AI Trajectory

null

{
  "EnableConfigs": [
    "RTW89_8852AU",
    "RTW89_8852BU",
    "RTW89_8852CU",
    "RTW89_8851BU"
  ],
  "FocusSymbols": [
    "rtw89_ops_start_ap"
  ],
  "Reasoning": "The patch adds error checking to several firmware command functions in `rtw89_ops_start_ap`. If any of these commands fail (e.g., due to TX resource exhaustion or memory allocation failure), the function now returns an error instead of continuing. This changes the execution flow and error handling of the driver. The driver can be reached in a virtualized environment via USB emulation (dummy-hcd), allowing syzkaller to trigger the mac80211 `start_ap` callback and potentially exhaust TX resources to exercise the new error paths.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 7c654b8f5537b0faa5cfa7a18aad489eb8bce113\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jun 29 10:01:03 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c\nindex 501c3af1da01a9..cd4076a179b330 100644\n--- a/drivers/net/wireless/realtek/rtw89/mac80211.c\n+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c\n@@ -811,11 +811,36 @@ static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\n \n \tether_addr_copy(rtwvif_link-\u003ebssid, link_conf-\u003ebssid);\n \trtw89_cam_bssid_changed(rtwdev, rtwvif_link);\n-\trtw89_mac_port_update(rtwdev, rtwvif_link);\n-\trtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);\n-\trtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_TYPE_CHANGE);\n-\trtw89_fw_h2c_join_info(rtwdev, rtwvif_link, NULL, true);\n-\trtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL, RTW89_ROLE_TYPE_CHANGE);\n+\tret = rtw89_mac_port_update(rtwdev, rtwvif_link);\n+\tif (ret) {\n+\t\trtw89_warn(rtwdev, \"failed to update mac port\\n\");\n+\t\treturn ret;\n+\t}\n+\n+\tret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);\n+\tif (ret) {\n+\t\trtw89_warn(rtwdev, \"failed to send h2c cmac table\\n\");\n+\t\treturn ret;\n+\t}\n+\n+\tret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_TYPE_CHANGE);\n+\tif (ret) {\n+\t\trtw89_warn(rtwdev, \"failed to send h2c role info\\n\");\n+\t\treturn ret;\n+\t}\n+\n+\tret = rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, NULL, true);\n+\tif (ret) {\n+\t\trtw89_warn(rtwdev, \"failed to send h2c join info\\n\");\n+\t\treturn ret;\n+\t}\n+\n+\tret = rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL, RTW89_ROLE_TYPE_CHANGE);\n+\tif (ret) {\n+\t\trtw89_warn(rtwdev, \"failed to send h2c cam\\n\");\n+\t\treturn ret;\n+\t}\n+\n \trtw89_chip_rfk_channel(rtwdev, rtwvif_link);\n \n \tif (RTW89_CHK_FW_FEATURE(NOTIFY_AP_INFO, \u0026rtwdev-\u003efw)) {\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "RTW89_8852AU",
    "RTW89_8852BU",
    "RTW89_8852CU",
    "RTW89_8851BU"
  ],
  "FocusSymbols": [
    "rtw89_ops_start_ap"
  ],
  "Reasoning": "The patch adds error checking to several firmware command functions in `rtw89_ops_start_ap`. If any of these commands fail (e.g., due to TX resource exhaustion or memory allocation failure), the function now returns an error instead of continuing. This changes the execution flow and error handling of the driver. The driver can be reached in a virtualized environment via USB emulation (dummy-hcd), allowing syzkaller to trigger the mac80211 `start_ap` callback and potentially exhaust TX resources to exercise the new error paths.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 7c654b8f5537b0faa5cfa7a18aad489eb8bce113
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jun 29 10:01:03 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index 501c3af1da01a9..cd4076a179b330 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -811,11 +811,36 @@ static int rtw89_ops_start_ap(struct ieee80211_hw *hw,
 
 	ether_addr_copy(rtwvif_link->bssid, link_conf->bssid);
 	rtw89_cam_bssid_changed(rtwdev, rtwvif_link);
-	rtw89_mac_port_update(rtwdev, rtwvif_link);
-	rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);
-	rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_TYPE_CHANGE);
-	rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, NULL, true);
-	rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL, RTW89_ROLE_TYPE_CHANGE);
+	ret = rtw89_mac_port_update(rtwdev, rtwvif_link);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to update mac port\n");
+		return ret;
+	}
+
+	ret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c cmac table\n");
+		return ret;
+	}
+
+	ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_TYPE_CHANGE);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c role info\n");
+		return ret;
+	}
+
+	ret = rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, NULL, true);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c join info\n");
+		return ret;
+	}
+
+	ret = rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL, RTW89_ROLE_TYPE_CHANGE);
+	if (ret) {
+		rtw89_warn(rtwdev, "failed to send h2c cam\n");
+		return ret;
+	}
+
 	rtw89_chip_rfk_channel(rtwdev, rtwvif_link);
 
 	if (RTW89_CHK_FW_FEATURE(NOTIFY_AP_INFO, &rtwdev->fw)) {

gemini-3.1-pro-preview

null

null

							input: 2505
							output: 37
							thoughts: 312
						

**Analyzing a Realtek Wireless Driver Patch**

Okay, so I'm looking at this patch that tweaks `drivers/net/wireless/realtek/rtw89/mac80211.c`. It's focused on `rtw89_ops_start_ap`, and it looks like they're beefing up the error handling there. They're adding checks after calls to `rtw89_mac_port_update`, `rtw89_chip_h2c_assoc_cmac_tbl`, `rtw89_fw_h2c_role_maintain`, `rtw89_fw_h2c_join_info`, and `rtw89_fw_h2c_cam`, which is definitely a good practice. They are returning the error codes instead of blindly ignoring them.

Now, the real question is, how do I actually *get* to this code? I need to think about how this interacts with virtualization and fuzzing. This is a Realtek 802.11ax driver, so reaching it in a virtualized setup isn't always straightforward. Syzkaller is the tool, but I need to figure out how it works. Does Syzkaller have some specific support for emulating Realtek hardware? Typically, we use `mac80211_hwsim` for wifi emulation, but this is a *specific* hardware driver, `rtw89`.

Can I even trigger `rtw89_ops_start_ap` without real hardware? Probably not, unless there's a USB or PCI emulation layer specifically for this Realtek chipset within Syzkaller, which is pretty rare. I'll need to confirm if `rtw89` is a PCI or USB driver. A quick look at the directory structure should tell me the physical connection. Let me check the directory `drivers/net/wireless/realtek/rtw89/`.

no matches

{
  "Expression": "module_init",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 3286
							output: 32
							thoughts: 8
						

Okay, here's the summary, formatted as requested:

**Assessing the Landscape**

Alright, before I dive in, let's just get a lay of the land. I need a clear picture of what I'm working with here. I'll need to check the directory contents. This initial scan will reveal the foundation, the files, the existing structure, and that will give me a better understanding of where to start. It helps me to decide what's pertinent, what's not, and what I need to focus on. Understanding the organizational architecture upfront can save a lot of time later. Okay, time to see what's there.

{
  "Dir": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Files": [
    "acpi.c",
    "acpi.h",
    "cam.c",
    "cam.h",
    "chan.c",
    "chan.h",
    "coex.c",
    "coex.h",
    "core.c",
    "core.h",
    "debug.c",
    "debug.h",
    "efuse.c",
    "efuse.h",
    "efuse_be.c",
    "fw.c",
    "fw.h",
    "mac.c",
    "mac.h",
    "mac80211.c",
    "mac_be.c",
    "pci.c",
    "pci.h",
    "pci_be.c",
    "phy.c",
    "phy.h",
    "phy_be.c",
    "ps.c",
    "ps.h",
    "reg.h",
    "regd.c",
    "rtw8851b.c",
    "rtw8851b.h",
    "rtw8851b_rfk.c",
    "rtw8851b_rfk.h",
    "rtw8851b_rfk_table.c",
    "rtw8851b_rfk_table.h",
    "rtw8851b_table.c",
    "rtw8851b_table.h",
    "rtw8851be.c",
    "rtw8851bu.c",
    "rtw8852a.c",
    "rtw8852a.h",
    "rtw8852a_rfk.c",
    "rtw8852a_rfk.h",
    "rtw8852a_rfk_table.c",
    "rtw8852a_rfk_table.h",
    "rtw8852a_table.c",
    "rtw8852a_table.h",
    "rtw8852ae.c",
    "rtw8852au.c",
    "rtw8852b.c",
    "rtw8852b.h",
    "rtw8852b_common.c",
    "rtw8852b_common.h",
    "rtw8852b_rfk.c",
    "rtw8852b_rfk.h",
    "rtw8852b_rfk_table.c",
    "rtw8852b_rfk_table.h",
    "rtw8852b_table.c",
    "rtw8852b_table.h",
    "rtw8852be.c",
    "rtw8852bt.c",
    "rtw8852bt.h",
    "rtw8852bt_rfk.c",
    "rtw8852bt_rfk.h",
    "rtw8852bt_rfk_table.c",
    "rtw8852bt_rfk_table.h",
    "rtw8852bte.c",
    "rtw8852bu.c",
    "rtw8852c.c",
    "rtw8852c.h",
    "rtw8852c_rfk.c",
    "rtw8852c_rfk.h",
    "rtw8852c_rfk_table.c",
    "rtw8852c_rfk_table.h",
    "rtw8852c_table.c",
    "rtw8852c_table.h",
    "rtw8852ce.c",
    "rtw8852cu.c",
    "rtw8922a.c",
    "rtw8922a.h",
    "rtw8922a_rfk.c",
    "rtw8922a_rfk.h",
    "rtw8922ae.c",
    "rtw8922d.c",
    "rtw8922d.h",
    "rtw8922d_rfk.c",
    "rtw8922d_rfk.h",
    "rtw8922de.c",
    "sar.c",
    "sar.h",
    "ser.c",
    "ser.h",
    "txrx.h",
    "usb.c",
    "usb.h",
    "util.c",
    "util.h",
    "wow.c",
    "wow.h"
  ],
  "Subdirs": null
}

gemini-3.1-pro-preview

null

null

							input: 4254
							output: 39
							thoughts: 481
						

**Analyzing a Realtek Wireless Driver Patch for Fuzzing Potential**

Okay, so I'm looking at a patch that's been applied to `drivers/net/wireless/realtek/rtw89/mac80211.c`. It seems they've added error checking to a handful of functions called within `rtw89_ops_start_ap`: `rtw89_mac_port_update`, `rtw89_chip_h2c_assoc_cmac_tbl`, `rtw89_fw_h2c_role_maintain`, `rtw89_fw_h2c_join_info`, and `rtw89_fw_h2c_cam`. My immediate thought is, "Can I fuzz this?"

Since this is a Realtek wireless driver (rtw89), and those are notoriously hardware-dependent, my first instinct is that it'll need actual hardware. I wonder about virtualization. Can I simulate this in a virtualized environment? Usually, with PCI or USB wireless drivers, emulation is a must. The code I see here is specific to the hardware, so mac80211_hwsim isn't an option.

But wait a minute, given that the driver supports both PCI and USB (`rtw8852ae.c`, `rtw8852au.c`, `pci.c`, `usb.c`), that's potentially very interesting. USB devices can be fuzzed using syzkaller's USB fuzzing capabilities via dummy-hcd. Let's check if `rtw89` actually *does* have USB support. Yep, I see `rtw8852au.c`, `rtw8852bu.c`, `rtw8852cu.c`, and `usb.c`. Good, that's what I needed to see. The driver *can* be reached via USB emulation.

Now, let's circle back to `rtw89_ops_start_ap`. Okay, it's a mac80211 callback for starting an AP. Can I trigger `start_ap` in a USB emulated device? Thinking about it... if the USB device probes successfully, it registers with mac80211, and *then* userspace (likely through nl80211) can issue commands to start an AP. That's a definite possibility.

I should probably confirm the necessary configs for that route, but that looks like a valid attack vector.

{
  "Expression": "config RTW89",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/Kconfig-1-# SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\ndrivers/net/wireless/realtek/rtw89/Kconfig:2:menuconfig RTW89\ndrivers/net/wireless/realtek/rtw89/Kconfig-3-\ttristate \"Realtek 802.11ax wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=11=if RTW89\ndrivers/net/wireless/realtek/rtw89/Kconfig-12-\ndrivers/net/wireless/realtek/rtw89/Kconfig:13:config RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-16-\ndrivers/net/wireless/realtek/rtw89/Kconfig:17:config RTW89_PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig-18-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-19-\ndrivers/net/wireless/realtek/rtw89/Kconfig:20:config RTW89_USB\ndrivers/net/wireless/realtek/rtw89/Kconfig-21-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-22-\ndrivers/net/wireless/realtek/rtw89/Kconfig:23:config RTW89_8851B\ndrivers/net/wireless/realtek/rtw89/Kconfig-24-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-25-\ndrivers/net/wireless/realtek/rtw89/Kconfig:26:config RTW89_8852A\ndrivers/net/wireless/realtek/rtw89/Kconfig-27-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-28-\ndrivers/net/wireless/realtek/rtw89/Kconfig:29:config RTW89_8852B_COMMON\ndrivers/net/wireless/realtek/rtw89/Kconfig-30-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-31-\ndrivers/net/wireless/realtek/rtw89/Kconfig:32:config RTW89_8852B\ndrivers/net/wireless/realtek/rtw89/Kconfig-33-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-34-\ndrivers/net/wireless/realtek/rtw89/Kconfig:35:config RTW89_8852BT\ndrivers/net/wireless/realtek/rtw89/Kconfig-36-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-37-\ndrivers/net/wireless/realtek/rtw89/Kconfig:38:config RTW89_8852C\ndrivers/net/wireless/realtek/rtw89/Kconfig-39-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-40-\ndrivers/net/wireless/realtek/rtw89/Kconfig:41:config RTW89_8922A\ndrivers/net/wireless/realtek/rtw89/Kconfig-42-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-43-\ndrivers/net/wireless/realtek/rtw89/Kconfig:44:config RTW89_8851BE\ndrivers/net/wireless/realtek/rtw89/Kconfig-45-\ttristate \"Realtek 8851BE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-54-\ndrivers/net/wireless/realtek/rtw89/Kconfig:55:config RTW89_8851BU\ndrivers/net/wireless/realtek/rtw89/Kconfig-56-\ttristate \"Realtek 8851BU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-65-\ndrivers/net/wireless/realtek/rtw89/Kconfig:66:config RTW89_8852AE\ndrivers/net/wireless/realtek/rtw89/Kconfig-67-\ttristate \"Realtek 8852AE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-76-\ndrivers/net/wireless/realtek/rtw89/Kconfig:77:config RTW89_8852AU\ndrivers/net/wireless/realtek/rtw89/Kconfig-78-\ttristate \"Realtek 8852AU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-87-\ndrivers/net/wireless/realtek/rtw89/Kconfig:88:config RTW89_8852BE\ndrivers/net/wireless/realtek/rtw89/Kconfig-89-\ttristate \"Realtek 8852BE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-99-\ndrivers/net/wireless/realtek/rtw89/Kconfig:100:config RTW89_8852BU\ndrivers/net/wireless/realtek/rtw89/Kconfig-101-\ttristate \"Realtek 8852BU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-111-\ndrivers/net/wireless/realtek/rtw89/Kconfig:112:config RTW89_8852BTE\ndrivers/net/wireless/realtek/rtw89/Kconfig-113-\ttristate \"Realtek 8852BE-VT PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-123-\ndrivers/net/wireless/realtek/rtw89/Kconfig:124:config RTW89_8852CE\ndrivers/net/wireless/realtek/rtw89/Kconfig-125-\ttristate \"Realtek 8852CE PCI wireless network (Wi-Fi 6E) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-134-\ndrivers/net/wireless/realtek/rtw89/Kconfig:135:config RTW89_8852CU\ndrivers/net/wireless/realtek/rtw89/Kconfig-136-\ttristate \"Realtek 8852CU USB wireless network (Wi-Fi 6E) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-145-\ndrivers/net/wireless/realtek/rtw89/Kconfig:146:config RTW89_8922AE\ndrivers/net/wireless/realtek/rtw89/Kconfig-147-\ttristate \"Realtek 8922AE/8922AE-VS PCI wireless network (Wi-Fi 7) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-159-\ndrivers/net/wireless/realtek/rtw89/Kconfig:160:config RTW89_DEBUG\ndrivers/net/wireless/realtek/rtw89/Kconfig-161-\tbool\ndrivers/net/wireless/realtek/rtw89/Kconfig-162-\ndrivers/net/wireless/realtek/rtw89/Kconfig:163:config RTW89_DEBUGMSG\ndrivers/net/wireless/realtek/rtw89/Kconfig-164-\tbool \"Realtek rtw89 debug message support\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-171-\ndrivers/net/wireless/realtek/rtw89/Kconfig:172:config RTW89_DEBUGFS\ndrivers/net/wireless/realtek/rtw89/Kconfig-173-\tbool \"Realtek rtw89 debugfs support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 7847
							output: 38
							thoughts: 435
						

**My Assessment of the RTW89 Driver Changes**

Okay, so I'm looking at this Realtek wireless driver, `RTW89`. My initial thought is to enable a set of configurations – `RTW89`, `RTW89_CORE`, `RTW89_USB`, and the specific device drivers like `RTW89_8851BU`, `RTW89_8852AU`, `RTW89_8852BU`, and `RTW89_8852CU`. But wait, `RTW89` is just a top-level menuconfig option, and the others are the actual driver options. Specifically, enabling `RTW89_8852AU` takes care of enabling the core and USB components as well as `RTW89_8852A`.

The key function that's been modified seems to be `rtw89_ops_start_ap`. Let me confirm this... Yep, that's the one. The change appears to be adding error checking; functions now return an error if a function fails, causing the execution flow to change. It's a functional change, not a security one, but that change in flow makes it worth considering for fuzzing. Returning early on failure can potentially reveal new code paths, so it's a good target. The `rtw89_ops_start_ap` function is a `mac80211` callback. Good, that's what I want to focus on.

Now, the question is how reachable is `rtw89_ops_start_ap` via USB? If syzkaller can emulate the USB device, it should be able to register the mac80211 device and then trigger `start_ap` through `nl80211`. However, I need to consider whether the driver can actually initialize successfully without real firmware. Modern wireless drivers often need firmware to load before registering with `mac80211`. If the firmware isn't there, or the hardware doesn't respond to the loading, the probe fails, and the mac80211 device never gets registered. I'll need to check if the `rtw89` driver requires firmware and see if there's a way around it. That is going to be the sticking point for USB fuzzing.

{
  "Expression": "request_firmware",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/fw.c=975=rtw89_early_fw_feature_recognize(struct device *device,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-991-\ndrivers/net/wireless/realtek/rtw89/fw.c:992:\t\tret = request_firmware(\u0026firmware, fw_name, device);\ndrivers/net/wireless/realtek/rtw89/fw.c-993-\t\tif (!ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2028=static int rtw89_load_firmware_req(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2043-\telse\ndrivers/net/wireless/realtek/rtw89/fw.c:2044:\t\tret = request_firmware(\u0026req-\u003efirmware, fw_name, rtwdev-\u003edev);\ndrivers/net/wireless/realtek/rtw89/fw.c-2045-\n"
}

gemini-3.1-pro-preview

null

null

							input: 9131
							output: 45
							thoughts: 76
						

Okay, let's break this down.

**Investigating Potential Firmware Loading Issues**

Alright, so the core question here is: what happens if the `request_firmware` call in this driver fails, or, even worse, if the firmware loads *but* the device is acting up and not responding as expected? We need to understand the failure modes. Syzkaller, in many cases, can provide placeholder firmware, right? But the key here is whether this specific driver is expecting, or even *waiting* for, some very specific hardware-level responses after the firmware is loaded. We need to confirm if it has hardware-dependent checks.

My next step is clear. Let's dig into the code. I need to focus on `rtw89_load_firmware_req` and then immediately trace the execution path that happens during the probe to see what kind of checks are performed. That should give me a good picture of how the driver handles firmware loading and if there are any specific timing constraints or hardware signals it relies on.

{
  "Expression": "rtw89_load_firmware_req",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/fw.c=2017=int rtw89_wait_firmware_completion(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2027-\ndrivers/net/wireless/realtek/rtw89/fw.c:2028:static int rtw89_load_firmware_req(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/fw.c-2029-\t\t\t\t   struct rtw89_fw_req_info *req,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2051=void rtw89_load_firmware_work(struct work_struct *work)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2060-\ndrivers/net/wireless/realtek/rtw89/fw.c:2061:\trtw89_load_firmware_req(rtwdev, \u0026rtwdev-\u003efw.req, fw_name, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2062-}\n"
}

gemini-3.1-pro-preview

null

null

							input: 8487
							output: 44
							thoughts: 0
						

{
  "Expression": "rtw89_ops_start_ap",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/mac80211.c=735=static void rtw89_ops_link_info_changed(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-784-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:785:static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-786-\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1990=const struct ieee80211_ops rtw89_ops = {\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2001-\t.link_info_changed\t= rtw89_ops_link_info_changed,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2002:\t.start_ap\t\t= rtw89_ops_start_ap,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2003-\t.stop_ap\t\t= rtw89_ops_stop_ap,\n"
}

gemini-3.1-pro-preview

null

null

							input: 10237
							output: 42
							thoughts: 58
						

Okay, here's my take on those thoughts, framed from my expert perspective:

**Debugging a Potential Firmware Loading Issue**

Alright, so if this firmware update bites the dust, the first question I'm asking myself is, "Does the *driver* at least initialize and register with `mac80211` even without a successful firmware load?". That's the baseline, isn't it? If the driver *doesn't* register, we have a bigger problem, potentially a fundamental PCI or USB probe issue, or maybe some dependency wasn't met.

To figure this out, I'm diving into the code. Specifically, I need to pinpoint the driver's initialization routines, the entry points. My go-to would be either the `rtw89_core_init` function, or, if we're dealing with a PCI or USB device, I’ll be examining the `rtw89_pci_probe` or `rtw89_usb_probe` functions respectively. These are the functions responsible for actually getting the hardware up and running and associating it with the kernel's wireless subsystem. By examining these functions, I can work out whether the driver loaded at all. The next step is knowing the exact status/error code for the failure, and then I will try to replicate.

