AI Trajectory

null

{
  "EnableConfigs": [
    "MAC80211",
    "CFG80211",
    "ATH11K",
    "MAC80211_DEBUGFS"
  ],
  "FocusSymbols": [
    "ieee80211_txq_airtime_check",
    "ieee80211_aql_sta_limit",
    "ieee80211_next_txq",
    "ieee80211_tx_dequeue",
    "__ath11k_mac_register"
  ],
  "KMSANReasoning": "The patch adds the `IEEE80211_HW_TX_NO_PUSHBACK` hardware flag for mac80211/ath11k and adjusts station Airtime Queue Limit (AQL) calculations based on station airtime weight when this flag is enabled.\n\nAll struct fields accessed (such as `sta-\u003eairtime_weight`, `local-\u003eaql_threshold`, and `sta-\u003eairtime[].aql_limit_*`) are standard integer fields initialized during station creation and driver configuration. Local variables in the new calculation helper `ieee80211_aql_sta_limit()` are explicitly assigned before use. No heap/stack allocations, memory copy operations to user space, or uninitialized memory reads are introduced or modified.\n\nTherefore, dedicated KMSAN fuzzing is not needed; any standard concurrency or logic issues are covered by standard KASAN/kernel debugging tools.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch introduces the IEEE80211_HW_TX_NO_PUSHBACK hardware flag and adds station airtime queue limit calculation (ieee80211_aql_sta_limit) to the mac80211 TX queue airtime check (ieee80211_txq_airtime_check). The mac80211 subsystem is reachable in virtualized environments via mac80211_hwsim and nl80211 interfaces, making these queue scheduling and airtime calculation changes worth fuzzing.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 111651b156fc2196665dddf9db62beac67715504\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Sep 8 18:09:27 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c\nindex 2d55cdc4d165d..87e6062c55509 100644\n--- a/drivers/net/wireless/ath/ath11k/mac.c\n+++ b/drivers/net/wireless/ath/ath11k/mac.c\n@@ -10494,6 +10494,7 @@ static int __ath11k_mac_register(struct ath11k *ar)\n \n \tieee80211_hw_set(ar-\u003ehw, SIGNAL_DBM);\n \tieee80211_hw_set(ar-\u003ehw, SUPPORTS_PS);\n+\tieee80211_hw_set(ar-\u003ehw, TX_NO_PUSHBACK);\n \tieee80211_hw_set(ar-\u003ehw, SUPPORTS_DYNAMIC_PS);\n \tieee80211_hw_set(ar-\u003ehw, MFP_CAPABLE);\n \tieee80211_hw_set(ar-\u003ehw, REPORTS_TX_ACK_STATUS);\ndiff --git a/include/net/mac80211.h b/include/net/mac80211.h\nindex 7bb4618065b67..80381c7abd84a 100644\n--- a/include/net/mac80211.h\n+++ b/include/net/mac80211.h\n@@ -3086,6 +3086,12 @@ struct ieee80211_txq {\n  * @IEEE80211_HW_SUPPORTS_NDP_BLOCKACK: HW can transmit/receive S1G NDP\n  *\tBlockAck frames.\n  *\n+ * @IEEE80211_HW_TX_NO_PUSHBACK: The driver hands every frame it dequeues\n+ *\tto the hardware at once, and the hardware picks the station it serves\n+ *\tnext, so the order in which mac80211 schedules the queues does not\n+ *\treach the air. mac80211 then applies the airtime weight to the\n+ *\tairtime queue limit instead.\n+ *\n  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays\n  */\n enum ieee80211_hw_flags {\n@@ -3147,6 +3153,7 @@ enum ieee80211_hw_flags {\n \tIEEE80211_HW_HANDLES_QUIET_CSA,\n \tIEEE80211_HW_STRICT,\n \tIEEE80211_HW_SUPPORTS_NDP_BLOCKACK,\n+\tIEEE80211_HW_TX_NO_PUSHBACK,\n \n \t/* keep last, obviously */\n \tNUM_IEEE80211_HW_FLAGS\ndiff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c\nindex 8946b027782cf..ddbfa991ec74e 100644\n--- a/net/mac80211/debugfs.c\n+++ b/net/mac80211/debugfs.c\n@@ -462,6 +462,7 @@ static const char *hw_flag_names[] = {\n \tFLAG(HANDLES_QUIET_CSA),\n \tFLAG(STRICT),\n \tFLAG(SUPPORTS_NDP_BLOCKACK),\n+\tFLAG(TX_NO_PUSHBACK),\n #undef FLAG\n };\n \ndiff --git a/net/mac80211/tx.c b/net/mac80211/tx.c\nindex c33092960df26..c94efff48d747 100644\n--- a/net/mac80211/tx.c\n+++ b/net/mac80211/tx.c\n@@ -4217,6 +4217,21 @@ EXPORT_SYMBOL(__ieee80211_schedule_txq);\n \n DEFINE_STATIC_KEY_FALSE(aql_disable);\n \n+static u32 ieee80211_aql_sta_limit(struct ieee80211_local *local,\n+\t\t\t\t   struct sta_info *sta, u32 limit)\n+{\n+\tu32 scaled;\n+\n+\tif (!ieee80211_hw_check(\u0026local-\u003ehw, TX_NO_PUSHBACK) ||\n+\t    sta-\u003eairtime_weight == IEEE80211_DEFAULT_AIRTIME_WEIGHT)\n+\t\treturn limit;\n+\n+\tscaled = mult_frac(limit, sta-\u003eairtime_weight,\n+\t\t\t   IEEE80211_DEFAULT_AIRTIME_WEIGHT);\n+\n+\treturn min(scaled, max(limit, local-\u003eaql_threshold));\n+}\n+\n bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,\n \t\t\t\t struct ieee80211_txq *txq)\n {\n@@ -4238,13 +4253,15 @@ bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,\n \n \tsta = container_of(txq-\u003esta, struct sta_info, sta);\n \tif (atomic_read(\u0026sta-\u003eairtime[txq-\u003eac].aql_tx_pending) \u003c\n-\t    sta-\u003eairtime[txq-\u003eac].aql_limit_low)\n+\t    ieee80211_aql_sta_limit(local, sta,\n+\t\t\t\t    sta-\u003eairtime[txq-\u003eac].aql_limit_low))\n \t\treturn true;\n \n \tif (atomic_read(\u0026local-\u003eaql_total_pending_airtime) \u003c\n \t    local-\u003eaql_threshold \u0026\u0026\n \t    atomic_read(\u0026sta-\u003eairtime[txq-\u003eac].aql_tx_pending) \u003c\n-\t    sta-\u003eairtime[txq-\u003eac].aql_limit_high)\n+\t    ieee80211_aql_sta_limit(local, sta,\n+\t\t\t\t    sta-\u003eairtime[txq-\u003eac].aql_limit_high))\n \t\treturn true;\n \n \treturn false;\n"
}

core

null

{
  "EnableConfigs": [
    "MAC80211",
    "CFG80211",
    "ATH11K",
    "MAC80211_DEBUGFS"
  ],
  "FocusSymbols": [
    "ieee80211_txq_airtime_check",
    "ieee80211_aql_sta_limit",
    "ieee80211_next_txq",
    "ieee80211_tx_dequeue",
    "__ath11k_mac_register"
  ],
  "Reasoning": "The patch introduces the IEEE80211_HW_TX_NO_PUSHBACK hardware flag and adds station airtime queue limit calculation (ieee80211_aql_sta_limit) to the mac80211 TX queue airtime check (ieee80211_txq_airtime_check). The mac80211 subsystem is reachable in virtualized environments via mac80211_hwsim and nl80211 interfaces, making these queue scheduling and airtime calculation changes worth fuzzing.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 111651b156fc2196665dddf9db62beac67715504
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Sep 8 18:09:27 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 2d55cdc4d165d..87e6062c55509 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -10494,6 +10494,7 @@ static int __ath11k_mac_register(struct ath11k *ar)
 
 	ieee80211_hw_set(ar->hw, SIGNAL_DBM);
 	ieee80211_hw_set(ar->hw, SUPPORTS_PS);
+	ieee80211_hw_set(ar->hw, TX_NO_PUSHBACK);
 	ieee80211_hw_set(ar->hw, SUPPORTS_DYNAMIC_PS);
 	ieee80211_hw_set(ar->hw, MFP_CAPABLE);
 	ieee80211_hw_set(ar->hw, REPORTS_TX_ACK_STATUS);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 7bb4618065b67..80381c7abd84a 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3086,6 +3086,12 @@ struct ieee80211_txq {
  * @IEEE80211_HW_SUPPORTS_NDP_BLOCKACK: HW can transmit/receive S1G NDP
  *	BlockAck frames.
  *
+ * @IEEE80211_HW_TX_NO_PUSHBACK: The driver hands every frame it dequeues
+ *	to the hardware at once, and the hardware picks the station it serves
+ *	next, so the order in which mac80211 schedules the queues does not
+ *	reach the air. mac80211 then applies the airtime weight to the
+ *	airtime queue limit instead.
+ *
  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
  */
 enum ieee80211_hw_flags {
@@ -3147,6 +3153,7 @@ enum ieee80211_hw_flags {
 	IEEE80211_HW_HANDLES_QUIET_CSA,
 	IEEE80211_HW_STRICT,
 	IEEE80211_HW_SUPPORTS_NDP_BLOCKACK,
+	IEEE80211_HW_TX_NO_PUSHBACK,
 
 	/* keep last, obviously */
 	NUM_IEEE80211_HW_FLAGS
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 8946b027782cf..ddbfa991ec74e 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -462,6 +462,7 @@ static const char *hw_flag_names[] = {
 	FLAG(HANDLES_QUIET_CSA),
 	FLAG(STRICT),
 	FLAG(SUPPORTS_NDP_BLOCKACK),
+	FLAG(TX_NO_PUSHBACK),
 #undef FLAG
 };
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c33092960df26..c94efff48d747 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4217,6 +4217,21 @@ EXPORT_SYMBOL(__ieee80211_schedule_txq);
 
 DEFINE_STATIC_KEY_FALSE(aql_disable);
 
+static u32 ieee80211_aql_sta_limit(struct ieee80211_local *local,
+				   struct sta_info *sta, u32 limit)
+{
+	u32 scaled;
+
+	if (!ieee80211_hw_check(&local->hw, TX_NO_PUSHBACK) ||
+	    sta->airtime_weight == IEEE80211_DEFAULT_AIRTIME_WEIGHT)
+		return limit;
+
+	scaled = mult_frac(limit, sta->airtime_weight,
+			   IEEE80211_DEFAULT_AIRTIME_WEIGHT);
+
+	return min(scaled, max(limit, local->aql_threshold));
+}
+
 bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
 				 struct ieee80211_txq *txq)
 {
@@ -4238,13 +4253,15 @@ bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
 
 	sta = container_of(txq->sta, struct sta_info, sta);
 	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
-	    sta->airtime[txq->ac].aql_limit_low)
+	    ieee80211_aql_sta_limit(local, sta,
+				    sta->airtime[txq->ac].aql_limit_low))
 		return true;
 
 	if (atomic_read(&local->aql_total_pending_airtime) <
 	    local->aql_threshold &&
 	    atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
-	    sta->airtime[txq->ac].aql_limit_high)
+	    ieee80211_aql_sta_limit(local, sta,
+				    sta->airtime[txq->ac].aql_limit_high))
 		return true;
 
 	return false;

gemini-3.7-flash

null

null

							input: 4294
							output: 43
							thoughts: 375
						

**Analyzing the Patch for Fuzzing Potential**

Okay, let's break this down. First, I need to figure out if this patch is even *worth* fuzzing. We have a patch diff with changes in `ath11k/mac.c`, `mac80211.h`, `debugfs.c`, and `tx.c`. The core seems to be around a `TX_NO_PUSHBACK` flag, and the addition of `ieee80211_aql_sta_limit()` in the transmit path. This definitely warrants a closer look.

My initial thought is to determine the reachability of these areas of code within the broader Linux kernel, specifically within the mac80211 wireless subsystem. Given mac80211's core role in wireless networking, it should be a juicy target. Luckily, since I already know syzkaller has had success fuzzing mac80211 via `mac80211_hwsim`, `virt_wifi`, `cfg80211`, and `nl80211`, that's a good starting point. This suggests it is definitely fuzzable in standard virtualized environments like QEMU and GCE, which is a great sign.

Next step: let's verify mac80211's place in the wireless stack. I need to confirm its role in this specific area – is it core, or reachable through the interfaces I mentioned? Then I need to understand the config options controlling these bits. I'll need to use some `grep` magic in the kernel source to look for configurations and call graphs. I want to understand exactly *how* these new changes are used, and what configurations are required to trigger them. This will guide my fuzzing setup.

{
  "Expression": "ieee80211_txq_airtime_check",
  "PathPrefix": "net/mac80211"
}

{
  "Output": "net/mac80211/tx.c=3886=struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,\n--\nnet/mac80211/tx.c-3904-\nnet/mac80211/tx.c:3905:\tif (!ieee80211_txq_airtime_check(hw, txq))\nnet/mac80211/tx.c-3906-\t\treturn NULL;\n--\nnet/mac80211/tx.c=4115=struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)\n--\nnet/mac80211/tx.c-4144-\nnet/mac80211/tx.c:4145:\taql_check = ieee80211_txq_airtime_check(hw, \u0026txqi-\u003etxq);\nnet/mac80211/tx.c-4146-\tif (aql_check)\n--\nnet/mac80211/tx.c=4220=static u32 ieee80211_aql_sta_limit(struct ieee80211_local *local,\n--\nnet/mac80211/tx.c-4234-\nnet/mac80211/tx.c:4235:bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,\nnet/mac80211/tx.c-4236-\t\t\t\t struct ieee80211_txq *txq)\n--\nnet/mac80211/tx.c-4268-}\nnet/mac80211/tx.c:4269:EXPORT_SYMBOL(ieee80211_txq_airtime_check);\nnet/mac80211/tx.c-4270-\n"
}

gemini-3.7-flash

null

null

							input: 5640
							output: 41
							thoughts: 38
						

Here's my summary, as if I were thinking these thoughts:

**Analyzing `ieee80211_aql_sta_limit` in `net/mac80211/tx.c`**

Okay, I need to dig into how this AQL (Airtime Fairness Queue Length) station limit is being handled. The obvious place to start is `net/mac80211/tx.c`, where I assume the actual transmission logic and queue management reside. I'll need to understand how `ieee80211_aql_sta_limit` is *used* first. Is it a hard limit? Is it a target? Is it dynamic? I'll be looking for where this variable is read, compared, and modified, and what that reveals about the behavior of the AQM system as a whole. Knowing the context around this function will also be vital; how are the queues structured, what other factors influence packet scheduling, and what are the implications for per-station fairness and overall throughput? I'll probably also need to keep an eye on related functions like those handling rate control and frame aggregation as they're all inter-related. I need to figure out what's causing the problem, and this seems like the likely place.

