u003e\n  10:\t#include \u003clinux/mmc/sdio.h\u003e\n  11:\t#include \u003clinux/mmc/sdio_ids.h\u003e\n  12:\t#include \u003clinux/mmc/sdio_func.h\u003e\n  13:\t#include \u003clinux/mmc/card.h\u003e\n  14:\t#include \u003clinux/mmc/host.h\u003e\n  15:\t#include \u003clinux/iopoll.h\u003e\n  16:\t#include \"cfg.h\"\n  17:\t#include \"util.h\"\n  18:\t#include \"fw.h\"\n  19:\t#include \"main.h\"\n  20:\t#include \"wmm.h\"\n  21:\t#include \"11n.h\"\n  22:\t#include \"sdio.h\"\n  23:\t\n  24:\t#define SDIO_VERSION\t\"1.0\"\n  25:\t\n  26:\t/* Process deferred SDIO work items. */\n  27:\tstatic void nxpwifi_sdio_work(struct work_struct *work);\n  28:\t\n  29:\tstatic struct nxpwifi_if_ops sdio_ops;\n  30:\t\n  31:\tstatic const struct nxpwifi_sdio_card_reg nxpwifi_reg_iw61x = {\n  32:\t\t.start_rd_port = 0,\n  33:\t\t.start_wr_port = 0,\n  34:\t\t.base_0_reg = 0xF8,\n  35:\t\t.base_1_reg = 0xF9,\n  36:\t\t.poll_reg = 0x5C,\n  37:\t\t.host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |\n  38:\t\t\t\t   CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,\n  39:\t\t.host_int_rsr_reg = 0x4,\n  40:\t\t.host_int_status_reg = 0x0C,\n  41:\t\t.host_int_mask_reg = 0x08,\n  42:\t\t.host_strap_reg = 0xF4,\n  43:\t\t.host_strap_mask = 0x01,\n  44:\t\t.host_strap_value = 0x00,\n  45:\t\t.status_reg_0 = 0xE8,\n  46:\t\t.status_reg_1 = 0xE9,\n  47:\t\t.sdio_int_mask = 0xff,\n  48:\t\t.data_port_mask = 0xffffffff,\n  49:\t\t.io_port_0_reg = 0xE4,\n  50:\t\t.io_port_1_reg = 0xE5,\n  51:\t\t.io_port_2_reg = 0xE6,\n  52:\t\t.max_mp_regs = 196,\n  53:\t\t.rd_bitmap_l = 0x10,\n  54:\t\t.rd_bitmap_u = 0x11,\n  55:\t\t.rd_bitmap_1l = 0x12,\n  56:\t\t.rd_bitmap_1u = 0x13,\n  57:\t\t.wr_bitmap_l = 0x14,\n  58:\t\t.wr_bitmap_u = 0x15,\n  59:\t\t.wr_bitmap_1l = 0x16,\n  60:\t\t.wr_bitmap_1u = 0x17,\n  61:\t\t.rd_len_p0_l = 0x18,\n  62:\t\t.rd_len_p0_u = 0x19,\n  63:\t\t.card_misc_cfg_reg = 0xd8,\n  64:\t\t.card_cfg_2_1_reg = 0xd9,\n  65:\t\t.cmd_rd_len_0 = 0xc0,\n  66:\t\t.cmd_rd_len_1 = 0xc1,\n  67:\t\t.cmd_rd_len_2 = 0xc2,\n  68:\t\t.cmd_rd_len_3 = 0xc3,\n  69:\t\t.cmd_cfg_0 = 0xc4,\n  70:\t\t.cmd_cfg_1 = 0xc5,\n  71:\t\t.cmd_cfg_2 = 0xc6,\n  72:\t\t.cmd_cfg_3 = 0xc7,\n  73:\t\t.fw_dump_host_ready = 0xcc,\n  74:\t\t.fw_dump_ctrl = 0xf9,\n  75:\t\t.fw_dump_start = 0xf1,\n  76:\t\t.fw_dump_end = 0xf8,\n  77:\t\t.func1_dump_reg_start = 0x10,\n  78:\t\t.func1_dump_reg_end = 0x17,\n  79:\t\t.func1_scratch_reg = 0xE8,\n  80:\t\t.func1_spec_reg_num = 13,\n"
}

gemini-3.7-flash

null

null

							input: 23395
							output: 44
							thoughts: 22
						

Here's my attempt at summarizing the thought process in the first person, assuming the user is an expert:

**Investigating nxpwifi Module Functionality**

Okay, so I'm thinking about the `nxpwifi` module, and I need to get a handle on its internal workings. First, I'm going to focus on the `probe` function. I want to see what that particular function is doing within the module and how it fits into the broader picture of device initialization. It's the standard entry point for driver loading, so I need to understand it fully.

Beyond the probe, I'm trying to identify how this module interacts with the system buses. I'm especially interested in knowing if there are other buses involved, beyond the obvious. Are there any indirect dependencies I'm not immediately aware of? Are there any specific bus drivers it relies on, or interacts with in an unusual way?

Finally, I want to assess the existence and suitability of mock drivers for nxpwifi. I have to see if there are any mock drivers available, and what their capabilities are. The intention here is to simulate specific scenarios, perform testing without actual hardware, or debug potential issues. It's often easier to develop and test with simulated environments than with real devices, so this is critical.