{
  "Expression": "rtw89_core_init",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=6212=void rtw89_sta_unset_link(struct rtw89_sta *rtwsta, unsigned int link_id)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6226-\ndrivers/net/wireless/realtek/rtw89/core.c:6227:int rtw89_core_init(struct rtw89_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw89/core.c-6228-{\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6313-}\ndrivers/net/wireless/realtek/rtw89/core.c:6314:EXPORT_SYMBOL(rtw89_core_init);\ndrivers/net/wireless/realtek/rtw89/core.c-6315-\n--\ndrivers/net/wireless/realtek/rtw89/core.h=7812=void rtw89_check_quirks(struct rtw89_dev *rtwdev, const struct dmi_system_id *quirks);\ndrivers/net/wireless/realtek/rtw89/core.h:7813:int rtw89_core_init(struct rtw89_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.h-7814-void rtw89_core_deinit(struct rtw89_dev *rtwdev);\n--\ndrivers/net/wireless/realtek/rtw89/pci.c=4741=int rtw89_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/net/wireless/realtek/rtw89/pci.c-4771-\ndrivers/net/wireless/realtek/rtw89/pci.c:4772:\tret = rtw89_core_init(rtwdev);\ndrivers/net/wireless/realtek/rtw89/pci.c-4773-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=1030=int rtw89_usb_probe(struct usb_interface *intf,\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-1076-\ndrivers/net/wireless/realtek/rtw89/usb.c:1077:\tret = rtw89_core_init(rtwdev);\ndrivers/net/wireless/realtek/rtw89/usb.c-1078-\tif (ret) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 9947
							output: 43
							thoughts: 0
						

no matches

{
  "Expression": "mac80211_hwsim",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 11374
							output: 47
							thoughts: 40
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating rtw89 Initialization**

Okay, so I'm trying to trace the initialization sequence for the `rtw89` core, and a question just popped into my head. I need to confirm whether `rtw89_core_init` is responsible for registering the core itself, or if there's a separate call. The likely candidate would be something like `rtw89_core_register`. Time to dive into the code and verify. Let's start by scrutinizing the `rtw89_core_init` function definition. I'm looking for either a direct call to a registration function within its body, or clues pointing towards where that registration might be happening.

{
  "File": "drivers/net/wireless/realtek/rtw89/core.c",
  "FirstLine": 6227,
  "LineCount": 100
}

{
  "Contents": "6227:\tint rtw89_core_init(struct rtw89_dev *rtwdev)\n6228:\t{\n6229:\t\tstruct rtw89_btc *btc = \u0026rtwdev-\u003ebtc;\n6230:\t\tu8 band;\n6231:\t\n6232:\t\tbitmap_or(rtwdev-\u003equirks, rtwdev-\u003equirks, \u0026rtwdev-\u003echip-\u003edefault_quirks,\n6233:\t\t\t  NUM_OF_RTW89_QUIRKS);\n6234:\t\n6235:\t\tINIT_LIST_HEAD(\u0026rtwdev-\u003eba_list);\n6236:\t\tINIT_LIST_HEAD(\u0026rtwdev-\u003eforbid_ba_list);\n6237:\t\tINIT_LIST_HEAD(\u0026rtwdev-\u003ertwvifs_list);\n6238:\t\tINIT_LIST_HEAD(\u0026rtwdev-\u003eearly_h2c_list);\n6239:\t\tfor (band = NL80211_BAND_2GHZ; band \u003c NUM_NL80211_BANDS; band++) {\n6240:\t\t\tif (!(rtwdev-\u003echip-\u003esupport_bands \u0026 BIT(band)))\n6241:\t\t\t\tcontinue;\n6242:\t\t\tINIT_LIST_HEAD(\u0026rtwdev-\u003escan_info.pkt_list[band]);\n6243:\t\t}\n6244:\t\tINIT_LIST_HEAD(\u0026rtwdev-\u003escan_info.chan_list);\n6245:\t\tINIT_LIST_HEAD(\u0026rtwdev-\u003etx_waits);\n6246:\t\tINIT_WORK(\u0026rtwdev-\u003eba_work, rtw89_core_ba_work);\n6247:\t\tINIT_WORK(\u0026rtwdev-\u003etxq_work, rtw89_core_txq_work);\n6248:\t\tINIT_DELAYED_WORK(\u0026rtwdev-\u003etxq_reinvoke_work, rtw89_core_txq_reinvoke_work);\n6249:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003etrack_work, rtw89_track_work);\n6250:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003etrack_ps_work, rtw89_track_ps_work);\n6251:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003echanctx_work, rtw89_chanctx_work);\n6252:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003ecoex_act1_work, rtw89_coex_act1_work);\n6253:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003ecoex_bt_devinfo_work, rtw89_coex_bt_devinfo_work);\n6254:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003ecoex_rfk_chk_work, rtw89_coex_rfk_chk_work);\n6255:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003ecfo_track_work, rtw89_phy_cfo_track_work);\n6256:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003emcc_prepare_done_work, rtw89_mcc_prepare_done_work);\n6257:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003etx_wait_work, rtw89_tx_wait_work);\n6258:\t\tINIT_DELAYED_WORK(\u0026rtwdev-\u003eforbid_ba_work, rtw89_forbid_ba_work);\n6259:\t\twiphy_delayed_work_init(\u0026rtwdev-\u003eantdiv_work, rtw89_phy_antdiv_work);\n6260:\t\trtwdev-\u003etxq_wq = alloc_workqueue(\"rtw89_tx_wq\", WQ_UNBOUND | WQ_HIGHPRI, 0);\n6261:\t\tif (!rtwdev-\u003etxq_wq)\n6262:\t\t\treturn -ENOMEM;\n6263:\t\tspin_lock_init(\u0026rtwdev-\u003eba_lock);\n6264:\t\tspin_lock_init(\u0026rtwdev-\u003erpwm_lock);\n6265:\t\trtwdev-\u003etotal_sta_assoc = 0;\n6266:\t\n6267:\t\trtw89_init_wait(\u0026rtwdev-\u003emcc.wait);\n6268:\t\trtw89_init_wait(\u0026rtwdev-\u003emlo.wait);\n6269:\t\trtw89_init_wait(\u0026rtwdev-\u003emac.fw_ofld_wait);\n6270:\t\trtw89_init_wait(\u0026rtwdev-\u003ewow.wait);\n6271:\t\trtw89_init_wait(\u0026rtwdev-\u003emac.ps_wait);\n6272:\t\n6273:\t\twiphy_work_init(\u0026rtwdev-\u003ec2h_work, rtw89_fw_c2h_work);\n6274:\t\twiphy_work_init(\u0026rtwdev-\u003eips_work, rtw89_ips_work);\n6275:\t\twiphy_work_init(\u0026rtwdev-\u003ecancel_6ghz_probe_work, rtw89_cancel_6ghz_probe_work);\n6276:\t\tINIT_WORK(\u0026rtwdev-\u003eload_firmware_work, rtw89_load_firmware_work);\n6277:\t\n6278:\t\tspin_lock_init(\u0026rtwdev-\u003etx_rpt.skb_lock);\n6279:\t\tskb_queue_head_init(\u0026rtwdev-\u003ec2h_queue);\n6280:\t\trtw89_core_ppdu_sts_init(rtwdev);\n6281:\t\trtw89_traffic_stats_init(rtwdev, \u0026rtwdev-\u003estats);\n6282:\t\n6283:\t\trtwdev-\u003ehal.rx_fltr = DEFAULT_AX_RX_FLTR;\n6284:\t\trtwdev-\u003edbcc_en = false;\n6285:\t\trtwdev-\u003emlo_dbcc_mode = MLO_DBCC_NOT_SUPPORT;\n6286:\t\trtwdev-\u003emac.qta_mode = RTW89_QTA_SCC;\n6287:\t\n6288:\t\tif (rtwdev-\u003echip-\u003echip_gen == RTW89_CHIP_BE) {\n6289:\t\t\trtwdev-\u003edbcc_en = true;\n6290:\t\t\trtwdev-\u003emac.qta_mode = RTW89_QTA_DBCC;\n6291:\t\t\trtwdev-\u003emlo_dbcc_mode = MLO_1_PLUS_1_1RF;\n6292:\t\t}\n6293:\t\n6294:\t\trtwdev-\u003ebbs[RTW89_PHY_0].phy_idx = RTW89_PHY_0;\n6295:\t\trtwdev-\u003ebbs[RTW89_PHY_1].phy_idx = RTW89_PHY_1;\n6296:\t\n6297:\t\twiphy_work_init(\u0026btc-\u003eeapol_notify_work, rtw89_btc_ntfy_eapol_packet_work);\n6298:\t\twiphy_work_init(\u0026btc-\u003earp_notify_work, rtw89_btc_ntfy_arp_packet_work);\n6299:\t\twiphy_work_init(\u0026btc-\u003edhcp_notify_work, rtw89_btc_ntfy_dhcp_packet_work);\n6300:\t\twiphy_work_init(\u0026btc-\u003eicmp_notify_work, rtw89_btc_ntfy_icmp_packet_work);\n6301:\t\n6302:\t\tinit_completion(\u0026rtwdev-\u003efw.req.completion);\n6303:\t\tinit_completion(\u0026rtwdev-\u003erfk_wait.completion);\n6304:\t\n6305:\t\tschedule_work(\u0026rtwdev-\u003eload_firmware_work);\n6306:\t\n6307:\t\trtw89_ser_init(rtwdev);\n6308:\t\trtw89_entity_init(rtwdev);\n6309:\t\trtw89_sar_init(rtwdev);\n6310:\t\trtw89_phy_ant_gain_init(rtwdev);\n6311:\t\n6312:\t\treturn 0;\n6313:\t}\n6314:\tEXPORT_SYMBOL(rtw89_core_init);\n6315:\t\n6316:\tvoid rtw89_core_deinit(struct rtw89_dev *rtwdev)\n6317:\t{\n6318:\t\trtw89_ser_deinit(rtwdev);\n6319:\t\trtw89_unload_firmware(rtwdev);\n6320:\t\t__rtw89_fw_free_all_early_h2c(rtwdev);\n6321:\t\n6322:\t\tdestroy_workqueue(rtwdev-\u003etxq_wq);\n6323:\t}\n6324:\tEXPORT_SYMBOL(rtw89_core_deinit);\n6325:\t\n6326:\tvoid rtw89_core_scan_start(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n"
}

gemini-3.1-pro-preview

null

null

							input: 12614
							output: 44
							thoughts: 0
						

{
  "Expression": "rtw89_ops_start_ap",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/mac80211.c=735=static void rtw89_ops_link_info_changed(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-784-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:785:static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-786-\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1990=const struct ieee80211_ops rtw89_ops = {\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2001-\t.link_info_changed\t= rtw89_ops_link_info_changed,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2002:\t.start_ap\t\t= rtw89_ops_start_ap,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2003-\t.stop_ap\t\t= rtw89_ops_stop_ap,\n"
}

gemini-3.1-pro-preview

null

null

							input: 13052
							output: 40
							thoughts: 0
						

{
  "Expression": "rtw89_ops",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=6883=struct rtw89_dev *rtw89_alloc_ieee80211_hw(struct device *device,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6900-\ndrivers/net/wireless/realtek/rtw89/core.c:6901:\tops = kmemdup(\u0026rtw89_ops, sizeof(rtw89_ops), GFP_KERNEL);\ndrivers/net/wireless/realtek/rtw89/core.c-6902-\tif (!ops)\n--\ndrivers/net/wireless/realtek/rtw89/core.h=29=struct rtw89_wow_cam_info;\ndrivers/net/wireless/realtek/rtw89/core.h-30-\ndrivers/net/wireless/realtek/rtw89/core.h:31:extern const struct ieee80211_ops rtw89_ops;\ndrivers/net/wireless/realtek/rtw89/core.h-32-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-18-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:19:static void rtw89_ops_tx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-20-\t\t\t struct ieee80211_tx_control *control,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-47-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:48:static void rtw89_ops_wake_tx_queue(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-49-\t\t\t\t    struct ieee80211_txq *txq)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-56-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:57:static int rtw89_ops_start(struct ieee80211_hw *hw)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-58-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-65-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:66:static void rtw89_ops_stop(struct ieee80211_hw *hw, bool suspend)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-67-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-74-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:75:static int rtw89_ops_config(struct ieee80211_hw *hw, int radio_idx, u32 changed)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-76-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-103-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:104:static int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-105-\t\t\t\t      struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-146-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:147:static void __rtw89_ops_remove_iface_link(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-148-\t\t\t\t\t  struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-165-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:166:static int rtw89_ops_add_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-167-\t\t\t\t   struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-219-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:220:\tret = __rtw89_ops_add_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-221-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-239-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:240:static void rtw89_ops_remove_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-241-\t\t\t\t       struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-263-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:264:\t__rtw89_ops_remove_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-265-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-278-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:279:static int rtw89_ops_change_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-280-\t\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-290-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:291:\trtw89_ops_remove_interface(hw, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-292-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-295-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:296:\tret = rtw89_ops_add_interface(hw, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-297-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-304-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:305:static void rtw89_ops_configure_filter(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-306-\t\t\t\t       unsigned int changed_flags,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=471=static void rtw89_conf_tx(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-479-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:480:static int __rtw89_ops_sta_add(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-481-\t\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-543-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:544:static int __rtw89_ops_sta_assoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-545-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-573-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:574:static int __rtw89_ops_sta_disassoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-575-\t\t\t\t    struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-600-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:601:static int __rtw89_ops_sta_disconnect(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-602-\t\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-624-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:625:static int __rtw89_ops_sta_remove(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-626-\t\t\t\t  struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=653=static void rtw89_station_mode_sta_assoc(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-666-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:667:\t__rtw89_ops_sta_assoc(rtwdev, vif, sta, true);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-668-}\ndrivers/net/wireless/realtek/rtw89/mac80211.c-669-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:670:static void __rtw89_ops_bss_link_assoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-671-\t\t\t\t       struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-679-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:680:static void __rtw89_ops_bss_assoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-681-\t\t\t\t  struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-687-\trtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:688:\t\t__rtw89_ops_bss_link_assoc(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-689-}\ndrivers/net/wireless/realtek/rtw89/mac80211.c-690-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:691:static void rtw89_ops_vif_cfg_changed(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-692-\t\t\t\t      struct ieee80211_vif *vif, u64 changed)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-703-\t\t\trtw89_station_mode_sta_assoc(rtwdev, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:704:\t\t\t__rtw89_ops_bss_assoc(rtwdev, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-705-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-734-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:735:static void rtw89_ops_link_info_changed(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-736-\t\t\t\t\tstruct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-784-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:785:static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-786-\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=857=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:858:void rtw89_ops_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-859-\t\t       struct ieee80211_bss_conf *link_conf)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-882-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:883:static int rtw89_ops_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-884-\t\t\t     bool set)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-896-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:897:static int rtw89_ops_conf_tx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-898-\t\t\t     struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-923-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:924:static int __rtw89_ops_sta_state(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-925-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-933-\t    new_state == IEEE80211_STA_NONE)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:934:\t\treturn __rtw89_ops_sta_add(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-935-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-939-\t\t\treturn 0; /* defer to bss_info_changed to have vif info */\ndrivers/net/wireless/realtek/rtw89/mac80211.c:940:\t\treturn __rtw89_ops_sta_assoc(rtwdev, vif, sta, false);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-941-\t}\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-944-\t    new_state == IEEE80211_STA_AUTH)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:945:\t\treturn __rtw89_ops_sta_disassoc(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-946-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-948-\t    new_state == IEEE80211_STA_NONE)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:949:\t\treturn __rtw89_ops_sta_disconnect(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-950-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-952-\t    new_state == IEEE80211_STA_NOTEXIST)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:953:\t\treturn __rtw89_ops_sta_remove(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-954-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-957-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:958:static int rtw89_ops_sta_state(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-959-\t\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-968-\trtw89_leave_ps_mode(rtwdev);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:969:\treturn __rtw89_ops_sta_state(hw, vif, sta, old_state, new_state);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-970-}\ndrivers/net/wireless/realtek/rtw89/mac80211.c-971-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:972:static int rtw89_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-973-\t\t\t     struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1009-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1010:static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1011-\t\t\t\t  struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1061-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1062:static int rtw89_ops_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1063-\t\t\t\t       u32 value)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1075-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1076:static void rtw89_ops_sta_statistics(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1077-\t\t\t\t     struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1093=void __rtw89_drop_packets(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1105-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1106:static void rtw89_ops_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1107-\t\t\t    u32 queues, bool drop)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1148=static void rtw89_ra_mask_info_update(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1159-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1160:static int rtw89_ops_set_bitrate_mask(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1161-\t\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1174=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1175:int rtw89_ops_set_antenna(struct ieee80211_hw *hw, int radio_idx, u32 tx_ant, u32 rx_ant)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1176-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1202=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1203:int rtw89_ops_get_antenna(struct ieee80211_hw *hw, int radio_idx, u32 *tx_ant,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1204-\t\t\t  u32 *rx_ant)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1214-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1215:static void rtw89_ops_sw_scan_start(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1216-\t\t\t\t    struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1235-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1236:static void rtw89_ops_sw_scan_complete(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1237-\t\t\t\t       struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1253-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1254:static void rtw89_ops_reconfig_complete(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1255-\t\t\t\t\tenum ieee80211_reconfig_type reconfig_type)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1262-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1263:static int rtw89_ops_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1264-\t\t\t     struct ieee80211_scan_request *req)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1300-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1301:static void rtw89_ops_cancel_hw_scan(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1302-\t\t\t\t     struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1324-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1325:static void rtw89_ops_sta_rc_update(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1326-\t\t\t\t    struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1340-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1341:static int rtw89_ops_add_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1342-\t\t\t\t struct ieee80211_chanctx_conf *ctx)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1350-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1351:static void rtw89_ops_remove_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1352-\t\t\t\t     struct ieee80211_chanctx_conf *ctx)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1360-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1361:static void rtw89_ops_change_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1362-\t\t\t\t     struct ieee80211_chanctx_conf *ctx,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1371-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1372:static int rtw89_ops_assign_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1373-\t\t\t\t\tstruct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1393-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1394:static void rtw89_ops_unassign_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1395-\t\t\t\t\t   struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1416=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1417:int rtw89_ops_switch_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1418-\t\t\t\t struct ieee80211_vif_chanctx_switch *vifs,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1463-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1464:static void rtw89_ops_channel_switch_beacon(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1465-\t\t\t\t\t    struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1482-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1483:static int rtw89_ops_remain_on_channel(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1484-\t\t\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1518-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1519:static int rtw89_ops_cancel_remain_on_channel(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1520-\t\t\t\t\t      struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1537=static void rtw89_set_tid_config_iter(void *data, struct ieee80211_sta *sta)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1545-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1546:static int rtw89_ops_set_tid_config(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1547-\t\t\t\t    struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1565=static bool rtw89_can_work_on_links(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1577-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1578:static bool rtw89_ops_can_activate_links(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1579-\t\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1607-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1608:static void __rtw89_ops_clr_vif_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1609-\t\t\t\t      struct rtw89_vif *rtwvif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1621-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1622:\t\t__rtw89_ops_remove_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1623-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1627-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1628:static int __rtw89_ops_set_vif_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1629-\t\t\t\t     struct rtw89_vif *rtwvif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1640-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1641:\t\tret = __rtw89_ops_add_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1642-\t\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1680=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1681:int rtw89_ops_change_vif_links(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1682-\t\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1723-\tif (!old_links)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1724:\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1725-\t\t\t\t\t  BIT(RTW89_VIF_IDLE_LINK_ID));\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1726-\telse if (clr_links)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1727:\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif, clr_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1728-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1742-\tif (set_links) {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1743:\t\tret = __rtw89_ops_set_vif_links(rtwdev, rtwvif, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1744-\t\tif (ret)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1745:\t\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1746-\t} else if (!new_links) {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1747:\t\tret = __rtw89_ops_set_vif_links(rtwdev, rtwvif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1748-\t\t\t\t\t\tBIT(RTW89_VIF_IDLE_LINK_ID));\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1749-\t\tif (ret)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1750:\t\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1751-\t\t\t\t\t\t  BIT(RTW89_VIF_IDLE_LINK_ID));\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1760-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1761:static void __rtw89_ops_clr_sta_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1762-\t\t\t\t      struct rtw89_sta *rtwsta,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1783-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1784:static int __rtw89_ops_set_sta_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1785-\t\t\t\t     struct rtw89_sta *rtwsta,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1816-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1817:\t\t__rtw89_ops_bss_link_assoc(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1818-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1837=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1838:int rtw89_ops_change_sta_links(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1839-\t\t\t       struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1860-\tif (clr_links)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1861:\t\t__rtw89_ops_clr_sta_links(rtwdev, rtwsta, clr_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1862-\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1863-\tif (set_links) {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1864:\t\tret = __rtw89_ops_set_sta_links(rtwdev, rtwsta, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1865-\t\tif (ret)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1866:\t\t\t__rtw89_ops_clr_sta_links(rtwdev, rtwsta, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1867-\t}\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1872-#ifdef CONFIG_PM\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1873:static int rtw89_ops_suspend(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1874-\t\t\t     struct cfg80211_wowlan *wowlan)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1894-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1895:static int rtw89_ops_resume(struct ieee80211_hw *hw)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1896-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1914-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1915:static void rtw89_ops_set_wakeup(struct ieee80211_hw *hw, bool enabled)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1916-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1922=static void rtw89_set_rekey_data(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1942-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1943:static int rtw89_ops_get_survey(struct ieee80211_hw *hw, int idx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1944-\t\t\t\tstruct survey_info *survey)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1976-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1977:static void rtw89_ops_rfkill_poll(struct ieee80211_hw *hw)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1978-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1989-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1990:const struct ieee80211_ops rtw89_ops = {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1991:\t.tx\t\t\t= rtw89_ops_tx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1992:\t.wake_tx_queue\t\t= rtw89_ops_wake_tx_queue,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1993:\t.start\t\t\t= rtw89_ops_start,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1994:\t.stop\t\t\t= rtw89_ops_stop,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1995:\t.config\t\t\t= rtw89_ops_config,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1996:\t.add_interface\t\t= rtw89_ops_add_interface,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1997:\t.change_interface       = rtw89_ops_change_interface,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1998:\t.remove_interface\t= rtw89_ops_remove_interface,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1999:\t.configure_filter\t= rtw89_ops_configure_filter,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2000:\t.vif_cfg_changed\t= rtw89_ops_vif_cfg_changed,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2001:\t.link_info_changed\t= rtw89_ops_link_info_changed,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2002:\t.start_ap\t\t= rtw89_ops_start_ap,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2003:\t.stop_ap\t\t= rtw89_ops_stop_ap,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2004:\t.set_tim\t\t= rtw89_ops_set_tim,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2005:\t.conf_tx\t\t= rtw89_ops_conf_tx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2006:\t.sta_state\t\t= rtw89_ops_sta_state,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2007:\t.set_key\t\t= rtw89_ops_set_key,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2008:\t.ampdu_action\t\t= rtw89_ops_ampdu_action,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2009:\t.get_survey\t\t= rtw89_ops_get_survey,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2010:\t.set_rts_threshold\t= rtw89_ops_set_rts_threshold,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2011:\t.sta_statistics\t\t= rtw89_ops_sta_statistics,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2012:\t.flush\t\t\t= rtw89_ops_flush,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2013:\t.set_bitrate_mask\t= rtw89_ops_set_bitrate_mask,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2014:\t.set_antenna\t\t= rtw89_ops_set_antenna,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2015:\t.get_antenna\t\t= rtw89_ops_get_antenna,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2016:\t.sw_scan_start\t\t= rtw89_ops_sw_scan_start,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2017:\t.sw_scan_complete\t= rtw89_ops_sw_scan_complete,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2018:\t.reconfig_complete\t= rtw89_ops_reconfig_complete,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2019:\t.hw_scan\t\t= rtw89_ops_hw_scan,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2020:\t.cancel_hw_scan\t\t= rtw89_ops_cancel_hw_scan,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2021:\t.add_chanctx\t\t= rtw89_ops_add_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2022:\t.remove_chanctx\t\t= rtw89_ops_remove_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2023:\t.change_chanctx\t\t= rtw89_ops_change_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2024:\t.assign_vif_chanctx\t= rtw89_ops_assign_vif_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2025:\t.unassign_vif_chanctx\t= rtw89_ops_unassign_vif_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2026:\t.switch_vif_chanctx\t= rtw89_ops_switch_vif_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2027:\t.channel_switch_beacon\t= rtw89_ops_channel_switch_beacon,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2028:\t.remain_on_channel\t\t= rtw89_ops_remain_on_channel,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2029:\t.cancel_remain_on_channel\t= rtw89_ops_cancel_remain_on_channel,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2030:\t.set_sar_specs\t\t= rtw89_ops_set_sar_specs,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2031:\t.link_sta_rc_update\t= rtw89_ops_sta_rc_update,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2032:\t.set_tid_config\t\t= rtw89_ops_set_tid_config,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2033:\t.can_activate_links\t= rtw89_ops_can_activate_links,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2034:\t.change_vif_links\t= rtw89_ops_change_vif_links,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2035:\t.change_sta_links\t= rtw89_ops_change_sta_links,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2036-#ifdef CONFIG_PM\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2037:\t.suspend\t\t= rtw89_ops_suspend,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2038:\t.resume\t\t\t= rtw89_ops_resume,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2039:\t.set_wakeup\t\t= rtw89_ops_set_wakeup,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2040-\t.set_rekey_data\t\t= rtw89_set_rekey_data,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2041-#endif\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2042:\t.rfkill_poll\t\t= rtw89_ops_rfkill_poll,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2043-};\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2044:EXPORT_SYMBOL(rtw89_ops);\n--\ndrivers/net/wireless/realtek/rtw89/sar.c=412=const struct cfg80211_sar_capa rtw89_sar_capa = {\n--\ndrivers/net/wireless/realtek/rtw89/sar.c-417-\ndrivers/net/wireless/realtek/rtw89/sar.c:418:int rtw89_ops_set_sar_specs(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/sar.c-419-\t\t\t    const struct cfg80211_sar_specs *sar)\n--\ndrivers/net/wireless/realtek/rtw89/sar.h=33=int rtw89_print_tas(struct rtw89_dev *rtwdev, char *buf, size_t bufsz);\ndrivers/net/wireless/realtek/rtw89/sar.h:34:int rtw89_ops_set_sar_specs(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/sar.h-35-\t\t\t    const struct cfg80211_sar_specs *sar);\n"
}

