| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/10 07:57 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies ath11k_fw_request_firmware_api_n in drivers/net/wireless/ath/ath11k/fw.c, which belongs to the Qualcomm 802.11ax (ath11k) wireless driver. This driver requires specific physical Qualcomm PCIe/AHB hardware that is not emulated in standard QEMU/GCE virtualized fuzzing environments, making the modified code structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/10 07:57 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 273258c9e50126395b026484c776034215e4368c\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Sep 10 07:57:46 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/fw.c b/drivers/net/wireless/ath/ath11k/fw.c\nindex ef1b4c81843a3..88ec2ffd9f00e 100644\n--- a/drivers/net/wireless/ath/ath11k/fw.c\n+++ b/drivers/net/wireless/ath/ath11k/fw.c\n@@ -16,10 +16,12 @@ static int ath11k_fw_request_firmware_api_n(struct ath11k_base *ab,\n \tstruct ath11k_fw_ie *hdr;\n \tconst u8 *data;\n \t__le32 *timestamp;\n+\tchar path[100];\n \n-\tab-\u003efw.fw = ath11k_core_firmware_request(ab, name);\n-\tif (IS_ERR(ab-\u003efw.fw)) {\n-\t\tret = PTR_ERR(ab-\u003efw.fw);\n+\tath11k_core_create_firmware_path(ab, name, path, sizeof(path));\n+\n+\tret = request_firmware_direct(\u0026ab-\u003efw.fw, path, ab-\u003edev);\n+\tif (ret) {\n \t\tath11k_dbg(ab, ATH11K_DBG_BOOT, \"failed to load %s: %d\\n\", name, ret);\n \t\tab-\u003efw.fw = NULL;\n \t\treturn ret;\n"
} |
| 2/1 | 2026/09/10 07:57 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies ath11k_fw_request_firmware_api_n in drivers/net/wireless/ath/ath11k/fw.c, which belongs to the Qualcomm 802.11ax (ath11k) wireless driver. This driver requires specific physical Qualcomm PCIe/AHB hardware that is not emulated in standard QEMU/GCE virtualized fuzzing environments, making the modified code structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 273258c9e50126395b026484c776034215e4368c
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Sep 10 07:57:46 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/ath/ath11k/fw.c b/drivers/net/wireless/ath/ath11k/fw.c
index ef1b4c81843a3..88ec2ffd9f00e 100644
--- a/drivers/net/wireless/ath/ath11k/fw.c
+++ b/drivers/net/wireless/ath/ath11k/fw.c
@@ -16,10 +16,12 @@ static int ath11k_fw_request_firmware_api_n(struct ath11k_base *ab,
struct ath11k_fw_ie *hdr;
const u8 *data;
__le32 *timestamp;
+ char path[100];
- ab->fw.fw = ath11k_core_firmware_request(ab, name);
- if (IS_ERR(ab->fw.fw)) {
- ret = PTR_ERR(ab->fw.fw);
+ ath11k_core_create_firmware_path(ab, name, path, sizeof(path));
+
+ ret = request_firmware_direct(&ab->fw.fw, path, ab->dev);
+ if (ret) {
ath11k_dbg(ab, ATH11K_DBG_BOOT, "failed to load %s: %d\n", name, ret);
ab->fw.fw = NULL;
return ret;
|
| 3/2 | 2026/09/10 07:57 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 3038 output: 36 thoughts: 274 Thoughts: **Analyzing a Qualcomm Wireless Driver Patch** Okay, let's dive into this patch. It looks like we're changing something in `drivers/net/wireless/ath/ath11k/fw.c`. Specifically, we're looking at a function called `ath11k_fw_request_firmware_api_n`. Right away, I see the old code used `ath11k_core_firmware_request` to fetch the firmware directly, and now we're replacing that with a call to `ath11k_core_create_firmware_path` and `request_firmware_direct`. Interesting. It looks like it's building a path, and then using a direct request. The older method might have had some issues, or perhaps this new approach offers some advantages in terms of control or error handling, given the change from a direct assignment to a return code check. Now, a quick reminder: `ath11k`... right, that's Qualcomm's IEEE 802.11ax wireless driver. The key question is whether this is running in a typical virtualized environment like QEMU or Google Compute Engine, or if this is targeting physical hardware, be it PCIe, AHB, SDIO, or something else entirely. The context around the firmware request is crucial for understanding the implications. I'll need to double check the bus and Kconfig settings within the `ath11k` directory to get a better sense of the target environment and potential limitations. I'll need to check how the firmware path is actually built and where it's looking for the files. |
| 4/2 | 2026/09/10 07:57 | tool | grepper |
0mArgs:{
"Expression": "ATH11K",
"PathPrefix": "drivers/net/wireless/ath/ath11k"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 9310 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath11k/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Kconfig:2:config ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-3-\ttristate \"Qualcomm 802.11ax chipset support\"\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig:13:config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig-14-\ttristate \"Atheros ath11k AHB support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:15:\tdepends on ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-16-\tdepends on REMOTEPROC\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-19-\ndrivers/net/wireless/ath/ath11k/Kconfig:20:config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig-21-\ttristate \"Atheros ath11k PCI support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:22:\tdepends on ATH11K \u0026\u0026 PCI\ndrivers/net/wireless/ath/ath11k/Kconfig-23-\tselect