| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/14 06:20 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch is a trivial refactoring that replaces open-coded copy_from_user() and kstrtou16() with the standard kstrtou16_from_user() helper in debugfs write handlers. It does not introduce new functional logic or alter the execution flow in a way that requires fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/08/14 06:20 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 39d2645cf41391b2935a1f27ba92c899d2b00347\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Aug 14 06:20:53 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c\nindex 84403aab21c05..e002848090d52 100644\n--- a/drivers/net/wireless/ath/ath6kl/debug.c\n+++ b/drivers/net/wireless/ath/ath6kl/debug.c\n@@ -1622,20 +1622,15 @@ static ssize_t ath6kl_bgscan_int_write(struct file *file,\n \tstruct ath6kl *ar = file-\u003eprivate_data;\n \tstruct ath6kl_vif *vif;\n \tu16 bgscan_int;\n-\tchar buf[32];\n-\tssize_t len;\n+\tint ret;\n \n \tvif = ath6kl_vif_first(ar);\n \tif (!vif)\n \t\treturn -EIO;\n \n-\tlen = min(count, sizeof(buf) - 1);\n-\tif (copy_from_user(buf, user_buf, len))\n-\t\treturn -EFAULT;\n-\n-\tbuf[len] = '\\0';\n-\tif (kstrtou16(buf, 0, \u0026bgscan_int))\n-\t\treturn -EINVAL;\n+\tret = kstrtou16_from_user(user_buf, count, 0, \u0026bgscan_int);\n+\tif (ret)\n+\t\treturn ret;\n \n \tif (bgscan_int == 0)\n \t\tbgscan_int = 0xffff;\n@@ -1662,20 +1657,15 @@ static ssize_t ath6kl_listen_int_write(struct file *file,\n \tstruct ath6kl *ar = file-\u003eprivate_data;\n \tstruct ath6kl_vif *vif;\n \tu16 listen_interval;\n-\tchar buf[32];\n-\tssize_t len;\n+\tint ret;\n \n \tvif = ath6kl_vif_first(ar);\n \tif (!vif)\n \t\treturn -EIO;\n \n-\tlen = min(count, sizeof(buf) - 1);\n-\tif (copy_from_user(buf, user_buf, len))\n-\t\treturn -EFAULT;\n-\n-\tbuf[len] = '\\0';\n-\tif (kstrtou16(buf, 0, \u0026listen_interval))\n-\t\treturn -EINVAL;\n+\tret = kstrtou16_from_user(user_buf, count, 0, \u0026listen_interval);\n+\tif (ret)\n+\t\treturn ret;\n \n \tif ((listen_interval \u003c 15) || (listen_interval \u003e 3000))\n \t\treturn -EINVAL;\n"
} |
| 2/1 | 2026/08/14 06:20 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch is a trivial refactoring that replaces open-coded copy_from_user() and kstrtou16() with the standard kstrtou16_from_user() helper in debugfs write handlers. It does not introduce new functional logic or alter the execution flow in a way that requires fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 39d2645cf41391b2935a1f27ba92c899d2b00347
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Aug 14 06:20:53 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
index 84403aab21c05..e002848090d52 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.c
+++ b/drivers/net/wireless/ath/ath6kl/debug.c
@@ -1622,20 +1622,15 @@ static ssize_t ath6kl_bgscan_int_write(struct file *file,
struct ath6kl *ar = file->private_data;
struct ath6kl_vif *vif;
u16 bgscan_int;
- char buf[32];
- ssize_t len;
+ int ret;
vif = ath6kl_vif_first(ar);
if (!vif)
return -EIO;
- len = min(count, sizeof(buf) - 1);
- if (copy_from_user(buf, user_buf, len))
- return -EFAULT;
-
- buf[len] = '\0';
- if (kstrtou16(buf, 0, &bgscan_int))
- return -EINVAL;
+ ret = kstrtou16_from_user(user_buf, count, 0, &bgscan_int);
+ if (ret)
+ return ret;
if (bgscan_int == 0)
bgscan_int = 0xffff;
@@ -1662,20 +1657,15 @@ static ssize_t ath6kl_listen_int_write(struct file *file,
struct ath6kl *ar = file->private_data;
struct ath6kl_vif *vif;
u16 listen_interval;
- char buf[32];
- ssize_t len;
+ int ret;
vif = ath6kl_vif_first(ar);
if (!vif)
return -EIO;
- len = min(count, sizeof(buf) - 1);
- if (copy_from_user(buf, user_buf, len))
- return -EFAULT;
-
- buf[len] = '\0';
- if (kstrtou16(buf, 0, &listen_interval))
- return -EINVAL;
+ ret = kstrtou16_from_user(user_buf, count, 0, &listen_interval);
+ if (ret)
+ return ret;
if ((listen_interval < 15) || (listen_interval > 3000))
return -EINVAL;
|
| 3/2 | 2026/08/14 06:20 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2494 output: 35 thoughts: 291 Thoughts: **Analyzing a Wi-Fi Driver Patch for Fuzzing Potential** Okay, so I've got this patch that touches `drivers/net/wireless/ath/ath6kl/debug.c`. Looks like they're replacing `copy_from_user` and `kstrtou16` with `kstrtou16_from_user` in these `ath6kl_bgscan_int_write` and `ath6kl_listen_int_write` functions. Classic debugfs write handler modifications. The driver itself is `ath6kl`, which is for Atheros AR6003/AR6004 Wi-Fi chips. My immediate thought is, can I even *reach* this thing in a virtualized environment? It's a hardware driver, isn't it? Yeah, it's specific hardware – SDIO or USB. Realistically, we don't usually mess with these unless there's some sort of software emulation going on. Drivers like `mac80211_hwsim` or USB gadget, for instance, are fair game. But wait a minute... I seem to recall `ath6kl` *does* have a USB driver. Now we're talking. If it has a USB interface, it might be possible to get somewhere with `dummy_hcd` and `syz-usb`. This opens up the possibility for fuzzing the USB interface, right? Time to confirm. Let me just check... Yep, the file `drivers/net/wireless/ath/ath6kl/usb.c` exists. Alright, this is promising. I'll need to investigate further to determine the extent of the USB interface and how susceptible it is to fuzzing. |