{
  "File": "net/mac80211/tx.c",
  "FirstLine": 4215,
  "LineCount": 60
}

{
  "Contents": "4215:\t}\n4216:\tEXPORT_SYMBOL(__ieee80211_schedule_txq);\n4217:\t\n4218:\tDEFINE_STATIC_KEY_FALSE(aql_disable);\n4219:\t\n4220:\tstatic u32 ieee80211_aql_sta_limit(struct ieee80211_local *local,\n4221:\t\t\t\t\t   struct sta_info *sta, u32 limit)\n4222:\t{\n4223:\t\tu32 scaled;\n4224:\t\n4225:\t\tif (!ieee80211_hw_check(\u0026local-\u003ehw, TX_NO_PUSHBACK) ||\n4226:\t\t    sta-\u003eairtime_weight == IEEE80211_DEFAULT_AIRTIME_WEIGHT)\n4227:\t\t\treturn limit;\n4228:\t\n4229:\t\tscaled = mult_frac(limit, sta-\u003eairtime_weight,\n4230:\t\t\t\t   IEEE80211_DEFAULT_AIRTIME_WEIGHT);\n4231:\t\n4232:\t\treturn min(scaled, max(limit, local-\u003eaql_threshold));\n4233:\t}\n4234:\t\n4235:\tbool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,\n4236:\t\t\t\t\t struct ieee80211_txq *txq)\n4237:\t{\n4238:\t\tstruct sta_info *sta;\n4239:\t\tstruct ieee80211_local *local = hw_to_local(hw);\n4240:\t\n4241:\t\tif (!wiphy_ext_feature_isset(local-\u003ehw.wiphy, NL80211_EXT_FEATURE_AQL))\n4242:\t\t\treturn true;\n4243:\t\n4244:\t\tif (static_branch_unlikely(\u0026aql_disable))\n4245:\t\t\treturn true;\n4246:\t\n4247:\t\tif (!txq-\u003esta)\n4248:\t\t\treturn atomic_read(\u0026local-\u003eaql_mc_pending_airtime) \u003c\n4249:\t\t\t       local-\u003eaql_txq_limit_mc;\n4250:\t\n4251:\t\tif (unlikely(txq-\u003etid == IEEE80211_NUM_TIDS))\n4252:\t\t\treturn true;\n4253:\t\n4254:\t\tsta = container_of(txq-\u003esta, struct sta_info, sta);\n4255:\t\tif (atomic_read(\u0026sta-\u003eairtime[txq-\u003eac].aql_tx_pending) \u003c\n4256:\t\t    ieee80211_aql_sta_limit(local, sta,\n4257:\t\t\t\t\t    sta-\u003eairtime[txq-\u003eac].aql_limit_low))\n4258:\t\t\treturn true;\n4259:\t\n4260:\t\tif (atomic_read(\u0026local-\u003eaql_total_pending_airtime) \u003c\n4261:\t\t    local-\u003eaql_threshold \u0026\u0026\n4262:\t\t    atomic_read(\u0026sta-\u003eairtime[txq-\u003eac].aql_tx_pending) \u003c\n4263:\t\t    ieee80211_aql_sta_limit(local, sta,\n4264:\t\t\t\t\t    sta-\u003eairtime[txq-\u003eac].aql_limit_high))\n4265:\t\t\treturn true;\n4266:\t\n4267:\t\treturn false;\n4268:\t}\n4269:\tEXPORT_SYMBOL(ieee80211_txq_airtime_check);\n4270:\t\n4271:\tu32 ieee80211_txq_aql_pending(struct ieee80211_hw *hw,\n4272:\t\t\t\t      struct ieee80211_txq *txq)\n4273:\t{\n4274:\t\tstruct ieee80211_local *local = hw_to_local(hw);\n"
}

gemini-3.7-flash

null

null

							input: 7061
							output: 35
							thoughts: 61
						

**Investigating MAC80211 Configuration and Driver Dependencies**

Okay, let's dive in. I need to get a handle on how `mac80211` is configured and which drivers are actually using it. My first stop should be to examine the configuration files. Let's start with `net/mac80211/Kconfig`. This should give me a high-level view of the configurable options within the `mac80211` core. Then, since I know ath11k is a major wireless driver that relies on this subsystem, I should also look at the ath11k's Kconfig file (`drivers/net/wireless/ath/ath11k/Kconfig`). Comparing these two will illuminate how dependencies are handled and how the specific driver interacts with the more general mac80211 framework. This should provide some useful information regarding overall system behavior.

{
  "Expression": "config MAC80211",
  "PathPrefix": "net/mac80211"
}

{
  "Output": "net/mac80211/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nnet/mac80211/Kconfig:2:config MAC80211\nnet/mac80211/Kconfig-3-\ttristate \"Generic IEEE 802.11 Networking Stack (mac80211)\"\n--\nnet/mac80211/Kconfig=19=if MAC80211 != n\nnet/mac80211/Kconfig-20-\nnet/mac80211/Kconfig:21:config MAC80211_HAS_RC\nnet/mac80211/Kconfig-22-\tbool\nnet/mac80211/Kconfig-23-\nnet/mac80211/Kconfig:24:config MAC80211_RC_MINSTREL\nnet/mac80211/Kconfig-25-\tbool \"Minstrel\" if EXPERT\n--\nnet/mac80211/Kconfig=31=choice\n--\nnet/mac80211/Kconfig-40-\nnet/mac80211/Kconfig:41:config MAC80211_RC_DEFAULT_MINSTREL\nnet/mac80211/Kconfig-42-\tbool \"Minstrel\"\n--\nnet/mac80211/Kconfig=48=endchoice\nnet/mac80211/Kconfig-49-\nnet/mac80211/Kconfig:50:config MAC80211_RC_DEFAULT\nnet/mac80211/Kconfig-51-\tstring\n--\nnet/mac80211/Kconfig=57=comment \"Some wireless drivers require a rate control algorithm\"\n--\nnet/mac80211/Kconfig-59-\nnet/mac80211/Kconfig:60:config MAC80211_KUNIT_TEST\nnet/mac80211/Kconfig-61-\ttristate \"KUnit tests for mac80211\" if !KUNIT_ALL_TESTS\n--\nnet/mac80211/Kconfig-69-\nnet/mac80211/Kconfig:70:config MAC80211_MESH\nnet/mac80211/Kconfig-71-\tbool \"Enable mac80211 mesh networking support\"\n--\nnet/mac80211/Kconfig-78-\nnet/mac80211/Kconfig:79:config MAC80211_LEDS\nnet/mac80211/Kconfig-80-\tbool \"Enable LED triggers\"\n--\nnet/mac80211/Kconfig-87-\nnet/mac80211/Kconfig:88:config MAC80211_DEBUGFS\nnet/mac80211/Kconfig-89-\tbool \"Export mac80211 internals in DebugFS\"\n--\nnet/mac80211/Kconfig-96-\nnet/mac80211/Kconfig:97:config MAC80211_MESSAGE_TRACING\nnet/mac80211/Kconfig-98-\tbool \"Trace all mac80211 debug messages\"\n--\nnet/mac80211/Kconfig-109-\nnet/mac80211/Kconfig:110:menuconfig MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-111-\tbool \"Select mac80211 debugging features\"\n--\nnet/mac80211/Kconfig-115-\nnet/mac80211/Kconfig:116:config MAC80211_NOINLINE\nnet/mac80211/Kconfig-117-\tbool \"Do not inline TX/RX handlers\"\n--\nnet/mac80211/Kconfig-131-\nnet/mac80211/Kconfig:132:config MAC80211_VERBOSE_DEBUG\nnet/mac80211/Kconfig-133-\tbool \"Verbose debugging output\"\n--\nnet/mac80211/Kconfig-142-\nnet/mac80211/Kconfig:143:config MAC80211_MLME_DEBUG\nnet/mac80211/Kconfig-144-\tbool \"Verbose managed MLME output\"\n--\nnet/mac80211/Kconfig-153-\nnet/mac80211/Kconfig:154:config MAC80211_STA_DEBUG\nnet/mac80211/Kconfig-155-\tbool \"Verbose station debugging\"\n--\nnet/mac80211/Kconfig-162-\nnet/mac80211/Kconfig:163:config MAC80211_HT_DEBUG\nnet/mac80211/Kconfig-164-\tbool \"Verbose HT debugging\"\n--\nnet/mac80211/Kconfig-174-\nnet/mac80211/Kconfig:175:config MAC80211_OCB_DEBUG\nnet/mac80211/Kconfig-176-\tbool \"Verbose OCB debugging\"\n--\nnet/mac80211/Kconfig-185-\nnet/mac80211/Kconfig:186:config MAC80211_IBSS_DEBUG\nnet/mac80211/Kconfig-187-\tbool \"Verbose IBSS debugging\"\n--\nnet/mac80211/Kconfig-196-\nnet/mac80211/Kconfig:197:config MAC80211_PS_DEBUG\nnet/mac80211/Kconfig-198-\tbool \"Verbose powersave mode debugging\"\n--\nnet/mac80211/Kconfig-208-\nnet/mac80211/Kconfig:209:config MAC80211_MPL_DEBUG\nnet/mac80211/Kconfig-210-\tbool \"Verbose mesh peer link debugging\"\n--\nnet/mac80211/Kconfig-221-\nnet/mac80211/Kconfig:222:config MAC80211_MPATH_DEBUG\nnet/mac80211/Kconfig-223-\tbool \"Verbose mesh path debugging\"\n--\nnet/mac80211/Kconfig-234-\nnet/mac80211/Kconfig:235:config MAC80211_MHWMP_DEBUG\nnet/mac80211/Kconfig-236-\tbool \"Verbose mesh HWMP routing debugging\"\n--\nnet/mac80211/Kconfig-247-\nnet/mac80211/Kconfig:248:config MAC80211_MESH_SYNC_DEBUG\nnet/mac80211/Kconfig-249-\tbool \"Verbose mesh synchronization debugging\"\n--\nnet/mac80211/Kconfig-258-\nnet/mac80211/Kconfig:259:config MAC80211_MESH_CSA_DEBUG\nnet/mac80211/Kconfig-260-\tbool \"Verbose mesh channel switch debugging\"\n--\nnet/mac80211/Kconfig-269-\nnet/mac80211/Kconfig:270:config MAC80211_MESH_PS_DEBUG\nnet/mac80211/Kconfig-271-\tbool \"Verbose mesh powersave debugging\"\n--\nnet/mac80211/Kconfig-280-\nnet/mac80211/Kconfig:281:config MAC80211_TDLS_DEBUG\nnet/mac80211/Kconfig-282-\tbool \"Verbose TDLS debugging\"\n--\nnet/mac80211/Kconfig-292-\nnet/mac80211/Kconfig:293:config MAC80211_DEBUG_COUNTERS\nnet/mac80211/Kconfig-294-\tbool \"Extra statistics for TX/RX debugging\"\n--\nnet/mac80211/Kconfig-307-\nnet/mac80211/Kconfig:308:config MAC80211_STA_HASH_MAX_SIZE\nnet/mac80211/Kconfig-309-\tint \"Station hash table maximum size\" if MAC80211_DEBUG_MENU\n"
}

gemini-3.7-flash

null

null

							input: 9532
							output: 36
							thoughts: 21
						

Here's my take on those thoughts, tailored for an expert audience:

**Kernel Configuration Context Shift: ath11k Kconfig**

Alright, so we're diving back into the kernel configuration, specifically the ath11k wireless driver. I need to make absolutely sure we've considered the relevant Kconfig options. It's too easy to overlook something, especially in a sprawling project like the kernel. So, I need to go over the driver's Kconfig file, which is located in drivers/net/wireless/ath/ath11k/Kconfig. It is important to fully understand the features that have been enabled and disabled.

