AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch replaces a manual implementation of finding the minimum non-zero value in an array with the standard `min_not_zero` macro. This is a purely cosmetic refactoring that does not functionally alter the execution flow or behavior of the driver.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 3618bc7a1131ab63bbb3632daec394972bfdac66\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Aug 2 02:43:49 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c\nindex a5efa13a892fd..89733f3fb1f28 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c\n@@ -121,15 +121,8 @@ mt76x2_get_min_rate_power(struct mt76x02_rate_power *r)\n \tint i;\n \ts8 ret = 0;\n \n-\tfor (i = 0; i \u003c sizeof(r-\u003eall); i++) {\n-\t\tif (!r-\u003eall[i])\n-\t\t\tcontinue;\n-\n-\t\tif (ret)\n-\t\t\tret = min(ret, r-\u003eall[i]);\n-\t\telse\n-\t\t\tret = r-\u003eall[i];\n-\t}\n+\tfor (i = 0; i \u003c sizeof(r-\u003eall); i++)\n+\t\tret = min_not_zero(ret, r-\u003eall[i]);\n \n \treturn ret;\n }\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch replaces a manual implementation of finding the minimum non-zero value in an array with the standard `min_not_zero` macro. This is a purely cosmetic refactoring that does not functionally alter the execution flow or behavior of the driver.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 3618bc7a1131ab63bbb3632daec394972bfdac66
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Aug 2 02:43:49 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c
index a5efa13a892fd..89733f3fb1f28 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/phy.c
@@ -121,15 +121,8 @@ mt76x2_get_min_rate_power(struct mt76x02_rate_power *r)
 	int i;
 	s8 ret = 0;
 
-	for (i = 0; i < sizeof(r->all); i++) {
-		if (!r->all[i])
-			continue;
-
-		if (ret)
-			ret = min(ret, r->all[i]);
-		else
-			ret = r->all[i];
-	}
+	for (i = 0; i < sizeof(r->all); i++)
+		ret = min_not_zero(ret, r->all[i]);
 
 	return ret;
 }

gemini-3.1-pro-preview

null

null

							input: 2167
							output: 44
							thoughts: 176
						

**Analyzing a Wi-Fi Driver Patch**

Okay, so I'm looking at a patch in `drivers/net/wireless/mediatek/mt76/mt76x2/phy.c`. The change is in the `mt76x2_get_min_rate_power` function – it's a simple loop optimization using `min_not_zero(ret, r->all[i])`. Nothing too groundbreaking, but I need to understand the context. Hmm, `mt76x2`... that's a MediaTek Wi-Fi driver, right? My initial reaction is that testing this properly will be a pain. These sorts of drivers often rely on specific hardware, typically PCIe or USB Wi-Fi adapters. Can I even test this in a QEMU environment? It'd be great if I could, that'd make things a lot easier.

Wait a minute, I seem to recall that mt76x2 *does* have USB variants. Let's verify that. I'll take a quick peek in the directory structure, see if I can spot anything that clearly indicates USB support: `drivers/net/wireless/mediatek/mt76/mt76x2/`.
I have to see if there is something USB-specific within the driver to determine if QEMU testing is viable.