| 4/2 | 2026/08/14 06:21 | tool | grepper |
0mArgs:{
"Expression": "ath6kl",
"PathPrefix": "drivers/net/wireless/ath/ath6kl/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 11056 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath6kl/Kconfig=2=config ATH6KL\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-10-\t If you choose to build it as a module, it will be called\ndrivers/net/wireless/ath/ath6kl/Kconfig:11:\t ath6kl_core. Please note that AR6002 and AR6001 are not\ndrivers/net/wireless/ath/ath6kl/Kconfig-12-\t supported by this driver.\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig=14=config ATH6KL_SDIO\ndrivers/net/wireless/ath/ath6kl/Kconfig:15:\ttristate \"Atheros ath6kl SDIO support\"\ndrivers/net/wireless/ath/ath6kl/Kconfig-16-\tdepends on ATH6KL\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-20-\t Atheros AR6003 and AR6004 chipsets running over SDIO. If you\ndrivers/net/wireless/ath/ath6kl/Kconfig:21:\t choose to build it as a module, it will be called ath6kl_sdio.\ndrivers/net/wireless/ath/ath6kl/Kconfig-22-\t Please note that AR6002 and AR6001 are not supported by this\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig=25=config ATH6KL_USB\ndrivers/net/wireless/ath/ath6kl/Kconfig:26:\ttristate \"Atheros ath6kl USB support\"\ndrivers/net/wireless/ath/ath6kl/Kconfig-27-\tdepends on ATH6KL\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-32-\t USB. If you choose to build it as a module, it will be\ndrivers/net/wireless/ath/ath6kl/Kconfig:33:\t called ath6kl_usb.\ndrivers/net/wireless/ath/ath6kl/Kconfig-34-\ndrivers/net/wireless/ath/ath6kl/Kconfig=35=config ATH6KL_DEBUG\ndrivers/net/wireless/ath/ath6kl/Kconfig:36:\tbool \"Atheros ath6kl debugging\"\ndrivers/net/wireless/ath/ath6kl/Kconfig-37-\tdepends on ATH6KL\ndrivers/net/wireless/ath/ath6kl/Kconfig-38-\thelp\ndrivers/net/wireless/ath/ath6kl/Kconfig:39:\t Enables ath6kl debug support, including debug messages\ndrivers/net/wireless/ath/ath6kl/Kconfig-40-\t enabled with debug_mask module parameter and debugfs\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig=45=config ATH6KL_TRACING\ndrivers/net/wireless/ath/ath6kl/Kconfig:46:\tbool \"Atheros ath6kl tracing support\"\ndrivers/net/wireless/ath/ath6kl/Kconfig-47-\tdepends on ATH6KL\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-49-\thelp\ndrivers/net/wireless/ath/ath6kl/Kconfig:50:\t Select this to ath6kl use tracing infrastructure which, for\ndrivers/net/wireless/ath/ath6kl/Kconfig-51-\t example, can be enabled with help of trace-cmd. All debug\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig=57=config ATH6KL_REGDOMAIN\ndrivers/net/wireless/ath/ath6kl/Kconfig:58:\tbool \"Atheros ath6kl regdomain support\"\ndrivers/net/wireless/ath/ath6kl/Kconfig-59-\tdepends on ATH6KL\n--\ndrivers/net/wireless/ath/ath6kl/Makefile-24-\ndrivers/net/wireless/ath/ath6kl/Makefile:25:obj-$(CONFIG_ATH6KL) += ath6kl_core.o\ndrivers/net/wireless/ath/ath6kl/Makefile:26:ath6kl_core-y += debug.o\ndrivers/net/wireless/ath/ath6kl/Makefile:27:ath6kl_core-y += hif.o\ndrivers/net/wireless/ath/ath6kl/Makefile:28:ath6kl_core-y += htc_mbox.o\ndrivers/net/wireless/ath/ath6kl/Makefile:29:ath6kl_core-y += htc_pipe.o\ndrivers/net/wireless/ath/ath6kl/Makefile:30:ath6kl_core-y += bmi.o\ndrivers/net/wireless/ath/ath6kl/Makefile:31:ath6kl_core-y += cfg80211.o\ndrivers/net/wireless/ath/ath6kl/Makefile:32:ath6kl_core-y += init.o\ndrivers/net/wireless/ath/ath6kl/Makefile:33:ath6kl_core-y += main.o\ndrivers/net/wireless/ath/ath6kl/Makefile:34:ath6kl_core-y += txrx.o\ndrivers/net/wireless/ath/ath6kl/Makefile:35:ath6kl_core-y += wmi.o\ndrivers/net/wireless/ath/ath6kl/Makefile:36:ath6kl_core-y += core.o\ndrivers/net/wireless/ath/ath6kl/Makefile:37:ath6kl_core-y += recovery.o\ndrivers/net/wireless/ath/ath6kl/Makefile-38-\ndrivers/net/wireless/ath/ath6kl/Makefile:39:ath6kl_core-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath6kl/Makefile:40:ath6kl_core-$(CONFIG_ATH6KL_TRACING) += trace.o\ndrivers/net/wireless/ath/ath6kl/Makefile-41-\ndrivers/net/wireless/ath/ath6kl/Makefile:42:obj-$(CONFIG_ATH6KL_SDIO) += ath6kl_sdio.o\ndrivers/net/wireless/ath/ath6kl/Makefile:43:ath6kl_sdio-y += sdio.o\ndrivers/net/wireless/ath/ath6kl/Makefile-44-\ndrivers/net/wireless/ath/ath6kl/Makefile:45:obj-$(CONFIG_ATH6KL_USB) += ath6kl_usb.o\ndrivers/net/wireless/ath/ath6kl/Makefile:46:ath6kl_usb-y += usb.o\ndrivers/net/wireless/ath/ath6kl/Makefile-47-\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-22-\ndrivers/net/wireless/ath/ath6kl/bmi.c:23:int ath6kl_bmi_done(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/bmi.c-24-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-28-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:29:\t\tath6kl_dbg(ATH6KL_DBG_BMI, \"bmi