{
  "Expression": "ATH11K",
  "PathPrefix": "drivers/net/wireless/ath/ath11k"
}

{
  "Output": "\nFull output is too long, showing 500 out of 9310 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath11k/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Kconfig:2:config ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-3-\ttristate \"Qualcomm 802.11ax chipset support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig:13:config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig-14-\ttristate \"Atheros ath11k AHB support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:15:\tdepends on ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-16-\tdepends on REMOTEPROC\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-19-\ndrivers/net/wireless/ath/ath11k/Kconfig:20:config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig-21-\ttristate \"Atheros ath11k PCI support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:22:\tdepends on ATH11K \u0026\u0026 PCI\ndrivers/net/wireless/ath/ath11k/Kconfig-23-\tselect MHI_BUS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-29-\ndrivers/net/wireless/ath/ath11k/Kconfig:30:config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig-31-\tbool \"QCA ath11k debugging\"\ndrivers/net/wireless/ath/ath11k/Kconfig:32:\tdepends on ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-33-\thelp\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-37-\ndrivers/net/wireless/ath/ath11k/Kconfig:38:config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-39-\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:40:\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-41-\thelp\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-45-\ndrivers/net/wireless/ath/ath11k/Kconfig:46:config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-47-\tbool \"ath11k tracing support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:48:\tdepends on ATH11K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-49-\thelp\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig:52:config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig-53-\tbool \"QCA ath11k spectral scan support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:54:\tdepends on ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-55-\tdepends on RELAY\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-60-\ndrivers/net/wireless/ath/ath11k/Kconfig:61:config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig-62-\tbool \"ath11k channel frequency response support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:63:\tdepends on ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-64-\tdepends on RELAY\n--\ndrivers/net/wireless/ath/ath11k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Makefile:2:obj-$(CONFIG_ATH11K) += ath11k.o\ndrivers/net/wireless/ath/ath11k/Makefile-3-ath11k-y += core.o \\\n--\ndrivers/net/wireless/ath/ath11k/Makefile-23-\ndrivers/net/wireless/ath/ath11k/Makefile:24:ath11k-$(CONFIG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath11k/Makefile-25-ath11k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath11k/Makefile:26:ath11k-$(CONFIG_ATH11K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath11k/Makefile-27-ath11k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath11k/Makefile:28:ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath11k/Makefile-29-ath11k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath11k/Makefile=30=ath11k-$(CONFIG_DEV_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath11k/Makefile:31:ath11k-$(CONFIG_ATH11K_CFR) += cfr.o\ndrivers/net/wireless/ath/ath11k/Makefile-32-\ndrivers/net/wireless/ath/ath11k/Makefile:33:obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-34-ath11k_ahb-y += ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-35-\ndrivers/net/wireless/ath/ath11k/Makefile:36:obj-$(CONFIG_ATH11K_PCI) += ath11k_pci.o\ndrivers/net/wireless/ath/ath11k/Makefile-37-ath11k_pci-y += mhi.o pci.o\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=24=static const struct of_device_id ath11k_ahb_of_match[] = {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-28-\t{ .compatible = \"qcom,ipq8074-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:29:\t  .data = (void *)ATH11K_HW_IPQ8074,\ndrivers/net/wireless/ath/ath11k/ahb.c-30-\t},\ndrivers/net/wireless/ath/ath11k/ahb.c-31-\t{ .compatible = \"qcom,ipq6018-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:32:\t  .data = (void *)ATH11K_HW_IPQ6018_HW10,\ndrivers/net/wireless/ath/ath11k/ahb.c-33-\t},\ndrivers/net/wireless/ath/ath11k/ahb.c-34-\t{ .compatible = \"qcom,wcn6750-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:35:\t  .data = (void *)ATH11K_HW_WCN6750_HW10,\ndrivers/net/wireless/ath/ath11k/ahb.c-36-\t},\ndrivers/net/wireless/ath/ath11k/ahb.c-37-\t{ .compatible = \"qcom,ipq5018-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:38:\t  .data = (void *)ATH11K_HW_IPQ5018_HW10,\ndrivers/net/wireless/ath/ath11k/ahb.c-39-\t},\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=43=MODULE_DEVICE_TABLE(of, ath11k_ahb_of_match);\ndrivers/net/wireless/ath/ath11k/ahb.c-44-\ndrivers/net/wireless/ath/ath11k/ahb.c:45:#define ATH11K_IRQ_CE0_OFFSET 4\ndrivers/net/wireless/ath/ath11k/ahb.c-46-\ndrivers/net/wireless/ath/ath11k/ahb.c:47:static const char *irq_name[ATH11K_IRQ_NUM_MAX] = {\ndrivers/net/wireless/ath/ath11k/ahb.c-48-\t\"misc-pulse1\",\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=151=ath11k_ahb_get_window_start_wcn6750(struct ath11k_base *ab, u32 offset)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-155-\t/* If offset lies within DP register range, use 1st window */\ndrivers/net/wireless/ath/ath11k/ahb.c:156:\tif ((offset ^ HAL_SEQ_WCSS_UMAC_OFFSET) \u003c ATH11K_PCI_WINDOW_RANGE_MASK)\ndrivers/net/wireless/ath/ath11k/ahb.c:157:\t\twindow_start = ATH11K_PCI_WINDOW_START;\ndrivers/net/wireless/ath/ath11k/ahb.c-158-\t/* If offset lies within CE register range, use 2nd window */\ndrivers/net/wireless/ath/ath11k/ahb.c-159-\telse if ((offset ^ HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab)) \u003c\ndrivers/net/wireless/ath/ath11k/ahb.c:160:\t\t ATH11K_PCI_WINDOW_RANGE_MASK)\ndrivers/net/wireless/ath/ath11k/ahb.c:161:\t\twindow_start = 2 * ATH11K_PCI_WINDOW_START;\ndrivers/net/wireless/ath/ath11k/ahb.c-162-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=167=ath11k_ahb_window_write32_wcn6750(struct ath11k_base *ab, u32 offset, u32 value)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-174-\tiowrite32(value, ab-\u003emem + window_start +\ndrivers/net/wireless/ath/ath11k/ahb.c:175:\t\t  (offset \u0026 ATH11K_PCI_WINDOW_RANGE_MASK));\ndrivers/net/wireless/ath/ath11k/ahb.c-176-}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=178=static u32 ath11k_ahb_window_read32_wcn6750(struct ath11k_base *ab, u32 offset)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-186-\tval = ioread32(ab-\u003emem + window_start +\ndrivers/net/wireless/ath/ath11k/ahb.c:187:\t\t       (offset \u0026 ATH11K_PCI_WINDOW_RANGE_MASK));\ndrivers/net/wireless/ath/ath11k/ahb.c-188-\treturn val;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=231=static void __ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-234-\ndrivers/net/wireless/ath/ath11k/ahb.c:235:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-236-\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=272=static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-277-\ndrivers/net/wireless/ath/ath11k/ahb.c:278:\tie1_reg_addr = ce_ie_addr-\u003eie1_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:279:\tie2_reg_addr = ce_ie_addr-\u003eie2_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:280:\tie3_reg_addr = ce_ie_addr-\u003eie3_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-281-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=293=static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-298-\ndrivers/net/wireless/ath/ath11k/ahb.c:299:\tie1_reg_addr = ce_ie_addr-\u003eie1_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:300:\tie2_reg_addr = ce_ie_addr-\u003eie2_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:301:\tie3_reg_addr = ce_ie_addr-\u003eie3_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-302-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=314=static void ath11k_ahb_sync_ce_irqs(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-322-\ndrivers/net/wireless/ath/ath11k/ahb.c:323:\t\tirq_idx = ATH11K_IRQ_CE0_OFFSET + i;\ndrivers/net/wireless/ath/ath11k/ahb.c-324-\t\tsynchronize_irq(ab-\u003eirq_num[irq_idx]);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=328=static void ath11k_ahb_sync_ext_irqs(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-332-\ndrivers/net/wireless/ath/ath11k/ahb.c:333:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-334-\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=373=static void ath11k_ahb_ext_irq_enable(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-376-\ndrivers/net/wireless/ath/ath11k/ahb.c:377:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-378-\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=394=static void ath11k_ahb_stop(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-395-{\ndrivers/net/wireless/ath/ath11k/ahb.c:396:\tif (!test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ahb.c-397-\t\tath11k_ahb_ce_irqs_disable(ab);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=446=static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-449-\ndrivers/net/wireless/ath/ath11k/ahb.c:450:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++)\ndrivers/net/wireless/ath/ath11k/ahb.c-451-\t\tath11k_ahb_free_ext_irq_grp(ab, \u0026ab-\u003eext_irq_grp[i]);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=454=static void ath11k_ahb_free_ce_irqs(struct ath11k_base *ab, int max_idx)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-460-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:461:\t\tirq_idx = ATH11K_IRQ_CE0_OFFSET + i;\ndrivers/net/wireless/ath/ath11k/ahb.c-462-\t\tfree_irq(ab-\u003eirq_num[irq_idx], \u0026ab-\u003ece.ce_pipe[i]);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=532=static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-539-\ndrivers/net/wireless/ath/ath11k/ahb.c:540:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-541-\t\tu32 num_irq = 0;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-557-\ndrivers/net/wireless/ath/ath11k/ahb.c:558:\t\tfor (j = 0; j \u003c ATH11K_EXT_IRQ_NUM_MAX; j++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-559-\t\t\tif (ab-\u003ehw_params.ring_mask-\u003etx[i] \u0026 BIT(j)) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=633=static int ath11k_ahb_config_irq(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-647-\ndrivers/net/wireless/ath/ath11k/ahb.c:648:\t\tirq_idx = ATH11K_IRQ_CE0_OFFSET + i;\ndrivers/net/wireless/ath/ath11k/ahb.c-649-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=718=static int ath11k_ahb_hif_suspend(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-727-\ndrivers/net/wireless/ath/ath11k/ahb.c:728:\twake_irq = ab-\u003eirq_num[ATH11K_PCI_IRQ_CE0_OFFSET + ATH11K_PCI_CE_WAKE_IRQ];\ndrivers/net/wireless/ath/ath11k/ahb.c-729-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-736-\tvalue = u32_encode_bits(ab_ahb-\u003esmp2p_info.seq_no++,\ndrivers/net/wireless/ath/ath11k/ahb.c:737:\t\t\t\tATH11K_AHB_SMP2P_SMEM_SEQ_NO);\ndrivers/net/wireless/ath/ath11k/ahb.c:738:\tvalue |= u32_encode_bits(ATH11K_AHB_POWER_SAVE_ENTER,\ndrivers/net/wireless/ath/ath11k/ahb.c:739:\t\t\t\t ATH11K_AHB_SMP2P_SMEM_MSG);\ndrivers/net/wireless/ath/ath11k/ahb.c-740-\ndrivers/net/wireless/ath/ath11k/ahb.c-741-\tret = qcom_smem_state_update_bits(ab_ahb-\u003esmp2p_info.smem_state,\ndrivers/net/wireless/ath/ath11k/ahb.c:742:\t\t\t\t\t  ATH11K_AHB_SMP2P_SMEM_VALUE_MASK, value);\ndrivers/net/wireless/ath/ath11k/ahb.c-743-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-747-\ndrivers/net/wireless/ath/ath11k/ahb.c:748:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device suspended\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-749-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=753=static int ath11k_ahb_hif_resume(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-762-\ndrivers/net/wireless/ath/ath11k/ahb.c:763:\twake_irq = ab-\u003eirq_num[ATH11K_PCI_IRQ_CE0_OFFSET + ATH11K_PCI_CE_WAKE_IRQ];\ndrivers/net/wireless/ath/ath11k/ahb.c-764-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-773-\tvalue = u32_encode_bits(ab_ahb-\u003esmp2p_info.seq_no++,\ndrivers/net/wireless/ath/ath11k/ahb.c:774:\t\t\t\tATH11K_AHB_SMP2P_SMEM_SEQ_NO);\ndrivers/net/wireless/ath/ath11k/ahb.c:775:\tvalue |= u32_encode_bits(ATH11K_AHB_POWER_SAVE_EXIT,\ndrivers/net/wireless/ath/ath11k/ahb.c:776:\t\t\t\t ATH11K_AHB_SMP2P_SMEM_MSG);\ndrivers/net/wireless/ath/ath11k/ahb.c-777-\ndrivers/net/wireless/ath/ath11k/ahb.c-778-\tret = qcom_smem_state_update_bits(ab_ahb-\u003esmp2p_info.smem_state,\ndrivers/net/wireless/ath/ath11k/ahb.c:779:\t\t\t\t\t  ATH11K_AHB_SMP2P_SMEM_VALUE_MASK, value);\ndrivers/net/wireless/ath/ath11k/ahb.c-780-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-790-\ndrivers/net/wireless/ath/ath11k/ahb.c:791:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device resumed\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-792-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=848=static int ath11k_ahb_setup_msi_resources(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-892-\ndrivers/net/wireless/ath/ath11k/ahb.c:893:\tset_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, \u0026ab-\u003edev_flags);\ndrivers/net/wireless/ath/ath11k/ahb.c-894-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1139=static int ath11k_ahb_probe(struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1149-\tswitch (hw_rev) {\ndrivers/net/wireless/ath/ath11k/ahb.c:1150:\tcase ATH11K_HW_IPQ8074:\ndrivers/net/wireless/ath/ath11k/ahb.c:1151:\tcase ATH11K_HW_IPQ6018_HW10:\ndrivers/net/wireless/ath/ath11k/ahb.c:1152:\tcase ATH11K_HW_IPQ5018_HW10:\ndrivers/net/wireless/ath/ath11k/ahb.c-1153-\t\thif_ops = \u0026ath11k_ahb_hif_ops_ipq8074;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1155-\t\tbreak;\ndrivers/net/wireless/ath/ath11k/ahb.c:1156:\tcase ATH11K_HW_WCN6750_HW10:\ndrivers/net/wireless/ath/ath11k/ahb.c-1157-\t\thif_ops = \u0026ath11k_ahb_hif_ops_wcn6750;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1171-\tab = ath11k_core_alloc(\u0026pdev-\u003edev, sizeof(struct ath11k_ahb),\ndrivers/net/wireless/ath/ath11k/ahb.c:1172:\t\t\t       ATH11K_BUS_AHB);\ndrivers/net/wireless/ath/ath11k/ahb.c-1173-\tif (!ab) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1180-\tab-\u003ehw_rev = hw_rev;\ndrivers/net/wireless/ath/ath11k/ahb.c:1181:\tab-\u003efw_mode = ATH11K_FIRMWARE_MODE_NORMAL;\ndrivers/net/wireless/ath/ath11k/ahb.c-1182-\tplatform_set_drvdata(pdev, ab);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1264=static void ath11k_ahb_remove_prepare(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1267-\ndrivers/net/wireless/ath/ath11k/ahb.c:1268:\tif (test_bit(ATH11K_FLAG_RECOVERY, \u0026ab-\u003edev_flags)) {\ndrivers/net/wireless/ath/ath11k/ahb.c-1269-\t\tleft = wait_for_completion_timeout(\u0026ab-\u003edriver_recovery,\ndrivers/net/wireless/ath/ath11k/ahb.c:1270:\t\t\t\t\t\t   ATH11K_AHB_RECOVERY_TIMEOUT);\ndrivers/net/wireless/ath/ath11k/ahb.c-1271-\t\tif (!left)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1274-\ndrivers/net/wireless/ath/ath11k/ahb.c:1275:\tset_bit(ATH11K_FLAG_UNREGISTERING, \u0026ab-\u003edev_flags);\ndrivers/net/wireless/ath/ath11k/ahb.c-1276-\tcancel_work_sync(\u0026ab-\u003erestart_work);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1295=static void ath11k_ahb_remove(struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1298-\ndrivers/net/wireless/ath/ath11k/ahb.c:1299:\tif (test_bit(ATH11K_FLAG_QMI_FAIL, \u0026ab-\u003edev_flags)) {\ndrivers/net/wireless/ath/ath11k/ahb.c-1300-\t\tath11k_ahb_power_down(ab, false);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1314=static void ath11k_ahb_shutdown(struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1323-\ndrivers/net/wireless/ath/ath11k/ahb.c:1324:\tif (!