gemini-3.1-pro-preview

null

null

							input: 27885
							output: 45
							thoughts: 523
						

**Analyzing a Realtek Wireless Driver Patch**

Okay, so I'm looking at this patch in `drivers/net/wireless/realtek/rtw89/mac80211.c`. It's pretty straightforward: it's adding error checking to `rtw89_ops_start_ap`, making sure that if any of these functions fail – `rtw89_mac_port_update`, `rtw89_chip_h2c_assoc_cmac_tbl`, `rtw89_fw_h2c_role_maintain`, `rtw89_fw_h2c_join_info`, or `rtw89_fw_h2c_cam` – it logs a warning and propagates the error. Standard defensive programming, good to see.

Now, my mind jumps to fuzzing this code. This is a hardware driver for a Realtek 802.11ax wireless chip, `rtw89`. Typically, these drivers are tricky to reach in a virtualized environment. We'd need emulated hardware or a software emulation like `mac80211_hwsim`, but this is a *specific* hardware driver, not the generic emulation. Hmm, but can Syzkaller get to this? Syzkaller has USB and PCI fuzzing, and the driver *does* support both (`RTW89_PCI`, `RTW89_USB`). If Syzkaller can emulate the device, it could potentially hit the probe function, which means the mac80211 device could be registered.

But here's the kicker: `rtw89_ops_start_ap` is a mac80211 callback. It's triggered when starting an AP, which means that if the device is probed and registered, user-space could reach this code via netlink (nl80211). Okay, so far, so good.

Wait, though… the firmware dependency. This driver *does* need firmware, `rtw89_load_firmware_req` calls `request_firmware`. If the firmware isn't available or fails to load, the driver might not fully initialize or register the mac80211 device. That's a critical point. So, I need to check the initialization flow. Does the mac80211 device get registered before or after the firmware load? Okay, `rtw89_core_init` schedules `load_firmware_work`. Now, let's see what happens in `rtw89_load_firmware_work`.

{
  "Expression": "rtw89_load_firmware_work",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=6227=int rtw89_core_init(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6275-\twiphy_work_init(\u0026rtwdev-\u003ecancel_6ghz_probe_work, rtw89_cancel_6ghz_probe_work);\ndrivers/net/wireless/realtek/rtw89/core.c:6276:\tINIT_WORK(\u0026rtwdev-\u003eload_firmware_work, rtw89_load_firmware_work);\ndrivers/net/wireless/realtek/rtw89/core.c-6277-\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2028=static int rtw89_load_firmware_req(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2050-\ndrivers/net/wireless/realtek/rtw89/fw.c:2051:void rtw89_load_firmware_work(struct work_struct *work)\ndrivers/net/wireless/realtek/rtw89/fw.c-2052-{\n--\ndrivers/net/wireless/realtek/rtw89/fw.h=5199=int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type,\ndrivers/net/wireless/realtek/rtw89/fw.h-5200-\t\t      bool include_bb);\ndrivers/net/wireless/realtek/rtw89/fw.h:5201:void rtw89_load_firmware_work(struct work_struct *work);\ndrivers/net/wireless/realtek/rtw89/fw.h-5202-void rtw89_unload_firmware(struct rtw89_dev *rtwdev);\n"
}

gemini-3.1-pro-preview

null

null

							input: 29017
							output: 44
							thoughts: 0
						

{
  "Expression": "rtw89_mac_port_update",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/mac.c=4942=int rtw89_mac_vif_init(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c-4945-\ndrivers/net/wireless/realtek/rtw89/mac.c:4946:\tret = rtw89_mac_port_update(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac.c-4947-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c=4984=int rtw89_mac_vif_deinit(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c-5000-\ndrivers/net/wireless/realtek/rtw89/mac.c:5001:int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\ndrivers/net/wireless/realtek/rtw89/mac.c-5002-{\n--\ndrivers/net/wireless/realtek/rtw89/mac.h=1302=int rtw89_mac_add_vif(struct rtw89_dev *rtwdev, struct rtw89_vif_link *vif);\ndrivers/net/wireless/realtek/rtw89/mac.h:1303:int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac.h-1304-void rtw89_mac_port_tsf_sync(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=670=static void __rtw89_ops_bss_link_assoc(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-674-\trtw89_chip_cfg_txpwr_ul_tb_offset(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:675:\trtw89_mac_port_update(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-676-\trtw89_mac_set_he_obss_narrow_bw_ru(rtwdev, rtwvif_link);\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=785=static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-813-\trtw89_cam_bssid_changed(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:814:\tret = rtw89_mac_port_update(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-815-\tif (ret) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 30035
							output: 44
							thoughts: 0
						

{
  "Expression": "rtw89_ops_start_ap",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/mac80211.c=735=static void rtw89_ops_link_info_changed(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-784-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:785:static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-786-\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1990=const struct ieee80211_ops rtw89_ops = {\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2001-\t.link_info_changed\t= rtw89_ops_link_info_changed,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2002:\t.start_ap\t\t= rtw89_ops_start_ap,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2003-\t.stop_ap\t\t= rtw89_ops_stop_ap,\n"
}

gemini-3.1-pro-preview

null

null

							input: 32406
							output: 38
							thoughts: 75
						

Okay, let me think this through.

**Analyzing the rtw89 Driver Initialization**

Alright, so I'm trying to figure out how this `rtw89` driver integrates with `mac80211`. My initial thought was that the registration with `mac80211` happened within `rtw89_core_init`, but wait... no, that doesn't seem right. Looking at `rtw89_core_init`, it's actually just allocating and setting up the core `rtw89_dev` structure and initializing some workqueues. That's more like the groundwork, not the registration itself.

So, the real question is: where does the driver actually become known to the wireless stack? I need to track down either `rtw89_core_register` or, more generally, the call to `wiphy_register`. That's where the connection to the larger `mac80211` framework should be happening. That's the key. I need to trace those function calls to find the actual point of integration.

no matches

{
  "Expression": "wiphy_register",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 32768
							output: 45
							thoughts: 0
						

no matches

{
  "Expression": "ieee80211_hw_register",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 30819
							output: 38
							thoughts: 0
						

no matches

{
  "Expression": "wiphy_new",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 30871
							output: 45
							thoughts: 0
						

no matches

{
  "Expression": "ieee80211_hw_alloc",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 30930
							output: 50
							thoughts: 0
						

{
  "Expression": "rtw89_alloc_ieee80211_hw",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=6881=EXPORT_SYMBOL(rtw89_core_unregister);\ndrivers/net/wireless/realtek/rtw89/core.c-6882-\ndrivers/net/wireless/realtek/rtw89/core.c:6883:struct rtw89_dev *rtw89_alloc_ieee80211_hw(struct device *device,\ndrivers/net/wireless/realtek/rtw89/core.c-6884-\t\t\t\t\t   u32 bus_data_size,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6964-}\ndrivers/net/wireless/realtek/rtw89/core.c:6965:EXPORT_SYMBOL(rtw89_alloc_ieee80211_hw);\ndrivers/net/wireless/realtek/rtw89/core.c-6966-\n--\ndrivers/net/wireless/realtek/rtw89/core.h=7816=void rtw89_core_unregister(struct rtw89_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.h:7817:struct rtw89_dev *rtw89_alloc_ieee80211_hw(struct device *device,\ndrivers/net/wireless/realtek/rtw89/core.h-7818-\t\t\t\t\t   u32 bus_data_size,\n--\ndrivers/net/wireless/realtek/rtw89/pci.c=4741=int rtw89_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/net/wireless/realtek/rtw89/pci.c-4749-\ndrivers/net/wireless/realtek/rtw89/pci.c:4750:\trtwdev = rtw89_alloc_ieee80211_hw(\u0026pdev-\u003edev,\ndrivers/net/wireless/realtek/rtw89/pci.c-4751-\t\t\t\t\t  sizeof(struct rtw89_pci),\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=1030=int rtw89_usb_probe(struct usb_interface *intf,\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-1039-\ndrivers/net/wireless/realtek/rtw89/usb.c:1040:\trtwdev = rtw89_alloc_ieee80211_hw(\u0026intf-\u003edev,\ndrivers/net/wireless/realtek/rtw89/usb.c-1041-\t\t\t\t\t  sizeof(struct rtw89_usb),\n"
}

gemini-3.1-pro-preview

null

null

							input: 31706
							output: 42
							thoughts: 0
						

{
  "Expression": "rtw89_core_register",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=6687=void rtw89_chip_cfg_txpwr_ul_tb_offset(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6707-\ndrivers/net/wireless/realtek/rtw89/core.c:6708:static int rtw89_core_register_hw(struct rtw89_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw89/core.c-6709-{\n--\ndrivers/net/wireless/realtek/rtw89/core.c=6850=static void rtw89_core_unregister_hw(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6857-\ndrivers/net/wireless/realtek/rtw89/core.c:6858:int rtw89_core_register(struct rtw89_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw89/core.c-6859-{\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6861-\ndrivers/net/wireless/realtek/rtw89/core.c:6862:\tret = rtw89_core_register_hw(rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.c-6863-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/core.c-6872-}\ndrivers/net/wireless/realtek/rtw89/core.c:6873:EXPORT_SYMBOL(rtw89_core_register);\ndrivers/net/wireless/realtek/rtw89/core.c-6874-\n--\ndrivers/net/wireless/realtek/rtw89/core.h=7814=void rtw89_core_deinit(struct rtw89_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.h:7815:int rtw89_core_register(struct rtw89_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.h-7816-void rtw89_core_unregister(struct rtw89_dev *rtwdev);\n--\ndrivers/net/wireless/realtek/rtw89/pci.c=4741=int rtw89_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/net/wireless/realtek/rtw89/pci.c-4809-\ndrivers/net/wireless/realtek/rtw89/pci.c:4810:\tret = rtw89_core_register(rtwdev);\ndrivers/net/wireless/realtek/rtw89/pci.c-4811-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=1030=int rtw89_usb_probe(struct usb_interface *intf,\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-1088-\ndrivers/net/wireless/realtek/rtw89/usb.c:1089:\tret = rtw89_core_register(rtwdev);\ndrivers/net/wireless/realtek/rtw89/usb.c-1090-\tif (ret) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 32685
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/core.c",
  "FirstLine": 6708,
  "LineCount": 100
}

{
  "Contents": "6708:\tstatic int rtw89_core_register_hw(struct rtw89_dev *rtwdev)\n6709:\t{\n6710:\t\tconst struct rtw89_chip_info *chip = rtwdev-\u003echip;\n6711:\t\tu8 n = rtwdev-\u003esupport_mlo ? chip-\u003esupport_link_num : 1;\n6712:\t\tstruct ieee80211_hw *hw = rtwdev-\u003ehw;\n6713:\t\tstruct rtw89_efuse *efuse = \u0026rtwdev-\u003eefuse;\n6714:\t\tstruct rtw89_hal *hal = \u0026rtwdev-\u003ehal;\n6715:\t\tint ret;\n6716:\t\tint tx_headroom = IEEE80211_HT_CTL_LEN;\n6717:\t\n6718:\t\tif (rtwdev-\u003ehci.type == RTW89_HCI_TYPE_USB)\n6719:\t\t\ttx_headroom += chip-\u003etxwd_body_size + chip-\u003etxwd_info_size;\n6720:\t\n6721:\t\thw-\u003evif_data_size = struct_size_t(struct rtw89_vif, links_inst, n);\n6722:\t\thw-\u003esta_data_size = struct_size_t(struct rtw89_sta, links_inst, n);\n6723:\t\thw-\u003etxq_data_size = sizeof(struct rtw89_txq);\n6724:\t\thw-\u003echanctx_data_size = sizeof(struct rtw89_chanctx_cfg);\n6725:\t\n6726:\t\tSET_IEEE80211_PERM_ADDR(hw, efuse-\u003eaddr);\n6727:\t\n6728:\t\thw-\u003eextra_tx_headroom = tx_headroom;\n6729:\t\thw-\u003equeues = IEEE80211_NUM_ACS;\n6730:\t\thw-\u003emax_rx_aggregation_subframes = chip-\u003emax_rx_agg_num;\n6731:\t\thw-\u003emax_tx_aggregation_subframes = chip-\u003emax_tx_agg_num;\n6732:\t\thw-\u003euapsd_max_sp_len = IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL;\n6733:\t\n6734:\t\thw-\u003eradiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |\n6735:\t\t\t\t\t    IEEE80211_RADIOTAP_MCS_HAVE_STBC;\n6736:\t\thw-\u003eradiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC;\n6737:\t\n6738:\t\tieee80211_hw_set(hw, SIGNAL_DBM);\n6739:\t\tieee80211_hw_set(hw, HAS_RATE_CONTROL);\n6740:\t\tieee80211_hw_set(hw, MFP_CAPABLE);\n6741:\t\tieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);\n6742:\t\tieee80211_hw_set(hw, AMPDU_AGGREGATION);\n6743:\t\tieee80211_hw_set(hw, RX_INCLUDES_FCS);\n6744:\t\tieee80211_hw_set(hw, TX_AMSDU);\n6745:\t\tieee80211_hw_set(hw, SUPPORT_FAST_XMIT);\n6746:\t\tieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);\n6747:\t\tieee80211_hw_set(hw, SUPPORTS_PS);\n6748:\t\tieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);\n6749:\t\tieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);\n6750:\t\tieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);\n6751:\t\tieee80211_hw_set(hw, WANT_MONITOR_VIF);\n6752:\t\tieee80211_hw_set(hw, CHANCTX_STA_CSA);\n6753:\t\n6754:\t\tif (chip-\u003esupport_bandwidths \u0026 BIT(NL80211_CHAN_WIDTH_160))\n6755:\t\t\tieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);\n6756:\t\n6757:\t\tif (RTW89_CHK_FW_FEATURE(BEACON_FILTER, \u0026rtwdev-\u003efw))\n6758:\t\t\tieee80211_hw_set(hw, CONNECTION_MONITOR);\n6759:\t\n6760:\t\tif (RTW89_CHK_FW_FEATURE(NOTIFY_AP_INFO, \u0026rtwdev-\u003efw))\n6761:\t\t\tieee80211_hw_set(hw, AP_LINK_PS);\n6762:\t\n6763:\t\thw-\u003ewiphy-\u003einterface_modes = BIT(NL80211_IFTYPE_STATION) |\n6764:\t\t\t\t\t     BIT(NL80211_IFTYPE_AP) |\n6765:\t\t\t\t\t     BIT(NL80211_IFTYPE_P2P_CLIENT) |\n6766:\t\t\t\t\t     BIT(NL80211_IFTYPE_P2P_GO);\n6767:\t\n6768:\t\tif (hal-\u003eant_diversity) {\n6769:\t\t\thw-\u003ewiphy-\u003eavailable_antennas_tx = 0x3;\n6770:\t\t\thw-\u003ewiphy-\u003eavailable_antennas_rx = 0x3;\n6771:\t\t} else {\n6772:\t\t\thw-\u003ewiphy-\u003eavailable_antennas_tx = BIT(rtwdev-\u003echip-\u003erf_path_num) - 1;\n6773:\t\t\thw-\u003ewiphy-\u003eavailable_antennas_rx = BIT(rtwdev-\u003echip-\u003erf_path_num) - 1;\n6774:\t\t}\n6775:\t\n6776:\t\thw-\u003ewiphy-\u003eflags |= WIPHY_FLAG_SUPPORTS_TDLS |\n6777:\t\t\t\t    WIPHY_FLAG_TDLS_EXTERNAL_SETUP |\n6778:\t\t\t\t    WIPHY_FLAG_AP_UAPSD |\n6779:\t\t\t\t    WIPHY_FLAG_HAS_CHANNEL_SWITCH |\n6780:\t\t\t\t    WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK;\n6781:\t\n6782:\t\tif (!chip-\u003esupport_rnr)\n6783:\t\t\thw-\u003ewiphy-\u003eflags |= WIPHY_FLAG_SPLIT_SCAN_6GHZ;\n6784:\t\n6785:\t\tif (chip-\u003echip_gen == RTW89_CHIP_BE)\n6786:\t\t\thw-\u003ewiphy-\u003eflags |= WIPHY_FLAG_DISABLE_WEXT;\n6787:\t\n6788:\t\tif (rtwdev-\u003esupport_mlo) {\n6789:\t\t\thw-\u003ewiphy-\u003eflags |= WIPHY_FLAG_SUPPORTS_MLO;\n6790:\t\t\thw-\u003ewiphy-\u003eiftype_ext_capab = rtw89_iftypes_ext_capa;\n6791:\t\t\thw-\u003ewiphy-\u003enum_iftype_ext_capab = ARRAY_SIZE(rtw89_iftypes_ext_capa);\n6792:\t\t}\n6793:\t\n6794:\t\thw-\u003ewiphy-\u003efeatures |= NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;\n6795:\t\n6796:\t\thw-\u003ewiphy-\u003emax_scan_ssids = RTW89_SCANOFLD_MAX_SSID;\n6797:\t\thw-\u003ewiphy-\u003emax_scan_ie_len = RTW89_SCANOFLD_MAX_IE_LEN;\n6798:\t\n6799:\t#ifdef CONFIG_PM\n6800:\t\thw-\u003ewiphy-\u003ewowlan = rtwdev-\u003echip-\u003ewowlan_stub;\n6801:\t\thw-\u003ewiphy-\u003emax_sched_scan_ssids = RTW89_SCANOFLD_MAX_SSID;\n6802:\t#endif\n6803:\t\n6804:\t\thw-\u003ewiphy-\u003etid_config_support.vif |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);\n6805:\t\thw-\u003ewiphy-\u003etid_config_support.peer |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);\n6806:\t\thw-\u003ewiphy-\u003etid_config_support.vif |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);\n6807:\t\thw-\u003ewiphy-\u003etid_config_support.peer |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);\n"
}

gemini-3.1-pro-preview

null

null

							input: 35101
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/core.c",
  "FirstLine": 6808,
  "LineCount": 100
}