done skipped\\n\");\ndrivers/net/wireless/ath/ath6kl/bmi.c-30-\t\treturn 0;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-34-\ndrivers/net/wireless/ath/ath6kl/bmi.c:35:\tret = ath6kl_hif_bmi_write(ar, (u8 *)\u0026cid, sizeof(cid));\ndrivers/net/wireless/ath/ath6kl/bmi.c-36-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:37:\t\tath6kl_err(\"Unable to send bmi done: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-38-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-43-\ndrivers/net/wireless/ath/ath6kl/bmi.c:44:int ath6kl_bmi_get_target_info(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/bmi.c:45:\t\t\t struct ath6kl_bmi_target_info *targ_info)\ndrivers/net/wireless/ath/ath6kl/bmi.c-46-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-50-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:51:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-52-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-54-\ndrivers/net/wireless/ath/ath6kl/bmi.c:55:\tret = ath6kl_hif_bmi_write(ar, (u8 *)\u0026cid, sizeof(cid));\ndrivers/net/wireless/ath/ath6kl/bmi.c-56-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:57:\t\tath6kl_err(\"Unable to send get target info: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-58-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-61-\tif (ar-\u003ehif_type == ATH6KL_HIF_TYPE_USB) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:62:\t\tret = ath6kl_hif_bmi_read(ar, (u8 *)targ_info,\ndrivers/net/wireless/ath/ath6kl/bmi.c-63-\t\t\t\t\t sizeof(*targ_info));\ndrivers/net/wireless/ath/ath6kl/bmi.c-64-\t} else {\ndrivers/net/wireless/ath/ath6kl/bmi.c:65:\t\tret = ath6kl_hif_bmi_read(ar, (u8 *)\u0026targ_info-\u003eversion,\ndrivers/net/wireless/ath/ath6kl/bmi.c-66-\t\t\t\tsizeof(targ_info-\u003eversion));\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-69-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:70:\t\tath6kl_err(\"Unable to recv target info: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-71-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-75-\t\t/* Determine how many bytes are in the Target's targ_info */\ndrivers/net/wireless/ath/ath6kl/bmi.c:76:\t\tret = ath6kl_hif_bmi_read(ar,\ndrivers/net/wireless/ath/ath6kl/bmi.c-77-\t\t\t\t (u8 *)\u0026targ_info-\u003ebyte_count,\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-79-\t\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:80:\t\t\tath6kl_err(\"unable to read target info byte count: %d\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-81-\t\t\t\t ret);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-89-\t\tif (le32_to_cpu(targ_info-\u003ebyte_count) != sizeof(*targ_info)) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:90:\t\t\tath6kl_err(\"mismatched byte count %d vs. expected %zd\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-91-\t\t\t\t le32_to_cpu(targ_info-\u003ebyte_count),\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-96-\t\t/* Read the remainder of the targ_info */\ndrivers/net/wireless/ath/ath6kl/bmi.c:97:\t\tret = ath6kl_hif_bmi_read(ar,\ndrivers/net/wireless/ath/ath6kl/bmi.c-98-\t\t\t\t ((u8 *)targ_info) +\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-103-\t\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:104:\t\t\tath6kl_err(\"Unable to read target info (%d bytes): %d\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-105-\t\t\t\t targ_info-\u003ebyte_count, ret);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-109-\ndrivers/net/wireless/ath/ath6kl/bmi.c:110:\tath6kl_dbg(ATH6KL_DBG_BMI, \"target info (ver: 0x%x type: 0x%x)\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-111-\t\t targ_info-\u003eversion, targ_info-\u003etype);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-115-\ndrivers/net/wireless/ath/ath6kl/bmi.c:116:int ath6kl_bmi_read(struct ath6kl *ar, u32 addr, u8 *buf, u32 len)\ndrivers/net/wireless/ath/ath6kl/bmi.c-117-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-124-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:125:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-126-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-135-\ndrivers/net/wireless/ath/ath6kl/bmi.c:136:\tath6kl_dbg(ATH6KL_DBG_BMI,\ndrivers/net/wireless/ath/ath6kl/bmi.c-137-\t\t \"bmi read memory: device: addr: 0x%x, len: %d\\n\",\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-152-\ndrivers/net/wireless/ath/ath6kl/bmi.c:153:\t\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-154-\t\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:155:\t\t\tath6kl_err(\"Unable to write to the device: %d\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-156-\t\t\t\t ret);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-158-\t\t}\ndrivers/net/wireless/ath/ath6kl/bmi.c:159:\t\tret = ath6kl_hif_bmi_read(ar, ar-\u003ebmi.cmd_buf, rx_len);\ndrivers/net/wireless/ath/ath6kl/bmi.c-160-\t\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:161:\t\t\tath6kl_err(\"Unable to read from the device: %d\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-162-\t\t\t\t ret);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-171-\ndrivers/net/wireless/ath/ath6kl/bmi.c:172:int ath6kl_bmi_write(struct ath6kl *ar, u32 addr, u8 *buf, u32 len)\ndrivers/net/wireless/ath/ath6kl/bmi.c-173-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-182-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:183:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-184-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-196-\ndrivers/net/wireless/ath/ath6kl/bmi.c:197:\tath6kl_dbg(ATH6KL_DBG_BMI,\ndrivers/net/wireless/ath/ath6kl/bmi.c-198-\t\t \"bmi write memory: addr: 0x%x, len: %d\\n\", addr, len);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-226-\ndrivers/net/wireless/ath/ath6kl/bmi.c:227:\t\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-228-\t\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:229:\t\t\tath6kl_err(\"Unable to write to the device: %d\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-230-\t\t\t\t ret);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-238-\ndrivers/net/wireless/ath/ath6kl/bmi.c:239:int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param)\ndrivers/net/wireless/ath/ath6kl/bmi.c-240-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-246-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:247:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-248-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-257-\ndrivers/net/wireless/ath/ath6kl/bmi.c:258:\tath6kl_dbg(ATH6KL_DBG_BMI, \"bmi execute: addr: 0x%x, param: %d)\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-259-\t\t addr, *param);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-268-\ndrivers/net/wireless/ath/ath6kl/bmi.c:269:\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-270-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:271:\t\tath6kl_err(\"Unable to write to the device: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-272-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-274-\ndrivers/net/wireless/ath/ath6kl/bmi.c:275:\tret = ath6kl_hif_bmi_read(ar, ar-\u003ebmi.cmd_buf, sizeof(*param));\ndrivers/net/wireless/ath/ath6kl/bmi.c-276-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:277:\t\tath6kl_err(\"Unable to read from the device: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-278-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-285-\ndrivers/net/wireless/ath/ath6kl/bmi.c:286:int ath6kl_bmi_set_app_start(struct ath6kl *ar, u32 addr)\ndrivers/net/wireless/ath/ath6kl/bmi.c-287-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-293-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:294:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-295-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-304-\ndrivers/net/wireless/ath/ath6kl/bmi.c:305:\tath6kl_dbg(ATH6KL_DBG_BMI, \"bmi set app start: addr: 0x%x\\n\", addr);\ndrivers/net/wireless/ath/ath6kl/bmi.c-306-\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-312-\ndrivers/net/wireless/ath/ath6kl/bmi.c:313:\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-314-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:315:\t\tath6kl_err(\"Unable to write to the device: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-316-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-321-\ndrivers/net/wireless/ath/ath6kl/bmi.c:322:int ath6kl_bmi_reg_read(struct ath6kl *ar, u32 addr, u32 *param)\ndrivers/net/wireless/ath/ath6kl/bmi.c-323-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-329-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:330:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-331-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-340-\ndrivers/net/wireless/ath/ath6kl/bmi.c:341:\tath6kl_dbg(ATH6KL_DBG_BMI, \"bmi read SOC reg: addr: 0x%x\\n\", addr);\ndrivers/net/wireless/ath/ath6kl/bmi.c-342-\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-348-\ndrivers/net/wireless/ath/ath6kl/bmi.c:349:\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-350-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:351:\t\tath6kl_err(\"Unable to write to the device: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-352-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-354-\ndrivers/net/wireless/ath/ath6kl/bmi.c:355:\tret = ath6kl_hif_bmi_read(ar, ar-\u003ebmi.cmd_buf, sizeof(*param));\ndrivers/net/wireless/ath/ath6kl/bmi.c-356-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:357:\t\tath6kl_err(\"Unable to read from the device: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-358-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-364-\ndrivers/net/wireless/ath/ath6kl/bmi.c:365:int ath6kl_bmi_reg_write(struct ath6kl *ar, u32 addr, u32 param)\ndrivers/net/wireless/ath/ath6kl/bmi.c-366-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-372-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:373:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-374-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-383-\ndrivers/net/wireless/ath/ath6kl/bmi.c:384:\tath6kl_dbg(ATH6KL_DBG_BMI,\ndrivers/net/wireless/ath/ath6kl/bmi.c-385-\t\t \"bmi write SOC reg: addr: 0x%x, param: %d\\n\",\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-395-\ndrivers/net/wireless/ath/ath6kl/bmi.c:396:\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-397-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:398:\t\tath6kl_err(\"Unable to write to the device: %d\\n\", ret);\ndrivers/net/wireless/ath/ath6kl/bmi.c-399-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-404-\ndrivers/net/wireless/ath/ath6kl/bmi.c:405:int ath6kl_bmi_lz_data(struct ath6kl *ar, u8 *buf, u32 len)\ndrivers/net/wireless/ath/ath6kl/bmi.c-406-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-414-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:415:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-416-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-425-\ndrivers/net/wireless/ath/ath6kl/bmi.c:426:\tath6kl_dbg(ATH6KL_DBG_BMI, \"bmi send LZ data: len: %d)\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-427-\t\t len);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-442-\ndrivers/net/wireless/ath/ath6kl/bmi.c:443:\t\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-444-\t\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:445:\t\t\tath6kl_err(\"Unable to write to the device: %d\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-446-\t\t\t\t ret);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-455-\ndrivers/net/wireless/ath/ath6kl/bmi.c:456:int ath6kl_bmi_lz_stream_start(struct ath6kl *ar, u32 addr)\ndrivers/net/wireless/ath/ath6kl/bmi.c-457-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-463-\tif (ar-\u003ebmi.done_sent) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:464:\t\tath6kl_err(\"bmi done sent already, cmd %d disallowed\\n\", cid);\ndrivers/net/wireless/ath/ath6kl/bmi.c-465-\t\treturn -EACCES;\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-474-\ndrivers/net/wireless/ath/ath6kl/bmi.c:475:\tath6kl_dbg(ATH6KL_DBG_BMI,\ndrivers/net/wireless/ath/ath6kl/bmi.c-476-\t\t \"bmi LZ stream start: addr: 0x%x)\\n\",\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-484-\ndrivers/net/wireless/ath/ath6kl/bmi.c:485:\tret = ath6kl_hif_bmi_write(ar, ar-\u003ebmi.cmd_buf, offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-486-\tif (ret) {\ndrivers/net/wireless/ath/ath6kl/bmi.c:487:\t\tath6kl_err(\"Unable to start LZ stream to the device: %d\\n\",\ndrivers/net/wireless/ath/ath6kl/bmi.c-488-\t\t\t ret);\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-494-\ndrivers/net/wireless/ath/ath6kl/bmi.c:495:int ath6kl_bmi_fast_download(struct ath6kl *ar, u32 addr, u8 *buf, u32 len)\ndrivers/net/wireless/ath/ath6kl/bmi.c-496-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-501-\ndrivers/net/wireless/ath/ath6kl/bmi.c:502:\tret = ath6kl_bmi_lz_stream_start(ar, addr);\ndrivers/net/wireless/ath/ath6kl/bmi.c-503-\tif (ret)\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-510-\ndrivers/net/wireless/ath/ath6kl/bmi.c:511:\tret = ath6kl_bmi_lz_data(ar, buf, last_word_offset);\ndrivers/net/wireless/ath/ath6kl/bmi.c-512-\tif (ret)\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-515-\tif (unaligned_bytes)\ndrivers/net/wireless/ath/ath6kl/bmi.c:516:\t\tret = ath6kl_bmi_lz_data(ar, (u8 *)\u0026last_word, 4);\ndrivers/net/wireless/ath/ath6kl/bmi.c-517-\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-520-\t\t * This serves mainly to flush Target caches. */\ndrivers/net/wireless/ath/ath6kl/bmi.c:521:\t\tret = ath6kl_bmi_lz_stream_start(ar, 0x00);\ndrivers/net/wireless/ath/ath6kl/bmi.c-522-\t}\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-525-\ndrivers/net/wireless/ath/ath6kl/bmi.c:526:void ath6kl_bmi_reset(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/bmi.c-527-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-530-\ndrivers/net/wireless/ath/ath6kl/bmi.c:531:int ath6kl_bmi_init(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/bmi.c-532-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.c-545-\ndrivers/net/wireless/ath/ath6kl/bmi.c:546:void ath6kl_bmi_cleanup(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/bmi.c-547-{\n--\ndrivers/net/wireless/ath/ath6kl/bmi.h-218-\ndrivers/net/wireless/ath/ath6kl/bmi.h:219:struct ath6kl;\ndrivers/net/wireless/ath/ath6kl/bmi.h:220:struct ath6kl_bmi_target_info {\ndrivers/net/wireless/ath/ath6kl/bmi.h-221-\t__le32 byte_count; /* size of this structure */\n--\ndrivers/net/wireless/ath/ath6kl/bmi.h-225-\ndrivers/net/wireless/ath/ath6kl/bmi.h:226:#define ath6kl_bmi_write_hi32(ar, item, val)\t\t\t\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h-227-\t({\t\t\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/ath/ath6kl/bmi.h-230-\t\t\t\t\t\t\t\t\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h:231:\t\taddr = ath6kl_get_hi_item_addr(ar, HI_ITEM(item));\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h-232-\t\tv = cpu_to_le32(val);\t\t\t\t\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h:233:\t\tath6kl_bmi_write(ar, addr, (u8 *) \u0026v, sizeof(v));\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h-234-\t})\ndrivers/net/wireless/ath/ath6kl/bmi.h-235-\ndrivers/net/wireless/ath/ath6kl/bmi.h:236:#define ath6kl_bmi_read_hi32(ar, item, val)\t\t\t\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h-237-\t({\t\t\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/ath/ath6kl/bmi.h-242-\t\t(void) (check_type == val);\t\t\t\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h:243:\t\taddr = ath6kl_get_hi_item_addr(ar, HI_ITEM(item));\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h:244:\t\tret = ath6kl_bmi_read(ar, addr, (u8 *) \u0026tmp, 4);\t\\\ndrivers/net/wireless/ath/ath6kl/bmi.h-245-\t\tif (!ret)\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/ath/ath6kl/bmi.h-249-\ndrivers/net/wireless/ath/ath6kl/bmi.h:250:int ath6kl_bmi_init(struct ath6kl *ar);\ndrivers/net/wireless/ath/ath6kl/bmi.h:251:void ath6kl_bmi_cleanup(struct ath6kl *ar);\ndrivers/net/wireless/ath/ath6kl/bmi.h:252:void ath6kl_bmi_reset(struct ath6kl *ar);\ndrivers/net/wireless/ath/ath6kl/bmi.h-253-\ndrivers/net/wireless/ath/ath6kl/bmi.h:254:int ath6kl_bmi_done(struct ath6kl *ar);\ndrivers/net/wireless/ath/ath6kl/bmi.h:255:int ath6kl_bmi_get_target_info(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/bmi.h:256:\t\t\t struct ath6kl_bmi_target_info *targ_info);\ndrivers/net/wireless/ath/ath6kl/bmi.h:257:int ath6kl_bmi_read(struct ath6kl *ar, u32 addr, u8 *buf, u32 len);\ndrivers/net/wireless/ath/ath6kl/bmi.h:258:int ath6kl_bmi_write(struct ath6kl *ar, u32 addr, u8 *buf, u32 len);\ndrivers/net/wireless/ath/ath6kl/bmi.h:259:int ath6kl_bmi_execute(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/bmi.h-260-\t\t u32 addr, u32 *param);\ndrivers/net/wireless/ath/ath6kl/bmi.h:261:int ath6kl_bmi_set_app_start(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/bmi.h-262-\t\t\t u32 addr);\ndrivers/net/wireless/ath/ath6kl/bmi.h:263:int ath6kl_bmi_reg_read(struct ath6kl *ar, u32 addr, u32 *param);\ndrivers/net/wireless/ath/ath6kl/bmi.h:264:int ath6kl_bmi_reg_write(struct ath6kl *ar, u32 addr, u32 param);\ndrivers/net/wireless/ath/ath6kl/bmi.h:265:int ath6kl_bmi_lz_data(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/bmi.h-266-\t\t u8 *buf, u32 len);\ndrivers/net/wireless/ath/ath6kl/bmi.h:267:int ath6kl_bmi_lz_stream_start(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/bmi.h-268-\t\t\t u32 addr);\ndrivers/net/wireless/ath/ath6kl/bmi.h:269:int ath6kl_bmi_fast_download(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/bmi.h-270-\t\t\t u32 addr, u8 *buf, u32 len);\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-57-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:58:struct ath6kl_cfg80211_match_probe_ssid {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-59-\tstruct cfg80211_ssid ssid;\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-62-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:63:static struct ieee80211_rate ath6kl_rates[] = {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-64-\tRATETAB_ENT(10, 0x1, 0),\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-77-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:78:#define ath6kl_a_rates (ath6kl_rates + 4)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:79:#define ath6kl_a_rates_size 8\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:80:#define ath6kl_g_rates (ath6kl_rates + 0)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:81:#define ath6kl_g_rates_size 12\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-82-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:83:#define ath6kl_g_htcap IEEE80211_HT_CAP_SGI_20\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:84:#define ath6kl_a_htcap (IEEE80211_HT_CAP_SUP_WIDTH_20_40 | \\\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-85-\t\t\tIEEE80211_HT_CAP_SGI_20\t\t | \\\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-87-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:88:static struct ieee80211_channel ath6kl_2ghz_channels[] = {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-89-\tCHAN2G(1, 2412, 0),\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-104-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:105:static struct ieee80211_channel ath6kl_5ghz_a_channels[] = {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-106-\tCHAN5G(36, 0), CHAN5G(40, 0),\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-124-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:125:static struct ieee80211_supported_band ath6kl_band_2ghz = {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:126:\t.n_channels = ARRAY_SIZE(ath6kl_2ghz_channels),\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:127:\t.channels = ath6kl_2ghz_channels,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:128:\t.n_bitrates = ath6kl_g_rates_size,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:129:\t.bitrates = ath6kl_g_rates,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:130:\t.ht_cap.cap = ath6kl_g_htcap,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-131-\t.ht_cap.ht_supported = true,\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-133-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:134:static struct ieee80211_supported_band ath6kl_band_5ghz = {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:135:\t.n_channels = ARRAY_SIZE(ath6kl_5ghz_a_channels),\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:136:\t.channels = ath6kl_5ghz_a_channels,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:137:\t.n_bitrates = ath6kl_a_rates_size,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:138:\t.bitrates = ath6kl_a_rates,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:139:\t.ht_cap.cap = ath6kl_a_htcap,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-140-\t.ht_cap.ht_supported = true,\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-145-/* returns true if scheduled scan was stopped */\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:146:static bool __ath6kl_cfg80211_sscan_stop(struct ath6kl_vif *vif)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-147-{\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:148:\tstruct ath6kl *ar = vif-\u003ear;\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-149-\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-157-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:158:\tath6kl_wmi_enable_sched_scan_cmd(ar-\u003ewmi, vif-\u003efw_vif_idx, false);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-159-\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-162-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:163:static void ath6kl_cfg80211_sscan_disable(struct ath6kl_vif *vif)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-164-{\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:165:\tstruct ath6kl *ar = vif-\u003ear;\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-166-\tbool stopped;\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-167-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:168:\tstopped = __ath6kl_cfg80211_sscan_stop(vif);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-169-\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-175-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:176:static int ath6kl_set_wpa_version(struct ath6kl_vif *vif,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-177-\t\t\t\t enum nl80211_wpa_versions wpa_version)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-178-{\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:179:\tath6kl_dbg(ATH6KL_DBG_WLAN_CFG, \"%s: %u\\n\", __func__, wpa_version);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-180-\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-187-\t} else {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:188:\t\tath6kl_err(\"%s: %u not supported\\n\", __func__, wpa_version);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-189-\t\treturn -ENOTSUPP;\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-194-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:195:static int ath6kl_set_auth_type(struct ath6kl_vif *vif,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-196-\t\t\t\tenum nl80211_auth_type auth_type)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-197-{\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:198:\tath6kl_dbg(ATH6KL_DBG_WLAN_CFG, \"%s: 0x%x\\n\", __func__, auth_type);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-199-\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-215-\tdefault:\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:216:\t\tath6kl_err(\"%s: 0x%x not supported\\n\", __func__, auth_type);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-217-\t\treturn -ENOTSUPP;\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-222-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:223:static int ath6kl_set_cipher(struct ath6kl_vif *vif, u32 cipher, bool ucast)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-224-{\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-228-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:229:\tath6kl_dbg(ATH6KL_DBG_WLAN_CFG, \"%s: cipher 0x%x, ucast %u\\n\",\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-230-\t\t __func__, cipher, ucast);\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-258-\tdefault:\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:259:\t\tath6kl_err(\"cipher 0x%x not supported\\n\", cipher);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-260-\t\treturn -ENOTSUPP;\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-265-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:266:static void ath6kl_set_key_mgmt(struct ath6kl_vif *vif, u32 key_mgmt)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-267-{\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:268:\tath6kl_dbg(ATH6KL_DBG_WLAN_CFG, \"%s: 0x%x\\n\", __func__, key_mgmt);\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-269-\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-284-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:285:static bool ath6kl_cfg80211_ready(struct