(test_bit(ATH11K_FLAG_REGISTERED, \u0026ab-\u003edev_flags)))\ndrivers/net/wireless/ath/ath11k/ahb.c-1325-\t\tgoto free_resources;\n--\ndrivers/net/wireless/ath/ath11k/ahb.h-5- */\ndrivers/net/wireless/ath/ath11k/ahb.h:6:#ifndef ATH11K_AHB_H\ndrivers/net/wireless/ath/ath11k/ahb.h:7:#define ATH11K_AHB_H\ndrivers/net/wireless/ath/ath11k/ahb.h-8-\n--\ndrivers/net/wireless/ath/ath11k/ahb.h-10-\ndrivers/net/wireless/ath/ath11k/ahb.h:11:#define ATH11K_AHB_RECOVERY_TIMEOUT (3 * HZ)\ndrivers/net/wireless/ath/ath11k/ahb.h-12-\ndrivers/net/wireless/ath/ath11k/ahb.h:13:#define ATH11K_AHB_SMP2P_SMEM_MSG\t\tGENMASK(15, 0)\ndrivers/net/wireless/ath/ath11k/ahb.h:14:#define ATH11K_AHB_SMP2P_SMEM_SEQ_NO\t\tGENMASK(31, 16)\ndrivers/net/wireless/ath/ath11k/ahb.h:15:#define ATH11K_AHB_SMP2P_SMEM_VALUE_MASK\t0xFFFFFFFF\ndrivers/net/wireless/ath/ath11k/ahb.h-16-\ndrivers/net/wireless/ath/ath11k/ahb.h=17=enum ath11k_ahb_smp2p_msg_id {\ndrivers/net/wireless/ath/ath11k/ahb.h:18:\tATH11K_AHB_POWER_SAVE_ENTER = 1,\ndrivers/net/wireless/ath/ath11k/ahb.h:19:\tATH11K_AHB_POWER_SAVE_EXIT,\ndrivers/net/wireless/ath/ath11k/ahb.h-20-};\n--\ndrivers/net/wireless/ath/ath11k/ce.c=321=static int ath11k_ce_rx_post_pipe(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-350-\ndrivers/net/wireless/ath/ath11k/ce.c:351:\t\tATH11K_SKB_RXCB(skb)-\u003epaddr = paddr;\ndrivers/net/wireless/ath/ath11k/ce.c-352-\n--\ndrivers/net/wireless/ath/ath11k/ce.c-355-\t\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ce.c:356:\t\t\tath11k_dbg(ab, ATH11K_DBG_CE, \"failed to enqueue rx buf: %d\\n\",\ndrivers/net/wireless/ath/ath11k/ce.c-357-\t\t\t\t   ret);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=417=static void ath11k_ce_recv_process_cb(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-427-\t\tmax_nbytes = skb-\u003elen + skb_tailroom(skb);\ndrivers/net/wireless/ath/ath11k/ce.c:428:\t\tdma_unmap_single(ab-\u003edev, ATH11K_SKB_RXCB(skb)-\u003epaddr,\ndrivers/net/wireless/ath/ath11k/ce.c-429-\t\t\t\t max_nbytes, DMA_FROM_DEVICE);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-442-\twhile ((skb = __skb_dequeue(\u0026list))) {\ndrivers/net/wireless/ath/ath11k/ce.c:443:\t\tath11k_dbg(ab, ATH11K_DBG_CE, \"rx ce pipe %d len %d\\n\",\ndrivers/net/wireless/ath/ath11k/ce.c-444-\t\t\t   pipe-\u003epipe_num, skb-\u003elen);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-452-\t\tmod_timer(\u0026ab-\u003erx_replenish_retry,\ndrivers/net/wireless/ath/ath11k/ce.c:453:\t\t\t  jiffies + ATH11K_CE_RX_POST_RETRY_JIFFIES);\ndrivers/net/wireless/ath/ath11k/ce.c-454-\t}\n--\ndrivers/net/wireless/ath/ath11k/ce.c=498=static void ath11k_ce_tx_process_cb(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-508-\ndrivers/net/wireless/ath/ath11k/ce.c:509:\t\tdma_unmap_single(ab-\u003edev, ATH11K_SKB_CB(skb)-\u003epaddr, skb-\u003elen,\ndrivers/net/wireless/ath/ath11k/ce.c-510-\t\t\t\t DMA_TO_DEVICE);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-520-\twhile ((skb = __skb_dequeue(\u0026list))) {\ndrivers/net/wireless/ath/ath11k/ce.c:521:\t\tath11k_dbg(ab, ATH11K_DBG_CE, \"tx ce pipe %d len %d\\n\",\ndrivers/net/wireless/ath/ath11k/ce.c-522-\t\t\t   pipe-\u003epipe_num, skb-\u003elen);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=553=static int ath11k_ce_init_ring(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/ce.c-604-\t\tath11k_dp_shadow_init_timer(ab, \u0026ab-\u003ece.hp_timer[ce_id],\ndrivers/net/wireless/ath/ath11k/ce.c:605:\t\t\t\t\t    ATH11K_SHADOW_CTRL_TIMER_INTERVAL,\ndrivers/net/wireless/ath/ath11k/ce.c-606-\t\t\t\t\t    ce_ring-\u003ehal_ring_id);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=709=int ath11k_ce_send(struct ath11k_base *ab, struct sk_buff *skb, u8 pipe_id,\n--\ndrivers/net/wireless/ath/ath11k/ce.c-738-\ndrivers/net/wireless/ath/ath11k/ce.c:739:\t\tif (num_used \u003e ATH11K_CE_USAGE_THRESHOLD)\ndrivers/net/wireless/ath/ath11k/ce.c-740-\t\t\tath11k_ce_poll_send_completed(ab, pipe-\u003epipe_num);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-742-\ndrivers/net/wireless/ath/ath11k/ce.c:743:\tif (test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ce.c-744-\t\treturn -ESHUTDOWN;\n--\ndrivers/net/wireless/ath/ath11k/ce.c-772-\ndrivers/net/wireless/ath/ath11k/ce.c:773:\tath11k_hal_ce_src_set_desc(desc, ATH11K_SKB_CB(skb)-\u003epaddr,\ndrivers/net/wireless/ath/ath11k/ce.c-774-\t\t\t\t   skb-\u003elen, transfer_id, byte_swap_data);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=799=static void ath11k_ce_rx_pipe_cleanup(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-814-\t\tring-\u003eskb[i] = NULL;\ndrivers/net/wireless/ath/ath11k/ce.c:815:\t\tdma_unmap_single(ab-\u003edev, ATH11K_SKB_RXCB(skb)-\u003epaddr,\ndrivers/net/wireless/ath/ath11k/ce.c-816-\t\t\t\t skb-\u003elen + skb_tailroom(skb), DMA_FROM_DEVICE);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=883=void ath11k_ce_rx_post_buf(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-898-\t\t\tmod_timer(\u0026ab-\u003erx_replenish_retry,\ndrivers/net/wireless/ath/ath11k/ce.c:899:\t\t\t\t  jiffies + ATH11K_CE_RX_POST_RETRY_JIFFIES);\ndrivers/net/wireless/ath/ath11k/ce.c-900-\n--\ndrivers/net/wireless/ath/ath11k/ce.h-6-\ndrivers/net/wireless/ath/ath11k/ce.h:7:#ifndef ATH11K_CE_H\ndrivers/net/wireless/ath/ath11k/ce.h:8:#define ATH11K_CE_H\ndrivers/net/wireless/ath/ath11k/ce.h-9-\n--\ndrivers/net/wireless/ath/ath11k/ce.h-25-/* Threshold to poll for tx completion in case of Interrupt disabled CE's */\ndrivers/net/wireless/ath/ath11k/ce.h:26:#define ATH11K_CE_USAGE_THRESHOLD 32\ndrivers/net/wireless/ath/ath11k/ce.h-27-\ndrivers/net/wireless/ath/ath11k/ce.h=28=void ath11k_ce_byte_swap(void *mem, u32 len);\n--\ndrivers/net/wireless/ath/ath11k/ce.h-61-\ndrivers/net/wireless/ath/ath11k/ce.h:62:#define ATH11K_CE_RX_POST_RETRY_JIFFIES 50\ndrivers/net/wireless/ath/ath11k/ce.h-63-\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=19=static int ath11k_cfr_calculate_tones_from_dma_hdr(struct ath11k_cfr_dma_hdr *hdr)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-24-\tswitch (preamble) {\ndrivers/net/wireless/ath/ath11k/cfr.c:25:\tcase ATH11K_CFR_PREAMBLE_TYPE_LEGACY:\ndrivers/net/wireless/ath/ath11k/cfr.c-26-\t\tfallthrough;\ndrivers/net/wireless/ath/ath11k/cfr.c:27:\tcase ATH11K_CFR_PREAMBLE_TYPE_VHT:\ndrivers/net/wireless/ath/ath11k/cfr.c-28-\t\tswitch (bw) {\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-39-\t\t}\ndrivers/net/wireless/ath/ath11k/cfr.c:40:\tcase ATH11K_CFR_PREAMBLE_TYPE_HT:\ndrivers/net/wireless/ath/ath11k/cfr.c-41-\t\tswitch (bw) {\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=114=ath11k_cfr_correlate_and_relay(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-121-\ndrivers/net/wireless/ath/ath11k/cfr.c:122:\tif (event_type == ATH11K_CORRELATE_TX_EVENT) {\ndrivers/net/wireless/ath/ath11k/cfr.c-123-\t\tif (lut-\u003etx_recv)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-126-\t\tlut-\u003etx_recv = true;\ndrivers/net/wireless/ath/ath11k/cfr.c:127:\t} else if (event_type == ATH11K_CORRELATE_DBR_EVENT) {\ndrivers/net/wireless/ath/ath11k/cfr.c-128-\t\tcfr-\u003edbr_evt_cnt++;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-140-\t\t\t\tdiff = lut-\u003edbr_tstamp - lut-\u003etxrx_tstamp;\ndrivers/net/wireless/ath/ath11k/cfr.c:141:\t\t\t\tath11k_dbg(ar-\u003eab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-142-\t\t\t\t\t   \"txrx event -\u003e dbr event delay = %u ms\",\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-145-\t\t\t\tdiff = lut-\u003etxrx_tstamp - lut-\u003edbr_tstamp;\ndrivers/net/wireless/ath/ath11k/cfr.c:146:\t\t\t\tath11k_dbg(ar-\u003eab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-147-\t\t\t\t\t   \"dbr event -\u003e txrx event delay = %u ms\",\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-153-\t\t\tcfr-\u003erelease_cnt++;\ndrivers/net/wireless/ath/ath11k/cfr.c:154:\t\t\tstatus = ATH11K_CORRELATE_STATUS_RELEASE;\ndrivers/net/wireless/ath/ath11k/cfr.c-155-\t\t} else {\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-160-\ndrivers/net/wireless/ath/ath11k/cfr.c:161:\t\t\tath11k_dbg(ar-\u003eab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-162-\t\t\t\t   \"Received dbr event twice for the same lut entry\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-166-\t\t\tcfr-\u003ecfr_dma_aborts++;\ndrivers/net/wireless/ath/ath11k/cfr.c:167:\t\t\tstatus = ATH11K_CORRELATE_STATUS_HOLD;\ndrivers/net/wireless/ath/ath11k/cfr.c-168-\t\t}\ndrivers/net/wireless/ath/ath11k/cfr.c-169-\t} else {\ndrivers/net/wireless/ath/ath11k/cfr.c:170:\t\tstatus = ATH11K_CORRELATE_STATUS_HOLD;\ndrivers/net/wireless/ath/ath11k/cfr.c-171-\t}\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=176=static int ath11k_cfr_process_data(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-178-{\ndrivers/net/wireless/ath/ath11k/cfr.c:179:\tu32 end_magic = ATH11K_CFR_END_MAGIC;\ndrivers/net/wireless/ath/ath11k/cfr.c-180-\tstruct ath11k_csi_cfr_header *header;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-218-\ndrivers/net/wireless/ath/ath11k/cfr.c:219:\tath11k_dbg_dump(ab, ATH11K_DBG_CFR_DUMP, \"data_from_buf_rel:\", \"\",\ndrivers/net/wireless/ath/ath11k/cfr.c-220-\t\t\tdata, length);\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-235-\tstatus = ath11k_cfr_correlate_and_relay(ar, lut,\ndrivers/net/wireless/ath/ath11k/cfr.c:236:\t\t\t\t\t\tATH11K_CORRELATE_DBR_EVENT);\ndrivers/net/wireless/ath/ath11k/cfr.c:237:\tif (status == ATH11K_CORRELATE_STATUS_RELEASE) {\ndrivers/net/wireless/ath/ath11k/cfr.c:238:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-239-\t\t\t   \"releasing CFR data to user space\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-244-\t\tath11k_cfr_release_lut_entry(lut);\ndrivers/net/wireless/ath/ath11k/cfr.c:245:\t} else if (status == ATH11K_CORRELATE_STATUS_HOLD) {\ndrivers/net/wireless/ath/ath11k/cfr.c:246:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-247-\t\t\t   \"tx event is not yet received holding the buf\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=255=static void ath11k_cfr_fill_hdr_info(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-261-\tcfr = \u0026ar-\u003ecfr;\ndrivers/net/wireless/ath/ath11k/cfr.c:262:\theader-\u003ecfr_metadata_version = ATH11K_CFR_META_VERSION_4;\ndrivers/net/wireless/ath/ath11k/cfr.c:263:\theader-\u003ecfr_data_version = ATH11K_CFR_DATA_VERSION_1;\ndrivers/net/wireless/ath/ath11k/cfr.c-264-\theader-\u003ecfr_metadata_len = sizeof(struct cfr_metadata);\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-285-\theader-\u003emeta_data.capture_mode = params-\u003ebandwidth ?\ndrivers/net/wireless/ath/ath11k/cfr.c:286:\t\tATH11K_CFR_CAPTURE_DUP_LEGACY_ACK : ATH11K_CFR_CAPTURE_LEGACY_ACK;\ndrivers/net/wireless/ath/ath11k/cfr.c-287-\theader-\u003emeta_data.capture_type = params-\u003ecapture_method;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=300=int ath11k_process_cfr_capture_event(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-303-\tstruct ath11k_look_up_table *lut = NULL;\ndrivers/net/wireless/ath/ath11k/cfr.c:304:\tu32 end_magic = ATH11K_CFR_END_MAGIC;\ndrivers/net/wireless/ath/ath11k/cfr.c-305-\tstruct ath11k_csi_cfr_header *header;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-378-\theader = \u0026lut-\u003eheader;\ndrivers/net/wireless/ath/ath11k/cfr.c:379:\theader-\u003estart_magic_num = ATH11K_CFR_START_MAGIC;\ndrivers/net/wireless/ath/ath11k/cfr.c-380-\theader-\u003evendorid = VENDOR_QCA;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-385-\tstatus = ath11k_cfr_correlate_and_relay(ar, lut,\ndrivers/net/wireless/ath/ath11k/cfr.c:386:\t\t\t\t\t\tATH11K_CORRELATE_TX_EVENT);\ndrivers/net/wireless/ath/ath11k/cfr.c:387:\tif (status == ATH11K_CORRELATE_STATUS_RELEASE) {\ndrivers/net/wireless/ath/ath11k/cfr.c:388:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-389-\t\t\t   \"Releasing CFR data to user space\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-398-\t\t\t\t\t     WMI_DIRECT_BUF_CFR);\ndrivers/net/wireless/ath/ath11k/cfr.c:399:\t} else if (status == ATH11K_CORRELATE_STATUS_HOLD) {\ndrivers/net/wireless/ath/ath11k/cfr.c:400:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-401-\t\t\t   \"dbr event is not yet received holding buf\\n\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=412=bool ath11k_cfr_peer_is_in_cfr_unassoc_pool(struct ath11k *ar, const u8 *peer_mac)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-421-\tspin_lock_bh(\u0026cfr-\u003elock);\ndrivers/net/wireless/ath/ath11k/cfr.c:422:\tfor (i = 0; i \u003c ATH11K_MAX_CFR_ENABLED_CLIENTS; i++) {\ndrivers/net/wireless/ath/ath11k/cfr.c-423-\t\tentry = \u0026cfr-\u003eunassoc_pool[i];\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=438=void ath11k_cfr_update_unassoc_pool_entry(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-445-\tspin_lock_bh(\u0026cfr-\u003elock);\ndrivers/net/wireless/ath/ath11k/cfr.c:446:\tfor (i = 0; i \u003c ATH11K_MAX_CFR_ENABLED_CLIENTS; i++) {\ndrivers/net/wireless/ath/ath11k/cfr.c-447-\t\tentry = \u0026cfr-\u003eunassoc_pool[i];\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=477=ath11k_cfr_bw_to_fw_cfr_bw(enum ath11k_cfr_capture_bw bw)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-479-\tswitch (bw) {\ndrivers/net/wireless/ath/ath11k/cfr.c:480:\tcase ATH11K_CFR_CAPTURE_BW_20:\ndrivers/net/wireless/ath/ath11k/cfr.c-481-\t\treturn WMI_PEER_CFR_CAPTURE_BW_20;\ndrivers/net/wireless/ath/ath11k/cfr.c:482:\tcase ATH11K_CFR_CAPTURE_BW_40:\ndrivers/net/wireless/ath/ath11k/cfr.c-483-\t\treturn WMI_PEER_CFR_CAPTURE_BW_40;\ndrivers/net/wireless/ath/ath11k/cfr.c:484:\tcase ATH11K_CFR_CAPTURE_BW_80:\ndrivers/net/wireless/ath/ath11k/cfr.c-485-\t\treturn WMI_PEER_CFR_CAPTURE_BW_80;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=492=ath11k_cfr_method_to_fw_cfr_method(enum ath11k_cfr_capture_method method)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-494-\tswitch (method) {\ndrivers/net/wireless/ath/ath11k/cfr.c:495:\tcase ATH11K_CFR_CAPTURE_METHOD_NULL_FRAME:\ndrivers/net/wireless/ath/ath11k/cfr.c-496-\t\treturn WMI_CFR_CAPTURE_METHOD_NULL_FRAME;\ndrivers/net/wireless/ath/ath11k/cfr.c:497:\tcase ATH11K_CFR_CAPTURE_METHOD_NULL_FRAME_WITH_PHASE:\ndrivers/net/wireless/ath/ath11k/cfr.c-498-\t\treturn WMI_CFR_CAPTURE_METHOD_NULL_FRAME_WITH_PHASE;\ndrivers/net/wireless/ath/ath11k/cfr.c:499:\tcase ATH11K_CFR_CAPTURE_METHOD_PROBE_RESP:\ndrivers/net/wireless/ath/ath11k/cfr.c-500-\t\treturn WMI_CFR_CAPTURE_METHOD_PROBE_RESP;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=506=int ath11k_cfr_send_peer_cfr_capture_cmd(struct ath11k *ar,\n\n"
}