{
  "Expression": "mt76x2",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt76x2/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1227 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:2:obj-$(CONFIG_MT76x2_COMMON) += mt76x2-common.o\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:3:obj-$(CONFIG_MT76x2E) += mt76x2e.o\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:4:obj-$(CONFIG_MT76x2U) += mt76x2u.o\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-5-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:6:mt76x2-common-y := \\\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-7-\teeprom.o mac.o init.o phy.o mcu.o\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-8-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:9:mt76x2e-y := \\\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-10-\tpci.o pci_main.o pci_init.o pci_mcu.o \\\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-12-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:13:mt76x2u-y := \\\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-14-\tusb.o usb_init.o usb_main.o usb_mac.o usb_mcu.o \\\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-8-#include \u003clinux/unaligned.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:9:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-10-#include \"eeprom.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=14=static int\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:15:mt76x2_eeprom_get_macaddr(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-16-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=23=static bool\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:24:mt76x2_has_cal_free_data(struct mt76x02_dev *dev, u8 *efuse)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-25-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=49=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:50:mt76x2_apply_cal_free_data(struct mt76x02_dev *dev, u8 *efuse)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-51-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-93-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:94:\tif (!mt76x2_has_cal_free_data(dev, efuse))\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-95-\t\treturn;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-122-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:123:static int mt76x2_check_eeprom(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-124-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=140=static int\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:141:mt76x2_eeprom_load(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-142-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-152-\tif (found)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:153:\t\tfound = !mt76x2_check_eeprom(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-154-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-167-\tif (found) {\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:168:\t\tmt76x2_apply_cal_free_data(dev, efuse);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-169-\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=182=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:183:mt76x2_set_rx_gain_group(struct mt76x02_dev *dev, u8 val)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-184-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=197=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:198:mt76x2_set_rssi_offset(struct mt76x02_dev *dev, int chain, u8 val)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-199-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-209-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:210:static enum mt76x2_cal_channel_group\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:211:mt76x2_get_cal_channel_group(int channel)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-212-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=226=static u8\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:227:mt76x2_get_5g_rx_gain(struct mt76x02_dev *dev, u8 channel)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-228-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:229:\tenum mt76x2_cal_channel_group group;\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-230-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:231:\tgroup = mt76x2_get_cal_channel_group(channel);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-232-\tswitch (group) {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-253-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:254:void mt76x2_read_rx_gain(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-255-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-265-\telse\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:266:\t\tval = mt76x2_get_5g_rx_gain(dev, channel);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-267-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:268:\tmt76x2_set_rx_gain_group(dev, val);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-269-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-270-\tmt76x02_get_rx_gain(dev, chan-\u003eband, \u0026val, \u0026lna_2g, lna_5g);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:271:\tmt76x2_set_rssi_offset(dev, 0, val);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:272:\tmt76x2_set_rssi_offset(dev, 1, val \u003e\u003e 8);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-273-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-289-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:290:EXPORT_SYMBOL_GPL(mt76x2_read_rx_gain);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-291-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:292:void mt76x2_get_rate_power(struct mt76x02_dev *dev, struct mt76x02_rate_power *t,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-293-\t\t\t   struct ieee80211_channel *chan)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-340-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:341:EXPORT_SYMBOL_GPL(mt76x2_get_rate_power);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-342-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=343=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:344:mt76x2_get_power_info_2g(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:345:\t\t\t struct mt76x2_tx_power_info *t,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-346-\t\t\t struct ieee80211_channel *chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c=373=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:374:mt76x2_get_power_info_5g(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:375:\t\t\t struct mt76x2_tx_power_info *t,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-376-\t\t\t struct ieee80211_channel *chan,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-379-\tint channel = chan-\u003ehw_value;\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:380:\tenum mt76x2_cal_channel_group group;\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-381-\tint delta_idx;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-384-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:385:\tgroup = mt76x2_get_cal_channel_group(channel);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-386-\toffset += group * MT_TX_POWER_GROUP_SIZE_5G;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-424-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:425:void mt76x2_get_power_info(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:426:\t\t\t   struct mt76x2_tx_power_info *t,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-427-\t\t\t   struct ieee80211_channel *chan)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-437-\t\tbw40 \u003e\u003e= 8;\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:438:\t\tmt76x2_get_power_info_5g(dev, t, chan, 0,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-439-\t\t\t\t\t MT_EE_TX_POWER_0_START_5G);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:440:\t\tmt76x2_get_power_info_5g(dev, t, chan, 1,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-441-\t\t\t\t\t MT_EE_TX_POWER_1_START_5G);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-442-\t} else {\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:443:\t\tmt76x2_get_power_info_2g(dev, t, chan, 0,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-444-\t\t\t\t\t MT_EE_TX_POWER_0_START_2G);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:445:\t\tmt76x2_get_power_info_2g(dev, t, chan, 1,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-446-\t\t\t\t\t MT_EE_TX_POWER_1_START_2G);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-448-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:449:\tif (mt76x2_tssi_enabled(dev) ||\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-450-\t    !mt76x02_field_valid(t-\u003etarget_power))\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-455-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:456:EXPORT_SYMBOL_GPL(mt76x2_get_power_info);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-457-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:458:int mt76x2_get_temp_comp(struct mt76x02_dev *dev, struct mt76x2_temp_comp *t)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-459-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-465-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:466:\tif (!mt76x2_temp_tx_alc_enabled(dev))\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-467-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-489-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:490:EXPORT_SYMBOL_GPL(mt76x2_get_temp_comp);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-491-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:492:int mt76x2_eeprom_init(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-493-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-495-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:496:\tret = mt76x2_eeprom_load(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-497-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-500-\tmt76x02_eeprom_parse_hw_cap(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:501:\tmt76x2_eeprom_get_macaddr(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-502-\tret = mt76_eeprom_override(\u0026dev-\u003emphy);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-508-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c:509:EXPORT_SYMBOL_GPL(mt76x2_eeprom_init);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c-510-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-10-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:11:enum mt76x2_cal_channel_group {\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-12-\tMT_CH_5G_JAPAN,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-20-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:21:struct mt76x2_tx_power_info {\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-22-\tu8 target_power;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-34-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:35:struct mt76x2_temp_comp {\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-36-\tu8 temp_25_ref;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-42-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:43:void mt76x2_get_rate_power(struct mt76x02_dev *dev, struct mt76x02_rate_power *t,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-44-\t\t\t   struct ieee80211_channel *chan);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:45:void mt76x2_get_power_info(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:46:\t\t\t   struct mt76x2_tx_power_info *t,\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-47-\t\t\t   struct ieee80211_channel *chan);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:48:int mt76x2_get_temp_comp(struct mt76x02_dev *dev, struct mt76x2_temp_comp *t);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:49:void mt76x2_read_rx_gain(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-50-\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h=51=static inline bool\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:52:mt76x2_has_ext_lna(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-53-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h=62=static inline bool\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:63:mt76x2_temp_tx_alc_enabled(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-64-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h=75=static inline bool\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:76:mt76x2_tssi_enabled(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-77-{\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h:78:\treturn !mt76x2_temp_tx_alc_enabled(dev) \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt76x2/eeprom.h-79-\t       (mt76x02_eeprom_get(dev, MT_EE_NIC_CONF_1) \u0026\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-6-\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:7:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-8-#include \"eeprom.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-10-\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:11:int mt76x2_set_sar_specs(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-12-\t\t\t const struct cfg80211_sar_specs *sar)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-31-\tif (test_bit(MT76_STATE_RUNNING, \u0026mphy-\u003estate))\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:32:\t\tmt76x2_phy_set_txpower(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-33-out:\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-37-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:38:EXPORT_SYMBOL_GPL(mt76x2_set_sar_specs);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-39-\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c=40=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:41:mt76x2_set_wlan_state(struct mt76x02_dev *dev, bool enable)\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-42-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-55-\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:56:void mt76x2_reset_wlan(struct mt76x02_dev *dev, bool enable)\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-57-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-78-out:\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:79:\tmt76x2_set_wlan_state(dev, enable);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-80-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:81:EXPORT_SYMBOL_GPL(mt76x2_reset_wlan);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-82-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c=178=EXPORT_SYMBOL_GPL(mt76_write_mac_initvals);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-179-\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:180:void mt76x2_init_txpower(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-181-\t\t\t struct ieee80211_supported_band *sband)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-183-\tstruct ieee80211_channel *chan;\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:184:\tstruct mt76x2_tx_power_info txp;\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-185-\tstruct mt76x02_rate_power t = {};\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-190-\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:191:\t\tmt76x2_get_power_info(dev, \u0026txp, chan);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:192:\t\tmt76x2_get_rate_power(dev, \u0026t, chan);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-193-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-203-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:204:EXPORT_SYMBOL_GPL(mt76x2_init_txpower);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.c-6-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.c:7:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.c-8-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.c:9:void mt76x2_mac_stop(struct mt76x02_dev *dev, bool force)\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.c-10-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.c-45-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.c:46:EXPORT_SYMBOL_GPL(mt76x2_mac_stop);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h-8-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h:9:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h-10-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h=11=struct mt76x02_dev;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h:12:struct mt76x2_sta;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h-13-struct mt76x02_vif;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h-14-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h:15:void mt76x2_mac_stop(struct mt76x02_dev *dev, bool force);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h-16-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h:17:static inline void mt76x2_mac_resume(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/mac.h-18-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-10-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:11:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-12-#include \"mcu.