MHI_BUS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-29-\ndrivers/net/wireless/ath/ath11k/Kconfig:30:config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig-31-\tbool \"QCA ath11k debugging\"\ndrivers/net/wireless/ath/ath11k/Kconfig:32:\tdepends on ATH11K\ndrivers/net/wireless/ath/ath11k/Kconfig-33-\thelp\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-37-\ndrivers/net/wireless/ath/ath11k/Kconfig:38:config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-39-\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:40:\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-41-\thelp\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-45-\ndrivers/net/wireless/ath/ath11k/Kconfig:46:config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-47-\tbool \"ath11k tracing support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:48:\tdepends on ATH11K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-49-\thelp\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\ndrivers/net/wireless/ath/ath11k/Kconfig:52:config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig-53-\tbool \"QCA ath11k spectral scan support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:54:\tdepends on ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-55-\tdepends on RELAY\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-60-\ndrivers/net/wireless/ath/ath11k/Kconfig:61:config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig-62-\tbool \"ath11k channel frequency response support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:63:\tdepends on ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-64-\tdepends on RELAY\n--\ndrivers/net/wireless/ath/ath11k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Makefile:2:obj-$(CONFIG_ATH11K) += ath11k.o\ndrivers/net/wireless/ath/ath11k/Makefile-3-ath11k-y += core.o \\\n--\ndrivers/net/wireless/ath/ath11k/Makefile-23-\ndrivers/net/wireless/ath/ath11k/Makefile:24:ath11k-$(CONFIG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath11k/Makefile-25-ath11k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath11k/Makefile:26:ath11k-$(CONFIG_ATH11K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath11k/Makefile-27-ath11k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath11k/Makefile:28:ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath11k/Makefile-29-ath11k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath11k/Makefile=30=ath11k-$(CONFIG_DEV_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath11k/Makefile:31:ath11k-$(CONFIG_ATH11K_CFR) += cfr.o\ndrivers/net/wireless/ath/ath11k/Makefile-32-\ndrivers/net/wireless/ath/ath11k/Makefile:33:obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-34-ath11k_ahb-y += ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-35-\ndrivers/net/wireless/ath/ath11k/Makefile:36:obj-$(CONFIG_ATH11K_PCI) += ath11k_pci.o\ndrivers/net/wireless/ath/ath11k/Makefile-37-ath11k_pci-y += mhi.o pci.o\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=24=static const struct of_device_id ath11k_ahb_of_match[] = {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-28-\t{ .compatible = \"qcom,ipq8074-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:29:\t .data = (void *)ATH11K_HW_IPQ8074,\ndrivers/net/wireless/ath/ath11k/ahb.c-30-\t},\ndrivers/net/wireless/ath/ath11k/ahb.c-31-\t{ .compatible = \"qcom,ipq6018-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:32:\t .data = (void *)ATH11K_HW_IPQ6018_HW10,\ndrivers/net/wireless/ath/ath11k/ahb.c-33-\t},\ndrivers/net/wireless/ath/ath11k/ahb.c-34-\t{ .compatible = \"qcom,wcn6750-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:35:\t .data = (void *)ATH11K_HW_WCN6750_HW10,\ndrivers/net/wireless/ath/ath11k/ahb.c-36-\t},\ndrivers/net/wireless/ath/ath11k/ahb.c-37-\t{ .compatible = \"qcom,ipq5018-wifi\",\ndrivers/net/wireless/ath/ath11k/ahb.c:38:\t .data = (void *)ATH11K_HW_IPQ5018_HW10,\ndrivers/net/wireless/ath/ath11k/ahb.c-39-\t},\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=43=MODULE_DEVICE_TABLE(of, ath11k_ahb_of_match);\ndrivers/net/wireless/ath/ath11k/ahb.c-44-\ndrivers/net/wireless/ath/ath11k/ahb.c:45:#define ATH11K_IRQ_CE0_OFFSET 4\ndrivers/net/wireless/ath/ath11k/ahb.c-46-\ndrivers/net/wireless/ath/ath11k/ahb.c:47:static const char *irq_name[ATH11K_IRQ_NUM_MAX] = {\ndrivers/net/wireless/ath/ath11k/ahb.c-48-\t\"misc-pulse1\",\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=151=ath11k_ahb_get_window_start_wcn6750(struct ath11k_base *ab, u32 offset)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-155-\t/* If offset lies within DP register range, use 1st window */\ndrivers/net/wireless/ath/ath11k/ahb.c:156:\tif ((offset ^ HAL_SEQ_WCSS_UMAC_OFFSET) \u003c ATH11K_PCI_WINDOW_RANGE_MASK)\ndrivers/net/wireless/ath/ath11k/ahb.c:157:\t\twindow_start = ATH11K_PCI_WINDOW_START;\ndrivers/net/wireless/ath/ath11k/ahb.c-158-\t/* If offset lies within CE register range, use 2nd window */\ndrivers/net/wireless/ath/ath11k/ahb.c-159-\telse if ((offset ^ HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab)) \u003c\ndrivers/net/wireless/ath/ath11k/ahb.c:160:\t\t ATH11K_PCI_WINDOW_RANGE_MASK)\ndrivers/net/wireless/ath/ath11k/ahb.c:161:\t\twindow_start = 2 * ATH11K_PCI_WINDOW_START;\ndrivers/net/wireless/ath/ath11k/ahb.c-162-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=167=ath11k_ahb_window_write32_wcn6750(struct