gemini-3.7-flash

null

null

							input: 24203
							output: 35
							thoughts: 664
						

**Analyzing the Implications of AQL Changes in mac80211 for 802.11ax Support**

Okay, so I'm looking at this patch and my initial thought is that it's related to the `ath11k` driver, which handles the Qualcomm 802.11ax chipset. That's a physical hardware driver, working with PCI or AHB. But the real meat of this change seems to be in `net/mac80211/tx.c`, `net/mac80211/debugfs.c`, and `include/net/mac80211.h`. That's where I need to focus.

Specifically, I see changes in the airtime fairness calculation within `tx.c`. It looks like the patch is adding new logic to limit the number of frames a station can transmit based on its "airtime weight." We're looking at functions like `ieee80211_aql_sta_limit` and `ieee80211_txq_airtime_check`. It's checking if a station has reached a limit on its airtime utilization before allowing more packets to be queued. This is all about ensuring fair access to the medium. This AQL (airtime fairness) stuff is quite interesting.

Now, here's where it gets potentially fascinating. `mac80211` can actually be used in a virtualized environment through `mac80211_hwsim`, which is a software-emulated 802.11 radio. I need to make sure I am thinking about how this change might impact that. Checking the dependencies, yep, `MAC80211_HWSIM` relies on both `MAC80211` and `CFG80211`. So any behavior changes in the core `mac80211` code, *especially* these airtime management changes, will also be reflected in the virtualized environment. That's something to keep in mind for testing. Let's delve deeper into how these AQL changes are implemented in the `mac80211_hwsim` code.

{
  "Expression": "MAC80211_HWSIM",
  "PathPrefix": "drivers/net/wireless"
}

{
  "Output": "drivers/net/wireless/virtual/Kconfig:1:config MAC80211_HWSIM\ndrivers/net/wireless/virtual/Kconfig-2-\ttristate \"Simulated radio testing tool for mac80211\"\n--\ndrivers/net/wireless/virtual/Makefile:1:obj-$(CONFIG_MAC80211_HWSIM)\t+= mac80211_hwsim.o\ndrivers/net/wireless/virtual/Makefile-2-mac80211_hwsim-objs\t\t+= mac80211_hwsim_main.o\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-8-\ndrivers/net/wireless/virtual/mac80211_hwsim.h:9:#ifndef __MAC80211_HWSIM_H\ndrivers/net/wireless/virtual/mac80211_hwsim.h:10:#define __MAC80211_HWSIM_H\ndrivers/net/wireless/virtual/mac80211_hwsim.h-11-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=217=struct hwsim_tx_rate {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-230- *\ndrivers/net/wireless/virtual/mac80211_hwsim.h:231: * @MAC80211_HWSIM_TX_RC_USE_RTS_CTS: Use RTS/CTS exchange for this rate.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:232: * @MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT: CTS-to-self protection is required.\ndrivers/net/wireless/virtual/mac80211_hwsim.h-233- *\tThis is set if the current BSS requires ERP protection.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:234: * @MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE: Use short preamble.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:235: * @MAC80211_HWSIM_TX_RC_MCS: HT rate.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:236: * @MAC80211_HWSIM_TX_RC_VHT_MCS: VHT MCS rate, in this case the idx field is\ndrivers/net/wireless/virtual/mac80211_hwsim.h-237- *\tsplit into a higher 4 bits (Nss) and lower 4 bits (MCS number)\ndrivers/net/wireless/virtual/mac80211_hwsim.h:238: * @MAC80211_HWSIM_TX_RC_GREEN_FIELD: Indicates whether this rate should be used\ndrivers/net/wireless/virtual/mac80211_hwsim.h-239- *\tin Greenfield mode.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:240: * @MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH: Indicates if the Channel Width should be\ndrivers/net/wireless/virtual/mac80211_hwsim.h-241- *\t40 MHz.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:242: * @MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH: Indicates 80 MHz transmission\ndrivers/net/wireless/virtual/mac80211_hwsim.h:243: * @MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH: Indicates 160 MHz transmission\ndrivers/net/wireless/virtual/mac80211_hwsim.h-244- *\t(80+80 isn't supported yet)\ndrivers/net/wireless/virtual/mac80211_hwsim.h:245: * @MAC80211_HWSIM_TX_RC_DUP_DATA: The frame should be transmitted on both of\ndrivers/net/wireless/virtual/mac80211_hwsim.h-246- *\tthe adjacent 20 MHz channels, if the current channel type is\ndrivers/net/wireless/virtual/mac80211_hwsim.h-247- *\tNL80211_CHAN_HT40MINUS or NL80211_CHAN_HT40PLUS.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:248: * @MAC80211_HWSIM_TX_RC_SHORT_GI: Short Guard interval should be used for this\ndrivers/net/wireless/virtual/mac80211_hwsim.h-249- *\trate.\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=251=enum hwsim_tx_rate_flags {\ndrivers/net/wireless/virtual/mac80211_hwsim.h:252:\tMAC80211_HWSIM_TX_RC_USE_RTS_CTS\t\t= BIT(0),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:253:\tMAC80211_HWSIM_TX_RC_USE_CTS_PROTECT\t\t= BIT(1),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:254:\tMAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE\t= BIT(2),\ndrivers/net/wireless/virtual/mac80211_hwsim.h-255-\ndrivers/net/wireless/virtual/mac80211_hwsim.h-256-\t/* rate index is an HT/VHT MCS instead of an index */\ndrivers/net/wireless/virtual/mac80211_hwsim.h:257:\tMAC80211_HWSIM_TX_RC_MCS\t\t\t= BIT(3),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:258:\tMAC80211_HWSIM_TX_RC_GREEN_FIELD\t\t= BIT(4),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:259:\tMAC80211_HWSIM_TX_RC_40_MHZ_WIDTH\t\t= BIT(5),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:260:\tMAC80211_HWSIM_TX_RC_DUP_DATA\t\t= BIT(6),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:261:\tMAC80211_HWSIM_TX_RC_SHORT_GI\t\t= BIT(7),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:262:\tMAC80211_HWSIM_TX_RC_VHT_MCS\t\t\t= BIT(8),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:263:\tMAC80211_HWSIM_TX_RC_80_MHZ_WIDTH\t\t= BIT(9),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:264:\tMAC80211_HWSIM_TX_RC_160_MHZ_WIDTH\t\t= BIT(10),\ndrivers/net/wireless/virtual/mac80211_hwsim.h-265-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=328=enum hwsim_rate_info_attributes {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-347-\ndrivers/net/wireless/virtual/mac80211_hwsim.h:348:#endif /* __MAC80211_HWSIM_H */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-9-\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:10:#ifndef __MAC80211_HWSIM_I_H\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:11:#define __MAC80211_HWSIM_I_H\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-12-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h=165=void ieee80211_hwsim_wake_tx_queue(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-167-\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:168:#endif /* __MAC80211_HWSIM_I_H */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=712=static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-716-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:717:/* MAC80211_HWSIM netlink family */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-718-static struct genl_family hwsim_genl_family;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=724=static const struct genl_multicast_group hwsim_mcgrps[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-727-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:728:/* MAC80211_HWSIM netlink policy */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-729-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=865=static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-901-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:902:/* MAC80211_HWSIM virtio queues */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-903-static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=1575=static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1579-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_RTS_CTS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1580:\t\tresult |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1581-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_CTS_PROTECT)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1582:\t\tresult |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1583-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_SHORT_PREAMBLE)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1584:\t\tresult |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1585-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_MCS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1586:\t\tresult |= MAC80211_HWSIM_TX_RC_MCS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1587-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_GREEN_FIELD)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1588:\t\tresult |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1589-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_40_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1590:\t\tresult |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1591-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_DUP_DATA)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1592:\t\tresult |= MAC80211_HWSIM_TX_RC_DUP_DATA;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1593-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_SHORT_GI)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1594:\t\tresult |= MAC80211_HWSIM_TX_RC_SHORT_GI;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1595-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_VHT_MCS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1596:\t\tresult |= MAC80211_HWSIM_TX_RC_VHT_MCS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1597-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_80_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1598:\t\tresult |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1599-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_160_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1600:\t\tresult |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1601-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3484=static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3494-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3495:#define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3496-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3506=static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3509-\tif (sset == ETH_SS_STATS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3510:\t\treturn MAC80211_HWSIM_SSTATS_LEN;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3511-\treturn 0;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3514=static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3529-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3530:\tWARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3531-}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=5647=static const u8 iftypes_ext_capa_ap[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5655-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:5656:#define MAC80211_HWSIM_MLD_CAPA_OPS\t\t\t\t\\\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5657-\tFIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP, \\\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=5662=static const struct wiphy_iftype_ext_capab mac80211_hwsim_iftypes_ext_capa[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5669-\t\t\t\t    IEEE80211_EML_CAP_EMLMR_SUPPORT,\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:5670:\t\t.mld_capa_and_ops = MAC80211_HWSIM_MLD_CAPA_OPS,\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5671-\t},\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=7147=static struct genl_family hwsim_genl_family __ro_after_init = {\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7148:\t.name = \"MAC80211_HWSIM\",\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7149-\t.version = 1,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=7467=static void hwsim_virtio_remove(struct virtio_device *vdev)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7475-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7476:/* MAC80211_HWSIM virtio device id table */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7477-static const struct virtio_device_id id_table[] = {\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7478:\t{ VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7479-\t{ 0 }\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=78=static u64 hwsim_nan_get_master_rank(struct mac80211_hwsim_data *data)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-82-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:83:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_UP) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-84-\t\tmaster_pref = data-\u003enan.master_pref;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=216=void mac80211_hwsim_nan_rx(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-273-\tif ((slot != SLOT_24GHZ_DW \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:274:\t     data-\u003enan.phase != MAC80211_HWSIM_NAN_PHASE_SCAN) ||\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-275-\t    rx_status.freq != 2437)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-436-\t\t    (cg == own_cg \u0026\u0026 frame_amr \u003e curr_amr) ||\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:437:\t\t    data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-438-\t\t\t/* Avoid a state transition */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-468-\t\t\t */\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:469:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_UP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-470-\t\t\tdata-\u003enan.random_factor_valid_dwst = 0;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=612=mac80211_hwsim_nan_exec_state_transitions(struct mac80211_hwsim_data *data)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-625-\tif (data-\u003enan.master_transition_score \u003c 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:626:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_MASTER;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:627:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_MASTER \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-628-\t\t data-\u003enan.master_transition_score \u003e= 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:629:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:630:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_SYNC \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-631-\t\t data-\u003enan.sync_transition_score \u003e= 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:632:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_NON_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:633:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_NON_SYNC \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-634-\t\t data-\u003enan.sync_transition_score \u003c 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:635:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-636-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-641-\t */\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:642:\tif (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_MASTER \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-643-\t    !hrtimer_active(\u0026data-\u003enan.discovery_beacon_timer))\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-653-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:654:\t\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:655:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_WARMUP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-656-\t\t\tdata-\u003enan.random_factor_valid_dwst = NAN_WARMUP_DWST;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-659-\t\t} else {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:660:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_UP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-661-\t\t\tdata-\u003enan.random_factor_valid_dwst =\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=695=mac80211_hwsim_nan_tx_beacon(struct mac80211_hwsim_data *data,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-750-\tnan_attr.length = cpu_to_le16(sizeof(master_indication));\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:751:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_UP) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-752-\t\tmaster_indication.master_pref = data-\u003enan.master_pref;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=774=mac80211_hwsim_nan_slot_timer(struct hrtimer *timer)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-807-\t\ttx_sync_beacon =\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:808:\t\t\tdata-\u003enan.phase != MAC80211_HWSIM_NAN_PHASE_SCAN \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:809:\t\t\tdata-\u003enan.role != MAC80211_HWSIM_NAN_ROLE_NON_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-810-\t}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=867=mac80211_hwsim_nan_discovery_beacon_timer(struct hrtimer *timer)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-879-\tscoped_guard(spinlock, \u0026data-\u003enan.state_lock) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:880:\t\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN ||\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:881:\t\t    data-\u003enan.role != MAC80211_HWSIM_NAN_ROLE_MASTER)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-882-\t\t\treturn HRTIMER_NORESTART;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=909=int mac80211_hwsim_nan_start(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-926-\t\t/* Start in the \"scan\" phase and stay there for a little bit */\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:927:\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_SCAN;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-928-\t\tdata-\u003enan.random_factor_valid_dwst = 1;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-930-\t\tdata-\u003enan.master_pref = conf-\u003emaster_pref;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:931:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_MASTER;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-932-\t\tmemset(\u0026data-\u003enan.current_ami, 0,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=1226=bool mac80211_hwsim_nan_receive(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-1235-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:1236:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-1237-\t\treturn channel-\u003ecenter_freq == 2437;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-6-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:7:#ifndef __MAC80211_HWSIM_NAN_H\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:8:#define __MAC80211_HWSIM_NAN_H\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-9-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=10=enum mac80211_hwsim_nan_phase {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:11:\tMAC80211_HWSIM_NAN_PHASE_SCAN,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:12:\tMAC80211_HWSIM_NAN_PHASE_WARMUP,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:13:\tMAC80211_HWSIM_NAN_PHASE_UP,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-14-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=16=enum mac80211_hwsim_nan_role {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:17:\tMAC80211_HWSIM_NAN_ROLE_MASTER,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:18:\tMAC80211_HWSIM_NAN_ROLE_SYNC,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:19:\tMAC80211_HWSIM_NAN_ROLE_NON_SYNC,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-20-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=99=void mac80211_hwsim_nan_local_sched_changed(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-101-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:102:#endif /* __MAC80211_HWSIM_NAN_H */\n"
}

gemini-3.7-flash

null

null

							input: 34332
							output: 45
							thoughts: 105
						

**Analyzing the 802.11 TX Queue Airtime Check**

Okay, let's break this down. My understanding is that `ieee80211_txq_airtime_check` is triggered during the transmit process, specifically within `net/mac80211/tx.c`. I need to confirm the exact call path. It seems that `ieee80211_tx_dequeue` and `ieee80211_next_txq` are the key functions to investigate, as they're likely the primary callers of that check. My next step will be to dive deeper and analyze all of the callers of both `ieee80211_tx_dequeue` and `ieee80211_next_txq`. This will give me a clear picture of the airtime check's context and how it fits into the overall transmit queue management of the 802.11 stack.