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-14-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:15:int mt76x2_mcu_set_channel(struct mt76x02_dev *dev, u8 channel, u8 bw,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-16-\t\t\t   u8 bw_index, bool scan)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-44-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:45:EXPORT_SYMBOL_GPL(mt76x2_mcu_set_channel);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-46-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:47:int mt76x2_mcu_load_cr(struct mt76x02_dev *dev, u8 type, u8 temp_level,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-48-\t\t       u8 channel)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-72-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:73:EXPORT_SYMBOL_GPL(mt76x2_mcu_load_cr);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-74-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:75:int mt76x2_mcu_init_gain(struct mt76x02_dev *dev, u8 channel, u32 gain,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-76-\t\t\t bool force)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-91-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:92:EXPORT_SYMBOL_GPL(mt76x2_mcu_init_gain);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-93-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:94:int mt76x2_mcu_tssi_comp(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:95:\t\t\t struct mt76x2_tssi_comp *tssi_data)\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-96-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-98-\t\t__le32 id;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:99:\t\tstruct mt76x2_tssi_comp data;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-100-\t} __packed __aligned(4) msg = {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c-107-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.c:108:EXPORT_SYMBOL_GPL(mt76x2_mcu_tssi_comp);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h=27=enum mcu_calibration {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h-44-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h:45:enum mt76x2_mcu_cr_mode {\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h-46-\tMT_RF_CR,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h-51-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h:52:struct mt76x2_tssi_comp {\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h-53-\tu8 pa_mode;\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h-62-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h:63:int mt76x2_mcu_tssi_comp(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h:64:\t\t\t struct mt76x2_tssi_comp *tssi_data);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h:65:int mt76x2_mcu_init_gain(struct mt76x02_dev *dev, u8 channel, u32 gain,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mcu.h-66-\t\t\t bool force);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h=26=static inline bool is_mt7612(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-30-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:31:static inline bool mt76x2_channel_silent(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-32-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-38-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:39:extern const struct ieee80211_ops mt76x2_ops;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-40-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:41:int mt76x2_register_device(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:42:int mt76x2_resume_device(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-43-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:44:int mt76x2_set_sar_specs(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-45-\t\t\t const struct cfg80211_sar_specs *sar);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:46:void mt76x2_phy_power_on(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:47:void mt76x2_stop_hardware(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:48:int mt76x2_eeprom_init(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:49:int mt76x2_apply_calibration_data(struct mt76x02_dev *dev, int channel);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:50:int mt76x2e_set_channel(struct mt76_phy *phy);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:51:int mt76x2u_set_channel(struct mt76_phy *phy);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-52-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:53:void mt76x2_phy_set_antenna(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:54:int mt76x2_phy_start(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:55:int mt76x2_phy_set_channel(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-56-\t\t\t   struct cfg80211_chan_def *chandef);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:57:void mt76x2_phy_calibrate(struct work_struct *work);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:58:void mt76x2_phy_set_txpower(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-59-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:60:int mt76x2_mcu_init(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:61:int mt76x2_mcu_set_channel(struct mt76x02_dev *dev, u8 channel, u8 bw,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-62-\t\t\t   u8 bw_index, bool scan);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:63:int mt76x2_mcu_load_cr(struct mt76x02_dev *dev, u8 type, u8 temp_level,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-64-\t\t       u8 channel);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-65-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:66:void mt76x2_cleanup(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-67-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:68:int mt76x2_mac_reset(struct mt76x02_dev *dev, bool hard);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:69:void mt76x2_reset_wlan(struct mt76x02_dev *dev, bool enable);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:70:void mt76x2_init_txpower(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-71-\t\t\t struct ieee80211_supported_band *sband);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h=72=void mt76_write_mac_initvals(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-73-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:74:void mt76x2_phy_tssi_compensate(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:75:void mt76x2_phy_set_txpower_regs(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-76-\t\t\t\t enum nl80211_band band);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:77:void mt76x2_configure_tx_delay(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-78-\t\t\t       enum nl80211_band band, u8 bw);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:79:void mt76x2_apply_gain_adj(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:80:void mt76x2_phy_update_channel_gain(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-81-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-10-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:11:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-12-#include \"mcu.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-18-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:19:extern const struct ieee80211_ops mt76x2u_ops;\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-20-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:21:int mt76x2u_register_device(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:22:int mt76x2u_init_hardware(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:23:void mt76x2u_cleanup(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:24:void mt76x2u_stop_hw(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-25-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:26:int mt76x2u_mac_reset(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:27:int mt76x2u_mac_stop(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-28-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:29:int mt76x2u_phy_set_channel(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-30-\t\t\t    struct cfg80211_chan_def *chandef);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:31:void mt76x2u_phy_calibrate(struct work_struct *work);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-32-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:33:void mt76x2u_mcu_complete_urb(struct urb *urb);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:34:int mt76x2u_mcu_init(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:35:int mt76x2u_mcu_fw_init(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-36-\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:37:int mt76x2u_alloc_queues(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:38:void mt76x2u_queues_deinit(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:39:void mt76x2u_stop_queues(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h:40:int mt76x2u_skb_dma_info(struct sk_buff *skb, enum dma_msg_port port,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2u.h-41-\t\t\t u32 flags);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-9-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:10:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-11-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:12:static const struct pci_device_id mt76x2e_device_table[] = {\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-13-\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7662) },\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c=19=static int\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:20:mt76x2e_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-21-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-28-\t\t.update_survey = mt76x02_update_channel,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:29:\t\t.set_channel = mt76x2e_set_channel,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-30-\t\t.tx_prepare_skb = mt76x02_tx_prepare_skb,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-55-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:56:\tmdev = mt76_alloc_device(\u0026pdev-\u003edev, sizeof(*dev), \u0026mt76x2_ops,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-57-\t\t\t\t \u0026drv_ops);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-62-\tmt76_mmio_init(mdev, pcim_iomap_table(pdev)[0]);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:63:\tmt76x2_reset_wlan(dev, false);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-64-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-74-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:75:\tret = mt76x2_register_device(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-76-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c=100=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:101:mt76x2e_remove(struct pci_dev *pdev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-102-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-106-\tmt76_unregister_device(mdev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:107:\tmt76x2_cleanup(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-108-\tmt76_free_device(mdev);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c=111=static int __maybe_unused\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:112:mt76x2e_suspend(struct pci_dev *pdev, pm_message_t state)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-113-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c=140=static int __maybe_unused\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:141:mt76x2e_resume(struct pci_dev *pdev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-142-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-166-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:167:\treturn mt76x2_resume_device(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-168-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-169-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:170:MODULE_DEVICE_TABLE(pci, mt76x2e_device_table);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-171-MODULE_FIRMWARE(MT7662_FIRMWARE);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c=176=static struct pci_driver mt76pci_driver = {\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-177-\t.name\t\t= KBUILD_MODNAME,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:178:\t.id_table\t= mt76x2e_device_table,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:179:\t.probe\t\t= mt76x2e_probe,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:180:\t.remove\t\t= mt76x2e_remove,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-181-#ifdef CONFIG_PM\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:182:\t.suspend\t= mt76x2e_suspend,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c:183:\t.resume\t\t= mt76x2e_resume,\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci.c-184-#endif /* CONFIG_PM */\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-6-#include \u003clinux/delay.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:7:#include \"mt76x2.h\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-8-#include \"eeprom.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c=12=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:13:mt76x2_mac_pbf_init(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-14-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c=30=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:31:mt76x2_fixup_xtal(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-32-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-69-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:70:int mt76x2_mac_reset(struct mt76x02_dev *dev, bool hard)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-71-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-89-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:90:\tmt76x2_mac_pbf_init(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-91-\tmt76_write_mac_initvals(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:92:\tmt76x2_fixup_xtal(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-93-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c=141=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:142:mt76x2_power_on_rf_patch(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-143-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c=162=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:163:mt76x2_power_on_rf(struct mt76x02_dev *dev, int unit)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-164-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-178-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:179:\tmt76x2_power_on_rf_patch(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-180-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c=184=static void\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:185:mt76x2_power_on(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-186-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-215-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:216:\tmt76x2_power_on_rf(dev, 0);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:217:\tmt76x2_power_on_rf(dev, 1);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-218-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-219-\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:220:int mt76x2_resume_device(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-221-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c-224-\tmt76x02_dma_disable(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c:225:\tmt76x2_reset_wlan(dev, true);\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 19764
							output: 46
							thoughts: 259
						