{
  "Contents": "6808:\t\thw-\u003ewiphy-\u003emax_remain_on_channel_duration = 1000;\n6809:\t\n6810:\t\twiphy_ext_feature_set(hw-\u003ewiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);\n6811:\t\twiphy_ext_feature_set(hw-\u003ewiphy, NL80211_EXT_FEATURE_SCAN_RANDOM_SN);\n6812:\t\twiphy_ext_feature_set(hw-\u003ewiphy, NL80211_EXT_FEATURE_SET_SCAN_DWELL);\n6813:\t\n6814:\t\tret = rtw89_core_set_supported_band(rtwdev);\n6815:\t\tif (ret) {\n6816:\t\t\trtw89_err(rtwdev, \"failed to set supported band\\n\");\n6817:\t\t\treturn ret;\n6818:\t\t}\n6819:\t\n6820:\t\tret = rtw89_regd_setup(rtwdev);\n6821:\t\tif (ret) {\n6822:\t\t\trtw89_err(rtwdev, \"failed to set up regd\\n\");\n6823:\t\t\treturn ret;\n6824:\t\t}\n6825:\t\n6826:\t\thw-\u003ewiphy-\u003esar_capa = \u0026rtw89_sar_capa;\n6827:\t\n6828:\t\tret = ieee80211_register_hw(hw);\n6829:\t\tif (ret) {\n6830:\t\t\trtw89_err(rtwdev, \"failed to register hw\\n\");\n6831:\t\t\treturn ret;\n6832:\t\t}\n6833:\t\n6834:\t\tret = rtw89_regd_init_hint(rtwdev);\n6835:\t\tif (ret) {\n6836:\t\t\trtw89_err(rtwdev, \"failed to init regd\\n\");\n6837:\t\t\tgoto err_unregister_hw;\n6838:\t\t}\n6839:\t\n6840:\t\trtw89_rfkill_polling_init(rtwdev);\n6841:\t\n6842:\t\treturn 0;\n6843:\t\n6844:\terr_unregister_hw:\n6845:\t\tieee80211_unregister_hw(hw);\n6846:\t\n6847:\t\treturn ret;\n6848:\t}\n6849:\t\n6850:\tstatic void rtw89_core_unregister_hw(struct rtw89_dev *rtwdev)\n6851:\t{\n6852:\t\tstruct ieee80211_hw *hw = rtwdev-\u003ehw;\n6853:\t\n6854:\t\trtw89_rfkill_polling_deinit(rtwdev);\n6855:\t\tieee80211_unregister_hw(hw);\n6856:\t}\n6857:\t\n6858:\tint rtw89_core_register(struct rtw89_dev *rtwdev)\n6859:\t{\n6860:\t\tint ret;\n6861:\t\n6862:\t\tret = rtw89_core_register_hw(rtwdev);\n6863:\t\tif (ret) {\n6864:\t\t\trtw89_err(rtwdev, \"failed to register core hw\\n\");\n6865:\t\t\treturn ret;\n6866:\t\t}\n6867:\t\n6868:\t\trtw89_phy_dm_init_data(rtwdev);\n6869:\t\trtw89_debugfs_init(rtwdev);\n6870:\t\n6871:\t\treturn 0;\n6872:\t}\n6873:\tEXPORT_SYMBOL(rtw89_core_register);\n6874:\t\n6875:\tvoid rtw89_core_unregister(struct rtw89_dev *rtwdev)\n6876:\t{\n6877:\t\trtw89_core_unregister_hw(rtwdev);\n6878:\t\n6879:\t\trtw89_debugfs_deinit(rtwdev);\n6880:\t}\n6881:\tEXPORT_SYMBOL(rtw89_core_unregister);\n6882:\t\n6883:\tstruct rtw89_dev *rtw89_alloc_ieee80211_hw(struct device *device,\n6884:\t\t\t\t\t\t   u32 bus_data_size,\n6885:\t\t\t\t\t\t   const struct rtw89_chip_info *chip,\n6886:\t\t\t\t\t\t   const struct rtw89_chip_variant *variant)\n6887:\t{\n6888:\t\tstruct rtw89_fw_info early_fw = {};\n6889:\t\tconst struct firmware *firmware;\n6890:\t\tstruct ieee80211_hw *hw;\n6891:\t\tstruct rtw89_dev *rtwdev;\n6892:\t\tstruct ieee80211_ops *ops;\n6893:\t\tu32 driver_data_size;\n6894:\t\tint fw_format = -1;\n6895:\t\tbool support_mlo;\n6896:\t\tbool no_chanctx;\n6897:\t\n6898:\t\tfirmware = rtw89_early_fw_feature_recognize(device, chip, variant,\n6899:\t\t\t\t\t\t\t    \u0026early_fw, \u0026fw_format);\n6900:\t\n6901:\t\tops = kmemdup(\u0026rtw89_ops, sizeof(rtw89_ops), GFP_KERNEL);\n6902:\t\tif (!ops)\n6903:\t\t\tgoto err;\n6904:\t\n6905:\t\tno_chanctx = chip-\u003esupport_chanctx_num == 0 ||\n6906:\t\t\t     !RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, \u0026early_fw) ||\n6907:\t\t\t     !RTW89_CHK_FW_FEATURE(BEACON_FILTER, \u0026early_fw);\n"
}

gemini-3.1-pro-preview

null

null

							input: 36787
							output: 40
							thoughts: 0
						

{
  "Expression": "ieee80211_register_hw",
  "PathPrefix": "net/mac80211/"
}

{
  "Output": "net/mac80211/main.c=1121=static void ieee80211_create_default_chandef(struct cfg80211_chan_def *chandef,\n--\nnet/mac80211/main.c-1133-\nnet/mac80211/main.c:1134:int ieee80211_register_hw(struct ieee80211_hw *hw)\nnet/mac80211/main.c-1135-{\n--\nnet/mac80211/main.c-1690-}\nnet/mac80211/main.c:1691:EXPORT_SYMBOL(ieee80211_register_hw);\nnet/mac80211/main.c-1692-\n"
}

gemini-3.1-pro-preview

null

null

							input: 37050
							output: 35
							thoughts: 0
						

{
  "Expression": "mac80211_hwsim",
  "PathPrefix": "drivers/net/wireless/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1224 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/virtual/Kconfig=1=config MAC80211_HWSIM\n--\ndrivers/net/wireless/virtual/Kconfig-7-\t  needed for normal wireless LAN usage and is only for testing. See\ndrivers/net/wireless/virtual/Kconfig:8:\t  Documentation/networking/mac80211_hwsim for more information on how\ndrivers/net/wireless/virtual/Kconfig-9-\t  to use this tool.\n--\ndrivers/net/wireless/virtual/Kconfig-11-\t  To compile this driver as a module, choose M here: the module will be\ndrivers/net/wireless/virtual/Kconfig:12:\t  called mac80211_hwsim.  If unsure, say N.\ndrivers/net/wireless/virtual/Kconfig-13-\n--\ndrivers/net/wireless/virtual/Makefile:1:obj-$(CONFIG_MAC80211_HWSIM)\t+= mac80211_hwsim.o\ndrivers/net/wireless/virtual/Makefile-2-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2-/*\ndrivers/net/wireless/virtual/mac80211_hwsim.c:3: * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211\ndrivers/net/wireless/virtual/mac80211_hwsim.c-4- * Copyright (c) 2008, Jouni Malinen \u003cj@w1.fi\u003e\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-40-#include \u003clinux/string.h\u003e\ndrivers/net/wireless/virtual/mac80211_hwsim.c:41:#include \"mac80211_hwsim.h\"\ndrivers/net/wireless/virtual/mac80211_hwsim.c-42-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=342=static const struct class hwsim_class = {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:343:\t.name\t= \"mac80211_hwsim\"\ndrivers/net/wireless/virtual/mac80211_hwsim.c-344-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=576=hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-579-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:580:static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-581-\t\t\t\t\t  struct wireless_dev *wdev,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-602-\t *\ndrivers/net/wireless/virtual/mac80211_hwsim.c:603:\t * event_idx = 0 (index in mac80211_hwsim_vendor_commands)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-604-\t */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-630-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:631:static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-632-\t{\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-635-\t\t.flags = WIPHY_VENDOR_CMD_NEED_NETDEV,\ndrivers/net/wireless/virtual/mac80211_hwsim.c:636:\t\t.doit = mac80211_hwsim_vendor_cmd_test,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-637-\t\t.policy = hwsim_vendor_test_policy,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-642-/* Advertise support vendor specific events */\ndrivers/net/wireless/virtual/mac80211_hwsim.c:643:static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-644-\t{ .vendor_id = OUI_QCA, .subcmd = 1 },\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=652=static u8 hwsim_nan_cluster_id[ETH_ALEN];\ndrivers/net/wireless/virtual/mac80211_hwsim.c-653-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:654:static struct platform_driver mac80211_hwsim_driver = {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-655-\t.driver = {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:656:\t\t.name = \"mac80211_hwsim\",\ndrivers/net/wireless/virtual/mac80211_hwsim.c-657-\t},\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-659-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:660:struct mac80211_hwsim_link_data {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-661-\tu32 link_id;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-665-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:666:struct mac80211_hwsim_data {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-667-\tstruct list_head list;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-759-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:760:\tstruct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];\ndrivers/net/wireless/virtual/mac80211_hwsim.c-761-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=771=static const struct rhashtable_params hwsim_rht_params = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-774-\t.key_len = ETH_ALEN,\ndrivers/net/wireless/virtual/mac80211_hwsim.c:775:\t.key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),\ndrivers/net/wireless/virtual/mac80211_hwsim.c:776:\t.head_offset = offsetof(struct mac80211_hwsim_data, rht),\ndrivers/net/wireless/virtual/mac80211_hwsim.c-777-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=788=struct hwsim_radiotap_ack_hdr {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-795-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:796:static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-797-{\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=955=static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-956-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:957:static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-958-\t\t\t   struct sk_buff *skb)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-985-/* cause a linker error if this ends up being needed */\ndrivers/net/wireless/virtual/mac80211_hwsim.c:986:extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-987-\t\t\t   struct sk_buff *skb);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=991=static int hwsim_get_chanwidth(enum nl80211_chan_width bw)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1024-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1025:static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1026-\t\t\t\t    struct sk_buff *skb,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1030=static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1031-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1032:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1033-\tstruct hwsim_vif_priv *vp = (void *)vif-\u003edrv_priv;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1055-\trcu_read_lock();\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1056:\tmac80211_hwsim_tx_frame(data-\u003ehw, skb,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1057-\t\t\t\trcu_dereference(vif-\u003ebss_conf.chanctx_conf)-\u003edef.chan);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1060-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1061:static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1062-\t\t\t\tstruct ieee80211_vif *vif, int ps)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1093-\trcu_read_lock();\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1094:\tmac80211_hwsim_tx_frame(data-\u003ehw, skb,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1095-\t\t\t\trcu_dereference(vif-\u003ebss_conf.chanctx_conf)-\u003edef.chan);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1100=static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1102-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1103:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1104-\thwsim_send_nullfunc(data, mac, vif, 1);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1107=static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1109-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1110:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1111-\thwsim_send_nullfunc(data, mac, vif, 0);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1114=static int hwsim_fops_ps_read(void *dat, u64 *val)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1115-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1116:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1117-\t*val = data-\u003eps;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1121=static int hwsim_fops_ps_write(void *dat, u64 val)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1122-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1123:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1124-\tenum ps_mode old_ps;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1161=static int hwsim_write_simulate_radar(void *dat, u64 val)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1162-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1163:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1164-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1173=static ssize_t hwsim_background_cac_write(struct file *file,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1176-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1177:\tstruct mac80211_hwsim_data *data = file-\u003eprivate_data;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1178-\tchar buf[8] = {};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1225=static ssize_t hwsim_simulate_incumbent_signal_write(struct file *file,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1228-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1229:\tstruct mac80211_hwsim_data *data = file-\u003eprivate_data;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1230-\tstruct hwsim_chanctx_iter_arg arg = {};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1267=static int hwsim_fops_group_read(void *dat, u64 *val)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1268-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1269:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1270-\t*val = data-\u003egroup;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1274=static int hwsim_fops_group_write(void *dat, u64 val)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1275-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1276:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1277-\tdata-\u003egroup = val;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1285=static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1286-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1287:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1288-\t*val = data-\u003erx_rssi;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1292=static int hwsim_fops_rx_rssi_write(void *dat, u64 val)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1293-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1294:\tstruct mac80211_hwsim_data *data = dat;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1295-\tint rssi = (int)val;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1308=static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1315-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1316:static inline u64 mac80211_hwsim_get_tsf_raw(void)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1317-{\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1320-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1321:static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1322-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1323:\tu64 now = mac80211_hwsim_get_tsf_raw();\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1324-\treturn cpu_to_le64(now + data-\u003etsf_offset);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1326-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1327:static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1328-\t\t\t\t  struct ieee80211_vif *vif)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1329-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1330:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1331:\treturn le64_to_cpu(__mac80211_hwsim_get_tsf(data));\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1332-}\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1333-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1334:static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1335-\t\tstruct ieee80211_vif *vif, u64 tsf)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1336-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1337:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1338:\tu64 now = mac80211_hwsim_get_tsf(hw, vif);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1339-\t/* MLD not supported here */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1357-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1358:static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1359-\t\t\t\t      struct sk_buff *tx_skb,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1361-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1362:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1363-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1388-\t\t\t\t\t  (1 \u003c\u003c IEEE80211_RADIOTAP_CHANNEL));\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1389:\thdr-\u003ert_tsft = __mac80211_hwsim_get_tsf(data);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1390-\thdr-\u003ert_flags = 0;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1409-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1410:static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1411-\t\t\t\t       const u8 *addr)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1451-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1452:struct mac80211_hwsim_addr_match_data {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1453-\tu8 addr[ETH_ALEN];\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1456-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1457:static void mac80211_hwsim_addr_iter(void *data, u8 *mac,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1458-\t\t\t\t     struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1460-\tint i;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1461:\tstruct mac80211_hwsim_addr_match_data *md = data;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1462-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1482-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1483:static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1484-\t\t\t\t      const u8 *addr)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1485-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1486:\tstruct mac80211_hwsim_addr_match_data md = {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1487-\t\t.ret = false,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1496-\t\t\t\t\t\t   IEEE80211_IFACE_ITER_NORMAL,\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1497:\t\t\t\t\t\t   mac80211_hwsim_addr_iter,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1498-\t\t\t\t\t\t   \u0026md);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1502-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1503:static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1504-\t\t\t   struct sk_buff *skb)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1518-\t\tif (data-\u003eps_poll_pending \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1519:\t\t    mac80211_hwsim_addr_match(data, skb-\u003edata + 4)) {\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1520-\t\t\tdata-\u003eps_poll_pending = false;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1528-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1529:static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1530-\t\t\t\t  struct sk_buff *skb, int portid)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1551-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1552:static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1553-\t\t\t\t\t const u8 *addr, bool add)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1554-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1555:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1556-\tu32 _portid = READ_ONCE(data-\u003ewmediumd);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1572-\tif (!msg_head) {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1573:\t\tpr_debug(\"mac80211_hwsim: problem with msg_head\\n\");\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1574-\t\tgoto nla_put_failure;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1595=static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1624-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1625:static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1626-\t\t\t\t       struct sk_buff *my_skb,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1630-\tstruct sk_buff *skb;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1631:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1632-\tstruct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb-\u003edata;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1658-\tif (msg_head == NULL) {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1659:\t\tpr_debug(\"mac80211_hwsim: problem with msg_head\\n\");\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1660-\t\tgoto nla_put_failure;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1731-err_free_txskb:\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1732:\tpr_debug(\"mac80211_hwsim: error occurred in %s\\n\", __func__);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1733-\tieee80211_free_txskb(hw, my_skb);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=1746=struct tx_iter_data {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1750-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1751:static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1752-\t\t\t\t   struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1786-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1787:static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1788-{\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1834-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1835:static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1836-\t\t\t      struct ieee80211_rx_status *rx_status,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1866-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1867:\tmac80211_hwsim_add_vendor_rtap(skb);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1868-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1873-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1874:static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1875-\t\t\t\t\t  struct sk_buff *skb,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1877-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1878:\tstruct mac80211_hwsim_data *data = hw-\u003epriv, *data2;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1879-\tbool ack = false;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1937-\t} else {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1938:\t\tnow = mac80211_hwsim_get_tsf_raw();\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1939-\t}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1966-\t\t\t\tdata2-\u003ehw, IEEE80211_IFACE_ITER_NORMAL,\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1967:\t\t\t\tmac80211_hwsim_tx_iter, \u0026tx_iter_data);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1968-\t\t\tif (!tx_iter_data.receive)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1995-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:1996:\t\tif (mac80211_hwsim_addr_match(data2, hdr-\u003eaddr1))\ndrivers/net/wireless/virtual/mac80211_hwsim.c-1997-\t\t\tack = true;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2000-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2001:\t\tmac80211_hwsim_rx(data2, \u0026rx_status, nskb);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2002-\t}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=2008=static struct ieee80211_bss_conf *\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2009:mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2010-\t\t\t      struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2057-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2058:static int mac80211_hwsim_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2059-\t\t\t\t  struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2076-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2077:static void mac80211_hwsim_tx(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2078-\t\t\t      struct ieee80211_tx_control *control,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2080-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2081:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2082-\tstruct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2145-\t\t} else {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2146:\t\t\tbss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2147-\t\t\t\t\t\t\t\t hdr, \u0026link_sta);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2251-\t\t\tbitrate = txrate-\u003ebitrate;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2252:\t\tts = mac80211_hwsim_get_tsf_raw();\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2253-\t\tmgmt-\u003eu.probe_resp.timestamp =\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2257-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2258:\tmac80211_hwsim_monitor_rx(hw, skb, channel);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2259-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2263-\tif (_portid || hwsim_virtio_enabled)\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2264:\t\treturn mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2265-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2268-\tdata-\u003etx_bytes += skb-\u003elen;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2269:\tack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2270-\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2271-\tif (ack \u0026\u0026 skb-\u003elen \u003e= 16)\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2272:\t\tmac80211_hwsim_monitor_ack(channel, hdr-\u003eaddr2);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2273-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2285-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2286:static int mac80211_hwsim_start(struct ieee80211_hw *hw)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2287-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2288:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2289-\twiphy_dbg(hw-\u003ewiphy, \"%s\\n\", __func__);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2294-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2295:static void mac80211_hwsim_stop(struct ieee80211_hw *hw, bool suspend)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2296-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2297:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2298-\tint i;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2311-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2312:static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2313-\t\t\t\t\tstruct ieee80211_vif *vif)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2320-\tif (vif-\u003etype != NL80211_IFTYPE_MONITOR)\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2321:\t\tmac80211_hwsim_config_mac_nl(hw, vif-\u003eaddr, true);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2322-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=2333=static void\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2334:mac80211_hwsim_link_add_debugfs(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2335-\t\t\t\tstruct ieee80211_vif *vif,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2345-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2346:static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2347-\t\t\t\t\t   struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2366-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2367:static void mac80211_hwsim_remove_interface(\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2368-\tstruct ieee80211_hw *hw, struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2375-\tif (vif-\u003etype != NL80211_IFTYPE_MONITOR)\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2376:\t\tmac80211_hwsim_config_mac_nl(hw, vif-\u003eaddr, false);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2377-}\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2378-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2379:static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2380-\t\t\t\t    struct sk_buff *skb,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2382-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2383:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2384-\tu32 _portid = READ_ONCE(data-\u003ewmediumd);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2392-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2393:\tmac80211_hwsim_monitor_rx(hw, skb, chan);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2394-\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2395-\tif (_portid || hwsim_virtio_enabled)\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2396:\t\treturn mac80211_hwsim_tx_frame_nl(hw, skb, _portid, chan);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2397-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2399-\tdata-\u003etx_bytes += skb-\u003elen;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2400:\tmac80211_hwsim_tx_frame_no_nl(hw, skb, chan);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2401-\tdev_kfree_skb(skb);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2403-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2404:static void __mac80211_hwsim_beacon_tx(struct ieee80211_bss_conf *link_conf,\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2405:\t\t\t\t       struct mac80211_hwsim_data *data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2406-\t\t\t\t       struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2434-\t/* fake header transmission time */\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2435:\tdata-\u003eabs_bcn_ts = mac80211_hwsim_get_tsf_raw();\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2436-\tif (ieee80211_is_s1g_beacon(mgmt-\u003eframe_control)) {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2449-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2450:\tmac80211_hwsim_tx_frame(hw, skb,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2451-\t\t\trcu_dereference(link_conf-\u003echanctx_conf)-\u003edef.chan);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2453-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2454:static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2455-\t\t\t\t     struct ieee80211_vif *vif)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2456-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2457:\tstruct mac80211_hwsim_link_data *link_data = arg;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2458-\tu32 link_id = link_data-\u003elink_id;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2459-\tstruct ieee80211_bss_conf *link_conf, *tx_bss_conf;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2460:\tstruct mac80211_hwsim_data *data =\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2461:\t\tcontainer_of(link_data, struct mac80211_hwsim_data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2462-\t\t\t     link_data[link_id]);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2490-\t\tfor (i = 0; i \u003c ema-\u003ecnt; i++) {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2491:\t\t\t__mac80211_hwsim_beacon_tx(link_conf, data, hw, vif,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2492-\t\t\t\t\t\t   ema-\u003ebcn[i].skb);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2500-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2501:\t\t__mac80211_hwsim_beacon_tx(link_conf, data, hw, vif, skb);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2502-\t}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2504-\twhile ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2505:\t\tmac80211_hwsim_tx_frame(hw, skb,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2506-\t\t\trcu_dereference(link_conf-\u003echanctx_conf)-\u003edef.chan);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=2517=static enum hrtimer_restart\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2518:mac80211_hwsim_beacon(struct hrtimer *timer)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2519-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2520:\tstruct mac80211_hwsim_link_data *link_data =\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2521:\t\tcontainer_of(timer, struct mac80211_hwsim_link_data, beacon_timer);\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2522:\tstruct mac80211_hwsim_data *data =\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2523:\t\tcontainer_of(link_data, struct mac80211_hwsim_data,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2524-\t\t\t     link_data[link_data-\u003elink_id]);\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2532-\t\thw, IEEE80211_IFACE_ITER_NORMAL,\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2533:\t\tmac80211_hwsim_beacon_tx, link_data);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2534-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c=2545=static const char * const hwsim_chanwidths[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2561-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2562:static int mac80211_hwsim_config(struct ieee80211_hw *hw, int radio_idx,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2563-\t\t\t\t u32 changed)\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2564-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2565:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2566-\tstruct ieee80211_conf *conf = \u0026hw-\u003econf;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2626-\tfor (idx = 0; idx \u003c ARRAY_SIZE(data-\u003elink_data); idx++) {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2627:\t\tstruct mac80211_hwsim_link_data *link_data =\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2628-\t\t\t\u0026data-\u003elink_data[idx];\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2632-\t\t} else if (!hrtimer_active(\u0026link_data-\u003ebeacon_timer)) {\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2633:\t\t\tu64 tsf = mac80211_hwsim_get_tsf(hw, NULL);\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2634-\t\t\tu32 bcn_int = link_data-\u003ebeacon_int;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2646-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2647:static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2648-\t\t\t\t\t    unsigned int changed_flags,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2650-{\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2651:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2652-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2663-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2664:static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2665-\t\t\t\t       struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2673-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2674:static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2675-\t\t\t\t\t    struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2700-\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2701:static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2702-\t\t\t\t\t     struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.c-2706-\tstruct hwsim_vif_priv *vp = (void *)vif-\u003edrv_priv;\ndrivers/net/wireless/virtual/mac80211_hwsim.c:2707:\tstruct mac80211_hwsim_data *data = hw-\u003epriv;\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 54462
							output: 47
							thoughts: 295
						

**Analyzing the `rtw89` Driver for Syzkaller Fuzzing**

Okay, so I'm looking at this `mac80211_hwsim` thing - that's a software simulator for mac80211, right? But `rtw89` is a *real* hardware driver. The question is, can Syzkaller fuzz the `rtw89` driver using USB emulation? I remember Syzkaller has this `dummy-hcd`, which can emulate USB devices. If `rtw89` is a USB driver, which it seems to be, then yes, it should be possible to probe it via `dummy-hcd`.