{
  "File": "drivers/net/wireless/nxp/nxpwifi/sdio.c",
  "FirstLine": 81,
  "LineCount": 80
}

{
  "Contents": "  81:\t\t.func1_spec_reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60,\n  82:\t\t\t\t\t 0x61, 0x62, 0x64, 0x65, 0x66,\n  83:\t\t\t\t\t 0x68, 0x69, 0x6a},\n  84:\t};\n  85:\t\n  86:\tstatic const struct nxpwifi_sdio_device nxpwifi_sdio_iw61x = {\n  87:\t\t.firmware = IW61X_SDIO_FW_NAME,\n  88:\t\t.reg = \u0026nxpwifi_reg_iw61x,\n  89:\t\t.max_ports = 32,\n  90:\t\t.mp_agg_pkt_limit = 16,\n  91:\t\t.tx_buf_size = NXPWIFI_TX_DATA_BUF_SIZE_4K,\n  92:\t\t.mp_tx_agg_buf_size = NXPWIFI_MP_AGGR_BSIZE_MAX,\n  93:\t\t.mp_rx_agg_buf_size = NXPWIFI_MP_AGGR_BSIZE_MAX,\n  94:\t\t.can_dump_fw = true,\n  95:\t\t.fw_dump_enh = true,\n  96:\t\t.can_ext_scan = true,\n  97:\t};\n  98:\t\n  99:\tstatic struct memory_type_mapping generic_mem_type_map[] = {\n 100:\t\t{\"DUMP\", NULL, 0, 0xDD},\n 101:\t};\n 102:\t\n 103:\tstatic struct memory_type_mapping mem_type_mapping_tbl[] = {\n 104:\t\t{\"ITCM\", NULL, 0, 0xF0},\n 105:\t\t{\"DTCM\", NULL, 0, 0xF1},\n 106:\t\t{\"SQRAM\", NULL, 0, 0xF2},\n 107:\t\t{\"APU\", NULL, 0, 0xF3},\n 108:\t\t{\"CIU\", NULL, 0, 0xF4},\n 109:\t\t{\"ICU\", NULL, 0, 0xF5},\n 110:\t\t{\"MAC\", NULL, 0, 0xF6},\n 111:\t\t{\"EXT7\", NULL, 0, 0xF7},\n 112:\t\t{\"EXT8\", NULL, 0, 0xF8},\n 113:\t\t{\"EXT9\", NULL, 0, 0xF9},\n 114:\t\t{\"EXT10\", NULL, 0, 0xFA},\n 115:\t\t{\"EXT11\", NULL, 0, 0xFB},\n 116:\t\t{\"EXT12\", NULL, 0, 0xFC},\n 117:\t\t{\"EXT13\", NULL, 0, 0xFD},\n 118:\t\t{\"EXTLAST\", NULL, 0, 0xFE},\n 119:\t};\n 120:\t\n 121:\t/* Bind the SDIO function and start device registration. */\n 122:\tstatic int\n 123:\tnxpwifi_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)\n 124:\t{\n 125:\t\tint ret;\n 126:\t\tstruct sdio_mmc_card *card = NULL;\n 127:\t\n 128:\t\tcard = devm_kzalloc(\u0026func-\u003edev, sizeof(*card), GFP_KERNEL);\n 129:\t\tif (!card)\n 130:\t\t\treturn -ENOMEM;\n 131:\t\n 132:\t\tinit_completion(\u0026card-\u003efw_done);\n 133:\t\n 134:\t\tcard-\u003efunc = func;\n 135:\t\n 136:\t\tif (id-\u003edriver_data) {\n 137:\t\t\tstruct nxpwifi_sdio_device *data = (void *)id-\u003edriver_data;\n 138:\t\n 139:\t\t\tcard-\u003efirmware = data-\u003efirmware;\n 140:\t\t\tcard-\u003efirmware_sdiouart = data-\u003efirmware_sdiouart;\n 141:\t\t\tcard-\u003ereg = data-\u003ereg;\n 142:\t\t\tcard-\u003emax_ports = data-\u003emax_ports;\n 143:\t\t\tcard-\u003emp_agg_pkt_limit = data-\u003emp_agg_pkt_limit;\n 144:\t\t\tcard-\u003etx_buf_size = data-\u003etx_buf_size;\n 145:\t\t\tcard-\u003emp_tx_agg_buf_size = data-\u003emp_tx_agg_buf_size;\n 146:\t\t\tcard-\u003emp_rx_agg_buf_size = data-\u003emp_rx_agg_buf_size;\n 147:\t\t\tcard-\u003ecan_dump_fw = data-\u003ecan_dump_fw;\n 148:\t\t\tcard-\u003efw_dump_enh = data-\u003efw_dump_enh;\n 149:\t\t\tcard-\u003ecan_ext_scan = data-\u003ecan_ext_scan;\n 150:\t\t\tINIT_WORK(\u0026card-\u003ework, nxpwifi_sdio_work);\n 151:\t\t}\n 152:\t\n 153:\t\tsdio_claim_host(func);\n 154:\t\tret = sdio_enable_func(func);\n 155:\t\tsdio_release_host(func);\n 156:\t\n 157:\t\tif (ret) {\n 158:\t\t\tdev_err(\u0026func-\u003edev, \"failed to enable function\\n\");\n 159:\t\t\treturn ret;\n 160:\t\t}\n"
}

gemini-3.7-flash

null

null

							input: 25203
							output: 19
							thoughts: 358
						

**My Assessment of SDIO Card Fuzzing Feasibility**

Okay, so I'm thinking about whether we can effectively fuzz or emulate SDIO cards within the current QEMU/syzkaller framework. Hmm, syzkaller doesn't seem to natively support emulating SDIO Wi-Fi devices – it's got USB via Raw Gadget/Dummy HCD, Bluetooth with vhci, Wi-Fi through mac80211_hwsim/virt_wifi, and media interfaces like vimc/vivid. But nothing for SDIO, at least not explicitly.

Now, hold on. Is there *any* SDIO device emulation, or perhaps software-based SDIO Wi-Fi implementations within the Linux kernel or QEMU itself? Time to check syzkaller's documentation again, or at least look into whether this is a hardware-only limitation.

Right, let's get specific. Can we emulate SDIO function devices like the NXP IW61x within QEMU? And the answer, as far as I can tell, is no. Darn.

Okay, let's take a step back and consider *why* this might be. I'll need to check the typical reasons drivers are deemed un-fuzzable due to virtualization limitations. Alright, there it is: code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware. It's things like USB gadget, mac80211_hwsim. Then there are those vendor-specific PCIe switch, SmartNIC, or GPU drivers (like mlxsw, pds_core, qed, ionic, amdgpu) that need physical hardware cards, which QEMU doesn't emulate.