**Fuzzing the MT76x2 Driver**

Okay, so I'm looking at this `mt76x2` driver, and I see it has both PCI (`mt76x2e`) and USB (`mt76x2u`) versions. Wait, *`mt76x2u`* is specifically the USB driver, right? Interesting. My first thought is to see if we can get it running in QEMU or perhaps use a USB gadget setup for testing. But then I remember, syzkaller has that nifty USB fuzzing subsystem, `vhci`. Brilliant! That means USB drivers are definitely fuzzable with syzkaller.

Now, I need to figure out a specific target. I recall seeing `mt76x2_get_min_rate_power` in `drivers/net/wireless/mediatek/mt76/mt76x2/phy.c`. The question is, does the USB variant, `mt76x2u`, actually use this code? Time to investigate. I'll dig into the build system. Ah, here's what I needed: `phy.c` is part of `mt76x2-common-y`, which is then linked into both the PCI and USB variants. So, `mt76x2-common` is a shared module. Excellent! Let's verify this in the `Makefile` in the `mt76x2` directory to be sure.

{
  "Expression": "mt76x2u",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt76x2/Makefile"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76x2/Makefile=3=obj-$(CONFIG_MT76x2E) += mt76x2e.o\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:4:obj-$(CONFIG_MT76x2U) += mt76x2u.o\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-5-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile=9=mt76x2e-y := \\\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-12-\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile:13:mt76x2u-y := \\\ndrivers/net/wireless/mediatek/mt76/mt76x2/Makefile-14-\tusb.o usb_init.o usb_main.o usb_mac.o usb_mcu.o \\\n"
}

gemini-3.1-pro-preview

null

null

							input: 20658
							output: 40
							thoughts: 58
						

Here's my thought process, as if I were considering this myself:

**Examining the MT76x2 Common Module Build Configuration**

Okay, so I'm focusing on the `mt76x2-common-y` build flag. Right, it's pretty clear that it's conditionally built, but the condition is key. It's built only when `CONFIG_MT76x2_COMMON` is defined. This is standard kernel module configuration logic. Now, I need to see *where* `CONFIG_MT76x2_COMMON` gets its value. The logical place to look is the Kconfig file associated with this driver. So, I need to open and examine `drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig`. That's where I'll find the definition, defaults, and potentially, any dependencies that impact the setting of that config option. Let's see what we find in there.

no matches

{
  "Expression": "MT76x2",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/Kconfig"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 20980
							output: 38
							thoughts: 29
						

Okay, let's dive into this. Here's how I'd approach this task, as if these were my internal thoughts:

**Investigating MT76 Configuration Options**

Alright, I need to get a handle on the `MT76` configurations. Time to dig into the source tree. Specifically, I'm going straight to the `drivers/net/wireless/mediatek/mt76/Kconfig` file. That's the logical place to start – it's where the kernel configuration options related to the Mediatek MT76 wireless drivers should be defined. From there I'll be able to work out what's available and, if necessary, trace dependencies or find more detailed explanations. This will give me a good overview of the possible configurations.