{
  "Expression": "ieee80211_(tx_dequeue|next_txq)",
  "PathPrefix": "net/mac80211"
}

{
  "Output": "net/mac80211/tx.c=3854=static bool ieee80211_drop_unauth_port(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-3885-\nnet/mac80211/tx.c:3886:struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,\nnet/mac80211/tx.c-3887-\t\t\t\t     struct ieee80211_txq *txq)\n--\nnet/mac80211/tx.c-4078-}\nnet/mac80211/tx.c:4079:EXPORT_SYMBOL(ieee80211_tx_dequeue);\nnet/mac80211/tx.c-4080-\n--\nnet/mac80211/tx.c=4101=ieee80211_txq_keep_active(struct txq_info *txqi)\n--\nnet/mac80211/tx.c-4114-\nnet/mac80211/tx.c:4115:struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)\nnet/mac80211/tx.c-4116-{\n--\nnet/mac80211/tx.c-4177-}\nnet/mac80211/tx.c:4178:EXPORT_SYMBOL(ieee80211_next_txq);\nnet/mac80211/tx.c-4179-\nnet/mac80211/tx.c=4180=void __ieee80211_schedule_txq(struct ieee80211_hw *hw,\n--\nnet/mac80211/tx.c-4199-\t\t * get immediately moved to the back of the list on the next\nnet/mac80211/tx.c:4200:\t\t * call to ieee80211_next_txq().\nnet/mac80211/tx.c-4201-\t\t */\n--\nnet/mac80211/util.c=286=static void wake_tx_push_queue(struct ieee80211_local *local,\n--\nnet/mac80211/util.c-295-\twhile (1) {\nnet/mac80211/util.c:296:\t\tskb = ieee80211_tx_dequeue(\u0026local-\u003ehw, queue);\nnet/mac80211/util.c-297-\t\tif (!skb)\n--\nnet/mac80211/util.c=305=void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,\n--\nnet/mac80211/util.c-313-\nnet/mac80211/util.c:314:\t/* Use ieee80211_next_txq() for airtime fairness accounting */\nnet/mac80211/util.c-315-\tieee80211_txq_schedule_start(hw, txq-\u003eac);\nnet/mac80211/util.c:316:\twhile ((queue = ieee80211_next_txq(hw, txq-\u003eac))) {\nnet/mac80211/util.c-317-\t\twake_tx_push_queue(local, sdata, queue);\n"
}

gemini-3.7-flash

null

null

							input: 35659
							output: 20
							thoughts: 99
						

**Analyzing the Wireless Transmission Queue**

Okay, so I'm looking into this `ieee80211_txq_airtime_check` function, which from what I understand, is crucial for managing packet transmission and queue processing within the mac80211 framework. My immediate thought is to understand the context of the `TX_NO_PUSHBACK` flag. I need to figure out if `ath11k` is the sole driver responsible for setting this specific flag. I need to determine if other drivers might utilize it, or if there's a broader mechanism at play. Therefore, the next step is a more exhaustive investigation into the kernel source. I'm going to conduct a comprehensive search for instances of `TX_NO_PUSHBACK` throughout the entire kernel repository to gain a holistic view of its usage and implications.

{
  "Expression": "TX_NO_PUSHBACK"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/mac.c=10442=static int __ath11k_mac_register(struct ath11k *ar)\n--\ndrivers/net/wireless/ath/ath11k/mac.c-10496-\tieee80211_hw_set(ar-\u003ehw, SUPPORTS_PS);\ndrivers/net/wireless/ath/ath11k/mac.c:10497:\tieee80211_hw_set(ar-\u003ehw, TX_NO_PUSHBACK);\ndrivers/net/wireless/ath/ath11k/mac.c-10498-\tieee80211_hw_set(ar-\u003ehw, SUPPORTS_DYNAMIC_PS);\n--\ninclude/net/mac80211.h=2825=struct ieee80211_txq {\n--\ninclude/net/mac80211.h-3088- *\ninclude/net/mac80211.h:3089: * @IEEE80211_HW_TX_NO_PUSHBACK: The driver hands every frame it dequeues\ninclude/net/mac80211.h-3090- *\tto the hardware at once, and the hardware picks the station it serves\n--\ninclude/net/mac80211.h=3097=enum ieee80211_hw_flags {\n--\ninclude/net/mac80211.h-3155-\tIEEE80211_HW_SUPPORTS_NDP_BLOCKACK,\ninclude/net/mac80211.h:3156:\tIEEE80211_HW_TX_NO_PUSHBACK,\ninclude/net/mac80211.h-3157-\n--\nnet/mac80211/debugfs.c=405=static const char *hw_flag_names[] = {\n--\nnet/mac80211/debugfs.c-464-\tFLAG(SUPPORTS_NDP_BLOCKACK),\nnet/mac80211/debugfs.c:465:\tFLAG(TX_NO_PUSHBACK),\nnet/mac80211/debugfs.c-466-#undef FLAG\n--\nnet/mac80211/tx.c=4220=static u32 ieee80211_aql_sta_limit(struct ieee80211_local *local,\n--\nnet/mac80211/tx.c-4224-\nnet/mac80211/tx.c:4225:\tif (!ieee80211_hw_check(\u0026local-\u003ehw, TX_NO_PUSHBACK) ||\nnet/mac80211/tx.c-4226-\t    sta-\u003eairtime_weight == IEEE80211_DEFAULT_AIRTIME_WEIGHT)\n"
}

gemini-3.7-flash

null

null

							input: 36698
							output: 35
							thoughts: 955
						

**Worth Fuzzing Assessment: AQL Integration in mac80211**

Okay, let's break this down. My initial scan shows this patch touches a few key areas. First, we have `drivers/net/wireless/ath/ath11k/mac.c`, which is setting the `TX_NO_PUSHBACK` flag during `ath11k` hardware registration. We also see the definition of this new flag, `IEEE80211_HW_TX_NO_PUSHBACK`, in `include/net/mac80211.h`, and its addition to debugfs in `net/mac80211/debugfs.c`.  Finally, the critical piece: `net/mac80211/tx.c`, where we find the implementation of `ieee80211_aql_sta_limit` and its integration into `ieee80211_txq_airtime_check`.

Now, the important question is reachability. Can we hit that code during fuzzing? The good news is, `ieee80211_txq_airtime_check()` *always* executes for airtime checks if AQL (airtime queue limit) is enabled on a wiphy. Looking at the code:

```c
	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
		return true;

	if (static_branch_unlikely(&aql_disable))
		return true;

	if (!txq->sta)
		return atomic_read(&local->aql_mc_pending_airtime) <
		       local->aql_txq_limit_mc;

	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
		return true;

	sta = container_of(txq->sta, struct sta_info, sta);
	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
	    ieee80211_aql_sta_limit(local, sta,
				    sta->airtime[txq->ac].aql_limit_low))
		return true;

	if (atomic_read(&local->aql_total_pending_airtime) <
	    local->aql_threshold &&
	    atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
	    ieee80211_aql_sta_limit(local, sta,
				    sta->airtime[txq->ac].aql_limit_high))
		return true;

	return false;
```

Even if `!ieee80211_hw_check(&local->hw, TX_NO_PUSHBACK)`, which is what this patch is likely aimed at,  `ieee80211_aql_sta_limit` *will* be called during TX on `mac80211` when AQL is active. And let's be clear: `mac80211` is a core subsystem.

Now, can we reach `mac80211` in standard virtualized environments like QEMU or GCE? Absolutely.  We have `netlink (nl80211)`, `mac80211_hwsim`, virtual interfaces, sockets, etc., all providing paths in. Syzkaller, which I'm very familiar with, extensively exercises `mac80211` and `nl80211`.

So, considering our criteria:

*   **Reachability**: Yes, `mac80211` is reachable in standard virtualized environments via the methods above.
*   **Core Subsystem Modification**:  We're modifying `mac80211` tx scheduling / AQL logic, which is critical.
*   **Worth Fuzzing**:  **TRUE**.  This is a prime target.

Next, I'll check the Kconfig dependencies for `MAC80211` and `ATH11K` to ensure this is all properly enabled for our fuzzing setups.  We're looking for any potential obstacles, but based on this initial analysis, this patch definitely warrants further investigation and fuzzing effort.

{
  "Expression": "config MAC80211",
  "PathPrefix": "net/mac80211"
}

{
  "Output": "net/mac80211/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nnet/mac80211/Kconfig:2:config MAC80211\nnet/mac80211/Kconfig-3-\ttristate \"Generic IEEE 802.11 Networking Stack (mac80211)\"\n--\nnet/mac80211/Kconfig=19=if MAC80211 != n\nnet/mac80211/Kconfig-20-\nnet/mac80211/Kconfig:21:config MAC80211_HAS_RC\nnet/mac80211/Kconfig-22-\tbool\nnet/mac80211/Kconfig-23-\nnet/mac80211/Kconfig:24:config MAC80211_RC_MINSTREL\nnet/mac80211/Kconfig-25-\tbool \"Minstrel\" if EXPERT\n--\nnet/mac80211/Kconfig=31=choice\n--\nnet/mac80211/Kconfig-40-\nnet/mac80211/Kconfig:41:config MAC80211_RC_DEFAULT_MINSTREL\nnet/mac80211/Kconfig-42-\tbool \"Minstrel\"\n--\nnet/mac80211/Kconfig=48=endchoice\nnet/mac80211/Kconfig-49-\nnet/mac80211/Kconfig:50:config MAC80211_RC_DEFAULT\nnet/mac80211/Kconfig-51-\tstring\n--\nnet/mac80211/Kconfig=57=comment \"Some wireless drivers require a rate control algorithm\"\n--\nnet/mac80211/Kconfig-59-\nnet/mac80211/Kconfig:60:config MAC80211_KUNIT_TEST\nnet/mac80211/Kconfig-61-\ttristate \"KUnit tests for mac80211\" if !KUNIT_ALL_TESTS\n--\nnet/mac80211/Kconfig-69-\nnet/mac80211/Kconfig:70:config MAC80211_MESH\nnet/mac80211/Kconfig-71-\tbool \"Enable mac80211 mesh networking support\"\n--\nnet/mac80211/Kconfig-78-\nnet/mac80211/Kconfig:79:config MAC80211_LEDS\nnet/mac80211/Kconfig-80-\tbool \"Enable LED triggers\"\n--\nnet/mac80211/Kconfig-87-\nnet/mac80211/Kconfig:88:config MAC80211_DEBUGFS\nnet/mac80211/Kconfig-89-\tbool \"Export mac80211 internals in DebugFS\"\n--\nnet/mac80211/Kconfig-96-\nnet/mac80211/Kconfig:97:config MAC80211_MESSAGE_TRACING\nnet/mac80211/Kconfig-98-\tbool \"Trace all mac80211 debug messages\"\n--\nnet/mac80211/Kconfig-109-\nnet/mac80211/Kconfig:110:menuconfig MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-111-\tbool \"Select mac80211 debugging features\"\n--\nnet/mac80211/Kconfig-115-\nnet/mac80211/Kconfig:116:config MAC80211_NOINLINE\nnet/mac80211/Kconfig-117-\tbool \"Do not inline TX/RX handlers\"\n--\nnet/mac80211/Kconfig-131-\nnet/mac80211/Kconfig:132:config MAC80211_VERBOSE_DEBUG\nnet/mac80211/Kconfig-133-\tbool \"Verbose debugging output\"\n--\nnet/mac80211/Kconfig-142-\nnet/mac80211/Kconfig:143:config MAC80211_MLME_DEBUG\nnet/mac80211/Kconfig-144-\tbool \"Verbose managed MLME output\"\n--\nnet/mac80211/Kconfig-153-\nnet/mac80211/Kconfig:154:config MAC80211_STA_DEBUG\nnet/mac80211/Kconfig-155-\tbool \"Verbose station debugging\"\n--\nnet/mac80211/Kconfig-162-\nnet/mac80211/Kconfig:163:config MAC80211_HT_DEBUG\nnet/mac80211/Kconfig-164-\tbool \"Verbose HT debugging\"\n--\nnet/mac80211/Kconfig-174-\nnet/mac80211/Kconfig:175:config MAC80211_OCB_DEBUG\nnet/mac80211/Kconfig-176-\tbool \"Verbose OCB debugging\"\n--\nnet/mac80211/Kconfig-185-\nnet/mac80211/Kconfig:186:config MAC80211_IBSS_DEBUG\nnet/mac80211/Kconfig-187-\tbool \"Verbose IBSS debugging\"\n--\nnet/mac80211/Kconfig-196-\nnet/mac80211/Kconfig:197:config MAC80211_PS_DEBUG\nnet/mac80211/Kconfig-198-\tbool \"Verbose powersave mode debugging\"\n--\nnet/mac80211/Kconfig-208-\nnet/mac80211/Kconfig:209:config MAC80211_MPL_DEBUG\nnet/mac80211/Kconfig-210-\tbool \"Verbose mesh peer link debugging\"\n--\nnet/mac80211/Kconfig-221-\nnet/mac80211/Kconfig:222:config MAC80211_MPATH_DEBUG\nnet/mac80211/Kconfig-223-\tbool \"Verbose mesh path debugging\"\n--\nnet/mac80211/Kconfig-234-\nnet/mac80211/Kconfig:235:config MAC80211_MHWMP_DEBUG\nnet/mac80211/Kconfig-236-\tbool \"Verbose mesh HWMP routing debugging\"\n--\nnet/mac80211/Kconfig-247-\nnet/mac80211/Kconfig:248:config MAC80211_MESH_SYNC_DEBUG\nnet/mac80211/Kconfig-249-\tbool \"Verbose mesh synchronization debugging\"\n--\nnet/mac80211/Kconfig-258-\nnet/mac80211/Kconfig:259:config MAC80211_MESH_CSA_DEBUG\nnet/mac80211/Kconfig-260-\tbool \"Verbose mesh channel switch debugging\"\n--\nnet/mac80211/Kconfig-269-\nnet/mac80211/Kconfig:270:config MAC80211_MESH_PS_DEBUG\nnet/mac80211/Kconfig-271-\tbool \"Verbose mesh powersave debugging\"\n--\nnet/mac80211/Kconfig-280-\nnet/mac80211/Kconfig:281:config MAC80211_TDLS_DEBUG\nnet/mac80211/Kconfig-282-\tbool \"Verbose TDLS debugging\"\n--\nnet/mac80211/Kconfig-292-\nnet/mac80211/Kconfig:293:config MAC80211_DEBUG_COUNTERS\nnet/mac80211/Kconfig-294-\tbool \"Extra statistics for TX/RX debugging\"\n--\nnet/mac80211/Kconfig-307-\nnet/mac80211/Kconfig:308:config MAC80211_STA_HASH_MAX_SIZE\nnet/mac80211/Kconfig-309-\tint \"Station hash table maximum size\" if MAC80211_DEBUG_MENU\n"
}

gemini-3.7-flash

null

null

							input: 40843
							output: 37
							thoughts: 34
						

Okay, let's dive into this. Here's how I'd approach that kernel configuration file check:

**Examining MAC80211 Dependencies**

Alright, before I get too deep into this problem, I want to take a look at the `net/mac80211/Kconfig` file, specifically lines 1 through 20. That's usually a good starting point to understand the dependencies and core configuration options for the MAC80211 wireless stack. I'm expecting to see things like platform drivers that it relies on, various feature flags, and potentially architecture-specific configurations in that initial section. This'll help me build a mental model of the requirements before I start digging into any particular issue. I need to understand what other components the MAC80211 layer links to so I can get a fuller picture of its relationship to the system as a whole.