So, where does this leave us? Now, I need to check if the `nxpwifi` driver is exclusively an SDIO driver for the NXP IW61x chips, or if it has some broader applicability.

Let's do a quick search in the kernel tree for `CONFIG_NXPWIFI`, `nxpwifi_`, or any other bus drivers related to `nxpwifi`. This might give us some insight into its potential flexibility.

{
  "Expression": "CONFIG_NXPWIFI"
}

{
  "Output": "drivers/net/wireless/nxp/Makefile-2-\ndrivers/net/wireless/nxp/Makefile:3:obj-$(CONFIG_NXPWIFI)\t+= nxpwifi/\n--\ndrivers/net/wireless/nxp/nxpwifi/Makefile=33=nxpwifi-$(CONFIG_DEBUG_FS) += debugfs.o\ndrivers/net/wireless/nxp/nxpwifi/Makefile:34:obj-$(CONFIG_NXPWIFI) += nxpwifi.o\ndrivers/net/wireless/nxp/nxpwifi/Makefile-35-\ndrivers/net/wireless/nxp/nxpwifi/Makefile=36=nxpwifi_sdio-y += sdio.o\ndrivers/net/wireless/nxp/nxpwifi/Makefile:37:obj-$(CONFIG_NXPWIFI_SDIO) += nxpwifi_sdio.o\ndrivers/net/wireless/nxp/nxpwifi/Makefile-38-\n"
}

gemini-3.7-flash

null

null

							input: 26286
							output: 49
							thoughts: 77
						

**Investigating the NXP WiFi Driver Context**

Okay, so I need to figure out what's going on with this driver. First, let me quickly confirm that `sdio.o` is the only bus driver in `nxpwifi`. Good, just confirming my initial assumptions. Now, let's get into the specifics of the patch. I need to understand exactly what modifications have been made. Let's dig into the code itself. I'll take a look at `drivers/net/wireless/nxp/nxpwifi/cfg80211.c`, focusing around lines 844 and 888. That seems like a good starting point to understand the core changes.

{
  "File": "drivers/net/wireless/nxp/nxpwifi/cfg80211.c",
  "FirstLine": 835,
  "LineCount": 70
}

{
  "Contents": " 835:\t\n 836:\t\tret = nxpwifi_deinit_priv_params(priv);\n 837:\t\tif (ret)\n 838:\t\t\tgoto done;\n 839:\t\tret = nxpwifi_init_new_priv_params(priv, dev, type);\n 840:\t\tif (ret)\n 841:\t\t\tgoto done;\n 842:\t\n 843:\t\tupdate_vif_type_counter(adapter, curr_iftype, -1);\n 844:\t\tupdate_vif_type_counter(adapter, type, 1);\n 845:\t\tdev-\u003eieee80211_ptr-\u003eiftype = type;\n 846:\t\n 847:\t\tret = nxpwifi_set_bss_mode(priv);\n 848:\t\n 849:\t\tif (ret)\n 850:\t\t\tgoto done;\n 851:\t\n 852:\t\tret = nxpwifi_sta_init_cmd(priv, false, false);\n 853:\t\n 854:\tdone:\n 855:\t\treturn ret;\n 856:\t}\n 857:\t\n 858:\tstatic int\n 859:\tnxpwifi_change_vif_to_ap(struct net_device *dev,\n 860:\t\t\t\t enum nl80211_iftype curr_iftype,\n 861:\t\t\t\t enum nl80211_iftype type,\n 862:\t\t\t\t struct vif_params *params)\n 863:\t{\n 864:\t\tstruct nxpwifi_private *priv;\n 865:\t\tstruct nxpwifi_adapter *adapter;\n 866:\t\tint ret;\n 867:\t\n 868:\t\tpriv = nxpwifi_netdev_get_priv(dev);\n 869:\t\n 870:\t\tif (!priv)\n 871:\t\t\treturn -EINVAL;\n 872:\t\n 873:\t\tadapter = priv-\u003eadapter;\n 874:\t\n 875:\t\tnxpwifi_dbg(adapter, INFO,\n 876:\t\t\t    \"%s: changing role to AP\\n\", dev-\u003ename);\n 877:\t\n 878:\t\tret = nxpwifi_deinit_priv_params(priv);\n 879:\t\tif (ret)\n 880:\t\t\tgoto done;\n 881:\t\n 882:\t\tret = nxpwifi_init_new_priv_params(priv, dev, type);\n 883:\t\tif (ret)\n 884:\t\t\tgoto done;\n 885:\t\n 886:\t\tupdate_vif_type_counter(adapter, curr_iftype, -1);\n 887:\t\tupdate_vif_type_counter(adapter, type, 1);\n 888:\t\tdev-\u003eieee80211_ptr-\u003eiftype = type;\n 889:\t\n 890:\t\tret = nxpwifi_set_bss_mode(priv);\n 891:\t\n 892:\t\tif (ret)\n 893:\t\t\tgoto done;\n 894:\t\n 895:\t\tret = nxpwifi_sta_init_cmd(priv, false, false);\n 896:\t\n 897:\tdone:\n 898:\t\treturn ret;\n 899:\t}\n 900:\t\n 901:\t/* cfg80211 operation handler to change interface type. */\n 902:\tstatic int\n 903:\tnxpwifi_cfg80211_change_virtual_intf(struct wiphy *wiphy,\n 904:\t\t\t\t\t     struct net_device *dev,\n"
}

gemini-3.7-flash

null

null

							input: 27540
							output: 26
							thoughts: 526
						

**Fuzzing Feasibility of NXP WiFi Driver**

Okay, let's break this down. My initial thought is that `nxpwifi_cfg80211_change_virtual_intf` calls both `nxpwifi_change_vif_to_sta` and `nxpwifi_change_vif_to_ap`. That's the entry point. But, `nxpwifi`... right, it's the driver for NXP WiFi devices, specifically the IW61x SDIO interface. The key question is, can I even *reach* this driver in a virtual environment? This is critical for fuzzing.