{
  "Expression": "MT76",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/Kconfig"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/Kconfig:2:config MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-3-\ttristate\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig-5-\ndrivers/net/wireless/mediatek/mt76/Kconfig:6:config MT76_LEDS\ndrivers/net/wireless/mediatek/mt76/Kconfig-7-\tbool\ndrivers/net/wireless/mediatek/mt76/Kconfig:8:\tdepends on MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig:9:\tdepends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS\ndrivers/net/wireless/mediatek/mt76/Kconfig-10-\tdefault y\ndrivers/net/wireless/mediatek/mt76/Kconfig-11-\ndrivers/net/wireless/mediatek/mt76/Kconfig:12:config MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-13-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:14:\tdepends on MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/Kconfig:16:config MT76_SDIO\ndrivers/net/wireless/mediatek/mt76/Kconfig-17-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:18:\tdepends on MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-19-\ndrivers/net/wireless/mediatek/mt76/Kconfig:20:config MT76x02_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-21-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:22:\tselect MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-23-\ndrivers/net/wireless/mediatek/mt76/Kconfig:24:config MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-25-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:26:\tselect MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-27-\ndrivers/net/wireless/mediatek/mt76/Kconfig:28:config MT76_CONNAC_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-29-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:30:\tselect MT76_CORE\ndrivers/net/wireless/mediatek/mt76/Kconfig-31-\ndrivers/net/wireless/mediatek/mt76/Kconfig=32=config MT792x_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-33-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:34:\tselect MT76_CONNAC_LIB\ndrivers/net/wireless/mediatek/mt76/Kconfig-35-\ndrivers/net/wireless/mediatek/mt76/Kconfig=36=config MT792x_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-37-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:38:\tselect MT76_USB\ndrivers/net/wireless/mediatek/mt76/Kconfig-39-\ndrivers/net/wireless/mediatek/mt76/Kconfig:40:config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:42:\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-43-\n"
}

gemini-3.1-pro-preview

null

null

							input: 22297
							output: 42
							thoughts: 27
						

Here's my take on those thoughts:

**Analyzing the Mediatek Wireless Driver Configuration**

Okay, so I need to dive into the Mediatek wireless driver code, specifically the `mt76x2` family, and I'm starting with the Kconfig file. Let me see... I'll pull up `drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig`. This is where all the configuration options for this specific driver version are defined. I expect to find things like feature toggles (802.11ac support, security protocols, etc.), debug settings, and maybe some platform-specific configurations. Understanding this Kconfig is crucial before I start digging into the driver's core logic because it dictates which parts of the driver are compiled and how they behave on different systems. It'll give me a roadmap of what's *possible* to configure and helps narrow down what's relevant to my current task or debugging effort. Let's see what goodies are in there...

{
  "Expression": ".*",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:1:# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:2:config MT76x2_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:3:\ttristate\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:4:\tselect MT76x02_LIB\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:5:\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:6:config MT76x2E\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:7:\ttristate \"MediaTek MT76x2E (PCIe) support\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:8:\tselect MT76x2_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:9:\tdepends on MAC80211\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:10:\tdepends on PCI\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:11:\thelp\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:12:\t  This adds support for MT7612/MT7602/MT7662-based PCIe wireless\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:13:\t  devices, which comply with IEEE 802.11ac standards and support\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:14:\t  2SS to 866Mbit/s PHY rate.\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:15:\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:16:\t  To compile this driver as a module, choose M here.\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:17:\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:18:config MT76x2U\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:19:\ttristate \"MediaTek MT76x2U (USB) support\"\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:20:\tselect MT76x2_COMMON\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:21:\tselect MT76x02_USB\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:22:\tdepends on MAC80211\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:23:\tdepends on USB\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:24:\thelp\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:25:\t  This adds support for MT7612U-based USB 3.0 wireless dongles,\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:26:\t  which comply with IEEE 802.11ac standards and support 2SS to\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:27:\t  866Mbit/s PHY rate.\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:28:\ndrivers/net/wireless/mediatek/mt76/mt76x2/Kconfig:29:\t  To compile this driver as a module, choose M here.\n"
}

gemini-3.1-pro-preview

null

null

							input: 23632
							output: 52
							thoughts: 113
						

**Analyzing the MT76x2U USB Driver**

Okay, so I'm looking at `CONFIG_MT76x2U`. Right, that's the USB driver for the MT76x2U chipset. It's pretty straightforward, it depends on the core wireless stack, `MAC80211`, and the `USB` subsystem, naturally. If I enable this driver, the configuration will pull in `MT76x2_COMMON`, which, if I recall correctly, builds the `phy.c` file.

Now, I need to make sure I'm thinking clearly about this connection. The question that has popped into my head is whether the function `mt76x2_get_min_rate_power` is accessible and used directly from the USB driver code path. It's potentially a key piece, and I don't want any assumptions to bite me later. Time to trace the call graph; I should go double-check where that function is actually invoked. I need to be certain that the USB driver can indeed call into that PHY-related function.

{
  "Expression": "mt76x2_get_min_rate_power",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt76x2/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76x2/phy.c=118=static int\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:119:mt76x2_get_min_rate_power(struct mt76x02_rate_power *r)\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-120-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c=130=void mt76x2_phy_set_txpower(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-150-\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:151:\tbase_power = mt76x2_get_min_rate_power(\u0026t);\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-152-\tdelta = base_power - txp.target_power;\n"
}

gemini-3.1-pro-preview

null

null

							input: 24333
							output: 51
							thoughts: 41
						

Okay, here's my interpretation of that thought process, assuming I'm deep in the weeds of embedded wireless driver development:

**Tracing Down the Transmitter Power Setting**

Alright, so the function in question is `mt76x2_phy_set_txpower`. I know this is responsible for setting the transmit power levels for the MT76x2 PHY. The goal here is to understand how this is being called and how the power levels are ultimately configured. Let's start with a systematic approach. The most logical first step is to trace back the call chain. I need to figure out where `mt76x2_phy_set_txpower` is *actually* being invoked. So, I need to see exactly where this function is called from within the driver's code. Knowing the call context is critical.