{
  "File": "net/mac80211/Kconfig",
  "FirstLine": 1,
  "LineCount": 25
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\tconfig MAC80211\n   3:\t\ttristate \"Generic IEEE 802.11 Networking Stack (mac80211)\"\n   4:\t\tdepends on CFG80211\n   5:\t\tselect CRYPTO\n   6:\t\tselect CRYPTO_LIB_AES_CBC_MACS\n   7:\t\tselect CRYPTO_LIB_ARC4\n   8:\t\tselect CRYPTO_AES\n   9:\t\tselect CRYPTO_CCM\n  10:\t\tselect CRYPTO_GCM\n  11:\t\tselect CRC32\n  12:\t\thelp\n  13:\t\t  This option enables the hardware independent IEEE 802.11\n  14:\t\t  networking stack.\n  15:\t\n  16:\tcomment \"CFG80211 needs to be enabled for MAC80211\"\n  17:\t\tdepends on CFG80211=n\n  18:\t\n  19:\tif MAC80211 != n\n  20:\t\n  21:\tconfig MAC80211_HAS_RC\n  22:\t\tbool\n  23:\t\n  24:\tconfig MAC80211_RC_MINSTREL\n  25:\t\tbool \"Minstrel\" if EXPERT\n"
}

gemini-3.7-flash

null

null

							input: 41452
							output: 31
							thoughts: 17
						

Here's a summary of my thought process, as if I were the one thinking it:

**Digging Deeper: CFG80211 Dependencies**

Okay, so we've been looking at this issue from a few angles, and I think we need to broaden our scope just a bit. While the initial focus was [original problem area, if given in the context], it's also worth checking the `CFG80211` dependencies. It's a key component in the wireless stack, and a potential hiccup there could easily be causing these symptoms, either directly or indirectly. It's the sort of detail that can get overlooked in the bigger picture, but I've learned that overlooking it is not a luxury I can afford at this point. Time to take a closer look at that module and its interactions.

{
  "Expression": "config CFG80211",
  "PathPrefix": "net/wireless"
}

{
  "Output": "net/wireless/Kconfig=14=config WEXT_PRIV\n--\nnet/wireless/Kconfig-16-\nnet/wireless/Kconfig:17:config CFG80211\nnet/wireless/Kconfig-18-\ttristate \"cfg80211 - wireless configuration API\"\n--\nnet/wireless/Kconfig=38=config NL80211_TESTMODE\n--\nnet/wireless/Kconfig-51-\nnet/wireless/Kconfig:52:config CFG80211_DEVELOPER_WARNINGS\nnet/wireless/Kconfig-53-\tbool \"enable developer warnings\"\n--\nnet/wireless/Kconfig-67-\nnet/wireless/Kconfig:68:config CFG80211_CERTIFICATION_ONUS\nnet/wireless/Kconfig-69-\tbool \"cfg80211 certification onus\"\n--\nnet/wireless/Kconfig-88-\nnet/wireless/Kconfig:89:config CFG80211_REQUIRE_SIGNED_REGDB\nnet/wireless/Kconfig-90-\tbool \"require regdb signature\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-98-\nnet/wireless/Kconfig:99:config CFG80211_USE_KERNEL_REGDB_KEYS\nnet/wireless/Kconfig-100-\tbool \"allow regdb keys shipped with the kernel\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-110-\nnet/wireless/Kconfig:111:config CFG80211_EXTRA_REGDB_KEYDIR\nnet/wireless/Kconfig-112-\tstring \"additional regdb key directory\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-121-\nnet/wireless/Kconfig:122:config CFG80211_REG_CELLULAR_HINTS\nnet/wireless/Kconfig-123-\tbool \"cfg80211 regulatory support for cellular base station hints\"\n--\nnet/wireless/Kconfig-134-\nnet/wireless/Kconfig:135:config CFG80211_REG_RELAX_NO_IR\nnet/wireless/Kconfig-136-\tbool \"cfg80211 support for NO_IR relaxation\"\n--\nnet/wireless/Kconfig-158-\nnet/wireless/Kconfig:159:config CFG80211_DEFAULT_PS\nnet/wireless/Kconfig-160-\tbool \"enable powersave by default\"\n--\nnet/wireless/Kconfig-168-\nnet/wireless/Kconfig:169:config CFG80211_DEBUGFS\nnet/wireless/Kconfig-170-\tbool \"cfg80211 DebugFS entries\"\n--\nnet/wireless/Kconfig-176-\nnet/wireless/Kconfig:177:config CFG80211_CRDA_SUPPORT\nnet/wireless/Kconfig-178-\tbool \"support CRDA\" if EXPERT\n--\nnet/wireless/Kconfig-186-\nnet/wireless/Kconfig:187:config CFG80211_WEXT\nnet/wireless/Kconfig-188-\tbool \"cfg80211 wireless extensions compatibility\"\n--\nnet/wireless/Kconfig-193-\nnet/wireless/Kconfig:194:config CFG80211_KUNIT_TEST\nnet/wireless/Kconfig-195-\ttristate \"KUnit tests for cfg80211\" if !KUNIT_ALL_TESTS\n"
}

gemini-3.7-flash

null

null

							input: 42594
							output: 37
							thoughts: 12
						

Here's my take on the dependencies, as if I were thinking it:

**Digging into ATH11K Dependencies**

Okay, time to get my hands dirty with `ATH11K`. First things first, let's nail down those dependencies. I need to understand what this thing is leaning on to make sure I don't miss anything crucial. I'm thinking drivers, firmware versions, specific hardware revisions – the whole shebang. Let's start mapping out the relationships, piece by piece, so I can have a complete picture of its ecosystem.

{
  "Expression": "config ATH11K",
  "PathPrefix": "drivers/net/wireless/ath/ath11k"
}

{
  "Output": "drivers/net/wireless/ath/ath11k/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Kconfig:2:config ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-3-\ttristate \"Qualcomm 802.11ax chipset support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig:13:config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig-14-\ttristate \"Atheros ath11k AHB support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-19-\ndrivers/net/wireless/ath/ath11k/Kconfig:20:config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig-21-\ttristate \"Atheros ath11k PCI support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-29-\ndrivers/net/wireless/ath/ath11k/Kconfig:30:config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig-31-\tbool \"QCA ath11k debugging\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-37-\ndrivers/net/wireless/ath/ath11k/Kconfig:38:config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-39-\tbool \"QCA ath11k debugfs support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-45-\ndrivers/net/wireless/ath/ath11k/Kconfig:46:config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-47-\tbool \"ath11k tracing support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig:52:config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig-53-\tbool \"QCA ath11k spectral scan support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-60-\ndrivers/net/wireless/ath/ath11k/Kconfig:61:config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig-62-\tbool \"ath11k channel frequency response support\"\n"
}

gemini-3.7-flash

null

null

							input: 43444
							output: 41
							thoughts: 29
						

Here's my summary, as if I were thinking these thoughts:

**Examining the Ath11k Kconfig Configuration**

Okay, time to dive into the Atheros 11k driver's configuration. Let's start by scrutinizing the `drivers/net/wireless/ath/ath11k/Kconfig` file, specifically the first 25 lines. This usually contains the core selection options, any dependencies on other subsystems, and potentially some basic default settings. I'm looking for the foundational building blocks of how this driver is configured within the kernel. I expect to see the main driver enable/disable option, likely `CONFIG_ATH11K`, and its dependencies on core wireless infrastructure like the cfg80211 layer, mac80211, and the ath module in general. I’ll be paying close attention to any conditional dependencies that might require a specific hardware platform or firmware version. Understanding this initial section will paint a clear picture of how to enable, disable, and tailor the Ath11k driver's functionality at compile time. It’s the starting point for understanding how the user can even choose to enable this driver or not. Any initial assumptions or configurations will likely be set in these first 25 lines.

{
  "File": "drivers/net/wireless/ath/ath11k/Kconfig",
  "FirstLine": 1,
  "LineCount": 25
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\tconfig ATH11K\n   3:\t\ttristate \"Qualcomm 802.11ax chipset support\"\n   4:\t\tdepends on MAC80211 \u0026\u0026 HAS_DMA\n   5:\t\tselect ATH_COMMON\n   6:\t\tselect QCOM_QMI_HELPERS\n   7:\t\thelp\n   8:\t\t  This module adds support for Qualcomm Technologies 802.11ax family of\n   9:\t\t  chipsets.\n  10:\t\n  11:\t\t  If you choose to build a module, it'll be called ath11k.\n  12:\t\n  13:\tconfig ATH11K_AHB\n  14:\t\ttristate \"Atheros ath11k AHB support\"\n  15:\t\tdepends on ATH11K\n  16:\t\tdepends on REMOTEPROC\n  17:\t\thelp\n  18:\t\t  This module adds support for AHB bus\n  19:\t\n  20:\tconfig ATH11K_PCI\n  21:\t\ttristate \"Atheros ath11k PCI support\"\n  22:\t\tdepends on ATH11K \u0026\u0026 PCI\n  23:\t\tselect MHI_BUS\n  24:\t\tselect QRTR\n  25:\t\tselect QRTR_MHI\n"
}

gemini-3.7-flash

null

null

							input: 44122
							output: 263
							thoughts: 1128
						

**Focusing on Airtime Queue Limits: A Deep Dive**

Okay, let's nail down these FocusSymbols. My initial pass has identified a few key functions that have been modified or added:

1.  `ieee80211_aql_sta_limit` (static, in `net/mac80211/tx.c`)
2.  `ieee80211_txq_airtime_check` (in `net/mac80211/tx.c`)
3.  `ieee80211_tx_dequeue` (calls `ieee80211_txq_airtime_check`, in `net/mac80211/tx.c`)
4.  `ieee80211_next_txq` (also calls `ieee80211_txq_airtime_check`, in `net/mac80211/tx.c`)
5.  `__ath11k_mac_register` (in `drivers/net/wireless/ath/ath11k/mac.c`)

Now, a quick check on the static nature of `ieee80211_aql_sta_limit`... Ah, yes, it's static. But, critically, `ieee80211_txq_airtime_check` is exported, as are `ieee80211_tx_dequeue` and `ieee80211_next_txq`. This means the airtime checking is definitely exposed. The calculation and related calls were changed in `ieee80211_txq_airtime_check`, so it's a prime target. Since `ieee80211_aql_sta_limit` is a static C function, it's likely to be inlined into `ieee80211_txq_airtime_check`, so it's also worth examining.

Therefore, `ieee80211_txq_airtime_check` becomes a key focus symbol, along with `ieee80211_next_txq`, `ieee80211_tx_dequeue`, and `__ath11k_mac_register`.

Next, I need to check the EnableConfigs. The relevant ones seem to be:

*   `MAC80211`
*   `CFG80211` (parent)
*   `ATH11K`

I should see if `MAC80211_DEBUGFS`, `ATH11K_PCI` / `ATH11K_AHB`, or `MAC80211_HWSIM` are relevant. `MAC80211` is the core, `CFG80211` is its parent. `ATH11K` seems to handle the driver side, compiling `ath11k/mac.c`.  `MAC80211_DEBUGFS` is worth including.

Let's do a final sanity check, ensuring everything is as expected:

*   `WorthFuzzing: true` - Good.
*   `EnableConfigs`: `["MAC80211", "CFG80211", "ATH11K", "MAC80211_DEBUGFS"]` - Yep, all set.
*   `FocusSymbols`: `["ieee80211_txq_airtime_check", "ieee80211_aql_sta_limit", "ieee80211_next_txq", "ieee80211_tx_dequeue", "__ath11k_mac_register"]` - Consistent.