But wait, hold on. Does `rtw89` require firmware to be loaded *before* it can register itself with mac80211? That's the crucial question. Let me dig into the code... I should check `rtw89_core_register_hw` and `rtw89_load_firmware_work` to understand the timing here. Okay, in `rtw89_core_init`, it schedules `rtwdev->load_firmware_work`. That's the firmware loading. Hmm, but `rtw89_core_register` gets called in `rtw89_usb_probe` immediately after `rtw89_core_init`.

Aha! `rtw89_core_register` calls `rtw89_core_register_hw`, and *that* calls `ieee80211_register_hw`. So it registers with mac80211 *before* the firmware is fully loaded? That's interesting. I need to make sure I understand the complete initialization process to see if I can get Syzkaller to trigger interesting bugs. Let me double-check how all that gets called in `rtw89_usb_probe`.

{
  "File": "drivers/net/wireless/realtek/rtw89/usb.c",
  "FirstLine": 1030,
  "LineCount": 100
}

{
  "Contents": "1030:\tint rtw89_usb_probe(struct usb_interface *intf,\n1031:\t\t\t    const struct usb_device_id *id)\n1032:\t{\n1033:\t\tconst struct rtw89_driver_info *info;\n1034:\t\tstruct rtw89_dev *rtwdev;\n1035:\t\tstruct rtw89_usb *rtwusb;\n1036:\t\tint ret;\n1037:\t\n1038:\t\tinfo = (const struct rtw89_driver_info *)id-\u003edriver_info;\n1039:\t\n1040:\t\trtwdev = rtw89_alloc_ieee80211_hw(\u0026intf-\u003edev,\n1041:\t\t\t\t\t\t  sizeof(struct rtw89_usb),\n1042:\t\t\t\t\t\t  info-\u003echip, info-\u003evariant);\n1043:\t\tif (!rtwdev) {\n1044:\t\t\tdev_err(\u0026intf-\u003edev, \"failed to allocate hw\\n\");\n1045:\t\t\treturn -ENOMEM;\n1046:\t\t}\n1047:\t\n1048:\t\trtwusb = rtw89_usb_priv(rtwdev);\n1049:\t\trtwusb-\u003ertwdev = rtwdev;\n1050:\t\trtwusb-\u003einfo = info-\u003ebus.usb;\n1051:\t\n1052:\t\trtwdev-\u003ehci.ops = \u0026rtw89_usb_ops;\n1053:\t\trtwdev-\u003ehci.type = RTW89_HCI_TYPE_USB;\n1054:\t\trtwdev-\u003ehci.tx_rpt_enabled = true;\n1055:\t\n1056:\t\tret = rtw89_usb_intf_init(rtwdev, intf);\n1057:\t\tif (ret) {\n1058:\t\t\trtw89_err(rtwdev, \"failed to initialise intf: %d\\n\", ret);\n1059:\t\t\tgoto err_free_hw;\n1060:\t\t}\n1061:\t\n1062:\t\tif (rtwusb-\u003eudev-\u003espeed == USB_SPEED_SUPER)\n1063:\t\t\trtwdev-\u003ehci.dle_type = RTW89_HCI_DLE_TYPE_USB3;\n1064:\t\telse\n1065:\t\t\trtwdev-\u003ehci.dle_type = RTW89_HCI_DLE_TYPE_USB2;\n1066:\t\n1067:\t\trtw89_usb_init_tx(rtwdev);\n1068:\t\n1069:\t\tret = rtw89_usb_alloc_rx_bufs(rtwusb);\n1070:\t\tif (ret)\n1071:\t\t\tgoto err_intf_deinit;\n1072:\t\n1073:\t\tret = rtw89_usb_init_rx(rtwdev);\n1074:\t\tif (ret)\n1075:\t\t\tgoto err_free_rx_bufs;\n1076:\t\n1077:\t\tret = rtw89_core_init(rtwdev);\n1078:\t\tif (ret) {\n1079:\t\t\trtw89_err(rtwdev, \"failed to initialise core: %d\\n\", ret);\n1080:\t\t\tgoto err_deinit_rx;\n1081:\t\t}\n1082:\t\n1083:\t\tret = rtw89_chip_info_setup(rtwdev);\n1084:\t\tif (ret) {\n1085:\t\t\trtw89_err(rtwdev, \"failed to setup chip information\\n\");\n1086:\t\t\tgoto err_core_deinit;\n1087:\t\t}\n1088:\t\n1089:\t\tret = rtw89_core_register(rtwdev);\n1090:\t\tif (ret) {\n1091:\t\t\trtw89_err(rtwdev, \"failed to register core\\n\");\n1092:\t\t\tgoto err_core_deinit;\n1093:\t\t}\n1094:\t\n1095:\t\trtw89_usb_start_rx(rtwdev);\n1096:\t\n1097:\t\tset_bit(RTW89_FLAG_PROBE_DONE, rtwdev-\u003eflags);\n1098:\t\n1099:\t\treturn 0;\n1100:\t\n1101:\terr_core_deinit:\n1102:\t\trtw89_core_deinit(rtwdev);\n1103:\terr_deinit_rx:\n1104:\t\trtw89_usb_deinit_rx(rtwdev);\n1105:\terr_free_rx_bufs:\n1106:\t\trtw89_usb_free_rx_bufs(rtwusb);\n1107:\terr_intf_deinit:\n1108:\t\trtw89_usb_intf_deinit(rtwdev, intf);\n1109:\terr_free_hw:\n1110:\t\trtw89_free_ieee80211_hw(rtwdev);\n1111:\t\n1112:\t\treturn ret;\n1113:\t}\n1114:\tEXPORT_SYMBOL(rtw89_usb_probe);\n1115:\t\n1116:\tvoid rtw89_usb_disconnect(struct usb_interface *intf)\n1117:\t{\n1118:\t\tstruct ieee80211_hw *hw = usb_get_intfdata(intf);\n1119:\t\tstruct rtw89_dev *rtwdev;\n1120:\t\tstruct rtw89_usb *rtwusb;\n1121:\t\n1122:\t\tif (!hw)\n1123:\t\t\treturn;\n1124:\t\n1125:\t\trtwdev = hw-\u003epriv;\n1126:\t\trtwusb = rtw89_usb_priv(rtwdev);\n1127:\t\n1128:\t\trtw89_usb_cancel_rx_bufs(rtwusb);\n1129:\t\trtw89_usb_cancel_tx_bufs(rtwusb);\n"
}

gemini-3.1-pro-preview

null

null

							input: 56863
							output: 50
							thoughts: 154
						

**My Line of Reasoning**

Okay, so I'm tracing the registration and initialization of this `rtw89` driver, specifically for USB. Right, `rtw89_core_register` is definitely called inside `rtw89_usb_probe`, which is the correct entry point. And that function, in turn, calls `ieee80211_register_hw`. That means the mac80211 device gets registered right away during the USB probe sequence. Hmm, even before the firmware is actually loaded, since firmware loading is deferred to a workqueue, as I remember.

Now, let's consider the AP use case. If a userspace application sends a command to start an Access Point, `rtw89_ops_start_ap` will get invoked, that's the natural choice. *But* wait a second… I think that function is only triggered if the network interface is already "up," or enabled. That raises a key question. Does bringing the interface up require the firmware to be loaded? I need to check. To confirm my suspicions, I'll need to scrutinize `rtw89_ops_start` to understand the setup flow.

{
  "File": "drivers/net/wireless/realtek/rtw89/mac80211.c",
  "FirstLine": 57,
  "LineCount": 100
}

{
  "Contents": "  57:\tstatic int rtw89_ops_start(struct ieee80211_hw *hw)\n  58:\t{\n  59:\t\tstruct rtw89_dev *rtwdev = hw-\u003epriv;\n  60:\t\n  61:\t\tlockdep_assert_wiphy(hw-\u003ewiphy);\n  62:\t\n  63:\t\treturn rtw89_core_start(rtwdev);\n  64:\t}\n  65:\t\n  66:\tstatic void rtw89_ops_stop(struct ieee80211_hw *hw, bool suspend)\n  67:\t{\n  68:\t\tstruct rtw89_dev *rtwdev = hw-\u003epriv;\n  69:\t\n  70:\t\tlockdep_assert_wiphy(hw-\u003ewiphy);\n  71:\t\n  72:\t\trtw89_core_stop(rtwdev);\n  73:\t}\n  74:\t\n  75:\tstatic int rtw89_ops_config(struct ieee80211_hw *hw, int radio_idx, u32 changed)\n  76:\t{\n  77:\t\tstruct rtw89_dev *rtwdev = hw-\u003epriv;\n  78:\t\n  79:\t\tlockdep_assert_wiphy(hw-\u003ewiphy);\n  80:\t\n  81:\t\t/* let previous ips work finish to ensure we don't leave ips twice */\n  82:\t\twiphy_work_cancel(hw-\u003ewiphy, \u0026rtwdev-\u003eips_work);\n  83:\t\n  84:\t\trtw89_leave_ps_mode(rtwdev);\n  85:\t\n  86:\t\tif ((changed \u0026 IEEE80211_CONF_CHANGE_IDLE) \u0026\u0026\n  87:\t\t    !(hw-\u003econf.flags \u0026 IEEE80211_CONF_IDLE))\n  88:\t\t\trtw89_leave_ips(rtwdev);\n  89:\t\n  90:\t\tif (changed \u0026 IEEE80211_CONF_CHANGE_CHANNEL) {\n  91:\t\t\trtw89_config_entity_chandef(rtwdev, RTW89_CHANCTX_0,\n  92:\t\t\t\t\t\t    \u0026hw-\u003econf.chandef);\n  93:\t\t\trtw89_set_channel(rtwdev);\n  94:\t\t}\n  95:\t\n  96:\t\tif ((changed \u0026 IEEE80211_CONF_CHANGE_IDLE) \u0026\u0026\n  97:\t\t    (hw-\u003econf.flags \u0026 IEEE80211_CONF_IDLE) \u0026\u0026\n  98:\t\t    !rtwdev-\u003escanning)\n  99:\t\t\trtw89_enter_ips(rtwdev);\n 100:\t\n 101:\t\treturn 0;\n 102:\t}\n 103:\t\n 104:\tstatic int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev,\n 105:\t\t\t\t\t      struct rtw89_vif_link *rtwvif_link)\n 106:\t{\n 107:\t\tstruct ieee80211_bss_conf *bss_conf;\n 108:\t\tint ret;\n 109:\t\n 110:\t\trtw89_leave_ps_mode(rtwdev);\n 111:\t\n 112:\t\trtw89_vif_type_mapping(rtwvif_link, false);\n 113:\t\n 114:\t\twiphy_work_init(\u0026rtwvif_link-\u003eupdate_beacon_work, rtw89_core_update_beacon_work);\n 115:\t\twiphy_delayed_work_init(\u0026rtwvif_link-\u003ecsa_beacon_work, rtw89_core_csa_beacon_work);\n 116:\t\twiphy_delayed_work_init(\u0026rtwvif_link-\u003emcc_gc_detect_beacon_work,\n 117:\t\t\t\t\trtw89_mcc_gc_detect_beacon_work);\n 118:\t\n 119:\t\tINIT_LIST_HEAD(\u0026rtwvif_link-\u003egeneral_pkt_list);\n 120:\t\n 121:\t\trtw89_p2p_noa_once_init(rtwvif_link);\n 122:\t\n 123:\t\trtwvif_link-\u003ehit_rule = 0;\n 124:\t\trtwvif_link-\u003ebcn_hit_cond = 0;\n 125:\t\trtwvif_link-\u003echanctx_assigned = false;\n 126:\t\trtwvif_link-\u003echanctx_idx = RTW89_CHANCTX_0;\n 127:\t\trtwvif_link-\u003ereg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT;\n 128:\t\trtwvif_link-\u003erand_tsf_done = false;\n 129:\t\trtwvif_link-\u003edetect_bcn_count = 0;\n 130:\t\trtwvif_link-\u003elast_sync_bcn_tsf = 0;\n 131:\t\n 132:\t\trcu_read_lock();\n 133:\t\n 134:\t\tbss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);\n 135:\t\tether_addr_copy(rtwvif_link-\u003emac_addr, bss_conf-\u003eaddr);\n 136:\t\n 137:\t\trcu_read_unlock();\n 138:\t\n 139:\t\tret = rtw89_mac_add_vif(rtwdev, rtwvif_link);\n 140:\t\tif (ret)\n 141:\t\t\treturn ret;\n 142:\t\n 143:\t\trtw89_btc_ntfy_role_info(rtwdev, rtwvif_link, NULL, BTC_ROLE_START);\n 144:\t\treturn 0;\n 145:\t}\n 146:\t\n 147:\tstatic void __rtw89_ops_remove_iface_link(struct rtw89_dev *rtwdev,\n 148:\t\t\t\t\t\t  struct rtw89_vif_link *rtwvif_link)\n 149:\t{\n 150:\t\tlockdep_assert_wiphy(rtwdev-\u003ehw-\u003ewiphy);\n 151:\t\n 152:\t\twiphy_work_cancel(rtwdev-\u003ehw-\u003ewiphy, \u0026rtwvif_link-\u003eupdate_beacon_work);\n 153:\t\twiphy_delayed_work_cancel(rtwdev-\u003ehw-\u003ewiphy, \u0026rtwvif_link-\u003ecsa_beacon_work);\n 154:\t\twiphy_delayed_work_cancel(rtwdev-\u003ehw-\u003ewiphy,\n 155:\t\t\t\t\t  \u0026rtwvif_link-\u003emcc_gc_detect_beacon_work);\n 156:\t\n"
}

gemini-3.1-pro-preview

null

null

							input: 59129
							output: 42
							thoughts: 0
						

{
  "Expression": "rtw89_core_start",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=5922=EXPORT_SYMBOL(rtw89_check_quirks);\ndrivers/net/wireless/realtek/rtw89/core.c-5923-\ndrivers/net/wireless/realtek/rtw89/core.c:5924:int rtw89_core_start(struct rtw89_dev *rtwdev)\ndrivers/net/wireless/realtek/rtw89/core.c-5925-{\n--\ndrivers/net/wireless/realtek/rtw89/core.h=7874=void rtw89_complete_cond(struct rtw89_wait_info *wait, unsigned int cond,\ndrivers/net/wireless/realtek/rtw89/core.h-7875-\t\t\t const struct rtw89_completion_data *data);\ndrivers/net/wireless/realtek/rtw89/core.h:7876:int rtw89_core_start(struct rtw89_dev *rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.h-7877-void rtw89_core_stop(struct rtw89_dev *rtwdev);\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=57=static int rtw89_ops_start(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-62-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:63:\treturn rtw89_core_start(rtwdev);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-64-}\n--\ndrivers/net/wireless/realtek/rtw89/ps.c=251=void rtw89_leave_ips(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/ps.c-260-\ndrivers/net/wireless/realtek/rtw89/ps.c:261:\tret = rtw89_core_start(rtwdev);\ndrivers/net/wireless/realtek/rtw89/ps.c-262-\tif (ret)\n"
}

gemini-3.1-pro-preview

null

null

							input: 59787
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/core.c",
  "FirstLine": 5924,
  "LineCount": 100
}

{
  "Contents": "5924:\tint rtw89_core_start(struct rtw89_dev *rtwdev)\n5925:\t{\n5926:\t\tbool no_bbmcu = !rtwdev-\u003echip-\u003ebbmcu_nr;\n5927:\t\tint ret;\n5928:\t\n5929:\t\tret = rtw89_mac_preinit(rtwdev);\n5930:\t\tif (ret) {\n5931:\t\t\trtw89_err(rtwdev, \"mac preinit fail, ret: %d\\n\", ret);\n5932:\t\t\treturn ret;\n5933:\t\t}\n5934:\t\n5935:\t\tif (no_bbmcu)\n5936:\t\t\trtw89_chip_bb_preinit(rtwdev);\n5937:\t\n5938:\t\trtw89_phy_init_bb_afe(rtwdev);\n5939:\t\n5940:\t\t/* above do preinit before downloading firmware */\n5941:\t\n5942:\t\tret = rtw89_mac_init(rtwdev);\n5943:\t\tif (ret) {\n5944:\t\t\trtw89_err(rtwdev, \"mac init fail, ret:%d\\n\", ret);\n5945:\t\t\treturn ret;\n5946:\t\t}\n5947:\t\n5948:\t\trtw89_btc_ntfy_poweron(rtwdev);\n5949:\t\n5950:\t\t/* efuse process */\n5951:\t\n5952:\t\t/* pre-config BB/RF, BB reset/RFC reset */\n5953:\t\tret = rtw89_chip_reset_bb_rf(rtwdev);\n5954:\t\tif (ret)\n5955:\t\t\treturn ret;\n5956:\t\n5957:\t\trtw89_phy_init_bb_reg(rtwdev);\n5958:\t\trtw89_chip_bb_postinit(rtwdev);\n5959:\t\trtw89_phy_init_rf_reg(rtwdev, false);\n5960:\t\n5961:\t\trtw89_btc_ntfy_init(rtwdev, BTC_MODE_NORMAL);\n5962:\t\n5963:\t\trtw89_phy_dm_init(rtwdev);\n5964:\t\n5965:\t\trtw89_mac_set_edcca_mode_bands(rtwdev, true);\n5966:\t\trtw89_mac_cfg_ppdu_status_bands(rtwdev, true);\n5967:\t\trtw89_mac_cfg_phy_rpt_bands(rtwdev, true);\n5968:\t\trtw89_mac_update_rts_threshold(rtwdev);\n5969:\t\n5970:\t\tret = rtw89_hci_start(rtwdev);\n5971:\t\tif (ret) {\n5972:\t\t\trtw89_err(rtwdev, \"failed to start hci\\n\");\n5973:\t\t\treturn ret;\n5974:\t\t}\n5975:\t\n5976:\t\twiphy_delayed_work_queue(rtwdev-\u003ehw-\u003ewiphy, \u0026rtwdev-\u003etrack_work,\n5977:\t\t\t\t\t RTW89_TRACK_WORK_PERIOD);\n5978:\t\twiphy_delayed_work_queue(rtwdev-\u003ehw-\u003ewiphy, \u0026rtwdev-\u003etrack_ps_work,\n5979:\t\t\t\t\t RTW89_TRACK_PS_WORK_PERIOD);\n5980:\t\n5981:\t\tset_bit(RTW89_FLAG_RUNNING, rtwdev-\u003eflags);\n5982:\t\n5983:\t\trtw89_chip_rfk_init_late(rtwdev);\n5984:\t\trtw89_btc_ntfy_radio_state(rtwdev, BTC_RFCTRL_WL_ON);\n5985:\t\trtw89_fw_h2c_fw_log(rtwdev, rtwdev-\u003efw.log.enable);\n5986:\t\trtw89_fw_h2c_init_ba_cam(rtwdev);\n5987:\t\trtw89_tas_fw_timer_enable(rtwdev, true);\n5988:\t\trtwdev-\u003eps_hang_cnt = 0;\n5989:\t\n5990:\t\treturn 0;\n5991:\t}\n5992:\t\n5993:\tvoid rtw89_core_stop(struct rtw89_dev *rtwdev)\n5994:\t{\n5995:\t\tstruct wiphy *wiphy = rtwdev-\u003ehw-\u003ewiphy;\n5996:\t\tstruct rtw89_btc *btc = \u0026rtwdev-\u003ebtc;\n5997:\t\n5998:\t\tlockdep_assert_wiphy(wiphy);\n5999:\t\n6000:\t\t/* Prvent to stop twice; enter_ips and ops_stop */\n6001:\t\tif (!test_bit(RTW89_FLAG_RUNNING, rtwdev-\u003eflags))\n6002:\t\t\treturn;\n6003:\t\n6004:\t\trtw89_tas_fw_timer_enable(rtwdev, false);\n6005:\t\trtw89_btc_ntfy_radio_state(rtwdev, BTC_RFCTRL_WL_OFF);\n6006:\t\n6007:\t\tclear_bit(RTW89_FLAG_RUNNING, rtwdev-\u003eflags);\n6008:\t\n6009:\t\twiphy_work_cancel(wiphy, \u0026rtwdev-\u003ec2h_work);\n6010:\t\twiphy_work_cancel(wiphy, \u0026rtwdev-\u003ecancel_6ghz_probe_work);\n6011:\t\twiphy_work_cancel(wiphy, \u0026btc-\u003eeapol_notify_work);\n6012:\t\twiphy_work_cancel(wiphy, \u0026btc-\u003earp_notify_work);\n6013:\t\twiphy_work_cancel(wiphy, \u0026btc-\u003edhcp_notify_work);\n6014:\t\twiphy_work_cancel(wiphy, \u0026btc-\u003eicmp_notify_work);\n6015:\t\tcancel_delayed_work_sync(\u0026rtwdev-\u003etxq_reinvoke_work);\n6016:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003etx_wait_work);\n6017:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003etrack_work);\n6018:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003etrack_ps_work);\n6019:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003echanctx_work);\n6020:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003ecoex_act1_work);\n6021:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003ecoex_bt_devinfo_work);\n6022:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003ecoex_rfk_chk_work);\n6023:\t\twiphy_delayed_work_cancel(wiphy, \u0026rtwdev-\u003ecfo_track_work);\n"
}

gemini-3.1-pro-preview

null

null

							input: 59302
							output: 44
							thoughts: 0
						

{
  "Expression": "rtw89_mac_port_update",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/mac.c=4942=int rtw89_mac_vif_init(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c-4945-\ndrivers/net/wireless/realtek/rtw89/mac.c:4946:\tret = rtw89_mac_port_update(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac.c-4947-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c=4984=int rtw89_mac_vif_deinit(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c-5000-\ndrivers/net/wireless/realtek/rtw89/mac.c:5001:int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\ndrivers/net/wireless/realtek/rtw89/mac.c-5002-{\n--\ndrivers/net/wireless/realtek/rtw89/mac.h=1302=int rtw89_mac_add_vif(struct rtw89_dev *rtwdev, struct rtw89_vif_link *vif);\ndrivers/net/wireless/realtek/rtw89/mac.h:1303:int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac.h-1304-void rtw89_mac_port_tsf_sync(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=670=static void __rtw89_ops_bss_link_assoc(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-674-\trtw89_chip_cfg_txpwr_ul_tb_offset(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:675:\trtw89_mac_port_update(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-676-\trtw89_mac_set_he_obss_narrow_bw_ru(rtwdev, rtwvif_link);\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=785=static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-813-\trtw89_cam_bssid_changed(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:814:\tret = rtw89_mac_port_update(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-815-\tif (ret) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 60320
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/mac.c",
  "FirstLine": 5001,
  "LineCount": 100
}