My first check is the obvious: does this require actual hardware? The driver is clearly identified as `NXPWIFI_SDIO`, binding to the SDIO function. And I know, from experience, there aren't any emulated or virtual SDIO WiFi devices readily available in environments like QEMU or Google Compute Engine. So, that's a *major* red flag.

Then I need to check the prompt rules. These rules are key: anything unreachable in a virtualized environment is not worth fuzzing. The patch is irrelevant if it's in a code path you can't hit. My experience gives me the edge here. Modifications to documentation, config files, or comments are out. Decorative changes, like logging, are out. Changes to numeric constants are out. Code paths completely unreachable in virtualization? That's the core. Also, vendor-specific PCIe switch drivers that require physical hardware are out, and so are teardown callbacks that are only executed when hardware is unplugged.

Now, because `nxpwifi` specifically requires that NXP IW61x SDIO hardware and because that hardware is *not* emulated in standard QEMU or GCE, it is impossible to instantiate and fuzz this code path in any standard virtualized fuzzing environment.

To be absolutely sure, I'll do a quick search through the kernel source to see if there's any clever trickery – a mock device, a platform device, anything that registers a virtual `nxpwifi` device. I will look for any use of functions like `nxpwifi_add_card` or `nxpwifi_register`, to make certain.

{
  "Expression": "nxpwifi_",
  "PathPrefix": "drivers/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 15017 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/nxp/nxpwifi/11ac.c=36=static u16\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:37:nxpwifi_convert_mcsmap_to_maxrate(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-38-\t\t\t\t  u16 bands, u16 mcs_map)\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-42-\tu32 usr_vht_cap_info = 0;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:43:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-44-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c=79=static void\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:80:nxpwifi_fill_vht_cap_info(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-81-\t\t\t  struct ieee80211_vht_cap *vht_cap, u16 bands)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-82-{\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:83:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-84-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c=93=void\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:94:nxpwifi_fill_vht_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-95-\t\t\t struct ieee80211_vht_cap *vht_cap, u16 bands)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-96-{\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:97:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-98-\tu16 mcs_map_user, mcs_map_resp, mcs_map_result;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-101-\t/* Fill VHT capability info. */\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:102:\tnxpwifi_fill_vht_cap_info(priv, vht_cap, bands);\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-103-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-123-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:124:\ttmp = nxpwifi_convert_mcsmap_to_maxrate(priv, bands, mcs_map_result);\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-125-\tvht_cap-\u003esupp_mcs.rx_highest = cpu_to_le16(tmp);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-145-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:146:\ttmp = nxpwifi_convert_mcsmap_to_maxrate(priv, bands, mcs_map_result);\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-147-\tvht_cap-\u003esupp_mcs.tx_highest = cpu_to_le16(tmp);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-149-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:150:int nxpwifi_cmd_append_11ac_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:151:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-152-\t\t\t\tu8 **buffer)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-153-{\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:154:\tstruct nxpwifi_ie_types_vhtcap *vht_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:155:\tstruct nxpwifi_ie_types_oper_mode_ntf *oper_ntf;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-156-\tstruct ieee_types_oper_mode_ntf *ieee_oper_ntf;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:157:\tstruct nxpwifi_ie_types_vht_oper *vht_op;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:158:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-159-\tu8 supp_chwd_set;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-169-\tif (bss_desc-\u003ebcn_vht_cap) {\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:170:\t\tvht_cap = (struct nxpwifi_ie_types_vhtcap *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-171-\t\tmemset(vht_cap, 0, sizeof(*vht_cap));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-174-\t\t\tcpu_to_le16(sizeof(struct ieee80211_vht_cap));\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:175:\t\tmemcpy((u8 *)vht_cap + sizeof(struct nxpwifi_ie_types_header),\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-176-\t\t       (u8 *)bss_desc-\u003ebcn_vht_cap,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-178-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:179:\t\tnxpwifi_fill_vht_cap_tlv(priv, \u0026vht_cap-\u003evht_cap,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-180-\t\t\t\t\t bss_desc-\u003ebss_band);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-187-\t\tif (priv-\u003ebss_mode == NL80211_IFTYPE_STATION) {\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:188:\t\t\tvht_op = (struct nxpwifi_ie_types_vht_oper *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-189-\t\t\tmemset(vht_op, 0, sizeof(*vht_op));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-192-\t\t\tvht_op-\u003eheader.len  = cpu_to_le16(sizeof(*vht_op) -\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:193:\t\t\t\tsizeof(struct nxpwifi_ie_types_header));\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-194-\t\t\tmemcpy((u8 *)vht_op +\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:195:\t\t\t\tsizeof(struct nxpwifi_ie_types_header),\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-196-\t\t\t       (u8 *)bss_desc-\u003ebcn_vht_oper,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-244-\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:245:int nxpwifi_cmd_11ac_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-246-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:247:\t\t\t struct nxpwifi_11ac_vht_cfg *cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-248-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-264-/* Initialize BlockAck parameters for 11ac. */\ndrivers/net/wireless/nxp/nxpwifi/11ac.c:265:void nxpwifi_set_11ac_ba_params(struct nxpwifi_private *priv)\ndrivers/net/wireless/nxp/nxpwifi/11ac.c-266-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.h=14=enum vht_cfg_misc_config {\n--\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-24-\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:25:int nxpwifi_cmd_append_11ac_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:26:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-27-\t\t\t\tu8 **buffer);\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:28:int nxpwifi_cmd_11ac_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-29-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:30:\t\t\t struct nxpwifi_11ac_vht_cfg *cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ac.h:31:void nxpwifi_fill_vht_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ac.h-32-\t\t\t      struct ieee80211_vht_cap *vht_cap, u16 bands);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-10-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:11:void nxpwifi_update_11ax_cap(struct nxpwifi_adapter *adapter,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-12-\t\t\t     struct hw_spec_extension *hw_he_cap)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-13-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:14:\tstruct nxpwifi_private *priv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:15:\tstruct nxpwifi_ie_types_he_cap *he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:16:\tstruct nxpwifi_ie_types_he_cap *user_he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:17:\tu8 header_len = sizeof(struct nxpwifi_ie_types_header);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-18-\tu16 data_len = le16_to_cpu(hw_he_cap-\u003eheader.len);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-22-\tif ((data_len + header_len) \u003e sizeof(adapter-\u003ehw_he_cap)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:23:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-24-\t\t\t    \"hw_he_cap too big, len=%d\\n\",\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-28-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:29:\the_cap = (struct nxpwifi_ie_types_he_cap *)hw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-30-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-37-\t\the_cap_2g = true;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:38:\t\tnxpwifi_dbg_dump(adapter, CMD_D, \"2.4G HE capability element \",\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-39-\t\t\t\t adapter-\u003ehw_2g_he_cap,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-45-\t\tadapter-\u003efw_bands |= BAND_AAX;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:46:\t\tnxpwifi_dbg_dump(adapter, CMD_D, \"5G HE capability element \",\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-47-\t\t\t\t adapter-\u003ehw_he_cap,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-57-\t\t\t       sizeof(adapter-\u003ehw_2g_he_cap));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:58:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-59-\t\t\t\tpriv-\u003euser_2g_he_cap;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-63-\t\t\t       sizeof(adapter-\u003ehw_he_cap));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:64:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-65-\t\t\t\tpriv-\u003euser_he_cap;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-78-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:79:bool nxpwifi_11ax_bandconfig_allowed(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:80:\t\t\t\t     struct nxpwifi_bssdescriptor *bss_desc)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-81-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-94-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:95:int nxpwifi_fill_he_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:96:\t\t\t    struct nxpwifi_ie_types_he_cap *he_cap,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-97-\t\t\t    u16 bands)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-98-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:99:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:100:\tstruct nxpwifi_ie_types_he_cap *hw_he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-101-\tu16 rx_nss, tx_nss;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-108-\t\tmemcpy(he_cap, priv-\u003euser_he_cap, priv-\u003euser_he_cap_len);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:109:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)adapter-\u003ehw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-110-\t\tret_len = priv-\u003euser_he_cap_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-112-\t\tmemcpy(he_cap, priv-\u003euser_2g_he_cap, priv-\u003euser_2g_he_cap_len);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:113:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)adapter-\u003ehw_2g_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-114-\t\tret_len = priv-\u003euser_2g_he_cap_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-125-\tfor (nss = 1; nss \u003c= 8; nss++) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:126:\t\tcfg_value = nxpwifi_get_he_nss_mcs(he_cap-\u003erx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:127:\t\thw_value = nxpwifi_get_he_nss_mcs(hw_he_cap-\u003erx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-128-\t\tif (rx_nss != 0 \u0026\u0026 nss \u003e rx_nss)\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-130-\t\tif (hw_value == NO_NSS_SUPPORT || cfg_value == NO_NSS_SUPPORT)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:131:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003erx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-132-\t\t\t\t\t       NO_NSS_SUPPORT);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-133-\t\telse\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:134:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003erx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-135-\t\t\t\t\t       min(cfg_value, hw_value));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-138-\tfor (nss = 1; nss \u003c= 8; nss++) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:139:\t\tcfg_value = nxpwifi_get_he_nss_mcs(he_cap-\u003etx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:140:\t\thw_value = nxpwifi_get_he_nss_mcs(hw_he_cap-\u003etx_mcs_80, nss);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-141-\t\tif (tx_nss != 0 \u0026\u0026 nss \u003e tx_nss)\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-143-\t\tif (hw_value == NO_NSS_SUPPORT || cfg_value == NO_NSS_SUPPORT)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:144:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003etx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-145-\t\t\t\t\t       NO_NSS_SUPPORT);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-146-\t\telse\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:147:\t\t\tnxpwifi_set_he_nss_mcs(\u0026he_cap-\u003etx_mcs_80, nss,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-148-\t\t\t\t\t       min(cfg_value, hw_value));\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-153-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:154:int nxpwifi_cmd_append_11ax_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:155:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-156-\t\t\t\tu8 **buffer)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-157-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:158:\tstruct nxpwifi_ie_types_he_cap *he_cap = NULL;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-159-\tint ret_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-163-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:164:\the_cap = (struct nxpwifi_ie_types_he_cap *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:165:\tret_len = nxpwifi_fill_he_cap_tlv(priv, he_cap, bss_desc-\u003ebss_band);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-166-\t*buffer += ret_len;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-170-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:171:int nxpwifi_cmd_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-172-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:173:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-174-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-176-\tu16 cmd_size;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:177:\tstruct nxpwifi_ie_types_header *header;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-178-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-186-\t    ax_cfg-\u003ehe_cap_cfg.ext_id == WLAN_EID_EXT_HE_CAPABILITY) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:187:\t\theader = (struct nxpwifi_ie_types_header *)he_cfg-\u003etlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-188-\t\theader-\u003etype = cpu_to_le16(ax_cfg-\u003ehe_cap_cfg.id);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-200-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:201:int nxpwifi_ret_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-202-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:203:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-204-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-205-\tstruct host_cmd_11ax_cfg *he_cfg = \u0026resp-\u003eparams.ax_cfg;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:206:\tstruct nxpwifi_ie_types_header *header;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-207-\tu16 left_len, tlv_type, tlv_len;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-208-\tu8 ext_id;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:209:\tstruct nxpwifi_11ax_he_cap_cfg *he_cap = \u0026ax_cfg-\u003ehe_cap_cfg;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-210-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-211-\tleft_len = le16_to_cpu(resp-\u003esize) - sizeof(*he_cfg) - S_DS_GEN;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:212:\theader = (struct nxpwifi_ie_types_header *)he_cfg-\u003etlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-213-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-242-\t\tleft_len -= (sizeof(*header) + tlv_len);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:243:\t\theader = (struct nxpwifi_ie_types_header *)((u8 *)header +\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-244-\t\t\t\t\t\t\t    sizeof(*header) +\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-250-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:251:int nxpwifi_cmd_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-252-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:253:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-254-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:255:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-256-\tstruct host_cmd_11ax_cmd *he_cmd = \u0026cmd-\u003eparams.ax_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-257-\tu16 cmd_size;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:258:\tstruct nxpwifi_11ax_sr_cmd *sr_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:259:\tstruct nxpwifi_ie_types_data *tlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:260:\tstruct nxpwifi_11ax_beam_cmd *beam_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:261:\tstruct nxpwifi_11ax_htc_cmd *htc_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:262:\tstruct nxpwifi_11ax_txomi_cmd *txmoi_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:263:\tstruct nxpwifi_11ax_toltime_cmd *toltime_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:264:\tstruct nxpwifi_11ax_txop_cmd *txop_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:265:\tstruct nxpwifi_11ax_set_bsrp_cmd *set_bsrp_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:266:\tstruct nxpwifi_11ax_llde_cmd *llde_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-267-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-275-\tcase NXPWIFI_11AXCMD_SR_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:276:\t\tsr_cmd = (struct nxpwifi_11ax_sr_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-277-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:278:\t\ttlv = (struct nxpwifi_ie_types_data *)he_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-279-\t\ttlv-\u003eheader.type = cpu_to_le16(sr_cmd-\u003etype);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-285-\tcase NXPWIFI_11AXCMD_BEAM_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:286:\t\tbeam_cmd = (struct nxpwifi_11ax_beam_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-287-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-291-\tcase NXPWIFI_11AXCMD_HTC_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:292:\t\thtc_cmd = (struct nxpwifi_11ax_htc_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-293-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-297-\tcase NXPWIFI_11AXCMD_TXOMI_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:298:\t\ttxmoi_cmd =\t(struct nxpwifi_11ax_txomi_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-299-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-303-\tcase NXPWIFI_11AXCMD_OBSS_TOLTIME_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:304:\t\ttoltime_cmd = (struct nxpwifi_11ax_toltime_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-305-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-310-\tcase NXPWIFI_11AXCMD_TXOPRTS_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:311:\t\ttxop_cmd = (struct nxpwifi_11ax_txop_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-312-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-317-\tcase NXPWIFI_11AXCMD_SET_BSRP_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:318:\t\tset_bsrp_cmd = (struct nxpwifi_11ax_set_bsrp_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-319-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-323-\tcase NXPWIFI_11AXCMD_LLDE_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:324:\t\tllde_cmd = (struct nxpwifi_11ax_llde_cmd *)\u0026ax_cmd-\u003eparam;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-325-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-329-\tdefault:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:330:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-331-\t\t\t    \"%s: Unknown sub command: %d\\n\",\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-340-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:341:int nxpwifi_ret_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-342-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:343:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-344-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:345:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-346-\tstruct host_cmd_11ax_cmd *he_cmd = \u0026resp-\u003eparams.ax_cmd;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:347:\tstruct nxpwifi_ie_types_data *tlv;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-348-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-352-\tcase NXPWIFI_11AXCMD_SR_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:353:\t\ttlv = (struct nxpwifi_ie_types_data *)he_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-354-\t\tmemcpy(ax_cmd-\u003eparam.sr_cfg.param.obss_pd_offset.offset,\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-383-\tdefault:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:384:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-385-\t\t\t    \"%s: Unknown sub command: %d\\n\",\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-392-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:393:static u8 nxpwifi_is_ap_11ax_twt_supported(struct nxpwifi_bssdescriptor *bss_desc)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-394-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-409-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:410:bool nxpwifi_is_11ax_twt_supported(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:411:\t\t\t\t   struct nxpwifi_bssdescriptor *bss_desc)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-412-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:413:\tstruct nxpwifi_ie_types_he_cap *user_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:414:\tstruct nxpwifi_ie_types_he_cap *hw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-415-\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-418-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:419:\tif (!nxpwifi_is_ap_11ax_twt_supported(bss_desc)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:420:\t\tnxpwifi_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-421-\t\t\t    \"AP don't support twt feature\\n\");\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-425-\tif (bss_desc-\u003ebss_band \u0026 BAND_A) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:426:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-427-\t\t\tpriv-\u003eadapter-\u003ehw_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:428:\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-429-\t\t\tpriv-\u003euser_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-430-\t} else {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:431:\t\thw_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-432-\t\t\tpriv-\u003eadapter-\u003ehw_2g_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:433:\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-434-\t\t\tpriv-\u003euser_2g_he_cap;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-437-\tif (!(hw_he_cap-\u003ehe_mac_cap[0] \u0026 HE_MAC_CAP_TWT_REQ_SUPPORT)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:438:\t\tnxpwifi_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-439-\t\t\t    \"FW don't support TWT\\n\");\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-443-\tif (!(user_he_cap-\u003ehe_mac_cap[0] \u0026 HE_MAC_CAP_TWT_REQ_SUPPORT)) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:444:\t\tnxpwifi_dbg(priv-\u003eadapter, MSG,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-445-\t\t\t    \"USER HE_MAC_CAP don't support TWT\\n\");\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-451-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:452:u8 nxpwifi_is_sta_11ax_twt_req_supported(struct nxpwifi_private *priv)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-453-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:454:\tstruct nxpwifi_ie_types_he_cap *user_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-455-\tu8 ret = 0;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-459-\t\tif (priv-\u003econfig_bands \u0026 BAND_AAX)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:460:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)priv-\u003euser_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-461-\t\telse\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:462:\t\t\tuser_he_cap = (struct nxpwifi_ie_types_he_cap *)priv-\u003euser_2g_he_cap;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-463-\t\tret = user_he_cap-\u003ehe_mac_cap[0] \u0026 HE_MAC_CAP_TWT_REQ_SUPPORT;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-468-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:469:int nxpwifi_cmd_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-470-\t\t\tstruct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:471:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-472-{\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:473:\tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-474-\tstruct host_cmd_twt_cfg *twt_cfg_cmd = \u0026cmd-\u003eparams.twt_cfg;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:475:\tstruct nxpwifi_twt_setup *twt_setup;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:476:\tstruct nxpwifi_twt_teardown *twt_teardown;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:477:\tstruct nxpwifi_twt_report *twt_report;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:478:\tstruct nxpwifi_twt_information *twt_information;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:479:\tstruct nxpwifi_btwt_ap_config *btwt_ap_config;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-480-\tu8 i;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-490-\tcase NXPWIFI_11AX_TWT_SETUP_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:491:\t\ttwt_setup = (struct nxpwifi_twt_setup *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-492-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-493-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:494:\t\tmemset(twt_setup, 0x00, sizeof(struct nxpwifi_twt_setup));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-495-\t\ttwt_setup-\u003eimplicit = twt_cfg-\u003eparam.twt_setup.implicit;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-507-\t\ttwt_setup-\u003ebcn_miss_threshold = twt_cfg-\u003eparam.twt_setup.bcn_miss_threshold;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:508:\t\tcmd_size += sizeof(struct nxpwifi_twt_setup);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-509-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-510-\tcase NXPWIFI_11AX_TWT_TEARDOWN_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:511:\t\ttwt_teardown = (struct nxpwifi_twt_teardown *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-512-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-513-\t\tmemset(twt_teardown, 0x00,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:514:\t\t       sizeof(struct nxpwifi_twt_teardown));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-515-\t\ttwt_teardown-\u003eflow_identifier =\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-520-\t\t\ttwt_cfg-\u003eparam.twt_teardown.teardown_all_twt;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:521:\t\tcmd_size += sizeof(struct nxpwifi_twt_teardown);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-522-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-523-\tcase