ath11k_base *ab, u32 offset, u32 value)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-174-\tiowrite32(value, ab-\u003emem + window_start +\ndrivers/net/wireless/ath/ath11k/ahb.c:175:\t\t (offset \u0026 ATH11K_PCI_WINDOW_RANGE_MASK));\ndrivers/net/wireless/ath/ath11k/ahb.c-176-}\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=178=static u32 ath11k_ahb_window_read32_wcn6750(struct ath11k_base *ab, u32 offset)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-186-\tval = ioread32(ab-\u003emem + window_start +\ndrivers/net/wireless/ath/ath11k/ahb.c:187:\t\t (offset \u0026 ATH11K_PCI_WINDOW_RANGE_MASK));\ndrivers/net/wireless/ath/ath11k/ahb.c-188-\treturn val;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=231=static void __ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-234-\ndrivers/net/wireless/ath/ath11k/ahb.c:235:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-236-\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=272=static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-277-\ndrivers/net/wireless/ath/ath11k/ahb.c:278:\tie1_reg_addr = ce_ie_addr-\u003eie1_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:279:\tie2_reg_addr = ce_ie_addr-\u003eie2_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:280:\tie3_reg_addr = ce_ie_addr-\u003eie3_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-281-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=293=static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-298-\ndrivers/net/wireless/ath/ath11k/ahb.c:299:\tie1_reg_addr = ce_ie_addr-\u003eie1_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:300:\tie2_reg_addr = ce_ie_addr-\u003eie2_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c:301:\tie3_reg_addr = ce_ie_addr-\u003eie3_reg_addr + ATH11K_CE_OFFSET(ab);\ndrivers/net/wireless/ath/ath11k/ahb.c-302-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=314=static void ath11k_ahb_sync_ce_irqs(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-322-\ndrivers/net/wireless/ath/ath11k/ahb.c:323:\t\tirq_idx = ATH11K_IRQ_CE0_OFFSET + i;\ndrivers/net/wireless/ath/ath11k/ahb.c-324-\t\tsynchronize_irq(ab-\u003eirq_num[irq_idx]);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=328=static void ath11k_ahb_sync_ext_irqs(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-332-\ndrivers/net/wireless/ath/ath11k/ahb.c:333:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-334-\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=373=static void ath11k_ahb_ext_irq_enable(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-376-\ndrivers/net/wireless/ath/ath11k/ahb.c:377:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-378-\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=394=static void ath11k_ahb_stop(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-395-{\ndrivers/net/wireless/ath/ath11k/ahb.c:396:\tif (!test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ahb.c-397-\t\tath11k_ahb_ce_irqs_disable(ab);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=446=static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-449-\ndrivers/net/wireless/ath/ath11k/ahb.c:450:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++)\ndrivers/net/wireless/ath/ath11k/ahb.c-451-\t\tath11k_ahb_free_ext_irq_grp(ab, \u0026ab-\u003eext_irq_grp[i]);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=454=static void ath11k_ahb_free_ce_irqs(struct ath11k_base *ab, int max_idx)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-460-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath11k/ahb.c:461:\t\tirq_idx = ATH11K_IRQ_CE0_OFFSET + i;\ndrivers/net/wireless/ath/ath11k/ahb.c-462-\t\tfree_irq(ab-\u003eirq_num[irq_idx], \u0026ab-\u003ece.ce_pipe[i]);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=532=static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-539-\ndrivers/net/wireless/ath/ath11k/ahb.c:540:\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-541-\t\tu32 num_irq = 0;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-557-\ndrivers/net/wireless/ath/ath11k/ahb.c:558:\t\tfor (j = 0; j \u003c ATH11K_EXT_IRQ_NUM_MAX; j++) {\ndrivers/net/wireless/ath/ath11k/ahb.c-559-\t\t\tif (ab-\u003ehw_params.ring_mask-\u003etx[i] \u0026 BIT(j)) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=633=static int ath11k_ahb_config_irq(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-647-\ndrivers/net/wireless/ath/ath11k/ahb.c:648:\t\tirq_idx = ATH11K_IRQ_CE0_OFFSET + i;\ndrivers/net/wireless/ath/ath11k/ahb.c-649-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=718=static int ath11k_ahb_hif_suspend(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-727-\ndrivers/net/wireless/ath/ath11k/ahb.c:728:\twake_irq = ab-\u003eirq_num[ATH11K_PCI_IRQ_CE0_OFFSET + ATH11K_PCI_CE_WAKE_IRQ];\ndrivers/net/wireless/ath/ath11k/ahb.c-729-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-736-\tvalue = u32_encode_bits(ab_ahb-\u003esmp2p_info.seq_no++,\ndrivers/net/wireless/ath/ath11k/ahb.c:737:\t\t\t\tATH11K_AHB_SMP2P_SMEM_SEQ_NO);\ndrivers/net/wireless/ath/ath11k/ahb.c:738:\tvalue |= u32_encode_bits(ATH11K_AHB_POWER_SAVE_ENTER,\ndrivers/net/wireless/ath/ath11k/ahb.c:739:\t\t\t\t ATH11K_AHB_SMP2P_SMEM_MSG);\ndrivers/net/wireless/ath/ath11k/ahb.c-740-\ndrivers/net/wireless/ath/ath11k/ahb.c-741-\tret = qcom_smem_state_update_bits(ab_ahb-\u003esmp2p_info.smem_state,\ndrivers/net/wireless/ath/ath11k/ahb.c:742:\t\t\t\t\t