{
  "Contents": "5001:\tint rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n5002:\t{\n5003:\t\tu8 port = rtwvif_link-\u003eport;\n5004:\t\n5005:\t\tif (port \u003e= RTW89_PORT_NUM)\n5006:\t\t\treturn -EINVAL;\n5007:\t\n5008:\t\trtw89_mac_port_cfg_func_sw(rtwdev, rtwvif_link);\n5009:\t\trtw89_mac_port_cfg_tx_rpt(rtwdev, rtwvif_link, false);\n5010:\t\trtw89_mac_port_cfg_rx_rpt(rtwdev, rtwvif_link, false);\n5011:\t\trtw89_mac_port_cfg_net_type(rtwdev, rtwvif_link);\n5012:\t\trtw89_mac_port_cfg_bcn_prct(rtwdev, rtwvif_link);\n5013:\t\trtw89_mac_port_cfg_rx_sw(rtwdev, rtwvif_link);\n5014:\t\trtw89_mac_port_cfg_rx_sync_by_nettype(rtwdev, rtwvif_link);\n5015:\t\trtw89_mac_port_cfg_tx_sw_by_nettype(rtwdev, rtwvif_link);\n5016:\t\trtw89_mac_port_cfg_bcn_intv(rtwdev, rtwvif_link);\n5017:\t\trtw89_mac_port_cfg_hiq_win(rtwdev, rtwvif_link);\n5018:\t\trtw89_mac_port_cfg_hiq_dtim(rtwdev, rtwvif_link);\n5019:\t\trtw89_mac_port_cfg_hiq_drop(rtwdev, rtwvif_link);\n5020:\t\trtw89_mac_port_cfg_bcn_setup_time(rtwdev, rtwvif_link);\n5021:\t\trtw89_mac_port_cfg_bcn_hold_time(rtwdev, rtwvif_link);\n5022:\t\trtw89_mac_port_cfg_bcn_mask_area(rtwdev, rtwvif_link);\n5023:\t\trtw89_mac_port_cfg_tbtt_early(rtwdev, rtwvif_link);\n5024:\t\trtw89_mac_port_cfg_tbtt_agg(rtwdev, rtwvif_link);\n5025:\t\trtw89_mac_port_cfg_bss_color(rtwdev, rtwvif_link);\n5026:\t\trtw89_mac_port_cfg_mbssid(rtwdev, rtwvif_link);\n5027:\t\trtw89_mac_port_cfg_func_en(rtwdev, rtwvif_link, true);\n5028:\t\trtw89_mac_port_tsf_resync_all(rtwdev);\n5029:\t\tfsleep(BCN_ERLY_SET_DLY);\n5030:\t\trtw89_mac_port_cfg_bcn_early(rtwdev, rtwvif_link);\n5031:\t\trtw89_mac_port_cfg_bcn_psr_rpt(rtwdev, rtwvif_link);\n5032:\t\n5033:\t\treturn 0;\n5034:\t}\n5035:\t\n5036:\tint rtw89_mac_port_get_tsf(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n5037:\t\t\t\t   u64 *tsf)\n5038:\t{\n5039:\t\tconst struct rtw89_mac_gen_def *mac = rtwdev-\u003echip-\u003emac_def;\n5040:\t\tconst struct rtw89_port_reg *p = mac-\u003eport_base;\n5041:\t\tu32 tsf_low, tsf_high;\n5042:\t\tint ret;\n5043:\t\n5044:\t\tret = rtw89_mac_check_mac_en(rtwdev, rtwvif_link-\u003emac_idx, RTW89_CMAC_SEL);\n5045:\t\tif (ret)\n5046:\t\t\treturn ret;\n5047:\t\n5048:\t\ttsf_low = rtw89_read32_port(rtwdev, rtwvif_link, p-\u003etsftr_l);\n5049:\t\ttsf_high = rtw89_read32_port(rtwdev, rtwvif_link, p-\u003etsftr_h);\n5050:\t\t*tsf = (u64)tsf_high \u003c\u003c 32 | tsf_low;\n5051:\t\n5052:\t\treturn 0;\n5053:\t}\n5054:\t\n5055:\tstatic void rtw89_mac_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,\n5056:\t\t\t\t\t\t\t      struct cfg80211_bss *bss,\n5057:\t\t\t\t\t\t\t      void *data)\n5058:\t{\n5059:\t\tconst struct cfg80211_bss_ies *ies;\n5060:\t\tconst struct element *elem;\n5061:\t\tbool *tolerated = data;\n5062:\t\n5063:\t\trcu_read_lock();\n5064:\t\ties = rcu_dereference(bss-\u003eies);\n5065:\t\telem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies-\u003edata,\n5066:\t\t\t\t\t  ies-\u003elen);\n5067:\t\n5068:\t\tif (!elem || elem-\u003edatalen \u003c 10 ||\n5069:\t\t    !(elem-\u003edata[10] \u0026 WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))\n5070:\t\t\t*tolerated = false;\n5071:\t\trcu_read_unlock();\n5072:\t}\n5073:\t\n5074:\tvoid rtw89_mac_set_he_obss_narrow_bw_ru(struct rtw89_dev *rtwdev,\n5075:\t\t\t\t\t\tstruct rtw89_vif_link *rtwvif_link)\n5076:\t{\n5077:\t\tstruct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);\n5078:\t\tconst struct rtw89_mac_gen_def *mac = rtwdev-\u003echip-\u003emac_def;\n5079:\t\tstruct ieee80211_hw *hw = rtwdev-\u003ehw;\n5080:\t\tstruct ieee80211_bss_conf *bss_conf;\n5081:\t\tstruct cfg80211_chan_def oper;\n5082:\t\tbool tolerated = true;\n5083:\t\tu32 reg;\n5084:\t\n5085:\t\trcu_read_lock();\n5086:\t\n5087:\t\tbss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);\n5088:\t\tif (!bss_conf-\u003ehe_support || vif-\u003etype != NL80211_IFTYPE_STATION) {\n5089:\t\t\trcu_read_unlock();\n5090:\t\t\treturn;\n5091:\t\t}\n5092:\t\n5093:\t\toper = bss_conf-\u003echanreq.oper;\n5094:\t\tif (!(oper.chan-\u003eflags \u0026 IEEE80211_CHAN_RADAR)) {\n5095:\t\t\trcu_read_unlock();\n5096:\t\t\treturn;\n5097:\t\t}\n5098:\t\n5099:\t\trcu_read_unlock();\n5100:\t\n"
}

gemini-3.1-pro-preview

null

null

							input: 62542
							output: 51
							thoughts: 0
						

{
  "Expression": "rtw89_chip_h2c_assoc_cmac_tbl",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=5098=int rtw89_core_sta_link_disconnect(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-5118-\ndrivers/net/wireless/realtek/rtw89/core.c:5119:\tret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);\ndrivers/net/wireless/realtek/rtw89/core.c-5120-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/core.c=5158=int rtw89_core_sta_link_assoc(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-5193-\ndrivers/net/wireless/realtek/rtw89/core.c:5194:\tret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);\ndrivers/net/wireless/realtek/rtw89/core.c-5195-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.h=5526=static inline int rtw89_chip_h2c_update_beacon(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.h-5533-\ndrivers/net/wireless/realtek/rtw89/fw.h:5534:static inline int rtw89_chip_h2c_assoc_cmac_tbl(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/fw.h-5535-\t\t\t\t\t\tstruct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=785=static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-819-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:820:\tret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-821-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=858=void rtw89_ops_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-878-\trtw89_mac_stop_ap(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:879:\trtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, NULL);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-880-\trtw89_fw_h2c_join_info(rtwdev, rtwvif_link, NULL, true);\n--\ndrivers/net/wireless/realtek/rtw89/wow.c=1260=static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)\n--\ndrivers/net/wireless/realtek/rtw89/wow.c-1310-\ndrivers/net/wireless/realtek/rtw89/wow.c:1311:\tret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);\ndrivers/net/wireless/realtek/rtw89/wow.c-1312-\tif (ret) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 63720
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/fw.h",
  "FirstLine": 5534,
  "LineCount": 100
}

{
  "Contents": "5534:\tstatic inline int rtw89_chip_h2c_assoc_cmac_tbl(struct rtw89_dev *rtwdev,\n5535:\t\t\t\t\t\t\tstruct rtw89_vif_link *rtwvif_link,\n5536:\t\t\t\t\t\t\tstruct rtw89_sta_link *rtwsta_link)\n5537:\t{\n5538:\t\tconst struct rtw89_chip_info *chip = rtwdev-\u003echip;\n5539:\t\n5540:\t\treturn chip-\u003eops-\u003eh2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);\n5541:\t}\n5542:\t\n5543:\tstatic inline\n5544:\tint rtw89_chip_h2c_ampdu_link_cmac_tbl(struct rtw89_dev *rtwdev,\n5545:\t\t\t\t\t       struct rtw89_vif_link *rtwvif_link,\n5546:\t\t\t\t\t       struct rtw89_sta_link *rtwsta_link)\n5547:\t{\n5548:\t\tconst struct rtw89_chip_info *chip = rtwdev-\u003echip;\n5549:\t\n5550:\t\tif (chip-\u003eops-\u003eh2c_ampdu_cmac_tbl)\n5551:\t\t\treturn chip-\u003eops-\u003eh2c_ampdu_cmac_tbl(rtwdev, rtwvif_link,\n5552:\t\t\t\t\t\t\t     rtwsta_link);\n5553:\t\n5554:\t\treturn 0;\n5555:\t}\n5556:\t\n5557:\tstatic inline int rtw89_chip_h2c_ampdu_cmac_tbl(struct rtw89_dev *rtwdev,\n5558:\t\t\t\t\t\t\tstruct rtw89_vif *rtwvif,\n5559:\t\t\t\t\t\t\tstruct rtw89_sta *rtwsta)\n5560:\t{\n5561:\t\tstruct rtw89_vif_link *rtwvif_link;\n5562:\t\tstruct rtw89_sta_link *rtwsta_link;\n5563:\t\tunsigned int link_id;\n5564:\t\tint ret;\n5565:\t\n5566:\t\trtw89_sta_for_each_link(rtwsta, rtwsta_link, link_id) {\n5567:\t\t\trtwvif_link = rtwsta_link-\u003ertwvif_link;\n5568:\t\t\tret = rtw89_chip_h2c_ampdu_link_cmac_tbl(rtwdev, rtwvif_link,\n5569:\t\t\t\t\t\t\t\t rtwsta_link);\n5570:\t\t\tif (ret)\n5571:\t\t\t\treturn ret;\n5572:\t\t}\n5573:\t\n5574:\t\treturn 0;\n5575:\t}\n5576:\t\n5577:\tstatic inline\n5578:\tint rtw89_chip_h2c_txtime_cmac_tbl(struct rtw89_dev *rtwdev,\n5579:\t\t\t\t\t   struct rtw89_sta_link *rtwsta_link)\n5580:\t{\n5581:\t\tconst struct rtw89_chip_info *chip = rtwdev-\u003echip;\n5582:\t\n5583:\t\treturn chip-\u003eops-\u003eh2c_txtime_cmac_tbl(rtwdev, rtwsta_link);\n5584:\t}\n5585:\t\n5586:\tstatic inline\n5587:\tint rtw89_chip_h2c_punctured_cmac_tbl(struct rtw89_dev *rtwdev,\n5588:\t\t\t\t\t      struct rtw89_vif_link *rtwvif_link,\n5589:\t\t\t\t\t      u16 punctured)\n5590:\t{\n5591:\t\tconst struct rtw89_chip_info *chip = rtwdev-\u003echip;\n5592:\t\n5593:\t\tif (!chip-\u003eops-\u003eh2c_punctured_cmac_tbl)\n5594:\t\t\treturn 0;\n5595:\t\n5596:\t\treturn chip-\u003eops-\u003eh2c_punctured_cmac_tbl(rtwdev, rtwvif_link, punctured);\n5597:\t}\n5598:\t\n5599:\tstatic inline\n5600:\tint rtw89_chip_h2c_ba_cam(struct rtw89_dev *rtwdev, struct rtw89_sta *rtwsta,\n5601:\t\t\t\t  bool valid, struct ieee80211_ampdu_params *params)\n5602:\t{\n5603:\t\tconst struct rtw89_chip_info *chip = rtwdev-\u003echip;\n5604:\t\tstruct rtw89_vif_link *rtwvif_link;\n5605:\t\tstruct rtw89_sta_link *rtwsta_link;\n5606:\t\tunsigned int link_id;\n5607:\t\tint ret;\n5608:\t\n5609:\t\trtw89_sta_for_each_link(rtwsta, rtwsta_link, link_id) {\n5610:\t\t\trtwvif_link = rtwsta_link-\u003ertwvif_link;\n5611:\t\t\tret = chip-\u003eops-\u003eh2c_ba_cam(rtwdev, rtwvif_link, rtwsta_link,\n5612:\t\t\t\t\t\t    valid, params);\n5613:\t\t\tif (ret)\n5614:\t\t\t\treturn ret;\n5615:\t\t}\n5616:\t\n5617:\t\treturn 0;\n5618:\t}\n5619:\t\n5620:\tstatic inline\n5621:\tint rtw89_chip_h2c_wow_cam_update(struct rtw89_dev *rtwdev,\n5622:\t\t\t\t\t  struct rtw89_wow_cam_info *cam_info)\n5623:\t{\n5624:\t\tconst struct rtw89_chip_info *chip = rtwdev-\u003echip;\n5625:\t\n5626:\t\treturn chip-\u003eops-\u003eh2c_wow_cam_update(rtwdev, cam_info);\n5627:\t}\n5628:\t\n5629:\t/* Must consider compatibility; don't insert new in the mid.\n5630:\t * Fill each field's default value in rtw89_regd_entcpy().\n5631:\t */\n5632:\tstruct rtw89_fw_regd_entry {\n5633:\t\tu8 alpha2_0;\n"
}

gemini-3.1-pro-preview

null

null

							input: 68004
							output: 48
							thoughts: 431
						

**Analyzing the Error Handling Enhancement in `rtw89_ops_start_ap`**

Okay, so this patch introduces error checking within `rtw89_ops_start_ap`. Essentially, if any of the underlying functions fail during the AP startup process, the function now correctly returns an error code, which is a definite functional change. Specifically, I'm noting the changes to `rtw89_mac_port_update` and the call to `rtw89_chip_h2c_assoc_cmac_tbl`. This is significant because it alters the error handling behavior when hardware or firmware setup goes awry. It's now going to be more robust, stopping at the source of the problem.

The question then becomes: is this worthy of focused fuzzing? Considering the functional change, the answer is *yes*. This alteration to the error path is something we can absolutely try and exercise with fuzzing.

Now, some caveats. If the driver's being probed using a USB dummy-hcd, the firmware load is going to fail unless Syzkaller can provide dummy firmware. But, Syzkaller *can* provide that dummy firmware. If it does, `rtw89_load_firmware_req` will succeed. This means the driver will proceed to send H2C commands to the firmware.

Here's the interesting part. Since we're dealing with dummy firmware, and dummy-hcd only emulates generic USB activity, the hardware (also emulated by the dummy-hcd) might not respond correctly to the H2C commands. It's likely going to be a non-specific response or possibly even a replay of previous USB traffic. This is where things get interesting. The crucial point is that `dummy-hcd` doesn't emulate the specific Realtek hardware logic; it's just emulating a generic USB device.

If we leverage `usb-raw-gadget` or `dummy-hcd`, Syzkaller can inject arbitrary USB responses. This gives us control over whether the driver's H2C commands fail or succeed. And, if they do fail, `rtw89_ops_start_ap` will *now* correctly return an error, which is the new error handling path.

This is a good, targeted area for fuzzing. We can focus on the H2C commands and their potential failure points, specifically looking for changes to `rtw89_fw_h2c_role_maintain`, `rtw89_fw_h2c_join_info`, and `rtw89_fw_h2c_cam`. The patch has created a clearer error-handling mechanism that we can leverage and improve through fuzzing.

{
  "Expression": "rtw89_fw_h2c_role_maintain",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=5015=int rtw89_core_sta_link_add(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-5059-\ndrivers/net/wireless/realtek/rtw89/core.c:5060:\t\tret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,\ndrivers/net/wireless/realtek/rtw89/core.c-5061-\t\t\t\t\t\t RTW89_ROLE_CREATE);\n--\ndrivers/net/wireless/realtek/rtw89/core.c=5253=int rtw89_core_sta_link_remove(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-5269-\t} else if (vif-\u003etype == NL80211_IFTYPE_AP || sta-\u003etdls) {\ndrivers/net/wireless/realtek/rtw89/core.c:5270:\t\tret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,\ndrivers/net/wireless/realtek/rtw89/core.c-5271-\t\t\t\t\t\t RTW89_ROLE_REMOVE);\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4836=int rtw89_fw_h2c_pwr_lvl(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4884-\ndrivers/net/wireless/realtek/rtw89/fw.c:4885:int rtw89_fw_h2c_role_maintain(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/fw.c-4886-\t\t\t       struct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.h=5275=void rtw89_fw_c2h_dummy_handler(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len);\ndrivers/net/wireless/realtek/rtw89/fw.h:5276:int rtw89_fw_h2c_role_maintain(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/fw.h-5277-\t\t\t       struct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/mac.c=4942=int rtw89_mac_vif_init(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c-4956-\ndrivers/net/wireless/realtek/rtw89/mac.c:4957:\tret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_CREATE);\ndrivers/net/wireless/realtek/rtw89/mac.c-4958-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c=4984=int rtw89_mac_vif_deinit(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac.c-4987-\ndrivers/net/wireless/realtek/rtw89/mac.c:4988:\tret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_REMOVE);\ndrivers/net/wireless/realtek/rtw89/mac.c-4989-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=785=static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-825-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:826:\tret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, NULL, RTW89_ROLE_TYPE_CHANGE);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-827-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/wow.c=1260=static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)\n--\ndrivers/net/wireless/realtek/rtw89/wow.c-1303-\ndrivers/net/wireless/realtek/rtw89/wow.c:1304:\tret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,\ndrivers/net/wireless/realtek/rtw89/wow.c-1305-\t\t\t\t\t RTW89_ROLE_FW_RESTORE);\n"
}

gemini-3.1-pro-preview

null

null

							input: 67652
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/fw.c",
  "FirstLine": 4885,
  "LineCount": 100
}

{
  "Contents": "4885:\tint rtw89_fw_h2c_role_maintain(struct rtw89_dev *rtwdev,\n4886:\t\t\t\t       struct rtw89_vif_link *rtwvif_link,\n4887:\t\t\t\t       struct rtw89_sta_link *rtwsta_link,\n4888:\t\t\t\t       enum rtw89_upd_mode upd_mode)\n4889:\t{\n4890:\t\tu8 mac_id = rtwsta_link ? rtwsta_link-\u003emac_id : rtwvif_link-\u003emac_id;\n4891:\t\tstruct rtw89_h2c_role_maintain *h2c;\n4892:\t\tu32 len = sizeof(*h2c);\n4893:\t\tstruct sk_buff *skb;\n4894:\t\tu8 self_role;\n4895:\t\tint ret;\n4896:\t\n4897:\t\tif (rtwvif_link-\u003enet_type == RTW89_NET_TYPE_AP_MODE) {\n4898:\t\t\tif (rtwsta_link)\n4899:\t\t\t\tself_role = RTW89_SELF_ROLE_AP_CLIENT;\n4900:\t\t\telse\n4901:\t\t\t\tself_role = rtwvif_link-\u003eself_role;\n4902:\t\t} else {\n4903:\t\t\tself_role = rtwvif_link-\u003eself_role;\n4904:\t\t}\n4905:\t\n4906:\t\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\n4907:\t\tif (!skb) {\n4908:\t\t\trtw89_err(rtwdev, \"failed to alloc skb for h2c join\\n\");\n4909:\t\t\treturn -ENOMEM;\n4910:\t\t}\n4911:\t\tskb_put(skb, len);\n4912:\t\th2c = (struct rtw89_h2c_role_maintain *)skb-\u003edata;\n4913:\t\n4914:\t\th2c-\u003ew0 = le32_encode_bits(mac_id, RTW89_H2C_ROLE_MAINTAIN_W0_MACID) |\n4915:\t\t\t  le32_encode_bits(self_role, RTW89_H2C_ROLE_MAINTAIN_W0_SELF_ROLE) |\n4916:\t\t\t  le32_encode_bits(upd_mode, RTW89_H2C_ROLE_MAINTAIN_W0_UPD_MODE) |\n4917:\t\t\t  le32_encode_bits(rtwvif_link-\u003ewifi_role,\n4918:\t\t\t\t\t   RTW89_H2C_ROLE_MAINTAIN_W0_WIFI_ROLE) |\n4919:\t\t\t  le32_encode_bits(rtwvif_link-\u003emac_idx,\n4920:\t\t\t\t\t   RTW89_H2C_ROLE_MAINTAIN_W0_BAND) |\n4921:\t\t\t  le32_encode_bits(rtwvif_link-\u003eport, RTW89_H2C_ROLE_MAINTAIN_W0_PORT);\n4922:\t\n4923:\t\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\n4924:\t\t\t\t      H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,\n4925:\t\t\t\t      H2C_FUNC_MAC_FWROLE_MAINTAIN, 0, 1,\n4926:\t\t\t\t      len);\n4927:\t\n4928:\t\tret = rtw89_h2c_tx(rtwdev, skb, false);\n4929:\t\tif (ret) {\n4930:\t\t\trtw89_err(rtwdev, \"failed to send h2c\\n\");\n4931:\t\t\tgoto fail;\n4932:\t\t}\n4933:\t\n4934:\t\treturn 0;\n4935:\tfail:\n4936:\t\tdev_kfree_skb_any(skb);\n4937:\t\n4938:\t\treturn ret;\n4939:\t}\n4940:\t\n4941:\tstatic enum rtw89_fw_sta_type\n4942:\trtw89_fw_get_sta_type(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n4943:\t\t\t      struct rtw89_sta_link *rtwsta_link)\n4944:\t{\n4945:\t\tstruct ieee80211_bss_conf *bss_conf;\n4946:\t\tstruct ieee80211_link_sta *link_sta;\n4947:\t\tenum rtw89_fw_sta_type type;\n4948:\t\n4949:\t\trcu_read_lock();\n4950:\t\n4951:\t\tif (!rtwsta_link)\n4952:\t\t\tgoto by_vif;\n4953:\t\n4954:\t\tlink_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, true);\n4955:\t\n4956:\t\tif (link_sta-\u003eeht_cap.has_eht)\n4957:\t\t\ttype = RTW89_FW_BE_STA;\n4958:\t\telse if (link_sta-\u003ehe_cap.has_he)\n4959:\t\t\ttype = RTW89_FW_AX_STA;\n4960:\t\telse\n4961:\t\t\ttype = RTW89_FW_N_AC_STA;\n4962:\t\n4963:\t\tgoto out;\n4964:\t\n4965:\tby_vif:\n4966:\t\tbss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);\n4967:\t\n4968:\t\tif (bss_conf-\u003eeht_support)\n4969:\t\t\ttype = RTW89_FW_BE_STA;\n4970:\t\telse if (bss_conf-\u003ehe_support)\n4971:\t\t\ttype = RTW89_FW_AX_STA;\n4972:\t\telse\n4973:\t\t\ttype = RTW89_FW_N_AC_STA;\n4974:\t\n4975:\tout:\n4976:\t\trcu_read_unlock();\n4977:\t\n4978:\t\treturn type;\n4979:\t}\n4980:\t\n4981:\tint rtw89_fw_h2c_join_info(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n4982:\t\t\t\t   struct rtw89_sta_link *rtwsta_link, bool dis_conn)\n4983:\t{\n4984:\t\tu8 mac_id = rtwsta_link ? rtwsta_link-\u003emac_id : rtwvif_link-\u003emac_id;\n"
}

gemini-3.1-pro-preview

null

null

							input: 72488
							output: 44
							thoughts: 87
						

Here's my analysis of what's happening, keeping in mind my expertise:

**Diving into the Firmware Control Flow**

Okay, so `rtw89_fw_h2c_role_maintain` is calling `rtw89_h2c_tx`. That's standard - we're likely dealing with a mechanism to influence the firmware's role or operational mode. The `h2c` naming is a giveaway; this is almost certainly a Host-to-Controller command path. If `rtw89_h2c_tx` bombs out, it returns an error, which makes sense. We need to know if the command sending failed, so the calling function can handle it gracefully. Now, the key is what happens inside `rtw89_h2c_tx` itself. That's where the actual firmware command gets generated and dispatched. So, let's drill down into `rtw89_h2c_tx` and get to the core of this operation. It's the sending itself I want to inspect closely.