ath6kl_vif *vif)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-286-{\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:287:\tstruct ath6kl *ar = vif-\u003ear;\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-288-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-289-\tif (!test_bit(WMI_READY, \u0026ar-\u003eflag)) {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:290:\t\tath6kl_err(\"wmi is not ready\\n\");\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-291-\t\treturn false;\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-294-\tif (!test_bit(WLAN_ENABLED, \u0026vif-\u003eflags)) {\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:295:\t\tath6kl_dbg(ATH6KL_DBG_WLAN_CFG, \"wlan disabled\\n\");\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-296-\t\treturn false;\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-301-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:302:static bool ath6kl_is_wpa_ie(const u8 *pos)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-303-{\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-308-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:309:static bool ath6kl_is_rsn_ie(const u8 *pos)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-310-{\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-313-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:314:static bool ath6kl_is_wps_ie(const u8 *pos)\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-315-{\n--\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-321-\ndrivers/net/wireless/ath/ath6kl/cfg80211.c:322:static int ath6kl_set_assoc_req_ies(struct ath6kl_vif *vif, const u8 *ies,\ndrivers/net/wireless/ath/ath6kl/cfg80211.c-323-\t\t\t\t size_t ies_len)\n\n"
} |
| 5/2 | 2026/08/14 06:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 17081 output: 96 thoughts: 802 Thoughts: **Analysis of the `ath6kl` Driver Patch for Fuzzing Suitability** Okay, so I'm looking at this patch for the `ath6kl` driver, specifically concerning the `ATH6KL_SDIO` and `ATH6KL_USB` configurations. The initial thought was to consider fuzzing the USB driver using `dummy_hcd` and `syz-usb`, but the patch itself touches `drivers/net/wireless/ath/ath6kl/debug.c`. That immediately flags it as a debugfs interface, which changes the focus. I dove into `ath6kl_bgscan_int_write` and `ath6kl_listen_int_write` – they're debugfs write handlers, and syzkaller *can* fuzz debugfs files if they are accessible. However, the critical question is whether this patch introduces functional changes that warrant fuzzing. The diff reveals the core change: it's replacing a manual `copy_from_user` and `kstrtou16` sequence with a single call to `kstrtou16_from_user`. This looks like a refactoring or cleanup. Specifically, the patch replaces: ```c - len = min(count, sizeof(buf) - 1); - if (copy_from_user(buf, user_buf, len)) - return -EFAULT; - - buf[len] = '\0'; - if (kstrtou16(buf, 0, &bgscan_int)) - return -EINVAL; + ret = kstrtou16_from_user(user_buf, count, 0, &bgscan_int); + if (ret) + return ret; ``` It's a pure refactoring, streamlining the code using a helper function. This isn't introducing any new logic; it's simply a more concise way of doing the same thing. My concern is whether the behavior actually *changes*. The helper function, `kstrtou16_from_user`, handles both the copy and the parsing in one go. But from what I can see, it does exactly what the original code did. Considering the patch's trivial nature, especially being contained within debugfs write handlers for a specific Wi-Fi driver, I'm leaning heavily towards "no" for fuzzing. The instructions explicitly state criteria for excluding patches, and this seems to fit. Specifically, this falls under the "Purely decorative changes...or Changes to numeric constants or macros that do not functionally alter execution flow". It's a minor refactoring. Also, I've confirmed that the patch isn't in a vendor-specific driver that requires physical hardware - it has a USB interface. Since the patch is just a trivial refactoring to replace a standard function, I will confidently set `WorthFuzzing=false`. I am going to double-check that `kstrtou16_from_user` doesn't do anything subtly different, but I don't see any evidence of that. It's a standard helper function. |
| 6/2 | 2026/08/14 06:21 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch is a trivial refactoring that replaces open-coded copy_from_user() and kstrtou16() with the standard kstrtou16_from_user() helper in debugfs write handlers. It does not introduce new functional logic or alter the execution flow in a way that requires fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch is a trivial refactoring that replaces open-coded copy_from_user() and kstrtou16() with the standard kstrtou16_from_user() helper in debugfs write handlers. It does not introduce new functional logic or alter the execution flow in a way that requires fuzzing.",
"WorthFuzzing": false
} |
| 7/1 | 2026/08/14 06:21 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|