{
  "Expression": "mt76x2_phy_set_txpower",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt76x2/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76x2/init.c=11=int mt76x2_set_sar_specs(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-31-\tif (test_bit(MT76_STATE_RUNNING, \u0026mphy-\u003estate))\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c:32:\t\tmt76x2_phy_set_txpower(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/init.c-33-out:\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h=57=void mt76x2_phy_calibrate(struct work_struct *work);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:58:void mt76x2_phy_set_txpower(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-59-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h=74=void mt76x2_phy_tssi_compensate(struct mt76x02_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h:75:void mt76x2_phy_set_txpower_regs(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/mt76x2.h-76-\t\t\t\t enum nl80211_band band);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c=57=mt76x2_config(struct ieee80211_hw *hw, int radio_idx, u32 changed)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c-82-\t\tif (test_bit(MT76_STATE_RUNNING, \u0026dev-\u003emphy.state)) {\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c:83:\t\t\tmt76x2_phy_set_txpower(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c-84-\t\t\tmt76x02_tx_set_txpwr_auto(dev, dev-\u003etxpower_conf);\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_phy.c=117=int mt76x2_phy_set_channel(struct mt76x02_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_phy.c-184-\tmt76x2_read_rx_gain(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_phy.c:185:\tmt76x2_phy_set_txpower_regs(dev, band);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_phy.c-186-\tmt76x2_configure_tx_delay(dev, band, bw);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_phy.c:187:\tmt76x2_phy_set_txpower(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/pci_phy.c-188-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c=43=EXPORT_SYMBOL_GPL(mt76x2_apply_gain_adj);\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-44-\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:45:void mt76x2_phy_set_txpower_regs(struct mt76x02_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-46-\t\t\t\t enum nl80211_band band)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-115-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:116:EXPORT_SYMBOL_GPL(mt76x2_phy_set_txpower_regs);\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-117-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c=119=mt76x2_get_min_rate_power(struct mt76x02_rate_power *r)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-129-\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:130:void mt76x2_phy_set_txpower(struct mt76x02_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-131-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-174-}\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:175:EXPORT_SYMBOL_GPL(mt76x2_phy_set_txpower);\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-176-\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c=53=mt76x2u_config(struct ieee80211_hw *hw, int radio_idx, u32 changed)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c-78-\t\tif (test_bit(MT76_STATE_RUNNING, \u0026mphy-\u003estate))\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c:79:\t\t\tmt76x2_phy_set_txpower(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_main.c-80-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_phy.c=60=int mt76x2u_phy_set_channel(struct mt76x02_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_phy.c-121-\tmt76x2_read_rx_gain(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_phy.c:122:\tmt76x2_phy_set_txpower_regs(dev, chan-\u003eband);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_phy.c-123-\tmt76x2_configure_tx_delay(dev, chan-\u003eband, bw);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_phy.c:124:\tmt76x2_phy_set_txpower(dev);\ndrivers/net/wireless/mediatek/mt76/mt76x2/usb_phy.c-125-\n"
}

gemini-3.1-pro-preview

null

null

							input: 26625
							output: 55
							thoughts: 388
						

**Reaching the `mt76x2_phy_set_txpower` Function: A Fuzzing Strategy**

Okay, here's the breakdown. `mt76x2_phy_set_txpower` is called from two key places: `mt76x2u_config` and `mt76x2u_phy_set_channel` within the `usb_main.c` and `usb_phy.c` files. This immediately tells me we're dealing with code directly accessible through the `mt76x2u` USB driver. And since syzkaller is capable of emulating USB devices using `vhci`, this looks very promising for fuzzing. We have a direct path in.

Now, a thought - `mt76x2u_config` is also triggered when configuring the device through mac80211, which opens up another avenue - `netlink` (specifically `nl80211`). If we can emulate the USB device, mac80211 will recognize it, and then we should be able to trigger `mt76x2u_config` or `mt76x2u_phy_set_channel` through the `nl80211` commands. This opens the door to using these commands to trigger the vulnerable code directly.

Before we move forward, let's verify the build configuration. The crucial option is `CONFIG_MT76x2U`. But does it have any dependencies? Looks like it depends on `MAC80211` and `USB`, but that is it. It seems `CONFIG_MT76x2U` itself is sufficient. Good, it selects `MT76x2_COMMON`, which, in turn, builds the `phy.c` file.

Now, the final point - the function `mt76x2_get_min_rate_power`. I need to confirm whether it is static. It's static within `phy.c`.
The patch must have modified this function. We must confirm this by checking the `phy.c` file itself.

{
  "Expression": "mt76x2_get_min_rate_power",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt76x2/phy.c"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76x2/phy.c=118=static int\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:119:mt76x2_get_min_rate_power(struct mt76x02_rate_power *r)\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-120-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c=130=void mt76x2_phy_set_txpower(struct mt76x02_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-150-\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c:151:\tbase_power = mt76x2_get_min_rate_power(\u0026t);\ndrivers/net/wireless/mediatek/mt76/mt76x2/phy.c-152-\tdelta = base_power - txp.target_power;\n"
}

gemini-3.1-pro-preview

null

null

							input: 27825
							output: 30
							thoughts: 778
						

**Analyzing the Patch: Refactoring vs. Functionality**

Okay, so I'm looking at this patch and my initial thought is, "Yes, this seems pretty static." The caller is `mt76x2_phy_set_txpower`, which is exported. That's a good starting point, so it seems like `FocusSymbols` should indeed be `mt76x2_phy_set_txpower`.