{
  "Expression": "rtw89_h2c_tx",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 742 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/realtek/rtw89/cam.c=52=static int rtw89_cam_send_sec_key_cmd(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/cam.c-69-\t\t\t      H2C_SEC_CAM_LEN);\ndrivers/net/wireless/realtek/rtw89/cam.c:70:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/cam.c-71-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/cam.c-91-\t\t\t      1, 0, H2C_SEC_CAM_LEN);\ndrivers/net/wireless/realtek/rtw89/cam.c:92:\tret = rtw89_h2c_tx(rtwdev, ext_skb, false);\ndrivers/net/wireless/realtek/rtw89/cam.c-93-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1286=int rtw89_core_tx_kick_off_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1312-\ndrivers/net/wireless/realtek/rtw89/core.c:1313:int rtw89_h2c_tx(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-1314-\t\t struct sk_buff *skb, bool fwdl)\n--\ndrivers/net/wireless/realtek/rtw89/core.h=7745=int rtw89_core_tx_write(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw89/core.h-7746-\t\t\tstruct ieee80211_sta *sta, struct sk_buff *skb, int *qsel);\ndrivers/net/wireless/realtek/rtw89/core.h:7747:int rtw89_h2c_tx(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.h-7748-\t\t struct sk_buff *skb, bool fwdl);\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=67=static void rtw89_fw_c2h_cmd_handle(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/fw.c-68-\t\t\t\t    struct sk_buff *skb);\ndrivers/net/wireless/realtek/rtw89/fw.c:69:static int rtw89_h2c_tx_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,\ndrivers/net/wireless/realtek/rtw89/fw.c-70-\t\t\t\t struct rtw89_wait_info *wait, unsigned int cond);\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=1689=static int __rtw89_fw_download_hdr(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-1731-\ndrivers/net/wireless/realtek/rtw89/fw.c:1732:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-1733-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=1770=static int __rtw89_fw_download_main(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-1815-\ndrivers/net/wireless/realtek/rtw89/fw.c:1816:\t\tret = rtw89_h2c_tx(rtwdev, skb, true);\ndrivers/net/wireless/realtek/rtw89/fw.c-1817-\t\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2249=int rtw89_fw_h2c_cam(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2291-\ndrivers/net/wireless/realtek/rtw89/fw.c:2292:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2293-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2305=int rtw89_fw_h2c_dctl_sec_cam_v1(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2329-\ndrivers/net/wireless/realtek/rtw89/fw.c:2330:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2331-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2344=int rtw89_fw_h2c_dctl_sec_cam_v2(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2368-\ndrivers/net/wireless/realtek/rtw89/fw.c:2369:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2370-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2383=int rtw89_fw_h2c_dctl_sec_cam_v3(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2407-\ndrivers/net/wireless/realtek/rtw89/fw.c:2408:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2409-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2422=int rtw89_fw_h2c_default_dmac_tbl_v2(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2462-\ndrivers/net/wireless/realtek/rtw89/fw.c:2463:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2464-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2477=int rtw89_fw_h2c_default_dmac_tbl_v3(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2518-\ndrivers/net/wireless/realtek/rtw89/fw.c:2519:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2520-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2533=int rtw89_fw_h2c_ba_cam(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2598-\ndrivers/net/wireless/realtek/rtw89/fw.c:2599:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2600-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2613=static int rtw89_fw_h2c_init_ba_cam_v0_ext(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2640-\ndrivers/net/wireless/realtek/rtw89/fw.c:2641:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2642-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2668=int rtw89_fw_h2c_ba_cam_v1(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2732-\ndrivers/net/wireless/realtek/rtw89/fw.c:2733:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2734-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2747=int rtw89_fw_h2c_init_ba_cam_users(struct rtw89_dev *rtwdev, u8 users,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2772-\ndrivers/net/wireless/realtek/rtw89/fw.c:2773:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2774-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2787=int rtw89_fw_h2c_fw_log(struct rtw89_dev *rtwdev, bool enable)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2815-\ndrivers/net/wireless/realtek/rtw89/fw.c:2816:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-2817-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3054=int rtw89_fw_h2c_general_pkt(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3088-\ndrivers/net/wireless/realtek/rtw89/fw.c:3089:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3090-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3103=int rtw89_fw_h2c_lps_parm(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3138-\ndrivers/net/wireless/realtek/rtw89/fw.c:3139:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3140-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3152=int rtw89_fw_h2c_lps_ch_info(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3203-\trtw89_phy_write32_mask(rtwdev, R_CHK_LPS_STAT, B_CHK_LPS_STAT, 0);\ndrivers/net/wireless/realtek/rtw89/fw.c:3204:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3205-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3222=int rtw89_fw_h2c_lps_ml_cmn_info(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3300-\trtw89_phy_write32_mask(rtwdev, R_CHK_LPS_STAT, B_CHK_LPS_STAT, 0);\ndrivers/net/wireless/realtek/rtw89/fw.c:3301:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3302-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3390=int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3455-\trtw89_phy_write32_mask(rtwdev, R_CHK_LPS_STAT_BE4, B_CHK_LPS_STAT, 0);\ndrivers/net/wireless/realtek/rtw89/fw.c:3456:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3457-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3475=int rtw89_fw_h2c_p2p_act(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3511-\ndrivers/net/wireless/realtek/rtw89/fw.c:3512:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3513-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3549=int rtw89_fw_h2c_default_cmac_tbl(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3584-\ndrivers/net/wireless/realtek/rtw89/fw.c:3585:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3586-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3599=int rtw89_fw_h2c_default_cmac_tbl_g7(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3669-\ndrivers/net/wireless/realtek/rtw89/fw.c:3670:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3671-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3684=int rtw89_fw_h2c_default_cmac_tbl_be(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3755-\ndrivers/net/wireless/realtek/rtw89/fw.c:3756:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3757-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3825=int rtw89_fw_h2c_assoc_cmac_tbl(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3899-\ndrivers/net/wireless/realtek/rtw89/fw.c:3900:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-3901-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3972=int rtw89_fw_h2c_assoc_cmac_tbl_g7(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4085-\ndrivers/net/wireless/realtek/rtw89/fw.c:4086:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4087-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4100=int rtw89_fw_h2c_assoc_cmac_tbl_be(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4213-\ndrivers/net/wireless/realtek/rtw89/fw.c:4214:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4215-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4228=int rtw89_fw_h2c_ampdu_cmac_tbl_g7(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4279-\ndrivers/net/wireless/realtek/rtw89/fw.c:4280:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4281-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4294=int rtw89_fw_h2c_ampdu_cmac_tbl_be(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4345-\ndrivers/net/wireless/realtek/rtw89/fw.c:4346:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4347-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4360=int rtw89_fw_h2c_txtime_cmac_tbl(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4388-\ndrivers/net/wireless/realtek/rtw89/fw.c:4389:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4390-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4403=int rtw89_fw_h2c_txtime_cmac_tbl_g7(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4442-\ndrivers/net/wireless/realtek/rtw89/fw.c:4443:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4444-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4457=int rtw89_fw_h2c_txtime_cmac_tbl_be(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4496-\ndrivers/net/wireless/realtek/rtw89/fw.c:4497:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4498-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4511=int rtw89_fw_h2c_punctured_cmac_tbl_g7(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4539-\ndrivers/net/wireless/realtek/rtw89/fw.c:4540:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4541-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4554=int rtw89_fw_h2c_punctured_cmac_tbl_be(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4581-\ndrivers/net/wireless/realtek/rtw89/fw.c:4582:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4583-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4596=int rtw89_fw_h2c_txpath_cmac_tbl(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4621-\ndrivers/net/wireless/realtek/rtw89/fw.c:4622:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4623-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4635=int rtw89_fw_h2c_update_beacon(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4703-\ndrivers/net/wireless/realtek/rtw89/fw.c:4704:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4705-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4715=int rtw89_fw_h2c_update_beacon_be(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4782-\ndrivers/net/wireless/realtek/rtw89/fw.c:4783:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4784-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4798=int rtw89_fw_h2c_tbtt_tuning(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4822-\ndrivers/net/wireless/realtek/rtw89/fw.c:4823:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4824-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4836=int rtw89_fw_h2c_pwr_lvl(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4871-\ndrivers/net/wireless/realtek/rtw89/fw.c:4872:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4873-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4885=int rtw89_fw_h2c_role_maintain(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4927-\ndrivers/net/wireless/realtek/rtw89/fw.c:4928:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-4929-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4981=int rtw89_fw_h2c_join_info(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5067-\ndrivers/net/wireless/realtek/rtw89/fw.c:5068:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5069-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5081=int rtw89_fw_h2c_notify_dbcc(struct rtw89_dev *rtwdev, bool en)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5102-\ndrivers/net/wireless/realtek/rtw89/fw.c:5103:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5104-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5116=int rtw89_fw_h2c_macid_pause(struct rtw89_dev *rtwdev, u8 sh, u8 grp,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5163-\ndrivers/net/wireless/realtek/rtw89/fw.c:5164:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5165-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5178=int rtw89_fw_h2c_set_edca(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5200-\ndrivers/net/wireless/realtek/rtw89/fw.c:5201:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5202-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5215=int rtw89_fw_h2c_tsf32_toggle(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5241-\ndrivers/net/wireless/realtek/rtw89/fw.c:5242:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5243-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5256=int rtw89_fw_h2c_set_ofld_cfg(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5273-\ndrivers/net/wireless/realtek/rtw89/fw.c:5274:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5275-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5287=int rtw89_fw_h2c_tx_duty(struct rtw89_dev *rtwdev, u8 lv)\ndrivers/net/wireless/realtek/rtw89/fw.c-5288-{\ndrivers/net/wireless/realtek/rtw89/fw.c:5289:\tstruct rtw89_h2c_tx_duty *h2c;\ndrivers/net/wireless/realtek/rtw89/fw.c-5290-\tu32 len = sizeof(*h2c);\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5301-\tskb_put(skb, len);\ndrivers/net/wireless/realtek/rtw89/fw.c:5302:\th2c = (struct rtw89_h2c_tx_duty *)skb-\u003edata;\ndrivers/net/wireless/realtek/rtw89/fw.c-5303-\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5319-\ndrivers/net/wireless/realtek/rtw89/fw.c:5320:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5321-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5333=int rtw89_fw_h2c_set_bcn_fltr_cfg(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5394-\ndrivers/net/wireless/realtek/rtw89/fw.c:5395:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5396-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5408=int rtw89_fw_h2c_rssi_offload(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5440-\ndrivers/net/wireless/realtek/rtw89/fw.c:5441:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5442-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5454=int rtw89_fw_h2c_tp_offload(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5482-\ndrivers/net/wireless/realtek/rtw89/fw.c:5483:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5484-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5496=int rtw89_fw_h2c_ra(struct rtw89_dev *rtwdev, struct rtw89_ra_info *ra, bool csi)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5573-\ndrivers/net/wireless/realtek/rtw89/fw.c:5574:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5575-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5587=int rtw89_fw_h2c_cxdrv_init(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5640-\ndrivers/net/wireless/realtek/rtw89/fw.c:5641:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5642-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5654=int rtw89_fw_h2c_cxdrv_init_v7(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5681-\ndrivers/net/wireless/realtek/rtw89/fw.c:5682:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5683-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5700=int rtw89_fw_h2c_cxdrv_role(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5764-\ndrivers/net/wireless/realtek/rtw89/fw.c:5765:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5766-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5781=int rtw89_fw_h2c_cxdrv_role_v1(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5854-\ndrivers/net/wireless/realtek/rtw89/fw.c:5855:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5856-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5871=int rtw89_fw_h2c_cxdrv_role_v2(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5940-\ndrivers/net/wireless/realtek/rtw89/fw.c:5941:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5942-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5954=int rtw89_fw_h2c_cxdrv_role_v7(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5986-\ndrivers/net/wireless/realtek/rtw89/fw.c:5987:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-5988-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6000=int rtw89_fw_h2c_cxdrv_role_v8(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6029-\ndrivers/net/wireless/realtek/rtw89/fw.c:6030:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-6031-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6043=int rtw89_fw_h2c_cxdrv_osi_info(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6069-\ndrivers/net/wireless/realtek/rtw89/fw.c:6070:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-6071-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6084=int rtw89_fw_h2c_cxdrv_ctrl(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6114-\ndrivers/net/wireless/realtek/rtw89/fw.c:6115:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-6116-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6128=int rtw89_fw_h2c_cxdrv_ctrl_v7(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6153-\ndrivers/net/wireless/realtek/rtw89/fw.c:6154:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-6155-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6168=int rtw89_fw_h2c_cxdrv_trx(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6209-\ndrivers/net/wireless/realtek/rtw89/fw.c:6210:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-6211-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6224=int rtw89_fw_h2c_cxdrv_rfk(struct rtw89_dev *rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6254-\ndrivers/net/wireless/realtek/rtw89/fw.c:6255:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-6256-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6269=int rtw89_fw_h2c_del_pkt_offload(struct rtw89_dev *rtwdev, u8 id)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6294-\ndrivers/net/wireless/realtek/rtw89/fw.c:6295:\tret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);\ndrivers/net/wireless/realtek/rtw89/fw.c-6296-\tif (ret \u003c 0) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6307=int rtw89_fw_h2c_add_pkt_offload(struct rtw89_dev *rtwdev, u8 *id,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6344-\ndrivers/net/wireless/realtek/rtw89/fw.c:6345:\tret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);\ndrivers/net/wireless/realtek/rtw89/fw.c-6346-\tif (ret \u003c 0) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6358=int rtw89_fw_h2c_scan_list_offload_ax(struct rtw89_dev *rtwdev, int ch_num,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6424-\ndrivers/net/wireless/realtek/rtw89/fw.c:6425:\tret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);\ndrivers/net/wireless/realtek/rtw89/fw.c-6426-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6435=int rtw89_fw_h2c_scan_list_offload_be(struct rtw89_dev *rtwdev, int ch_num,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6532-\ndrivers/net/wireless/realtek/rtw89/fw.c:6533:\tret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);\ndrivers/net/wireless/realtek/rtw89/fw.c-6534-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6542=int rtw89_fw_h2c_scan_offload_ax(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6620-\ndrivers/net/wireless/realtek/rtw89/fw.c:6621:\tret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);\ndrivers/net/wireless/realtek/rtw89/fw.c-6622-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6652=int rtw89_fw_h2c_scan_offload_be(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6878-\ndrivers/net/wireless/realtek/rtw89/fw.c:6879:\tret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);\ndrivers/net/wireless/realtek/rtw89/fw.c-6880-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6888=int rtw89_fw_h2c_trx_protect(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6964-\ndrivers/net/wireless/realtek/rtw89/fw.c:6965:\tret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait,\ndrivers/net/wireless/realtek/rtw89/fw.c-6966-\t\t\t\t    RTW89_FW_OFLD_WAIT_COND_TRX_PROTECT);\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6975=int rtw89_fw_h2c_rf_reg(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6994-\ndrivers/net/wireless/realtek/rtw89/fw.c:6995:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-6996-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7008=int rtw89_fw_h2c_rf_ntfy_mcc(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7053-\ndrivers/net/wireless/realtek/rtw89/fw.c:7054:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7055-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7068=int rtw89_fw_h2c_mcc_dig(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7107-\ndrivers/net/wireless/realtek/rtw89/fw.c:7108:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7109-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7121=int rtw89_fw_h2c_rf_ps_info(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7165-\ndrivers/net/wireless/realtek/rtw89/fw.c:7166:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7167-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7180=int rtw89_fw_h2c_rf_pre_ntfy(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7295-\ndrivers/net/wireless/realtek/rtw89/fw.c:7296:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7297-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7309=int rtw89_fw_h2c_rf_pre_ntfy_mcc(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7394-\ndrivers/net/wireless/realtek/rtw89/fw.c:7395:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7396-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7408=int rtw89_fw_h2c_rf_tssi(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7447-\ndrivers/net/wireless/realtek/rtw89/fw.c:7448:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7449-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7461=int rtw89_fw_h2c_rf_iqk(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7508-\ndrivers/net/wireless/realtek/rtw89/fw.c:7509:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7510-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7522=int rtw89_fw_h2c_rf_dpk(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7550-\ndrivers/net/wireless/realtek/rtw89/fw.c:7551:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7552-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7564=int rtw89_fw_h2c_rf_txgapk(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7593-\ndrivers/net/wireless/realtek/rtw89/fw.c:7594:\tret = rtw89_h2c_tx(rtwdev, skb, false);\ndrivers/net/wireless/realtek/rtw89/fw.c-7595-\tif (ret) {\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 83907
							output: 47
							thoughts: 0
						

{
  "Expression": "rtw89_h2c_tx",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/core.c"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=1286=int rtw89_core_tx_kick_off_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1312-\ndrivers/net/wireless/realtek/rtw89/core.c:1313:int rtw89_h2c_tx(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-1314-\t\t struct sk_buff *skb, bool fwdl)\n"
}

gemini-3.1-pro-preview

null

null

							input: 84140
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/core.c",
  "FirstLine": 1313,
  "LineCount": 100
}