ATH11K_AHB_SMP2P_SMEM_VALUE_MASK, value);\ndrivers/net/wireless/ath/ath11k/ahb.c-743-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-747-\ndrivers/net/wireless/ath/ath11k/ahb.c:748:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device suspended\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-749-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=753=static int ath11k_ahb_hif_resume(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-762-\ndrivers/net/wireless/ath/ath11k/ahb.c:763:\twake_irq = ab-\u003eirq_num[ATH11K_PCI_IRQ_CE0_OFFSET + ATH11K_PCI_CE_WAKE_IRQ];\ndrivers/net/wireless/ath/ath11k/ahb.c-764-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-773-\tvalue = u32_encode_bits(ab_ahb-\u003esmp2p_info.seq_no++,\ndrivers/net/wireless/ath/ath11k/ahb.c:774:\t\t\t\tATH11K_AHB_SMP2P_SMEM_SEQ_NO);\ndrivers/net/wireless/ath/ath11k/ahb.c:775:\tvalue |= u32_encode_bits(ATH11K_AHB_POWER_SAVE_EXIT,\ndrivers/net/wireless/ath/ath11k/ahb.c:776:\t\t\t\t ATH11K_AHB_SMP2P_SMEM_MSG);\ndrivers/net/wireless/ath/ath11k/ahb.c-777-\ndrivers/net/wireless/ath/ath11k/ahb.c-778-\tret = qcom_smem_state_update_bits(ab_ahb-\u003esmp2p_info.smem_state,\ndrivers/net/wireless/ath/ath11k/ahb.c:779:\t\t\t\t\t ATH11K_AHB_SMP2P_SMEM_VALUE_MASK, value);\ndrivers/net/wireless/ath/ath11k/ahb.c-780-\tif (ret) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-790-\ndrivers/net/wireless/ath/ath11k/ahb.c:791:\tath11k_dbg(ab, ATH11K_DBG_AHB, \"device resumed\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-792-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=848=static int ath11k_ahb_setup_msi_resources(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-892-\ndrivers/net/wireless/ath/ath11k/ahb.c:893:\tset_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, \u0026ab-\u003edev_flags);\ndrivers/net/wireless/ath/ath11k/ahb.c-894-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1139=static int ath11k_ahb_probe(struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1149-\tswitch (hw_rev) {\ndrivers/net/wireless/ath/ath11k/ahb.c:1150:\tcase ATH11K_HW_IPQ8074:\ndrivers/net/wireless/ath/ath11k/ahb.c:1151:\tcase ATH11K_HW_IPQ6018_HW10:\ndrivers/net/wireless/ath/ath11k/ahb.c:1152:\tcase ATH11K_HW_IPQ5018_HW10:\ndrivers/net/wireless/ath/ath11k/ahb.c-1153-\t\thif_ops = \u0026ath11k_ahb_hif_ops_ipq8074;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1155-\t\tbreak;\ndrivers/net/wireless/ath/ath11k/ahb.c:1156:\tcase ATH11K_HW_WCN6750_HW10:\ndrivers/net/wireless/ath/ath11k/ahb.c-1157-\t\thif_ops = \u0026ath11k_ahb_hif_ops_wcn6750;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1171-\tab = ath11k_core_alloc(\u0026pdev-\u003edev, sizeof(struct ath11k_ahb),\ndrivers/net/wireless/ath/ath11k/ahb.c:1172:\t\t\t ATH11K_BUS_AHB);\ndrivers/net/wireless/ath/ath11k/ahb.c-1173-\tif (!ab) {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1180-\tab-\u003ehw_rev = hw_rev;\ndrivers/net/wireless/ath/ath11k/ahb.c:1181:\tab-\u003efw_mode = ATH11K_FIRMWARE_MODE_NORMAL;\ndrivers/net/wireless/ath/ath11k/ahb.c-1182-\tplatform_set_drvdata(pdev, ab);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1264=static void ath11k_ahb_remove_prepare(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1267-\ndrivers/net/wireless/ath/ath11k/ahb.c:1268:\tif (test_bit(ATH11K_FLAG_RECOVERY, \u0026ab-\u003edev_flags)) {\ndrivers/net/wireless/ath/ath11k/ahb.c-1269-\t\tleft = wait_for_completion_timeout(\u0026ab-\u003edriver_recovery,\ndrivers/net/wireless/ath/ath11k/ahb.c:1270:\t\t\t\t\t\t ATH11K_AHB_RECOVERY_TIMEOUT);\ndrivers/net/wireless/ath/ath11k/ahb.c-1271-\t\tif (!left)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1274-\ndrivers/net/wireless/ath/ath11k/ahb.c:1275:\tset_bit(ATH11K_FLAG_UNREGISTERING, \u0026ab-\u003edev_flags);\ndrivers/net/wireless/ath/ath11k/ahb.c-1276-\tcancel_work_sync(\u0026ab-\u003erestart_work);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1295=static void ath11k_ahb_remove(struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1298-\ndrivers/net/wireless/ath/ath11k/ahb.c:1299:\tif (test_bit(ATH11K_FLAG_QMI_FAIL, \u0026ab-\u003edev_flags)) {\ndrivers/net/wireless/ath/ath11k/ahb.c-1300-\t\tath11k_ahb_power_down(ab, false);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1314=static void ath11k_ahb_shutdown(struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1323-\ndrivers/net/wireless/ath/ath11k/ahb.c:1324:\tif (!(test_bit(ATH11K_FLAG_REGISTERED, \u0026ab-\u003edev_flags)))\ndrivers/net/wireless/ath/ath11k/ahb.c-1325-\t\tgoto free_resources;\n--\ndrivers/net/wireless/ath/ath11k/ahb.h-5- */\ndrivers/net/wireless/ath/ath11k/ahb.h:6:#ifndef ATH11K_AHB_H\ndrivers/net/wireless/ath/ath11k/ahb.h:7:#define ATH11K_AHB_H\ndrivers/net/wireless/ath/ath11k/ahb.h-8-\n--\ndrivers/net/wireless/ath/ath11k/ahb.h-10-\ndrivers/net/wireless/ath/ath11k/ahb.h:11:#define ATH11K_AHB_RECOVERY_TIMEOUT (3 * HZ)\ndrivers/net/wireless/ath/ath11k/ahb.h-12-\ndrivers/net/wireless/ath/ath11k/ahb.h:13:#define ATH11K_AHB_SMP2P_SMEM_MSG\t\tGENMASK(15, 0)\ndrivers/net/wireless/ath/ath11k/ahb.h:14:#define ATH11K_AHB_SMP2P_SMEM_SEQ_NO\t\tGENMASK(31, 16)\ndrivers/net/wireless/ath/ath11k/ahb.h:15:#define ATH11K_AHB_SMP2P_SMEM_VALUE_MASK\t0xFFFFFFFF\ndrivers/net/wireless/ath/ath11k/ahb.h-16-\ndrivers/net/wireless/ath/ath11k/ahb.h=17=enum ath11k_ahb_smp2p_msg_id {\ndrivers/net/wireless/ath/ath11k/ahb.h:18:\tATH11K_AHB_POWER_SAVE_ENTER = 1,\ndrivers/net/wireless/ath/ath11k/ahb.h:19:\tATH11K_AHB_POWER_SAVE_EXIT,\ndrivers/net/wireless/ath/ath11k/ahb.h-20-};\n--\ndrivers/net/wireless/ath/ath11k/ce.c=321=static int ath11k_ce_rx_post_pipe(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-350-\ndrivers/net/wireless/ath/ath11k/ce.c:351:\t\tATH11K_SKB_RXCB(skb)-\u003epaddr = paddr;\ndrivers/net/wireless/ath/ath11k/ce.c-352-\n--\ndrivers/net/wireless/ath/ath11k/ce.c-355-\t\tif (ret) {\ndrivers/net/wireless/ath/ath11k/ce.c:356:\t\t\tath11k_dbg(ab, ATH11K_DBG_CE, \"failed to enqueue rx buf: %d\\n\",\ndrivers/net/wireless/ath/ath11k/ce.c-357-\t\t\t\t ret);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=417=static void ath11k_ce_recv_process_cb(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-427-\t\tmax_nbytes = skb-\u003elen + skb_tailroom(skb);\ndrivers/net/wireless/ath/ath11k/ce.c:428:\t\tdma_unmap_single(ab-\u003edev, ATH11K_SKB_RXCB(skb)-\u003epaddr,\ndrivers/net/wireless/ath/ath11k/ce.c-429-\t\t\t\t max_nbytes, DMA_FROM_DEVICE);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-442-\twhile ((skb = __skb_dequeue(\u0026list))) {\ndrivers/net/wireless/ath/ath11k/ce.c:443:\t\tath11k_dbg(ab, ATH11K_DBG_CE, \"rx ce pipe %d len %d\\n\",\ndrivers/net/wireless/ath/ath11k/ce.c-444-\t\t\t pipe-\u003epipe_num, skb-\u003elen);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-452-\t\tmod_timer(\u0026ab-\u003erx_replenish_retry,\ndrivers/net/wireless/ath/ath11k/ce.c:453:\t\t\t jiffies + ATH11K_CE_RX_POST_RETRY_JIFFIES);\ndrivers/net/wireless/ath/ath11k/ce.c-454-\t}\n--\ndrivers/net/wireless/ath/ath11k/ce.c=498=static void ath11k_ce_tx_process_cb(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-508-\ndrivers/net/wireless/ath/ath11k/ce.c:509:\t\tdma_unmap_single(ab-\u003edev, ATH11K_SKB_CB(skb)-\u003epaddr, skb-\u003elen,\ndrivers/net/wireless/ath/ath11k/ce.c-510-\t\t\t\t DMA_TO_DEVICE);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-520-\twhile ((skb = __skb_dequeue(\u0026list))) {\ndrivers/net/wireless/ath/ath11k/ce.c:521:\t\tath11k_dbg(ab, ATH11K_DBG_CE, \"tx ce pipe %d len %d\\n\",\ndrivers/net/wireless/ath/ath11k/ce.c-522-\t\t\t pipe-\u003epipe_num, skb-\u003elen);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=553=static int ath11k_ce_init_ring(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/ce.c-604-\t\tath11k_dp_shadow_init_timer(ab, \u0026ab-\u003ece.hp_timer[ce_id],\ndrivers/net/wireless/ath/ath11k/ce.c:605:\t\t\t\t\t ATH11K_SHADOW_CTRL_TIMER_INTERVAL,\ndrivers/net/wireless/ath/ath11k/ce.c-606-\t\t\t\t\t ce_ring-\u003ehal_ring_id);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=709=int ath11k_ce_send(struct ath11k_base *ab, struct sk_buff *skb, u8 pipe_id,\n--\ndrivers/net/wireless/ath/ath11k/ce.c-738-\ndrivers/net/wireless/ath/ath11k/ce.c:739:\t\tif (num_used \u003e ATH11K_CE_USAGE_THRESHOLD)\ndrivers/net/wireless/ath/ath11k/ce.c-740-\t\t\tath11k_ce_poll_send_completed(ab, pipe-\u003epipe_num);\n--\ndrivers/net/wireless/ath/ath11k/ce.c-742-\ndrivers/net/wireless/ath/ath11k/ce.c:743:\tif (test_bit(ATH11K_FLAG_CRASH_FLUSH, \u0026ab-\u003edev_flags))\ndrivers/net/wireless/ath/ath11k/ce.c-744-\t\treturn -ESHUTDOWN;\n--\ndrivers/net/wireless/ath/ath11k/ce.c-772-\ndrivers/net/wireless/ath/ath11k/ce.c:773:\tath11k_hal_ce_src_set_desc(desc, ATH11K_SKB_CB(skb)-\u003epaddr,\ndrivers/net/wireless/ath/ath11k/ce.c-774-\t\t\t\t skb-\u003elen, transfer_id, byte_swap_data);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=799=static void ath11k_ce_rx_pipe_cleanup(struct ath11k_ce_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-814-\t\tring-\u003eskb[i] = NULL;\ndrivers/net/wireless/ath/ath11k/ce.c:815:\t\tdma_unmap_single(ab-\u003edev, ATH11K_SKB_RXCB(skb)-\u003epaddr,\ndrivers/net/wireless/ath/ath11k/ce.c-816-\t\t\t\t skb-\u003elen + skb_tailroom(skb), DMA_FROM_DEVICE);\n--\ndrivers/net/wireless/ath/ath11k/ce.c=883=void ath11k_ce_rx_post_buf(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ce.c-898-\t\t\tmod_timer(\u0026ab-\u003erx_replenish_retry,\ndrivers/net/wireless/ath/ath11k/ce.c:899:\t\t\t\t jiffies + ATH11K_CE_RX_POST_RETRY_JIFFIES);\ndrivers/net/wireless/ath/ath11k/ce.c-900-\n--\ndrivers/net/wireless/ath/ath11k/ce.h-6-\ndrivers/net/wireless/ath/ath11k/ce.h:7:#ifndef ATH11K_CE_H\ndrivers/net/wireless/ath/ath11k/ce.h:8:#define ATH11K_CE_H\ndrivers/net/wireless/ath/ath11k/ce.h-9-\n--\ndrivers/net/wireless/ath/ath11k/ce.h-25-/* Threshold to poll for tx completion in case of Interrupt disabled CE's */\ndrivers/net/wireless/ath/ath11k/ce.h:26:#define ATH11K_CE_USAGE_THRESHOLD 32\ndrivers/net/wireless/ath/ath11k/ce.h-27-\ndrivers/net/wireless/ath/ath11k/ce.h=28=void ath11k_ce_byte_swap(void *mem, u32 len);\n--\ndrivers/net/wireless/ath/ath11k/ce.h-61-\ndrivers/net/wireless/ath/ath11k/ce.h:62:#define ATH11K_CE_RX_POST_RETRY_JIFFIES 50\ndrivers/net/wireless/ath/ath11k/ce.h-63-\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=19=static int ath11k_cfr_calculate_tones_from_dma_hdr(struct ath11k_cfr_dma_hdr *hdr)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-24-\tswitch (preamble) {\ndrivers/net/wireless/ath/ath11k/cfr.c:25:\tcase ATH11K_CFR_PREAMBLE_TYPE_LEGACY:\ndrivers/net/wireless/ath/ath11k/cfr.c-26-\t\tfallthrough;\ndrivers/net/wireless/ath/ath11k/cfr.c:27:\tcase ATH11K_CFR_PREAMBLE_TYPE_VHT:\ndrivers/net/wireless/ath/ath11k/cfr.c-28-\t\tswitch (bw) {\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-39-\t\t}\ndrivers/net/wireless/ath/ath11k/cfr.c:40:\tcase ATH11K_CFR_PREAMBLE_TYPE_HT:\ndrivers/net/wireless/ath/ath11k/cfr.c-41-\t\tswitch (bw) {\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=114=ath11k_cfr_correlate_and_relay(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-121-\ndrivers/net/wireless/ath/ath11k/cfr.c:122:\tif (event_type == ATH11K_CORRELATE_TX_EVENT) {\ndrivers/net/wireless/ath/ath11k/cfr.c-123-\t\tif (lut-\u003etx_recv)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-126-\t\tlut-\u003etx_recv = true;\ndrivers/net/wireless/ath/ath11k/cfr.c:127:\t} else if (event_type == ATH11K_CORRELATE_DBR_EVENT) {\ndrivers/net/wireless/ath/ath11k/cfr.c-128-\t\tcfr-\u003edbr_evt_cnt++;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-140-\t\t\t\tdiff = lut-\u003edbr_tstamp - lut-\u003etxrx_tstamp;\ndrivers/net/wireless/ath/ath11k/cfr.c:141:\t\t\t\tath11k_dbg(ar-\u003eab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-142-\t\t\t\t\t \"txrx event -\u003e dbr event delay = %u ms\",\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-145-\t\t\t\tdiff = lut-\u003etxrx_tstamp - lut-\u003edbr_tstamp;\ndrivers/net/wireless/ath/ath11k/cfr.c:146:\t\t\t\tath11k_dbg(ar-\u003eab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-147-\t\t\t\t\t \"dbr event -\u003e txrx event delay = %u ms\",\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-153-\t\t\tcfr-\u003erelease_cnt++;\ndrivers/net/wireless/ath/ath11k/cfr.c:154:\t\t\tstatus = ATH11K_CORRELATE_STATUS_RELEASE;\ndrivers/net/wireless/ath/ath11k/cfr.c-155-\t\t} else {\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-160-\ndrivers/net/wireless/ath/ath11k/cfr.c:161:\t\t\tath11k_dbg(ar-\u003eab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-162-\t\t\t\t \"Received dbr event twice for the same lut entry\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-166-\t\t\tcfr-\u003ecfr_dma_aborts++;\ndrivers/net/wireless/ath/ath11k/cfr.c:167:\t\t\tstatus = ATH11K_CORRELATE_STATUS_HOLD;\ndrivers/net/wireless/ath/ath11k/cfr.c-168-\t\t}\ndrivers/net/wireless/ath/ath11k/cfr.c-169-\t} else {\ndrivers/net/wireless/ath/ath11k/cfr.c:170:\t\tstatus = ATH11K_CORRELATE_STATUS_HOLD;\ndrivers/net/wireless/ath/ath11k/cfr.c-171-\t}\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=176=static int ath11k_cfr_process_data(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-178-{\ndrivers/net/wireless/ath/ath11k/cfr.c:179:\tu32 end_magic = ATH11K_CFR_END_MAGIC;\ndrivers/net/wireless/ath/ath11k/cfr.c-180-\tstruct ath11k_csi_cfr_header *header;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-218-\ndrivers/net/wireless/ath/ath11k/cfr.c:219:\tath11k_dbg_dump(ab, ATH11K_DBG_CFR_DUMP, \"data_from_buf_rel:\", \"\",\ndrivers/net/wireless/ath/ath11k/cfr.c-220-\t\t\tdata, length);\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-235-\tstatus = ath11k_cfr_correlate_and_relay(ar, lut,\ndrivers/net/wireless/ath/ath11k/cfr.c:236:\t\t\t\t\t\tATH11K_CORRELATE_DBR_EVENT);\ndrivers/net/wireless/ath/ath11k/cfr.c:237:\tif (status == ATH11K_CORRELATE_STATUS_RELEASE) {\ndrivers/net/wireless/ath/ath11k/cfr.c:238:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-239-\t\t\t \"releasing CFR data to user space\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-244-\t\tath11k_cfr_release_lut_entry(lut);\ndrivers/net/wireless/ath/ath11k/cfr.c:245:\t} else if (status == ATH11K_CORRELATE_STATUS_HOLD) {\ndrivers/net/wireless/ath/ath11k/cfr.c:246:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-247-\t\t\t \"tx event is not yet received holding the buf\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=255=static void ath11k_cfr_fill_hdr_info(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-261-\tcfr = \u0026ar-\u003ecfr;\ndrivers/net/wireless/ath/ath11k/cfr.c:262:\theader-\u003ecfr_metadata_version = ATH11K_CFR_META_VERSION_4;\ndrivers/net/wireless/ath/ath11k/cfr.c:263:\theader-\u003ecfr_data_version = ATH11K_CFR_DATA_VERSION_1;\ndrivers/net/wireless/ath/ath11k/cfr.c-264-\theader-\u003ecfr_metadata_len = sizeof(struct cfr_metadata);\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-285-\theader-\u003emeta_data.capture_mode = params-\u003ebandwidth ?\ndrivers/net/wireless/ath/ath11k/cfr.c:286:\t\tATH11K_CFR_CAPTURE_DUP_LEGACY_ACK : ATH11K_CFR_CAPTURE_LEGACY_ACK;\ndrivers/net/wireless/ath/ath11k/cfr.c-287-\theader-\u003emeta_data.capture_type = params-\u003ecapture_method;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=300=int ath11k_process_cfr_capture_event(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-303-\tstruct ath11k_look_up_table *lut = NULL;\ndrivers/net/wireless/ath/ath11k/cfr.c:304:\tu32 end_magic = ATH11K_CFR_END_MAGIC;\ndrivers/net/wireless/ath/ath11k/cfr.c-305-\tstruct ath11k_csi_cfr_header *header;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-378-\theader = \u0026lut-\u003eheader;\ndrivers/net/wireless/ath/ath11k/cfr.c:379:\theader-\u003estart_magic_num = ATH11K_CFR_START_MAGIC;\ndrivers/net/wireless/ath/ath11k/cfr.c-380-\theader-\u003evendorid = VENDOR_QCA;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-385-\tstatus = ath11k_cfr_correlate_and_relay(ar, lut,\ndrivers/net/wireless/ath/ath11k/cfr.c:386:\t\t\t\t\t\tATH11K_CORRELATE_TX_EVENT);\ndrivers/net/wireless/ath/ath11k/cfr.c:387:\tif (status == ATH11K_CORRELATE_STATUS_RELEASE) {\ndrivers/net/wireless/ath/ath11k/cfr.c:388:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-389-\t\t\t \"Releasing CFR data to user space\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-398-\t\t\t\t\t WMI_DIRECT_BUF_CFR);\ndrivers/net/wireless/ath/ath11k/cfr.c:399:\t} else if (status == ATH11K_CORRELATE_STATUS_HOLD) {\ndrivers/net/wireless/ath/ath11k/cfr.c:400:\t\tath11k_dbg(ab, ATH11K_DBG_CFR,\ndrivers/net/wireless/ath/ath11k/cfr.c-401-\t\t\t \"dbr event is not yet received holding buf\\n\");\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=412=bool ath11k_cfr_peer_is_in_cfr_unassoc_pool(struct ath11k *ar, const u8 *peer_mac)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-421-\tspin_lock_bh(\u0026cfr-\u003elock);\ndrivers/net/wireless/ath/ath11k/cfr.c:422:\tfor (i = 0; i \u003c ATH11K_MAX_CFR_ENABLED_CLIENTS; i++) {\ndrivers/net/wireless/ath/ath11k/cfr.c-423-\t\tentry = \u0026cfr-\u003eunassoc_pool[i];\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=438=void ath11k_cfr_update_unassoc_pool_entry(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-445-\tspin_lock_bh(\u0026cfr-\u003elock);\ndrivers/net/wireless/ath/ath11k/cfr.c:446:\tfor (i = 0; i \u003c ATH11K_MAX_CFR_ENABLED_CLIENTS; i++) {\ndrivers/net/wireless/ath/ath11k/cfr.c-447-\t\tentry = \u0026cfr-\u003eunassoc_pool[i];\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=477=ath11k_cfr_bw_to_fw_cfr_bw(enum ath11k_cfr_capture_bw bw)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-479-\tswitch (bw) {\ndrivers/net/wireless/ath/ath11k/cfr.c:480:\tcase ATH11K_CFR_CAPTURE_BW_20:\ndrivers/net/wireless/ath/ath11k/cfr.c-481-\t\treturn WMI_PEER_CFR_CAPTURE_BW_20;\ndrivers/net/wireless/ath/ath11k/cfr.c:482:\tcase ATH11K_CFR_CAPTURE_BW_40:\ndrivers/net/wireless/ath/ath11k/cfr.c-483-\t\treturn WMI_PEER_CFR_CAPTURE_BW_40;\ndrivers/net/wireless/ath/ath11k/cfr.c:484:\tcase ATH11K_CFR_CAPTURE_BW_80:\ndrivers/net/wireless/ath/ath11k/cfr.c-485-\t\treturn WMI_PEER_CFR_CAPTURE_BW_80;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=492=ath11k_cfr_method_to_fw_cfr_method(enum ath11k_cfr_capture_method method)\n--\ndrivers/net/wireless/ath/ath11k/cfr.c-494-\tswitch (method) {\ndrivers/net/wireless/ath/ath11k/cfr.c:495:\tcase ATH11K_CFR_CAPTURE_METHOD_NULL_FRAME:\ndrivers/net/wireless/ath/ath11k/cfr.c-496-\t\treturn WMI_CFR_CAPTURE_METHOD_NULL_FRAME;\ndrivers/net/wireless/ath/ath11k/cfr.c:497:\tcase ATH11K_CFR_CAPTURE_METHOD_NULL_FRAME_WITH_PHASE:\ndrivers/net/wireless/ath/ath11k/cfr.c-498-\t\treturn WMI_CFR_CAPTURE_METHOD_NULL_FRAME_WITH_PHASE;\ndrivers/net/wireless/ath/ath11k/cfr.c:499:\tcase ATH11K_CFR_CAPTURE_METHOD_PROBE_RESP:\ndrivers/net/wireless/ath/ath11k/cfr.c-500-\t\treturn WMI_CFR_CAPTURE_METHOD_PROBE_RESP;\n--\ndrivers/net/wireless/ath/ath11k/cfr.c=506=int ath11k_cfr_send_peer_cfr_capture_cmd(struct ath11k *ar,\n\n"
} |
| 5/2 | 2026/09/10 07:57 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18170 output: 38 thoughts: 68 Thoughts: Here's my summary, as the expert: **Investigating ath11k PCI Device Support** Okay, so I'm looking at `ath11k` and immediately I'm thinking about its hardware support. Specifically, I need to understand how it's dealing with different bus interfaces. Right, right, it's pretty clear: `ath11k` is built for either the AHB bus (`ATH11K_AHB`) or PCI (`ATH11K_PCI`). Now, the question is, *which* PCI devices are actually recognized and handled by this driver? That's what I really need to drill down on. Therefore, I need to dive into the `ath11k_pci.c` source code, or potentially the relevant PCI infrastructure code (`pci.c`) to understand the specific PCI device IDs that are within the purview of the driver. Let's see what device IDs it's actually matching. That should tell the whole story. |
| 6/2 | 2026/09/10 07:57 | tool | grepper |
0mArgs:{
"Expression": "pci_device_id",
"PathPrefix": "drivers/net/wireless/ath/ath11k"
}Results: {
"Output": "drivers/net/wireless/ath/ath11k/pci.c-35-\ndrivers/net/wireless/ath/ath11k/pci.c:36:static const struct pci_device_id ath11k_pci_id_table[] = {\ndrivers/net/wireless/ath/ath11k/pci.c-37-\t{ PCI_VDEVICE(QCOM, QCA6390_DEVICE_ID) },\n--\ndrivers/net/wireless/ath/ath11k/pci.c=949=static int ath11k_pci_probe(struct pci_dev *pdev,\ndrivers/net/wireless/ath/ath11k/pci.c:950:\t\t\t const struct pci_device_id *pci_dev)\ndrivers/net/wireless/ath/ath11k/pci.c-951-{\n"
} |
| 7/2 | 2026/09/10 07:57 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18718 output: 44 thoughts: 37 Thoughts: Here's a summary of my thought process, as requested: **Diving into the Atheros Driver - PCI ID Table** Okay, so I need to get into the Atheros driver code, specifically the `ath11k` module, and I'm focusing on the PCI interface. The first thing that comes to mind is the device ID table. It's usually the place where the driver associates itself with specific hardware. So, I'm going to navigate over to `drivers/net/wireless/ath/ath11k/pci.c` and take a look at the `ath11k_pci_id_table`. That table should hold the PCI device IDs, vendor IDs, and hopefully some associated driver-specific data structures or initialization information that the driver needs to work. Understanding this table will tell me precisely which devices this specific Atheros driver supports through the PCI interface. Time to dig in and see what's in there. |