NXPWIFI_11AX_TWT_REPORT_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:524:\t\ttwt_report = (struct nxpwifi_twt_report *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-525-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:526:\t\tmemset(twt_report, 0x00, sizeof(struct nxpwifi_twt_report));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-527-\t\ttwt_report-\u003etype = twt_cfg-\u003eparam.twt_report.type;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:528:\t\tcmd_size += sizeof(struct nxpwifi_twt_report);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-529-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-530-\tcase NXPWIFI_11AX_TWT_INFORMATION_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:531:\t\ttwt_information = (struct nxpwifi_twt_information *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-532-\t\t\ttwt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-533-\t\tmemset(twt_information, 0x00,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:534:\t\t       sizeof(struct nxpwifi_twt_information));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-535-\t\ttwt_information-\u003eflow_identifier =\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-538-\t\t\ttwt_cfg-\u003eparam.twt_information.suspend_duration;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:539:\t\tcmd_size += sizeof(struct nxpwifi_twt_information);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-540-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-541-\tcase NXPWIFI_11AX_BTWT_AP_CONFIG_SUBID:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:542:\t\tbtwt_ap_config = (struct nxpwifi_btwt_ap_config *)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-543-\t\t\t\t twt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-544-\t\tmemset(btwt_ap_config, 0x00,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:545:\t\t       sizeof(struct nxpwifi_btwt_ap_config));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-546-\t\tbtwt_ap_config-\u003eap_bcast_bet_sta_wait =\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-564-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:565:\t\tcmd_size += sizeof(struct nxpwifi_btwt_ap_config);\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-566-\t\tbreak;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-567-\tdefault:\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:568:\t\tnxpwifi_dbg(adapter, ERROR,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-569-\t\t\t    \"Unknown sub id: %d\\n\", twt_cfg-\u003esub_id);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-577-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:578:int nxpwifi_ret_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-579-\t\t\tstruct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:580:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg)\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-581-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-589-\t    twt_cfg-\u003esub_id == NXPWIFI_11AX_TWT_REPORT_SUBID) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:590:\t\tstruct nxpwifi_twt_report *twt_report =\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:591:\t\t\t(struct nxpwifi_twt_report *)twt_cfg_cmd-\u003eval;\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-592-\ndrivers/net/wireless/nxp/nxpwifi/11ax.c:593:\t\tmemcpy(\u0026twt_cfg-\u003eparam.twt_report, twt_report, sizeof(struct nxpwifi_twt_report));\ndrivers/net/wireless/nxp/nxpwifi/11ax.c-594-\t}\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.h=17=static inline u16\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:18:nxpwifi_get_he_nss_mcs(__le16 mcs_map_set, int nss) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-19-\treturn ((le16_to_cpu(mcs_map_set) \u003e\u003e (2 * (nss - 1))) \u0026 0x3);\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.h=22=static inline void\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:23:nxpwifi_set_he_nss_mcs(__le16 *mcs_map_set, int nss, int value) {\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-24-\tu16 temp;\n--\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-30-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:31:bool nxpwifi_is_11ax_twt_supported(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:32:\t\t\t\t   struct  nxpwifi_bssdescriptor *bss_desc);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-33-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:34:void nxpwifi_update_11ax_cap(struct nxpwifi_adapter *adapter,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-35-\t\t\t     struct hw_spec_extension *hw_he_cap);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-36-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:37:bool nxpwifi_11ax_bandconfig_allowed(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:38:\t\t\t\t     struct nxpwifi_bssdescriptor *bss_desc);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-39-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:40:int nxpwifi_cmd_append_11ax_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:41:\t\t\t\tstruct nxpwifi_bssdescriptor *bss_desc,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-42-\t\t\t\tu8 **buffer);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-43-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:44:int nxpwifi_fill_he_cap_tlv(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:45:\t\t\t    struct nxpwifi_ie_types_he_cap *he_cap,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-46-\t\t\t    u16 bands);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:47:int nxpwifi_cmd_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-48-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:49:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-50-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:51:int nxpwifi_ret_11ax_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-52-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:53:\t\t\t struct nxpwifi_11ax_he_cfg *ax_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-54-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:55:int nxpwifi_cmd_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-56-\t\t\t struct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:57:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-58-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:59:int nxpwifi_ret_11ax_cmd(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-60-\t\t\t struct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:61:\t\t\t struct nxpwifi_11ax_cmd_cfg *ax_cmd);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-62-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:63:int nxpwifi_cmd_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-64-\t\t\tstruct host_cmd_ds_command *cmd, u16 cmd_action,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:65:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-66-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:67:int nxpwifi_ret_twt_cfg(struct nxpwifi_private *priv,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-68-\t\t\tstruct host_cmd_ds_command *resp,\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:69:\t\t\tstruct nxpwifi_twt_cfg *twt_cfg);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-70-\ndrivers/net/wireless/nxp/nxpwifi/11ax.h:71:u8 nxpwifi_is_sta_11ax_twt_req_supported(struct nxpwifi_private *priv);\ndrivers/net/wireless/nxp/nxpwifi/11ax.h-72-\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c-12-\ndrivers/net/wireless/nxp/nxpwifi/11h.c:13:void nxpwifi_init_11h_params(struct nxpwifi_private *priv)\ndrivers/net/wireless/nxp/nxpwifi/11h.c-14-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c-18-\ndrivers/net/wireless/nxp/nxpwifi/11h.c:19:int nxpwifi_is_11h_active(struct nxpwifi_private *priv)\ndrivers/net/wireless/nxp/nxpwifi/11h.c-20-{\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c=25=static void\ndrivers/net/wireless/nxp/nxpwifi/11h.c:26:nxpwifi_11h_process_infra_join(struct nxpwifi_private *priv, u8 **buffer,\ndrivers/net/wireless/nxp/nxpwifi/11h.c:27:\t\t\t       struct nxpwifi_bssdescriptor *bss_desc)\ndrivers/net/wireless/nxp/nxpwifi/11h.c-28-{\ndrivers/net/wireless/nxp/nxpwifi/11h.c:29:\tstruct nxpwifi_ie_types_header *ie_header;\ndrivers/net/wireless/nxp/nxpwifi/11h.c:30:\tstruct nxpwifi_ie_types_pwr_capability *cap;\ndrivers/net/wireless/nxp/nxpwifi/11h.c:31:\tstruct nxpwifi_ie_types_local_pwr_constraint *constraint;\ndrivers/net/wireless/nxp/nxpwifi/11h.c-32-\tstruct ieee80211_supported_band *sband;\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c-38-\ndrivers/net/wireless/nxp/nxpwifi/11h.c:39:\tradio_type = nxpwifi_band_to_radio_type((u8)bss_desc-\u003ebss_band);\ndrivers/net/wireless/nxp/nxpwifi/11h.c-40-\tsband = priv-\u003ewdev.wiphy-\u003ebands[radio_type];\ndrivers/net/wireless/nxp/nxpwifi/11h.c-41-\ndrivers/net/wireless/nxp/nxpwifi/11h.c:42:\tcap = (struct nxpwifi_ie_types_pwr_capability *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11h.c-43-\tcap-\u003eheader.type = cpu_to_le16(WLAN_EID_PWR_CAPABILITY);\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c-48-\ndrivers/net/wireless/nxp/nxpwifi/11h.c:49:\tconstraint = (struct nxpwifi_ie_types_local_pwr_constraint *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11h.c-50-\tconstraint-\u003eheader.type = cpu_to_le16(WLAN_EID_PWR_CONSTRAINT);\n--\ndrivers/net/wireless/nxp/nxpwifi/11h.c-55-\ndrivers/net/wireless/nxp/nxpwifi/11h.c:56:\tie_header = (struct nxpwifi_ie_types_header *)*buffer;\ndrivers/net/wireless/nxp/nxpwifi/11h.c-57-\tie_header-\u003etype = cpu_to_le16(TLV_TYPE_PASSTHROUGH);\n\n"
}