Just to be absolutely sure, let's verify all the symbol names:

*   `ieee80211_txq_airtime_check` (net/mac80211/tx.c)
*   `ieee80211_aql_sta_limit` (net/mac80211/tx.c)
*   `ieee80211_next_txq` (net/mac80211/tx.c)
*   `ieee80211_tx_dequeue` (net/mac80211/tx.c)
*   `__ath11k_mac_register` (drivers/net/wireless/ath/ath11k/mac.c)

The reasoning seems sound: This patch introduces

{
  "EnableConfigs": [
    "MAC80211",
    "CFG80211",
    "ATH11K",
    "MAC80211_DEBUGFS"
  ],
  "FocusSymbols": [
    "ieee80211_txq_airtime_check",
    "ieee80211_aql_sta_limit",
    "ieee80211_next_txq",
    "ieee80211_tx_dequeue",
    "__ath11k_mac_register"
  ],
  "Reasoning": "The patch introduces the IEEE80211_HW_TX_NO_PUSHBACK hardware flag and adds station airtime queue limit calculation (ieee80211_aql_sta_limit) to the mac80211 TX queue airtime check (ieee80211_txq_airtime_check). The mac80211 subsystem is reachable in virtualized environments via mac80211_hwsim and nl80211 interfaces, making these queue scheduling and airtime calculation changes worth fuzzing.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MAC80211",
    "CFG80211",
    "ATH11K",
    "MAC80211_DEBUGFS"
  ],
  "FocusSymbols": [
    "ieee80211_txq_airtime_check",
    "ieee80211_aql_sta_limit",
    "ieee80211_next_txq",
    "ieee80211_tx_dequeue",
    "__ath11k_mac_register"
  ],
  "Reasoning": "The patch introduces the IEEE80211_HW_TX_NO_PUSHBACK hardware flag and adds station airtime queue limit calculation (ieee80211_aql_sta_limit) to the mac80211 TX queue airtime check (ieee80211_txq_airtime_check). The mac80211 subsystem is reachable in virtualized environments via mac80211_hwsim and nl80211 interfaces, making these queue scheduling and airtime calculation changes worth fuzzing.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

core

null

{
  "KMSANReasoning": "The patch adds the `IEEE80211_HW_TX_NO_PUSHBACK` hardware flag for mac80211/ath11k and adjusts station Airtime Queue Limit (AQL) calculations based on station airtime weight when this flag is enabled.\n\nAll struct fields accessed (such as `sta-\u003eairtime_weight`, `local-\u003eaql_threshold`, and `sta-\u003eairtime[].aql_limit_*`) are standard integer fields initialized during station creation and driver configuration. Local variables in the new calculation helper `ieee80211_aql_sta_limit()` are explicitly assigned before use. No heap/stack allocations, memory copy operations to user space, or uninitialized memory reads are introduced or modified.\n\nTherefore, dedicated KMSAN fuzzing is not needed; any standard concurrency or logic issues are covered by standard KASAN/kernel debugging tools.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 111651b156fc2196665dddf9db62beac67715504
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Sep 8 18:09:27 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 2d55cdc4d165d..87e6062c55509 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -10494,6 +10494,7 @@ static int __ath11k_mac_register(struct ath11k *ar)
 
 	ieee80211_hw_set(ar->hw, SIGNAL_DBM);
 	ieee80211_hw_set(ar->hw, SUPPORTS_PS);
+	ieee80211_hw_set(ar->hw, TX_NO_PUSHBACK);
 	ieee80211_hw_set(ar->hw, SUPPORTS_DYNAMIC_PS);
 	ieee80211_hw_set(ar->hw, MFP_CAPABLE);
 	ieee80211_hw_set(ar->hw, REPORTS_TX_ACK_STATUS);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 7bb4618065b67..80381c7abd84a 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3086,6 +3086,12 @@ struct ieee80211_txq {
  * @IEEE80211_HW_SUPPORTS_NDP_BLOCKACK: HW can transmit/receive S1G NDP
  *	BlockAck frames.
  *
+ * @IEEE80211_HW_TX_NO_PUSHBACK: The driver hands every frame it dequeues
+ *	to the hardware at once, and the hardware picks the station it serves
+ *	next, so the order in which mac80211 schedules the queues does not
+ *	reach the air. mac80211 then applies the airtime weight to the
+ *	airtime queue limit instead.
+ *
  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
  */
 enum ieee80211_hw_flags {
@@ -3147,6 +3153,7 @@ enum ieee80211_hw_flags {
 	IEEE80211_HW_HANDLES_QUIET_CSA,
 	IEEE80211_HW_STRICT,
 	IEEE80211_HW_SUPPORTS_NDP_BLOCKACK,
+	IEEE80211_HW_TX_NO_PUSHBACK,
 
 	/* keep last, obviously */
 	NUM_IEEE80211_HW_FLAGS
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 8946b027782cf..ddbfa991ec74e 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -462,6 +462,7 @@ static const char *hw_flag_names[] = {
 	FLAG(HANDLES_QUIET_CSA),
 	FLAG(STRICT),
 	FLAG(SUPPORTS_NDP_BLOCKACK),
+	FLAG(TX_NO_PUSHBACK),
 #undef FLAG
 };
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c33092960df26..c94efff48d747 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4217,6 +4217,21 @@ EXPORT_SYMBOL(__ieee80211_schedule_txq);
 
 DEFINE_STATIC_KEY_FALSE(aql_disable);
 
+static u32 ieee80211_aql_sta_limit(struct ieee80211_local *local,
+				   struct sta_info *sta, u32 limit)
+{
+	u32 scaled;
+
+	if (!ieee80211_hw_check(&local->hw, TX_NO_PUSHBACK) ||
+	    sta->airtime_weight == IEEE80211_DEFAULT_AIRTIME_WEIGHT)
+		return limit;
+
+	scaled = mult_frac(limit, sta->airtime_weight,
+			   IEEE80211_DEFAULT_AIRTIME_WEIGHT);
+
+	return min(scaled, max(limit, local->aql_threshold));
+}
+
 bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
 				 struct ieee80211_txq *txq)
 {
@@ -4238,13 +4253,15 @@ bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
 
 	sta = container_of(txq->sta, struct sta_info, sta);
 	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
-	    sta->airtime[txq->ac].aql_limit_low)
+	    ieee80211_aql_sta_limit(local, sta,
+				    sta->airtime[txq->ac].aql_limit_low))
 		return true;
 
 	if (atomic_read(&local->aql_total_pending_airtime) <
 	    local->aql_threshold &&
 	    atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
-	    sta->airtime[txq->ac].aql_limit_high)
+	    ieee80211_aql_sta_limit(local, sta,
+				    sta->airtime[txq->ac].aql_limit_high))
 		return true;
 
 	return false;

gemini-3.7-flash

null

null

							input: 3506
							output: 32
							thoughts: 493
						

**Analyzing the Patch for Uninitialized Memory Risks**

Okay, let's dive into this patch and see if we need to bring in KMSAN. First things first, I need to understand what's changed and where the potential for uninitialized memory lies.

The patch includes additions to a few files: `ath11k/mac.c`, `mac80211.h`, `debugfs.c`, and `tx.c`. It looks like it's enabling `TX_NO_PUSHBACK` and adding some airtime weight calculations related to a new helper `ieee80211_aql_sta_limit`.

Specifically, this `ieee80211_aql_sta_limit` function is what I need to focus on. It uses `sta->airtime_weight`. This could be a problem if `sta->airtime_weight` isn't properly initialized. I see that if `ieee80211_hw_check` returns true, or `sta->airtime_weight` is set to `IEEE80211_DEFAULT_AIRTIME_WEIGHT`, the function directly returns `limit`. It only calculates something when `sta->airtime_weight` is set to something else.

So, the key here is to confirm how `sta->airtime_weight` gets initialized. I need to trace where `sta` is allocated and populated, and then look for where and how `airtime_weight` is set. Let's start with a search of the mac80211 code for any relevant references to `airtime_weight`.

{
  "Expression": "airtime_weight",
  "PathPrefix": "net/mac80211"
}

{
  "Output": "net/mac80211/cfg.c=2450=static int sta_apply_parameters(struct ieee80211_local *local,\n--\nnet/mac80211/cfg.c-2586-\nnet/mac80211/cfg.c:2587:\tif (params-\u003eairtime_weight)\nnet/mac80211/cfg.c:2588:\t\tsta-\u003eairtime_weight = params-\u003eairtime_weight;\nnet/mac80211/cfg.c-2589-\n--\nnet/mac80211/debugfs_sta.c=188=static ssize_t sta_airtime_read(struct file *file, char __user *userbuf,\n--\nnet/mac80211/debugfs_sta.c-213-\t\t\"Deficit: VO: %d us VI: %d us BE: %d us BK: %d us\\n\",\nnet/mac80211/debugfs_sta.c:214:\t\trx_airtime, tx_airtime, sta-\u003eairtime_weight,\nnet/mac80211/debugfs_sta.c-215-\t\tdeficit[0], deficit[1], deficit[2], deficit[3]);\n--\nnet/mac80211/debugfs_sta.c=222=static ssize_t sta_airtime_write(struct file *file, const char __user *userbuf,\n--\nnet/mac80211/debugfs_sta.c-232-\t\tsta-\u003eairtime[ac].tx_airtime = 0;\nnet/mac80211/debugfs_sta.c:233:\t\tsta-\u003eairtime[ac].deficit = sta-\u003eairtime_weight;\nnet/mac80211/debugfs_sta.c-234-\t\tspin_unlock_bh(\u0026local-\u003eactive_txq_lock[ac]);\n--\nnet/mac80211/sta_info.c=633=__sta_info_alloc(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/sta_info.c-729-\nnet/mac80211/sta_info.c:730:\tsta-\u003eairtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;\nnet/mac80211/sta_info.c-731-\n--\nnet/mac80211/sta_info.c-734-\t\tskb_queue_head_init(\u0026sta-\u003etx_filtered[i]);\nnet/mac80211/sta_info.c:735:\t\tsta-\u003eairtime[i].deficit = sta-\u003eairtime_weight;\nnet/mac80211/sta_info.c-736-\t\tatomic_set(\u0026sta-\u003eairtime[i].aql_tx_pending, 0);\n--\nnet/mac80211/sta_info.c=2837=static void sta_set_link_sinfo(struct sta_info *sta,\n--\nnet/mac80211/sta_info.c-2955-\tif (!(link_sinfo-\u003efilled \u0026 BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {\nnet/mac80211/sta_info.c:2956:\t\tlink_sinfo-\u003eairtime_weight = sta-\u003eairtime_weight;\nnet/mac80211/sta_info.c-2957-\t\tlink_sinfo-\u003efilled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);\n--\nnet/mac80211/sta_info.c=3079=void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,\n--\nnet/mac80211/sta_info.c-3187-\tif (!(sinfo-\u003efilled \u0026 BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {\nnet/mac80211/sta_info.c:3188:\t\tsinfo-\u003eairtime_weight = sta-\u003eairtime_weight;\nnet/mac80211/sta_info.c-3189-\t\tsinfo-\u003efilled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);\n--\nnet/mac80211/sta_info.h=619=struct ieee80211_sta_removed_link_stats {\n--\nnet/mac80211/sta_info.h-676- *\tstation\nnet/mac80211/sta_info.h:677: * @airtime_weight: station weight for airtime fairness calculation purposes\nnet/mac80211/sta_info.h-678- * @ampdu_mlme: A-MPDU state machine state\n--\nnet/mac80211/sta_info.h=715=struct sta_info {\n--\nnet/mac80211/sta_info.h-766-\tstruct airtime_info airtime[IEEE80211_NUM_ACS];\nnet/mac80211/sta_info.h:767:\tu16 airtime_weight;\nnet/mac80211/sta_info.h-768-\n--\nnet/mac80211/tx.c=4115=struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)\n--\nnet/mac80211/tx.c-4154-\t\t\tsta-\u003eairtime[txqi-\u003etxq.ac].deficit +=\nnet/mac80211/tx.c:4155:\t\t\t\tsta-\u003eairtime_weight;\nnet/mac80211/tx.c-4156-\n--\nnet/mac80211/tx.c=4220=static u32 ieee80211_aql_sta_limit(struct ieee80211_local *local,\n--\nnet/mac80211/tx.c-4225-\tif (!ieee80211_hw_check(\u0026local-\u003ehw, TX_NO_PUSHBACK) ||\nnet/mac80211/tx.c:4226:\t    sta-\u003eairtime_weight == IEEE80211_DEFAULT_AIRTIME_WEIGHT)\nnet/mac80211/tx.c-4227-\t\treturn limit;\nnet/mac80211/tx.c-4228-\nnet/mac80211/tx.c:4229:\tscaled = mult_frac(limit, sta-\u003eairtime_weight,\nnet/mac80211/tx.c-4230-\t\t\t   IEEE80211_DEFAULT_AIRTIME_WEIGHT);\n--\nnet/mac80211/tx.c=4308=bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,\n--\nnet/mac80211/tx.c-4338-\t\tif (ieee80211_sta_deficit(sta, ac) \u003c 0)\nnet/mac80211/tx.c:4339:\t\t\tsta-\u003eairtime[ac].deficit += sta-\u003eairtime_weight;\nnet/mac80211/tx.c-4340-\t\tlist_move_tail(\u0026iter-\u003eschedule_order, \u0026local-\u003eactive_txqs[ac]);\n--\nnet/mac80211/tx.c-4346-\nnet/mac80211/tx.c:4347:\tsta-\u003eairtime[ac].deficit += sta-\u003eairtime_weight;\nnet/mac80211/tx.c-4348-\tlist_move_tail(\u0026txqi-\u003eschedule_order, \u0026local-\u003eactive_txqs[ac]);\n"
}

gemini-3.7-flash

null

null

							input: 6411
							output: 217
							thoughts: 438
						

**Analyzing the Patch for Uninitialized Memory Risks**

Okay, let's break down this patch and see if it introduces any nasty surprises, particularly around uninitialized memory. First, we're adding a new hardware flag, `IEEE80211_HW_TX_NO_PUSHBACK`, to mac80211. Good, standard procedure. We're also adding the string name for debugfs, which is a common practice. This is pretty straightforward. The flag is getting set within `ath11k`, which makes sense given the context.

The meat of it seems to be this new helper function, `ieee80211_aql_sta_limit`. This is where the airtime weighting comes in. It appears this function scales the AQL limit based on a station's airtime weight when `TX_NO_PUSHBACK` is active. Looking at the variables used, it seems like we're dealing with `local`, `sta`, and `limit`. The `sta` is initialized during station creation with `kzalloc` in `__sta_info_alloc`, and, importantly, its `airtime_weight` is initialized as well with `IEEE80211_DEFAULT_AIRTIME_WEIGHT`. The `scaled` value is a local `u32` that is explicitly computed and assigned before being returned.

Now, the crucial question: are we accidentally reading uninitialized memory, leaking information, or introducing a use-after-free situation? It doesn't look like it. The calculation of `scaled` within `ieee80211_aql_sta_limit` uses `mult_frac(...)` and returns `min(...)`, so it seems pretty self-contained. The new string entry in `debugfs.c` is just a string, which is fine. Setting the bit in `ath11k` with `ieee80211_hw_set()` isn't inherently risky. There are no `copy_to_user` or netlink calls that could be leaking info. No uninitialized fields or memory allocations are being done by these changes, and we're not modifying pointers or buffer sizes in a way that would open up uninitialized memory reads.

Therefore, my conclusion is that this patch doesn't introduce any new uninitialized memory risks. Standard KASAN checks and existing tests should be sufficient to catch any potential problems, and we can safely set `NeedsKMSAN = false`. Let's log this with `set-results`.

{
  "KMSANReasoning": "The patch adds the `IEEE80211_HW_TX_NO_PUSHBACK` hardware flag for mac80211/ath11k and adjusts station Airtime Queue Limit (AQL) calculations based on station airtime weight when this flag is enabled.\n\nAll struct fields accessed (such as `sta-\u003eairtime_weight`, `local-\u003eaql_threshold`, and `sta-\u003eairtime[].aql_limit_*`) are standard integer fields initialized during station creation and driver configuration. Local variables in the new calculation helper `ieee80211_aql_sta_limit()` are explicitly assigned before use. No heap/stack allocations, memory copy operations to user space, or uninitialized memory reads are introduced or modified.\n\nTherefore, dedicated KMSAN fuzzing is not needed; any standard concurrency or logic issues are covered by standard KASAN/kernel debugging tools.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch adds the `IEEE80211_HW_TX_NO_PUSHBACK` hardware flag for mac80211/ath11k and adjusts station Airtime Queue Limit (AQL) calculations based on station airtime weight when this flag is enabled.\n\nAll struct fields accessed (such as `sta-\u003eairtime_weight`, `local-\u003eaql_threshold`, and `sta-\u003eairtime[].aql_limit_*`) are standard integer fields initialized during station creation and driver configuration. Local variables in the new calculation helper `ieee80211_aql_sta_limit()` are explicitly assigned before use. No heap/stack allocations, memory copy operations to user space, or uninitialized memory reads are introduced or modified.\n\nTherefore, dedicated KMSAN fuzzing is not needed; any standard concurrency or logic issues are covered by standard KASAN/kernel debugging tools.",
  "NeedsKMSAN": false
}