| 8/2 | 2026/09/10 07:57 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/ath/ath11k/pci.c",
"FirstLine": 35,
"LineCount": 20
}Results: {
"Contents": " 35:\t\n 36:\tstatic const struct pci_device_id ath11k_pci_id_table[] = {\n 37:\t\t{ PCI_VDEVICE(QCOM, QCA6390_DEVICE_ID) },\n 38:\t\t{ PCI_VDEVICE(QCOM, WCN6855_DEVICE_ID) },\n 39:\t\t{ PCI_VDEVICE(QCOM, QCN9074_DEVICE_ID) },\n 40:\t\t{}\n 41:\t};\n 42:\t\n 43:\tMODULE_DEVICE_TABLE(pci, ath11k_pci_id_table);\n 44:\t\n 45:\tstatic int ath11k_pci_bus_wake_up(struct ath11k_base *ab)\n 46:\t{\n 47:\t\tstruct ath11k_pci *ab_pci = ath11k_pci_priv(ab);\n 48:\t\n 49:\t\treturn mhi_device_get_sync(ab_pci-\u003emhi_ctrl-\u003emhi_dev);\n 50:\t}\n 51:\t\n 52:\tstatic void ath11k_pci_bus_release(struct ath11k_base *ab)\n 53:\t{\n 54:\t\tstruct ath11k_pci *ab_pci = ath11k_pci_priv(ab);\n"
} |
| 9/2 | 2026/09/10 07:57 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 19373 output: 30 thoughts: 131 Thoughts: **My Assessment of ath11k's Bus Support** Okay, so ath11k, the Qualcomm Wi-Fi driver, has a pretty solid handle on the usual suspects – the PCI and AHB based Qualcomm devices: QCA6390, WCN6855, QCN9074, IPQ8074, IPQ6018, WCN6750, and IPQ5018. But I'm curious, does the driver have any flexibility beyond this? Does it extend to handling virtual or emulated buses, or even USB gadgets? My initial impression is that it primarily deals with these hardware platforms, but I can't be sure without digging deeper. I need to confirm the extent of its supported bus types. To clarify this, I need to check whether it's solely tied to physical PCI and AHB interfaces, or if it offers wider compatibility. The most direct approach is to examine the source code. Let's delve into the `drivers/net/wireless/ath/ath11k` directory, and scrutinize all the files therein. That should give me the best insight into its bus support capabilities. |
| 10/2 | 2026/09/10 07:58 | tool | codesearch-dir-index |
0mArgs:{
"Dir": "drivers/net/wireless/ath/ath11k"
}Results: {
"Files": [
"ahb.c",
"ahb.h",
"ce.c",
"ce.h",
"cfr.c",
"cfr.h",
"core.c",
"core.h",
"coredump.c",
"coredump.h",
"dbring.c",
"dbring.h",
"debug.c",
"debug.h",
"debugfs.c",
"debugfs.h",
"debugfs_htt_stats.c",
"debugfs_htt_stats.h",
"debugfs_sta.c",
"debugfs_sta.h",
"dp.c",
"dp.h",
"dp_rx.c",
"dp_rx.h",
"dp_tx.c",
"dp_tx.h",
"fw.c",
"fw.h",
"hal.c",
"hal.h",
"hal_desc.h",
"hal_rx.c",
"hal_rx.h",
"hal_tx.c",
"hal_tx.h",
"hif.h",
"htc.c",
"htc.h",
"hw.c",
"hw.h",
"mac.c",
"mac.h",
"mhi.c",
"mhi.h",
"p2p.c",
"p2p.h",
"pci.c",
"pci.h",
"pcic.c",
"pcic.h",
"peer.c",
"peer.h",
"qmi.c",
"qmi.h",
"reg.c",
"reg.h",
"rx_desc.h",
"spectral.c",
"spectral.h",
"testmode.c",
"testmode.h",
"thermal.c",
"thermal.h",
"trace.c",
"trace.h",
"wmi.c",
"wmi.h",
"wow.c",
"wow.h"
],
"Subdirs": null
} |
| 11/2 | 2026/09/10 07:58 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 20274 output: 129 thoughts: 470 Thoughts: **Analysis of ath11k Driver Fuzzing Feasibility** Okay, let's break this down. My initial assessment is that fuzzing the `ath11k` driver, specifically the modified code within `ath11k_fw_request_firmware_api_n()`, isn't going to be fruitful in standard fuzzing setups. The driver, as I understand it, primarily deals with Qualcomm 802.11ax hardware – things like the QCA6390, WCN6855, and other silicon-based devices communicating via PCIe or AHB. The key here is the *physical* nature of the hardware. The issue, as I see it, boils down to emulation. Standard QEMU and Google Compute Engine environments simply don't emulate these specific Qualcomm WiFi components. The logic I'm following aligns with the "structurally unreachable hardware" negative criterion. The patch hits the `ath11k_fw_request_firmware_api_n` function in `drivers/net/wireless/ath/ath11k/fw.c` which handles requests to load firmware into the hardware, and the hardware itself isn't present in a standard QEMU environment. Given that the underlying hardware is vendor-specific, requiring physical Qualcomm WiFi silicon connected over the PCIe/AHB bus, and that standard virtualization environments don't provide this, fuzzing the modified code is structurally unreachable. Therefore, `WorthFuzzing` is unequivocally `false`. Consequently, my `FocusSymbols` and `EnableConfigs` are empty as I need to specify what targets the fuzzer can attempt to reach. It’s important to make this decision based on what is practically achievable in standard fuzzing setups. Everything seems to check out. Time to call `set-results`. |
| 12/2 | 2026/09/10 07:58 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies ath11k_fw_request_firmware_api_n in drivers/net/wireless/ath/ath11k/fw.c, which belongs to the Qualcomm 802.11ax (ath11k) wireless driver. This driver requires specific physical Qualcomm PCIe/AHB hardware that is not emulated in standard QEMU/GCE virtualized fuzzing environments, making the modified code structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies ath11k_fw_request_firmware_api_n in drivers/net/wireless/ath/ath11k/fw.c, which belongs to the Qualcomm 802.11ax (ath11k) wireless driver. This driver requires specific physical Qualcomm PCIe/AHB hardware that is not emulated in standard QEMU/GCE virtualized fuzzing environments, making the modified code structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 13/1 | 2026/09/10 07:58 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|