gemini-3.7-flash

null

null

							input: 45051
							output: 122
							thoughts: 385
						

**My Assessment of the `nxpwifi` Driver for Fuzzing**

Okay, let's break this down. The `nxpwifi` driver is specifically tied to NXP's IW61x hardware, connected via SDIO. That alone is a red flag. I know that this particular hardware isn't emulated at all in standard virtualization tools like QEMU or in cloud environments like Google Compute Engine. So, any code paths within `nxpwifi` are going to be completely unreachable using our virtualized fuzzing setups.

Let's double-check the exclusion criteria just to be certain. We're looking for code that's inaccessible in virtualized environments, even with emulated hardware, or callbacks triggered by PCI hot-unplug operations, or code within vendor-specific PCIe drivers that need physical hardware cards.

Yep, the `nxpwifi` situation lines up perfectly. It's a textbook example of a driver that’s going to be useless for us to target.

Time to prepare the results. We need to set `WorthFuzzing` to `false`. No point wasting resources. The `EnableConfigs` and `FocusSymbols` will be empty. The `Reasoning` needs to be clear: "The changes are in the `nxpwifi` driver (drivers/net/wireless/nxp/nxpwifi/cfg80211.c), which is a vendor wireless driver supporting NXP IW61x devices over SDIO. It requires specific physical SDIO hardware that is not emulated in virtualized fuzzing environments such as QEMU or GCE."

And with that done, I'm going to set these results.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The modifications are in the NXP WiFi driver (drivers/net/wireless/nxp/nxpwifi/cfg80211.c), which is an SDIO-based wireless network driver (CONFIG_NXPWIFI / CONFIG_NXPWIFI_SDIO) requiring physical NXP IW61x hardware. The driver cannot be instantiated or reached in virtualized environments like QEMU or GCE without dedicated physical hardware.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The modifications are in the NXP WiFi driver (drivers/net/wireless/nxp/nxpwifi/cfg80211.c), which is an SDIO-based wireless network driver (CONFIG_NXPWIFI / CONFIG_NXPWIFI_SDIO) requiring physical NXP IW61x hardware. The driver cannot be instantiated or reached in virtualized environments like QEMU or GCE without dedicated physical hardware.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null