Let's quickly verify – are there any other functions that call `mt76x2_phy_set_txpower`? Looks like it's called from `mt76x2u_config`, `mt76x2u_phy_set_channel`, `mt76x2_set_sar_specs`, `mt76x2_config`, and `mt76x2_phy_set_channel`. Confirms my initial assessment, `mt76x2_phy_set_txpower` is a solid focus symbol.

But wait, looking at the actual code change:

```c
-	for (i = 0; i < sizeof(r->all); i++) {
-		if (!r->all[i])
-			continue;
-
-		if (ret)
-			ret = min(ret, r->all[i]);
-		else
-			ret = r->all[i];
-	}
+	for (i = 0; i < sizeof(r->all); i++)
+		ret = min_not_zero(ret, r->all[i]);
```

That's where the question mark pops up. Is this a functional change, a *real* change? I need to analyze this closely. It seems to just replace an existing loop with `min_not_zero`. But does this fundamentally change how the program behaves? Let's break it down:

Essentially, `min_not_zero` appears to be doing exactly what the old code was doing. If `ret` is 0, it returns `r->all[i]` (provided `r->all[i]` isn't also 0). If `r->all[i]` is 0, it returns `ret`. If neither is zero, it finds the minimum. Now, if I remember correctly the old code had an equivalent logic: if `!r->all[i]`, we skip to the next element, if `ret` is not 0, `ret` will become the minimum between `ret` and `r->all[i]`, and if `ret` is 0, `ret` is `r->all[i]`. This matches the behavior of `min_not_zero`.

So, it's not a functional *change*, not a change in behavior, but rather a *refactoring* to use `min_not_zero`. Is that right? I think it is.

Now, wait a minute, the prompt says... and I read through the list: "Return WorthFuzzing=false if the patch only contains [specific types of changes]..." and one of those is: "Changes to numeric constants or macros that do not functionally alter execution flow".

So, this change boils down to replacing a manual implementation of `min_not_zero` with a `min_not_zero` macro. The key here is to determine whether execution flow is functionally altered. Since `min_not_zero` is a macro, I should check how the macro is defined, but it seems unlikely that the patch will introduce a functional change.

{
  "Expression": "define min_not_zero",
  "PathPrefix": "include/linux/"
}

{
  "Output": "include/linux/minmax.h-175- */\ninclude/linux/minmax.h:176:#define min_not_zero(x, y) ({\t\t\t\\\ninclude/linux/minmax.h-177-\ttypeof(x) __x = (x);\t\t\t\\\n"
}

gemini-3.1-pro-preview

null

null

							input: 29482
							output: 36
							thoughts: 13
						

Okay, here's my interpretation of that thought process, tailored for an expert audience:

**Analyzing the `min_not_zero` Macro**

Alright, let's dive in. The core thought here is to examine the `min_not_zero` macro. I'm immediately thinking about its intended functionality. What's it designed to do? My guess, based on the name, is that it aims to find the minimum value from a set of inputs, but with the added constraint of excluding any zero values. This implies a need for a specific logic to handle potential zero inputs and correctly identify the smallest *non-zero* value. I wonder how the implementation handles edge cases: what happens if all inputs are zero? Does it return a specific value, an error, or perhaps an optional type? I'm already anticipating questions about performance; is the implementation efficient, or are there potential optimizations I could consider regarding branching or short-circuiting? Finally, I need to evaluate its overall design: does it adhere to established coding conventions, and is it easily understandable and maintainable? I'm ready to dig in and see how it works under the hood.

{
  "File": "include/linux/minmax.h",
  "FirstLine": 170,
  "LineCount": 20
}

{
  "Contents": " 170:\t\n 171:\t/**\n 172:\t * min_not_zero - return the minimum that is _not_ zero, unless both are zero\n 173:\t * @x: value1\n 174:\t * @y: value2\n 175:\t */\n 176:\t#define min_not_zero(x, y) ({\t\t\t\\\n 177:\t\ttypeof(x) __x = (x);\t\t\t\\\n 178:\t\ttypeof(y) __y = (y);\t\t\t\\\n 179:\t\t__x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); })\n 180:\t\n 181:\t#define __clamp(val, lo, hi)\t\\\n 182:\t\t((val) \u003e= (hi) ? (hi) : ((val) \u003c= (lo) ? (lo) : (val)))\n 183:\t\n 184:\t#define __clamp_once(type, val, lo, hi, uval, ulo, uhi) ({\t\t\t\\\n 185:\t\ttype uval = (val);\t\t\t\t\t\t\t\\\n 186:\t\ttype ulo = (lo);\t\t\t\t\t\t\t\\\n 187:\t\ttype uhi = (hi);\t\t\t\t\t\t\t\\\n 188:\t\tBUILD_BUG_ON_MSG(statically_true(ulo \u003e uhi),\t\t\t\t\\\n 189:\t\t\t\"clamp() low limit \" #lo \" greater than high limit \" #hi);\t\\\n"
}

gemini-3.1-pro-preview

null

null

							input: 30158
							output: 45
							thoughts: 72
						

Okay, let's see what we have here.

**Analyzing the Macro's Functionality**

Alright, first things first, the macro seems to be replicating the behavior of the existing code. That's good, a good starting point. But, hang on a second... I see `r->all`, which is an array of `s8`. Okay, let's just make sure I have that correct in my head.

```c
struct mt76x02_rate_power {
	s8 all[...];
};
```

Right, a `struct mt76x02_rate_power` where `all` is an array of signed 8-bit integers. Let me take a look at the definition of `struct mt76x02_rate_power` just to be certain about the context of the array. I need to understand what this array represents within the larger data structure and how it relates to the rate control process. That's where I need to start.