{
  "Contents": "1313:\tint rtw89_h2c_tx(struct rtw89_dev *rtwdev,\n1314:\t\t\t struct sk_buff *skb, bool fwdl)\n1315:\t{\n1316:\t\tstruct rtw89_core_tx_request tx_req = {0};\n1317:\t\tu32 cnt;\n1318:\t\tint ret;\n1319:\t\n1320:\t\tif (!test_bit(RTW89_FLAG_POWERON, rtwdev-\u003eflags)) {\n1321:\t\t\trtw89_debug(rtwdev, RTW89_DBG_FW,\n1322:\t\t\t\t    \"ignore h2c due to power is off with firmware state=%d\\n\",\n1323:\t\t\t\t    test_bit(RTW89_FLAG_FW_RDY, rtwdev-\u003eflags));\n1324:\t\t\tdev_kfree_skb(skb);\n1325:\t\t\treturn 0;\n1326:\t\t}\n1327:\t\n1328:\t\ttx_req.skb = skb;\n1329:\t\ttx_req.tx_type = RTW89_CORE_TX_TYPE_FWCMD;\n1330:\t\tif (fwdl)\n1331:\t\t\ttx_req.desc_info.fw_dl = true;\n1332:\t\n1333:\t\trtw89_core_tx_update_desc_info(rtwdev, \u0026tx_req);\n1334:\t\n1335:\t\tif (!fwdl)\n1336:\t\t\trtw89_hex_dump(rtwdev, RTW89_DBG_FW, \"H2C: \", skb-\u003edata, skb-\u003elen);\n1337:\t\n1338:\t\tcnt = rtw89_hci_check_and_reclaim_tx_resource(rtwdev, RTW89_TXCH_CH12);\n1339:\t\tif (cnt == 0) {\n1340:\t\t\trtw89_err(rtwdev, \"no tx fwcmd resource\\n\");\n1341:\t\t\treturn -ENOSPC;\n1342:\t\t}\n1343:\t\n1344:\t\tret = rtw89_hci_tx_write(rtwdev, \u0026tx_req);\n1345:\t\tif (ret) {\n1346:\t\t\trtw89_err(rtwdev, \"failed to transmit skb to HCI\\n\");\n1347:\t\t\treturn ret;\n1348:\t\t}\n1349:\t\trtw89_hci_tx_kick_off(rtwdev, RTW89_TXCH_CH12);\n1350:\t\n1351:\t\treturn 0;\n1352:\t}\n1353:\t\n1354:\tstatic int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,\n1355:\t\t\t\t\t    struct rtw89_vif_link *rtwvif_link,\n1356:\t\t\t\t\t    struct rtw89_sta_link *rtwsta_link,\n1357:\t\t\t\t\t    struct sk_buff *skb, int *qsel,\n1358:\t\t\t\t\t    struct rtw89_tx_wait_info *wait)\n1359:\t{\n1360:\t\tstruct ieee80211_sta *sta = rtwsta_link_to_sta_safe(rtwsta_link);\n1361:\t\tstruct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);\n1362:\t\tstruct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb);\n1363:\t\tstruct rtw89_vif *rtwvif = rtwvif_link-\u003ertwvif;\n1364:\t\tstruct rtw89_core_tx_request tx_req = {};\n1365:\t\tint ret;\n1366:\t\n1367:\t\ttx_req.skb = skb;\n1368:\t\ttx_req.vif = vif;\n1369:\t\ttx_req.sta = sta;\n1370:\t\ttx_req.rtwvif_link = rtwvif_link;\n1371:\t\ttx_req.rtwsta_link = rtwsta_link;\n1372:\t\ttx_req.with_wait = !!wait;\n1373:\t\n1374:\t\trtw89_traffic_stats_accu(rtwdev, rtwvif, skb, true, true);\n1375:\t\trtw89_wow_parse_akm(rtwdev, skb);\n1376:\t\trtw89_core_tx_update_desc_info(rtwdev, \u0026tx_req);\n1377:\t\trtw89_core_tx_wake(rtwdev, \u0026tx_req);\n1378:\t\n1379:\t\trcu_assign_pointer(skb_data-\u003ewait, wait);\n1380:\t\n1381:\t\tret = rtw89_hci_tx_write(rtwdev, \u0026tx_req);\n1382:\t\tif (ret) {\n1383:\t\t\trtw89_err(rtwdev, \"failed to transmit skb to HCI\\n\");\n1384:\t\t\treturn ret;\n1385:\t\t}\n1386:\t\n1387:\t\tif (qsel)\n1388:\t\t\t*qsel = tx_req.desc_info.qsel;\n1389:\t\n1390:\t\treturn 0;\n1391:\t}\n1392:\t\n1393:\tint rtw89_core_tx_write(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,\n1394:\t\t\t\tstruct ieee80211_sta *sta, struct sk_buff *skb, int *qsel)\n1395:\t{\n1396:\t\tstruct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);\n1397:\t\tstruct rtw89_vif *rtwvif = vif_to_rtwvif(vif);\n1398:\t\tstruct rtw89_sta_link *rtwsta_link = NULL;\n1399:\t\tstruct rtw89_vif_link *rtwvif_link;\n1400:\t\n1401:\t\tif (rtwsta) {\n1402:\t\t\trtwsta_link = rtw89_get_designated_link(rtwsta);\n1403:\t\t\tif (unlikely(!rtwsta_link)) {\n1404:\t\t\t\trtw89_err(rtwdev, \"tx: find no sta designated link\\n\");\n1405:\t\t\t\treturn -ENOLINK;\n1406:\t\t\t}\n1407:\t\n1408:\t\t\trtwvif_link = rtwsta_link-\u003ertwvif_link;\n1409:\t\t} else {\n1410:\t\t\trtwvif_link = rtw89_get_designated_link(rtwvif);\n1411:\t\t\tif (unlikely(!rtwvif_link)) {\n1412:\t\t\t\trtw89_err(rtwdev, \"tx: find no vif designated link\\n\");\n"
}

gemini-3.1-pro-preview

null

null

							input: 86125
							output: 44
							thoughts: 0
						

{
  "Expression": "rtw89_hci_tx_write",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/core.c=1313=int rtw89_h2c_tx(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1343-\ndrivers/net/wireless/realtek/rtw89/core.c:1344:\tret = rtw89_hci_tx_write(rtwdev, \u0026tx_req);\ndrivers/net/wireless/realtek/rtw89/core.c-1345-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1354=static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1380-\ndrivers/net/wireless/realtek/rtw89/core.c:1381:\tret = rtw89_hci_tx_write(rtwdev, \u0026tx_req);\ndrivers/net/wireless/realtek/rtw89/core.c-1382-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/core.h=6510=static inline void rtw89_tx_wait_list_clear(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/core.h-6523-\ndrivers/net/wireless/realtek/rtw89/core.h:6524:static inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.h-6525-\t\t\t\t     struct rtw89_core_tx_request *tx_req)\n--\ndrivers/net/wireless/realtek/rtw89/core.h=6665=struct rtw89_tx_skb_data *RTW89_TX_SKB_CB(struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw89/core.h-6667-\t/*\ndrivers/net/wireless/realtek/rtw89/core.h:6668:\t * This should be used by/after rtw89_hci_tx_write() and before doing\ndrivers/net/wireless/realtek/rtw89/core.h-6669-\t * ieee80211_tx_info_clear_status().\n"
}

gemini-3.1-pro-preview

null

null

							input: 86836
							output: 47
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/core.h",
  "FirstLine": 6524,
  "LineCount": 100
}

{
  "Contents": "6524:\tstatic inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev,\n6525:\t\t\t\t\t     struct rtw89_core_tx_request *tx_req)\n6526:\t{\n6527:\t\treturn rtwdev-\u003ehci.ops-\u003etx_write(rtwdev, tx_req);\n6528:\t}\n6529:\t\n6530:\tstatic inline void rtw89_hci_reset(struct rtw89_dev *rtwdev)\n6531:\t{\n6532:\t\trtwdev-\u003ehci.ops-\u003ereset(rtwdev);\n6533:\t\t/* hci.ops-\u003ereset must complete all pending TX wait SKBs */\n6534:\t\trtw89_tx_wait_list_clear(rtwdev);\n6535:\t}\n6536:\t\n6537:\tstatic inline int rtw89_hci_start(struct rtw89_dev *rtwdev)\n6538:\t{\n6539:\t\treturn rtwdev-\u003ehci.ops-\u003estart(rtwdev);\n6540:\t}\n6541:\t\n6542:\tstatic inline void rtw89_hci_stop(struct rtw89_dev *rtwdev)\n6543:\t{\n6544:\t\trtwdev-\u003ehci.ops-\u003estop(rtwdev);\n6545:\t}\n6546:\t\n6547:\tstatic inline int rtw89_hci_deinit(struct rtw89_dev *rtwdev)\n6548:\t{\n6549:\t\treturn rtwdev-\u003ehci.ops-\u003edeinit(rtwdev);\n6550:\t}\n6551:\t\n6552:\tstatic inline void rtw89_hci_pause(struct rtw89_dev *rtwdev, bool pause)\n6553:\t{\n6554:\t\trtwdev-\u003ehci.ops-\u003epause(rtwdev, pause);\n6555:\t}\n6556:\t\n6557:\tstatic inline void rtw89_hci_switch_mode(struct rtw89_dev *rtwdev, bool low_power)\n6558:\t{\n6559:\t\trtwdev-\u003ehci.ops-\u003eswitch_mode(rtwdev, low_power);\n6560:\t}\n6561:\t\n6562:\tstatic inline void rtw89_hci_recalc_int_mit(struct rtw89_dev *rtwdev)\n6563:\t{\n6564:\t\trtwdev-\u003ehci.ops-\u003erecalc_int_mit(rtwdev);\n6565:\t}\n6566:\t\n6567:\tstatic inline u32 rtw89_hci_check_and_reclaim_tx_resource(struct rtw89_dev *rtwdev, u8 txch)\n6568:\t{\n6569:\t\treturn rtwdev-\u003ehci.ops-\u003echeck_and_reclaim_tx_resource(rtwdev, txch);\n6570:\t}\n6571:\t\n6572:\tstatic inline void rtw89_hci_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch)\n6573:\t{\n6574:\t\treturn rtwdev-\u003ehci.ops-\u003etx_kick_off(rtwdev, txch);\n6575:\t}\n6576:\t\n6577:\tstatic inline int rtw89_hci_mac_pre_deinit(struct rtw89_dev *rtwdev)\n6578:\t{\n6579:\t\treturn rtwdev-\u003ehci.ops-\u003emac_pre_deinit(rtwdev);\n6580:\t}\n6581:\t\n6582:\tstatic inline void rtw89_hci_flush_queues(struct rtw89_dev *rtwdev, u32 queues,\n6583:\t\t\t\t\t\t  bool drop)\n6584:\t{\n6585:\t\tif (!test_bit(RTW89_FLAG_POWERON, rtwdev-\u003eflags))\n6586:\t\t\treturn;\n6587:\t\n6588:\t\tif (rtwdev-\u003ehci.ops-\u003eflush_queues)\n6589:\t\t\treturn rtwdev-\u003ehci.ops-\u003eflush_queues(rtwdev, queues, drop);\n6590:\t}\n6591:\t\n6592:\tstatic inline void rtw89_hci_recovery_start(struct rtw89_dev *rtwdev)\n6593:\t{\n6594:\t\tif (rtwdev-\u003ehci.ops-\u003erecovery_start)\n6595:\t\t\trtwdev-\u003ehci.ops-\u003erecovery_start(rtwdev);\n6596:\t}\n6597:\t\n6598:\tstatic inline void rtw89_hci_recovery_complete(struct rtw89_dev *rtwdev)\n6599:\t{\n6600:\t\tif (rtwdev-\u003ehci.ops-\u003erecovery_complete)\n6601:\t\t\trtwdev-\u003ehci.ops-\u003erecovery_complete(rtwdev);\n6602:\t}\n6603:\t\n6604:\tstatic inline void rtw89_hci_enable_intr(struct rtw89_dev *rtwdev)\n6605:\t{\n6606:\t\tif (rtwdev-\u003ehci.ops-\u003eenable_intr)\n6607:\t\t\trtwdev-\u003ehci.ops-\u003eenable_intr(rtwdev);\n6608:\t}\n6609:\t\n6610:\tstatic inline void rtw89_hci_disable_intr(struct rtw89_dev *rtwdev)\n6611:\t{\n6612:\t\tif (rtwdev-\u003ehci.ops-\u003edisable_intr)\n6613:\t\t\trtwdev-\u003ehci.ops-\u003edisable_intr(rtwdev);\n6614:\t}\n6615:\t\n6616:\tstatic inline void rtw89_hci_ctrl_txdma_ch(struct rtw89_dev *rtwdev, bool enable)\n6617:\t{\n6618:\t\tif (rtwdev-\u003ehci.ops-\u003ectrl_txdma_ch)\n6619:\t\t\trtwdev-\u003ehci.ops-\u003ectrl_txdma_ch(rtwdev, enable);\n6620:\t}\n6621:\t\n6622:\tstatic inline void rtw89_hci_ctrl_txdma_fw_ch(struct rtw89_dev *rtwdev, bool enable)\n6623:\t{\n"
}

gemini-3.1-pro-preview

null

null

							input: 91600
							output: 44
							thoughts: 34
						

Okay, here's my interpretation of that thought process, from an expert's perspective:

**Diving into the Transmission Process**

Right, so we're looking at a transmission event, specifically within the Realtek wireless driver, `rtwdev`. The system has initiated a write operation, and the entry point is the `rtwdev->hci.ops->tx_write` function pointer. For a USB-based implementation, which is likely what we're dealing with here, that function pointer resolves to `rtw89_usb_tx_write`. This tells me we're hitting the USB-specific pathway for transmitting data from the host to the wireless adapter. This is the crucial point for injecting the data.

{
  "Expression": "rtw89_usb_tx_write",
  "PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}

{
  "Output": "drivers/net/wireless/realtek/rtw89/usb.c=295=static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch)\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-336-\ndrivers/net/wireless/realtek/rtw89/usb.c:337:static int rtw89_usb_tx_write_fwcmd(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/usb.c-338-\t\t\t\t    struct rtw89_core_tx_request *tx_req)\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=379=static int rtw89_usb_ops_tx_write(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-398-\tif (desc_info-\u003ech_dma == RTW89_TXCH_CH12)\ndrivers/net/wireless/realtek/rtw89/usb.c:399:\t\treturn rtw89_usb_tx_write_fwcmd(rtwdev, tx_req);\ndrivers/net/wireless/realtek/rtw89/usb.c-400-\n"
}

gemini-3.1-pro-preview

null

null

							input: 92188
							output: 46
							thoughts: 0
						

{
  "File": "drivers/net/wireless/realtek/rtw89/usb.c",
  "FirstLine": 337,
  "LineCount": 100
}

{
  "Contents": " 337:\tstatic int rtw89_usb_tx_write_fwcmd(struct rtw89_dev *rtwdev,\n 338:\t\t\t\t\t    struct rtw89_core_tx_request *tx_req)\n 339:\t{\n 340:\t\tstruct rtw89_tx_desc_info *desc_info = \u0026tx_req-\u003edesc_info;\n 341:\t\tstruct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev);\n 342:\t\tstruct sk_buff *skb = tx_req-\u003eskb;\n 343:\t\tstruct sk_buff *skb512;\n 344:\t\tu32 txdesc_size = rtwdev-\u003echip-\u003eh2c_desc_size;\n 345:\t\tvoid *txdesc;\n 346:\t\n 347:\t\tif (((desc_info-\u003epkt_size + txdesc_size) % 512) == 0) {\n 348:\t\t\trtw89_debug(rtwdev, RTW89_DBG_HCI, \"avoiding multiple of 512\\n\");\n 349:\t\n 350:\t\t\tskb512 = dev_alloc_skb(txdesc_size + desc_info-\u003epkt_size +\n 351:\t\t\t\t\t       RTW89_USB_MOD512_PADDING);\n 352:\t\t\tif (!skb512) {\n 353:\t\t\t\trtw89_err(rtwdev, \"%s: failed to allocate skb\\n\",\n 354:\t\t\t\t\t  __func__);\n 355:\t\n 356:\t\t\t\treturn -ENOMEM;\n 357:\t\t\t}\n 358:\t\n 359:\t\t\tskb_pull(skb512, txdesc_size);\n 360:\t\t\tskb_put_data(skb512, skb-\u003edata, skb-\u003elen);\n 361:\t\t\tskb_put_zero(skb512, RTW89_USB_MOD512_PADDING);\n 362:\t\n 363:\t\t\tdev_kfree_skb_any(skb);\n 364:\t\t\tskb = skb512;\n 365:\t\t\ttx_req-\u003eskb = skb512;\n 366:\t\n 367:\t\t\tdesc_info-\u003epkt_size += RTW89_USB_MOD512_PADDING;\n 368:\t\t}\n 369:\t\n 370:\t\ttxdesc = skb_push(skb, txdesc_size);\n 371:\t\tmemset(txdesc, 0, txdesc_size);\n 372:\t\trtw89_chip_fill_txdesc_fwcmd(rtwdev, desc_info, txdesc);\n 373:\t\n 374:\t\tskb_queue_tail(\u0026rtwusb-\u003etx_queue[desc_info-\u003ech_dma], skb);\n 375:\t\n 376:\t\treturn 0;\n 377:\t}\n 378:\t\n 379:\tstatic int rtw89_usb_ops_tx_write(struct rtw89_dev *rtwdev,\n 380:\t\t\t\t\t  struct rtw89_core_tx_request *tx_req)\n 381:\t{\n 382:\t\tstruct rtw89_tx_desc_info *desc_info = \u0026tx_req-\u003edesc_info;\n 383:\t\tstruct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev);\n 384:\t\tstruct rtw89_tx_skb_data *skb_data;\n 385:\t\tstruct sk_buff *skb = tx_req-\u003eskb;\n 386:\t\tstruct rtw89_txwd_body *txdesc;\n 387:\t\tu32 txdesc_size;\n 388:\t\n 389:\t\tif ((desc_info-\u003ech_dma == RTW89_TXCH_CH12 ||\n 390:\t\t     tx_req-\u003etx_type == RTW89_CORE_TX_TYPE_FWCMD) \u0026\u0026\n 391:\t\t    (desc_info-\u003ech_dma != RTW89_TXCH_CH12 ||\n 392:\t\t     tx_req-\u003etx_type != RTW89_CORE_TX_TYPE_FWCMD)) {\n 393:\t\t\trtw89_err(rtwdev, \"dma channel %d/TX type %d mismatch\\n\",\n 394:\t\t\t\t  desc_info-\u003ech_dma, tx_req-\u003etx_type);\n 395:\t\t\treturn -EINVAL;\n 396:\t\t}\n 397:\t\n 398:\t\tif (desc_info-\u003ech_dma == RTW89_TXCH_CH12)\n 399:\t\t\treturn rtw89_usb_tx_write_fwcmd(rtwdev, tx_req);\n 400:\t\n 401:\t\ttxdesc_size = rtwdev-\u003echip-\u003etxwd_body_size;\n 402:\t\tif (desc_info-\u003een_wd_info)\n 403:\t\t\ttxdesc_size += rtwdev-\u003echip-\u003etxwd_info_size;\n 404:\t\n 405:\t\ttxdesc = skb_push(skb, txdesc_size);\n 406:\t\tmemset(txdesc, 0, txdesc_size);\n 407:\t\trtw89_chip_fill_txdesc(rtwdev, desc_info, txdesc);\n 408:\t\n 409:\t\tle32p_replace_bits(\u0026txdesc-\u003edword0, 1, RTW89_TXWD_BODY0_STF_MODE);\n 410:\t\n 411:\t\tskb_data = RTW89_TX_SKB_CB(skb);\n 412:\t\tif (tx_req-\u003edesc_info.sn)\n 413:\t\t\tskb_data-\u003etx_rpt_sn = tx_req-\u003edesc_info.sn;\n 414:\t\tif (tx_req-\u003edesc_info.tx_cnt_lmt)\n 415:\t\t\tskb_data-\u003etx_pkt_cnt_lmt = tx_req-\u003edesc_info.tx_cnt_lmt;\n 416:\t\n 417:\t\tskb_queue_tail(\u0026rtwusb-\u003etx_queue[desc_info-\u003ech_dma], skb);\n 418:\t\n 419:\t\treturn 0;\n 420:\t}\n 421:\t\n 422:\tstatic void rtw89_usb_rx_handler(struct work_struct *work)\n 423:\t{\n 424:\t\tstruct rtw89_usb *rtwusb = container_of(work, struct rtw89_usb, rx_work);\n 425:\t\tconst struct rtw89_usb_info *info = rtwusb-\u003einfo;\n 426:\t\tstruct rtw89_dev *rtwdev = rtwusb-\u003ertwdev;\n 427:\t\tstruct rtw89_rx_desc_info desc_info;\n 428:\t\ts32 aligned_offset, remaining;\n 429:\t\tstruct sk_buff *rx_skb;\n 430:\t\tstruct sk_buff *skb;\n 431:\t\tu32 pkt_offset;\n 432:\t\tu8 *pkt_ptr;\n 433:\t\tint limit;\n 434:\t\n 435:\t\tfor (limit = 0; limit \u003c 200; limit++) {\n 436:\t\t\trx_skb = skb_dequeue(\u0026rtwusb-\u003erx_queue);\n"
}

gemini-3.1-pro-preview

null

null

							input: 94238
							output: 210
							thoughts: 1541
						

**Analysis of Realtek WiFi Driver Patch**

Okay, let's break this down. My initial thought process revolves around understanding the implications of this patch, specifically for the Realtek rtw89 wireless driver.  It seems the focus is on improved error handling, particularly around resource exhaustion when sending commands to the firmware.

Initially, I see that functions like `rtw89_usb_tx_write_fwcmd`, which are responsible for queuing firmware commands, don't block. They enqueue and return, meaning the driver doesn't wait for the firmware's processing. Functions such as `rtw89_h2c_tx` and those called by it, like `rtw89_fw_h2c_role_maintain`, just queue the commands. They only fail if the underlying resource allocation fails (e.g. `dev_alloc_skb` returning -ENOMEM or `rtw89_hci_check_and_reclaim_tx_resource` returns 0). This means a TX resource shortage or memory issue will trigger the error path. The critical point is now, that these errors are *not* being ignored, unlike potentially what it was previously, and the calling function is informed of it.

So, the key change is that functions like `rtw89_ops_start_ap` now return errors if they encounter these resource issues when queuing commands. This seems like a good functional improvement, a much better way of handling resource exhaustion that might have lead to inconsistent state or crashing later.

The question then becomes: is this reachable? Absolutely. I believe that Syzkaller, which is perfect for this, can trigger a scenario with a dummy USB device that registers the mac80211 device. By sending many commands or by the dummy USB device not processing TX URBs, we can fill the TX queue. Then, when `rtw89_hci_check_and_reclaim_tx_resource` fails, the `rtw89_ops_start_ap` function will return an error due to the new error handling.

I'm also considering another function, `rtw89_mac_port_update` to be sure there are no other changes. I don't see anything wrong here, returning `-EINVAL` if the port number is out of range, which seems to be correct since `RTW89_PORT_NUM` is 5.

Therefore, this patch improves error handling in a reachable part of the driver. Now, the main target for fuzzing is `rtw89_ops_start_ap`.

To ensure the system is correctly configured, I'll need these configurations: `RTW89`, `RTW89_CORE`, `RTW89_USB`, and specific USB drivers like `RTW89_8852AU`, `RTW89_8852BU`, `RTW89_8852CU`, and `RTW89_8851BU`. I will make a list of these driver configs.

Let me verify that the code change is contained to `rtw89_ops_start_ap`. The analysis shows that this is the only relevant function in the `drivers/net/wireless/realtek/rtw89/mac80211.c` file.

Finally, I will verify that the configurations are correctly interdependent. The specific Realtek USB driver configs listed require `USB` and `MAC80211`, so those are required as well.

My focus should be on fuzzing `rtw89_ops_start_ap` with resource exhaustion as the target, likely through a flood of commands triggered by Syzkaller via USB emulation.

{
  "EnableConfigs": [
    "RTW89_8852AU",
    "RTW89_8852BU",
    "RTW89_8852CU",
    "RTW89_8851BU"
  ],
  "FocusSymbols": [
    "rtw89_ops_start_ap"
  ],
  "Reasoning": "The patch adds error checking to several firmware command functions in `rtw89_ops_start_ap`. If any of these commands fail (e.g., due to TX resource exhaustion or memory allocation failure), the function now returns an error instead of continuing. This changes the execution flow and error handling of the driver. The driver can be reached in a virtualized environment via USB emulation (dummy-hcd), allowing syzkaller to trigger the mac80211 `start_ap` callback and potentially exhaust TX resources to exercise the new error paths.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "RTW89_8852AU",
    "RTW89_8852BU",
    "RTW89_8852CU",
    "RTW89_8851BU"
  ],
  "FocusSymbols": [
    "rtw89_ops_start_ap"
  ],
  "Reasoning": "The patch adds error checking to several firmware command functions in `rtw89_ops_start_ap`. If any of these commands fail (e.g., due to TX resource exhaustion or memory allocation failure), the function now returns an error instead of continuing. This changes the execution flow and error handling of the driver. The driver can be reached in a virtualized environment via USB emulation (dummy-hcd), allowing syzkaller to trigger the mac80211 `start_ap` callback and potentially exhaust TX resources to exercise the new error paths.",
  "WorthFuzzing": true
}