{
  "Expression": "struct mt76x02_rate_power \\{",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt76x02.h=63=struct mt76x02_beacon_ops {\n--\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-74-\ndrivers/net/wireless/mediatek/mt76/mt76x02.h:75:struct mt76x02_rate_power {\ndrivers/net/wireless/mediatek/mt76/mt76x02.h-76-\tunion {\n"
}

gemini-3.1-pro-preview

null

null

							input: 30636
							output: 48
							thoughts: 17
						

Here's a first-person summary, tailored for an expert audience, based on the prompt:

**Diving into the `mt76x02_rate_power` Structure**

Okay, let's take a look at the `struct mt76x02_rate_power`. My guess is that this is where the Mediatek 7602 driver (or a related family) stores the power configuration data for different data rates. Given my experience, I'm expecting to see members related to output power levels (in dBm, probably, or maybe an internal representation). There might be different power tables for different bands (2.4 GHz vs. 5 GHz), channel widths (20/40/80 MHz), and modulation schemes (OFDM, HT, VHT, etc.).

I'd be particularly interested to see how they handle power back-off mechanisms. Do they account for temperature, or perhaps link quality feedback to dynamically adjust the transmit power? Are there any per-antenna power adjustments in here? And how is this structure associated with the hardware registers? Is there a direct mapping, or do they use some kind of intermediate representation for power control?

This structure is a crucial piece of the puzzle for understanding how the driver manages transmit power, and I'm eager to dig in and understand its nuances. This is where I'll get an understanding of the relationship between data rates, modulation/coding schemes and power settings.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt76x02.h",
  "FirstLine": 70,
  "LineCount": 30
}

{
  "Contents": "  70:\t#define mt76x02_beacon_enable(dev, enable)\t\\\n  71:\t\t(dev)-\u003ebeacon_ops-\u003ebeacon_enable(dev, enable)\n  72:\t#define mt76x02_pre_tbtt_enable(dev, enable)\t\\\n  73:\t\t(dev)-\u003ebeacon_ops-\u003epre_tbtt_enable(dev, enable)\n  74:\t\n  75:\tstruct mt76x02_rate_power {\n  76:\t\tunion {\n  77:\t\t\tstruct {\n  78:\t\t\t\ts8 cck[4];\n  79:\t\t\t\ts8 ofdm[8];\n  80:\t\t\t\ts8 ht[16];\n  81:\t\t\t\ts8 vht[2];\n  82:\t\t\t};\n  83:\t\t\ts8 all[30];\n  84:\t\t};\n  85:\t};\n  86:\t\n  87:\tstruct mt76x02_dev {\n  88:\t\tunion { /* must be first */\n  89:\t\t\tstruct mt76_dev mt76;\n  90:\t\t\tstruct mt76_phy mphy;\n  91:\t\t};\n  92:\t\n  93:\t\tstruct mac_address macaddr_list[8];\n  94:\t\n  95:\t\tstruct mutex phy_mutex;\n  96:\t\n  97:\t\tu8 txdone_seq;\n  98:\t\tDECLARE_KFIFO_PTR(txstatus_fifo, struct mt76x02_tx_status);\n  99:\t\tspinlock_t txstatus_fifo_lock;\n"
}

gemini-3.1-pro-preview

null

null

							input: 31425
							output: 81
							thoughts: 1181
						

**Analysis of the Code Change**

Okay, so I'm looking at this patch. It seems like the core change revolves around replacing a loop that finds the minimum non-zero value with a call to the `min_not_zero` macro. Let's break this down.

Initially, I see that `r->all` is an array of `s8` (signed 8-bit integers) of size 30. The old code iterated through this array, skipping zero values, and finding the minimum non-zero value. The new code simply uses `min_not_zero`.

My first thought is, "Is there any *functional* difference here?" It looks like a straightforward refactoring. `min_not_zero` uses `typeof(x)` and `typeof(y)`. Both `ret` and `r->all[i]` are `s8`, so the `min` macro inside should be comparing `s8` values. It appears that the `min_not_zero` macro is essentially doing the same thing as the original loop, but using the macro, which I understand.

I have to carefully consider edge cases. Let's say `r->all[i]` is negative. The original code has `!r->all[i]`. In the case of a negative value, `!r->all[i]` will be false, so it won't `continue`. This is important. If `ret` is also negative, the comparison within the loop would still work as expected, using the `min` macro.

Now, what does `min_not_zero` do? It looks like it checks `__x == 0` and `__y == 0`. It returns `__y` if `__x` is zero, and returns `__x` if `__y` is zero. If both are non-zero, it returns the minimum. This is the same logic as the old code.

I need to confirm there is no subtle bug in `min_not_zero` when dealing with negative numbers. If `x` is -5 and `y` is 0, then `min_not_zero(-5, 0)` returns -5. Consider the old code; initial `ret` = 0, and `r->all[i]` = -5. The `!r->all[i]` would be `false` (i.e. not continue), `ret` becomes -5. Then the loop continues, when `r->all[i]` is 0, the `!r->all[i]` is true (continue), and the old `ret` stays at -5. Therefore, there's no difference.

I am concluding that this is a purely refactoring change and that it doesn't change the execution flow. I need to be sure this is correct. I will carefully consider any other changes included in the diff.

The prompt specifically says that changes to numeric constants or macros that don't functionally alter execution flow means the patch is not worth fuzzing.

I've examined the full diff, it only does what I described. I am satisfied. This is a purely cosmetic refactoring that doesn't affect behavior. It is not worth fuzzing. I have a thorough reasoning of why I think the result is `WorthFuzzing=false`. The `min_not_zero` macro is implemented to do the same thing as the old implementation. My checks for type safety in `min` and negative number handling also confirm this.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch replaces a manual implementation of finding the minimum non-zero value in an array with the standard `min_not_zero` macro. This is a purely cosmetic refactoring that does not functionally alter the execution flow or behavior of the driver.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch replaces a manual implementation of finding the minimum non-zero value in an array with the standard `min_not_zero` macro. This is a purely cosmetic refactoring that does not functionally alter the execution flow or behavior of the driver.",
  "WorthFuzzing": false
}